mirror of
https://github.com/cyberark/RPCMon
synced 2026-06-06 15:34:28 +00:00
g3rzi
12555 lines
432 KiB
JSON
12555 lines
432 KiB
JSON
{
|
|
"54f96d15-d9a7-4422-bd32-8b0cebd00400": {
|
|
"Module": "NcaSvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\NcaSvc.dll",
|
|
"InterfaceId": "54f96d15-d9a7-4422-bd32-8b0cebd00400",
|
|
"InterfaceStructOffset": 125648,
|
|
"ProceduresCount": 11,
|
|
"Procedures": [
|
|
"Rpc_NcaEngineOpen",
|
|
"Rpc_NcaEngineClose",
|
|
"Rpc_NcaNetworkOpen",
|
|
"Rpc_NcaNetworkClose",
|
|
"Rpc_NcaStatusEventSubscribe",
|
|
"Rpc_NcaStatusEventSubscriptionGetLastEvent",
|
|
"Rpc_NcaStatusEventUnsubscribe",
|
|
"Rpc_NcaGetConfig",
|
|
"Rpc_NcaToggleNamePreferenceState",
|
|
"Rpc_NcaExecuteAndCaptureLogs",
|
|
"Rpc_NcaGetEvidenceCollectorResult"
|
|
],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140707581182256,
|
|
"Service": "NcaSvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"cb407bbf-c14f-4cd9-8f55-cbb08146598c": {
|
|
"Module": "IMJPDCT.EXE",
|
|
"ModulePath": "C:\\Windows\\System32\\IME\\IMEJP\\IMJPDCT.EXE",
|
|
"InterfaceId": "cb407bbf-c14f-4cd9-8f55-cbb08146598c",
|
|
"InterfaceStructOffset": 269360,
|
|
"ProceduresCount": 2,
|
|
"Procedures": [
|
|
"Rpc_Open",
|
|
"Rpc_GetServerProcessId"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140702047819808,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"847c6e33-7372-4a11-9b86-f5a4af446dd8": {
|
|
"Module": "VoipRT.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\VoipRT.dll",
|
|
"InterfaceId": "847c6e33-7372-4a11-9b86-f5a4af446dd8",
|
|
"InterfaceStructOffset": 112720,
|
|
"ProceduresCount": 7,
|
|
"Procedures": [
|
|
"EndCall",
|
|
"HoldCall",
|
|
"UnholdCall",
|
|
"MuteAllCalls",
|
|
"UnmuteAllCalls",
|
|
"AcceptIncomingCall",
|
|
"RejectIncomingCall"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140707581089376,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"18f70770-8e64-11cf-9af1-0020af6e72f4": {
|
|
"Module": "combase.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\combase.dll",
|
|
"InterfaceId": "18f70770-8e64-11cf-9af1-0020af6e72f4",
|
|
"InterfaceStructOffset": 2274736,
|
|
"ProceduresCount": 5,
|
|
"Procedures": [
|
|
"_UseProtseq",
|
|
"_GetCustomProtseqInfo",
|
|
"_UpdateResolverBindings",
|
|
"_NotifyFDT",
|
|
"_ControlTracing"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140708189286624,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"8c7fbdb0-8513-44f9-a8b1-1a3b49322bf4": {
|
|
"Module": "AppVEntSubsystemController.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\AppVEntSubsystemController.dll",
|
|
"InterfaceId": "8c7fbdb0-8513-44f9-a8b1-1a3b49322bf4",
|
|
"InterfaceStructOffset": 864448,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"vfs_server_GetConfiguration"
|
|
],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140706797870656,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"00000131-0000-0000-c000-000000000046": {
|
|
"Module": "combase.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\combase.dll",
|
|
"InterfaceId": "00000131-0000-0000-c000-000000000046",
|
|
"InterfaceStructOffset": 2274640,
|
|
"ProceduresCount": 0,
|
|
"Procedures": [],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140707382121168,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"7c69ac10-fa12-4dbf-90d9-c7f1e40f5dc5": {
|
|
"Module": "audiosrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\audiosrv.dll",
|
|
"InterfaceId": "7c69ac10-fa12-4dbf-90d9-c7f1e40f5dc5",
|
|
"InterfaceStructOffset": 1381312,
|
|
"ProceduresCount": 52,
|
|
"Procedures": [
|
|
"s_winmmGetPnpInfo",
|
|
"s_mmeNotifyDeviceStateChanged",
|
|
"s_mmeNotifyDeviceAdded",
|
|
"s_mmeNotifyDeviceRemoved",
|
|
"s_mmeNotifyDefaultDeviceChanged",
|
|
"s_tsSessionGetAudioProtocol",
|
|
"s_tsRegisterAudioProtocolNotification",
|
|
"s_tsUnregisterAudioProtocolNotification",
|
|
"s_sndevtResolveSoundAlias",
|
|
"s_pbmRegisterPlaybackManagerNotifications",
|
|
"s_pbmUnregisterPlaybackManagerNotifications",
|
|
"s_pbmSetSmtcSubscriptionState",
|
|
"s_pbmGetSoundLevel",
|
|
"s_ccCreateHandsfreeHidFileFromAudioId",
|
|
"s_pbmRegisterAppClosureNotification",
|
|
"s_pbmUnregisterAppClosureNotification",
|
|
"s_pbmPlayToStreamStateChanged",
|
|
"s_pbmIsPlaying",
|
|
"s_pbmCastingAppStateChanged",
|
|
"s_pbmVoipCallStateChanged",
|
|
"s_pbmLaunchBackgroundTask",
|
|
"s_pbmRegisterAsBackgroundTask",
|
|
"s_afxOpenAudioEffectsWatcher",
|
|
"s_afxCloseAudioEffectsWatcher",
|
|
"s_midiOpenPort",
|
|
"s_rtgGetDefaultAudioEndpoint",
|
|
"s_apmRegisterProxyAudioProcess",
|
|
"s_apmSetDuckingGainForId",
|
|
"s_apmSetLayoutGainForId",
|
|
"s_apmSetVolumeGroupGainForId",
|
|
"s_apmSetVolumeGroupGainScalarForId",
|
|
"s_apmSetVolumeGroupMuteForId",
|
|
"s_setRingerVibrateState",
|
|
"s_getRingerVibrateState",
|
|
"s_getEmergencyCallbackMode",
|
|
"s_setEmergencyCallbackMode",
|
|
"s_apmSetPersistedDefaultAudioEndpoint",
|
|
"s_apmGetPersistedDefaultAudioEndpoint",
|
|
"s_apmClearAllPersistedApplicationDefaultEndpoints",
|
|
"s_apmRegisterAudioStateMonitor",
|
|
"s_apmUnregisterAudioStateMonitor",
|
|
"s_apmHandleEuVolumeNotificationResponse",
|
|
"AudioServerTelephonyControlGetCallStateSync",
|
|
"AudioServerTelephonyControlGetMuteSync",
|
|
"s_StartPersonalAssistantDialogSession",
|
|
"s_StopPersonalAssistantDialogSession",
|
|
"s_apmSetBalanceGroupBalanceForId",
|
|
"s_apmSetPreferredChatApplication",
|
|
"s_apmResetPreferredChatApplication",
|
|
"s_CreateHolographicDisplay",
|
|
"s_DestroyHolographicDisplay",
|
|
"s_GetHeadRotation"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140708026792256,
|
|
"Service": "Audiosrv",
|
|
"IsServiceRunning": true
|
|
},
|
|
"76f226c3-ec14-4325-8a99-6a46348418ae": {
|
|
"Module": "wininit.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\wininit.exe",
|
|
"InterfaceId": "76f226c3-ec14-4325-8a99-6a46348418ae",
|
|
"InterfaceStructOffset": 296208,
|
|
"ProceduresCount": 2,
|
|
"Procedures": [
|
|
"I_WMsgkSendMessage",
|
|
"I_WMsgkSendPSPMessage"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140699626518608,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"7f89f606-468e-4ee4-b1f3-73b68767b0e1": {
|
|
"Module": "AppVShNotify.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\AppVShNotify.exe",
|
|
"InterfaceId": "7f89f606-468e-4ee4-b1f3-73b68767b0e1",
|
|
"InterfaceStructOffset": 103200,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"s_IShellExtensionNotify_ShellNotify"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140702910021472,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"ff00653f-064a-49ca-9783-0e33730d7d71": {
|
|
"Module": "ipxlatcfg.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\ipxlatcfg.dll",
|
|
"InterfaceId": "ff00653f-064a-49ca-9783-0e33730d7d71",
|
|
"InterfaceStructOffset": 41456,
|
|
"ProceduresCount": 2,
|
|
"Procedures": [
|
|
"Enable464xlat",
|
|
"Disable464xlat"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140707880071568,
|
|
"Service": "IpxlatCfgSvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"b50f395f-b08b-495a-b2d3-b8201e1f2388": {
|
|
"Module": "uireng.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\uireng.dll",
|
|
"InterfaceId": "b50f395f-b08b-495a-b2d3-b8201e1f2388",
|
|
"InterfaceStructOffset": 156416,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"GetData"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140707581061632,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"afa8bd80-7d8a-11c9-bef4-08002b102989": {
|
|
"Module": "rpcrt4.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\rpcrt4.dll",
|
|
"InterfaceId": "afa8bd80-7d8a-11c9-bef4-08002b102989",
|
|
"InterfaceStructOffset": 916704,
|
|
"ProceduresCount": 5,
|
|
"Procedures": [
|
|
"rpc_mgmt_inq_if_ids",
|
|
"rpc_mgmt_inq_stats",
|
|
"rpc_mgmt_is_server_listening",
|
|
"rpc_mgmt_stop_server_listening",
|
|
"rpc_mgmt_inq_princ_name"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140708203084256,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"11899a43-2b68-4a76-92e3-a3d6ad8c26ce": {
|
|
"Module": "lsm.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\lsm.dll",
|
|
"InterfaceId": "11899a43-2b68-4a76-92e3-a3d6ad8c26ce",
|
|
"InterfaceStructOffset": 479888,
|
|
"ProceduresCount": 4,
|
|
"Procedures": [
|
|
"RpcWaitForSessionState",
|
|
"RpcRegisterAsyncNotification",
|
|
"RpcWaitAsyncNotification",
|
|
"RpcUnRegisterAsyncNotification"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140708131490608,
|
|
"Service": "LSM",
|
|
"IsServiceRunning": true
|
|
},
|
|
"3a7e8d55-62d7-4626-8af6-c19598881347": {
|
|
"Module": "CCG.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\CCG.exe",
|
|
"InterfaceId": "3a7e8d55-62d7-4626-8af6-c19598881347",
|
|
"InterfaceStructOffset": 92896,
|
|
"ProceduresCount": 4,
|
|
"Procedures": [
|
|
"CredFetchGetContext",
|
|
"CredFetchGetDomainJoinConfig",
|
|
"CredFetchAddAccount",
|
|
"CredFetchGetPasswordInfo"
|
|
],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140699048540048,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"c2d15ccf-a416-46dc-ba58-4624ac7a9123": {
|
|
"Module": "lsm.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\lsm.dll",
|
|
"InterfaceId": "c2d15ccf-a416-46dc-ba58-4624ac7a9123",
|
|
"InterfaceStructOffset": 479792,
|
|
"ProceduresCount": 3,
|
|
"Procedures": [
|
|
"RpcRegisterCurrentSessionAsyncNotification",
|
|
"RpcWaitAsyncNotificationEx",
|
|
"RpcUnRegisterAsyncNotificationEx"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140708131561136,
|
|
"Service": "LSM",
|
|
"IsServiceRunning": true
|
|
},
|
|
"f02facbc-a48b-4de1-98ec-70025bd9b48e": {
|
|
"Module": "BioIso.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\BioIso.exe",
|
|
"InterfaceId": "f02facbc-a48b-4de1-98ec-70025bd9b48e",
|
|
"InterfaceStructOffset": 632624,
|
|
"ProceduresCount": 96,
|
|
"Procedures": [
|
|
"BioIsoSrvCreateSecureBiometricUnit",
|
|
"BioIsoSrvSetBiometricUnitPolicy",
|
|
"BioIsoSrvCloseSecureBiometricUnit",
|
|
"BioIsoSrvSensorAttach",
|
|
"BioIsoSrvSensorDetach",
|
|
"BioIsoSrvSensorClearContext",
|
|
"BioIsoSrvSensorAsyncRawBufferClear",
|
|
"BioIsoSrvSensorAsyncRawBufferImportBegin",
|
|
"BioIsoSrvSensorAsyncRawBufferImportNext",
|
|
"BioIsoSrvSensorAsyncRawBufferImportEnd",
|
|
"BioIsoSrvSensorAsyncImportSecureBuffer",
|
|
"BioIsoSrvSensorPushDataToEngine",
|
|
"BioIsoSrvSensorNotifyPowerChange",
|
|
"BioIsoSrvSensorPipelineInit",
|
|
"BioIsoSrvSensorPipelineCleanup",
|
|
"BioIsoSrvSensorActivate",
|
|
"BioIsoSrvSensorDeactivate",
|
|
"BioIsoSrvEngineAttach",
|
|
"BioIsoSrvEngineDetach",
|
|
"BioIsoSrvEngineClearContext",
|
|
"BioIsoSrvEngineQueryPreferredFormat",
|
|
"BioIsoSrvEngineQueryIndexVectorSize",
|
|
"BioIsoSrvEngineQuerySampleHint",
|
|
"BioIsoSrvEngineSampleClear",
|
|
"BioIsoSrvEngineSampleImportBegin",
|
|
"BioIsoSrvEngineSampleImportNext",
|
|
"BioIsoSrvEngineSampleImportEnd",
|
|
"BioIsoSrvEngineAcceptSampleData",
|
|
"BioIsoSrvEngineCreateEnrollment",
|
|
"BioIsoSrvEngineUpdateEnrollment",
|
|
"BioIsoSrvEngineGetEnrollmentStatus",
|
|
"BioIsoSrvEngineGetEnrollmentHash",
|
|
"BioIsoSrvEngineCheckForDuplicate",
|
|
"BioIsoSrvEngineCommitEnrollment",
|
|
"BioIsoSrvEngineDiscardEnrollment",
|
|
"BioIsoSrvEngineNotifyPowerChange",
|
|
"BioIsoSrvEnginePipelineInit",
|
|
"BioIsoSrvEnginePipelineCleanup",
|
|
"BioIsoSrvEngineActivate",
|
|
"BioIsoSrvEngineDeactivate",
|
|
"BioIsoSrvEngineQueryExtendedInfo",
|
|
"BioIsoSrvEngineSetEnrollmentSelector",
|
|
"BioIsoSrvEngineSetEnrollmentParameters",
|
|
"BioIsoSrvEngineQueryExtendedEnrollmentStatus",
|
|
"BioIsoSrvEngineRefreshCache",
|
|
"BioIsoSrvEngineSelectCalibrationFormat",
|
|
"BioIsoSrvEngineQueryCalibrationData",
|
|
"BioIsoSrvEngineSetAccountPolicy",
|
|
"BioIsoSrvEngineIdentifyFeatureSetSecure",
|
|
"BioIsoSrvEngineAcceptPrivateSensorTypeInfo",
|
|
"BioIsoSrvStorageAttach",
|
|
"BioIsoSrvStorageDetach",
|
|
"BioIsoSrvStorageClearContext",
|
|
"BioIsoSrvStorageCreateDatabase",
|
|
"BioIsoSrvStorageOpenDatabase",
|
|
"BioIsoSrvStorageCloseDatabase",
|
|
"BioIsoSrvStorageDeleteRecord",
|
|
"BioIsoSrvStorageNotifyPowerChange",
|
|
"BioIsoSrvStoragePipelineInit",
|
|
"BioIsoSrvStoragePipelineCleanup",
|
|
"BioIsoSrvStorageActivate",
|
|
"BioIsoSrvStorageDeactivate",
|
|
"BioIsoSrvStorageQueryExtendedInfo",
|
|
"BioIsoSrvStorageCacheClear",
|
|
"BioIsoSrvStorageCacheImportBegin",
|
|
"BioIsoSrvStorageCacheImportNext",
|
|
"BioIsoSrvStorageCacheImportEnd",
|
|
"BioIsoSrvStorageCacheExportBegin",
|
|
"BioIsoSrvStorageCacheExportNext",
|
|
"BioIsoSrvStorageCacheExportEnd",
|
|
"BioIsoSrvStorageManagerImportBegin",
|
|
"BioIsoSrvStorageManagerImportNext",
|
|
"BioIsoSrvStorageManagerImportEnd",
|
|
"BioIsoSrvStorageManagerExportBegin",
|
|
"BioIsoSrvStorageManagerExportNext",
|
|
"BioIsoSrvStorageManagerExportEnd",
|
|
"BioIsoSrvPresenceMonitorUpdate",
|
|
"BioIsoSrvPresenceMonitorGetChanges",
|
|
"BioIsoSrvPresenceMonitorClearCache",
|
|
"BioIsoSrvPresenceMonitorEnumAll",
|
|
"BioIsoSrvPresenceMonitorSetLifetimeInSeconds",
|
|
"BioIsoSrvOpenEnrollAuthorizationSession",
|
|
"BioIsoSrvAuthorizeEnrollment",
|
|
"BioIsoSrvCloseEnrollAuthorizationSession",
|
|
"BioIsoSrvQueryAuthorizedEnrollments",
|
|
"BioIsoSrvDeleteAuthorizedEnrollments",
|
|
"BioIsoSrvAuthorizeKeyRelease",
|
|
"BioIsoSrvCloseKeyAuthorizationSession",
|
|
"BioIsoSrvGetSecureConnectionParams",
|
|
"BioIsoSrvConnectSecure",
|
|
"BioIsoSrvAuthenticateEnrollmentIdentity",
|
|
"BioIsoSrvGetIdentificationNonce",
|
|
"BioIsoSrvAuthenticateIdentification",
|
|
"BioIsoSrvIsIdle",
|
|
"BioIsoSrvPingTrustlet",
|
|
"BioIsoSrvStopServer"
|
|
],
|
|
"ProcStackSize": 8,
|
|
"DispatchFunction": 140701342552624,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"cad784cb-4c1b-4d96-b8f7-4716b568b13c": {
|
|
"Module": "wininet.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\wininet.dll",
|
|
"InterfaceId": "cad784cb-4c1b-4d96-b8f7-4716b568b13c",
|
|
"InterfaceStructOffset": 2033776,
|
|
"ProceduresCount": 83,
|
|
"Procedures": [
|
|
"s_UrlCacheGetManagerInterface",
|
|
"CancelAll",
|
|
"s_UrlCacheOpenContainer",
|
|
"s_UrlCacheCloseContainer",
|
|
"s_UrlCacheSetContainerEntryMaximumAge",
|
|
"s_UrlCacheAddUrl",
|
|
"s_UrlCacheLookupUrl",
|
|
"s_UrlCacheCheckUrlsExist",
|
|
"s_UrlCacheGetUrlBinaryBlob",
|
|
"s_UrlCacheAddUrlBinaryBlob",
|
|
"s_UrlCacheDeleteUrl",
|
|
"s_UrlCacheUnlockUrl",
|
|
"s_UrlCacheUpdateUrl",
|
|
"s_UrlCacheEntryEnum",
|
|
"s_UrlCacheEntryEnumClose",
|
|
"s_UrlCacheEntryEnumNext",
|
|
"s_UrlCacheCleanupUrls",
|
|
"s_UrlCacheCleanupHttpsUrls",
|
|
"s_UrlCacheGetSize",
|
|
"s_UrlCacheGetLimit",
|
|
"s_UrlCacheSetLimit",
|
|
"s_UrlCacheGetCrossContainerContentTotalSizeAndLimit",
|
|
"s_UrlCacheCleanupCrossContainers",
|
|
"s_UrlCacheGetBloomFilter",
|
|
"s_UrlCacheReleaseBloomFilter",
|
|
"s_UrlCacheGetNextDirectory",
|
|
"s_UrlCacheAddLeakFile",
|
|
"s_UrlCacheCreateGroup",
|
|
"s_UrlCacheDeleteGroup",
|
|
"s_UrlCacheGetGroupIds",
|
|
"s_UrlCacheGetGroup",
|
|
"s_UrlCacheUpdateGroup",
|
|
"s_UrlCacheSetUrlGroup",
|
|
"s_UrlCacheGetContentContainerDirectories",
|
|
"s_UrlCacheCreateExtensibleContainer",
|
|
"s_UrlCacheDeleteExtensibleContainer",
|
|
"s_UrlCacheGetExtensibleContainersList",
|
|
"s_UrlCacheRpcSetGlobalLimit",
|
|
"s_UrlCacheRpcGetGlobalLimit",
|
|
"s_UrlCacheRpcReloadSettings",
|
|
"s_UrlCacheGetGlobalCounters",
|
|
"s_AppCacheOpenContainer",
|
|
"s_AppCacheCloseContainer",
|
|
"s_AppCacheRpcCheckManifest",
|
|
"s_AppCacheRpcLookup",
|
|
"s_AppCacheRpcDeleteGroup",
|
|
"s_AppCacheRpcDeleteIeGroup",
|
|
"s_AppCacheRpcGetFallbackUrl",
|
|
"s_AppCacheRpcGetDownloadList",
|
|
"s_AppCacheRpcCloseHandle",
|
|
"s_AppCacheRpcInvalidate",
|
|
"s_AppCacheRpcGetInfo",
|
|
"s_AppCacheRpcGetGroupsList",
|
|
"s_AppCacheRpcFreeSpace",
|
|
"s_AppCacheRpcGetIeGroupList",
|
|
"s_AppCacheRpcFreeIeSpace",
|
|
"s_AppCacheRpcRetrieveUrl",
|
|
"s_AppCacheRpcCommitUrl",
|
|
"s_AppCacheRpcUpdateExtraData",
|
|
"s_AppCacheRpcFinalize",
|
|
"s_DependencyStoreOpenContainer",
|
|
"s_DependencyStoreCloseContainer",
|
|
"s_DependencyStoreUpdateUrl",
|
|
"s_DependencyStoreRetrieveUrl",
|
|
"s_DependencyStoreDeleteContainer",
|
|
"s_HstsOpenContainer",
|
|
"s_HstsCloseContainer",
|
|
"s_HstsGetHstsEntries",
|
|
"s_HstsSetHstsEntries",
|
|
"s_HstsPurgeContainer",
|
|
"s_CookieOpenContainer",
|
|
"s_CookieCloseContainer",
|
|
"s_CookieGetCookies",
|
|
"s_CookieGetAllCookies",
|
|
"s_CookieUpdateCookies",
|
|
"s_CookiePurgeContainer",
|
|
"s_BlobOpenContainer",
|
|
"s_BlobCloseContainer",
|
|
"s_BlobGetEntries",
|
|
"s_BlobGetEntry",
|
|
"s_BlobSetEntry",
|
|
"s_BlobDeleteEntry",
|
|
"s_BlobPurgeContainer"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140707608812464,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"8bef2320-f308-4720-b913-0129cecfa6b9": {
|
|
"Module": "NgcCtnrSvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\NgcCtnrSvc.dll",
|
|
"InterfaceId": "8bef2320-f308-4720-b913-0129cecfa6b9",
|
|
"InterfaceStructOffset": 551296,
|
|
"ProceduresCount": 3,
|
|
"Procedures": [
|
|
"s_RpcCreateVsc",
|
|
"s_RpcCreateVsc",
|
|
"s_RpcVscCreated"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140707094013104,
|
|
"Service": "NgcCtnrSvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"857fb1be-084f-4fb5-b59c-4b2c4be5f0cf": {
|
|
"Module": "bisrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\bisrv.dll",
|
|
"InterfaceId": "857fb1be-084f-4fb5-b59c-4b2c4be5f0cf",
|
|
"InterfaceStructOffset": 551968,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"SrvOdbPrivGetLaunchInfo"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140708130747456,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"7e048d38-ac08-4ff1-8e6b-f35dbab88d4a": {
|
|
"Module": "mqqm.dll",
|
|
"ModulePath": "C:\\Windows\\WinSxS\\amd64_microsoft-windows-msmq-queuemanager-core_31bf3856ad364e35_10.0.18362.1977_none_8d1646dec2a87b94\\mqqm.dll",
|
|
"InterfaceId": "7e048d38-ac08-4ff1-8e6b-f35dbab88d4a",
|
|
"InterfaceStructOffset": 1028672,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"R_NotifyQM"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140707093296656,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"9cbc9d3a-7586-4814-8d70-18737dcbe523": {
|
|
"Module": "ngcsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\ngcsvc.dll",
|
|
"InterfaceId": "9cbc9d3a-7586-4814-8d70-18737dcbe523",
|
|
"InterfaceStructOffset": 629936,
|
|
"ProceduresCount": 6,
|
|
"Procedures": [
|
|
"s_NgcLocalAccountVaultAddCredential",
|
|
"s_NgcLocalAccountVaultRemoveCredential",
|
|
"s_NgcLocalAccountVaultGetCredential",
|
|
"s_NgcLocalAccountVaultGetDefaultUserCredential",
|
|
"s_NgcLocalAccountVaultFindCredential",
|
|
"s_NgcLocalAccountVaultProtectCredential"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140707093973408,
|
|
"Service": "NgcSvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"1832bcf6-cab8-41d4-85d2-c9410764f75a": {
|
|
"Module": "PsmServiceExtHost.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\PsmServiceExtHost.dll",
|
|
"InterfaceId": "1832bcf6-cab8-41d4-85d2-c9410764f75a",
|
|
"InterfaceStructOffset": 560000,
|
|
"ProceduresCount": 9,
|
|
"Procedures": [
|
|
"RmCoreRpcSrvConnectToRmServer",
|
|
"RmCoreRpcSrvDisconnectFromRmServer",
|
|
"RmCoreRpcSrvRegisterActivityHostCallbacks",
|
|
"RmCoreRpcSrvUnregisterActivityHostCallbacks",
|
|
"RmCoreRpcSrvAcquireResourceSet",
|
|
"RmCoreRpcSrvApplyResourceSet",
|
|
"RmCoreRpcSrvReleaseResourceSet",
|
|
"CrmRpcSrvActivityRenew",
|
|
"RmCoreRpcSrvQueryHostMemoryLimitValues"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140708133698384,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"3f31c91e-2545-4b7b-9311-9529e8bffef6": {
|
|
"Module": "p2psvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\p2psvc.dll",
|
|
"InterfaceId": "3f31c91e-2545-4b7b-9311-9529e8bffef6",
|
|
"InterfaceStructOffset": 364016,
|
|
"ProceduresCount": 39,
|
|
"Procedures": [
|
|
"PeerGroupCreateRpc",
|
|
"PeerGroupOpenRpc",
|
|
"PeerGroupJoinRpc",
|
|
"PeerGroupPasswordJoinRpc",
|
|
"PeerGroupConnectRpc",
|
|
"PeerGroupCloseRpc",
|
|
"PeerGroupDeleteRpc",
|
|
"PeerGroupCreateInvitationRpc",
|
|
"PeerGroupCreatePasswordInvitationRpc",
|
|
"PeerGroupGetStatusRpc",
|
|
"PeerGroupGetPropertiesRpc",
|
|
"PeerGroupSetPropertiesRpc",
|
|
"PeerGroupEnumConnectionsRpc",
|
|
"PeerGroupEnumMembersRpc",
|
|
"PeerGroupOpenDirectConnectionRpc",
|
|
"PeerGroupCloseDirectConnectionRpc",
|
|
"PeerGroupSendDataRpc",
|
|
"PeerGroupRegisterEventRpc",
|
|
"PeerGroupUnregisterEventRpc",
|
|
"PeerGroupGetEventDataRpc",
|
|
"PeerGroupGetRecordRpc",
|
|
"PeerGroupAddRecordRpc",
|
|
"PeerGroupUpdateRecordRpc",
|
|
"PeerGroupDeleteRecordRpc",
|
|
"PeerGroupEnumRecordsRpc",
|
|
"PeerGroupSearchRecordsRpc",
|
|
"PeerGroupExportDatabaseRpc",
|
|
"PeerGroupImportDatabaseRpc",
|
|
"PeerGroupUniversalTimeToPeerTimeRpc",
|
|
"PeerGroupPeerTimeToUniversalTimeRpc",
|
|
"PeerGetItemCountRpc",
|
|
"PeerGetNextMemberInfoItemRpc",
|
|
"PeerGetNextConnectionInfoItemRpc",
|
|
"PeerGetNextRecordItemRpc",
|
|
"PeerEndEnumerationRpc",
|
|
"PeerGroupIssueCredentialsRpc",
|
|
"PeerGroupConnectByAddressRpc",
|
|
"PeerGroupResumePasswordAuthenticationRpc",
|
|
"PeerGroupHandlePowerEventRpc"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140707580884080,
|
|
"Service": "p2psvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"7642249b-84c2-4404-b6eb-1e0a2458839a": {
|
|
"Module": "NgcCtnrSvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\NgcCtnrSvc.dll",
|
|
"InterfaceId": "7642249b-84c2-4404-b6eb-1e0a2458839a",
|
|
"InterfaceStructOffset": 544224,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"s_NgcSecureBioHandlerRpcGetAuthorizationNonce"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140707093991616,
|
|
"Service": "NgcCtnrSvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"a2484e1a-a313-4ea2-8fe9-8a873ea275ba": {
|
|
"Module": "witnesswmiv2provider.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\witnesswmiv2provider.dll",
|
|
"InterfaceId": "a2484e1a-a313-4ea2-8fe9-8a873ea275ba",
|
|
"InterfaceStructOffset": 26592,
|
|
"ProceduresCount": 4,
|
|
"Procedures": [
|
|
"SERVER_WitnessrMoveClientRequest",
|
|
"SERVER_WitnessrGetWmiObjects",
|
|
"SERVER_WitnessrGetSvcVersion",
|
|
"SERVER_WitnessrMoveClientRequestEx"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140708037793552,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"b4cb7611-ad0b-4c2d-b35f-ffe45785c709": {
|
|
"Module": "wwansvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\wwansvc.dll",
|
|
"InterfaceId": "b4cb7611-ad0b-4c2d-b35f-ffe45785c709",
|
|
"InterfaceStructOffset": 1117296,
|
|
"ProceduresCount": 46,
|
|
"Procedures": [
|
|
"WwanRpcOpenHandle",
|
|
"WwanRpcCloseHandle",
|
|
"WwanRpcRegisterNotification",
|
|
"WwanRpcAsyncGetNotification",
|
|
"WwanRpcEnumerateInterfaces",
|
|
"WwanRpcSetInterface",
|
|
"WwanRpcQueryInterface",
|
|
"WwanRpcScan",
|
|
"WwanRpcRegister",
|
|
"WwanRpcConnect",
|
|
"WwanRpcConnectAdditionalPdpContext",
|
|
"WwanRpcDisconnect",
|
|
"WwanRpcSetSmsConfiguration",
|
|
"WwanRpcSmsRead",
|
|
"WwanRpcSmsSend",
|
|
"WwanRpcSmsDelete",
|
|
"WwanRpcSetProfile",
|
|
"WwanRpcDeleteProfile",
|
|
"WwanRpcGetProfile",
|
|
"WwanRpcGetProfileList",
|
|
"WwanRpcGetProfileListByPurpose",
|
|
"WwanRpcGetProfileIstream",
|
|
"WwanRpcGetProfileMetaData",
|
|
"WwanRpcSetProfileMetaData",
|
|
"WwanRpcAuthChallenge",
|
|
"WwanRpcGetProfileIndex",
|
|
"WwanRpcUssdRequest",
|
|
"WwanRpcGetProfileHomeProviderName",
|
|
"WwanRpcSearchProfile",
|
|
"WwanRpcGetProfileState",
|
|
"WwanRpcGetDMConfigProfileList",
|
|
"WwanRpcGetDMConfigProfile",
|
|
"WwanRpcSetDMConfigProfile",
|
|
"WwanRpcDeleteDMConfigProfile",
|
|
"WwanRpcGetDMConfigBinary",
|
|
"WwanRpcSetDMConfigBinary",
|
|
"WwanRpcSetNetworkQuietMode",
|
|
"WwanRpcQueryInterfaceEx",
|
|
"WwanRpcIPv6eHRPDControlSet",
|
|
"WwanRpcIPv6eHRPDControlQuery",
|
|
"WwanRpcUiccOpenChannel",
|
|
"WwanRpcUiccCloseChannel",
|
|
"WwanRpcUiccSendApdu",
|
|
"WwanRpcUiccSetTerminalCapability",
|
|
"WwanRpcActivateNotification",
|
|
"WwanRpcModemLogging"
|
|
],
|
|
"ProcStackSize": 64,
|
|
"DispatchFunction": 140707093454224,
|
|
"Service": "WwanSvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"ea0a3165-4834-11d2-a6f8-00c04fa346cc": {
|
|
"Module": "FXSSVC.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\FXSSVC.exe",
|
|
"InterfaceId": "ea0a3165-4834-11d2-a6f8-00c04fa346cc",
|
|
"InterfaceStructOffset": 518000,
|
|
"ProceduresCount": 105,
|
|
"Procedures": [
|
|
"FAX_GetServicePrinters",
|
|
"FAX_ConnectionRefCount",
|
|
"FAX_OpenPort",
|
|
"FAX_ClosePort",
|
|
"FAX_EnumJobs",
|
|
"FAX_GetJob",
|
|
"FAX_SetJob",
|
|
"FAX_GetPageData",
|
|
"FAX_GetDeviceStatus",
|
|
"FAX_Abort",
|
|
"FAX_EnumPorts",
|
|
"FAX_GetPort",
|
|
"FAX_SetPort",
|
|
"FAX_EnumRoutingMethods",
|
|
"FAX_EnableRoutingMethod",
|
|
"FAX_GetRoutingInfo",
|
|
"FAX_SetRoutingInfo",
|
|
"FAX_EnumGlobalRoutingInfo",
|
|
"FAX_SetGlobalRoutingInfo",
|
|
"FAX_GetConfiguration",
|
|
"FAX_SetConfiguration",
|
|
"FAX_GetLoggingCategories",
|
|
"FAX_SetLoggingCategories",
|
|
"FAX_GetSecurity",
|
|
"FAX_SetSecurity",
|
|
"FAX_AccessCheck",
|
|
"FAX_CheckServerProtSeq",
|
|
"FAX_SendDocumentEx",
|
|
"FAX_EnumJobsEx",
|
|
"FAX_GetJobEx",
|
|
"FAX_GetCountryList",
|
|
"FAX_GetPersonalProfileInfo",
|
|
"FAX_GetQueueStates",
|
|
"FAX_SetQueue",
|
|
"FAX_GetReceiptsConfiguration",
|
|
"FAX_SetReceiptsConfiguration",
|
|
"FAX_GetReceiptsOptions",
|
|
"FAX_GetVersion",
|
|
"FAX_GetOutboxConfiguration",
|
|
"FAX_SetOutboxConfiguration",
|
|
"FAX_GetPersonalCoverPagesOption",
|
|
"FAX_GetArchiveConfiguration",
|
|
"FAX_SetArchiveConfiguration",
|
|
"FAX_GetActivityLoggingConfiguration",
|
|
"FAX_SetActivityLoggingConfiguration",
|
|
"FAX_EnumerateProviders",
|
|
"FAX_GetPortEx",
|
|
"FAX_SetPortEx",
|
|
"FAX_EnumPortsEx",
|
|
"FAX_GetExtensionData",
|
|
"FAX_SetExtensionData",
|
|
"FAX_AddOutboundGroup",
|
|
"FAX_SetOutboundGroup",
|
|
"FAX_RemoveOutboundGroup",
|
|
"FAX_EnumOutboundGroups",
|
|
"FAX_SetDeviceOrderInGroup",
|
|
"FAX_AddOutboundRule",
|
|
"FAX_RemoveOutboundRule",
|
|
"FAX_SetOutboundRule",
|
|
"FAX_EnumOutboundRules",
|
|
"FAX_RegisterServiceProviderEx",
|
|
"FAX_UnregisterServiceProviderEx",
|
|
"FAX_UnregisterRoutingExtension",
|
|
"FAX_StartMessagesEnum",
|
|
"FAX_EndMessagesEnum",
|
|
"FAX_EnumMessages",
|
|
"FAX_GetMessage",
|
|
"FAX_RemoveMessage",
|
|
"FAX_StartCopyToServer",
|
|
"FAX_StartCopyMessageFromServer",
|
|
"FAX_WriteFile",
|
|
"FAX_ReadFile",
|
|
"FAX_EndCopy",
|
|
"FAX_StartServerNotification",
|
|
"FAX_StartServerNotificationEx",
|
|
"FAX_EndServerNotification",
|
|
"FAX_GetServerActivity",
|
|
"FAX_SetConfigWizardUsed",
|
|
"FAX_EnumRoutingExtensions",
|
|
"FAX_AnswerCall",
|
|
"FAX_ConnectFaxServer",
|
|
"FAX_GetSecurityEx",
|
|
"FAX_RefreshArchive",
|
|
"FAX_SetRecipientsLimit",
|
|
"FAX_GetRecipientsLimit",
|
|
"FAX_GetServerSKU",
|
|
"FAX_CheckValidFaxFolder",
|
|
"FAX_GetJobEx2",
|
|
"FAX_EnumJobsEx2",
|
|
"FAX_GetMessageEx",
|
|
"FAX_StartMessagesEnumEx",
|
|
"FAX_EnumMessagesEx",
|
|
"FAX_StartServerNotificationEx2",
|
|
"FAX_CreateAccount",
|
|
"FAX_DeleteAccount",
|
|
"FAX_EnumAccounts",
|
|
"FAX_GetAccountInfo",
|
|
"FAX_GetGeneralConfiguration",
|
|
"FAX_SetGeneralConfiguration",
|
|
"FAX_GetSecurityEx2",
|
|
"FAX_SetSecurityEx2",
|
|
"FAX_AccessCheckEx2",
|
|
"FAX_ReAssignMessage",
|
|
"FAX_SetMessage",
|
|
"FAX_GetConfigOption"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140702770662416,
|
|
"Service": "Fax",
|
|
"IsServiceRunning": false
|
|
},
|
|
"fd7a0523-dc70-43dd-9b2e-9c5ed48225b1": {
|
|
"Module": "appinfo.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\appinfo.dll",
|
|
"InterfaceId": "fd7a0523-dc70-43dd-9b2e-9c5ed48225b1",
|
|
"InterfaceStructOffset": 106688,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"RAiGetTokenForMSI"
|
|
],
|
|
"ProcStackSize": 152,
|
|
"DispatchFunction": 140707486598720,
|
|
"Service": "Appinfo",
|
|
"IsServiceRunning": true
|
|
},
|
|
"bdaa0970-413b-4a3e-9e5d-f6dc9d7e0760": {
|
|
"Module": "psmsrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\psmsrv.dll",
|
|
"InterfaceId": "bdaa0970-413b-4a3e-9e5d-f6dc9d7e0760",
|
|
"InterfaceStructOffset": 168672,
|
|
"ProceduresCount": 5,
|
|
"Procedures": [
|
|
"PsmSrvOpenTcChannel",
|
|
"PsmSrvApplyTaskCompletion",
|
|
"PsmSrvRegisterDynamicProcess",
|
|
"PsmSrvCloseActivationChannel",
|
|
"PsmSrvGetSessionInfo"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140708134210256,
|
|
"Service": "BrokerInfrastructure",
|
|
"IsServiceRunning": true
|
|
},
|
|
"4943e10d-2d9c-4f31-a31b-212c9f1dca8b": {
|
|
"Module": "rpcss.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\rpcss.dll",
|
|
"InterfaceId": "4943e10d-2d9c-4f31-a31b-212c9f1dca8b",
|
|
"InterfaceStructOffset": 978608,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"ExpireRemoteResources"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140708135228400,
|
|
"Service": "RpcSs",
|
|
"IsServiceRunning": true
|
|
},
|
|
"53825514-1183-4934-a0f4-cfdc51c3389b": {
|
|
"Module": "lsm.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\lsm.dll",
|
|
"InterfaceId": "53825514-1183-4934-a0f4-cfdc51c3389b",
|
|
"InterfaceStructOffset": 479984,
|
|
"ProceduresCount": 5,
|
|
"Procedures": [
|
|
"RpcIsCurrentSessionTerminalRemote",
|
|
"RpcGetCurrentSessionTerminalName",
|
|
"RpcGetCurrentSessionInformation",
|
|
"RpcGetCurrentSessionCapabilities",
|
|
"RpcGetCurrentSessionType"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140708131516656,
|
|
"Service": "LSM",
|
|
"IsServiceRunning": true
|
|
},
|
|
"ecbdb051-f208-46b9-8c8b-648d9d3f3944": {
|
|
"Module": "iphlpsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\iphlpsvc.dll",
|
|
"InterfaceId": "ecbdb051-f208-46b9-8c8b-648d9d3f3944",
|
|
"InterfaceStructOffset": 483776,
|
|
"ProceduresCount": 2,
|
|
"Procedures": [
|
|
"RefreshTeredoState",
|
|
"ResetDisabledComponentsForTeredo"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140707888009952,
|
|
"Service": "iphlpsvc",
|
|
"IsServiceRunning": true
|
|
},
|
|
"367abb81-9844-35f1-ad32-98f038001003": {
|
|
"Module": "services.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\services.exe",
|
|
"InterfaceId": "367abb81-9844-35f1-ad32-98f038001003",
|
|
"InterfaceStructOffset": 501200,
|
|
"ProceduresCount": 65,
|
|
"Procedures": [
|
|
"RCloseServiceHandle",
|
|
"RControlService",
|
|
"RDeleteService",
|
|
"RLockServiceDatabase",
|
|
"RQueryServiceObjectSecurity",
|
|
"RSetServiceObjectSecurity",
|
|
"RQueryServiceStatus",
|
|
"RSetServiceStatus",
|
|
"RUnlockServiceDatabase",
|
|
"RNotifyBootConfigStatus",
|
|
"RI_ScSetServiceBitsW",
|
|
"RChangeServiceConfigW",
|
|
"RCreateServiceW",
|
|
"REnumDependentServicesW",
|
|
"REnumServicesStatusW",
|
|
"ROpenSCManagerW",
|
|
"ROpenServiceW",
|
|
"RQueryServiceConfigW",
|
|
"RQueryServiceLockStatusW",
|
|
"RStartServiceW",
|
|
"RGetServiceDisplayNameW",
|
|
"RGetServiceKeyNameW",
|
|
"GetStatusInternal",
|
|
"RChangeServiceConfigA",
|
|
"RCreateServiceA",
|
|
"REnumDependentServicesA",
|
|
"REnumServicesStatusA",
|
|
"ROpenSCManagerA",
|
|
"ROpenServiceA",
|
|
"RQueryServiceConfigA",
|
|
"RQueryServiceLockStatusA",
|
|
"RStartServiceA",
|
|
"RGetServiceDisplayNameA",
|
|
"RGetServiceKeyNameA",
|
|
"GetStatusInternal",
|
|
"REnumServiceGroupW",
|
|
"RChangeServiceConfig2A",
|
|
"RChangeServiceConfig2W",
|
|
"RQueryServiceConfig2A",
|
|
"RQueryServiceConfig2W",
|
|
"RQueryServiceStatusEx",
|
|
"REnumServicesStatusExA",
|
|
"REnumServicesStatusExW",
|
|
"RI_ScBroadcastServiceControlMessage",
|
|
"RCreateServiceWOW64A",
|
|
"RCreateServiceWOW64W",
|
|
"RI_ScQueryServiceTagInfo",
|
|
"RNotifyServiceStatusChange",
|
|
"RGetNotifyResults",
|
|
"RCloseNotifyHandle",
|
|
"RControlServiceExA",
|
|
"RControlServiceExW",
|
|
"RI_ScSendPnPMessage",
|
|
"RI_ScValidatePnPService",
|
|
"RI_ScOpenServiceStatusHandle",
|
|
"RI_ScQueryServiceConfig",
|
|
"RQueryServiceConfigEx",
|
|
"RI_ScRegisterPreshutdownRestart",
|
|
"RI_ScReparseServiceDatabase",
|
|
"RQueryUserServiceName",
|
|
"RCreateWowService",
|
|
"RGetServiceRegistryStateKey",
|
|
"RGetServiceDirectory",
|
|
"RGetServiceProcessToken",
|
|
"ROpenSCManager2"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140702191738272,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"78e5d322-59a2-4324-ae3f-8bc8de32bdfc": {
|
|
"Module": "sstpsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\sstpsvc.dll",
|
|
"InterfaceId": "78e5d322-59a2-4324-ae3f-8bc8de32bdfc",
|
|
"InterfaceStructOffset": 127152,
|
|
"ProceduresCount": 5,
|
|
"Procedures": [
|
|
"SstpSvcSetConfig",
|
|
"SstpSvcGetConfig",
|
|
"SstpSvcCreateUpdateTenantGatewayMapping",
|
|
"SstpSvcRemoveTenantGatewayMapping",
|
|
"SstpSvcGetTenantGatewayMapping"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140707932021904,
|
|
"Service": "SstpSvc",
|
|
"IsServiceRunning": true
|
|
},
|
|
"c8ba73d2-3d55-429c-8e9a-c44f006f69fc": {
|
|
"Module": "UserDataService.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\UserDataService.dll",
|
|
"InterfaceId": "c8ba73d2-3d55-429c-8e9a-c44f006f69fc",
|
|
"InterfaceStructOffset": 1286160,
|
|
"ProceduresCount": 133,
|
|
"Procedures": [
|
|
"UdmSvcImpl_CloseEnumHandle",
|
|
"UdmSvcImpl_CloseSessionHandle",
|
|
"UdmSvcImpl_OpenSession",
|
|
"UdmSvcImpl_CreateSessionWithSameSecurityContext",
|
|
"UdmSvcImpl_OpenCallHistorySession",
|
|
"UdmSvcImpl_EnableProcessForTesting",
|
|
"UdmSvcImpl_EnableUserDataServiceBackgroundNotification",
|
|
"UdmSvcImpl_CheckObjectExistence",
|
|
"UdmSvcImpl_GetObjectProperties",
|
|
"UdmSvcImpl_GetObjectPropertiesWithScope",
|
|
"UdmSvcImpl_GetAppointmentProperties",
|
|
"UdmSvcImpl_GetCallHistoryEnum",
|
|
"UdmSvcImpl_DeleteCallHistory",
|
|
"UdmSvcImpl_MarkCallHistorySeen",
|
|
"UdmSvcImpl_CreateCallHistoryItem",
|
|
"UdmSvcImpl_GetUnseenCallCount",
|
|
"UdmSvcImpl_UpdateCallDetails",
|
|
"UdmSvcImpl_ResolveCalls",
|
|
"UdmSvcImpl_GetCallHistoryEntryEnum",
|
|
"UdmSvcImpl_UpdateEnumPropertySet",
|
|
"UdmSvcImpl_EnumFetchObjects",
|
|
"UdmSvcImpl_EnumFetchMatchingObjects",
|
|
"UdmSvcImpl_EnumGetCount",
|
|
"UdmSvcImpl_EnumGetState",
|
|
"UdmSvcImpl_EnumMoveFirst",
|
|
"UdmSvcImpl_EnumMoveLast",
|
|
"UdmSvcImpl_CreateCallFavoriteItem",
|
|
"UdmSvcImpl_DeleteCallFavorite",
|
|
"UdmSvcImpl_MoveCallFavoriteItem",
|
|
"UdmSvcImpl_ReorderGroups",
|
|
"UdmSvcImpl_ResolveFavorites",
|
|
"UdmSvcImpl_GetCallFavoriteEnum",
|
|
"UdmSvcImpl_ControlSessionNotifies",
|
|
"UdmSvcImpl_Advise",
|
|
"UdmSvcImpl_Unadvise",
|
|
"UdmSvcImpl_HasNotifications",
|
|
"UdmSvcImpl_GetNotifyMessage",
|
|
"UdmSvcImpl_GetFilePropertyStream",
|
|
"UdmSvcImpl_UpdateCallHistoryObjects",
|
|
"UdmSvcImpl_UpdateCalendarObjects",
|
|
"UdmSvcImpl_GetUnexpandedAppointmentEnum",
|
|
"UdmSvcImpl_GetCalendarEnum",
|
|
"UdmSvcImpl_GetAppointmentEnum",
|
|
"UdmSvcImpl_GetSingleAppointmentEnum",
|
|
"UdmSvcImpl_GetAppointmentSearchEnum",
|
|
"UdmSvcImpl_GetAppointmentExceptionEnum",
|
|
"UdmSvcImpl_GetAppointmentRevisionEnum",
|
|
"UdmSvcImpl_GetConflictInfoById",
|
|
"UdmSvcImpl_GetConflictInfoByProperties",
|
|
"UdmSvcImpl_GetAppointmentAppInfo",
|
|
"UdmSvcImpl_GetLocalIdArrayFromAppointmentRemoteObjectId",
|
|
"UdmSvcImpl_SetAutoReplySettings",
|
|
"UdmSvcImpl_GetAutoReplySettings",
|
|
"UdmSvcImpl_StartOrResetChangeTracking",
|
|
"UdmSvcImpl_ValidateCallerAccess",
|
|
"UdmSvcImpl_GenerateValidationToken",
|
|
"UdmSvcImpl_RedeemValidationToken",
|
|
"UdmSvcImpl_DeleteAllPackageData",
|
|
"UdmSvcImpl_CleanupStaleAppData",
|
|
"UdmSvcImpl_UpdateChatObjects",
|
|
"UdmSvcImpl_UpdateChangeTracking",
|
|
"UdmSvcImpl_ValidateChatMessage",
|
|
"UdmSvcImpl_GetChatObjectProperties",
|
|
"UdmSvcImpl_GetChatMessageEnum",
|
|
"UdmSvcImpl_GetChatRevisionMessageEnum",
|
|
"UdmSvcImpl_EnumFetchChatMessages",
|
|
"UdmSvcImpl_GetChatConversationEnum",
|
|
"UdmSvcImpl_GetChatSearchEnum",
|
|
"UdmSvcImpl_GetChatConversationIdFromThreadingInfo",
|
|
"UdmSvcImpl_GetChatTransports",
|
|
"UdmSvcImpl_RegisterChatTransport",
|
|
"UdmSvcImpl_GetChatApps",
|
|
"UdmSvcImpl_GetDefaultChatApp",
|
|
"UdmSvcImpl_SetDefaultChatApp",
|
|
"UdmSvcImpl_NotifyChatApp",
|
|
"UdmSvcImpl_UpdateAnnotationObjects",
|
|
"UdmSvcImpl_GetContactMatchSuggestions",
|
|
"UdmSvcImpl_UpdateContactObjects",
|
|
"UdmSvcImpl_ContactLinking",
|
|
"UdmSvcImpl_SetContactPreference",
|
|
"UdmSvcImpl_SetRemoteIdentificationInformation",
|
|
"UdmSvcImpl_GetMeContactId",
|
|
"UdmSvcImpl_VCardToContact",
|
|
"UdmSvcImpl_ContactToVCard",
|
|
"UdmSvcImpl_SetContactNameOrder",
|
|
"UdmSvcImpl_SetContactNameIncludeMiddle",
|
|
"UdmSvcImpl_ToggleContactMaintenance",
|
|
"UdmSvcImpl_GetObjectByRemoteId",
|
|
"UdmSvcImpl_GetAnnotationListEnum",
|
|
"UdmSvcImpl_GetContactListEnum",
|
|
"UdmSvcImpl_GetContactEnum",
|
|
"UdmSvcImpl_GetAnnotationEnum",
|
|
"UdmSvcImpl_GetContactRevisionEnum",
|
|
"UdmSvcImpl_UpdateEmailObjects",
|
|
"UdmSvcImpl_GetEmailFolderMessageCounts",
|
|
"UdmSvcImpl_GetEmailMailboxEnum",
|
|
"UdmSvcImpl_GetEmailFolderEnum",
|
|
"UdmSvcImpl_GetEmailRevisionEnum",
|
|
"UdmSvcImpl_GetEmailMessageEnum",
|
|
"UdmSvcImpl_GetEmailConversationEnum",
|
|
"UdmSvcImpl_IsChangeTrackingEnabled",
|
|
"UdmSvcImpl_EmptyEmailFolder",
|
|
"UdmSvcImpl_CreateResponseMessage",
|
|
"UdmSvcImpl_MoveFolder",
|
|
"UdmSvcImpl_CreateFolder",
|
|
"UdmSvcImpl_RespondToMeeting",
|
|
"UdmSvcImpl_ForwardMeeting",
|
|
"UdmSvcImpl_ProposeNewTimeForMeeting",
|
|
"UdmSvcImpl_ResolveRecipients",
|
|
"UdmSvcImpl_ValidateCertificates",
|
|
"UdmSvcImpl_GetMessageIdFromAttachmentId",
|
|
"UdmSvcImpl_RegisterSyncManager",
|
|
"UdmSvcImpl_SyncObject",
|
|
"UdmSvcImpl_GetUserDataAccountEnum",
|
|
"UdmSvcImpl_UpdateUserDataAccountObjects",
|
|
"UdmSvcImpl_MakeDefaultAccount",
|
|
"UdmSvcImpl_GetCachedChatCapabilities",
|
|
"UdmSvcImpl_GetChatCapabilitiesFromNetwork",
|
|
"UdmSvcImpl_GetRcsServiceStatus",
|
|
"UdmSvcImpl_SendLocalParticipantComposing",
|
|
"UdmSvcImpl_RaiseRemoteParticipantComposing",
|
|
"UdmSvcImpl_AdviseForConversationComposingStatusChanges",
|
|
"UdmSvcImpl_UnadviseFromConversationComposingStatusChanges",
|
|
"UdmSvcImpl_GetChatCloudServiceSettings",
|
|
"UdmSvcImpl_SetChatCloudServiceSettings",
|
|
"UdmSvcImpl_UpdateRcsEndUserMessage",
|
|
"UdmSvcImpl_StartCloudServiceSync",
|
|
"UdmSvcImpl_UpdateTaskObjects",
|
|
"UdmSvcImpl_GetTaskListEnum",
|
|
"UdmSvcImpl_GetTaskEnum",
|
|
"UdmSvcImpl_UpdateContactGroupObjects",
|
|
"UdmSvcImpl_GetContactGroupEnum",
|
|
"UdmSvcImpl_GetContactGroupMemberEnum"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140706535273312,
|
|
"Service": "UserDataSvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"cc105610-da03-467e-bc73-5b9e2937458d": {
|
|
"Module": "wlidsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\wlidsvc.dll",
|
|
"InterfaceId": "cc105610-da03-467e-bc73-5b9e2937458d",
|
|
"InterfaceStructOffset": 1315024,
|
|
"ProceduresCount": 87,
|
|
"Procedures": [
|
|
"WLIDPublishService",
|
|
"WLIDUnpublishService",
|
|
"WLIDResolveDevice",
|
|
"WLIDResolveUser",
|
|
"WLIDConnectIdentity",
|
|
"WLIDUpdateConnectedIdentity",
|
|
"WLIDCompleteConnect",
|
|
"WLIDDisconnectIdentity",
|
|
"WLIDCreateIdentity",
|
|
"WLIDDeleteIdentity",
|
|
"WLIDImportIdentity",
|
|
"WLIDGetLocalDeviceName",
|
|
"WLIDCreateContext",
|
|
"WLIDCreateContextWithLogonId",
|
|
"WLIDSetAuthData",
|
|
"WLIDDeleteContext",
|
|
"WLIDGetServiceConfig",
|
|
"WLIDAcquireTokens",
|
|
"WLIDUpdateToken",
|
|
"WLIDAddOrDeleteColorSetCookie",
|
|
"WLIDWatsonReport",
|
|
"WLIDGetCachedTokens",
|
|
"WLIDGetExtendedError",
|
|
"WLIDGetUserExtendedProperty",
|
|
"WLIDSetUserExtendedProperty",
|
|
"WLIDGetIdentityProperty",
|
|
"WLIDSetOptions",
|
|
"WLIDEnumIdentities",
|
|
"WLIDHasPersistedCredential",
|
|
"WLIDPersistCredential",
|
|
"WLIDPersistCredentialForConnectedUser",
|
|
"WLIDRemovePersistedCredential",
|
|
"WLIDVerifyAssertion",
|
|
"WLIDGetDeviceId",
|
|
"WLIDProvisionDeviceId",
|
|
"WLIDGetDeviceIdEx",
|
|
"WLIDRenewDeviceId",
|
|
"WLIDDeProvisionDeviceId",
|
|
"WLIDEnumDevices",
|
|
"WLIDAssociateDeviceToUser",
|
|
"WLIDDisassociateDeviceFromUser",
|
|
"WLIDEnumerateUserAssociatedDevices",
|
|
"WLIDUpdateUserAssociatedDeviceProperties",
|
|
"WLIDCreateContextForLinkedIdentity",
|
|
"WLIDAddUserToSsoGroup",
|
|
"WLIDGetUsersFromSsoGroup",
|
|
"WLIDRemoveUserFromSsoGroup",
|
|
"WLIDGetAuthError",
|
|
"WLIDGetDeviceShortLivedToken",
|
|
"WLIDGetHIPChallenge",
|
|
"WLIDSetHIPSolution",
|
|
"WLIDSetDefaultUserForTarget",
|
|
"WLIDGetDefaultUserForTarget",
|
|
"WLIDIsKioskMode",
|
|
"WLIDGetConfigString",
|
|
"WLIDGetSvcEnvironment",
|
|
"WLIDGetIdName",
|
|
"WLIDGetConfigDWORDValue",
|
|
"WLIDGetUserPropertiesFromSystemStore",
|
|
"WLIDSetUserPropertiesToSystemStore",
|
|
"WLIDInitializeEx",
|
|
"WLIDEnableTrace",
|
|
"WLIDDisableTrace",
|
|
"WLIDGetOneTimeCredential",
|
|
"WLIDGetIssuerCertificate",
|
|
"WLIDCreateContextWithChallenge",
|
|
"WLIDGetDefaultUserForTargetEx",
|
|
"WLIDSendOneTimeCode",
|
|
"WLIDGetUserPropertiesFromHandle",
|
|
"WLIDGetKeyLatest",
|
|
"WLIDGetKeyWithVersion",
|
|
"WLIDGetOpenHandlesData",
|
|
"WLIDGetSignedTokens",
|
|
"WLIDGetDeviceDAToken",
|
|
"WLIDGetProofOfPossessionTokens",
|
|
"WLIDRegisterUserIdkey",
|
|
"WLIDUpdateDeviceLicenseInfo",
|
|
"WLIDManageApprover",
|
|
"WLIDListSessions",
|
|
"WLIDApproveSession",
|
|
"WLIDGetScenarioInlineUrlWithContextData",
|
|
"WLIDGetInlineUrlContextData",
|
|
"WLIDAcquireTokensWithNGC",
|
|
"WLIDGetTotpCode",
|
|
"WLIDCleanupIdentity",
|
|
"WLIDGetAppData",
|
|
"WLIDProvisionIdentityWithTransferToken"
|
|
],
|
|
"ProcStackSize": 72,
|
|
"DispatchFunction": 140707092939056,
|
|
"Service": "wlidsvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"00efb8be-002d-45cd-81b0-f65b260f8a13": {
|
|
"Module": "ActionMgr.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\ActionMgr.dll",
|
|
"InterfaceId": "00efb8be-002d-45cd-81b0-f65b260f8a13",
|
|
"InterfaceStructOffset": 49152,
|
|
"ProceduresCount": 3,
|
|
"Procedures": [
|
|
"SrvRpcActionObjectServiceConnect",
|
|
"SrvRpcActionObjectServiceDisconnect",
|
|
"SrvRpcActionObjectRunJson"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140707392628128,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"0b1c2170-5732-4e0e-8cd3-d9b16f3b84d7": {
|
|
"Module": "authz.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\authz.dll",
|
|
"InterfaceId": "0b1c2170-5732-4e0e-8cd3-d9b16f3b84d7",
|
|
"InterfaceStructOffset": 172224,
|
|
"ProceduresCount": 7,
|
|
"Procedures": [
|
|
"s_AuthzrFreeContext",
|
|
"s_AuthzrInitializeContextFromSid",
|
|
"s_AuthzrInitializeCompoundContext",
|
|
"s_AuthzrAccessCheck",
|
|
"s_AuthzGetInformationFromContext",
|
|
"s_AuthzrModifyClaims",
|
|
"s_AuthzrModifySids"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140708142033392,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"26268c86-e770-433e-86ef-5f3ba6731fba": {
|
|
"Module": "HostNetSvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\HostNetSvc.dll",
|
|
"InterfaceId": "26268c86-e770-433e-86ef-5f3ba6731fba",
|
|
"InterfaceStructOffset": 2499872,
|
|
"ProceduresCount": 53,
|
|
"Procedures": [
|
|
"HnsRpc_EnumerateNetworks",
|
|
"HnsRpc_CreateNetwork",
|
|
"HnsRpc_OpenNetwork",
|
|
"HnsRpc_ModifyNetwork",
|
|
"HnsRpc_QueryNetworkProperties",
|
|
"HnsRpc_DeleteNetwork",
|
|
"HnsRpc_RegisterNetworkNotifications",
|
|
"HnsRpc_UnregisterGuestNetworkServiceNotifications",
|
|
"HnsRpc_QueryGuestNetworkServiceNotification",
|
|
"HnsRpc_CloseGuestNetworkService",
|
|
"HnsRpc_EnumerateNamespaces",
|
|
"HnsRpc_CreateNamespace",
|
|
"HnsRpc_OpenNamespace",
|
|
"HnsRpc_ModifyNamespace",
|
|
"HnsRpc_QueryNamespaceProperties",
|
|
"HnsRpc_DeleteNamespace",
|
|
"HnsRpc_CloseGuestNetworkService",
|
|
"HnsRpc_EnumerateEndpoints",
|
|
"HnsRpc_CreateEndpoint",
|
|
"HnsRpc_OpenEndpoint",
|
|
"HnsRpc_ModifyEndpoint",
|
|
"HnsRpc_QueryEndpointProperties",
|
|
"HnsRpc_DeleteEndpoint",
|
|
"HnsRpc_CloseEndpoint",
|
|
"HnsRpc_EnumerateLoadBalancers",
|
|
"HnsRpc_CreateLoadBalancer",
|
|
"HnsRpc_OpenLoadBalancer",
|
|
"HnsRpc_ModifyLoadBalancer",
|
|
"HnsRpc_QueryLoadBalancerProperties",
|
|
"HnsRpc_DeleteLoadBalancer",
|
|
"HnsRpc_CloseGuestNetworkService",
|
|
"HnsRpc_EnumerateSdnRoutes",
|
|
"HnsRpc_CreateSdnRoute",
|
|
"HnsRpc_OpenLoadBalancer",
|
|
"HnsRpc_ModifySdnRoute",
|
|
"HnsRpc_QuerySdnRouteProperties",
|
|
"HnsRpc_DeleteLoadBalancer",
|
|
"HnsRpc_CloseGuestNetworkService",
|
|
"HnsRpc_OpenService",
|
|
"HnsRpc_RegisterServiceNotifications",
|
|
"HnsRpc_UnregisterGuestNetworkServiceNotifications",
|
|
"HnsRpc_QueryGuestNetworkServiceNotification",
|
|
"HnsRpc_CloseGuestNetworkService",
|
|
"HnsRpc_EnumerateGuestNetworkServices",
|
|
"HnsRpc_CreateGuestNetworkService",
|
|
"HnsRpc_OpenGuestNetworkService",
|
|
"HnsRpc_ModifyGuestNetworkService",
|
|
"HnsRpc_QueryGuestNetworkServiceProperties",
|
|
"HnsRpc_DeleteGuestNetworkService",
|
|
"HnsRpc_RegisterGuestNetworkServiceNotifications",
|
|
"HnsRpc_UnregisterGuestNetworkServiceNotifications",
|
|
"HnsRpc_QueryGuestNetworkServiceNotification",
|
|
"HnsRpc_CloseGuestNetworkService"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140707750170608,
|
|
"Service": "hns",
|
|
"IsServiceRunning": true
|
|
},
|
|
"7f9d11bf-7fb9-436b-a812-b2d50c5d4c03": {
|
|
"Module": "MPSSVC.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\MPSSVC.dll",
|
|
"InterfaceId": "7f9d11bf-7fb9-436b-a812-b2d50c5d4c03",
|
|
"InterfaceStructOffset": 710800,
|
|
"ProceduresCount": 18,
|
|
"Procedures": [
|
|
"RPC_FWIndicatePortInUse",
|
|
"RPC_FWGetIndicatedPortInUse",
|
|
"RPC_FWIndicateTupleInUse",
|
|
"RPC_FWResetIndicatedTupleInUse",
|
|
"RPC_FWIndicateProxyForUrl",
|
|
"OnNetworkAdded",
|
|
"RPC_FWIsTargetAProxy",
|
|
"RPC_NetworkIsolationSetupAppContainerBinaries",
|
|
"RPC_NetworkIsolationRegisterForAppContainerChanges",
|
|
"Rpc_NetworkIsolationRegistrationGetLastEvent",
|
|
"RPC_NetworkIsolationUnregisterForAppContainerChanges",
|
|
"RPC_NetworkIsolationGetAppContainer",
|
|
"RPC_NetworkIsolationEnumAppContainers",
|
|
"RPC_NetworkIsolationAddAllowEnterpriseIdRule",
|
|
"RPC_NetworkIsolationCreateAllInterfacesContainer",
|
|
"RPC_NetworkIsolationCreateInterfaceContainer",
|
|
"RPC_NetworkIsolationDeleteAllInterfacesContainer",
|
|
"RPC_NetworkIsolationDeleteInterfaceContainer"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140708003537936,
|
|
"Service": "mpssvc",
|
|
"IsServiceRunning": true
|
|
},
|
|
"fd6bb951-c830-4734-bf2c-18ba6ec7ab49": {
|
|
"Module": "iscsiexe.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\iscsiexe.dll",
|
|
"InterfaceId": "fd6bb951-c830-4734-bf2c-18ba6ec7ab49",
|
|
"InterfaceStructOffset": 121488,
|
|
"ProceduresCount": 24,
|
|
"Procedures": [
|
|
"DiscGetInitiatorList",
|
|
"DiscGetTargets",
|
|
"DiscGetTargetInfo",
|
|
"DiscLoginTarget",
|
|
"DiscLogoutTarget",
|
|
"DiscRefreshAll",
|
|
"DiscRefreshInitiator",
|
|
"DiscSessionIdToHBA",
|
|
"DiscStaticTarget",
|
|
"DiscSNS",
|
|
"DiscTargetPortal",
|
|
"DiscReportTargetPortals",
|
|
"DiscPresharedKey",
|
|
"DiscGetIKEInformation",
|
|
"DiscAddConnection",
|
|
"DiscRemoveConnection",
|
|
"DiscSetTunnelOuterModeAddress",
|
|
"DiscInitiatorSharedSecret",
|
|
"DiscRadiusSharedSecret",
|
|
"DiscInitiatorNodeName",
|
|
"DiscGetInitiatorNodeName",
|
|
"DiscSetupPersistentDevices",
|
|
"DiscGetTargetPortals",
|
|
"DiscRADIUSServer"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140707581084992,
|
|
"Service": "MSiSCSI",
|
|
"IsServiceRunning": false
|
|
},
|
|
"cc4b408c-4c4e-422f-9849-47bb47bd4d2e": {
|
|
"Module": "NaturalAuth.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\NaturalAuth.dll",
|
|
"InterfaceId": "cc4b408c-4c4e-422f-9849-47bb47bd4d2e",
|
|
"InterfaceStructOffset": 385824,
|
|
"ProceduresCount": 12,
|
|
"Procedures": [
|
|
"NARPCRuleRegister",
|
|
"NARPCRuleQuery",
|
|
"NARPCRuleUnregister",
|
|
"NARPCRuleValidate",
|
|
"NARPCDynamicLockStart",
|
|
"NARPCDynamicLockStop",
|
|
"NARPCDynamicLockForceEvaluate",
|
|
"NARPCDynamicLockShouldSkipGracePeriod",
|
|
"NARPCDynamicLockShouldIgnoreUserActivity",
|
|
"NARPCDynamicLockShouldIgnoreDisplayRequestActivity",
|
|
"NARPCDeviceUnlockStart",
|
|
"NARPCDeviceUnlockStop"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140707093834192,
|
|
"Service": "NaturalAuthentication",
|
|
"IsServiceRunning": false
|
|
},
|
|
"12345778-1234-abcd-ef00-0123456789ab": {
|
|
"Module": "lsasrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\lsasrv.dll",
|
|
"InterfaceId": "12345778-1234-abcd-ef00-0123456789ab",
|
|
"InterfaceStructOffset": 1270144,
|
|
"ProceduresCount": 129,
|
|
"Procedures": [
|
|
"LsarClose",
|
|
"CredrRename",
|
|
"LsarEnumeratePrivileges",
|
|
"LsarQuerySecurityObject",
|
|
"LsarSetSecurityObject",
|
|
"LsaITestCall",
|
|
"LsarOpenPolicyRPC",
|
|
"LsarQueryInformationPolicy",
|
|
"LsarSetInformationPolicy",
|
|
"LsaITestCall",
|
|
"LsarCreateAccount",
|
|
"LsarEnumerateAccounts",
|
|
"LsarCreateTrustedDomain",
|
|
"LsarEnumerateTrustedDomains",
|
|
"LsarLookupNames",
|
|
"LsarLookupSids",
|
|
"LsarCreateSecret",
|
|
"LsarOpenAccount",
|
|
"LsarEnumeratePrivilegesAccount",
|
|
"LsarAddPrivilegesToAccount",
|
|
"LsarRemovePrivilegesFromAccount",
|
|
"LsarGetQuotasForAccount",
|
|
"LsarSetQuotasForAccount",
|
|
"LsarGetSystemAccessAccount",
|
|
"LsarSetSystemAccessAccount",
|
|
"LsarOpenTrustedDomain",
|
|
"LsarQueryInfoTrustedDomain",
|
|
"LsarSetInformationTrustedDomain",
|
|
"LsarOpenSecret",
|
|
"LsarSetSecret",
|
|
"LsarQuerySecret",
|
|
"LsarLookupPrivilegeValue",
|
|
"LsarLookupPrivilegeName",
|
|
"LsarLookupPrivilegeDisplayName",
|
|
"LsarDeleteObject",
|
|
"LsarEnumerateAccountsWithUserRight",
|
|
"LsarEnumerateAccountRights",
|
|
"LsarAddAccountRights",
|
|
"LsarRemoveAccountRights",
|
|
"LsarQueryTrustedDomainInfo",
|
|
"LsarSetTrustedDomainInfo",
|
|
"LsarDeleteTrustedDomain",
|
|
"LsarStorePrivateData",
|
|
"LsarRetrievePrivateData",
|
|
"LsarOpenPolicy2",
|
|
"LsarGetUserName",
|
|
"LsarQueryInformationPolicy2",
|
|
"LsarSetInformationPolicy2",
|
|
"LsarQueryTrustedDomainInfoByName",
|
|
"LsarSetTrustedDomainInfoByName",
|
|
"LsarEnumerateTrustedDomainsEx",
|
|
"LsarCreateTrustedDomainEx",
|
|
"LsaITestCall",
|
|
"LsarQueryDomainInformationPolicy",
|
|
"LsarSetDomainInformationPolicy",
|
|
"LsarOpenTrustedDomainByName",
|
|
"LsaITestCall",
|
|
"LsarLookupSids2",
|
|
"LsarLookupNames2",
|
|
"LsarCreateTrustedDomainEx2",
|
|
"CredrWrite",
|
|
"CredrRead",
|
|
"CredrEnumerate",
|
|
"CredrWriteDomainCredentials",
|
|
"CredrReadDomainCredentials",
|
|
"CredrDelete",
|
|
"CredrGetTargetInfo",
|
|
"CredrProfileLoaded",
|
|
"LsarLookupNames3",
|
|
"CredrGetSessionTypes",
|
|
"LsarRegisterAuditEvent",
|
|
"LsarGenAuditEvent",
|
|
"LsarUnregisterAuditEvent",
|
|
"LsarQueryForestTrustInformation",
|
|
"LsarSetForestTrustInformation",
|
|
"CredrRename",
|
|
"LsarLookupSids3",
|
|
"LsarLookupNames4",
|
|
"LsarOpenPolicySce",
|
|
"LsarAdtRegisterSecurityEventSource",
|
|
"LsarAdtUnregisterSecurityEventSource",
|
|
"LsarAdtReportSecurityEvent",
|
|
"CredrFindBestCredential",
|
|
"LsarSetAuditPolicy",
|
|
"LsarQueryAuditPolicy",
|
|
"LsarEnumerateAuditPolicy",
|
|
"LsarEnumerateAuditCategories",
|
|
"LsarEnumerateAuditSubCategories",
|
|
"LsarLookupAuditCategoryName",
|
|
"LsarLookupAuditSubCategoryName",
|
|
"LsarSetAuditSecurity",
|
|
"LsarQueryAuditSecurity",
|
|
"CredrReadByTokenHandle",
|
|
"CredrRestoreCredentials",
|
|
"CredrBackupCredentials",
|
|
"LsarManageSidNameMapping",
|
|
"CredrProfileUnloaded",
|
|
"CredrRename",
|
|
"CredrRename",
|
|
"CredrRename",
|
|
"CredrRename",
|
|
"CredrRename",
|
|
"LsarEfsGetSmartcardCredentials",
|
|
"LsarAuditSetGlobalSacl",
|
|
"LsarAuditQueryGlobalSacl",
|
|
"CredrProfileLoadedEx",
|
|
"LsarInteractiveSessionIsLoggedOff",
|
|
"LsarConfigureAutoLogonCredentials",
|
|
"LsarGetDeviceRegistrationInfo",
|
|
"LsaITestCall",
|
|
"LsarProfileDeleted",
|
|
"LsaITestCall",
|
|
"CredrRename",
|
|
"LsarValidateProcUniqueLuid",
|
|
"LsarIsArsoAllowedByPolicy",
|
|
"LsarIsArsoAllowedByConsent",
|
|
"LsarEnableArsoConsent",
|
|
"LsarDisableArsoConsent",
|
|
"LsarIsUserArsoAllowed",
|
|
"LsarIsUserArsoEnabled",
|
|
"LsarEnableUserArso",
|
|
"LsarDisableUserArso",
|
|
"LsarConfigureUserArso",
|
|
"LsarGetInprocDispatchTable",
|
|
"LsarSetSharedUserSession",
|
|
"LsarClearSharedUserSession",
|
|
"LsarEnablePasswordLessCurrentUser",
|
|
"LsarDisablePasswordLessCurrentUser",
|
|
"LsarUpdateUserTokenSessionId"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140708153895600,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"9d420415-b8fb-4f4a-8c53-4502ead30ca9": {
|
|
"Module": "PlaySndSrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\PlaySndSrv.dll",
|
|
"InterfaceId": "9d420415-b8fb-4f4a-8c53-4502ead30ca9",
|
|
"InterfaceStructOffset": 20688,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"I_PlaySoundkPostMessage"
|
|
],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140707681603712,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"a58d24fe-8b46-4a22-811b-15f95a43956e": {
|
|
"Module": "mpengine.dll",
|
|
"ModulePath": "C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\mpengine.dll",
|
|
"InterfaceId": "a58d24fe-8b46-4a22-811b-15f95a43956e",
|
|
"InterfaceStructOffset": 11413344,
|
|
"ProceduresCount": 9,
|
|
"Procedures": [
|
|
"MpBootStrap",
|
|
"MpBootStrap",
|
|
"Proc2",
|
|
"MpBootStrap",
|
|
"MpBootStrap",
|
|
"MpBootStrap",
|
|
"MpBootStrap",
|
|
"MpBootStrap",
|
|
"MpBootStrap"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140706774273824,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"b450acb1-fe83-4b48-956e-89be5c42b5c4": {
|
|
"Module": "hvsirpcd.exe",
|
|
"ModulePath": "C:\\Windows\\WinSxS\\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.18362.1832_none_158049e1d563edb9\\hvsirpcd.exe",
|
|
"InterfaceId": "b450acb1-fe83-4b48-956e-89be5c42b5c4",
|
|
"InterfaceStructOffset": 67904,
|
|
"ProceduresCount": 5,
|
|
"Procedures": [
|
|
"s_HvsiLsaProxyInitializeSecurityContext",
|
|
"s_HvsiLsaProxyQueryContextAttributesEx",
|
|
"s_HvsiLsaProxyDeleteSecurityContext",
|
|
"s_HvsiLsaProxyAcquireCredentialsHandle",
|
|
"s_HvsiLsaProxyFreeCredentialsHandle"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140698086703920,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"2fb92682-6599-42dc-ae13-bd2ca89bd11c": {
|
|
"Module": "MPSSVC.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\MPSSVC.dll",
|
|
"InterfaceId": "2fb92682-6599-42dc-ae13-bd2ca89bd11c",
|
|
"InterfaceStructOffset": 710592,
|
|
"ProceduresCount": 92,
|
|
"Procedures": [
|
|
"RPC_FWOpenPolicyStore",
|
|
"RPC_FWClosePolicyStore",
|
|
"RPC_FWRestoreDefaults",
|
|
"RPC_FWGetGlobalConfig",
|
|
"RPC_FWSetGlobalConfig",
|
|
"RPC_FWAddFirewallRule",
|
|
"RPC_FWSetFirewallRule",
|
|
"RPC_FWDeleteFirewallRule",
|
|
"RPC_FWDeleteAllFirewallRules",
|
|
"RPC_FWEnumFirewallRules",
|
|
"RPC_FWGetConfig",
|
|
"RPC_FWSetConfig",
|
|
"RPC_FWNotifyUnsupportedAttempt",
|
|
"RPC_FWAddConnectionSecurityRule",
|
|
"RPC_FWSetConnectionSecurityRule",
|
|
"RPC_FWDeleteConnectionSecurityRule",
|
|
"RPC_FWDeleteAllConnectionSecurityRules",
|
|
"RPC_FWEnumConnectionSecurityRules",
|
|
"RPC_FWAddAuthenticationSet",
|
|
"RPC_FWSetAuthenticationSet",
|
|
"RPC_FWDeleteAuthenticationSet",
|
|
"RPC_FWDeleteAllAuthenticationSets",
|
|
"RPC_FWEnumAuthenticationSets",
|
|
"RPC_FWAddCryptoSet",
|
|
"RPC_FWSetCryptoSet",
|
|
"RPC_FWDeleteCryptoSet",
|
|
"RPC_FWDeleteAllCryptoSets",
|
|
"RPC_FWEnumCryptoSets",
|
|
"RPC_FWEnumPhase1SAs",
|
|
"RPC_FWEnumPhase2SAs",
|
|
"RPC_FWDeletePhase1SAs",
|
|
"RPC_FWDeletePhase2SAs",
|
|
"RPC_FWRegisterProduct",
|
|
"RPC_FWUnregisterProduct",
|
|
"RPC_FWEnumProducts",
|
|
"RPC_FWAddMainModeRule",
|
|
"RPC_FWSetMainModeRule",
|
|
"RPC_FWDeleteMainModeRule",
|
|
"RPC_FWDeleteAllMainModeRules",
|
|
"RPC_FWEnumMainModeRules",
|
|
"RPC_FWQueryFirewallRules",
|
|
"RPC_FWQueryConnectionSecurityRules2_10",
|
|
"RPC_FWQueryMainModeRules",
|
|
"RPC_FWQueryAuthenticationSets",
|
|
"RPC_FWQueryCryptoSets",
|
|
"RPC_FWEnumNetworks",
|
|
"RPC_FWEnumAdapters",
|
|
"RPC_FWGetGlobalConfig2_10",
|
|
"RPC_FWGetConfig2_10",
|
|
"RPC_FWAddFirewallRule2_10",
|
|
"RPC_FWSetFirewallRule2_10",
|
|
"RPC_FWEnumFirewallRules2_10",
|
|
"RPC_FWAddConnectionSecurityRule2_10",
|
|
"RPC_FWSetConnectionSecurityRule2_10",
|
|
"RPC_FWEnumConnectionSecurityRules2_10",
|
|
"RPC_FWAddAuthenticationSet2_10",
|
|
"RPC_FWSetAuthenticationSet2_10",
|
|
"RPC_FWEnumAuthenticationSets2_10",
|
|
"RPC_FWAddCryptoSet2_10",
|
|
"RPC_FWSetCryptoSet2_10",
|
|
"RPC_FWEnumCryptoSets2_10",
|
|
"RPC_FWDiagGetAppList",
|
|
"RPC_FWAddConnectionSecurityRule2_20",
|
|
"RPC_FWSetConnectionSecurityRule2_20",
|
|
"RPC_FWEnumConnectionSecurityRules2_20",
|
|
"RPC_FWQueryConnectionSecurityRules2_20",
|
|
"RPC_FWAddAuthenticationSet2_20",
|
|
"RPC_FWSetAuthenticationSet2_20",
|
|
"RPC_FWEnumAuthenticationSets2_20",
|
|
"RPC_FWQueryAuthenticationSets2_20",
|
|
"RPC_FWAddFirewallRule2_20",
|
|
"RPC_FWSetFirewallRule2_20",
|
|
"RPC_FWEnumFirewallRules2_20",
|
|
"RPC_FWQueryFirewallRules2_20",
|
|
"RPC_FWQueryIsolationType",
|
|
"RPC_FWSelectConSecRule",
|
|
"RPC_FWAddFirewallRule2_24",
|
|
"RPC_FWSetFirewallRule2_24",
|
|
"RPC_FWEnumFirewallRules2_24",
|
|
"RPC_FWQueryFirewallRules2_24",
|
|
"RPC_FWAddFirewallRule2_25",
|
|
"RPC_FWSetFirewallRule2_25",
|
|
"RPC_FWEnumFirewallRules2_25",
|
|
"RPC_FWQueryFirewallRules2_25",
|
|
"RPC_FWAddFirewallRule2_26",
|
|
"RPC_FWSetFirewallRule2_26",
|
|
"RPC_FWEnumFirewallRules2_26",
|
|
"RPC_FWQueryFirewallRules2_26",
|
|
"RPC_FWAddFirewallRule2_27",
|
|
"RPC_FWSetFirewallRule2_27",
|
|
"RPC_FWEnumFirewallRules2_27",
|
|
"RPC_FWQueryFirewallRules2_27"
|
|
],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140708002896304,
|
|
"Service": "mpssvc",
|
|
"IsServiceRunning": true
|
|
},
|
|
"8337aebc-5564-46fd-bc41-7798f18d2e4b": {
|
|
"Module": "ngcsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\ngcsvc.dll",
|
|
"InterfaceId": "8337aebc-5564-46fd-bc41-7798f18d2e4b",
|
|
"InterfaceStructOffset": 630512,
|
|
"ProceduresCount": 9,
|
|
"Procedures": [
|
|
"s_DeviceCredentialMgrRpcBeginAuthentication",
|
|
"s_DeviceCredentialMgrRpcUpdateAuthenticationStage",
|
|
"s_DeviceCredentialMgrRpcGetAuthenticationData",
|
|
"s_DeviceCredentialMgrRpcProtectData",
|
|
"s_DeviceCredentialMgrRpcUnprotectData",
|
|
"s_DeviceCredentialMgrRpcCheckProvisionedDevice",
|
|
"s_DeviceCredentialMgrRpcHasLogonSession",
|
|
"s_DeviceCredentialMgrRpcCheckIfUserSessionIsRequired",
|
|
"s_DeviceCredentialMgrRpcStartDevicePresenceCheck"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140707094133664,
|
|
"Service": "NgcSvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"55e6b932-1979-45d6-90c5-7f6270724112": {
|
|
"Module": "ResourcePolicyServer.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\ResourcePolicyServer.dll",
|
|
"InterfaceId": "55e6b932-1979-45d6-90c5-7f6270724112",
|
|
"InterfaceStructOffset": 105984,
|
|
"ProceduresCount": 10,
|
|
"Procedures": [
|
|
"Srv_GetResourcePolicyKey",
|
|
"Srv_GetResourcePolicyInformation",
|
|
"Srv_CreateResourcePolicy",
|
|
"Srv_GetResourcePolicyName",
|
|
"Srv_CreatePolicyEngineClientContext",
|
|
"Srv_ClosePolicyEngineClientContext",
|
|
"Srv_RegisterForPackageEnergyStateChangeNotifications",
|
|
"Srv_IsPackageInGoodEnergyState",
|
|
"Srv_InterruptiveUIStateChanged_Subscribe",
|
|
"Srv_InterruptiveUIStateChanged_Unsubscribe"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140708127422960,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"07b91411-14fe-4856-8982-c3fa7581d784": {
|
|
"Module": "PackageStateRoaming.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\PackageStateRoaming.dll",
|
|
"InterfaceId": "07b91411-14fe-4856-8982-c3fa7581d784",
|
|
"InterfaceStructOffset": 98720,
|
|
"ProceduresCount": 7,
|
|
"Procedures": [
|
|
"SignalRoamingDataChange",
|
|
"SignalPackageRegistrationChange",
|
|
"SignalHighPrioritySettingChange",
|
|
"SignalBackgroundUploadsStarted",
|
|
"SignalEnableBackupForPackage",
|
|
"SignalForcedQuiesceForPackage",
|
|
"SignalStateChangeForPackage"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140707581156528,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"4dace966-a243-4450-ae3f-9b7bcb5315b8": {
|
|
"Module": "PsmServiceExtHost.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\PsmServiceExtHost.dll",
|
|
"InterfaceId": "4dace966-a243-4450-ae3f-9b7bcb5315b8",
|
|
"InterfaceStructOffset": 562224,
|
|
"ProceduresCount": 6,
|
|
"Procedures": [
|
|
"RmGameModeSrvRegisterProcess",
|
|
"RmGameModeSrvUnregisterProcess",
|
|
"RmGameModeSrvDisableForRegisteredProcess",
|
|
"RmGameModeSrvReenableForRegisteredProcess",
|
|
"RmGameModeSrvGetLargestValidResourceRequest",
|
|
"RmGameModeSrvRegisterPairedAuxiliaryProcess"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140708133699104,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"b9e79e60-3d52-11ce-aaa1-00006901293f": {
|
|
"Module": "rpcss.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\rpcss.dll",
|
|
"InterfaceId": "b9e79e60-3d52-11ce-aaa1-00006901293f",
|
|
"InterfaceStructOffset": 959984,
|
|
"ProceduresCount": 11,
|
|
"Procedures": [
|
|
"IrotRegister",
|
|
"IrotRevoke",
|
|
"IrotIsRunning",
|
|
"IrotGetObject",
|
|
"IrotNoteChangeTime",
|
|
"IrotGetTimeOfLastChange",
|
|
"IrotEnumRunning",
|
|
"IMgotRegister",
|
|
"IMgotRevoke",
|
|
"IMgotGetObject",
|
|
"IMgotEnumRunning"
|
|
],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140708135455360,
|
|
"Service": "RpcSs",
|
|
"IsServiceRunning": true
|
|
},
|
|
"e7f76134-9ef5-4949-a2d6-3368cc0988f3": {
|
|
"Module": "wcmsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\wcmsvc.dll",
|
|
"InterfaceId": "e7f76134-9ef5-4949-a2d6-3368cc0988f3",
|
|
"InterfaceStructOffset": 768272,
|
|
"ProceduresCount": 4,
|
|
"Procedures": [
|
|
"RpcEnterConnectedStandby",
|
|
"RpcExitConnectedStandby",
|
|
"RpcEnterNetQuiet",
|
|
"RpcExitNetQuiet"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140708018993856,
|
|
"Service": "Wcmsvc",
|
|
"IsServiceRunning": true
|
|
},
|
|
"ffe01159-cfe1-4002-91de-0e0ef32731f5": {
|
|
"Module": "NaturalAuth.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\NaturalAuth.dll",
|
|
"InterfaceId": "ffe01159-cfe1-4002-91de-0e0ef32731f5",
|
|
"InterfaceStructOffset": 387104,
|
|
"ProceduresCount": 3,
|
|
"Procedures": [
|
|
"CDFRPCUpdatePresenceState",
|
|
"CDFRPCRegisterDevice",
|
|
"CDFRPCUnregisterDevice"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140707094069344,
|
|
"Service": "NaturalAuthentication",
|
|
"IsServiceRunning": false
|
|
},
|
|
"015163bb-e769-45e1-afaf-dff7e782b560": {
|
|
"Module": "CmService.dll",
|
|
"ModulePath": "C:\\Windows\\WinSxS\\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.18362.1500_none_a0633e62409b621c\\CmService.dll",
|
|
"InterfaceId": "015163bb-e769-45e1-afaf-dff7e782b560",
|
|
"InterfaceStructOffset": 626560,
|
|
"ProceduresCount": 2,
|
|
"Procedures": [
|
|
"CmsRpcSrv_EnumerateContainers",
|
|
"CmsRpcSrv_GetDebugLayerPath"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140707487015760,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"faf2447b-b348-4feb-8dbe-beee5b7f7778": {
|
|
"Module": "wlidsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\wlidsvc.dll",
|
|
"InterfaceId": "faf2447b-b348-4feb-8dbe-beee5b7f7778",
|
|
"InterfaceStructOffset": 1314928,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"RenewCertificate"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140707092905904,
|
|
"Service": "wlidsvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"f6beaff7-1e19-4fbb-9f8f-b89e2018337c": {
|
|
"Module": "wevtsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\wevtsvc.dll",
|
|
"InterfaceId": "f6beaff7-1e19-4fbb-9f8f-b89e2018337c",
|
|
"InterfaceStructOffset": 970752,
|
|
"ProceduresCount": 29,
|
|
"Procedures": [
|
|
"_EvtRpcRegisterRemoteSubscription",
|
|
"_EvtRpcRemoteSubscriptionNextAsync",
|
|
"_EvtRpcRemoteSubscriptionNext",
|
|
"_EvtRpcRemoteSubscriptionWaitAsync",
|
|
"EvtRpcRegisterControllableOperation",
|
|
"_EvtRpcRegisterLogQuery",
|
|
"EvtRpcClearLog",
|
|
"EvtRpcExportLog",
|
|
"EvtRpcLocalizeExportLog",
|
|
"_EvtRpcMessageRender",
|
|
"_EvtRpcMessageRenderDefault",
|
|
"_EvtRpcQueryNext",
|
|
"_EvtRpcQuerySeek",
|
|
"_EvtRpcClose",
|
|
"_EvtRpcCancel",
|
|
"_EvtRpcAssertConfig",
|
|
"_EvtRpcRetractConfig",
|
|
"_EvtRpcOpenLogHandle",
|
|
"_EvtRpcGetLogFileInfo",
|
|
"_EvtRpcGetChannelList",
|
|
"_EvtRpcGetChannelConfig",
|
|
"EvtRpcPutChannelConfig",
|
|
"_EvtRpcGetPublisherList",
|
|
"EvtRpcGetPublisherListForChannel",
|
|
"_EvtRpcGetPublisherMetadata",
|
|
"_EvtRpcGetPublisherResourceMetadata",
|
|
"EvtRpcGetEventMetadataEnum",
|
|
"EvtRpcGetNextEventMetadata",
|
|
"_EvtRpcGetClassicLogDisplayName"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140708089353104,
|
|
"Service": "EventLog",
|
|
"IsServiceRunning": true
|
|
},
|
|
"b8cadbaf-e84b-46b9-84f2-6f71c03f9e55": {
|
|
"Module": "bisrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\bisrv.dll",
|
|
"InterfaceId": "b8cadbaf-e84b-46b9-84f2-6f71c03f9e55",
|
|
"InterfaceStructOffset": 552064,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"SrvOdbLbPublishLegacyExitCode"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140708131134848,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"df1941c5-fe89-4e79-bf10-463657acf44d": {
|
|
"Module": "efssvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\efssvc.dll",
|
|
"InterfaceId": "df1941c5-fe89-4e79-bf10-463657acf44d",
|
|
"InterfaceStructOffset": 57104,
|
|
"ProceduresCount": 53,
|
|
"Procedures": [
|
|
"EfsRpcOpenFileRaw",
|
|
"EfsRpcReadFileRaw",
|
|
"EfsRpcWriteFileRaw",
|
|
"EfsRpcCloseRaw",
|
|
"EfsRpcEncryptFileSrv",
|
|
"EfsRpcDecryptFileSrv",
|
|
"EfsRpcQueryUsersOnFile",
|
|
"EfsRpcQueryRecoveryAgents",
|
|
"EfsRpcRemoveUsersFromFile",
|
|
"EfsRpcAddUsersToFile",
|
|
"EfsRpcSetFileEncryptionKey",
|
|
"EfsRpcFileKeyInfoEx",
|
|
"EfsRpcFileKeyInfo",
|
|
"EfsRpcDuplicateEncryptionInfoFile",
|
|
"EfsUsePinForEncryptedFiles",
|
|
"EfsRpcAddUsersToFileEx",
|
|
"EfsRpcFileKeyInfoEx",
|
|
"EfsRpcFileKeyInfoEx",
|
|
"EfsRpcFileKeyInfoEx",
|
|
"EfsRpcFileKeyInfoEx",
|
|
"EfsRpcFlushEfsCache",
|
|
"EfsRpcEncryptFileExSrv",
|
|
"EfsRpcQueryProtectors",
|
|
"EfsRpcWriteFileWithHeaderRaw",
|
|
"EdpRpcCredentialCreate",
|
|
"EdpRpcCredentialQuery",
|
|
"EdpRpcCredentialExists",
|
|
"EdpRpcCredentialDelete",
|
|
"EdpRpcQueryRevokedPolicyOwnerIds",
|
|
"EdpRpcQueryDplEnforcedPolicyOwnerIds",
|
|
"EdpRpcGetLockSessionWrappedKey",
|
|
"EdpRpcGetLockSessionUnwrappedKey",
|
|
"EdpRpcGetCredServiceState",
|
|
"EdpRpcDplUpgradePinInfo",
|
|
"EdpRpcDplUpgradeVerifyUser",
|
|
"EdpRpcDplUserCredentialsSet",
|
|
"EdpRpcDplUserUnlockStart",
|
|
"EdpRpcDplUserUnlockComplete",
|
|
"EdpRpcQueueFileForEncryption",
|
|
"EdpRpcServiceFileEncryptionQueue",
|
|
"EdpRpcCredSvcControl",
|
|
"EdpRpcRmsClearKeys",
|
|
"EdpRpcRmsContainerizeFile",
|
|
"EdpRpcRmsGetContainerIdentity",
|
|
"EdpRpcRmsDecontainerizeFile",
|
|
"EdpRpcAllowFileAccessForProcess",
|
|
"EdpRpcGetTfaCache",
|
|
"EdpRpcUnprotectFile",
|
|
"EdpRpcPurgeAppLearningEvents",
|
|
"OefsRpcCheckSupport",
|
|
"EdpRpcWriteLogSiteLearningEvents",
|
|
"EfsRpcReprotectFile",
|
|
"EdpRpcIsConsumerProtectionEnforced"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140707880067024,
|
|
"Service": "EFS",
|
|
"IsServiceRunning": false
|
|
},
|
|
"d3c1b64b-cd05-4fb2-bb2c-bb61d80c123e": {
|
|
"Module": "Spectrum.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\Spectrum.exe",
|
|
"InterfaceId": "d3c1b64b-cd05-4fb2-bb2c-bb61d80c123e",
|
|
"InterfaceStructOffset": 726992,
|
|
"ProceduresCount": 50,
|
|
"Procedures": [
|
|
"S_System_Connect",
|
|
"S_System_Disconnect",
|
|
"S_System_DrainSensorData",
|
|
"S_System_SetSensorRefs",
|
|
"S_Capability_GetRequestedAccessState",
|
|
"S_Capability_RequestAccess",
|
|
"S_PVCamCalibrator_GetPVCamCalibration",
|
|
"S_SecondaryHead_GetUpdates",
|
|
"S_SecondaryHead_GetCalibration",
|
|
"S_Stage_GetCurrent",
|
|
"S_GestureRecognizer_GetParams",
|
|
"S_HeadTracker_RegisterActiveLocation",
|
|
"S_HeadTracker_RegisterLocation",
|
|
"S_HeadTracker_UnregisterLocation",
|
|
"S_HeadTracker_PersistedLocations",
|
|
"S_HeadTracker_PersistLocation",
|
|
"S_HeadTracker_UnpersistLocation",
|
|
"S_HeadTracker_GetAugmentedPoseForTime",
|
|
"S_HeadTracker_GenerateRenderingMetadataForPose",
|
|
"S_HeadTracker_GetAugmentedPoseForSerializedRigPose",
|
|
"S_HeadTracker_GetHeTLayoutBuffer",
|
|
"S_HeadTracker_SetRequestedMrcStatus",
|
|
"S_HeadTracker_GetRequestedMrcStatus",
|
|
"S_HeadTracker_SetupExportAnchors",
|
|
"S_HeadTracker_SetupImportAnchors",
|
|
"S_HeadTracker_SetupGetNeighborhoodData",
|
|
"S_HeadTracker_SetupGetNeighborhoodDataStatus",
|
|
"S_HeadTracker_GetDeviceID",
|
|
"S_Display_GetDisplays",
|
|
"S_Display_GetDisplayCalibration",
|
|
"S_Display_RenderingMetadataSharedBuffer",
|
|
"S_Display_GetDisplayAreaMesh",
|
|
"S_Display_GetIsUserPresent",
|
|
"S_Display_ContainsDevice",
|
|
"S_Display_SetIPD",
|
|
"S_Display_GetIPD",
|
|
"S_Display_GetIPDAdjustmentCapability",
|
|
"S_Display_GetPrimaryAdapterId",
|
|
"S_Surfaces_IsSupported",
|
|
"S_Surfaces_GetSRBuffer",
|
|
"S_Surfaces_FetchMesh",
|
|
"S_SpatialDevice_FindById",
|
|
"S_SpatialDevice_GetAllDevices",
|
|
"S_SpatialDevice_GetOrCreateGlobal",
|
|
"S_SpatialDevice_CreateAppLocal",
|
|
"S_SpatialDevice_ComputeSpatialGraphBinding",
|
|
"S_SpatialDevice_SetDesiredTrackingLevel",
|
|
"S_SpatialDevice_GetLastKnownTrackerMode",
|
|
"S_SpatialGraph_GetSpatialDeviceForFloor",
|
|
"S_SpatialDevice_GetDynamicNodePoseQueueLayoutBuffer"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140701106670448,
|
|
"Service": "spectrum",
|
|
"IsServiceRunning": false
|
|
},
|
|
"4ed8abcc-f1e2-438b-981f-bb0e8abc010c": {
|
|
"Module": "PsmServiceExtHost.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\PsmServiceExtHost.dll",
|
|
"InterfaceId": "4ed8abcc-f1e2-438b-981f-bb0e8abc010c",
|
|
"InterfaceStructOffset": 565648,
|
|
"ProceduresCount": 4,
|
|
"Procedures": [
|
|
"HamRpcSrvConnectStateChangeNotifications",
|
|
"HamRpcSrvDisconnect",
|
|
"HamRpcSrvGetApplicationStateForPsmKey",
|
|
"HamRpcSrvTerminateIfSuspendedByProcess"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140708133772976,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"56244243-3ed3-4013-b3e7-0fc809e35fba": {
|
|
"Module": "wephostsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\wephostsvc.dll",
|
|
"InterfaceId": "56244243-3ed3-4013-b3e7-0fc809e35fba",
|
|
"InterfaceStructOffset": 17424,
|
|
"ProceduresCount": 8,
|
|
"Procedures": [
|
|
"s_QueryProtectionStatus",
|
|
"s_IsDeviceLockable",
|
|
"s_LockDevice",
|
|
"s_GetDeviceLockoutData",
|
|
"s_ValidateDeviceLockoutState",
|
|
"s_UpdateDeviceLockoutState",
|
|
"s_DisableDeviceLockoutState",
|
|
"s_GetDeviceLockoutSize"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140708037796368,
|
|
"Service": "WEPHOSTSVC",
|
|
"IsServiceRunning": false
|
|
},
|
|
"6d809348-7e6c-41b9-91bc-630fe5503d66": {
|
|
"Module": "AppVEntSubsystemController.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\AppVEntSubsystemController.dll",
|
|
"InterfaceId": "6d809348-7e6c-41b9-91bc-630fe5503d66",
|
|
"InterfaceStructOffset": 900944,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"vobjects_server_GetObjectExclusions"
|
|
],
|
|
"ProcStackSize": 72,
|
|
"DispatchFunction": 140706797802416,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"e1ac57d7-2eeb-4553-b980-f80c69a9e0f7": {
|
|
"Module": "combase.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\combase.dll",
|
|
"InterfaceId": "e1ac57d7-2eeb-4553-b980-f80c69a9e0f7",
|
|
"InterfaceStructOffset": 2274448,
|
|
"ProceduresCount": 0,
|
|
"Procedures": [],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140707382121168,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"81ee95a8-882e-4615-888a-53344ca149e4": {
|
|
"Module": "vpnike.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\vpnike.dll",
|
|
"InterfaceId": "81ee95a8-882e-4615-888a-53344ca149e4",
|
|
"InterfaceStructOffset": 480064,
|
|
"ProceduresCount": 18,
|
|
"Procedures": [
|
|
"VpnikeCreateTunnel",
|
|
"VpnikeUpdateTunnel",
|
|
"VpnikeCloseTunnel",
|
|
"VpnikeGetCfgPayloadRequest",
|
|
"VpnikeProcessCfgPayloadReply",
|
|
"VpnikeProcessCfgPayloadRequest",
|
|
"VpnikeNewRasIncomingCall",
|
|
"VpnikeGetTsRequest",
|
|
"VpnikeProcessTsReply",
|
|
"VpnikeProcessTsRequest",
|
|
"VpnikeRemoveTs",
|
|
"VpnikeGetServerEapAuthRequestPacket",
|
|
"VpnikeProcessEapAuthPacket",
|
|
"VpnikeQueryEapAuthAttributes",
|
|
"VpnIkeProcessAdditionalAddressNotification",
|
|
"VpnikeCreateIDPayload",
|
|
"VpnikeTunnelAuthDone",
|
|
"VpnikeCreateOptionalIDrPayload"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140707795823200,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"4c8d0bef-d7f1-49f0-9102-caa05f58d114": {
|
|
"Module": "nlasvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\nlasvc.dll",
|
|
"InterfaceId": "4c8d0bef-d7f1-49f0-9102-caa05f58d114",
|
|
"InterfaceStructOffset": 294912,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"RPCQueryLANIds"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140708037538960,
|
|
"Service": "NlaSvc",
|
|
"IsServiceRunning": true
|
|
},
|
|
"b35534c5-a66e-473f-afa3-a4b21c02ea27": {
|
|
"Module": "WaaSMedicAgent.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\WaaSMedicAgent.exe",
|
|
"InterfaceId": "b35534c5-a66e-473f-afa3-a4b21c02ea27",
|
|
"InterfaceStructOffset": 50080,
|
|
"ProceduresCount": 4,
|
|
"Procedures": [
|
|
"PluginAction",
|
|
"LoadPluginLibrary",
|
|
"FreePluginLibrary",
|
|
"Shutdown"
|
|
],
|
|
"ProcStackSize": 8,
|
|
"DispatchFunction": 140696469456784,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"178d84be-9291-4994-82c6-3f909aca5a03": {
|
|
"Module": "PsmServiceExtHost.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\PsmServiceExtHost.dll",
|
|
"InterfaceId": "178d84be-9291-4994-82c6-3f909aca5a03",
|
|
"InterfaceStructOffset": 562448,
|
|
"ProceduresCount": 5,
|
|
"Procedures": [
|
|
"RmGameModeRSrvRegisterProcess",
|
|
"RmGameModeRSrvUnregisterProcess",
|
|
"RmGameModeRSrvDisableForRegisteredProcess",
|
|
"RmGameModeRSrvReenableForRegisteredProcess",
|
|
"RmGameModeRSrvRegisterPairedAuxiliaryProcess"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140708133698688,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"5f54ce7d-5b79-4175-8584-cb65313a0e98": {
|
|
"Module": "appinfo.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\appinfo.dll",
|
|
"InterfaceId": "5f54ce7d-5b79-4175-8584-cb65313a0e98",
|
|
"InterfaceStructOffset": 106784,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"RAiGetTokenForCOM"
|
|
],
|
|
"ProcStackSize": 120,
|
|
"DispatchFunction": 140707486598080,
|
|
"Service": "Appinfo",
|
|
"IsServiceRunning": true
|
|
},
|
|
"de2daf3b-5c16-4613-b204-d810ee629d9e": {
|
|
"Module": "wwansvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\wwansvc.dll",
|
|
"InterfaceId": "de2daf3b-5c16-4613-b204-d810ee629d9e",
|
|
"InterfaceStructOffset": 1118336,
|
|
"ProceduresCount": 15,
|
|
"Procedures": [
|
|
"RpcSetPowerState",
|
|
"RpcScanForAvailableOperators",
|
|
"RpcSaveRegistrationPreferences",
|
|
"RpcGet2GSupportSettings",
|
|
"RpcInform2GSettingsChanges",
|
|
"RpcSetCanPowerState",
|
|
"RpcSetLocationUpdateFilterOverride",
|
|
"RpcSetDataAffinityForSlot",
|
|
"RpcSetFriendlyName",
|
|
"RpcArdActivated",
|
|
"RpcSavePin",
|
|
"RpcGetMccFromSidNid",
|
|
"RpcSwitchToNextCDMANetwork",
|
|
"RpcUpdateIWLANPreferences",
|
|
"RpcSavePSMediaPreferences"
|
|
],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140707093623584,
|
|
"Service": "WwanSvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"aa411582-9bdf-48fb-b42b-faa1eee33949": {
|
|
"Module": "nlasvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\nlasvc.dll",
|
|
"InterfaceId": "aa411582-9bdf-48fb-b42b-faa1eee33949",
|
|
"InterfaceStructOffset": 295104,
|
|
"ProceduresCount": 3,
|
|
"Procedures": [
|
|
"PMuxRpcPluginRegister",
|
|
"PMuxRpcPluginUnregister",
|
|
"PMuxRpcPluginDataIndicate"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140708037368176,
|
|
"Service": "NlaSvc",
|
|
"IsServiceRunning": true
|
|
},
|
|
"2d24ff0b-1bab-404c-a0fd-42c85577bf68": {
|
|
"Module": "NgcCtnrSvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\NgcCtnrSvc.dll",
|
|
"InterfaceId": "2d24ff0b-1bab-404c-a0fd-42c85577bf68",
|
|
"InterfaceStructOffset": 545296,
|
|
"ProceduresCount": 25,
|
|
"Procedures": [
|
|
"s_NgcHandlerRpcAuthenticateGesture",
|
|
"s_NgcHandlerRpcDeauthenticate",
|
|
"s_NgcHandlerRpcChangePin",
|
|
"s_NgcHandlerRpcRecoverPin",
|
|
"s_NgcHandlerRpcAddBioProtector",
|
|
"s_NgcHandlerRpcRemoveBioProtector",
|
|
"s_NgcHandlerRpcAddPrebootProtector",
|
|
"s_NgcHandlerRpcRemovePrebootProtector",
|
|
"s_NgcHandlerRpcAddCompanionDeviceProtector",
|
|
"s_NgcHandlerRpcRemoveCompanionDeviceProtector",
|
|
"s_NgcHandlerRpcRsaSignWithPkcs1",
|
|
"s_NgcHandlerRpcRsaDecryptWithPkcs1",
|
|
"s_NgcHandlerRpcRsaCreateKey",
|
|
"s_NgcHandlerRpcRsaImportKey",
|
|
"s_NgcHandlerRpcExportKey",
|
|
"s_NgcHandlerRpcRsaExportPublicKey",
|
|
"s_NgcHandlerRpcRsaDeleteKey",
|
|
"s_NgcHandlerRpcEnumContainers",
|
|
"s_NgcHandlerRpcEnumKeys",
|
|
"s_NgcHandlerRpcSetKeyMetadata",
|
|
"s_NgcHandlerRpcGetKeyMetadata",
|
|
"s_NgcHandlerRpcSetContainerMetadata",
|
|
"s_NgcHandlerRpcGetContainerMetadata",
|
|
"s_NgcHandlerRpcGetKeyAikCertificate",
|
|
"s_NgcHandlerRpcCreateClaim"
|
|
],
|
|
"ProcStackSize": 88,
|
|
"DispatchFunction": 140707093988480,
|
|
"Service": "NgcCtnrSvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"c6b5235a-e413-481d-9ac8-31681b1faaf5": {
|
|
"Module": "SCardSvr.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\SCardSvr.dll",
|
|
"InterfaceId": "c6b5235a-e413-481d-9ac8-31681b1faaf5",
|
|
"InterfaceStructOffset": 173456,
|
|
"ProceduresCount": 20,
|
|
"Procedures": [
|
|
"s_RPC_SCardBeginTransaction",
|
|
"s_RPC_SCardCancel",
|
|
"s_RPC_SCardConnect",
|
|
"s_RPC_SCardControl",
|
|
"s_RPC_SCardDisconnect",
|
|
"s_RPC_SCardEndTransaction",
|
|
"s_RPC_SCardEstablishContext",
|
|
"s_RPC_SCardGetAttrib",
|
|
"s_RPC_SCardGetStatusChange",
|
|
"s_RPC_SCardGetTransmitCount",
|
|
"s_RPC_SCardIsValidContext",
|
|
"s_RPC_SCardListReaders",
|
|
"s_RPC_SCardLocateCards",
|
|
"s_RPC_SCardReconnect",
|
|
"s_RPC_SCardReleaseContext",
|
|
"s_RPC_SCardSetAttrib",
|
|
"s_RPC_SCardStatus",
|
|
"s_RPC_SCardTransmit",
|
|
"s_RPC_SCardGetReaderDeviceInstanceId",
|
|
"s_RPC_SCardGetDeviceTypeId"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140707581067088,
|
|
"Service": "SCardSvr",
|
|
"IsServiceRunning": false
|
|
},
|
|
"f26e2372-d601-44f0-84b8-2591d2af2f82": {
|
|
"Module": "PhoneService.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\PhoneService.dll",
|
|
"InterfaceId": "f26e2372-d601-44f0-84b8-2591d2af2f82",
|
|
"InterfaceStructOffset": 787024,
|
|
"ProceduresCount": 36,
|
|
"Procedures": [
|
|
"PhoneSvcImpl_PhoneRpcCallVoicemail",
|
|
"PhoneSvcImpl_PhoneRpcPublicDial",
|
|
"PhoneSvcImpl_PhoneRpcCallCapabilityAccessCheck",
|
|
"PhoneSvcImpl_PhoneRpcGetLinePublicInfo",
|
|
"PhoneSvcImpl_PhoneRpcGetLinePublicInfoExtended",
|
|
"PhoneSvcImpl_PhoneRpcGetLinePublicSettings",
|
|
"PhoneSvcImpl_PhoneRpcGetDefaultOutgoingLine",
|
|
"PhoneSvcImpl_PhoneRpcGetCallFilteringEnabled",
|
|
"PhoneSvcImpl_PhoneRpcIsEmergencyNumber",
|
|
"PhoneSvcImpl_PhoneRpcIsImmediateDialString",
|
|
"PhoneSvcImpl_PhoneRpcGetLines",
|
|
"PhoneSvcImpl_PhoneRpcAdvise",
|
|
"PhoneSvcImpl_PhoneRpcUnadvise",
|
|
"PhoneSvcImpl_PhoneRpcGetNotifyData",
|
|
"PhoneSvcImpl_PhoneRpcIsPhoneNumberInBlockList",
|
|
"PhoneSvcImpl_PhoneRpcGetActiveSpamFilterApp",
|
|
"PhoneSvcImpl_PhoneRpcSetBlockPrivateNumbersSetting",
|
|
"PhoneSvcImpl_PhoneRpcGetBlockPrivateNumbersSetting",
|
|
"PhoneSvcImpl_PhoneRpcSetBlockUnknownNumbersSetting",
|
|
"PhoneSvcImpl_PhoneRpcGetBlockUnknownNumbersSetting",
|
|
"PhoneSvcImpl_PhoneRpcSetFilterAppBlockList",
|
|
"PhoneSvcImpl_PhoneRpcSetCallOriginInfo",
|
|
"PhoneSvcImpl_PhoneRpcSetCallerAsActiveAppByType",
|
|
"PhoneSvcImpl_PhoneRpcGetActiveAppByType",
|
|
"PhoneSvcImpl_PhoneRpcGetDeviceSupportsVideoCalling",
|
|
"PhoneSvcImpl_PhoneRpcGetDeviceRealTimeTextEnabled",
|
|
"PhoneSvcImpl_PhoneRpcGetDeviceRealTimeTextAutomaticEnabled",
|
|
"PhoneSvcImpl_PhoneRpcGetRecordingApplications",
|
|
"PhoneSvcImpl_PhoneRpcSetRecordingApplication",
|
|
"PhoneSvcImpl_PhoneRpcGetVideoCapabilities",
|
|
"PhoneSvcImpl_PhoneRpcGetShouldMuteKeypad",
|
|
"PhoneSvcImpl_PhoneRpcIsVideoCallingEnabled",
|
|
"PhoneSvcImpl_PhoneRpcGetBluetoothHandsFreeLineInfo",
|
|
"PhoneSvcImpl_PhoneRpcAddLineCapabilities",
|
|
"PhoneSvcImpl_PhoneRpcRemoveLineCapabilities",
|
|
"PhoneSvcImpl_PhoneRpcIsCallOriginManagerSupported"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140707094340384,
|
|
"Service": "PhoneSvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"cb40a179-20e1-43f0-97fb-3c5c6ff37ec3": {
|
|
"Module": "rpcss.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\rpcss.dll",
|
|
"InterfaceId": "cb40a179-20e1-43f0-97fb-3c5c6ff37ec3",
|
|
"InterfaceStructOffset": 978784,
|
|
"ProceduresCount": 6,
|
|
"Procedures": [
|
|
"GetCrossContainerServerInfo",
|
|
"CreateCrossContainerOidSet",
|
|
"DeleteCrossContainerOidSet",
|
|
"CrossContainerActivation",
|
|
"CrossContainerResolveOxid",
|
|
"CrossContainerBulkUpdateOids"
|
|
],
|
|
"ProcStackSize": 96,
|
|
"DispatchFunction": 140708135528576,
|
|
"Service": "RpcSs",
|
|
"IsServiceRunning": true
|
|
},
|
|
"420bca2f-a0e8-45f4-a8ff-906745e8876c": {
|
|
"Module": "DeviceSetupManager.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\DeviceSetupManager.dll",
|
|
"InterfaceId": "420bca2f-a0e8-45f4-a8ff-906745e8876c",
|
|
"InterfaceStructOffset": 167936,
|
|
"ProceduresCount": 3,
|
|
"Procedures": [
|
|
"DsmRpcOpenDevice",
|
|
"DsmRpcCloseDevice",
|
|
"DsmRpcGetDeviceNotification"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140707581087440,
|
|
"Service": "DsmSvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"76f226c3-ec14-4325-8a99-6a46348418af": {
|
|
"Module": "wininit.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\wininit.exe",
|
|
"InterfaceId": "76f226c3-ec14-4325-8a99-6a46348418af",
|
|
"InterfaceStructOffset": 296304,
|
|
"ProceduresCount": 5,
|
|
"Procedures": [
|
|
"I_WMsgSendMessage",
|
|
"I_WMsgSendPSPMessage",
|
|
"I_WMsgSendNotifyMessage",
|
|
"I_WMsgSendReconnectionUpdateMessage",
|
|
"I_WMsgGetSwitchUserLogonInfo"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140699626706192,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"06bba54a-be05-49f9-b0a0-30f790261023": {
|
|
"Module": "wscsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\wscsvc.dll",
|
|
"InterfaceId": "06bba54a-be05-49f9-b0a0-30f790261023",
|
|
"InterfaceStructOffset": 233904,
|
|
"ProceduresCount": 28,
|
|
"Procedures": [
|
|
"DrawTextExW",
|
|
"s_wscRegisterChangeNotification",
|
|
"s_wscUnRegisterChangeNotification",
|
|
"s_wscGetAlertStatus",
|
|
"s_wscAntiVirusExpiredBeyondThreshold",
|
|
"s_wscAntiVirusExpiredBeyondThreshold",
|
|
"s_wscAntiVirusExpiredBeyondThreshold",
|
|
"s_wscFirewallGetStatus",
|
|
"s_wscIcfEnable",
|
|
"s_wscAntiVirusGetStatus",
|
|
"s_wscAntiSpywareGetStatus",
|
|
"s_wscGeneralSecurityGetStatus",
|
|
"s_wscLuaSettingsFix",
|
|
"s_wscRegisterSecurityProduct",
|
|
"s_wscUnregisterSecurityProduct",
|
|
"s_wscUpdateProductStatus",
|
|
"s_wscAntiVirusExpiredBeyondThreshold",
|
|
"s_wscIsDefenderAntivirusSupported",
|
|
"s_wscUserNotificationRequired",
|
|
"s_wscInitiateOfflineCleaning",
|
|
"s_wscAbortOfflineCleaning",
|
|
"s_wscNotifyUserForNearExpiration",
|
|
"s_wscAntiVirusGetUpgradableProducts",
|
|
"s_wscAntiVirusRemoveUpgradableProduct",
|
|
"s_wscAntiVirusGetRemovedButNotUpgradableProducts",
|
|
"s_wscMakeDefaultProductRequest",
|
|
"s_wscSetDefaultProduct",
|
|
"s_wscUpdateProductSubStatus"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140707589576992,
|
|
"Service": "wscsvc",
|
|
"IsServiceRunning": true
|
|
},
|
|
"c521facf-09a9-42c5-b155-72388595cbf0": {
|
|
"Module": "PsmServiceExtHost.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\PsmServiceExtHost.dll",
|
|
"InterfaceId": "c521facf-09a9-42c5-b155-72388595cbf0",
|
|
"InterfaceStructOffset": 558144,
|
|
"ProceduresCount": 8,
|
|
"Procedures": [
|
|
"RmtSrv_RM_ConnectToServer",
|
|
"RmtSrv_RM_DisconnectFromServer",
|
|
"RmtSrv_RM_AcquireResourceSet",
|
|
"RmtSrv_RS_Apply",
|
|
"RmtSrv_RS_ReleaseResources",
|
|
"OnAccessLost",
|
|
"RmtSrv_RS_SetExternalResourcePriorities",
|
|
"OnAccessLost"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140708133530576,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"ae2dc901-312d-41df-8b79-e835e63db874": {
|
|
"Module": "AppXDeploymentServer.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\AppXDeploymentServer.dll",
|
|
"InterfaceId": "ae2dc901-312d-41df-8b79-e835e63db874",
|
|
"InterfaceStructOffset": 2609472,
|
|
"ProceduresCount": 63,
|
|
"Procedures": [
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"MergeSystemResourceFilesImplementation",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"MergeSystemResourceFilesImplementation",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140706734141664,
|
|
"Service": "AppXSvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"c0d930f0-b787-4124-99bc-21f0ecb642ce": {
|
|
"Module": "lsasrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\lsasrv.dll",
|
|
"InterfaceId": "c0d930f0-b787-4124-99bc-21f0ecb642ce",
|
|
"InterfaceStructOffset": 1269856,
|
|
"ProceduresCount": 7,
|
|
"Procedures": [
|
|
"LsarConnectLocalUser",
|
|
"LsarDisconnectLocalUser",
|
|
"LsarCreateConnectedUser",
|
|
"LsarIsCurrentUserConnected",
|
|
"LsarRenewCertificate",
|
|
"LsarGetSSOAccountType",
|
|
"LsarIsUserMSA"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140708154214960,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"e00c29a5-0f62-4d84-b7f0-d2387e41ed18": {
|
|
"Module": "tetheringservice.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\tetheringservice.dll",
|
|
"InterfaceId": "e00c29a5-0f62-4d84-b7f0-d2387e41ed18",
|
|
"InterfaceStructOffset": 179792,
|
|
"ProceduresCount": 16,
|
|
"Procedures": [
|
|
"TetheringSvcGetSharingState",
|
|
"TetheringSvcGetDefaultInterface",
|
|
"TetheringSvcStartSharing",
|
|
"TetheringSvcStopSharing",
|
|
"TetheringSvcGetLastApiError",
|
|
"TetheringSvcGetConfiguration",
|
|
"TetheringSvcSetConfiguration",
|
|
"TetheringSvcGetPeerList",
|
|
"TetheringSvcGetSharedInterfaceIndices",
|
|
"TetheringSvcGetMaxClientCount",
|
|
"TetheringSvcAuthorize",
|
|
"TetheringSvcGetErrorString",
|
|
"TetheringSvcRpcSetPreferredInterface",
|
|
"TetheringSvcRpcGetPreferredInterface",
|
|
"TetheringSvcGetIsPeerlessTimeoutEnabled",
|
|
"TetheringSvcSetIsPeerlessTimeoutEnabled"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140707581026592,
|
|
"Service": "icssvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"6c323e3f-585f-4432-8a2e-0719fb35e48b": {
|
|
"Module": "SenseCE.exe",
|
|
"ModulePath": "C:\\Windows\\WinSxS\\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.18362.1916_none_b57d3553f248f034\\SenseCE.exe",
|
|
"InterfaceId": "6c323e3f-585f-4432-8a2e-0719fb35e48b",
|
|
"InterfaceStructOffset": 269328,
|
|
"ProceduresCount": 7,
|
|
"Procedures": [
|
|
"Init",
|
|
"ParseFile",
|
|
"ClassifyFile",
|
|
"OpenArchiveFile",
|
|
"GetNextDlpFileName",
|
|
"DumpNextDlpFile",
|
|
"GetArchiveFileData"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140701284818768,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"fdb3a030-065f-11d1-bb9b-00a024ea5525": {
|
|
"Module": "mqqm.dll",
|
|
"ModulePath": "C:\\Windows\\WinSxS\\amd64_microsoft-windows-msmq-queuemanager-core_31bf3856ad364e35_10.0.18362.1977_none_8d1646dec2a87b94\\mqqm.dll",
|
|
"InterfaceId": "fdb3a030-065f-11d1-bb9b-00a024ea5525",
|
|
"InterfaceStructOffset": 1012048,
|
|
"ProceduresCount": 35,
|
|
"Procedures": [
|
|
"qmcomm_v1_0_S_QMOpenQueue",
|
|
"qmcomm_v1_0_S_QMGetRemoteQueueName",
|
|
"qmcomm_v1_0_S_QMOpenRemoteQueue",
|
|
"qmcomm_v1_0_S_QMCloseRemoteQueueContext",
|
|
"qmcomm_v1_0_S_QMCreateRemoteCursor",
|
|
"qmcomm_v1_0_S_QMSendMessageInternal",
|
|
"qmcomm_v1_0_S_QMCreateObjectInternal",
|
|
"qmcomm_v1_0_S_QMSetObjectSecurityInternal",
|
|
"qmcomm_v1_0_S_QMGetObjectSecurityInternal",
|
|
"qmcomm_v1_0_S_QMDeleteObject",
|
|
"qmcomm_v1_0_S_QMGetObjectProperties",
|
|
"qmcomm_v1_0_S_QMSetObjectProperties",
|
|
"qmcomm_v1_0_S_QMObjectPathToObjectFormat",
|
|
"qmcomm_v1_0_S_QMAttachProcess",
|
|
"qmcomm_v1_0_S_QMGetTmWhereabouts",
|
|
"qmcomm_v1_0_S_QMEnlistTransaction",
|
|
"qmcomm_v1_0_S_QMEnlistInternalTransaction",
|
|
"qmcomm_v1_0_S_QMCommitTransaction",
|
|
"qmcomm_v1_0_S_QMAbortTransaction",
|
|
"qmcomm_v1_0_S_rpc_QMOpenQueueInternal",
|
|
"qmcomm_v1_0_S_rpc_ACCloseHandle",
|
|
"qmcomm_v1_0_S_rpc_ACCreateCursor",
|
|
"qmcomm_v1_0_S_rpc_ACCloseCursor",
|
|
"qmcomm_v1_0_S_rpc_ACSetCursorProperties",
|
|
"qmcomm_v1_0_S_rpc_ACSendMessage",
|
|
"qmcomm_v1_0_S_rpc_ACReceiveMessage",
|
|
"qmcomm_v1_0_S_rpc_ACHandleToFormatName",
|
|
"qmcomm_v1_0_S_rpc_ACPurgeQueue",
|
|
"qmcomm_v1_0_S_QMQueryQMRegistryInternal",
|
|
"qmcomm_v1_0_S_QMListInternalQueues",
|
|
"qmcomm_v1_0_S_QMCorrectOutSequence",
|
|
"qm2qm_v1_0_R_QMGetRemoteQMServerPort",
|
|
"qmcomm_v1_0_S_QMGetMsmqServiceName",
|
|
"qmcomm_v1_0_S_QMCreateDSObjectInternal",
|
|
"qmcomm_v1_0_S_QMEnlistTransactionEx"
|
|
],
|
|
"ProcStackSize": 64,
|
|
"DispatchFunction": 140707093285248,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"3919286a-b10c-11d0-9ba8-00c04fd92ef5": {
|
|
"Module": "lsasrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\lsasrv.dll",
|
|
"InterfaceId": "3919286a-b10c-11d0-9ba8-00c04fd92ef5",
|
|
"InterfaceStructOffset": 1269760,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"DsRolerGetPrimaryDomainInformation"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140708153128080,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"1088a980-eae5-11d0-8d9b-00a02453c337": {
|
|
"Module": "mqqm.dll",
|
|
"ModulePath": "C:\\Windows\\WinSxS\\amd64_microsoft-windows-msmq-queuemanager-core_31bf3856ad364e35_10.0.18362.1977_none_8d1646dec2a87b94\\mqqm.dll",
|
|
"InterfaceId": "1088a980-eae5-11d0-8d9b-00a02453c337",
|
|
"InterfaceStructOffset": 979840,
|
|
"ProceduresCount": 11,
|
|
"Procedures": [
|
|
"qm2qm_v1_0_R_QMRemoteStartReceive",
|
|
"qm2qm_v1_0_R_QMRemoteEndReceive",
|
|
"qm2qm_v1_0_R_QMRemoteOpenQueue",
|
|
"qm2qm_v1_0_R_QMRemoteCloseQueue",
|
|
"qm2qm_v1_0_R_QMRemoteCloseCursor",
|
|
"qm2qm_v1_0_R_QMRemoteCancelReceive",
|
|
"qm2qm_v1_0_R_QMRemotePurgeQueue",
|
|
"qm2qm_v1_0_R_QMGetRemoteQMServerPort",
|
|
"qm2qm_v1_0_R_QMRemoteGetVersion",
|
|
"qm2qm_v1_0_R_QMRemoteStartReceive2",
|
|
"qm2qm_v1_0_R_QMRemoteStartReceiveByLookupId"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140707093325904,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"7df1ceae-de4e-4e6f-ab14-49636e7c2052": {
|
|
"Module": "diagtrack.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\diagtrack.dll",
|
|
"InterfaceId": "7df1ceae-de4e-4e6f-ab14-49636e7c2052",
|
|
"InterfaceStructOffset": 2764704,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"UtcInternalApi_SendAggregatorEvents"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140707991506176,
|
|
"Service": "DiagTrack",
|
|
"IsServiceRunning": true
|
|
},
|
|
"326731e3-c1c0-4a69-ae20-7d9044a4ea5c": {
|
|
"Module": "profsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\profsvc.dll",
|
|
"InterfaceId": "326731e3-c1c0-4a69-ae20-7d9044a4ea5c",
|
|
"InterfaceStructOffset": 307808,
|
|
"ProceduresCount": 8,
|
|
"Procedures": [
|
|
"DropClientContext",
|
|
"ReleaseClientContext",
|
|
"LoadUserProfileServer",
|
|
"UnloadUserProfileServer",
|
|
"DeleteProfileServer",
|
|
"RemapProfileServer",
|
|
"CreateProfileServer",
|
|
"ProcessWmiSettingsServer"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140708064859888,
|
|
"Service": "ProfSvc",
|
|
"IsServiceRunning": true
|
|
},
|
|
"e8748f69-a2a4-40df-9366-62dbeb696e26": {
|
|
"Module": "Unistore.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\Unistore.dll",
|
|
"InterfaceId": "e8748f69-a2a4-40df-9366-62dbeb696e26",
|
|
"InterfaceStructOffset": 812192,
|
|
"ProceduresCount": 212,
|
|
"Procedures": [
|
|
"USSvcImpl_Object_Close",
|
|
"USSvcImpl_RegisterRundownProtection",
|
|
"USSvcImpl_ConvertToOtherObject",
|
|
"USSvcImpl_Manager_Create",
|
|
"USSvcImpl_Manager_CreateStoreGrouping",
|
|
"USSvcImpl_Manager_CreateStore",
|
|
"USSvcImpl_Manager_GetDeviceStore",
|
|
"USSvcImpl_Manager_GetDeviceStoreOid",
|
|
"USSvcImpl_Manager_GetHighestStoreBitPosition",
|
|
"USSvcImpl_Manager_GetStore",
|
|
"USSvcImpl_Manager_GetStoreCollection",
|
|
"USSvcImpl_Manager_Notify",
|
|
"USSvcImpl_Manager_CustomNotify",
|
|
"USSvcImpl_Manager_GetObjectByOid",
|
|
"USSvcImpl_Manager_GetAllEmbeddedObjects",
|
|
"USSvcImpl_Manager_GetAllItems",
|
|
"USSvcImpl_Manager_GetTypeManager",
|
|
"USSvcImpl_Manager_StartTransaction",
|
|
"USSvcImpl_Manager_EndTransaction",
|
|
"USSvcImpl_Manager_CleanupTombstones",
|
|
"USSvcImpl_Manager_GetStreamFilePath",
|
|
"USSvcImpl_Manager_CleanupTemporaryFolders",
|
|
"USSvcImpl_Manager_GetAllAggregateObjects",
|
|
"USSvcImpl_Manager_GetAllObjects",
|
|
"USSvcImpl_Manager_GetBatchedPropValsFromIdsBlob",
|
|
"USSvcImpl_Manager_GetPropValsFromIdBlob",
|
|
"USSvcImpl_Manager_MapNamedProps",
|
|
"USSvcImpl_Manager_GetDefaultPIMStoreId",
|
|
"USSvcImpl_Manager_SetDefaultPIMStoreId",
|
|
"USSvcImpl_Manager_GetUnistoreDatabaseRefreshTime",
|
|
"USSvcImpl_ManagerPriv_put_DeviceStoreId",
|
|
"USSvcImpl_ManagerPriv_GetNotificationsManager",
|
|
"USSvcImpl_ManagerPriv_UnmapNamedProps",
|
|
"USSvcImpl_ManagerPriv_GetPerfStats",
|
|
"USSvcImpl_ManagerPriv_ResetPerfStats",
|
|
"USSvcImpl_ManagerPriv_ToggleRecordingPerfStats",
|
|
"USSvcImpl_ManagerPriv_BackupStoreVolume",
|
|
"USSvcImpl_ManagerPriv_SetToSuspending",
|
|
"USSvcImpl_ManagerPriv_SetToResumed",
|
|
"USSvcImpl_NotificationManager_Advise",
|
|
"USSvcImpl_NotificationManager_Unadvise",
|
|
"USSvcImpl_NotificationManager_Notify",
|
|
"USSvcImpl_NotificationManager_SuspendNotifications",
|
|
"USSvcImpl_NotificationManager_ResumeNotifications",
|
|
"USSvcImpl_NotificationManager_FilterProcessEventsForTests",
|
|
"USSvcImpl_NotificationManager_GetAdviseContent",
|
|
"USSvcImpl_Object_GetOid",
|
|
"USSvcImpl_Object_Delete",
|
|
"USSvcImpl_Object_GetPropValsBlob",
|
|
"USSvcImpl_Object_GetAllPropValsBlob",
|
|
"USSvcImpl_Object_SetPropVals",
|
|
"USSvcImpl_Object_SetPropValsEx",
|
|
"USSvcImpl_Object_SetStreamProperty",
|
|
"USSvcImpl_Object_GetStreamProp",
|
|
"USSvcImpl_Object_GetStore",
|
|
"USSvcImpl_Object_GetStreamFilePath",
|
|
"USSvcImpl_Object_GetAssociatedItems",
|
|
"USSvcImpl_Object_CreateEmbeddedObject",
|
|
"USSvcImpl_Object_DeleteEmbeddedObjects",
|
|
"USSvcImpl_Object_GetEmbeddedObjects",
|
|
"USSvcImpl_Object_IncrementRevision",
|
|
"USSvcImpl_Store_GetRootFolder",
|
|
"USSvcImpl_Store_GetObjectByOid",
|
|
"USSvcImpl_Store_CreateAssociateObject",
|
|
"USSvcImpl_Store_GetAssociateObjects",
|
|
"USSvcImpl_Store_GetEmbeddedObjects",
|
|
"USSvcImpl_Store_GetTypeManager",
|
|
"USSvcImpl_Store_Flush",
|
|
"USSvcImpl_Store_AddSyncPartner",
|
|
"USSvcImpl_Store_GetSyncPartner",
|
|
"USSvcImpl_Store_GetSyncPartners",
|
|
"USSvcImpl_Store_StartFetchSession",
|
|
"USSvcImpl_Store_EndFetchSession",
|
|
"USSvcImpl_Store_ThreadInFetchSession",
|
|
"USSvcImpl_Store_CreateAggregateObject",
|
|
"USSvcImpl_Store_GetAggregateObjects",
|
|
"USSvcImpl_Store_GetDeletedRevisionItems",
|
|
"USSvcImpl_Store_GetLongDeletedRevisionItems",
|
|
"USSvcImpl_Store_ResetLongRevisionChangeTracking",
|
|
"USSvcImpl_Store_UpdateLongRevisionChangeTracking",
|
|
"USSvcImpl_Store_GetLongRevision",
|
|
"USSvcImpl_Store_IsObjectRevisionTracked",
|
|
"USSvcImpl_Store_GetFolders",
|
|
"USSvcImpl_Store_GetStoreGrouping",
|
|
"USSvcImpl_Folder_CreateFolder",
|
|
"USSvcImpl_Folder_CreateItem",
|
|
"USSvcImpl_Folder_DeleteItems",
|
|
"USSvcImpl_Folder_GetChildFolders",
|
|
"USSvcImpl_Folder_GetItems",
|
|
"USSvcImpl_Folder_GetAllItems",
|
|
"USSvcImpl_Folder_GetParent",
|
|
"USSvcImpl_Folder_IsEmpty",
|
|
"USSvcImpl_Folder_CopyToFolder",
|
|
"USSvcImpl_Folder_MoveToFolder",
|
|
"USSvcImpl_Item_DeleteWithFlags",
|
|
"USSvcImpl_Item_GetParent",
|
|
"USSvcImpl_Item_CopyToFolder",
|
|
"USSvcImpl_Item_MoveToFolder",
|
|
"USSvcImpl_Item_AssociateObject",
|
|
"USSvcImpl_Item_DeleteAssociations",
|
|
"USSvcImpl_Item_DeleteAllAssociations",
|
|
"USSvcImpl_Item_GetAssociateObjects",
|
|
"USSvcImpl_Item_GetAggregateObject",
|
|
"USSvcImpl_Item_AggregateObject",
|
|
"USSvcImpl_Item_DeleteAggregation",
|
|
"USSvcImpl_EmbeddeObject_GetItem",
|
|
"USSvcImpl_EmbeddedObject_GetObject",
|
|
"USSvcImpl_AssociatedObject_HasItems",
|
|
"USSvcImpl_AggregateObject_GetAggregatedObjects",
|
|
"USSvcImpl_ObjectCollection_GetCount",
|
|
"USSvcImpl_ObjectCollection_GetCurrentIndex",
|
|
"USSvcImpl_ObjectCollection_GetObject",
|
|
"USSvcImpl_ObjectCollection_GetPropValsBlob",
|
|
"USSvcImpl_ObjectCollection_GetBatchedPropValsBlob",
|
|
"USSvcImpl_ObjectCollection_SetPropValsOnAll",
|
|
"USSvcImpl_ObjectCollection_GetAllPropValsBlob",
|
|
"USSvcImpl_ObjectCollection_Oid",
|
|
"USSvcImpl_ObjectCollection_GetBookmark",
|
|
"USSvcImpl_ObjectCollection_Move",
|
|
"USSvcImpl_ObjectCollection_DeleteAllObjects",
|
|
"USSvcImpl_SyncPartnerEnum_Next",
|
|
"USSvcImpl_SyncPartnerEnum_Skip",
|
|
"USSvcImpl_SyncPartnerEnum_Reset",
|
|
"USSvcImpl_SyncPartnerEnum_Clone",
|
|
"USSvcImpl_TypeManager_MapNamedProps",
|
|
"USSvcImpl_TypeManager_GetSchemaPropertiesFromObjectType",
|
|
"USSvcImpl_Stream_Seek",
|
|
"USSvcImpl_Stream_SetSize",
|
|
"USSvcImpl_Stream_Commit",
|
|
"USSvcImpl_Stream_Revert",
|
|
"USSvcImpl_Stream_LockRegion",
|
|
"USSvcImpl_Stream_UnlockRegion",
|
|
"USSvcImpl_Stream_Stat",
|
|
"USSvcImpl_Stream_Clone",
|
|
"USSvcImpl_Stream_Read",
|
|
"USSvcImpl_Stream_Write",
|
|
"USSvcImpl_SyncPartner_GetPropsBlob",
|
|
"USSvcImpl_SyncPartner_SetProps",
|
|
"USSvcImpl_SyncPartner_GetName",
|
|
"USSvcImpl_SyncPartner_GetGuid",
|
|
"USSvcImpl_SyncPartner_GetStoreId",
|
|
"USSvcImpl_SyncPartner_GetPartnerId",
|
|
"USSvcImpl_SyncPartner_EnableFolderForSync",
|
|
"USSvcImpl_SyncPartner_IsFolderEnabledForSync",
|
|
"USSvcImpl_SyncPartner_HasChanges",
|
|
"USSvcImpl_SyncPartner_GetChangeCount",
|
|
"USSvcImpl_SyncPartner_StartSyncSession",
|
|
"USSvcImpl_SyncPartner_StartSyncSessionNoContext",
|
|
"USSvcImpl_SyncPartner_GetNextChange",
|
|
"USSvcImpl_SyncPartner_GetChangeForObject",
|
|
"USSvcImpl_SyncPartner_SetExceptionOnChange",
|
|
"USSvcImpl_SyncPartner_SetExceptionOnChangeUnits",
|
|
"USSvcImpl_SyncPartner_ResetChangeEnumeration",
|
|
"USSvcImpl_SyncPartner_EndSyncSession",
|
|
"USSvcImpl_SyncPartner_GetRootFolder",
|
|
"USSvcImpl_SyncPartner_LookupFolderObjectId",
|
|
"USSvcImpl_SyncPartner_LookupFolderRemoteId",
|
|
"USSvcImpl_SyncPartner_GetFolders",
|
|
"USSvcImpl_SyncPartner_LookupItemObjectId",
|
|
"USSvcImpl_SyncPartner_UpdateSyncPartnerSchema",
|
|
"USSvcImpl_SyncPartner_Delete",
|
|
"USSvcImpl_SyncPartner_SetMeetingResponse",
|
|
"USSvcImpl_SyncPartner_GetAllMeetingResponses",
|
|
"USSvcImpl_SyncPartner_DefragmentKnowledge",
|
|
"USSvcImpl_ObjectMetadata_GetPropsBlob",
|
|
"USSvcImpl_ObjectMetadata_SetProps",
|
|
"USSvcImpl_ObjectMetadata_GetObjectId",
|
|
"USSvcImpl_ObjectMetadata_GetPartner",
|
|
"USSvcImpl_ObjectMetadata_GetRemoteId",
|
|
"USSvcImpl_ObjectMetadata_SetRemoteId",
|
|
"USSvcImpl_ObjectMetadata_GetParent",
|
|
"USSvcImpl_ObjectMetadata_SetParent",
|
|
"USSvcImpl_ItemMetadata_Move",
|
|
"USSvcImpl_ItemMetadata_SetMeetingResponse",
|
|
"USSvcImpl_ItemMetadata_GetMeetingResponses",
|
|
"USSvcImpl_ItemMetadata_Delete",
|
|
"USSvcImpl_FolderMetadata_GetFolderName",
|
|
"USSvcImpl_FolderMetadata_GetFolderType",
|
|
"USSvcImpl_FolderMetadata_GetRemoteKnowledge",
|
|
"USSvcImpl_FolderMetadata_SetRemoteKnowledge",
|
|
"USSvcImpl_FolderMetadata_AddItem",
|
|
"USSvcImpl_FolderMetadata_LookupItemObjectId",
|
|
"USSvcImpl_FolderMetadata_LookupItemRemoteId",
|
|
"USSvcImpl_FolderMetadata_GetItems",
|
|
"USSvcImpl_FolderMetadata_AddFolder",
|
|
"USSvcImpl_FolderMetadata_LookupFolderObjectId",
|
|
"USSvcImpl_FolderMetadata_LookupFolderRemoteId",
|
|
"USSvcImpl_FolderMetadata_GetChildFolders",
|
|
"USSvcImpl_FolderMetadata_Delete",
|
|
"USSvcImpl_FolderMetadata_DeleteInBatches",
|
|
"USSvcImpl_MeetingResponse_GetResponseId",
|
|
"USSvcImpl_MeetingResponse_GetMeetingMetadata",
|
|
"USSvcImpl_MeetingResponse_GetMeetingPermanentId",
|
|
"USSvcImpl_MeetingResponse_GetMeetingInstanceId",
|
|
"USSvcImpl_MeetingResponse_GetResponseType",
|
|
"USSvcImpl_MeetingResponse_GetMeetingUserComments",
|
|
"USSvcImpl_MeetingResponse_GetPlaceholderMeetingObjectId",
|
|
"USSvcImpl_MeetingResponse_GetPropsBlob",
|
|
"USSvcImpl_MeetingResponse_SetProps",
|
|
"USSvcImpl_MeetingResponse_Delete",
|
|
"USSvcImpl_ItemMetadataEnum_Next",
|
|
"USSvcImpl_ItemMetadataEnum_Skip",
|
|
"USSvcImpl_ItemMetadataEnum_Reset",
|
|
"USSvcImpl_ItemMetadataEnum_Clone",
|
|
"USSvcImpl_FolderMetadataEnum_Next",
|
|
"USSvcImpl_FolderMetadataEnum_Skip",
|
|
"USSvcImpl_FolderMetadataEnum_Reset",
|
|
"USSvcImpl_FolderMetadataEnum_Clone",
|
|
"USSvcImpl_EnumMeetingResponses_Next",
|
|
"USSvcImpl_EnumMeetingResponses_Skip",
|
|
"USSvcImpl_EnumMeetingResponses_Reset",
|
|
"USSvcImpl_EnumMeetingResponses_Clone"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140706535998720,
|
|
"Service": "UnistoreSvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"05ebb278-e114-4ec1-a5a3-096153f300e4": {
|
|
"Module": "tsgqec.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\tsgqec.dll",
|
|
"InterfaceId": "05ebb278-e114-4ec1-a5a3-096153f300e4",
|
|
"InterfaceStructOffset": 46096,
|
|
"ProceduresCount": 5,
|
|
"Procedures": [
|
|
"TsgQecCreateNapConnection",
|
|
"TsgQecNapConnectionGetNapChangeNotify",
|
|
"TsgQecNapConnectionGetSoHRequest",
|
|
"TsgQecNapConnectionProcessSoHResponse",
|
|
"TsgQecNapConnectionTerminate"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140707880905584,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"894de0c0-0d55-11d3-a322-00c04fa321a1": {
|
|
"Module": "wininit.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\wininit.exe",
|
|
"InterfaceId": "894de0c0-0d55-11d3-a322-00c04fa321a1",
|
|
"InterfaceStructOffset": 294368,
|
|
"ProceduresCount": 3,
|
|
"Procedures": [
|
|
"s_BaseInitiateShutdown",
|
|
"s_BaseAbortShutdown",
|
|
"s_BaseInitiateShutdownEx"
|
|
],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140699626688608,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"9fa6aff6-e0ad-48df-a6b4-e64be66a17a1": {
|
|
"Module": "WFDSConMgrSvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\WFDSConMgrSvc.dll",
|
|
"InterfaceId": "9fa6aff6-e0ad-48df-a6b4-e64be66a17a1",
|
|
"InterfaceStructOffset": 524320,
|
|
"ProceduresCount": 17,
|
|
"Procedures": [
|
|
"WFDSConMgrOpenSessionContextRPC",
|
|
"WFDSConMgrOpenSessionContextForMacAddressRPC",
|
|
"WFDSConMgrOpenSessionContextForNotificationRPC",
|
|
"WFDSConMgrCloseSessionContextRPC",
|
|
"WFDSConMgrGetOpenSessionListRPC",
|
|
"WFDSConMgrConnectRPC",
|
|
"WFDSConMgrWriteCeremonyDataRPC",
|
|
"WFDSConMgrReadCeremonyDataRPC",
|
|
"WFDSConMgrConnectTransportRPC",
|
|
"WFDSConMgrSetAllowRemoteInputRPC",
|
|
"WFDSConMgrQueryStatusRPC",
|
|
"WFDSConMgrQueryCorrelationIdRPC",
|
|
"WFDSConMgrDisconnectRPC",
|
|
"WFDSConMgrDisconnectTransportRPC",
|
|
"WFDSConMgrAsyncGetNotificationRPC",
|
|
"WFDSConMgrIntCompleteInfracastConnectionRPC",
|
|
"WFDSConMgrIntGetInfracastBackchannelParamsRPC"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140707487041664,
|
|
"Service": "WFDSConMgrSvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"5b665b9a-a086-4e26-ae24-96ab050b0ec3": {
|
|
"Module": "das.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\das.dll",
|
|
"InterfaceId": "5b665b9a-a086-4e26-ae24-96ab050b0ec3",
|
|
"InterfaceStructOffset": 368640,
|
|
"ProceduresCount": 3,
|
|
"Procedures": [
|
|
"DasCreateAepStoreAep",
|
|
"DasDeleteAepStoreAep",
|
|
"DasSetAepStoreAepProperties"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140707580862288,
|
|
"Service": "DeviceAssociationService",
|
|
"IsServiceRunning": false
|
|
},
|
|
"f44e62af-dab1-44c2-8013-049a9de417d6": {
|
|
"Module": "wcmsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\wcmsvc.dll",
|
|
"InterfaceId": "f44e62af-dab1-44c2-8013-049a9de417d6",
|
|
"InterfaceStructOffset": 768368,
|
|
"ProceduresCount": 2,
|
|
"Procedures": [
|
|
"RpcUpdateCapabilityAccess",
|
|
"RpcDeprovisionCapability"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140708018992432,
|
|
"Service": "Wcmsvc",
|
|
"IsServiceRunning": true
|
|
},
|
|
"76d12b80-3467-11d3-91ff-0090272f9ea3": {
|
|
"Module": "mqqm.dll",
|
|
"ModulePath": "C:\\Windows\\WinSxS\\amd64_microsoft-windows-msmq-queuemanager-core_31bf3856ad364e35_10.0.18362.1977_none_8d1646dec2a87b94\\mqqm.dll",
|
|
"InterfaceId": "76d12b80-3467-11d3-91ff-0090272f9ea3",
|
|
"InterfaceStructOffset": 1017936,
|
|
"ProceduresCount": 4,
|
|
"Procedures": [
|
|
"qmcomm2_v1_0_S_QMSendMessageInternalEx",
|
|
"qmcomm2_v1_0_S_rpc_ACSendMessageEx",
|
|
"qmcomm2_v1_0_S_rpc_ACReceiveMessageEx",
|
|
"qmcomm2_v1_0_S_rpc_ACCreateCursorEx"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140707093191616,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"d95afe70-a6d5-4259-822e-2c84da1ddb0d": {
|
|
"Module": "wininit.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\wininit.exe",
|
|
"InterfaceId": "d95afe70-a6d5-4259-822e-2c84da1ddb0d",
|
|
"InterfaceStructOffset": 295072,
|
|
"ProceduresCount": 3,
|
|
"Procedures": [
|
|
"s_WsdrInitiateShutdown",
|
|
"s_WsdrAbortShutdown",
|
|
"s_WsdrCheckForHiberboot"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140699626515200,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"12345678-1234-abcd-ef00-01234567cffb": {
|
|
"Module": "netlogon.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\netlogon.dll",
|
|
"InterfaceId": "12345678-1234-abcd-ef00-01234567cffb",
|
|
"InterfaceStructOffset": 479232,
|
|
"ProceduresCount": 59,
|
|
"Procedures": [
|
|
"NetrLogonUasLogon",
|
|
"NetrLogonUasLogoff",
|
|
"NetrLogonSamLogon",
|
|
"NetrLogonSamLogoff",
|
|
"NetrServerReqChallenge",
|
|
"NetrServerAuthenticate",
|
|
"NetrServerPasswordSet",
|
|
"NetrDatabaseDeltas",
|
|
"NetrDatabaseSync",
|
|
"NetrAccountDeltas",
|
|
"NetrAccountSync",
|
|
"NetrGetDCName",
|
|
"NetrLogonControl",
|
|
"NetrGetAnyDCName",
|
|
"NetrLogonControl2",
|
|
"NetrServerAuthenticate2",
|
|
"NetrDatabaseSync2",
|
|
"NetrDatabaseRedo",
|
|
"NetrLogonControl2Ex",
|
|
"NetrEnumerateTrustedDomains",
|
|
"DsrGetDcName",
|
|
"NetrLogonGetCapabilities",
|
|
"NetrLogonSetServiceBits",
|
|
"NetrLogonGetTrustRid",
|
|
"NetrLogonComputeServerDigest",
|
|
"NetrLogonComputeClientDigest",
|
|
"NetrServerAuthenticate3",
|
|
"DsrGetDcNameEx",
|
|
"DsrGetSiteName",
|
|
"NetrLogonGetDomainInfo",
|
|
"NetrServerPasswordSet2",
|
|
"NetrServerPasswordGet",
|
|
"NetrLogonSendToSam",
|
|
"DsrAddressToSiteNamesW",
|
|
"DsrGetDcNameEx2",
|
|
"NetrLogonGetTimeServiceParentDomain",
|
|
"NetrEnumerateTrustedDomainsEx",
|
|
"DsrAddressToSiteNamesExW",
|
|
"DsrGetDcSiteCoverageW",
|
|
"NetrLogonSamLogonEx",
|
|
"DsrEnumerateDomainTrusts",
|
|
"DsrDeregisterDnsHostRecords",
|
|
"NetrServerTrustPasswordsGet",
|
|
"DsrGetForestTrustInformation",
|
|
"NetrGetForestTrustInformation",
|
|
"NetrLogonSamLogonWithFlags",
|
|
"NetrServerGetTrustInfo",
|
|
"NetrCollectPerfData",
|
|
"DsrUpdateReadOnlyServerDnsRecords",
|
|
"NetrChainSetClientAttributes",
|
|
"NetrAddServiceAccount",
|
|
"NetrRemoveServiceAccount",
|
|
"NetrEnumerateServiceAccounts",
|
|
"NetrQueryServiceAccount",
|
|
"NetrChainSetClientAttributes2",
|
|
"NetrLogonComputeClientSignature",
|
|
"NetrLogonComputeServerSignature",
|
|
"NetrExtendMachinePasswordExpirationTimeout",
|
|
"NetrQuerySecureChannelDCInfo"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140708147754544,
|
|
"Service": "Netlogon",
|
|
"IsServiceRunning": false
|
|
},
|
|
"048cf666-ab42-42b4-8975-1357018decb3": {
|
|
"Module": "ws2_32.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\ws2_32.dll",
|
|
"InterfaceId": "048cf666-ab42-42b4-8975-1357018decb3",
|
|
"InterfaceStructOffset": 295024,
|
|
"ProceduresCount": 6,
|
|
"Procedures": [
|
|
"RPCNSPv2Startup",
|
|
"RPCNSPv2Cleanup",
|
|
"RPCNSPv2LookupServiceBegin",
|
|
"RPCNSPv2LookupServiceNextEx",
|
|
"RPCNSPv2LookupServiceEnd",
|
|
"RPCNSPv2SetServiceEx"
|
|
],
|
|
"ProcStackSize": 64,
|
|
"DispatchFunction": 140708205991280,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"c6f3ee72-ce7e-11d1-b71e-00c04fc3111a": {
|
|
"Module": "rpcss.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\rpcss.dll",
|
|
"InterfaceId": "c6f3ee72-ce7e-11d1-b71e-00c04fc3111a",
|
|
"InterfaceStructOffset": 959600,
|
|
"ProceduresCount": 7,
|
|
"Procedures": [
|
|
"ProcessActivatorStarted",
|
|
"ProcessActivatorInitializing",
|
|
"ProcessActivatorReady",
|
|
"ProcessActivatorStopped",
|
|
"ProcessActivatorPaused",
|
|
"ProcessActivatorResumed",
|
|
"ProcessActivatorUserInitializing"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140708135488704,
|
|
"Service": "RpcSs",
|
|
"IsServiceRunning": true
|
|
},
|
|
"647d4452-9f33-4a18-b2be-c5c0e920e94e": {
|
|
"Module": "pla.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\pla.dll",
|
|
"InterfaceId": "647d4452-9f33-4a18-b2be-c5c0e920e94e",
|
|
"InterfaceStructOffset": 1261888,
|
|
"ProceduresCount": 7,
|
|
"Procedures": [
|
|
"PlaiSrvControl",
|
|
"PlaiSrvQuerySession",
|
|
"PlaiSrvGetStatus",
|
|
"PlaiSrvRegisterCollectorSet",
|
|
"PlaiSrvUpdateMetadata",
|
|
"PlaiSrvSwitchToCompiling",
|
|
"PlaiSrvCloseCollectorSet"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140707093898272,
|
|
"Service": "pla",
|
|
"IsServiceRunning": false
|
|
},
|
|
"c6fce9d4-0b0e-49aa-a7ba-a6b217b52d16": {
|
|
"Module": "gns.dll",
|
|
"ModulePath": "C:\\Windows\\WinSxS\\amd64_microsoft-windows-guest-network-service_31bf3856ad364e35_10.0.18362.1714_none_7b03a8936de4e29d\\gns.dll",
|
|
"InterfaceId": "c6fce9d4-0b0e-49aa-a7ba-a6b217b52d16",
|
|
"InterfaceStructOffset": 338752,
|
|
"ProceduresCount": 13,
|
|
"Procedures": [
|
|
"Request",
|
|
"GnsRpc_EnumerateEndpoints",
|
|
"GnsRpc_CreateEndpoint",
|
|
"GnsRpc_OpenEndpoint",
|
|
"GnsRpc_ModifyEndpoint",
|
|
"GnsRpc_DeleteEndpoint",
|
|
"GnsRpc_CloseEndpoint",
|
|
"GnsRpc_EnumerateNamespaces",
|
|
"GnsRpc_CreateNamespace",
|
|
"GnsRpc_OpenNamespace",
|
|
"GnsRpc_ModifyNamespace",
|
|
"GnsRpc_DeleteNamespace",
|
|
"GnsRpc_CloseNamespace"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140707880336864,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"e6f89680-fc98-11e3-80d4-10604b681cfa": {
|
|
"Module": "NgcCtnrGidsHandler.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\NgcCtnrGidsHandler.dll",
|
|
"InterfaceId": "e6f89680-fc98-11e3-80d4-10604b681cfa",
|
|
"InterfaceStructOffset": 369680,
|
|
"ProceduresCount": 7,
|
|
"Procedures": [
|
|
"ProcessAfterContainerCreation",
|
|
"s_GidsHandlerRpcAcquireChannel",
|
|
"s_GidsHandlerRpcReleaseChannel",
|
|
"s_GidsHandlerRpcGetAttribute",
|
|
"s_GidsHandlerRpcGetAttribute",
|
|
"s_GidsHandlerRpcGetAttribute",
|
|
"s_GidsHandlerRpcSendReceiveData"
|
|
],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140707580798048,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"68227ae7-9a32-45b0-8472-bf9619965838": {
|
|
"Module": "PhoneService.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\PhoneService.dll",
|
|
"InterfaceId": "68227ae7-9a32-45b0-8472-bf9619965838",
|
|
"InterfaceStructOffset": 783312,
|
|
"ProceduresCount": 2,
|
|
"Procedures": [
|
|
"PhoneSvcImpl_PhoneRpcDialExternal",
|
|
"PhoneSvcImpl_PhoneRpcClearMissedCallCount"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140707094325280,
|
|
"Service": "PhoneSvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"2f5f6520-ca46-1067-b319-00dd010662da": {
|
|
"Module": "tapisrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\tapisrv.dll",
|
|
"InterfaceId": "2f5f6520-ca46-1067-b319-00dd010662da",
|
|
"InterfaceStructOffset": 245408,
|
|
"ProceduresCount": 3,
|
|
"Procedures": [
|
|
"ClientAttach",
|
|
"ClientRequest",
|
|
"ClientDetach"
|
|
],
|
|
"ProcStackSize": 8,
|
|
"DispatchFunction": 140707581105040,
|
|
"Service": "TapiSrv",
|
|
"IsServiceRunning": false
|
|
},
|
|
"3ca78105-a3a3-4a68-b458-1a606bab8fd6": {
|
|
"Module": "mpnotify.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\mpnotify.exe",
|
|
"InterfaceId": "3ca78105-a3a3-4a68-b458-1a606bab8fd6",
|
|
"InterfaceStructOffset": 13072,
|
|
"ProceduresCount": 2,
|
|
"Procedures": [
|
|
"LogonNotify",
|
|
"ChangePasswordNotify"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140700413990832,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"d2716e94-25cb-4820-bc15-537866578562": {
|
|
"Module": "APHostService.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\APHostService.dll",
|
|
"InterfaceId": "d2716e94-25cb-4820-bc15-537866578562",
|
|
"InterfaceStructOffset": 229168,
|
|
"ProceduresCount": 8,
|
|
"Procedures": [
|
|
"ServerRPC_SubmitJob",
|
|
"ServerRPC_GetPendingJobs",
|
|
"ServerRPC_RetryJobById",
|
|
"ServerRPC_CancelJobById",
|
|
"ServerRPC_AdviseNotifications",
|
|
"ServerRPC_SubscribeNextNotification",
|
|
"ServerRPC_RegisterAppId",
|
|
"ServerRPC_UnadviseNotifications"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140707488996416,
|
|
"Service": "OneSyncSvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"c33b9f46-2088-4dbc-97e3-6125f127661c": {
|
|
"Module": "nlasvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\nlasvc.dll",
|
|
"InterfaceId": "c33b9f46-2088-4dbc-97e3-6125f127661c",
|
|
"InterfaceStructOffset": 295008,
|
|
"ProceduresCount": 6,
|
|
"Procedures": [
|
|
"AppSrv_NlaOpenQuery",
|
|
"AppSrv_NlaAsyncIndicate",
|
|
"AppSrv_NlaRefreshQuery",
|
|
"AppSrv_NlaCloseQuery",
|
|
"RpcNlaIndicateReprobe",
|
|
"RpcNlaGetCaptivePortalHosts"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140708037495088,
|
|
"Service": "NlaSvc",
|
|
"IsServiceRunning": true
|
|
},
|
|
"f1c37891-201f-4aa3-94b1-a5d131b04920": {
|
|
"Module": "CmService.dll",
|
|
"ModulePath": "C:\\Windows\\WinSxS\\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.18362.1500_none_a0633e62409b621c\\CmService.dll",
|
|
"InterfaceId": "f1c37891-201f-4aa3-94b1-a5d131b04920",
|
|
"InterfaceStructOffset": 623616,
|
|
"ProceduresCount": 14,
|
|
"Procedures": [
|
|
"CmsRpcSrv_CreateContainer",
|
|
"CmsRpcSrv_OpenContainer",
|
|
"CmsRpcSrv_CloseContainer",
|
|
"CmsRpcSrv_TerminateContainer",
|
|
"CmsRpcSrv_QueryInformationContainer",
|
|
"CmsRpcSrv_EnumerateNetworkEndpoints",
|
|
"CmsRpcSrv_StartActivityAsync",
|
|
"CmsRpcSrv_StopActivity",
|
|
"CmsRpcSrv_AddHostNetworkToContainer",
|
|
"CmsRpcSrv_RemoveHostNetworkFromContainer",
|
|
"CmsRpcSrv_MapNamedPipeToContainer",
|
|
"CmsRpcSrv_UnmapNamedPipeFromContainer",
|
|
"CmsRpcSrv_MapVirtualDiskToContainer",
|
|
"CmsRpcSrv_UnmapVirtualDiskFromContainer"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140707487005728,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"82273fdc-e32a-18c3-3f78-827929dc23ea": {
|
|
"Module": "wevtsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\wevtsvc.dll",
|
|
"InterfaceId": "82273fdc-e32a-18c3-3f78-827929dc23ea",
|
|
"InterfaceStructOffset": 970848,
|
|
"ProceduresCount": 27,
|
|
"Procedures": [
|
|
"ElfrClearELFW",
|
|
"ElfrBackupELFW",
|
|
"ElfrCloseEL",
|
|
"ElfrDeregisterEventSource",
|
|
"ElfrNumberOfRecords",
|
|
"ElfrOldestRecord",
|
|
"ElfrChangeNotify",
|
|
"ElfrOpenELW",
|
|
"ElfrRegisterEventSourceW",
|
|
"ElfrOpenBELW",
|
|
"ElfrReadELW",
|
|
"ElfrReportEventW",
|
|
"ElfrClearELFA",
|
|
"ElfrBackupELFA",
|
|
"ElfrOpenELA",
|
|
"ElfrRegisterEventSourceA",
|
|
"ElfrOpenBELA",
|
|
"ElfrReadELA",
|
|
"ElfrReportEventA",
|
|
"ElfrRegisterClusterSvc",
|
|
"ElfrDeregisterClusterSvc",
|
|
"ElfrWriteClusterEvents",
|
|
"ElfrGetLogInformation",
|
|
"ElfrFlushEL",
|
|
"ElfrReportEventAndSourceW",
|
|
"ElfrReportEventExW",
|
|
"ElfrReportEventExA"
|
|
],
|
|
"ProcStackSize": 112,
|
|
"DispatchFunction": 140708090064864,
|
|
"Service": "EventLog",
|
|
"IsServiceRunning": true
|
|
},
|
|
"51c82175-844e-4750-b0d8-ec255555bc06": {
|
|
"Module": "SppExtComObj.Exe",
|
|
"ModulePath": "C:\\Windows\\System32\\SppExtComObj.Exe",
|
|
"InterfaceId": "51c82175-844e-4750-b0d8-ec255555bc06",
|
|
"InterfaceStructOffset": 480064,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"Proc0"
|
|
],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140694666941856,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"30034843-029d-46ec-8fff-5d12987f85c4": {
|
|
"Module": "NgcCtnrSvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\NgcCtnrSvc.dll",
|
|
"InterfaceId": "30034843-029d-46ec-8fff-5d12987f85c4",
|
|
"InterfaceStructOffset": 549680,
|
|
"ProceduresCount": 2,
|
|
"Procedures": [
|
|
"s_NgcRpcCreateContainer",
|
|
"s_NgcRpcDeleteContainer"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140707094013008,
|
|
"Service": "NgcCtnrSvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"6ddfc7d1-7fca-44eb-a279-e9988f4db32b": {
|
|
"Module": "FrameServer.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\FrameServer.dll",
|
|
"InterfaceId": "6ddfc7d1-7fca-44eb-a279-e9988f4db32b",
|
|
"InterfaceStructOffset": 630112,
|
|
"ProceduresCount": 24,
|
|
"Procedures": [
|
|
"Server_CreateClientContext",
|
|
"Server_EnableNotifications",
|
|
"Server_AddDeviceToClientContext",
|
|
"Server_CreateMSKSHandle",
|
|
"Server_GetFSStreamInformationSizes",
|
|
"Server_GetFSStreamInformation",
|
|
"Server_GetCurrentMediaType",
|
|
"Server_SetCurrentMediaType",
|
|
"Server_SetStreamState",
|
|
"Server_GetStreamState",
|
|
"Server_GetNotifications",
|
|
"Server_SendContextCommand",
|
|
"Server_RegisterKSEvent",
|
|
"Server_RegisterKSSemaphore",
|
|
"Server_CloseClientContext",
|
|
"Server_GetCurrentMuxMediaType",
|
|
"Server_SetCurrentMuxMediaType",
|
|
"Server_GetMuxedMediaTypes",
|
|
"Server_GetMuxedStreamAttributes",
|
|
"Server_SetBufferAccessMode",
|
|
"Server_AddMultipleSensorDevicesToClientContext",
|
|
"Server_ShutdownContextSource",
|
|
"Server_SetDXGIAdapter",
|
|
"Server_ContextKeepAlive"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140707093865712,
|
|
"Service": "FrameServer",
|
|
"IsServiceRunning": false
|
|
},
|
|
"6a59ed09-c0dd-404a-8428-da82ad5153cb": {
|
|
"Module": "UtcDecoderHost.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\UtcDecoderHost.exe",
|
|
"InterfaceId": "6a59ed09-c0dd-404a-8428-da82ad5153cb",
|
|
"InterfaceStructOffset": 76640,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"UtcDecoderHostApi_Decode"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140702477510320,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"e3907f22-c899-44e7-9d11-9d8b3d924832": {
|
|
"Module": "lsm.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\lsm.dll",
|
|
"InterfaceId": "e3907f22-c899-44e7-9d11-9d8b3d924832",
|
|
"InterfaceStructOffset": 480080,
|
|
"ProceduresCount": 5,
|
|
"Procedures": [
|
|
"RpcEnableChildSessions",
|
|
"RpcIsChildSessionsEnabled",
|
|
"RpcGetChildSessionId",
|
|
"RpcGetParentSessionId",
|
|
"RpcGetAllUserSessions"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140708131495280,
|
|
"Service": "LSM",
|
|
"IsServiceRunning": true
|
|
},
|
|
"cb735210-b16a-4fdd-8bf3-e3e63424f4cd": {
|
|
"Module": "hvsicontainerservice.dll",
|
|
"ModulePath": "C:\\Windows\\WinSxS\\amd64_microsoft-windows-hvsi-service_31bf3856ad364e35_10.0.18362.1916_none_ce843808b173de74\\hvsicontainerservice.dll",
|
|
"InterfaceId": "cb735210-b16a-4fdd-8bf3-e3e63424f4cd",
|
|
"InterfaceStructOffset": 966832,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"s_HvsiK_ValidateConnection"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140707093997920,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"e60c73e6-88f9-11cf-9af1-0020af6e72f4": {
|
|
"Module": "rpcss.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\rpcss.dll",
|
|
"InterfaceId": "e60c73e6-88f9-11cf-9af1-0020af6e72f4",
|
|
"InterfaceStructOffset": 960176,
|
|
"ProceduresCount": 12,
|
|
"Procedures": [
|
|
"_Connect",
|
|
"_SetAppID",
|
|
"GetDefaultSecurityPermissions",
|
|
"_AllocateReservedIds",
|
|
"BulkUpdateOIDs",
|
|
"_ClientResolveOXID",
|
|
"_ServerAllocateOXIDAndOIDs",
|
|
"ServerAllocateOIDs",
|
|
"_ServerFreeOXIDAndOIDs",
|
|
"_SetServerOIDFlags",
|
|
"_Disconnect",
|
|
"GetUpdatedResolverBindings"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140708135236880,
|
|
"Service": "RpcSs",
|
|
"IsServiceRunning": true
|
|
},
|
|
"04557228-209a-46b4-aaa4-4eb4c84db7a2": {
|
|
"Module": "rdpshell.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\rdpshell.exe",
|
|
"InterfaceId": "04557228-209a-46b4-aaa4-4eb4c84db7a2",
|
|
"InterfaceStructOffset": 427536,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"RpcEncodeRailOrder"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140698607236592,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"4d9f4ab8-7d1c-11cf-861e-0020af6e7c57": {
|
|
"Module": "rpcss.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\rpcss.dll",
|
|
"InterfaceId": "4d9f4ab8-7d1c-11cf-861e-0020af6e7c57",
|
|
"InterfaceStructOffset": 959504,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"RemoteActivation"
|
|
],
|
|
"ProcStackSize": 168,
|
|
"DispatchFunction": 140708135482080,
|
|
"Service": "RpcSs",
|
|
"IsServiceRunning": true
|
|
},
|
|
"af7fead8-c34a-461f-8894-6d6f0e5eddcd": {
|
|
"Module": "wifinetworkmanager.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\wifinetworkmanager.dll",
|
|
"InterfaceId": "af7fead8-c34a-461f-8894-6d6f0e5eddcd",
|
|
"InterfaceStructOffset": 488512,
|
|
"ProceduresCount": 12,
|
|
"Procedures": [
|
|
"WiFiUserGetPowerBackOnOption",
|
|
"WiFiUserSetPowerBackOnOption",
|
|
"WiFiUserDeleteNetwork",
|
|
"WiFiUserGetHotspotStatus",
|
|
"WiFiUserSetHotspotStatus",
|
|
"WiFiUserProvisionHotspotApp",
|
|
"WifiUserStartHotspot2Registration",
|
|
"WifiUserEnableHotspot2OsuRegistration",
|
|
"WifiUserGetHotspot2OsuRegistrationStatus",
|
|
"WiFiUserActivateNotification",
|
|
"WiFiUserGetNotificationTargetProfile",
|
|
"WiFiTestSetActionRequired"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140707601932064,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"1f260487-ba29-4f13-928a-bbd29761b083": {
|
|
"Module": "termsrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\termsrv.dll",
|
|
"InterfaceId": "1f260487-ba29-4f13-928a-bbd29761b083",
|
|
"InterfaceStructOffset": 748560,
|
|
"ProceduresCount": 10,
|
|
"Procedures": [
|
|
"RpcIsSessionPermitted",
|
|
"RpcGetUserCredentials",
|
|
"RpcGetUserProfile",
|
|
"RpcWinStationRedirectErrorMessage",
|
|
"RpcRedirectLogonBeginPainting",
|
|
"RpcRedirectLogonStatus",
|
|
"RpcRedirectLogonMessage",
|
|
"RpcRedirectLogonError",
|
|
"RpcGetRedirectAuthInfo",
|
|
"RpcGetRestrictedLogonInfo"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140708119075584,
|
|
"Service": "TermService",
|
|
"IsServiceRunning": true
|
|
},
|
|
"12345778-1234-abcd-ef00-0123456789ac": {
|
|
"Module": "samsrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\samsrv.dll",
|
|
"InterfaceId": "12345778-1234-abcd-ef00-0123456789ac",
|
|
"InterfaceStructOffset": 667648,
|
|
"ProceduresCount": 74,
|
|
"Procedures": [
|
|
"SamrConnect",
|
|
"SamrCloseHandle",
|
|
"SamrSetSecurityObject",
|
|
"SamrQuerySecurityObject",
|
|
"SamrShutdownSamServer",
|
|
"SamrLookupDomainInSamServer",
|
|
"SamrEnumerateDomainsInSamServer",
|
|
"SamrOpenDomain",
|
|
"SamrQueryInformationDomain",
|
|
"SamrSetInformationDomain",
|
|
"SamrCreateGroupInDomain",
|
|
"SamrEnumerateGroupsInDomain",
|
|
"SamrCreateUserInDomain",
|
|
"SamrEnumerateUsersInDomain",
|
|
"SamrCreateAliasInDomain",
|
|
"SamrEnumerateAliasesInDomain",
|
|
"SamrGetAliasMembership",
|
|
"SamrLookupNamesInDomain",
|
|
"SamrLookupIdsInDomain",
|
|
"SamrOpenGroup",
|
|
"SamrQueryInformationGroup",
|
|
"SamrSetInformationGroup",
|
|
"SamrAddMemberToGroup",
|
|
"SamrDeleteGroup",
|
|
"SamrRemoveMemberFromGroup",
|
|
"SamrGetMembersInGroup",
|
|
"SamrSetMemberAttributesOfGroup",
|
|
"SamrOpenAlias",
|
|
"SamrQueryInformationAlias",
|
|
"SamrSetInformationAlias",
|
|
"SamrDeleteAlias",
|
|
"SamrAddMemberToAlias",
|
|
"SamrRemoveMemberFromAlias",
|
|
"SamrGetMembersInAlias",
|
|
"SamrOpenUser",
|
|
"SamrDeleteUser",
|
|
"SamrQueryInformationUser",
|
|
"SamrSetInformationUser",
|
|
"SamrChangePasswordUser",
|
|
"SamrGetGroupsForUser",
|
|
"SamrQueryDisplayInformation",
|
|
"SamrGetDisplayEnumerationIndex",
|
|
"SamrTestPrivateFunctionsDomain",
|
|
"SamrTestPrivateFunctionsUser",
|
|
"SamrGetUserDomainPasswordInformation",
|
|
"SamrRemoveMemberFromForeignDomain",
|
|
"SamrQueryInformationDomain2",
|
|
"SamrQueryInformationUser2",
|
|
"SamrQueryDisplayInformation2",
|
|
"SamrGetDisplayEnumerationIndex2",
|
|
"SamrCreateUser2InDomain",
|
|
"SamrQueryDisplayInformation3",
|
|
"SamrAddMultipleMembersToAlias",
|
|
"SamrRemoveMultipleMembersFromAlias",
|
|
"SamrOemChangePasswordUser2",
|
|
"SamrUnicodeChangePasswordUser2",
|
|
"SamrGetDomainPasswordInformation",
|
|
"SamrConnect2",
|
|
"SamrSetInformationUser2",
|
|
"SamrSetBootKeyInformation",
|
|
"SamrGetBootKeyInformation",
|
|
"SamrConnect3",
|
|
"SamrConnect4",
|
|
"SamrUnicodeChangePasswordUser3",
|
|
"SamrConnect5",
|
|
"SamrRidToSid",
|
|
"SamrSetDSRMPassword",
|
|
"SamrValidatePassword",
|
|
"SamrQueryLocalizableAccountsInDomain",
|
|
"SamrPerformGenericOperation",
|
|
"SamrSyncDSRMPasswordFromAccount",
|
|
"SamrLookupNamesInDomain2",
|
|
"SamrEnumerateUsersInDomain2",
|
|
"SamrUnicodeChangePasswordUser4"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140708152242448,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"850cee52-3038-4277-b9b4-e05db8b2c35c": {
|
|
"Module": "das.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\das.dll",
|
|
"InterfaceId": "850cee52-3038-4277-b9b4-e05db8b2c35c",
|
|
"InterfaceStructOffset": 369024,
|
|
"ProceduresCount": 14,
|
|
"Procedures": [
|
|
"DasCreateAssociationContextForApp",
|
|
"DasCreateAssociationContextFromOobBlob",
|
|
"DasStartEnumCeremonies",
|
|
"DasSelectCeremony",
|
|
"DasStartReadCeremonyData",
|
|
"DasStartWriteCeremonyData",
|
|
"DasStartFinalize",
|
|
"DasStartDeviceStatusNotification",
|
|
"DasCloseAssociationContext",
|
|
"DasStartRemoveAssociation",
|
|
"DasCreateImportExportContext",
|
|
"DasStartAepImport",
|
|
"DasStartAepExport",
|
|
"DasCloseImportExportContext"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140707580866480,
|
|
"Service": "DeviceAssociationService",
|
|
"IsServiceRunning": false
|
|
},
|
|
"c605f9fb-f0a3-4e2a-a073-73560f8d9e3e": {
|
|
"Module": "bisrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\bisrv.dll",
|
|
"InterfaceId": "c605f9fb-f0a3-4e2a-a073-73560f8d9e3e",
|
|
"InterfaceStructOffset": 551584,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"RBiSrvSignalEvent"
|
|
],
|
|
"ProcStackSize": 64,
|
|
"DispatchFunction": 140708131125024,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"b05885e9-fd8c-4839-9d73-f1baff8f4e44": {
|
|
"Module": "datamarketsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\datamarketsvc.dll",
|
|
"InterfaceId": "b05885e9-fd8c-4839-9d73-f1baff8f4e44",
|
|
"InterfaceStructOffset": 83712,
|
|
"ProceduresCount": 6,
|
|
"Procedures": [
|
|
"s_SetMobileBroadbandFirewall",
|
|
"s_RemoveMobileBroadbandFirewall",
|
|
"s_IsDynaMoDisabled",
|
|
"s_GetInterfaceGuid",
|
|
"s_GetWmiProperty",
|
|
"s_IsUserAdmin"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140707594718608,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"9b008953-f195-4bf9-bde0-4471971e58ed": {
|
|
"Module": "SystemEventsBrokerServer.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\SystemEventsBrokerServer.dll",
|
|
"InterfaceId": "9b008953-f195-4bf9-bde0-4471971e58ed",
|
|
"InterfaceStructOffset": 154320,
|
|
"ProceduresCount": 6,
|
|
"Procedures": [
|
|
"SebiEnumerateEvents",
|
|
"_SebiEnumerateEventsByType",
|
|
"_SebiQueryEventData",
|
|
"SebiQueryEventPackage",
|
|
"_SebiSignalSyncEventEx",
|
|
"SebiCancelEvent"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140708127150736,
|
|
"Service": "SystemEventsBroker",
|
|
"IsServiceRunning": true
|
|
},
|
|
"c2d1b5dd-fa81-4460-9dd6-e7658b85454b": {
|
|
"Module": "wcmsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\wcmsvc.dll",
|
|
"InterfaceId": "c2d1b5dd-fa81-4460-9dd6-e7658b85454b",
|
|
"InterfaceStructOffset": 768560,
|
|
"ProceduresCount": 2,
|
|
"Procedures": [
|
|
"RpcSetProxyInformation",
|
|
"RpcDeleteProxyInformation"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140708018992160,
|
|
"Service": "Wcmsvc",
|
|
"IsServiceRunning": true
|
|
},
|
|
"6b5bdd1e-528c-422c-af8c-a4079be4fe48": {
|
|
"Module": "FwRemoteSvr.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\FwRemoteSvr.dll",
|
|
"InterfaceId": "6b5bdd1e-528c-422c-af8c-a4079be4fe48",
|
|
"InterfaceStructOffset": 72192,
|
|
"ProceduresCount": 86,
|
|
"Procedures": [
|
|
"RRPC_FWOpenPolicyStore",
|
|
"RRPC_FWClosePolicyStore",
|
|
"RRPC_FWRestoreDefaults",
|
|
"RRPC_FWGetGlobalConfig",
|
|
"RRPC_FWSetGlobalConfig",
|
|
"RRPC_FWAddFirewallRule",
|
|
"RRPC_FWSetFirewallRule",
|
|
"RRPC_FWDeleteFirewallRule",
|
|
"RRPC_FWDeleteAllFirewallRules",
|
|
"RRPC_FWEnumFirewallRules",
|
|
"RRPC_FWGetConfig",
|
|
"RRPC_FWSetConfig",
|
|
"RRPC_FWAddConnectionSecurityRule",
|
|
"RRPC_FWSetConnectionSecurityRule",
|
|
"RRPC_FWDeleteConnectionSecurityRule",
|
|
"RRPC_FWDeleteAllConnectionSecurityRules",
|
|
"RRPC_FWEnumConnectionSecurityRules",
|
|
"RRPC_FWAddAuthenticationSet",
|
|
"RRPC_FWSetAuthenticationSet",
|
|
"RRPC_FWDeleteAuthenticationSet",
|
|
"RRPC_FWDeleteAllAuthenticationSets",
|
|
"RRPC_FWEnumAuthenticationSets",
|
|
"RRPC_FWAddCryptoSet",
|
|
"RRPC_FWSetCryptoSet",
|
|
"RRPC_FWDeleteCryptoSet",
|
|
"RRPC_FWDeleteAllCryptoSets",
|
|
"RRPC_FWEnumCryptoSets",
|
|
"RRPC_FWEnumPhase1SAs",
|
|
"RRPC_FWEnumPhase2SAs",
|
|
"RRPC_FWDeletePhase1SAs",
|
|
"RRPC_FWDeletePhase2SAs",
|
|
"RRPC_FWEnumProducts",
|
|
"RRPC_FWAddMainModeRule",
|
|
"RRPC_FWSetMainModeRule",
|
|
"RRPC_FWDeleteMainModeRule",
|
|
"RRPC_FWDeleteAllMainModeRules",
|
|
"RRPC_FWEnumMainModeRules",
|
|
"RRPC_FWQueryFirewallRules",
|
|
"RRPC_FWQueryConnectionSecurityRules2_10",
|
|
"RRPC_FWQueryMainModeRules",
|
|
"RRPC_FWQueryAuthenticationSets",
|
|
"RRPC_FWQueryCryptoSets",
|
|
"RRPC_FWEnumNetworks",
|
|
"RRPC_FWEnumAdapters",
|
|
"RRPC_FWGetGlobalConfig2_10",
|
|
"RRPC_FWGetConfig2_10",
|
|
"RRPC_FWAddFirewallRule2_10",
|
|
"RRPC_FWSetFirewallRule2_10",
|
|
"RRPC_FWEnumFirewallRules2_10",
|
|
"RRPC_FWAddConnectionSecurityRule2_10",
|
|
"RRPC_FWSetConnectionSecurityRule2_10",
|
|
"RRPC_FWEnumConnectionSecurityRules2_10",
|
|
"RRPC_FWAddAuthenticationSet2_10",
|
|
"RRPC_FWSetAuthenticationSet2_10",
|
|
"RRPC_FWEnumAuthenticationSets2_10",
|
|
"RRPC_FWAddCryptoSet2_10",
|
|
"RRPC_FWSetCryptoSet2_10",
|
|
"RRPC_FWEnumCryptoSets2_10",
|
|
"RRPC_FWAddConnectionSecurityRule2_20",
|
|
"RRPC_FWSetConnectionSecurityRule2_20",
|
|
"RRPC_FWEnumConnectionSecurityRules2_20",
|
|
"RRPC_FWQueryConnectionSecurityRules2_20",
|
|
"RRPC_FWAddAuthenticationSet2_20",
|
|
"RRPC_FWSetAuthenticationSet2_20",
|
|
"RRPC_FWEnumAuthenticationSets2_20",
|
|
"RRPC_FWQueryAuthenticationSets2_20",
|
|
"RRPC_FWAddFirewallRule2_20",
|
|
"RRPC_FWSetFirewallRule2_20",
|
|
"RRPC_FWEnumFirewallRules2_20",
|
|
"RRPC_FWQueryFirewallRules2_20",
|
|
"RRPC_FWAddFirewallRule2_24",
|
|
"RRPC_FWSetFirewallRule2_24",
|
|
"RRPC_FWEnumFirewallRules2_24",
|
|
"RRPC_FWQueryFirewallRules2_24",
|
|
"RRPC_FWAddFirewallRule2_25",
|
|
"RRPC_FWSetFirewallRule2_25",
|
|
"RRPC_FWEnumFirewallRules2_25",
|
|
"RRPC_FWQueryFirewallRules2_25",
|
|
"RRPC_FWAddFirewallRule2_26",
|
|
"RRPC_FWSetFirewallRule2_26",
|
|
"RRPC_FWEnumFirewallRules2_26",
|
|
"RRPC_FWQueryFirewallRules2_26",
|
|
"RRPC_FWAddFirewallRule2_27",
|
|
"RRPC_FWSetFirewallRule2_27",
|
|
"RRPC_FWEnumFirewallRules2_27",
|
|
"RRPC_FWQueryFirewallRules2_27"
|
|
],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140707880924336,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"00000143-0000-0000-c000-000000000046": {
|
|
"Module": "combase.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\combase.dll",
|
|
"InterfaceId": "00000143-0000-0000-c000-000000000046",
|
|
"InterfaceStructOffset": 2274544,
|
|
"ProceduresCount": 0,
|
|
"Procedures": [],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140707382121168,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"412f241e-c12a-11ce-abff-0020af6e7a17": {
|
|
"Module": "rpcss.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\rpcss.dll",
|
|
"InterfaceId": "412f241e-c12a-11ce-abff-0020af6e7a17",
|
|
"InterfaceStructOffset": 959792,
|
|
"ProceduresCount": 29,
|
|
"Procedures": [
|
|
"ServerRegisterClsid",
|
|
"ServerRevokeClsid",
|
|
"ServerRegisterActivatableClasses",
|
|
"ServerRevokeActivatableClasses",
|
|
"GetThreadID",
|
|
"UpdateActivationSettings",
|
|
"RegisterWindowPropInterface",
|
|
"GetWindowPropInterface",
|
|
"EnableDisableDynamicIPTracking",
|
|
"GetCurrentAddrExclusionList",
|
|
"SetAddrExclusionList",
|
|
"FlushSCMBindings",
|
|
"RetireServer",
|
|
"NotifyDDStartOrStop",
|
|
"QueryDragDropActive",
|
|
"SetOrRevokeForcedDropTarget",
|
|
"IsObjectCreationAllowed",
|
|
"ControlTracingForProcess",
|
|
"QueryPIDForActivation",
|
|
"NotifyWinRTActivationStoreChanged",
|
|
"DecodeProxy",
|
|
"NotifyPsmResume",
|
|
"QueryServerProcessHandleHeld",
|
|
"RegisterRacActivationToken",
|
|
"RevokeRacActivationToken",
|
|
"RegisterConsoleHandles",
|
|
"RevokeConsoleHandles",
|
|
"NotifyComClassChangesFromDeployment",
|
|
"LogMachineClassesRootPermissions"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140708135400464,
|
|
"Service": "RpcSs",
|
|
"IsServiceRunning": true
|
|
},
|
|
"824d8d77-a27f-4915-a536-36e9283dce29": {
|
|
"Module": "winhttp.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\winhttp.dll",
|
|
"InterfaceId": "824d8d77-a27f-4915-a536-36e9283dce29",
|
|
"InterfaceStructOffset": 805088,
|
|
"ProceduresCount": 11,
|
|
"Procedures": [
|
|
"s_PacWorkerCallbackInitSessionRpc",
|
|
"s_PacWorkerCallbackCloseSessionRpc",
|
|
"s_PacWorkerCallbackIsResolvableRpc",
|
|
"s_PacWorkerCallbackIsResolvableExRpc",
|
|
"s_PacWorkerCallbackIsInNetRpc",
|
|
"s_PacWorkerCallbackIsInNetExRpc",
|
|
"s_PacWorkerCallbackDnsResolveRpc",
|
|
"s_PacWorkerCallbackDnsResolveExRpc",
|
|
"s_PacWorkerCallbackMyIpAddressRpc",
|
|
"s_PacWorkerCallbackMyIpAddressExRpc",
|
|
"s_PacWorkerCallbackSortIpAddressListRpc"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140708017921968,
|
|
"Service": "WinHttpAutoProxySvc",
|
|
"IsServiceRunning": true
|
|
},
|
|
"b54e9aa3-cf29-4f21-a8ea-98c5850ce296": {
|
|
"Module": "Microsoft.Graphics.Display.DisplayEnhancementService.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\Microsoft.Graphics.Display.DisplayEnhancementService.dll",
|
|
"InterfaceId": "b54e9aa3-cf29-4f21-a8ea-98c5850ce296",
|
|
"InterfaceStructOffset": 900832,
|
|
"ProceduresCount": 26,
|
|
"Procedures": [
|
|
"DeoRpcServerOpenContextHandle",
|
|
"DeoRpcServerCloseContextHandle",
|
|
"DeoRpcServerStartViewPropertyChangedCallbacks",
|
|
"DeoRpcServerStartCanOverrideChangedCallbacks",
|
|
"DeoRpcServerStartIsOverrideActiveChangedCallbacks",
|
|
"DeoRpcServerStopViewPropertyChangedCallbacks",
|
|
"DeoRpcServerStopCanOverrideChangedCallbacks",
|
|
"DeoRpcServerStopIsOverrideActiveChangedCallbacks",
|
|
"DeoRpcServerStartOverride",
|
|
"DeoRpcServerStopOverride",
|
|
"DeoRpcServerGetCanOverride",
|
|
"DeoRpcServerGetIsOverrideActive",
|
|
"DeoRpcServerGetIsBrightnessOverrideSupported",
|
|
"DeoRpcServerGetIsBrightnessNitsOverrideSupported",
|
|
"DeoRpcServerGetSupportedMillinitRanges",
|
|
"DeoRpcServerGetBrightnessLevel",
|
|
"DeoRpcServerGetBrightnessMillinits",
|
|
"DeoRpcServerGetBrightnessLevelForBrightnessScenario",
|
|
"DeoRpcServerGetBrightnessMillinitsForBrightnessScenario",
|
|
"DeoRpcServerSetBrightnessLevel",
|
|
"DeoRpcServerSetBrightnessMillinits",
|
|
"DeoRpcServerSetBrightnessScenario",
|
|
"DeoRpcServerGetIsColorOverrideSupported",
|
|
"DeoRpcServerGetColorScenario",
|
|
"DeoRpcServerSetColorScenario",
|
|
"DeoRpcServerSaveForSystem"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140707093776944,
|
|
"Service": "DisplayEnhancementService",
|
|
"IsServiceRunning": false
|
|
},
|
|
"29770a8f-829b-4158-90a2-78cd488501f7": {
|
|
"Module": "SessEnv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\SessEnv.dll",
|
|
"InterfaceId": "29770a8f-829b-4158-90a2-78cd488501f7",
|
|
"InterfaceStructOffset": 332832,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"TSSDFarmRpcGrantUserTSAccessRight"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140708025016560,
|
|
"Service": "SessionEnv",
|
|
"IsServiceRunning": true
|
|
},
|
|
"650a7e26-eab8-5533-ce43-9c1dfce11511": {
|
|
"Module": "rascustom.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\rascustom.dll",
|
|
"InterfaceId": "650a7e26-eab8-5533-ce43-9c1dfce11511",
|
|
"InterfaceStructOffset": 310544,
|
|
"ProceduresCount": 37,
|
|
"Procedures": [
|
|
"Rpc_VpnProtEngOpen",
|
|
"Rpc_VpnProtEngClose",
|
|
"Rpc_VpnProtEngEventSubscribe",
|
|
"Rpc_VpnProtEngEventSubscriptionGetLastEvent",
|
|
"Rpc_VpnProtEngEventUnsubscribe",
|
|
"Rpc_VpnProtEngSendGetCredentialsRequest",
|
|
"Rpc_VpnProtEngSendNegotiatingNetworkRequest",
|
|
"Rpc_VpnProtEngSendInterfaceCreateRequest",
|
|
"Rpc_VpnProtEngSendInterfaceDestroyRequest",
|
|
"Rpc_VpnProtEngDisconnectInternal",
|
|
"Rpc_VpnProtEngSendConnectError",
|
|
"Rpc_VpnProtEngGetConfiguration",
|
|
"Rpc_VpnProtEngGetBestCostInterface",
|
|
"Rpc_VpnProtEngGetStatementOfHealth",
|
|
"Rpc_VpnProtEngSetKeepAliveFrequencyOverrideRequest",
|
|
"Rpc_VpnProtEngSendGetCustomPromptRequest",
|
|
"Rpc_VpnProtEngSendGetCertificateConsentBlankUiRequest",
|
|
"Rpc_VpnProtEngSendCloseCertificateConsentBlankUiRequest",
|
|
"Rpc_VpnProtEngPluginInstall",
|
|
"Rpc_VpnProtEngPluginUninstall",
|
|
"Rpc_VpnProtEngSetCostNetworkSettings",
|
|
"Rpc_VpnProtEngGetCostNetworkSettings",
|
|
"Rpc_VpnProtEngExecuteAndCaptureLogs",
|
|
"Rpc_VpnProtEngGetInterface",
|
|
"Rpc_VpnProtEngPluginEnumerate",
|
|
"Rpc_VpnProtEngAddProfileFromXml",
|
|
"Rpc_VpnProtEngWinRtConnect",
|
|
"Rpc_VpnProtEngWinRtDisconnect",
|
|
"Rpc_VpnProtEngWinRtEnumerate",
|
|
"Rpc_VpnProtEngWinRtGetEntryProperties",
|
|
"Rpc_VpnProtEngWinRtGetRasCustomData",
|
|
"Rpc_VpnProtEngWinRtGetEapBlob",
|
|
"Rpc_VpnProtEngWinRtGetEapXml",
|
|
"Rpc_VpnProtEngWinRtGetMoniker",
|
|
"Rpc_VpnProtEngWinRtGetConnectionStatus",
|
|
"Rpc_VpnProtEngWinRtUpdateRegistryProfileList",
|
|
"Rpc_VpnProtEngGetProxyForUrlAndSingleSessionDeviceUser"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140707795102544,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"8c7a6de0-788d-11d0-9edf-444553540000": {
|
|
"Module": "wiaservc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\wiaservc.dll",
|
|
"InterfaceId": "8c7a6de0-788d-11d0-9edf-444553540000",
|
|
"InterfaceStructOffset": 421984,
|
|
"ProceduresCount": 16,
|
|
"Procedures": [
|
|
"R_StiApiGetVersion",
|
|
"R_StiApiEnableHwNotifications",
|
|
"R_StiApiGetHwNotificationState",
|
|
"R_StiApiLaunchApplication",
|
|
"R_StiApiOpenDevice",
|
|
"R_StiApiSubscribe",
|
|
"R_StiApiGetLastNotificationData",
|
|
"R_StiApiUnSubscribe",
|
|
"R_StiApiCloseDevice",
|
|
"R_StiApiLockDevice",
|
|
"R_StiApiUnlockDevice",
|
|
"R_WiaGetEventDataAsync",
|
|
"OpenClientConnection",
|
|
"CloseClientConnection",
|
|
"RegisterUnregisterForEventNotification",
|
|
"WiaGetRuntimetEventDataAsync"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140707487128656,
|
|
"Service": "stisvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"97be9507-17da-4999-87d7-66c0b2d83cc7": {
|
|
"Module": "SensorService.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\SensorService.dll",
|
|
"InterfaceId": "97be9507-17da-4999-87d7-66c0b2d83cc7",
|
|
"InterfaceStructOffset": 373472,
|
|
"ProceduresCount": 8,
|
|
"Procedures": [
|
|
"RSensorBrokerServerOpen",
|
|
"RSensorBrokerServerClose",
|
|
"RSensorBrokerServerDoesSdoExist",
|
|
"RSensorBrokerServerStart",
|
|
"RSensorBrokerServerStop",
|
|
"RSensorBrokerServerGetDeviceID",
|
|
"RSensorBrokerServerGetCurrentOrientation",
|
|
"RSensorBrokerServerGetProperties"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140707580872032,
|
|
"Service": "SensorService",
|
|
"IsServiceRunning": false
|
|
},
|
|
"0a74ef1c-41a4-4e06-83ae-dc74fb1cdd53": {
|
|
"Module": "schedsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\schedsvc.dll",
|
|
"InterfaceId": "0a74ef1c-41a4-4e06-83ae-dc74fb1cdd53",
|
|
"InterfaceStructOffset": 478080,
|
|
"ProceduresCount": 5,
|
|
"Procedures": [
|
|
"ItSrvRegisterIdleTask",
|
|
"ItSrvUnregisterIdleTask",
|
|
"ItSrvProcessIdleTasks",
|
|
"ItSrvSetDetectionParameters",
|
|
"ItSrvSetRuntimeOverrides"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140708047002624,
|
|
"Service": "Schedule",
|
|
"IsServiceRunning": true
|
|
},
|
|
"5dea026d-f999-40b1-a234-2164fd086783": {
|
|
"Module": "Windows.Internal.Bluetooth.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\Windows.Internal.Bluetooth.dll",
|
|
"InterfaceId": "5dea026d-f999-40b1-a234-2164fd086783",
|
|
"InterfaceStructOffset": 494032,
|
|
"ProceduresCount": 9,
|
|
"Procedures": [
|
|
"s_BthEvtBrRetrieveEventSocket",
|
|
"s_BthEvtBrCloseEventSocket",
|
|
"s_BthEvtBrRetrieveEventAdvertisements",
|
|
"s_BthEvtBrRetrieveEventCharacteristicNotifications",
|
|
"s_BthEvtBrGattEnumerateBrokeredServices",
|
|
"s_BthEvtBrGattEnumerateBrokeredAttributeRequests",
|
|
"s_BthEvtBrGattRetrieveBrokeredAttributeRequestDetails",
|
|
"s_BthEvtBrGattSendResponseForBrokeredAttributeRequest",
|
|
"s_BthEvtBrGattDisposeBrokeredAttributeRequest"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140707487503888,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"10bd2718-13bd-4b84-8e7d-8b5c83770a86": {
|
|
"Module": "rdpclip.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\rdpclip.exe",
|
|
"InterfaceId": "10bd2718-13bd-4b84-8e7d-8b5c83770a86",
|
|
"InterfaceStructOffset": 358080,
|
|
"ProceduresCount": 2,
|
|
"Procedures": [
|
|
"RpcSetRenderHint",
|
|
"RpcGetStartMenuRect"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140698142342480,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"572e35b4-1344-4565-96a1-f5df3bfa89bb": {
|
|
"Module": "wlidsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\wlidsvc.dll",
|
|
"InterfaceId": "572e35b4-1344-4565-96a1-f5df3bfa89bb",
|
|
"InterfaceStructOffset": 1314832,
|
|
"ProceduresCount": 3,
|
|
"Procedures": [
|
|
"WLIDNCreateContext",
|
|
"WLIDNDeleteContext",
|
|
"WLIDNGetNextNotification"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140707092937264,
|
|
"Service": "wlidsvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"5c9a4cd7-ba75-45d2-9898-1773b3d1e5f1": {
|
|
"Module": "umpnpmgr.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\umpnpmgr.dll",
|
|
"InterfaceId": "5c9a4cd7-ba75-45d2-9898-1773b3d1e5f1",
|
|
"InterfaceStructOffset": 79936,
|
|
"ProceduresCount": 7,
|
|
"Procedures": [
|
|
"PNP_Local_Connect",
|
|
"PNP_Local_Connect",
|
|
"PNP_Local_InstallDevInst",
|
|
"PNP_Local_InstallDriver",
|
|
"PNP_Local_UninstallDriver",
|
|
"PNP_Local_AddDriverPackage",
|
|
"PNP_Local_DeleteDriverPackage"
|
|
],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140708140331504,
|
|
"Service": "PlugPlay",
|
|
"IsServiceRunning": true
|
|
},
|
|
"c3f42c6e-d4cc-4e5a-938b-9c5e8a5d8c2e": {
|
|
"Module": "wlanmsm.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\wlanmsm.dll",
|
|
"InterfaceId": "c3f42c6e-d4cc-4e5a-938b-9c5e8a5d8c2e",
|
|
"InterfaceStructOffset": 368240,
|
|
"ProceduresCount": 15,
|
|
"Procedures": [
|
|
"RpcDot11ExtRegisterIhvProcess",
|
|
"RpcDot11ExtPreAssociateCompletion",
|
|
"RpcDot11ExtPostAssociateCompletion",
|
|
"RpcDot11ExtSendUIRequest",
|
|
"RpcDot11ExtSendNotification",
|
|
"RpcDot11ExtGetProfileCustomUserData",
|
|
"RpcDot11ExtSetProfileCustomUserData",
|
|
"RpcDot11ExtNotifyChangeState",
|
|
"RpcDot11ExtSetCurrentProfile",
|
|
"RpcDot11ExtStartOneX",
|
|
"RpcDot11ExtStopOneX",
|
|
"RpcDot11ExtProcessSecurityPacket",
|
|
"RpcDot11ExtRequestVirtualStation",
|
|
"RpcDot11ExtReleaseVirtualStation",
|
|
"RpcDot11ExtSetVirtualStationAPProperties"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140707753709952,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"9435cc56-1d9c-4924-ac7d-b60a2c3520e1": {
|
|
"Module": "sppsvc.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\sppsvc.exe",
|
|
"InterfaceId": "9435cc56-1d9c-4924-ac7d-b60a2c3520e1",
|
|
"InterfaceStructOffset": 3858208,
|
|
"ProceduresCount": 5,
|
|
"Procedures": [
|
|
"Proc0",
|
|
"Proc1",
|
|
"Proc2",
|
|
"Proc3",
|
|
"Proc4"
|
|
],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140699231198240,
|
|
"Service": "sppsvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"e1af8308-5d1f-11c9-91a4-08002b14a0fa": {
|
|
"Module": "RpcEpMap.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\RpcEpMap.dll",
|
|
"InterfaceId": "e1af8308-5d1f-11c9-91a4-08002b14a0fa",
|
|
"InterfaceStructOffset": 45248,
|
|
"ProceduresCount": 9,
|
|
"Procedures": [
|
|
"ept_delete",
|
|
"ept_delete",
|
|
"ept_lookup",
|
|
"ept_map",
|
|
"ept_lookup_handle_free",
|
|
"ept_delete",
|
|
"ept_delete",
|
|
"ept_map_auth",
|
|
"ept_map_auth_async"
|
|
],
|
|
"ProcStackSize": 80,
|
|
"DispatchFunction": 140708134459744,
|
|
"Service": "RpcEptMapper",
|
|
"IsServiceRunning": true
|
|
},
|
|
"4f4fa786-2f8f-49e8-8aae-6669febd5d1d": {
|
|
"Module": "lpasvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\lpasvc.dll",
|
|
"InterfaceId": "4f4fa786-2f8f-49e8-8aae-6669febd5d1d",
|
|
"InterfaceStructOffset": 992336,
|
|
"ProceduresCount": 23,
|
|
"Procedures": [
|
|
"LuiApiOpenHandle",
|
|
"LuiApiCloseHandle",
|
|
"LuiApiRegisterForAllEnterpriseProfileNotifications",
|
|
"LuiApiRegisterForAllProfileNotifications",
|
|
"LuiApiRegisterForEnterpriseEsimNotifications",
|
|
"LuiApiRegisterForEsimNotifications",
|
|
"LuiApiRegisterForLpaNotifications",
|
|
"LuiApiAddProfile",
|
|
"LuiApiCancelOperation",
|
|
"LuiApiDeleteProfile",
|
|
"LuiApiDisableProfile",
|
|
"LuiApiDiscoverProfiles",
|
|
"LuiApiEnableProfile",
|
|
"LuiApiInstallProfile",
|
|
"LuiApiProcessActivationCode",
|
|
"LuiApiReleaseProvisioningProfile",
|
|
"LuiApiRequestProvisioningProfile",
|
|
"LuiApiSetDefaultSmdpAddress",
|
|
"LuiApiSetEsimPolicy",
|
|
"LuiApiSetProfileNickname",
|
|
"LuiApiSetUserAuthenticationMode",
|
|
"LuiApiVerifyClientToken",
|
|
"LuiApiWipeEsim"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140707094052928,
|
|
"Service": "wlpasvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"4b112204-0e19-11d3-b42b-0000f81feb9f": {
|
|
"Module": "ssdpsrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\ssdpsrv.dll",
|
|
"InterfaceId": "4b112204-0e19-11d3-b42b-0000f81feb9f",
|
|
"InterfaceStructOffset": 217120,
|
|
"ProceduresCount": 21,
|
|
"Procedures": [
|
|
"_SSDPOpenRpc",
|
|
"_SSDPCloseRpc",
|
|
"RegisterServiceExRpc",
|
|
"_DeregisterServiceRpc",
|
|
"CleanupCacheRpc",
|
|
"BeginSearchRpc",
|
|
"GetSearchNotificationRpc",
|
|
"CancelSearchRpc",
|
|
"CloseSearchRpc",
|
|
"EnableNotificationRpc",
|
|
"_InitializeSyncHandle",
|
|
"_RemoveSyncHandle",
|
|
"RegisterNotificationRpc",
|
|
"RegisterNotificationAsyncRpc",
|
|
"_GetNotificationRpc",
|
|
"_WakeupGetNotificationRpc",
|
|
"DeregisterNotificationRpc",
|
|
"SetICSInterfaces",
|
|
"SetICSOff",
|
|
"EnableFirewallRuleRpc",
|
|
"DisableFirewallRuleRpc"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140708048804496,
|
|
"Service": "SSDPSRV",
|
|
"IsServiceRunning": true
|
|
},
|
|
"8a92a787-eba6-4d09-ba84-0a8cb293bc30": {
|
|
"Module": "AppVEntSubsystems64.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\AppVEntSubsystems64.dll",
|
|
"InterfaceId": "8a92a787-eba6-4d09-ba84-0a8cb293bc30",
|
|
"InterfaceStructOffset": 1410848,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"IActivationMarshaller_CoGetClassObject"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140706797638080,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5": {
|
|
"Module": "dhcpcore.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\dhcpcore.dll",
|
|
"InterfaceId": "3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5",
|
|
"InterfaceStructOffset": 270336,
|
|
"ProceduresCount": 43,
|
|
"Procedures": [
|
|
"RpcSrvEnableDhcp",
|
|
"RpcSrvEnableDhcpAdvanced",
|
|
"RpcSrvRenewLease",
|
|
"RpcSrvDeleteStaticAddressAndDefaultGateways",
|
|
"RpcSrvCheckServerAvailability",
|
|
"RpcSrvRenewLeaseByBroadcast",
|
|
"RpcSrvReleaseLease",
|
|
"RpcSrvSetFallbackParams",
|
|
"RpcSrvGetFallbackParams",
|
|
"RpcSrvFallbackRefreshParams",
|
|
"RpcSrvStaticRefreshParams",
|
|
"RpcSrvRemoveDnsRegistrations",
|
|
"RpcSrvRequestParams",
|
|
"RpcSrvPersistentRequestParams",
|
|
"RpcSrvRegisterParams",
|
|
"RpcSrvDeRegisterParams",
|
|
"RpcSrvEnumInterfaces",
|
|
"RpcSrvQueryLeaseInfo",
|
|
"RpcSrvQueryLeaseInfoArray",
|
|
"RpcSrvSetClassId",
|
|
"RpcSrvGetClassId",
|
|
"RpcSrvSetClientId",
|
|
"RpcSrvGetClientId",
|
|
"RpcSrvNotifyMediaReconnected",
|
|
"RpcSrvGetOriginalSubnetMask",
|
|
"RpcSrvSetMSFTVendorSpecificOptions",
|
|
"RpcSrvRequestCachedParams",
|
|
"RpcSrvRegisterConnectionStateNotification",
|
|
"RpcSrvDeRegisterConnectionStateNotification",
|
|
"RpcSrvGetNotificationStatus",
|
|
"RpcSrvGetDhcpServicedConnections",
|
|
"RpcSrvGetTraceArray",
|
|
"RpcSrvEnableTracing",
|
|
"RpcSrvLeaseIpAddressEx",
|
|
"RpcSrvRenewIpAddressLeaseEx",
|
|
"RpcSrvReleaseIpAddressLeaseEx",
|
|
"RpcSrvMadcapApiStartup",
|
|
"RpcSrvMadcapApiCleanup",
|
|
"RpcSrvMadcapEnumerateScopes",
|
|
"RpcSrvMadcapGenUID",
|
|
"RpcSrvMadcapRequestAddress",
|
|
"RpcSrvMadcapRenewAddress",
|
|
"RpcSrvMadcapReleaseAddress"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140708059983744,
|
|
"Service": "Dhcp",
|
|
"IsServiceRunning": true
|
|
},
|
|
"5824833b-3c1a-4ad2-bdfd-c31d19e23ed2": {
|
|
"Module": "psmsrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\psmsrv.dll",
|
|
"InterfaceId": "5824833b-3c1a-4ad2-bdfd-c31d19e23ed2",
|
|
"InterfaceStructOffset": 168768,
|
|
"ProceduresCount": 6,
|
|
"Procedures": [
|
|
"PsmSrvRegisterAppPriorityNotification",
|
|
"PsmSrvQueryApplicationResourceUsageForTimer",
|
|
"PsmSrvTimerStart",
|
|
"PsmSrvTimerCleanup",
|
|
"PsmSrvTimerRemainingResourceTimeGet",
|
|
"PsmSrvTimerElapsedResourceTimeGet"
|
|
],
|
|
"ProcStackSize": 104,
|
|
"DispatchFunction": 140708134219824,
|
|
"Service": "BrokerInfrastructure",
|
|
"IsServiceRunning": true
|
|
},
|
|
"ecd85155-cc3a-4f10-aad5-9a9a2bf2ef0c": {
|
|
"Module": "termsrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\termsrv.dll",
|
|
"InterfaceId": "ecd85155-cc3a-4f10-aad5-9a9a2bf2ef0c",
|
|
"InterfaceStructOffset": 747680,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"RpcSetAutologonPassword"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140708119080560,
|
|
"Service": "TermService",
|
|
"IsServiceRunning": true
|
|
},
|
|
"c8cb7687-e6d3-11d2-a958-00c04f682e16": {
|
|
"Module": "WebClnt.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\WebClnt.dll",
|
|
"InterfaceId": "c8cb7687-e6d3-11d2-a958-00c04f682e16",
|
|
"InterfaceStructOffset": 189584,
|
|
"ProceduresCount": 19,
|
|
"Procedures": [
|
|
"DavrCreateConnection",
|
|
"DavrGetCookie",
|
|
"DavrSetCookie",
|
|
"DavrDoesServerDoDav",
|
|
"DavrIsValidShare",
|
|
"DavrEnumNetUses",
|
|
"DavrEnumShares",
|
|
"DavrEnumServers",
|
|
"DavrGetConnection",
|
|
"DavrDeleteConnection",
|
|
"DavrCancelConnectionsToServer",
|
|
"DavrGetUser",
|
|
"DavrConnectionExist",
|
|
"BeginChildren",
|
|
"DavrFreeUsedDiskSpace",
|
|
"DavrGetTheLockOwnerOfTheFile",
|
|
"DavrInvalidateCache",
|
|
"DavrIsWebClientRunning",
|
|
"DavrGetServerAuthType"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140707580976304,
|
|
"Service": "WebClient",
|
|
"IsServiceRunning": false
|
|
},
|
|
"3473dd4d-2e88-4006-9cba-22570909dd10": {
|
|
"Module": "winhttp.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\winhttp.dll",
|
|
"InterfaceId": "3473dd4d-2e88-4006-9cba-22570909dd10",
|
|
"InterfaceStructOffset": 789984,
|
|
"ProceduresCount": 11,
|
|
"Procedures": [
|
|
"GetProxyForUrl",
|
|
"ResetAutoProxy",
|
|
"SaveProxyCredentials",
|
|
"StoreSavedProxyCredentialsForCurrentUser",
|
|
"DeleteSavedProxyCredentials",
|
|
"ReindicateAllProxies",
|
|
"ReadProxySettings",
|
|
"WriteProxySettings",
|
|
"ConnectionUpdateIfIndexTable",
|
|
"ConnectionSetPolicyEntries",
|
|
"ConnectionDeletePolicyEntries"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140708017721872,
|
|
"Service": "WinHttpAutoProxySvc",
|
|
"IsServiceRunning": true
|
|
},
|
|
"58e604e8-9adb-4d2e-a464-3b0683fb1480": {
|
|
"Module": "appinfo.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\appinfo.dll",
|
|
"InterfaceId": "58e604e8-9adb-4d2e-a464-3b0683fb1480",
|
|
"InterfaceStructOffset": 106592,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"RAiGetTokenForAxIS"
|
|
],
|
|
"ProcStackSize": 88,
|
|
"DispatchFunction": 140707486597664,
|
|
"Service": "Appinfo",
|
|
"IsServiceRunning": true
|
|
},
|
|
"a3e5af3e-8a33-4737-af6e-bc1f8ecee4bf": {
|
|
"Module": "LsaIso.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\LsaIso.exe",
|
|
"InterfaceId": "a3e5af3e-8a33-4737-af6e-bc1f8ecee4bf",
|
|
"InterfaceStructOffset": 179344,
|
|
"ProceduresCount": 5,
|
|
"Procedures": [
|
|
"ProvIumCreateMachineKey",
|
|
"ProvIumCreateMachineSelfSignedCertificate",
|
|
"ProvIumCreateMachineCertificateRequest",
|
|
"ProvIumCheckMachineKey",
|
|
"ProvIumCheckRootSecretValidity"
|
|
],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140697528904208,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"0c53aa2e-fb1c-49c5-bfb6-c54f8e5857cd": {
|
|
"Module": "SyncController.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\SyncController.dll",
|
|
"InterfaceId": "0c53aa2e-fb1c-49c5-bfb6-c54f8e5857cd",
|
|
"InterfaceStructOffset": 498464,
|
|
"ProceduresCount": 14,
|
|
"Procedures": [
|
|
"ActiveSyncServer_QuerySyncStatusProps",
|
|
"ActiveSyncServer_QueryLastSyncResult",
|
|
"ActiveSyncServer_SetPassword",
|
|
"ActiveSyncServer_CopyCredentials",
|
|
"ActiveSyncServer_DeletePassword",
|
|
"ActiveSyncServer_IsPasswordSet",
|
|
"ActiveSyncServer_CreateDataStoreLock",
|
|
"ActiveSyncServer_CloseDataStoreLock",
|
|
"ActiveSyncServer_SetConversationSyncEnabled",
|
|
"ActiveSyncServer_GetConversationSyncEnabled",
|
|
"ActiveSyncServer_SetUnifiedInboxEnabled",
|
|
"ActiveSyncServer_GetUnifiedInboxEnabled",
|
|
"ActiveSyncServer_GetUnifiedInboxServerValue",
|
|
"ActiveSyncServer_GetUserInfoForUnconfiguredAccount"
|
|
],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140707460332240,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"22e5386d-8b12-4bf0-b0ec-6a1ea419e366": {
|
|
"Module": "NetEvtFwdr.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\NetEvtFwdr.exe",
|
|
"InterfaceId": "22e5386d-8b12-4bf0-b0ec-6a1ea419e366",
|
|
"InterfaceStructOffset": 25488,
|
|
"ProceduresCount": 3,
|
|
"Procedures": [
|
|
"RpcNetEventOpenSession",
|
|
"RpcNetEventReceiveData",
|
|
"RpcNetEventCloseSession"
|
|
],
|
|
"ProcStackSize": 8,
|
|
"DispatchFunction": 140702640380160,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"64d1d045-f675-460b-8a94-570246b36dab": {
|
|
"Module": "ClipSVC.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\ClipSVC.dll",
|
|
"InterfaceId": "64d1d045-f675-460b-8a94-570246b36dab",
|
|
"InterfaceStructOffset": 820464,
|
|
"ProceduresCount": 4,
|
|
"Procedures": [
|
|
"rpcsClipOpen",
|
|
"rpcsClipClose",
|
|
"rpcsClipExecute",
|
|
"rpcsClipExecute2"
|
|
],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140707382121168,
|
|
"Service": "ClipSVC",
|
|
"IsServiceRunning": false
|
|
},
|
|
"f3f09ffd-fbcf-4291-944d-70ad6e0e73bb": {
|
|
"Module": "LogonController.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\LogonController.dll",
|
|
"InterfaceId": "f3f09ffd-fbcf-4291-944d-70ad6e0e73bb",
|
|
"InterfaceStructOffset": 594528,
|
|
"ProceduresCount": 29,
|
|
"Procedures": [
|
|
"WluirAbort",
|
|
"WluirSecureDisplayLocked",
|
|
"WluirDisplayLocked",
|
|
"WluirWaitForLockScreenDismiss",
|
|
"WluirDisplayMessage",
|
|
"WluirDisplayRequestCredentialsError",
|
|
"WluirDisplaySequentialLogonPrompt",
|
|
"WluirDisplaySecurityOptions",
|
|
"WluirDisplayStatus",
|
|
"WluirDisplayStatusOnCredentialPage",
|
|
"WluirDisplayTSDisconnectOptions",
|
|
"WluirDisplayWelcome",
|
|
"WluirNotifyIsReadyForDesktopSwitch",
|
|
"WluirPromptForCredentials",
|
|
"WluirReleaseContext",
|
|
"WluirClearUIState",
|
|
"WluirReportResult",
|
|
"WluirRequestCredentials",
|
|
"WluirDisplayTSDisconnectUI",
|
|
"WluirDisplayTSReconnectUI",
|
|
"WluirNotifyUserIsLoggedOn",
|
|
"WluirFinishOperation",
|
|
"WluirInformLogonUI",
|
|
"WluirDelayLocked",
|
|
"WluirSecureDelayLocked",
|
|
"WluirGetShutdownResolverInfo",
|
|
"WluirSignalShutdown",
|
|
"WluirPrepareWebDialog",
|
|
"WluirWaitForWebDialogComplete"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140707094315136,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"51a227ae-825b-41f2-b4a9-1ac9557a1018": {
|
|
"Module": "keyiso.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\keyiso.dll",
|
|
"InterfaceId": "51a227ae-825b-41f2-b4a9-1ac9557a1018",
|
|
"InterfaceStructOffset": 57344,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"s_TokenBindingGenerateTpmKeyFromSoftware"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140707761406896,
|
|
"Service": "KeyIso",
|
|
"IsServiceRunning": true
|
|
},
|
|
"1f53838b-693a-4bbb-99c9-b154f749b8a3": {
|
|
"Module": "audiodg.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\audiodg.exe",
|
|
"InterfaceId": "1f53838b-693a-4bbb-99c9-b154f749b8a3",
|
|
"InterfaceStructOffset": 426720,
|
|
"ProceduresCount": 7,
|
|
"Procedures": [
|
|
"AudioDGGetStartupStatus",
|
|
"AudioDGChallenge",
|
|
"AudioDGGetStreamVpoDescription",
|
|
"AudioDGSetStreamVpoPolicySchemas",
|
|
"AudioDGCloseStreamVpo",
|
|
"AudioDGGetDeviceGraphWnfStateName",
|
|
"AudioDGGetVpoFromVpoContext"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140702252390464,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"09c76598-1491-4810-bbb0-7f403a2ab7ea": {
|
|
"Module": "winhttp.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\winhttp.dll",
|
|
"InterfaceId": "09c76598-1491-4810-bbb0-7f403a2ab7ea",
|
|
"InterfaceStructOffset": 806512,
|
|
"ProceduresCount": 3,
|
|
"Procedures": [
|
|
"s_PacScriptWorkerOpenSiteRpc",
|
|
"s_PacScriptWorkerCloseSiteRpc",
|
|
"s_PacScriptWorkerGetProxyRpc"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140708017922496,
|
|
"Service": "WinHttpAutoProxySvc",
|
|
"IsServiceRunning": true
|
|
},
|
|
"f19c345c-5e00-4cb4-b1d1-eff9ea31b166": {
|
|
"Module": "DeviceSetupManager.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\DeviceSetupManager.dll",
|
|
"InterfaceId": "f19c345c-5e00-4cb4-b1d1-eff9ea31b166",
|
|
"InterfaceStructOffset": 168032,
|
|
"ProceduresCount": 4,
|
|
"Procedures": [
|
|
"DsmRpcInstallDevice",
|
|
"DsmRpcRemoveDevice",
|
|
"DsmRpcSetServicePaused",
|
|
"DsmRpcGetServiceInfo"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140707581087696,
|
|
"Service": "DsmSvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"6b06753b-9073-4cfd-ba89-12af04bec9eb": {
|
|
"Module": "TimeBrokerServer.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\TimeBrokerServer.dll",
|
|
"InterfaceId": "6b06753b-9073-4cfd-ba89-12af04bec9eb",
|
|
"InterfaceStructOffset": 118976,
|
|
"ProceduresCount": 5,
|
|
"Procedures": [
|
|
"TbThQueryEventState",
|
|
"TbThSimulatePowerState",
|
|
"TbThSimulatePsmQuantumStart",
|
|
"TbThSimulateExpireEvent",
|
|
"TbThSimulateChangeLockScreen"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140708098226400,
|
|
"Service": "TimeBrokerSvc",
|
|
"IsServiceRunning": true
|
|
},
|
|
"8be456ec-9244-4d10-88e8-1ddf1baa9ade": {
|
|
"Module": "PhoneService.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\PhoneService.dll",
|
|
"InterfaceId": "8be456ec-9244-4d10-88e8-1ddf1baa9ade",
|
|
"InterfaceStructOffset": 780672,
|
|
"ProceduresCount": 85,
|
|
"Procedures": [
|
|
"PhoneSvcImpl_PhoneRpcDial",
|
|
"PhoneSvcImpl_PhoneRpcEnd",
|
|
"PhoneSvcImpl_PhoneRpcSwap",
|
|
"PhoneSvcImpl_PhoneRpcHold",
|
|
"PhoneSvcImpl_PhoneRpcFlash",
|
|
"PhoneSvcImpl_PhoneRpcConference",
|
|
"PhoneSvcImpl_PhoneRpcPrivate",
|
|
"PhoneSvcImpl_PhoneRpcSendDtmf",
|
|
"PhoneSvcImpl_PhoneRpcSendDtmfStart",
|
|
"PhoneSvcImpl_PhoneRpcSendDtmfStop",
|
|
"PhoneSvcImpl_PhoneRpcAcceptIncoming",
|
|
"PhoneSvcImpl_PhoneRpcRejectIncomingEx",
|
|
"PhoneSvcImpl_PhoneRpcDropAccept",
|
|
"PhoneSvcImpl_PhoneRpcGetContactPictureHandle",
|
|
"PhoneSvcImpl_PhoneRpcGetCallInfo",
|
|
"PhoneSvcImpl_PhoneRpcGetState",
|
|
"PhoneSvcImpl_PhoneRpcGetCallCounts",
|
|
"PhoneSvcImpl_PhoneRpcGetProviderLineInfo",
|
|
"PhoneSvcImpl_PhoneRpcGetProviderLineServiceInfo",
|
|
"PhoneSvcImpl_PhoneRpcGetProviderLineLockInfo",
|
|
"PhoneSvcImpl_PhoneRpcModifyLineSetting",
|
|
"PhoneSvcImpl_PhoneRpcSendRealTimeTextData",
|
|
"PhoneSvcImpl_PhoneRpcAcceptUpgradingRealTimeTextCall",
|
|
"PhoneSvcImpl_PhoneRpcUpgradeToRealTimeTextCall",
|
|
"PhoneSvcImpl_PhoneRpcDowngradeFromRealTimeTextCall",
|
|
"PhoneSvcImpl_PhoneRpcGetAudioRouting",
|
|
"PhoneSvcImpl_PhoneRpcSetAudioRouting",
|
|
"PhoneSvcImpl_PhoneRpcSetMute",
|
|
"PhoneSvcImpl_PhoneRpcSetBluetoothHfpCallAudioTransfer",
|
|
"PhoneSvcImpl_PhoneRpcClearIdleCallsFromController",
|
|
"PhoneSvcImpl_PhoneRpcIsDtmfWaitPending",
|
|
"PhoneSvcImpl_PhoneRpcExitEmergencyMode",
|
|
"PhoneSvcImpl_PhoneRpcGetCellularApiComponentInfo",
|
|
"PhoneSvcImpl_PhoneRpcGetVoicemailNumberAndOverrideInfo",
|
|
"PhoneSvcImpl_PhoneRpcInitiateRetrievalOfCIDRestrictionSupport",
|
|
"PhoneSvcImpl_PhoneRpcRefreshCallForwardingState",
|
|
"PhoneSvcImpl_PhoneRpcGetServiceProcessId",
|
|
"PhoneSvcImpl_PhoneRpcStartVoicemailSync",
|
|
"PhoneSvcImpl_PhoneRpcSaveVvmPassword",
|
|
"PhoneSvcImpl_PhoneRpcGetSupportsLocalVvmConfig",
|
|
"PhoneSvcImpl_PhoneRpcActivateVisualVoicemail",
|
|
"PhoneSvcImpl_PhoneRpcDeactivateVisualVoicemail",
|
|
"PhoneSvcImpl_PhoneRpcGetVisualVoicemailAccessorInfo",
|
|
"PhoneSvcImpl_PhoneRpcGetVisualVoicemailBranding",
|
|
"PhoneSvcImpl_PhoneRpcMapIddPrefixToPlus",
|
|
"PhoneSvcImpl_PhoneRpcGetAssistedDialNumber",
|
|
"PhoneSvcImpl_PhoneRpcGetAssistedDialSetting",
|
|
"PhoneSvcImpl_PhoneRpcGetGlobalAvailableVerbs",
|
|
"PhoneSvcImpl_PhoneRpcGetNetworkAlertText",
|
|
"PhoneSvcImpl_PhoneRpcIsVvmSetupComplete",
|
|
"PhoneSvcImpl_PhoneRpcMarkVvmSetupComplete",
|
|
"PhoneSvcImpl_PhoneRpcReinitiateCallerIdLookup",
|
|
"PhoneSvcImpl_PhoneRpcGetPreferredCallUpgradeLine",
|
|
"PhoneSvcImpl_PhoneRpcSetPreferredCallUpgradeLine",
|
|
"PhoneSvcImpl_PhoneRpcInitiateCallUpgrade",
|
|
"PhoneSvcImpl_PhoneRpcIsVoiceRoamingRestrictionActive",
|
|
"PhoneSvcImpl_PhoneRpcSetForegroundLine",
|
|
"PhoneSvcImpl_PhoneRpcGetAggregateBranding",
|
|
"PhoneSvcImpl_PhoneRpcGetBrandingText",
|
|
"PhoneSvcImpl_PhoneRpcSetReminderInfo",
|
|
"PhoneSvcImpl_PhoneRpcConfirmNonSeamlessUpgrade",
|
|
"PhoneSvcImpl_PhoneRpcCancelNonSeamlessUpgrade",
|
|
"PhoneSvcImpl_PhoneRpcSetLocalVideo",
|
|
"PhoneSvcImpl_PhoneRpcAddVideo",
|
|
"PhoneSvcImpl_PhoneRpcDropVideo",
|
|
"PhoneSvcImpl_PhoneRpcAcceptVideo",
|
|
"PhoneSvcImpl_PhoneRpcRejectVideo",
|
|
"PhoneSvcImpl_PhoneRpcSetVideoPaused",
|
|
"PhoneSvcImpl_PhoneRpcRefreshVideoCallingSetting",
|
|
"PhoneSvcImpl_PhoneRpcIsVideoCallingSwitchActionable",
|
|
"PhoneSvcImpl_PhoneRpcSetActiveAppByType",
|
|
"PhoneSvcImpl_PhoneRpcGetAppListByType",
|
|
"PhoneSvcImpl_PhoneRpcSetActiveSpamFilterApp",
|
|
"PhoneSvcImpl_PhoneRpcHandleAppUninstallByType",
|
|
"PhoneSvcImpl_PhoneRpcGetRecordingState",
|
|
"PhoneSvcImpl_PhoneRpcStartRecording",
|
|
"PhoneSvcImpl_PhoneRpcPauseRecording",
|
|
"PhoneSvcImpl_PhoneRpcFinishRecording",
|
|
"PhoneSvcImpl_PhoneRpcRefreshEcbmState",
|
|
"PhoneSvcImpl_PhoneRpcGetVideoCapabilitySharingSettings",
|
|
"PhoneSvcImpl_PhoneRpcSetVideoCapabilitySharingSettings",
|
|
"PhoneSvcImpl_PhoneRpcExplicitCallTransfer",
|
|
"PhoneSvcImpl_PhoneRpcMarkDataAffinityNotificationSeen",
|
|
"PhoneSvcImpl_ReceivedSystemNotificationCallbackPayload",
|
|
"PhoneSvcImpl_RpcRetrieveSystemNotificationCallbackPayload"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140707094323776,
|
|
"Service": "PhoneSvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"e0606e56-2380-422f-a66f-ae6b71b85832": {
|
|
"Module": "FsIso.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\FsIso.exe",
|
|
"InterfaceId": "e0606e56-2380-422f-a66f-ae6b71b85832",
|
|
"InterfaceStructOffset": 62960,
|
|
"ProceduresCount": 8,
|
|
"Procedures": [
|
|
"RpcCloseSecureSection",
|
|
"RpcCopySecureSection",
|
|
"RpcCreateSecureSection",
|
|
"RpcDestroyFsIsoConnection",
|
|
"RpcEstablishFsIsoConnection",
|
|
"RpcCreateMJPEGSession",
|
|
"RpcDecodeOneMJPGFrameSecure",
|
|
"RpcDeleteMJPEGSession"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140695587203136,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"0361ae94-0316-4c6c-8ad8-c594375800e2": {
|
|
"Module": "psmsrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\psmsrv.dll",
|
|
"InterfaceId": "0361ae94-0316-4c6c-8ad8-c594375800e2",
|
|
"InterfaceStructOffset": 168864,
|
|
"ProceduresCount": 8,
|
|
"Procedures": [
|
|
"PsmSrvQueryCurrentApplications",
|
|
"PsmSrvQueryApplicationHosts",
|
|
"PsmSrvQueryApplicationHostExecutionState",
|
|
"PsmSrvQueryApplicationHostJob",
|
|
"PsmSrvConnect",
|
|
"PsmSrvDisconnect",
|
|
"PsmSrvSubscribeToNotifications",
|
|
"PsmSrvUnsubscribeFromNotifications"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140708134220512,
|
|
"Service": "BrokerInfrastructure",
|
|
"IsServiceRunning": true
|
|
},
|
|
"2d98a740-581d-41b9-aa0d-a88b9d5ce938": {
|
|
"Module": "bisrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\bisrv.dll",
|
|
"InterfaceId": "2d98a740-581d-41b9-aa0d-a88b9d5ce938",
|
|
"InterfaceStructOffset": 551872,
|
|
"ProceduresCount": 28,
|
|
"Procedures": [
|
|
"RBiSrvActivateDeferredWorkItem",
|
|
"RBiSrvActivateInBackground",
|
|
"RBiSrvActivateWorkItem",
|
|
"RBiSrvAssociateActivationProxy",
|
|
"RBiSrvAssociateApplicationExtensionClass",
|
|
"RBiSrvCancelWorkItem",
|
|
"RBiSrvCreateEvent",
|
|
"RBiSrvCreateEventForPackageName",
|
|
"RBiSrvDeleteEvent",
|
|
"RBiSrvDisassociateWorkItem",
|
|
"RBiSrvDiscardPendingActivations",
|
|
"RBiSrvEnumerateBrokeredEvents",
|
|
"RBiSrvEnumerateUserContexts",
|
|
"RBiSrvEnumerateUserSessions",
|
|
"RBiSrvEnumerateWorkItemsForPackageName",
|
|
"RBiPtSrvGetStatusStateNameFromBrokerEventId",
|
|
"RBiSrvQueryBrokeredEvent",
|
|
"RBiSrvQuerySystemStateBroadcastChannels",
|
|
"RBiSrvQueryUserContext",
|
|
"RBiSrvQueryUserSession",
|
|
"RBiSrvQueryWorkItem",
|
|
"RBiPtSrvQueryWorkItemStatusStateName",
|
|
"RBiSrvSignalEvent",
|
|
"RBiSrvSignalMultipleEvents",
|
|
"RBiSrvSignalTriggerEvent",
|
|
"RBiSrvUpdateEventParameters",
|
|
"RBiSrvUpdateEventFlags",
|
|
"RBiSrvUpdateEventInformation"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140708131127056,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"a0bc4698-b8d7-4330-a28f-7709e18b6108": {
|
|
"Module": "Sens.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\Sens.dll",
|
|
"InterfaceId": "a0bc4698-b8d7-4330-a28f-7709e18b6108",
|
|
"InterfaceStructOffset": 49344,
|
|
"ProceduresCount": 3,
|
|
"Procedures": [
|
|
"RPC_SensNotifyWinlogonEvent",
|
|
"RPC_SensNotifyRasEvent",
|
|
"RPC_SensNotifyNetconEvent"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140708049295712,
|
|
"Service": "SENS",
|
|
"IsServiceRunning": true
|
|
},
|
|
"a4b04892-b1e0-5ca3-a5e4-098751b2b4c2": {
|
|
"Module": "vmsp.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\vmsp.exe",
|
|
"InterfaceId": "a4b04892-b1e0-5ca3-a5e4-098751b2b4c2",
|
|
"InterfaceStructOffset": 113280,
|
|
"ProceduresCount": 10,
|
|
"Procedures": [
|
|
"RpcVmspOpenSecureHandle",
|
|
"RpcVmspCloseSecureHandle",
|
|
"RpcVTpmInitialize",
|
|
"RpcVTpmShutdown",
|
|
"RpcVTpmExecuteCommand",
|
|
"RpcVTpmGetRuntimeSize",
|
|
"RpcVTpmGetRuntimeState",
|
|
"RpcVTpmSetCancelFlag",
|
|
"Deserialize",
|
|
"RpcVTpmCreateReport"
|
|
],
|
|
"ProcStackSize": 72,
|
|
"DispatchFunction": 140701201367168,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"fc13257d-5567-4dea-898d-c6f9c48415a0": {
|
|
"Module": "mqqm.dll",
|
|
"ModulePath": "C:\\Windows\\WinSxS\\amd64_microsoft-windows-msmq-queuemanager-core_31bf3856ad364e35_10.0.18362.1977_none_8d1646dec2a87b94\\mqqm.dll",
|
|
"InterfaceId": "fc13257d-5567-4dea-898d-c6f9c48415a0",
|
|
"InterfaceStructOffset": 1028128,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"R_ProcessHTTPRequest"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140707093564560,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"acd792e4-5239-48b6-8baf-7d0a79a64ac0": {
|
|
"Module": "SmsRouterSvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\SmsRouterSvc.dll",
|
|
"InterfaceId": "acd792e4-5239-48b6-8baf-7d0a79a64ac0",
|
|
"InterfaceStructOffset": 427728,
|
|
"ProceduresCount": 16,
|
|
"Procedures": [
|
|
"RpcSmsRouter_GetRegistrationList",
|
|
"RpcSmsRouter_RegisterForMessagesPersistent",
|
|
"RpcSmsRouter_UnregisterForMessagesPersistent",
|
|
"RpcSmsRouter_RegisterForMessagesTransient",
|
|
"RpcSmsRouter_UnregisterForMessagesTransient",
|
|
"RpcSmsRouter_GetMessageAvailableEvent",
|
|
"RpcSmsRouter_GetMessage",
|
|
"RpcSmsRouter_AcknowledgeMessage",
|
|
"RpcSmsRouter_SendMessage",
|
|
"RpcSmsRouter_SendMessageClose",
|
|
"SetBroadcastConfiguration",
|
|
"SetBroadcastConfiguration",
|
|
"SetBroadcastConfiguration",
|
|
"RpcSmsRouter_SetSmscAddress",
|
|
"RpcSmsRouter_GetSmscAddress",
|
|
"RpcSmsRouter_GetSmsDeviceStatusEvent"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140707580621328,
|
|
"Service": "SmsRouter",
|
|
"IsServiceRunning": false
|
|
},
|
|
"906b0ce0-c70b-1067-b317-00dd010662da": {
|
|
"Module": "msdtcprx.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\msdtcprx.dll",
|
|
"InterfaceId": "906b0ce0-c70b-1067-b317-00dd010662da",
|
|
"InterfaceStructOffset": 533696,
|
|
"ProceduresCount": 8,
|
|
"Procedures": [
|
|
"Poke",
|
|
"BuildContext",
|
|
"NegotiateResources",
|
|
"SendReceive",
|
|
"TearDownContext",
|
|
"BeginTearDown",
|
|
"PokeW",
|
|
"BuildContextW"
|
|
],
|
|
"ProcStackSize": 104,
|
|
"DispatchFunction": 140707789486384,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"98716d03-89ac-44c7-bb8c-285824e51c4a": {
|
|
"Module": "srvsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\srvsvc.dll",
|
|
"InterfaceId": "98716d03-89ac-44c7-bb8c-285824e51c4a",
|
|
"InterfaceStructOffset": 192704,
|
|
"ProceduresCount": 6,
|
|
"Procedures": [
|
|
"XsOpenPrinter",
|
|
"XsClosePrinter",
|
|
"XsAddJob",
|
|
"XsScheduleJob",
|
|
"XsProcessPnp",
|
|
"XsProcDownLevelAPI"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140707955985056,
|
|
"Service": "LanmanServer",
|
|
"IsServiceRunning": true
|
|
},
|
|
"6982a06e-5fe2-46b1-b39c-a2c545bfa069": {
|
|
"Module": "PsmServiceExtHost.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\PsmServiceExtHost.dll",
|
|
"InterfaceId": "6982a06e-5fe2-46b1-b39c-a2c545bfa069",
|
|
"InterfaceStructOffset": 563616,
|
|
"ProceduresCount": 5,
|
|
"Procedures": [
|
|
"HamRpcSrvConnectFullTrust",
|
|
"HamRpcSrvDisconnect",
|
|
"HamRpcSrvFullTrustOpenPackageHandle",
|
|
"HamRpcSrvDebugClosePackageHandle",
|
|
"HamRpcSrvDebugTerminatePackage"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140708133772720,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"8bfc3be1-6def-4e2d-af74-7c47cd0ade4a": {
|
|
"Module": "bisrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\bisrv.dll",
|
|
"InterfaceId": "8bfc3be1-6def-4e2d-af74-7c47cd0ade4a",
|
|
"InterfaceStructOffset": 551776,
|
|
"ProceduresCount": 17,
|
|
"Procedures": [
|
|
"RBiSrvActivateWorkItemForUser",
|
|
"RBiSrvChangeApplicationStateForPackageNameForUser",
|
|
"RBiSrvChangeApplicationStateForPsmKeyForUser",
|
|
"RBiSrvChangeUserState",
|
|
"RBiSrvEnumerateWorkItemsForPackageNameAndUser",
|
|
"RBiSrvGetActiveBackgroundTasksEventForUser",
|
|
"RBiSrvGetCancellationTimeoutInMs",
|
|
"RBiSrvIsApplicationTerminateSensitiveForUser",
|
|
"RBiSrvNotifyEndSession",
|
|
"RBiSrvNotifyNewSession",
|
|
"RBiSrvNotifyNewSessionComplete",
|
|
"RBiSrvNotifyNewUser",
|
|
"RBiSrvQueryWorkItemForUser",
|
|
"RBiSrvResetActiveUserForPackage",
|
|
"RBiSrvSetActiveUserForPackage",
|
|
"RBiSrvTerminateApplicationHostForUser",
|
|
"RBiSrvUpdateBackgroundAccessApplicationsForUser"
|
|
],
|
|
"ProcStackSize": 64,
|
|
"DispatchFunction": 140708131126304,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"dd59071b-3215-4c59-8481-972edadc0f6a": {
|
|
"Module": "PsmServiceExtHost.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\PsmServiceExtHost.dll",
|
|
"InterfaceId": "dd59071b-3215-4c59-8481-972edadc0f6a",
|
|
"InterfaceStructOffset": 546672,
|
|
"ProceduresCount": 10,
|
|
"Procedures": [
|
|
"CrmRpcSrvRegister",
|
|
"CrmRpcSrvUnregister",
|
|
"CrmRpcSrvActivityAllocate",
|
|
"CrmRpcSrvActivityQueryWindowClosedReasons",
|
|
"CrmRpcSrvActivityFree",
|
|
"CrmRpcSrvActivityStart",
|
|
"CrmRpcSrvActivityRenew",
|
|
"CrmRpcSrvActivityStop",
|
|
"CrmRpcSrvActivityWindowClosedReasonSubscribe",
|
|
"CrmRpcSrvActivityWindowClosedReasonUnsubscribe"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140708133530944,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"a398e520-d59a-4bdd-aa7a-3c1e0303a511": {
|
|
"Module": "IKEEXT.DLL",
|
|
"ModulePath": "C:\\Windows\\System32\\IKEEXT.DLL",
|
|
"InterfaceId": "a398e520-d59a-4bdd-aa7a-3c1e0303a511",
|
|
"InterfaceStructOffset": 835664,
|
|
"ProceduresCount": 10,
|
|
"Procedures": [
|
|
"IkeRpcIkeGetStatistics",
|
|
"IkeRpcIkeSACreateEnumHandle",
|
|
"IkeRpcIkeSAEnum",
|
|
"IkeRpcIkeSADestroyEnumHandle",
|
|
"IkeRpcIkeSADeleteById",
|
|
"IkeRpcIkeSAGetById",
|
|
"IkeRpcIkeSaDbGetSecurityInfo",
|
|
"IkeRpcIkeSaDbSetSecurityInfo",
|
|
"IkeRpcIkeSaUpdatePreferredAddressesAsync",
|
|
"IkeRpcIkeSaUpdateAdditionalAddressesAsync"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140707093787648,
|
|
"Service": "IKEEXT",
|
|
"IsServiceRunning": false
|
|
},
|
|
"1495a2be-b7a8-4299-9d3b-8825e5bcbfb9": {
|
|
"Module": "webauthn.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\webauthn.dll",
|
|
"InterfaceId": "1495a2be-b7a8-4299-9d3b-8825e5bcbfb9",
|
|
"InterfaceStructOffset": 343568,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"s_SSCtapCommand"
|
|
],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140707993672896,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"fdd45924-784a-499c-aee9-0813850ce182": {
|
|
"Module": "DiagnosticInvoker.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\DiagnosticInvoker.dll",
|
|
"InterfaceId": "fdd45924-784a-499c-aee9-0813850ce182",
|
|
"InterfaceStructOffset": 75824,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"Server_NotifyProgress"
|
|
],
|
|
"ProcStackSize": 8,
|
|
"DispatchFunction": 140707880915648,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"2579ff35-0ab0-4e5a-88fa-1d88c4e0cb92": {
|
|
"Module": "crypttpmeksvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\crypttpmeksvc.dll",
|
|
"InterfaceId": "2579ff35-0ab0-4e5a-88fa-1d88c4e0cb92",
|
|
"InterfaceStructOffset": 40960,
|
|
"ProceduresCount": 5,
|
|
"Procedures": [
|
|
"s_SSTpmEndorsementKeyGetInfo",
|
|
"s_SSTpmEndorsementKeyDecryptChallenge",
|
|
"s_SSTpmAttestationCapable",
|
|
"s_SSTpmGetAttestationForAik",
|
|
"s_SSTpmGetManufacturerInfo"
|
|
],
|
|
"ProcStackSize": 80,
|
|
"DispatchFunction": 140707994238576,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"63fbe424-2029-11d1-8db8-00aa004abd5e": {
|
|
"Module": "Sens.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\Sens.dll",
|
|
"InterfaceId": "63fbe424-2029-11d1-8db8-00aa004abd5e",
|
|
"InterfaceStructOffset": 49440,
|
|
"ProceduresCount": 3,
|
|
"Procedures": [
|
|
"RPC_IsNetworkAlive",
|
|
"RPC_IsDestinationReachableA",
|
|
"RPC_IsDestinationReachableA"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140708049267824,
|
|
"Service": "SENS",
|
|
"IsServiceRunning": true
|
|
},
|
|
"7f1317a8-4dea-4fa2-a551-df5516ff8879": {
|
|
"Module": "dpapisrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\dpapisrv.dll",
|
|
"InterfaceId": "7f1317a8-4dea-4fa2-a551-df5516ff8879",
|
|
"InterfaceStructOffset": 184512,
|
|
"ProceduresCount": 2,
|
|
"Procedures": [
|
|
"s_LRpcSIDKeyProtect",
|
|
"s_LRpcSIDKeyUnprotect"
|
|
],
|
|
"ProcStackSize": 64,
|
|
"DispatchFunction": 140708143086592,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"2eb08e3e-639f-4fba-97b1-14f878961076": {
|
|
"Module": "gpsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\gpsvc.dll",
|
|
"InterfaceId": "2eb08e3e-639f-4fba-97b1-14f878961076",
|
|
"InterfaceStructOffset": 770144,
|
|
"ProceduresCount": 8,
|
|
"Procedures": [
|
|
"Server_ProcessRefresh",
|
|
"Server_RegisterForNotification",
|
|
"Server_CheckRegisterForNotification",
|
|
"Server_LockPolicySection",
|
|
"Server_UnLockPolicySection",
|
|
"Server_GetGroupPolicyObjectList",
|
|
"Server_GetAppliedGroupPolicyObjectList",
|
|
"Server_GenerateGroupPolicyNotification"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140707093628208,
|
|
"Service": "gpsvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"1bddb2a6-c0c3-41be-8703-ddbdf4f0e80a": {
|
|
"Module": "dot3svc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\dot3svc.dll",
|
|
"InterfaceId": "1bddb2a6-c0c3-41be-8703-ddbdf4f0e80a",
|
|
"InterfaceStructOffset": 196960,
|
|
"ProceduresCount": 21,
|
|
"Procedures": [
|
|
"RpcOpenHandle",
|
|
"RpcCloseHandle",
|
|
"RpcEnumInterfaces",
|
|
"RpcSetInterface",
|
|
"RpcGetInterfaceState",
|
|
"RpcReConnect",
|
|
"RpcRegisterNotification",
|
|
"RpcAsyncGetNotification",
|
|
"RpcSetProfile",
|
|
"RpcGetProfile",
|
|
"RpcGetCurrentProfile",
|
|
"RpcDeleteProfile",
|
|
"RpcUIResponse",
|
|
"RpcQueryUIRequest",
|
|
"RpcSetProfileEapUserData",
|
|
"RpcAsyncDoPlap",
|
|
"RpcQueryPlapCredentials",
|
|
"RpcCancelPlap",
|
|
"RpcGetProfileEapUserDataInfo",
|
|
"RpcSetAutoConfigParameter",
|
|
"RpcQueryAutoConfigParameter"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140707580982704,
|
|
"Service": "dot3svc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"75ef42c7-22f4-44a0-8200-9351cd316e01": {
|
|
"Module": "CExecSvc.exe",
|
|
"ModulePath": "C:\\Windows\\WinSxS\\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.18362.1500_none_635326ad9114445f\\CExecSvc.exe",
|
|
"InterfaceId": "75ef42c7-22f4-44a0-8200-9351cd316e01",
|
|
"InterfaceStructOffset": 138752,
|
|
"ProceduresCount": 4,
|
|
"Procedures": [
|
|
"CExecCreateProcess",
|
|
"CExecResizeConsole",
|
|
"CExecSignalProcess",
|
|
"CExecShutdownSystem"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140703104628976,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"7aeb6705-3ae6-471a-882d-f39c109edc12": {
|
|
"Module": "wcmsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\wcmsvc.dll",
|
|
"InterfaceId": "7aeb6705-3ae6-471a-882d-f39c109edc12",
|
|
"InterfaceStructOffset": 768080,
|
|
"ProceduresCount": 3,
|
|
"Procedures": [
|
|
"RpcSetOperatorDataplanStatus",
|
|
"RpcSetOperatorConnectionCost",
|
|
"RpcSetOperatorCycleData"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140708019001776,
|
|
"Service": "Wcmsvc",
|
|
"IsServiceRunning": true
|
|
},
|
|
"169c453b-5955-4672-be44-21f61e9ef18f": {
|
|
"Module": "ScDeviceEnum.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\ScDeviceEnum.dll",
|
|
"InterfaceId": "169c453b-5955-4672-be44-21f61e9ef18f",
|
|
"InterfaceStructOffset": 142976,
|
|
"ProceduresCount": 2,
|
|
"Procedures": [
|
|
"s_NgcCtnrEnumCreateNode",
|
|
"s_NgcCtnrEnumDeleteNode"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140707581063232,
|
|
"Service": "ScDeviceEnum",
|
|
"IsServiceRunning": false
|
|
},
|
|
"98e96949-bc59-47f1-92d1-8c25b46f85c7": {
|
|
"Module": "wlanext.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\wlanext.exe",
|
|
"InterfaceId": "98e96949-bc59-47f1-92d1-8c25b46f85c7",
|
|
"InterfaceStructOffset": 81648,
|
|
"ProceduresCount": 15,
|
|
"Procedures": [
|
|
"RpcDot11ExtIhvInitService",
|
|
"RpcDot11ExtIhvDeinitService",
|
|
"RpcDot11ExtIhvInitAdapter",
|
|
"RpcDot11ExtIhvDeinitAdapter",
|
|
"RpcDot11ExtIhvProcessSessionChange",
|
|
"RpcDot11ExtIhvIsUIRequestPending",
|
|
"RpcDot11ExtIhvPerformCapabilityMatch",
|
|
"RpcDot11ExtIhvValidateProfile",
|
|
"RpcDot11ExtIhvPerformPreAssociate",
|
|
"RpcDot11ExtIhvAdapterReset",
|
|
"RpcDot11ExtIhvCreateDiscoveryProfiles",
|
|
"RpcDot11ExtIhvProcessUIResponse",
|
|
"RpcDot11ExtIhvQueryUIRequest",
|
|
"RpcDot11ExtIhvOnexIndicateResult",
|
|
"RpcDot11ExtIhvControl"
|
|
],
|
|
"ProcStackSize": 72,
|
|
"DispatchFunction": 140702830459824,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"ae987d31-12d4-450d-90ce-0d6e7cb483be": {
|
|
"Module": "tttracer.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\tttracer.exe",
|
|
"InterfaceId": "ae987d31-12d4-450d-90ce-0d6e7cb483be",
|
|
"InterfaceStructOffset": 239808,
|
|
"ProceduresCount": 2,
|
|
"Procedures": [
|
|
"RpcServerPassCommandLine",
|
|
"RpcServerRetrieveStatus"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140702201977872,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"714dc5c4-c5f6-466a-b037-a573c958031e": {
|
|
"Module": "eeprov.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\eeprov.dll",
|
|
"InterfaceId": "714dc5c4-c5f6-466a-b037-a573c958031e",
|
|
"InterfaceStructOffset": 129088,
|
|
"ProceduresCount": 2,
|
|
"Procedures": [
|
|
"PtRpcSetProcessTag",
|
|
"PtRpcWriteTelemetry"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140707800202528,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"1a9134dd-7b39-45ba-ad88-44d01ca47f28": {
|
|
"Module": "mqqm.dll",
|
|
"ModulePath": "C:\\Windows\\WinSxS\\amd64_microsoft-windows-msmq-queuemanager-core_31bf3856ad364e35_10.0.18362.1977_none_8d1646dec2a87b94\\mqqm.dll",
|
|
"InterfaceId": "1a9134dd-7b39-45ba-ad88-44d01ca47f28",
|
|
"InterfaceStructOffset": 1025248,
|
|
"ProceduresCount": 16,
|
|
"Procedures": [
|
|
"RemoteRead_v1_0_S_GetServerPort",
|
|
"RemoteRead_v1_0_S_GetVersion",
|
|
"RemoteRead_v1_0_S_OpenQueue",
|
|
"RemoteRead_v1_0_S_CloseQueue",
|
|
"RemoteRead_v1_0_S_CreateCursor",
|
|
"RemoteRead_v1_0_S_CloseCursor",
|
|
"RemoteRead_v1_0_S_PurgeQueue",
|
|
"RemoteRead_v1_0_S_StartReceive",
|
|
"RemoteRead_v1_0_S_CancelReceive",
|
|
"RemoteRead_v1_0_S_EndReceive",
|
|
"RemoteRead_v1_0_S_MoveMessage",
|
|
"RemoteRead_v1_0_S_OpenQueueForMove",
|
|
"RemoteRead_v1_0_S_QMEnlistRemoteTransaction",
|
|
"RemoteRead_v1_0_S_StartTransactionalReceive",
|
|
"RemoteRead_v1_0_S_SetUserAcknowledgementClass",
|
|
"RemoteRead_v1_0_S_EndReceiveSynch"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140707093646000,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"f5cc5a18-4264-101a-8c59-08002b2f8426": {
|
|
"Module": "ntdsai.dll",
|
|
"ModulePath": "C:\\Windows\\WinSxS\\amd64_microsoft-windows-d..toryservices-ntdsai_31bf3856ad364e35_10.0.18362.1916_none_fe1eba331c36e95d\\ntdsai.dll",
|
|
"InterfaceId": "f5cc5a18-4264-101a-8c59-08002b2f8426",
|
|
"InterfaceStructOffset": 4346288,
|
|
"ProceduresCount": 21,
|
|
"Procedures": [
|
|
"NspiBind",
|
|
"NspiUnbind",
|
|
"NspiUpdateStat",
|
|
"NspiQueryRows",
|
|
"NspiSeekEntries",
|
|
"NspiGetMatches",
|
|
"NspiResortRestriction",
|
|
"NspiDNToEph",
|
|
"NspiGetPropList",
|
|
"NspiGetProps",
|
|
"NspiCompareDNTs",
|
|
"NspiModProps",
|
|
"NspiGetHierarchyInfo",
|
|
"NspiGetTemplateInfo",
|
|
"NspiModLinkAtt",
|
|
"NspiDeleteEntries",
|
|
"NspiQueryColumns",
|
|
"NspiGetNamesFromIDs",
|
|
"NspiGetIDsFromNames",
|
|
"NspiResolveNames",
|
|
"NspiResolveNamesW"
|
|
],
|
|
"ProcStackSize": 64,
|
|
"DispatchFunction": 140706771718336,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"ade78933-5718-4476-9ce3-6be8cc4d1cc8": {
|
|
"Module": "webplatstorageserver.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\webplatstorageserver.dll",
|
|
"InterfaceId": "ade78933-5718-4476-9ce3-6be8cc4d1cc8",
|
|
"InterfaceStructOffset": 934336,
|
|
"ProceduresCount": 14,
|
|
"Procedures": [
|
|
"s_CreateCacheStorage",
|
|
"s_CacheStorage_open",
|
|
"s_CacheStorage_has",
|
|
"s_CacheStorage_delete",
|
|
"s_CacheStorage_match",
|
|
"s_CacheStorage_keys",
|
|
"s_CacheStorage_close",
|
|
"s_Cache_put",
|
|
"s_Cache_put_complete",
|
|
"s_Cache_match",
|
|
"s_Cache_matchAll",
|
|
"s_Cache_delete",
|
|
"s_Cache_keys",
|
|
"s_Cache_close"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140706992637504,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"4a51dcf2-5c3a-4dd2-84db-c3802ee7f9b7": {
|
|
"Module": "ntdsai.dll",
|
|
"ModulePath": "C:\\Windows\\WinSxS\\amd64_microsoft-windows-d..toryservices-ntdsai_31bf3856ad364e35_10.0.18362.1916_none_fe1eba331c36e95d\\ntdsai.dll",
|
|
"InterfaceId": "4a51dcf2-5c3a-4dd2-84db-c3802ee7f9b7",
|
|
"InterfaceStructOffset": 4346192,
|
|
"ProceduresCount": 11,
|
|
"Procedures": [
|
|
"IDL_SsiInitialize",
|
|
"IDL_SsiReleaseHandle",
|
|
"IDL_SsiRegisterNotification",
|
|
"IDL_SsiUnRegisterNotification",
|
|
"IDL_SsiQueryRealmList",
|
|
"IDL_SsiSearchByIdentityKey",
|
|
"IDL_SsiQueryRealmInformation",
|
|
"IDL_SsiQueryRealmInformation",
|
|
"IDL_SsiQueryPrincipalInformation",
|
|
"IDL_SsiSetPrincipalInformation",
|
|
"IDL_SsiIsPrincipalKnown"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140706770304064,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"910562c3-ebd9-46b9-baba-1d45842a0ceb": {
|
|
"Module": "audiosrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\audiosrv.dll",
|
|
"InterfaceId": "910562c3-ebd9-46b9-baba-1d45842a0ceb",
|
|
"InterfaceStructOffset": 1381216,
|
|
"ProceduresCount": 12,
|
|
"Procedures": [
|
|
"s_pbmReportAppInteractivityChange",
|
|
"Commit",
|
|
"s_pbmAllowMediaPlaybackForApp",
|
|
"s_CapabilityAccessManagerNotification",
|
|
"s_pbmRegisterAppManagerNotification",
|
|
"s_pbmUnregisterAppManagerNotification",
|
|
"s_pbmReportAppClosing",
|
|
"s_pbmReportHostedAppStateChange",
|
|
"s_SetScreenReaderState",
|
|
"s_pbmSwitchSoftNonInteractiveAppsToHardNonInteractive",
|
|
"s_pbmReportApplicationState",
|
|
"s_pbmSetApplicationViewPosition"
|
|
],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140708026803328,
|
|
"Service": "Audiosrv",
|
|
"IsServiceRunning": true
|
|
},
|
|
"4719c6c2-b769-48c6-9caf-392f8e6ea642": {
|
|
"Module": "BthAvrcpAppSvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\BthAvrcpAppSvc.dll",
|
|
"InterfaceId": "4719c6c2-b769-48c6-9caf-392f8e6ea642",
|
|
"InterfaceStructOffset": 46624,
|
|
"ProceduresCount": 5,
|
|
"Procedures": [
|
|
"BthAvrcpApp_GetAppDescription",
|
|
"BthAvrcpApp_OpenConnection",
|
|
"BthAvrcpApp_StartPlayback",
|
|
"BthAvrcpApp_SendMessage",
|
|
"BthAvrcpApp_CloseConnection"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140707880907904,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"f6c98708-c7b8-4919-887c-2ce66e78b9a0": {
|
|
"Module": "XblGameSave.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\XblGameSave.dll",
|
|
"InterfaceId": "f6c98708-c7b8-4919-887c-2ce66e78b9a0",
|
|
"InterfaceStructOffset": 871104,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"svcScheduleTaskOperation"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140707093326144,
|
|
"Service": "XblGameSave",
|
|
"IsServiceRunning": false
|
|
},
|
|
"ae58b386-c914-4a73-ba5c-2c3e2749e478": {
|
|
"Module": "PhoneService.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\PhoneService.dll",
|
|
"InterfaceId": "ae58b386-c914-4a73-ba5c-2c3e2749e478",
|
|
"InterfaceStructOffset": 783920,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"PhoneSvcImpl_RpcClearNewVoicemailCount"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140707094325664,
|
|
"Service": "PhoneSvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"484809d6-4239-471b-b5bc-61df8c23ac48": {
|
|
"Module": "lsm.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\lsm.dll",
|
|
"InterfaceId": "484809d6-4239-471b-b5bc-61df8c23ac48",
|
|
"InterfaceStructOffset": 480176,
|
|
"ProceduresCount": 21,
|
|
"Procedures": [
|
|
"RpcOpenSession",
|
|
"RpcCloseSession",
|
|
"RpcConnect",
|
|
"RpcDisconnect",
|
|
"RpcLogoff",
|
|
"RpcGetUserName",
|
|
"RpcGetTerminalName",
|
|
"RpcGetState",
|
|
"RpcIsSessionDesktopLocked",
|
|
"RpcShowMessageBox",
|
|
"RpcGetTimes",
|
|
"RpcGetSessionCounters",
|
|
"RpcGetSessionInformation",
|
|
"RpcSwitchToServicesSession",
|
|
"RpcRevertFromServicesSession",
|
|
"RpcGetLoggedOnCount",
|
|
"RpcGetSessionType",
|
|
"RpcGetSessionInformationEx",
|
|
"RpcIsTerminalRemote",
|
|
"RpcIsBoundToCacheTerminal",
|
|
"RpcConnectAndLockTargetDesktop"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140708131754464,
|
|
"Service": "LSM",
|
|
"IsServiceRunning": true
|
|
},
|
|
"db2ce634-191d-42af-a28c-16be97924ca7": {
|
|
"Module": "SensorService.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\SensorService.dll",
|
|
"InterfaceId": "db2ce634-191d-42af-a28c-16be97924ca7",
|
|
"InterfaceStructOffset": 375152,
|
|
"ProceduresCount": 10,
|
|
"Procedures": [
|
|
"RSensorBrokerServerClearMotionHistory",
|
|
"RSensorBrokerServerGetActivityHistory",
|
|
"RSensorBrokerServerGetActivityTriggerReports",
|
|
"RSensorBrokerServerGetPedometerHistory",
|
|
"RSensorBrokerServerGetPedometerTriggerReports",
|
|
"RSensorBrokerServerEnableDisableProximityMonitoringForDisplay",
|
|
"RSensorBrokerServerCreateProximityContextHandle",
|
|
"RSensorBrokerServerReleaseProximityContextHandle",
|
|
"RSensorBrokerServerGetProximityTriggerReports",
|
|
"RSensorBrokerServerGetFloorElevationTriggerReports"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140707580902032,
|
|
"Service": "SensorService",
|
|
"IsServiceRunning": false
|
|
},
|
|
"91fd044b-902f-42c7-a945-6861bcf9309c": {
|
|
"Module": "moshost.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\moshost.dll",
|
|
"InterfaceId": "91fd044b-902f-42c7-a945-6861bcf9309c",
|
|
"InterfaceStructOffset": 55584,
|
|
"ProceduresCount": 9,
|
|
"Procedures": [
|
|
"MapsStorageSvcOpen",
|
|
"MapsStorageSvcClose",
|
|
"MapsStorageSvcGetCurrentLocation",
|
|
"MapsStorageSvcGetLocations",
|
|
"MapsStorageSvcGetMigrationState",
|
|
"MapsStorageSvcValidateLocationAsync",
|
|
"MapsStorageSvcGetDataDirectory",
|
|
"MapsStorageSvcUseDefaultExternalStorage",
|
|
"MapsStorageSvcQueueSwitchToDefaultExternalStorage"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140707880922096,
|
|
"Service": "MapsBroker",
|
|
"IsServiceRunning": false
|
|
},
|
|
"c80066a8-7579-44fc-b9b2-8466930791b0": {
|
|
"Module": "umrdp.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\umrdp.dll",
|
|
"InterfaceId": "c80066a8-7579-44fc-b9b2-8466930791b0",
|
|
"InterfaceStructOffset": 272000,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"RpcPrintDrvGetInfo"
|
|
],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140708067585184,
|
|
"Service": "UmRdpService",
|
|
"IsServiceRunning": true
|
|
},
|
|
"5267aaba-4f49-4653-8e26-d1e11f3f2ad9": {
|
|
"Module": "termsrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\termsrv.dll",
|
|
"InterfaceId": "5267aaba-4f49-4653-8e26-d1e11f3f2ad9",
|
|
"InterfaceStructOffset": 755296,
|
|
"ProceduresCount": 11,
|
|
"Procedures": [
|
|
"RpcCreateVirtualChannel",
|
|
"Connect",
|
|
"RpcPopSecurityDialog",
|
|
"RpcGetInitialApplication",
|
|
"RpcGetConnectionProperty",
|
|
"Connect",
|
|
"RpcVerify",
|
|
"RpcCreateChildSessionTransport",
|
|
"RpcRcmShadow2",
|
|
"RpcShadowAccessCheck",
|
|
"RpcShadowStop2"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140708119094384,
|
|
"Service": "TermService",
|
|
"IsServiceRunning": true
|
|
},
|
|
"99fcfec4-5260-101b-bbcb-00aa0021347a": {
|
|
"Module": "rpcss.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\rpcss.dll",
|
|
"InterfaceId": "99fcfec4-5260-101b-bbcb-00aa0021347a",
|
|
"InterfaceStructOffset": 960080,
|
|
"ProceduresCount": 6,
|
|
"Procedures": [
|
|
"ResolveOxid",
|
|
"SimplePing",
|
|
"ComplexPing",
|
|
"ServerAlive",
|
|
"ResolveOxid2",
|
|
"ServerAlive2"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140708135229568,
|
|
"Service": "RpcSs",
|
|
"IsServiceRunning": true
|
|
},
|
|
"b1ef227e-dfa5-421e-82bb-67a6a129c496": {
|
|
"Module": "modernexecserver.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\modernexecserver.dll",
|
|
"InterfaceId": "b1ef227e-dfa5-421e-82bb-67a6a129c496",
|
|
"InterfaceStructOffset": 324112,
|
|
"ProceduresCount": 11,
|
|
"Procedures": [
|
|
"FmMuxSrvIsActivationBeingDebugged",
|
|
"FmMuxSrvIsForegroundActivation",
|
|
"FmMuxSrvGetForegroundActivationInstanceId",
|
|
"FmMuxSrvGetApplicationId",
|
|
"FmMuxSrvGetPackageFamilyName",
|
|
"FmMuxSrvGetPackageFullName",
|
|
"FmMuxSrvGetPSMKey",
|
|
"FmMuxSrvDehydrateApplication",
|
|
"FmMuxSrvSetAutoDehydrateFlag",
|
|
"FmMuxSrvGetAutoDehydrateFlag",
|
|
"FmMuxSrvReloadSettings"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140707571598096,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"f0c68743-5631-4289-8aad-37e5e64d843f": {
|
|
"Module": "embeddedmodesvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\embeddedmodesvc.dll",
|
|
"InterfaceId": "f0c68743-5631-4289-8aad-37e5e64d843f",
|
|
"InterfaceStructOffset": 124960,
|
|
"ProceduresCount": 3,
|
|
"Procedures": [
|
|
"s_CreateContext",
|
|
"s_CloseContext",
|
|
"s_ActivatePackage"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140707581090288,
|
|
"Service": "embeddedmode",
|
|
"IsServiceRunning": false
|
|
},
|
|
"3a9ef155-691d-4449-8d05-09ad57031823": {
|
|
"Module": "schedsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\schedsvc.dll",
|
|
"InterfaceId": "3a9ef155-691d-4449-8d05-09ad57031823",
|
|
"InterfaceStructOffset": 477984,
|
|
"ProceduresCount": 7,
|
|
"Procedures": [
|
|
"I_pSchRpcRegisterTask",
|
|
"I_pSchRpcEnumTasks",
|
|
"I_pSchRpcGetTaskInfo",
|
|
"I_pSchRpcAquireTaskStateNotificationsName",
|
|
"I_pAcquireBackgroundExecutionMode",
|
|
"I_pReleaseBackgroundExecutionMode",
|
|
"I_pSetTaskDisabledForCurrentUser"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140708046653104,
|
|
"Service": "Schedule",
|
|
"IsServiceRunning": true
|
|
},
|
|
"e7a216af-1ec1-447f-8d3f-a87278db564d": {
|
|
"Module": "vmcompute.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\vmcompute.exe",
|
|
"InterfaceId": "e7a216af-1ec1-447f-8d3f-a87278db564d",
|
|
"InterfaceStructOffset": 2458432,
|
|
"ProceduresCount": 27,
|
|
"Procedures": [
|
|
"HcsRpc_EnumerateSystems",
|
|
"HcsRpc_CreateSystem",
|
|
"HcsRpc_OpenSystem",
|
|
"HcsRpc_StartSystem",
|
|
"HcsRpc_ShutdownSystem",
|
|
"HcsRpc_TerminateSystem",
|
|
"HcsRpc_PauseSystem",
|
|
"HcsRpc_ResumeSystem",
|
|
"HcsRpc_SaveSystem",
|
|
"HcsRpc_GetSystemProperties",
|
|
"HcsRpc_ModifySystem",
|
|
"HcsRpc_RegisterSystemNotifications",
|
|
"HcsRpc_UnregisterSystemNotifications",
|
|
"HcsRpc_QuerySystemNotification",
|
|
"HcsRpc_CloseSystem",
|
|
"HcsRpc_CreateProcess",
|
|
"HcsRpc_OpenProcess",
|
|
"HcsRpc_SignalProcess",
|
|
"HcsRpc_GetProcessInfo",
|
|
"HcsRpc_GetProcessProperties",
|
|
"HcsRpc_ModifyProcess",
|
|
"HcsRpc_RegisterProcessNotifications",
|
|
"HcsRpc_UnregisterProcessNotifications",
|
|
"HcsRpc_QueryProcessNotification",
|
|
"HcsRpc_CloseProcess",
|
|
"HcsRpc_GetServiceProperties",
|
|
"HcsRpc_ModifyServiceSettings"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140697749985376,
|
|
"Service": "vmcompute",
|
|
"IsServiceRunning": true
|
|
},
|
|
"8c7daf44-b6dc-11d1-9a4c-0020af6e7c57": {
|
|
"Module": "appmgmts.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\appmgmts.dll",
|
|
"InterfaceId": "8c7daf44-b6dc-11d1-9a4c-0020af6e7c57",
|
|
"InterfaceStructOffset": 160400,
|
|
"ProceduresCount": 9,
|
|
"Procedures": [
|
|
"PINSTALLCONTEXT_rundown",
|
|
"InstallBegin",
|
|
"InstallManageApp",
|
|
"InstallUnmanageApp",
|
|
"InstallEnd",
|
|
"ARPRemoveApp",
|
|
"GetManagedApps",
|
|
"RsopReportInstallFailure",
|
|
"GetManagedAppCategories"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140707880776320,
|
|
"Service": "AppMgmt",
|
|
"IsServiceRunning": false
|
|
},
|
|
"bf4dc912-e52f-4904-8ebe-9317c1bdd497": {
|
|
"Module": "dssvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\dssvc.dll",
|
|
"InterfaceId": "bf4dc912-e52f-4904-8ebe-9317c1bdd497",
|
|
"InterfaceStructOffset": 104592,
|
|
"ProceduresCount": 8,
|
|
"Procedures": [
|
|
"RpcDSSCreateSharedFileToken",
|
|
"RpcDSSGetSharedFileName",
|
|
"RpcDSSGetSharingTokenInformation",
|
|
"RpcDSSDelegateSharingToken",
|
|
"RpcDSSRemoveSharingToken",
|
|
"RpcDSSOpenSharedFile",
|
|
"RpcDSSCopyFromSharedFile",
|
|
"RpcDSSRemoveExpiredTokens"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140708033741296,
|
|
"Service": "DsSvc",
|
|
"IsServiceRunning": true
|
|
},
|
|
"3f7b77f5-7f38-4033-afd9-343d42d8dabb": {
|
|
"Module": "moshost.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\moshost.dll",
|
|
"InterfaceId": "3f7b77f5-7f38-4033-afd9-343d42d8dabb",
|
|
"InterfaceStructOffset": 58624,
|
|
"ProceduresCount": 5,
|
|
"Procedures": [
|
|
"MapsPackageSvcOpen",
|
|
"MapsPackageSvcClose",
|
|
"MapsPackageSvcFindNearbyPackagesAsync",
|
|
"MapsPackageSvcGetPackages",
|
|
"MapsPackageSvcAddMapPackageAsync"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140707880923216,
|
|
"Service": "MapsBroker",
|
|
"IsServiceRunning": false
|
|
},
|
|
"8f1acdc1-754d-43eb-9629-aa1620928e65": {
|
|
"Module": "IMEPADSM.DLL",
|
|
"ModulePath": "C:\\Windows\\System32\\IME\\SHARED\\IMEPADSM.DLL",
|
|
"InterfaceId": "8f1acdc1-754d-43eb-9629-aa1620928e65",
|
|
"InterfaceStructOffset": 80624,
|
|
"ProceduresCount": 2,
|
|
"Procedures": [
|
|
"AddRef",
|
|
"s_ToClientFromServer"
|
|
],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140707880930576,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"15cd3850-28ca-11ce-a4e8-00aa006116cb": {
|
|
"Module": "PeerDistSvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\PeerDistSvc.dll",
|
|
"InterfaceId": "15cd3850-28ca-11ce-a4e8-00aa006116cb",
|
|
"InterfaceStructOffset": 1559872,
|
|
"ProceduresCount": 24,
|
|
"Procedures": [
|
|
"PeerDistStartupRPC",
|
|
"PeerDistShutdownRPC",
|
|
"PeerDistGetServiceStatusRPC",
|
|
"PeerDistServerPublishStreamRPC",
|
|
"PeerDistServerPublishAddToStreamRPC",
|
|
"PeerDistServerPublishCompleteStreamRPC",
|
|
"PeerDistServerCloseStreamHandleRPC",
|
|
"PeerDistServerUnpublishRPC",
|
|
"PeerDistServerOpenContentInformationRPC",
|
|
"PeerDistServerRetrieveContentInformationRPC",
|
|
"PeerDistServerCloseContentInfoRPC",
|
|
"PeerDistClientOpenContentRPC",
|
|
"PeerDistClientCloseContentRPC",
|
|
"PeerDistClientAddContentInformationRPC",
|
|
"PeerDistClientCompleteContentInformationRPC",
|
|
"PeerDistClientAddDataRPC",
|
|
"PeerDistClientBlockReadRPC",
|
|
"PeerDistClientStreamReadRPC",
|
|
"PeerDistClientIsFlashCrowdRPC",
|
|
"PeerDistClientFlushContentRPC",
|
|
"PeerDistFlushContentRPC",
|
|
"PeerDistQueryCacheInformationRPC",
|
|
"PeerDistConfigureCacheDatabaseRPC",
|
|
"PeerDistForceConfigurationRefreshRPC"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140707093992784,
|
|
"Service": "PeerDistSvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"86d35949-83c9-4044-b424-db363231fd0c": {
|
|
"Module": "schedsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\schedsvc.dll",
|
|
"InterfaceId": "86d35949-83c9-4044-b424-db363231fd0c",
|
|
"InterfaceStructOffset": 477888,
|
|
"ProceduresCount": 20,
|
|
"Procedures": [
|
|
"SchRpcHighestVersion",
|
|
"SchRpcRegisterTask",
|
|
"SchRpcRetrieveTask",
|
|
"SchRpcCreateFolder",
|
|
"SchRpcSetSecurity",
|
|
"SchRpcGetSecurity",
|
|
"SchRpcEnumFolders",
|
|
"SchRpcEnumTasks",
|
|
"SchRpcEnumInstances",
|
|
"SchRpcGetInstanceInfo",
|
|
"SchRpcStopInstance",
|
|
"SchRpcStop",
|
|
"SchRpcRun",
|
|
"SchRpcDelete",
|
|
"SchRpcRename",
|
|
"SchRpcScheduledRuntimes",
|
|
"SchRpcGetLastRunInfo",
|
|
"_SchRpcGetTaskInfo",
|
|
"SchRpcGetNumberOfMissedRuns",
|
|
"SchRpcEnableTask"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140708046648816,
|
|
"Service": "Schedule",
|
|
"IsServiceRunning": true
|
|
},
|
|
"d4051bde-9cdd-4910-b393-4aa85ec3c482": {
|
|
"Module": "diagtrack.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\diagtrack.dll",
|
|
"InterfaceId": "d4051bde-9cdd-4910-b393-4aa85ec3c482",
|
|
"InterfaceStructOffset": 2709376,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"UtcAdminApi_SnapMiniTrace"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140707991489344,
|
|
"Service": "DiagTrack",
|
|
"IsServiceRunning": true
|
|
},
|
|
"c36be077-e14b-4fe9-8abc-e856ef4f048b": {
|
|
"Module": "httpprxm.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\httpprxm.dll",
|
|
"InterfaceId": "c36be077-e14b-4fe9-8abc-e856ef4f048b",
|
|
"InterfaceStructOffset": 69808,
|
|
"ProceduresCount": 6,
|
|
"Procedures": [
|
|
"RpcSrvProxyMgrClientRegisterForEventNotification",
|
|
"RpcSrvProxyMgrClientGetNotification",
|
|
"RpcSrvProxyMgrClientUnregisterEventNotification",
|
|
"RpcSrvProxyMgrClientGetProxyForUrl",
|
|
"RpcSrvProxyMgrClientGetProxyCredentials",
|
|
"RpcSrvProxyMgrClientGetAllProxiesForUrl"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140707879068848,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"9b8699ae-0e44-47b1-8e7f-86a461d7ecdc": {
|
|
"Module": "rpcss.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\rpcss.dll",
|
|
"InterfaceId": "9b8699ae-0e44-47b1-8e7f-86a461d7ecdc",
|
|
"InterfaceStructOffset": 959888,
|
|
"ProceduresCount": 29,
|
|
"Procedures": [
|
|
"_LaunchActivatorServer",
|
|
"_LaunchRunAsServer",
|
|
"_LaunchService",
|
|
"_LaunchWinRTActivatorServer",
|
|
"_LaunchWinRTRunAsServer",
|
|
"_LaunchWinRTService",
|
|
"_CertifyServerIdentity",
|
|
"_QueryNTService",
|
|
"QueryNTServiceType",
|
|
"ControlNTService",
|
|
"PrivTranslateShareName",
|
|
"Commit",
|
|
"IsPortOpen",
|
|
"TickleActivationSettings",
|
|
"QueryProcessArchitecture",
|
|
"PrivilegedNotifyWinRTActivationStoreChanged",
|
|
"_QueryUserSidForSession",
|
|
"PrivActivatePsmServer",
|
|
"_PrivGetUserTokenForSession",
|
|
"PrivGetBrokerToken",
|
|
"PrivGetDesktopWinRTBrokerToken",
|
|
"PrivGetPsmToken",
|
|
"GetSessionUserTokenCacheDetails",
|
|
"PrivilegedNotifyComClassChangesFromDeployment",
|
|
"PrivGetPsmTokenWithDynamicId",
|
|
"PrivGetInteractiveUserToken",
|
|
"PrivReportUnhealthyProcess",
|
|
"PrivNormalizePsmTokenHostId",
|
|
"PrivLogMachineClassesRootPermissions"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140708135411984,
|
|
"Service": "RpcSs",
|
|
"IsServiceRunning": true
|
|
},
|
|
"fd8be72b-a9cd-4b2c-a9ca-4ded242fbe4d": {
|
|
"Module": "diagtrack.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\diagtrack.dll",
|
|
"InterfaceId": "fd8be72b-a9cd-4b2c-a9ca-4ded242fbe4d",
|
|
"InterfaceStructOffset": 2709568,
|
|
"ProceduresCount": 2,
|
|
"Procedures": [
|
|
"UtcApi_SendSyntheticTrigger",
|
|
"UtcApi_ChangeEtmPauseState"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140707991489568,
|
|
"Service": "DiagTrack",
|
|
"IsServiceRunning": true
|
|
},
|
|
"ba26f803-f095-40e9-b5e1-0afc44e18479": {
|
|
"Module": "dnsrslvr.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\dnsrslvr.dll",
|
|
"InterfaceId": "ba26f803-f095-40e9-b5e1-0afc44e18479",
|
|
"InterfaceStructOffset": 250464,
|
|
"ProceduresCount": 3,
|
|
"Procedures": [
|
|
"s_HvsiK_CloseHandle",
|
|
"s_HvsiK_JoinHandles",
|
|
"s_HvsiK_CloneHandle"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140708025556688,
|
|
"Service": "Dnscache",
|
|
"IsServiceRunning": true
|
|
},
|
|
"1a0d010f-1c33-432c-b0f5-8cf4e8053099": {
|
|
"Module": "srvsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\srvsvc.dll",
|
|
"InterfaceId": "1a0d010f-1c33-432c-b0f5-8cf4e8053099",
|
|
"InterfaceStructOffset": 192608,
|
|
"ProceduresCount": 2,
|
|
"Procedures": [
|
|
"IdSegRequestNextSequence",
|
|
"IdSegRequestNodeInvalidation"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140707955945888,
|
|
"Service": "LanmanServer",
|
|
"IsServiceRunning": true
|
|
},
|
|
"bf999caa-2e5d-4bdd-ae89-e7ee0ea5fcbe": {
|
|
"Module": "mspdb140.dll",
|
|
"ModulePath": "C:\\Program Files (x86)\\Microsoft Visual Studio\\2017\\Community\\VC\\Tools\\MSVC\\14.12.25827\\bin\\Hostx64\\x64\\mspdb140.dll",
|
|
"InterfaceId": "bf999caa-2e5d-4bdd-ae89-e7ee0ea5fcbe",
|
|
"InterfaceStructOffset": 212576,
|
|
"ProceduresCount": 26,
|
|
"Procedures": [
|
|
"RPC_CALLBACK_PfnPDBQueryCallback",
|
|
"RPC_CALLBACK_PfnPDBNotifyDebugDir",
|
|
"RPC_CALLBACK_PfnPDBNotifyDebugDir",
|
|
"RPC_CALLBACK_PfnPDBNotifyDebugDir",
|
|
"RPC_CALLBACK_PfnPDBQueryCallback",
|
|
"RPC_CALLBACK_PfnPDBQueryCallback",
|
|
"RPC_CALLBACK_PfnPDBNotifyDebugDir",
|
|
"RPC_CALLBACK_PfnPDBQueryCallback",
|
|
"RPC_CALLBACK_PfnPDBReadMiscDebugData",
|
|
"RPC_CALLBACK_PfnPDBQueryCallback",
|
|
"RPC_CALLBACK_PfnPDBQueryCallback",
|
|
"RPC_CALLBACK_PfnPDBQueryCallback",
|
|
"RPC_CALLBACK_PfnPDBQueryCallback",
|
|
"RPC_CALLBACK_PfnPDBQueryCallback",
|
|
"RPC_CALLBACK_PfnPDBQueryCallback",
|
|
"RPC_CALLBACK_PfnFEFDepCallBack",
|
|
"RPC_CALLBACK_PfnFEFDepCallBack",
|
|
"RPC_CALLBACK_PfnFEFAllCallBack",
|
|
"RPC_CALLBACK_PfnPdbCopyQueryCallback",
|
|
"RPC_CALLBACK_PfnPdbCopyFilterPublics",
|
|
"RPC_CALLBACK_PfnNoteTypeMismatch",
|
|
"RPC_CALLBACK_PfnPdbCopyFilterStreamNames",
|
|
"RPC_CALLBACK_PfnDBIQueryCallback",
|
|
"RPC_CALLBACK_PfnNotePdbUsed",
|
|
"RPC_CALLBACK_PfnNoteTypeMismatch",
|
|
"RPC_CALLBACK_PfnPdbCopyFilterStreamNames"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140707880323872,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"c100beab-d33a-4a4b-bf23-bbef4663d017": {
|
|
"Module": "wcncsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\wcncsvc.dll",
|
|
"InterfaceId": "c100beab-d33a-4a4b-bf23-bbef4663d017",
|
|
"InterfaceStructOffset": 354176,
|
|
"ProceduresCount": 31,
|
|
"Procedures": [
|
|
"WcnpRpcSubscribe",
|
|
"WcnpRpcUnSubscribe",
|
|
"WcnpRpcSetNotificationFilter",
|
|
"WcnpRpcGetCachedPeers",
|
|
"WcnpRpcAsyncGetNotification",
|
|
"WcnpRpcCancelPendingNotification",
|
|
"WcnpRpcPerformDiscovery",
|
|
"WcnpRpcTargetedWlanDiscovery",
|
|
"WcnpRpcGetPeerUuidFromTransportAddress",
|
|
"WcnpRpcGetPeer",
|
|
"WcnpRpcReleasePeer",
|
|
"WcnpRpcPeerOpenSession",
|
|
"WcnpRpcPeerGetAttribute",
|
|
"WcnpRpcPeerGetAttributeAsInteger",
|
|
"WcnpRpcPeerGetAttributeAsString",
|
|
"WcnpRpcPeerGetVendorExtensions",
|
|
"WcnpRpcSessionSetPassword",
|
|
"WcnpRpcSessionSetNFCPassword",
|
|
"WcnpRpcSessionSetProfileData",
|
|
"WcnpRpcSessionSetProfilePassphrase",
|
|
"WcnpRpcSessionConnect",
|
|
"WcnpRpcSessionGetNotifications",
|
|
"WcnpRpcSessionGetWirelessProfile",
|
|
"WcnpRpcSessionGetTelemetry",
|
|
"WcnpRpcSessionGetAttributeAsInteger",
|
|
"WcnpRpcReleaseSession",
|
|
"WcnpRpcSessionSetVendorExtensions",
|
|
"WcnpRpcSessionGetVendorExtensions",
|
|
"WcnpRpcCreateManagementHandle",
|
|
"WcnpRpcSetAdvertisementsEnabled",
|
|
"WcnpRpcCloseManagementHandle"
|
|
],
|
|
"ProcStackSize": 8,
|
|
"DispatchFunction": 140707580936848,
|
|
"Service": "wcncsvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"e38f5360-8572-473e-b696-1b46873beeab": {
|
|
"Module": "diagtrack.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\diagtrack.dll",
|
|
"InterfaceId": "e38f5360-8572-473e-b696-1b46873beeab",
|
|
"InterfaceStructOffset": 2709760,
|
|
"ProceduresCount": 4,
|
|
"Procedures": [
|
|
"UtcTenantApi_RegisterTelemetryTenant",
|
|
"UtcTenantApi_UnregisterTelemetryTenant",
|
|
"UtcTenantApi_UpdateDailyUploadQuota",
|
|
"UtcTenantApi_ForceUpload"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140707991503584,
|
|
"Service": "DiagTrack",
|
|
"IsServiceRunning": true
|
|
},
|
|
"a13a9961-953f-4157-8a29-e65e29be510d": {
|
|
"Module": "SgrmLpac.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\SgrmLpac.exe",
|
|
"InterfaceId": "a13a9961-953f-4157-8a29-e65e29be510d",
|
|
"InterfaceStructOffset": 33696,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"s_HttpPost"
|
|
],
|
|
"ProcStackSize": 80,
|
|
"DispatchFunction": 140700842341040,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"1e665584-40fe-4450-8f6e-802362399694": {
|
|
"Module": "lsm.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\lsm.dll",
|
|
"InterfaceId": "1e665584-40fe-4450-8f6e-802362399694",
|
|
"InterfaceStructOffset": 479504,
|
|
"ProceduresCount": 4,
|
|
"Procedures": [
|
|
"RpcBroadcastSystemMessage",
|
|
"RpcSendWindowMessage",
|
|
"RpcCreateSession",
|
|
"RpcTerminateSession"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140708131751312,
|
|
"Service": "LSM",
|
|
"IsServiceRunning": true
|
|
},
|
|
"eda3c9e4-0d4c-4bb7-b612-0e89d4f0607d": {
|
|
"Module": "LsaIso.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\LsaIso.exe",
|
|
"InterfaceId": "eda3c9e4-0d4c-4bb7-b612-0e89d4f0607d",
|
|
"InterfaceStructOffset": 184832,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"GetRunningServices"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140697528904848,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"0e3ae095-8a23-48f4-9782-03c1594a890e": {
|
|
"Module": "ngcsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\ngcsvc.dll",
|
|
"InterfaceId": "0e3ae095-8a23-48f4-9782-03c1594a890e",
|
|
"InterfaceStructOffset": 629840,
|
|
"ProceduresCount": 19,
|
|
"Procedures": [
|
|
"s_NgcKspOpenStorageProvider",
|
|
"s_NgcKspEnumKeys",
|
|
"s_NgcKspFreeBuffer",
|
|
"s_NgcKspFreeProvider",
|
|
"s_NgcKspFreeKey",
|
|
"s_NgcKspOpenKey",
|
|
"s_NgcKspCreatePersistedKey",
|
|
"s_NgcKspGetProviderProperty",
|
|
"s_NgcKspSetProviderProperty",
|
|
"s_NgcKspGetKeyProperty",
|
|
"s_NgcKspSetKeyProperty",
|
|
"s_NgcKspFinalizeKey",
|
|
"s_NgcKspDecrypt",
|
|
"s_NgcKspSignHash",
|
|
"s_NgcKspDeleteKey",
|
|
"s_NgcKspImportKey",
|
|
"s_NgcKspExportKey",
|
|
"s_NgcKspCreateClaim",
|
|
"s_NgcKspVerifyClaim"
|
|
],
|
|
"ProcStackSize": 72,
|
|
"DispatchFunction": 140707093969040,
|
|
"Service": "NgcSvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"28098650-fe3c-4af4-8a41-8bcd284941c5": {
|
|
"Module": "termsrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\termsrv.dll",
|
|
"InterfaceId": "28098650-fe3c-4af4-8a41-8bcd284941c5",
|
|
"InterfaceStructOffset": 749568,
|
|
"ProceduresCount": 4,
|
|
"Procedures": [
|
|
"RpcGetCurrentSessionConnectionProperty",
|
|
"RpcGetCurrentSessionClientData",
|
|
"RpcGetCurrentSessionConfigData",
|
|
"RpcGetCurrentSessionProtocolLastInputTime"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140708118764736,
|
|
"Service": "TermService",
|
|
"IsServiceRunning": true
|
|
},
|
|
"4f361416-bd16-44a5-ab86-e8bf3a86410d": {
|
|
"Module": "hvsirpcd.exe",
|
|
"ModulePath": "C:\\Windows\\WinSxS\\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.18362.1832_none_158049e1d563edb9\\hvsirpcd.exe",
|
|
"InterfaceId": "4f361416-bd16-44a5-ab86-e8bf3a86410d",
|
|
"InterfaceStructOffset": 68096,
|
|
"ProceduresCount": 4,
|
|
"Procedures": [
|
|
"s_HvsiR_ResolverQuery",
|
|
"s_HvsiR_CloseHandle",
|
|
"s_HvsiR_JoinHandles",
|
|
"s_HvsiR_CloneHandle"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140698086697280,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"76f03f96-cdfd-44fc-a22c-64950a001209": {
|
|
"Module": "spoolsv.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\spoolsv.exe",
|
|
"InterfaceId": "76f03f96-cdfd-44fc-a22c-64950a001209",
|
|
"InterfaceStructOffset": 476528,
|
|
"ProceduresCount": 75,
|
|
"Procedures": [
|
|
"RpcAsyncOpenPrinter",
|
|
"RpcAsyncAddPrinter",
|
|
"RpcAsyncSetJob",
|
|
"RpcAsyncGetJob",
|
|
"RpcAsyncEnumJobs",
|
|
"RpcAsyncAddJob",
|
|
"RpcAsyncScheduleJob",
|
|
"RpcAsyncDeletePrinter",
|
|
"RpcAsyncSetPrinter",
|
|
"RpcAsyncGetPrinter",
|
|
"RpcAsyncStartDocPrinter",
|
|
"RpcAsyncStartPagePrinter",
|
|
"RpcAsyncWritePrinter",
|
|
"RpcAsyncEndPagePrinter",
|
|
"RpcAsyncEndDocPrinter",
|
|
"RpcAsyncAbortPrinter",
|
|
"RpcAsyncGetPrinterData",
|
|
"RpcAsyncGetPrinterDataEx",
|
|
"RpcAsyncSetPrinterData",
|
|
"RpcAsyncSetPrinterDataEx",
|
|
"RpcAsyncClosePrinter",
|
|
"RpcAsyncAddForm",
|
|
"RpcAsyncDeleteForm",
|
|
"RpcAsyncGetForm",
|
|
"RpcAsyncSetForm",
|
|
"RpcAsyncEnumForms",
|
|
"RpcAsyncGetPrinterDriver",
|
|
"RpcAsyncEnumPrinterData",
|
|
"RpcAsyncEnumPrinterDataEx",
|
|
"RpcAsyncEnumPrinterKey",
|
|
"RpcAsyncDeletePrinterData",
|
|
"RpcAsyncDeletePrinterDataEx",
|
|
"RpcAsyncDeletePrinterKey",
|
|
"RpcAsyncXcvData",
|
|
"RpcAsyncSendRecvBidiData",
|
|
"RpcAsyncCreatePrinterIC",
|
|
"RpcAsyncPlayGdiScriptOnPrinterIC",
|
|
"RpcAsyncDeletePrinterIC",
|
|
"RpcAsyncEnumPrinters",
|
|
"RpcAsyncAddPrinterDriver",
|
|
"RpcAsyncEnumPrinterDrivers",
|
|
"RpcAsyncGetPrinterDriverDirectory",
|
|
"RpcAsyncDeletePrinterDriver",
|
|
"RpcAsyncDeletePrinterDriverEx",
|
|
"RpcAsyncAddPrintProcessor",
|
|
"RpcAsyncEnumPrintProcessors",
|
|
"RpcAsyncGetPrintProcessorDirectory",
|
|
"RpcAsyncEnumPorts",
|
|
"RpcAsyncEnumMonitors",
|
|
"RpcAsyncAddPort",
|
|
"RpcAsyncSetPort",
|
|
"RpcAsyncAddMonitor",
|
|
"RpcAsyncDeleteMonitor",
|
|
"RpcAsyncDeletePrintProcessor",
|
|
"RpcAsyncEnumPrintProcessorDatatypes",
|
|
"RpcAsyncAddPerMachineConnection",
|
|
"RpcAsyncDeletePerMachineConnection",
|
|
"RpcAsyncEnumPerMachineConnections",
|
|
"RpcSyncRegisterForRemoteNotifications",
|
|
"RpcSyncUnRegisterForRemoteNotifications",
|
|
"RpcSyncRefreshRemoteNotifications",
|
|
"RpcAsyncGetRemoteNotifications",
|
|
"RpcAsyncInstallPrinterDriverFromPackage",
|
|
"RpcAsyncUploadPrinterDriverPackage",
|
|
"RpcAsyncGetCorePrinterDrivers",
|
|
"RpcAsyncCorePrinterDriverInstalled",
|
|
"RpcAsyncGetPrinterDriverPackagePath",
|
|
"RpcAsyncDeletePrinterDriverPackage",
|
|
"RpcAsyncReadPrinter",
|
|
"RpcAsyncResetPrinter",
|
|
"RpcAsyncGetJobNamedPropertyValue",
|
|
"RpcAsyncSetJobNamedProperty",
|
|
"RpcAsyncDeleteJobNamedProperty",
|
|
"RpcAsyncEnumJobNamedProperties",
|
|
"RpcAsyncLogJobInfoForBranchOffice"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140698296502800,
|
|
"Service": "Spooler",
|
|
"IsServiceRunning": true
|
|
},
|
|
"ed19cc3c-31d4-4b12-b63e-78b2c65a61d5": {
|
|
"Module": "vmicrdv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\vmicrdv.dll",
|
|
"InterfaceId": "ed19cc3c-31d4-4b12-b63e-78b2c65a61d5",
|
|
"InterfaceStructOffset": 96416,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"RpcCreateVmEndPoint"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140707581023248,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"5ca4a760-ebb1-11cf-8611-00a0245420ed": {
|
|
"Module": "termsrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\termsrv.dll",
|
|
"InterfaceId": "5ca4a760-ebb1-11cf-8611-00a0245420ed",
|
|
"InterfaceStructOffset": 756576,
|
|
"ProceduresCount": 76,
|
|
"Procedures": [
|
|
"RpcWinStationOpenServer",
|
|
"RpcWinStationCloseServer",
|
|
"RpcIcaServerPing",
|
|
"RpcWinStationEnumerate",
|
|
"RpcWinStationRename",
|
|
"RpcWinStationQueryInformation",
|
|
"RpcWinStationSetInformation",
|
|
"RpcWinStationSendMessage",
|
|
"RpcLogonIdFromWinStationName",
|
|
"RpcWinStationNameFromLogonId",
|
|
"RpcWinStationConnect",
|
|
"RpcWinStationVirtualOpen",
|
|
"RpcWinStationBeepOpen",
|
|
"RpcWinStationDisconnect",
|
|
"RpcWinStationReset",
|
|
"RpcWinStationShutdownSystem",
|
|
"RpcWinStationWaitSystemEvent",
|
|
"RpcWinStationShadow",
|
|
"RpcWinStationShadowTargetSetup",
|
|
"RpcWinStationShadowTarget",
|
|
"RpcWinStationGenerateLicense",
|
|
"RpcWinStationInstallLicense",
|
|
"RpcWinStationEnumerateLicenses",
|
|
"RpcWinStationActivateLicense",
|
|
"RpcWinStationRemoveLicense",
|
|
"RpcWinStationQueryLicense",
|
|
"RpcWinStationSetPoolCount",
|
|
"RpcWinStationQueryUpdateRequired",
|
|
"RpcWinStationCallback",
|
|
"RpcWinStationBreakPoint",
|
|
"RpcWinStationReadRegistry",
|
|
"RpcWinStationWaitForConnect",
|
|
"RpcWinStationNotifyLogon",
|
|
"RpcWinStationNotifyLogoff",
|
|
"OldRpcWinStationEnumerateProcesses",
|
|
"RpcWinStationAnnoyancePopup",
|
|
"RpcWinStationEnumerateProcesses",
|
|
"RpcWinStationTerminateProcess",
|
|
"RpcServerNWLogonSetAdmin",
|
|
"RpcServerNWLogonQueryAdmin",
|
|
"RpcWinStationCheckForApplicationName",
|
|
"RpcWinStationGetApplicationInfo",
|
|
"RpcWinStationNtsdDebug",
|
|
"RpcWinStationGetAllProcesses",
|
|
"RpcWinStationGetProcessSid",
|
|
"RpcWinStationGetTermSrvCountersValue",
|
|
"RpcWinStationReInitializeSecurity",
|
|
"RpcWinStationBroadcastSystemMessage",
|
|
"RpcWinStationSendWindowMessage",
|
|
"RpcWinStationNotifyNewSession",
|
|
"RpcServerGetInternetConnectorStatus",
|
|
"RpcServerSetInternetConnectorStatus",
|
|
"RpcServerQueryInetConnectorInformation",
|
|
"RpcWinStationGetLanAdapterName",
|
|
"RpcWinStationUpdateUserConfig",
|
|
"RpcWinStationQueryLogonCredentials",
|
|
"RpcWinStationRegisterConsoleNotification",
|
|
"RpcWinStationUnRegisterConsoleNotification",
|
|
"RpcWinStationUpdateSettings",
|
|
"RpcWinStationShadowStop",
|
|
"RpcWinStationCloseServerEx",
|
|
"RpcWinStationIsHelpAssistantSession",
|
|
"RpcWinStationGetMachinePolicy",
|
|
"RpcWinStationUpdateClientCachedCredentials",
|
|
"RpcWinStationFUSCanRemoteUserDisconnect",
|
|
"RpcWinStationCheckLoopBack",
|
|
"RpcConnectCallback",
|
|
"RpcWinStationNotifyDisconnectPipe",
|
|
"RpcWinStationSessionInitialized",
|
|
"RpcRemoteAssistancePrepareSystemRestore",
|
|
"RpcWinStationGetAllProcesses_NT6",
|
|
"RpcWinStationRegisterNotificationEvent",
|
|
"RpcWinStationUnRegisterNotificationEvent",
|
|
"RpcWinStationAutoReconnect",
|
|
"RpcWinStationCheckAccess",
|
|
"RpcWinStationOpenSessionDirectory"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140708119110608,
|
|
"Service": "TermService",
|
|
"IsServiceRunning": true
|
|
},
|
|
"53b46b02-c73b-4a3e-8dee-b16b80672fc0": {
|
|
"Module": "TSVIPSrv.dll",
|
|
"ModulePath": "C:\\Windows\\WinSxS\\amd64_microsoft-windows-t..-tsappsrv-component_31bf3856ad364e35_10.0.18362.1316_none_7c6dc83f556303be\\TSVIPSrv.dll",
|
|
"InterfaceId": "53b46b02-c73b-4a3e-8dee-b16b80672fc0",
|
|
"InterfaceStructOffset": 99808,
|
|
"ProceduresCount": 2,
|
|
"Procedures": [
|
|
"RpcGetSessionIP",
|
|
"RpcGetBindingAdapter"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140707880844688,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"bd84cd86-9825-4376-813d-334c543f89b1": {
|
|
"Module": "das.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\das.dll",
|
|
"InterfaceId": "bd84cd86-9825-4376-813d-334c543f89b1",
|
|
"InterfaceStructOffset": 368736,
|
|
"ProceduresCount": 4,
|
|
"Procedures": [
|
|
"RpcDevQueryCreate",
|
|
"RpcDevQueryClose",
|
|
"RpcDevQueryGetResult",
|
|
"RpcDevPropertySet"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140707580792416,
|
|
"Service": "DeviceAssociationService",
|
|
"IsServiceRunning": false
|
|
},
|
|
"e3514235-4b06-11d1-ab04-00c04fc2dcd2": {
|
|
"Module": "ntdsai.dll",
|
|
"ModulePath": "C:\\Windows\\WinSxS\\amd64_microsoft-windows-d..toryservices-ntdsai_31bf3856ad364e35_10.0.18362.1916_none_fe1eba331c36e95d\\ntdsai.dll",
|
|
"InterfaceId": "e3514235-4b06-11d1-ab04-00c04fc2dcd2",
|
|
"InterfaceStructOffset": 4346000,
|
|
"ProceduresCount": 31,
|
|
"Procedures": [
|
|
"IDL_DRSBind",
|
|
"IDL_DRSUnbind",
|
|
"IDL_DRSReplicaSync",
|
|
"IDL_DRSGetNCChanges",
|
|
"IDL_DRSUpdateRefs",
|
|
"IDL_DRSReplicaAdd",
|
|
"IDL_DRSReplicaDel",
|
|
"IDL_DRSReplicaModify",
|
|
"IDL_DRSVerifyNames",
|
|
"IDL_DRSGetMemberships",
|
|
"IDL_DRSInterDomainMove",
|
|
"IDL_DRSGetNT4ChangeLog",
|
|
"IDL_DRSCrackNames",
|
|
"IDL_DRSWriteSPN",
|
|
"IDL_DRSRemoveDsServer",
|
|
"IDL_DRSRemoveDsDomain",
|
|
"IDL_DRSDomainControllerInfo",
|
|
"IDL_DRSAddEntry",
|
|
"IDL_DRSExecuteKCC",
|
|
"IDL_DRSGetReplInfo",
|
|
"IDL_DRSAddSidHistory",
|
|
"IDL_DRSGetMemberships2",
|
|
"IDL_DRSReplicaVerifyObjects",
|
|
"IDL_DRSGetObjectExistence",
|
|
"IDL_DRSQuerySitesByCost",
|
|
"IDL_DRSInitDemotion",
|
|
"IDL_DRSReplicaDemotion",
|
|
"IDL_DRSFinishDemotion",
|
|
"IDL_DRSAddCloneDC",
|
|
"IDL_DRSWriteNgcKey",
|
|
"IDL_DRSReadNgcKey"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140706768764672,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"c503f532-443a-4c69-8300-ccd1fbdb3839": {
|
|
"Module": "MpSvc.dll",
|
|
"ModulePath": "C:\\Windows\\WinSxS\\amd64_windows-defender-service_31bf3856ad364e35_10.0.18362.1533_none_d32c1fb0b9be2eb7\\MpSvc.dll",
|
|
"InterfaceId": "c503f532-443a-4c69-8300-ccd1fbdb3839",
|
|
"InterfaceStructOffset": 1872048,
|
|
"ProceduresCount": 152,
|
|
"Procedures": [
|
|
"ServerMpEnableFeature",
|
|
"ServerMpDisableFeature",
|
|
"ServerMpQueryStatus",
|
|
"ServerMpEventOpen",
|
|
"ServerMpEventClose",
|
|
"ServerMpEventQueryNotification",
|
|
"ServerMpOnDemandStartScan",
|
|
"ServerMpOnDemandQueryNotification",
|
|
"ServerMpOnDemandQueryScanResult",
|
|
"ServerMpOnDemandControlScan",
|
|
"ServerMpOnDemandControlSystemScan",
|
|
"ServerMpOnDemandPersistScan",
|
|
"ServerMpOnDemandCloseScan",
|
|
"ServerMpOnDemandThreatOpen",
|
|
"ServerMpOnDemandThreatEnum",
|
|
"ServerMpOnDemandThreatClose",
|
|
"ServerMpScanOpenThreatHistory",
|
|
"ServerMpScanEnumerateThreatHistory",
|
|
"ServerMpScanEnumerateDetectionHistory",
|
|
"ServerMpScanCloseThreatHistory",
|
|
"ServerMpScanDeleteThreatHistory",
|
|
"ServerMpRpcCleanOpen",
|
|
"ServerMpRpcScanCleanOpen",
|
|
"ServerMpRpcCleanStart",
|
|
"ServerMpRpcCleanControl",
|
|
"ServerMpRpcCleanThreatsNotification",
|
|
"ServerMpRpcPrecheckStart",
|
|
"ServerMpRpcPrecheckNotification",
|
|
"ServerMpRpcCleanQuery",
|
|
"ServerMpRpcCleanClose",
|
|
"Clone",
|
|
"Clone",
|
|
"Clone",
|
|
"Clone",
|
|
"ServerMpQuarantineEnumOpen",
|
|
"ServerMpQuarantineEnumerate",
|
|
"ServerMpQuarantineEnumClose",
|
|
"ServerMpQuarantineQueryInfo",
|
|
"ServerMpQuarantineRestoreThreat",
|
|
"ServerMpQuarantineDeleteThreat",
|
|
"ServerMpStateEnumOpen",
|
|
"ServerMpQueryEngineVersion",
|
|
"ServerMpUpdateEngineSignature",
|
|
"ServerMpRollbackEngineSignature",
|
|
"ServerMpThreatStaticInfo",
|
|
"ServerMpQuerySystemInfo",
|
|
"ServerMpRpcConfigSetValue",
|
|
"ServerMpRpcConfigDelValue",
|
|
"ServerMpRpcElevationHandleOpen",
|
|
"ServerMpRpcElevationHandleAttach",
|
|
"ServerMpRpcElevationHandleClose",
|
|
"ServerMpRpcElevateCleanHandle",
|
|
"ServerMpRpcSignatureThreatOpen",
|
|
"ServerMpRpcSignatureThreatEnum",
|
|
"ServerMpRpcSignatureThreatClose",
|
|
"ServerMpRpcGetSampleInfo",
|
|
"ServerMpRpcQueryScansWithSamples",
|
|
"ServerMpRpcDropScansWithSamples",
|
|
"ServerMpRpcSpynetQueueCreate",
|
|
"ServerMpRpcSpynetQueueQueryNotification",
|
|
"ServerMpRpcSpynetQueueClose",
|
|
"ServerMpRpcSpynetGenerateReport",
|
|
"ServerMpRpcSenseGenerateReport",
|
|
"ServerMpRpcSpynetOnResponse",
|
|
"ServerMpRpcSpynetGetStartTime",
|
|
"ServerMpRpcSpynetUpdateSpynetMetrics",
|
|
"ServerMpRpcSpynetClose",
|
|
"ServerMpRpcSigUpdServiceOpen",
|
|
"ServerMpRpcSigUpdServiceQueryNotification",
|
|
"ServerMpRpcSigUpdServiceSendProgressNotification",
|
|
"ServerMpRpcSigUpdServiceClose",
|
|
"ServerMpRpcSigUpdClientOpen",
|
|
"ServerMpRpcSigUpdClientQueryNotification",
|
|
"ServerMpRpcSigUpdClientClose",
|
|
"ServerMpRpcSigUpdControl",
|
|
"ServerMpRpcIdleNotificationOpen",
|
|
"ServerMpRpcIdleNotificationClose",
|
|
"ServerMpRpcNotifyIdle",
|
|
"ServerMpRpcIdleCheckTaskCompletion",
|
|
"ServerMpRpcThreatOpen",
|
|
"ServerMpRpcThreatEnumerate",
|
|
"ServerMpRpcThreatClose",
|
|
"ServerMpRpcDbgThreatViewAction",
|
|
"ServerMpRpcForcedReboot",
|
|
"Clone",
|
|
"ServerMpRpcAddFastPathSignatureFile",
|
|
"ServerMpRpcRemoveFastPathSignatureFile",
|
|
"ServerMpRpcDynamicSignatureOpen",
|
|
"ServerMpRpcDynamicSignatureEnumerate",
|
|
"ServerMpRpcDynamicSignatureClose",
|
|
"Clone",
|
|
"Clone",
|
|
"Clone",
|
|
"Clone",
|
|
"ServerMpRpcMemoryScanStart",
|
|
"ServerMpRpcMemoryScanQueryNotification",
|
|
"ServerMpRpcMemoryScanClose",
|
|
"ServerMpRpcFastMemoryScanOpen",
|
|
"ServerMpRpcFastMemoryScan",
|
|
"ServerMpRpcFastMemoryScanClose",
|
|
"ServerMpRpcFastMemoryScanCacheInfo",
|
|
"ServerMpRpcAmsiCloseSession",
|
|
"ServerMpRpcTcgLogScan",
|
|
"ServerMpRpcTcgLogApplyExtResult",
|
|
"ServerMpRpcDbgSendCallbackNotification",
|
|
"ServerMpRpcThreatRollup",
|
|
"ServerMpDetectionQuery",
|
|
"ServerMpRpcRequestSnooze",
|
|
"ServerMpRpcOfflineScanInstall",
|
|
"ServerMpRpcOfflineScanStatusQuery",
|
|
"ServerMpRpcTriggerHeartbeatOnDefenderDisable",
|
|
"ServerMpRpcTriggerHeartbeatOnUninstall",
|
|
"ServerMpRpcTriggerErrorHeartbeatReport",
|
|
"ServerMpRpcTriggerHeartbeatReport",
|
|
"ServerMpRpcRemapCallistoDetections",
|
|
"ServerMpRpcGetCallistoDetections",
|
|
"ServerMpRpcIsAdlFallbackDue",
|
|
"ServerMpRpcIsRtpAutoEnable",
|
|
"ServerMpRpcEngineQueryConfigDword",
|
|
"ServerMpRpcSampleHeaderQueueCreate",
|
|
"ServerMpRpcSampleHeaderQueueQueryNotification",
|
|
"ServerMpRpcSampleHeaderQueueClose",
|
|
"ServerMpRpcSampleHeaderClose",
|
|
"ServerMpRpcSampleHeaderGetSampleDetails",
|
|
"ServerMpRpcGetSampleChunk",
|
|
"ServerMpRpcConveySampleSubmissionResult",
|
|
"ServerMpRpcGetSampleListRequiringConsent",
|
|
"ServerMpRpcConveyUserChoiceForSampleList",
|
|
"ServerMpRpcGetRunningMode",
|
|
"ServerMpRpcIsGivenRunningModeSupported",
|
|
"ServerMpDisableXBGM",
|
|
"ServerMpDisableXBGM",
|
|
"ServerMpXBGMUpdateIV",
|
|
"ServerMpXBGMGetData",
|
|
"ServerMpXBGMGetData",
|
|
"ServerMpOnDemandStartScan2",
|
|
"ServerMpQueryDefaultFolderGuardList",
|
|
"ServerMpRpcTriggerStatusRefreshNotification",
|
|
"ServerMpRpcGetHIPSRuleInfo",
|
|
"ServerMpEnableSmartLocker",
|
|
"ServerMpDisableSmartLocker",
|
|
"ServerMpXBGMUpdateIV",
|
|
"ServerMpFlushLowfiCache",
|
|
"ServerMpRpcGetAsrBlockedProcesses",
|
|
"ServerMpRpcGetAsrBlockedActions",
|
|
"ServerMpRpcDeleteAsrHistory",
|
|
"ServerMpGetTaskSchedulerStrings",
|
|
"ServerMpRpcGetAsrBlockedActionInfos",
|
|
"ServerMpRpcGetTPStateInfo",
|
|
"ServerMpRpcSetTPState",
|
|
"ServerMpRpcUpdateDevMode",
|
|
"ServerMpRpcGetDevMode"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140707092421504,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"0767a036-0d22-48aa-ba69-b619480f38cb": {
|
|
"Module": "pcasvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\pcasvc.dll",
|
|
"InterfaceId": "0767a036-0d22-48aa-ba69-b619480f38cb",
|
|
"InterfaceStructOffset": 404384,
|
|
"ProceduresCount": 5,
|
|
"Procedures": [
|
|
"RAiMonitorProcess",
|
|
"RAiSendToService",
|
|
"RAiNotifyMsiInstall",
|
|
"RAiLinkChildToParent",
|
|
"RAiGetFileInfoFromPath"
|
|
],
|
|
"ProcStackSize": 72,
|
|
"DispatchFunction": 140707617368272,
|
|
"Service": "PcaSvc",
|
|
"IsServiceRunning": true
|
|
},
|
|
"54b4c689-969a-476f-8dc2-990885e9f562": {
|
|
"Module": "StorSvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\StorSvc.dll",
|
|
"InterfaceId": "54b4c689-969a-476f-8dc2-990885e9f562",
|
|
"InterfaceStructOffset": 661280,
|
|
"ProceduresCount": 10,
|
|
"Procedures": [
|
|
"SvcOpenStorageType",
|
|
"SvcSelectStorageVolumeEx",
|
|
"SvcSelectStorageVolume",
|
|
"SvcFindNextStorageType",
|
|
"SvcFindNextStorageTypeEx",
|
|
"SvcCloseFindStorage",
|
|
"SvcGetStorageDebugInfo",
|
|
"SvcGetStorageExecutionInfo",
|
|
"SvcGetTopFolders",
|
|
"SvcFindNextStorageTypeExAsync"
|
|
],
|
|
"ProcStackSize": 64,
|
|
"DispatchFunction": 140707759710864,
|
|
"Service": "StorSvc",
|
|
"IsServiceRunning": true
|
|
},
|
|
"b754ffa1-7b7b-4fb1-9d0c-f12bbda17593": {
|
|
"Module": "webplatstorageserver.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\webplatstorageserver.dll",
|
|
"InterfaceId": "b754ffa1-7b7b-4fb1-9d0c-f12bbda17593",
|
|
"InterfaceStructOffset": 933072,
|
|
"ProceduresCount": 46,
|
|
"Procedures": [
|
|
"s_Legacy_IDBFactory_openDatabase",
|
|
"s_Legacy_IDBFactory_Handle_openDatabase_Blocked",
|
|
"s_Legacy_IDBFactory_deleteDatabase",
|
|
"s_Legacy_IDBFactory_setClientOriginAttributes",
|
|
"s_Legacy_IDBDatabase_createObjectStore",
|
|
"s_Legacy_IDBDatabase_deleteObjectStore",
|
|
"s_Legacy_IDBDatabase_transaction",
|
|
"s_Legacy_IDBDatabase_close",
|
|
"s_Legacy_IDBDatabaseBlocked_close",
|
|
"s_Legacy_IDBTransaction_openObjectStore",
|
|
"s_Legacy_IDBTransaction_abortAndClose",
|
|
"s_Legacy_IDBTransaction_commitAndClose",
|
|
"s_Legacy_IDBObjectStore_put",
|
|
"s_Legacy_IDBObjectStore_add",
|
|
"s_Legacy_IDBObjectStore_get",
|
|
"s_Legacy_IDBObjectStore_getFromKeyRange",
|
|
"s_Legacy_IDBObjectStore_delete",
|
|
"s_Legacy_IDBObjectStore_deleteFromKeyRange",
|
|
"s_Legacy_IDBObjectStore_clear",
|
|
"s_Legacy_IDBObjectStore_openCursor",
|
|
"s_Legacy_IDBObjectStore_count",
|
|
"s_Legacy_IDBObjectStore_createIndex",
|
|
"s_Legacy_IDBObjectStore_openIndex",
|
|
"s_Legacy_IDBObjectStore_deleteIndex",
|
|
"s_Legacy_IDBObjectStore_close",
|
|
"s_Legacy_IDBIndex_openCursor",
|
|
"s_Legacy_IDBIndex_count",
|
|
"s_Legacy_IDBIndex_get",
|
|
"s_Legacy_IDBIndex_getFromKeyRange",
|
|
"s_Legacy_IDBIndex_getKey",
|
|
"s_Legacy_IDBIndex_getKeyFromKeyRange",
|
|
"s_Legacy_IDBIndex_close",
|
|
"s_Legacy_IDBCursor_update",
|
|
"s_Legacy_IDBCursor_continue",
|
|
"s_Legacy_IDBCursor_advance",
|
|
"s_Legacy_IDBCursor_delete",
|
|
"s_Legacy_IDBCursor_close",
|
|
"s_Legacy_IDB_BrowserQuota_DeleteWebSiteDatabases",
|
|
"s_Legacy_IDB_SpartanQuota_DeleteWebSiteDatabases",
|
|
"s_Legacy_IDB_BrowserQuota_DeleteAllDatabases",
|
|
"s_Legacy_IDB_Spartan_DeleteAllDatabases",
|
|
"s_Legacy_IDB_BrowserQuota_GetSpaceConsumption",
|
|
"s_Legacy_IDB_SpartanQuota_GetSpaceConsumption",
|
|
"s_Legacy_IDB_AppQuota_Uninstall",
|
|
"s_Legacy_IDB_App_CheckIfIDBDataPresent",
|
|
"s_Legacy_IDB_App_ForceShutdownIndexedDBDatabase"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140706993135264,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"2b70bed6-1757-4d22-9f39-448589fbebf5": {
|
|
"Module": "ngcsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\ngcsvc.dll",
|
|
"InterfaceId": "2b70bed6-1757-4d22-9f39-448589fbebf5",
|
|
"InterfaceStructOffset": 630224,
|
|
"ProceduresCount": 4,
|
|
"Procedures": [
|
|
"s_NgcTicketCreateForKeyOperations",
|
|
"s_NgcTicketCreateForNewKey",
|
|
"s_NgcTicketCreateForSmartCard",
|
|
"s_NgcTicketGetTicketFromPinCache"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140707094056144,
|
|
"Service": "NgcSvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"abfb6ca3-0c5e-4734-9285-0aee72fe8d1c": {
|
|
"Module": "wcmsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\wcmsvc.dll",
|
|
"InterfaceId": "abfb6ca3-0c5e-4734-9285-0aee72fe8d1c",
|
|
"InterfaceStructOffset": 768176,
|
|
"ProceduresCount": 21,
|
|
"Procedures": [
|
|
"RpcOpenHandle",
|
|
"RpcCloseHandle",
|
|
"RpcEnumInterfaces",
|
|
"RpcQueryParameter",
|
|
"RpcSetParameter",
|
|
"RpcQueryPublicParameter",
|
|
"RpcSetPublicParameter",
|
|
"RpcSetProfileList",
|
|
"RpcGetProfileList",
|
|
"RpcGetProfileListByPurpose",
|
|
"RpcGetTokens",
|
|
"RpcOrderConnection",
|
|
"RpcBeginIgnoreProfileList",
|
|
"RpcResetIgnoreProfileList",
|
|
"RpcEndIgnoreProfileList",
|
|
"RpcOpenOnDemandRequestHandle",
|
|
"RpcOpenOnDemandRequestHandleByWwanProfileName",
|
|
"RpcStartOnDemandRequest",
|
|
"RpcCancelOnDemandRequest",
|
|
"RpcCloseOnDemandRequestHandle",
|
|
"RpcQueryOnDemandRequestStateInfo"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140708018998304,
|
|
"Service": "Wcmsvc",
|
|
"IsServiceRunning": true
|
|
},
|
|
"eeee008d-5c99-4e4b-861b-547a26e8abd0": {
|
|
"Module": "dasHost.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\dasHost.exe",
|
|
"InterfaceId": "eeee008d-5c99-4e4b-861b-547a26e8abd0",
|
|
"InterfaceStructOffset": 68016,
|
|
"ProceduresCount": 33,
|
|
"Procedures": [
|
|
"DasHostLoadProvider",
|
|
"DasHostSetDasProcessHandle",
|
|
"DasHostUnloadProvider",
|
|
"DasHostShutdown",
|
|
"DasHostCreateProviderQuery",
|
|
"DasHostCloseQuery",
|
|
"DasHostProviderQueryGetResult",
|
|
"DasHostCreateAssociationContext",
|
|
"DasHostCreateAssociationContextFromOobBlob",
|
|
"DasHostStartEnumCeremonies",
|
|
"DasHostSelectCeremony",
|
|
"DasHostStartReadCeremonyData",
|
|
"DasHostStartWriteCeremonyData",
|
|
"DasHostStartFinalize",
|
|
"DasHostDeviceStatusNotification",
|
|
"DasHostStartRemoveAssociation",
|
|
"DasHostCloseAssociationContext",
|
|
"DasHostCreateDevnodeManagementContext",
|
|
"DasHostStartDevnodeManagement",
|
|
"DasHostEndDevnodeManagement",
|
|
"DasHostPickupDevnodeManagementOperation",
|
|
"DasHostGetDevnodeFactoryOperationInfo",
|
|
"DasHostCompleteDevnodeFactoryOperation",
|
|
"DasHostGetDevnodeOperationInfo",
|
|
"DasHostCompleteDevnodeOperation",
|
|
"DasHostCloseDevnodeManagementContext",
|
|
"DasHostCreateChallengeContext",
|
|
"DasHostStartChallengeDevicePresence",
|
|
"DasHostCloseChallengeContext",
|
|
"DasHostCreateImportExportContext",
|
|
"DasHostStartImport",
|
|
"DasHostStartExport",
|
|
"DasHostCloseImportExportContext"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140700528890528,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"69510fa1-2f99-4eeb-a4ff-af259f0f9749": {
|
|
"Module": "wecsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\wecsvc.dll",
|
|
"InterfaceId": "69510fa1-2f99-4eeb-a4ff-af259f0f9749",
|
|
"InterfaceStructOffset": 143664,
|
|
"ProceduresCount": 7,
|
|
"Procedures": [
|
|
"EcRpcGetSubscriptionNames",
|
|
"EcRpcGetSubscription",
|
|
"EcRpcPutSubscription",
|
|
"EcRpcDeleteSubscription",
|
|
"EcRpcGetSubscriptionRunTimeStatus",
|
|
"EcRpcGetSubscriptionRunTimeEventSources",
|
|
"EcRpcRetrySubscription"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140707581011872,
|
|
"Service": "Wecsvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"d3e9e61c-7c85-4a62-8e06-9bd2892311bd": {
|
|
"Module": "mpengine.dll",
|
|
"ModulePath": "C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\mpengine.dll",
|
|
"InterfaceId": "d3e9e61c-7c85-4a62-8e06-9bd2892311bd",
|
|
"InterfaceStructOffset": 11416768,
|
|
"ProceduresCount": 22,
|
|
"Procedures": [
|
|
"MpBootStrap",
|
|
"_rsignal",
|
|
"MpBootStrap",
|
|
"Proc3",
|
|
"Proc4",
|
|
"MpBootStrap",
|
|
"MpBootStrap",
|
|
"Proc7",
|
|
"MpBootStrap",
|
|
"MpBootStrap",
|
|
"MpBootStrap",
|
|
"_rsignal",
|
|
"Proc12",
|
|
"Proc13",
|
|
"MpBootStrap",
|
|
"MpBootStrap",
|
|
"Proc16",
|
|
"MpBootStrap",
|
|
"MpBootStrap",
|
|
"MpBootStrap",
|
|
"MpBootStrap",
|
|
"MpBootStrap"
|
|
],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140706774274704,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"88143fd0-c28d-4b2b-8fef-8d882f6a9390": {
|
|
"Module": "lsm.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\lsm.dll",
|
|
"InterfaceId": "88143fd0-c28d-4b2b-8fef-8d882f6a9390",
|
|
"InterfaceStructOffset": 479696,
|
|
"ProceduresCount": 12,
|
|
"Procedures": [
|
|
"RpcOpenEnum",
|
|
"RpcCloseEnum",
|
|
"RpcFilterByState",
|
|
"RpcFilterByCallersName",
|
|
"RpcEnumAddFilter",
|
|
"RpcGetEnumResult",
|
|
"RpcFilterBySessionType",
|
|
"RpcFilterByLicenseType",
|
|
"RpcGetSessionIds",
|
|
"RpcGetEnumResultEx",
|
|
"RpcGetAllSessions",
|
|
"RpcGetAllSessionsEx"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140708131514208,
|
|
"Service": "LSM",
|
|
"IsServiceRunning": true
|
|
},
|
|
"300f3532-38cc-11d0-a3f0-0020af6b0add": {
|
|
"Module": "trkwks.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\trkwks.dll",
|
|
"InterfaceId": "300f3532-38cc-11d0-a3f0-0020af6b0add",
|
|
"InterfaceStructOffset": 80672,
|
|
"ProceduresCount": 13,
|
|
"Procedures": [
|
|
"Stubold_LnkMendLink",
|
|
"StubGetFileTrackingInformation",
|
|
"StubGetFileTrackingInformation",
|
|
"StubLnkSetVolumeId",
|
|
"StubGetFileTrackingInformation",
|
|
"StubGetFileTrackingInformation",
|
|
"StubGetFileTrackingInformation",
|
|
"StubGetFileTrackingInformation",
|
|
"StubLnkOnRestore",
|
|
"StubLnkMendLink",
|
|
"StubGetFileTrackingInformation",
|
|
"StubGetFileTrackingInformation",
|
|
"StubLnkSearchMachine"
|
|
],
|
|
"ProcStackSize": 72,
|
|
"DispatchFunction": 140707904071616,
|
|
"Service": "TrkWks",
|
|
"IsServiceRunning": true
|
|
},
|
|
"1d55b526-c137-46c5-ab79-638f2a68e869": {
|
|
"Module": "RpcEpMap.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\RpcEpMap.dll",
|
|
"InterfaceId": "1d55b526-c137-46c5-ab79-638f2a68e869",
|
|
"InterfaceStructOffset": 45056,
|
|
"ProceduresCount": 13,
|
|
"Procedures": [
|
|
"RemoteGetCellByDebugCellID",
|
|
"RemoteOpenRPCDebugCallInfoEnumeration",
|
|
"RemoteGetNextRPCDebugCallInfo",
|
|
"RemoteFinishRPCDebugCallInfoEnumeration",
|
|
"RemoteOpenRPCDebugEndpointInfoEnumeration",
|
|
"RemoteGetNextRPCDebugEndpointInfo",
|
|
"RemoteFinishRPCDebugEndpointInfoEnumeration",
|
|
"RemoteOpenRPCDebugThreadInfoEnumeration",
|
|
"RemoteGetNextRPCDebugThreadInfo",
|
|
"RemoteFinishRPCDebugThreadInfoEnumeration",
|
|
"RemoteOpenRPCDebugClientCallInfoEnumeration",
|
|
"RemoteGetNextRPCDebugClientCallInfo",
|
|
"RemoteFinishRPCDebugClientCallInfoEnumeration"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140708134488656,
|
|
"Service": "RpcEptMapper",
|
|
"IsServiceRunning": true
|
|
},
|
|
"c225e799-29de-42af-bc05-1e2127cc056e": {
|
|
"Module": "ngcsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\ngcsvc.dll",
|
|
"InterfaceId": "c225e799-29de-42af-bc05-1e2127cc056e",
|
|
"InterfaceStructOffset": 630128,
|
|
"ProceduresCount": 13,
|
|
"Procedures": [
|
|
"s_NgcMgmtGetPolicy",
|
|
"s_NgcMgmtGetProtectedRecoveryBlob",
|
|
"s_NgcMgmtChangePin",
|
|
"s_NgcMgmtChangePinSilent",
|
|
"s_NgcMgmtRecoverPin",
|
|
"s_NgcMgmtRecoverPinSilent",
|
|
"s_NgcMgmtAddBioProtector",
|
|
"s_NgcMgmtRemoveBioProtector",
|
|
"s_NgcMgmtSetLastCredProv",
|
|
"s_NgcMgmtAddPrebootProtector",
|
|
"s_NgcMgmtRemovePrebootProtector",
|
|
"s_NgcMgmtAddCompanionDeviceProtector",
|
|
"s_NgcMgmtRemoveCompanionDeviceProtector"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140707093979344,
|
|
"Service": "NgcSvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"9c56d792-0591-4431-8d1f-681bfd80e4c0": {
|
|
"Module": "wwansvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\wwansvc.dll",
|
|
"InterfaceId": "9c56d792-0591-4431-8d1f-681bfd80e4c0",
|
|
"InterfaceStructOffset": 1110496,
|
|
"ProceduresCount": 14,
|
|
"Procedures": [
|
|
"Wwan2RpcOpenHandle",
|
|
"Wwan2RpcCloseHandle",
|
|
"Wwan2RpcQueryInterfaces",
|
|
"Wwan2RpcEnumerateDeviceServices",
|
|
"Wwan2RpcRegisterNotification",
|
|
"Wwan2RpcAsyncGetNotification",
|
|
"Wwan2RpcOpenDeviceServiceCommandSession",
|
|
"Wwan2RpcCloseDeviceServiceCommandSession",
|
|
"Wwan2RpcSendDeviceServiceCommand",
|
|
"Wwan2RpcQueryDeviceServiceSupportedCommands",
|
|
"Wwan2RpcOpenDeviceServiceDataSession",
|
|
"Wwan2RpcCloseDeviceServiceDataSession",
|
|
"Wwan2RpcWriteDeviceServiceData",
|
|
"Wwan2RpcSubscribePowerStateEvents"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140707093452496,
|
|
"Service": "WwanSvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"6099fc12-3eff-11d0-abd0-00c04fd91a4e": {
|
|
"Module": "FXSAPI.DLL",
|
|
"ModulePath": "C:\\Windows\\System32\\DriverStore\\FileRepository\\prnms002.inf_amd64_327b6e6da271683d\\Amd64\\FXSAPI.DLL",
|
|
"InterfaceId": "6099fc12-3eff-11d0-abd0-00c04fd91a4e",
|
|
"InterfaceStructOffset": 223984,
|
|
"ProceduresCount": 4,
|
|
"Procedures": [
|
|
"FAX_OpenConnection",
|
|
"FAX_ClientEventQueue",
|
|
"FAX_CloseConnection",
|
|
"FAX_ClientEventQueueEx"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140707880707760,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"11220835-5b26-4d94-ae86-c3e475a809de": {
|
|
"Module": "dpapisrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\dpapisrv.dll",
|
|
"InterfaceId": "11220835-5b26-4d94-ae86-c3e475a809de",
|
|
"InterfaceStructOffset": 184416,
|
|
"ProceduresCount": 3,
|
|
"Procedures": [
|
|
"s_SSCryptProtectData",
|
|
"s_SSCryptUnprotectData",
|
|
"s_SSCryptUpdateProtectedState"
|
|
],
|
|
"ProcStackSize": 64,
|
|
"DispatchFunction": 140708143007488,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"ace1c026-8b3f-4711-8918-f345d17f5bff": {
|
|
"Module": "lsasrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\lsasrv.dll",
|
|
"InterfaceId": "ace1c026-8b3f-4711-8918-f345d17f5bff",
|
|
"InterfaceStructOffset": 1270048,
|
|
"ProceduresCount": 2,
|
|
"Procedures": [
|
|
"S_RPC_LspUpdatePrivateData",
|
|
"S_RPC_LspReadPrivateData"
|
|
],
|
|
"ProcStackSize": 64,
|
|
"DispatchFunction": 140708153423376,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"93149ca2-973b-11d1-8c39-00c04fb984f9": {
|
|
"Module": "scecli.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\scecli.dll",
|
|
"InterfaceId": "93149ca2-973b-11d1-8c39-00c04fb984f9",
|
|
"InterfaceStructOffset": 191248,
|
|
"ProceduresCount": 3,
|
|
"Procedures": [
|
|
"SceClientCallback",
|
|
"SceClientBrowseCallback",
|
|
"SceClientCallbackRsopLog"
|
|
],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140708141469440,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"71d6addc-3548-4d49-8580-589694df3c9d": {
|
|
"Module": "AppVEntSubsystemController.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\AppVEntSubsystemController.dll",
|
|
"InterfaceId": "71d6addc-3548-4d49-8580-589694df3c9d",
|
|
"InterfaceStructOffset": 900560,
|
|
"ProceduresCount": 2,
|
|
"Procedures": [
|
|
"registry_staging_server_GetConfiguration",
|
|
"registry_staging_server_RequestStaging"
|
|
],
|
|
"ProcStackSize": 64,
|
|
"DispatchFunction": 140706797733328,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"f2c9b409-c1c9-4100-8639-d8ab1486694a": {
|
|
"Module": "wkssvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\wkssvc.dll",
|
|
"InterfaceId": "f2c9b409-c1c9-4100-8639-d8ab1486694a",
|
|
"InterfaceStructOffset": 195888,
|
|
"ProceduresCount": 2,
|
|
"Procedures": [
|
|
"ClusterConnectUpcall",
|
|
"ClusterDisConnectUpcall"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140708036954688,
|
|
"Service": "LanmanWorkstation",
|
|
"IsServiceRunning": true
|
|
},
|
|
"880fd55e-43b9-11e0-b1a8-cf4edfd72085": {
|
|
"Module": "ncbservice.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\ncbservice.dll",
|
|
"InterfaceId": "880fd55e-43b9-11e0-b1a8-cf4edfd72085",
|
|
"InterfaceStructOffset": 233568,
|
|
"ProceduresCount": 4,
|
|
"Procedures": [
|
|
"KapiRegisterProvider",
|
|
"KapiDeregisterProvider",
|
|
"KapiUpdateKaSample",
|
|
"KapiReceiveKaUpdateRequest"
|
|
],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140708099397504,
|
|
"Service": "NcbService",
|
|
"IsServiceRunning": true
|
|
},
|
|
"0820a0d0-1aae-49f9-acf9-3e3d3fe303cb": {
|
|
"Module": "webplatstorageserver.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\webplatstorageserver.dll",
|
|
"InterfaceId": "0820a0d0-1aae-49f9-acf9-3e3d3fe303cb",
|
|
"InterfaceStructOffset": 922240,
|
|
"ProceduresCount": 40,
|
|
"Procedures": [
|
|
"s_CreateIDBFactory",
|
|
"s_IDBFactory_openDatabase",
|
|
"s_IDBFactory_deleteDatabase",
|
|
"s_IDBFactory_getDatabaseNames",
|
|
"s_IDBFactory_setClientOriginAttributes",
|
|
"s_IDBFactory_close",
|
|
"s_IDBDatabase_createObjectStore",
|
|
"s_IDBDatabase_deleteObjectStore",
|
|
"s_IDBDatabase_transaction",
|
|
"s_IDBDatabase_close",
|
|
"s_IDBTransaction_objectStore",
|
|
"s_IDBTransaction_abortAndClose",
|
|
"s_IDBTransaction_commitAndClose",
|
|
"s_IDBObjectStore_put",
|
|
"s_IDBObjectStore_add",
|
|
"s_IDBObjectStore_get",
|
|
"s_IDBObjectStore_getFromKeyRange",
|
|
"s_IDBObjectStore_delete",
|
|
"s_IDBObjectStore_deleteFromKeyRange",
|
|
"s_IDBObjectStore_clear",
|
|
"s_IDBObjectStore_openCursor",
|
|
"s_IDBObjectStore_count",
|
|
"s_IDBObjectStore_createIndex",
|
|
"s_IDBObjectStore_openIndex",
|
|
"s_IDBObjectStore_deleteIndex",
|
|
"s_IDBObjectStore_close",
|
|
"s_IDBIndex_openCursor",
|
|
"s_IDBIndex_count",
|
|
"s_IDBIndex_get",
|
|
"s_IDBIndex_getFromKeyRange",
|
|
"s_IDBIndex_getKey",
|
|
"s_IDBIndex_getKeyFromKeyRange",
|
|
"s_IDBIndex_close",
|
|
"s_IDBCursor_update",
|
|
"s_IDBCursor_continue",
|
|
"s_IDBCursor_advance",
|
|
"s_IDBCursor_delete",
|
|
"s_IDBCursor_close",
|
|
"s_IDB_AppQuota_Uninstall",
|
|
"s_HaveDataInSharedDatabase"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140706993055072,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"d22895ef-aff4-42c5-a5b2-b14466d34ab4": {
|
|
"Module": "diagtrack.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\diagtrack.dll",
|
|
"InterfaceId": "d22895ef-aff4-42c5-a5b2-b14466d34ab4",
|
|
"InterfaceStructOffset": 2709856,
|
|
"ProceduresCount": 13,
|
|
"Procedures": [
|
|
"UtcEventTranscriptApi_FetchTranscriptStats",
|
|
"UtcEventTranscriptApi_FetchTranscriptRecordsPage",
|
|
"UtcEventTranscriptApi_FetchTranscriptRecordPayload",
|
|
"UtcEventTranscriptApi_FetchKnownTags",
|
|
"UtcEventTranscriptApi_FetchEventTags",
|
|
"UtcEventTranscriptApi_IsSampledIn",
|
|
"UtcEventTranscriptApi_FetchTranscriptRecordsPage2",
|
|
"UtcEventTranscriptApi_CancelFetchOperations",
|
|
"UtcEventTranscriptApi_FetchEventPerCategoryDistribution",
|
|
"UtcEventTranscriptApi_FetchEventPerBinaryDistribution",
|
|
"UtcEventTranscriptApi_FetchDiagnosticsStats",
|
|
"UtcEventTranscriptApi_SetTranscriptConfiguration",
|
|
"UtcEventTranscriptApi_GetTranscriptConfiguration"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140707991502544,
|
|
"Service": "DiagTrack",
|
|
"IsServiceRunning": true
|
|
},
|
|
"aed52de0-6162-4172-b4a5-258ff409ecc4": {
|
|
"Module": "MpCopyAccelerator.exe",
|
|
"ModulePath": "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2109.6-0\\MpCopyAccelerator.exe",
|
|
"InterfaceId": "aed52de0-6162-4172-b4a5-258ff409ecc4",
|
|
"InterfaceStructOffset": 70736,
|
|
"ProceduresCount": 3,
|
|
"Procedures": [
|
|
"Proc0",
|
|
"Proc1",
|
|
"Proc2"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140701464608272,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"38d99c23-51e0-4487-8c43-5b83c7b5ec30": {
|
|
"Module": "vmplatformca.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\vmplatformca.exe",
|
|
"InterfaceId": "38d99c23-51e0-4487-8c43-5b83c7b5ec30",
|
|
"InterfaceStructOffset": 21152,
|
|
"ProceduresCount": 5,
|
|
"Procedures": [
|
|
"RpcVmCaCertProvOpenHandle",
|
|
"RpcVmCaCertProvCloseHandle",
|
|
"RpcVmCaCreateReport",
|
|
"RpcVmCaSetIntermediateCertificate",
|
|
"RpcVmCaGetIdkSigningKey"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140696258621488,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"6bbd4016-73b6-4fac-81c4-f2256dcee12d": {
|
|
"Module": "AppVShNotify.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\AppVShNotify.exe",
|
|
"InterfaceId": "6bbd4016-73b6-4fac-81c4-f2256dcee12d",
|
|
"InterfaceStructOffset": 103328,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"s_IShortcutNotify_ShellNotifyPath"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140702910023424,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"a3bae3f7-bf97-49fb-b48d-2a5e8657b436": {
|
|
"Module": "PhoneProviders.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\PhoneProviders.dll",
|
|
"InterfaceId": "a3bae3f7-bf97-49fb-b48d-2a5e8657b436",
|
|
"InterfaceStructOffset": 737312,
|
|
"ProceduresCount": 25,
|
|
"Procedures": [
|
|
"InitializeConnectionToAppHost",
|
|
"NewIncomingCall",
|
|
"NewIncomingUpgradeCall",
|
|
"NewOutgoingCall",
|
|
"NewAcceptedCall",
|
|
"NewAppInitiatedCall",
|
|
"ShowAppUI",
|
|
"NewOutgoingUpgradeCall",
|
|
"CallAccepted",
|
|
"CallActive",
|
|
"CallReady",
|
|
"CallHeld",
|
|
"CallEnded",
|
|
"SetMuteState",
|
|
"UpdateCallContactName",
|
|
"UpdateCallStartTime",
|
|
"GetCallStartTime",
|
|
"UpdateCallAttributes",
|
|
"GetNextVoipAppOperation",
|
|
"VoipAppOperationComplete",
|
|
"ConfirmVoipNonSeamlessUpgrade",
|
|
"CancelVoipUpgrade",
|
|
"ReserveVoipCallResources",
|
|
"ReserveVoipCallResourcesForOneProcessVoIP",
|
|
"CancelVoipCallResourceReservation"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140707093695296,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"8174bb16-571b-4c38-8386-1102b449044a": {
|
|
"Module": "pnrpsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\pnrpsvc.dll",
|
|
"InterfaceId": "8174bb16-571b-4c38-8386-1102b449044a",
|
|
"InterfaceStructOffset": 301584,
|
|
"ProceduresCount": 13,
|
|
"Procedures": [
|
|
"RPCPeerIdentityCreate",
|
|
"RPCPeerIdentityRelease",
|
|
"RPCPeerIdentityDelete",
|
|
"RPCPeerIdentityByPeerName",
|
|
"RPCPeerIdentitySetFriendlyName",
|
|
"RPCPeerIdentityCreateCert",
|
|
"RPCPeerIdentityGetCert",
|
|
"RPCPeerIdentitySetCert",
|
|
"RPCPeerIdentityList",
|
|
"RPCPeerIdentityGroupCreate",
|
|
"RPCPeerIdentityGroupList",
|
|
"RPCPeerIdentityGroupDelete",
|
|
"RPCPeerIdentityImport"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140707580889584,
|
|
"Service": "PNRPsvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"2bacbe6a-051a-4524-b495-c26a9878fb2b": {
|
|
"Module": "HostNetSvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\HostNetSvc.dll",
|
|
"InterfaceId": "2bacbe6a-051a-4524-b495-c26a9878fb2b",
|
|
"InterfaceStructOffset": 2501600,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"HnsRpcHv_NotifyGuestStatus"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140707750176736,
|
|
"Service": "hns",
|
|
"IsServiceRunning": true
|
|
},
|
|
"eb17bee4-2a08-46ba-89d3-0be4a2239df3": {
|
|
"Module": "TSVIPSrv.dll",
|
|
"ModulePath": "C:\\Windows\\WinSxS\\amd64_microsoft-windows-t..-tsappsrv-component_31bf3856ad364e35_10.0.18362.1316_none_7c6dc83f556303be\\TSVIPSrv.dll",
|
|
"InterfaceId": "eb17bee4-2a08-46ba-89d3-0be4a2239df3",
|
|
"InterfaceStructOffset": 98384,
|
|
"ProceduresCount": 3,
|
|
"Procedures": [
|
|
"RpcRequestVirtualIP",
|
|
"FailedToBind",
|
|
"RpcGetMachineIPs"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140707880843744,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"1ff70682-0a51-30e8-076d-740be8cee98b": {
|
|
"Module": "taskcomp.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\taskcomp.dll",
|
|
"InterfaceId": "1ff70682-0a51-30e8-076d-740be8cee98b",
|
|
"InterfaceStructOffset": 293472,
|
|
"ProceduresCount": 4,
|
|
"Procedures": [
|
|
"NetrJobAdd",
|
|
"NetrJobDel",
|
|
"NetrJobEnum",
|
|
"NetrJobGetInfo"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140708043127840,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"51919b05-128e-4db4-9686-27e6c89a7db9": {
|
|
"Module": "psp.exe",
|
|
"ModulePath": "C:\\Windows\\WinSxS\\amd64_microsoft-windows-p..ioningsecureprocess_31bf3856ad364e35_10.0.18362.1_none_69337af49cf9e1d5\\psp.exe",
|
|
"InterfaceId": "51919b05-128e-4db4-9686-27e6c89a7db9",
|
|
"InterfaceStructOffset": 124416,
|
|
"ProceduresCount": 5,
|
|
"Procedures": [
|
|
"RpcPspTerminate",
|
|
"RpcPspOpenHandle",
|
|
"RpcPspCloseHandle",
|
|
"RpcPspSetMessageBuffer",
|
|
"RpcPspCallbackWorker"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140697258585424,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"7a20fcec-dec4-4c59-be57-212e8f65d3de": {
|
|
"Module": "SgrmBroker.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\SgrmBroker.exe",
|
|
"InterfaceId": "7a20fcec-dec4-4c59-be57-212e8f65d3de",
|
|
"InterfaceStructOffset": 182720,
|
|
"ProceduresCount": 5,
|
|
"Procedures": [
|
|
"s_SgrmCreateSession",
|
|
"s_SgrmEndSession",
|
|
"s_GetSessionReport",
|
|
"s_GetRuntimeReport",
|
|
"s_GetSessionCertificate"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140696621664176,
|
|
"Service": "SgrmBroker",
|
|
"IsServiceRunning": true
|
|
},
|
|
"4a452661-8290-4b36-8fbe-7f4093a94978": {
|
|
"Module": "spoolsv.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\spoolsv.exe",
|
|
"InterfaceId": "4a452661-8290-4b36-8fbe-7f4093a94978",
|
|
"InterfaceStructOffset": 557936,
|
|
"ProceduresCount": 4,
|
|
"Procedures": [
|
|
"IRPCAsyncNotifyChannel_CreateChannel",
|
|
"IRPCAsyncNotifyChannel_SendNotification",
|
|
"IRPCAsyncNotifyChannel_SendNotificationGetResponse",
|
|
"IRPCAsyncNotifyChannel_CloseChannel"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140698296497600,
|
|
"Service": "Spooler",
|
|
"IsServiceRunning": true
|
|
},
|
|
"6c9b7b96-45a8-4cca-9eb3-e21ccf8b5a89": {
|
|
"Module": "umpo.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\umpo.dll",
|
|
"InterfaceId": "6c9b7b96-45a8-4cca-9eb3-e21ccf8b5a89",
|
|
"InterfaceStructOffset": 81984,
|
|
"ProceduresCount": 33,
|
|
"Procedures": [
|
|
"UmpoRpcGetPowerConfiguration",
|
|
"UmpoRpcReadFromSystemPowerKey",
|
|
"UmpoRpcReadFromUserPowerKey",
|
|
"UmpoRpcReadACValue",
|
|
"UmpoRpcReadDCValue",
|
|
"UmpoRpcWriteToSystemPowerKey",
|
|
"UmpoRpcWriteToUserPowerKey",
|
|
"UmpoRpcApplyPowerRequestOverride",
|
|
"UmpoRpcApplyPowerSetting",
|
|
"UmpoRpcSetActiveScheme",
|
|
"UmpoRpcGetActiveScheme",
|
|
"UmpoRpcSetActiveOverlayScheme",
|
|
"UmpoRpcGetActualOverlayScheme",
|
|
"UmpoRpcGetEffectiveOverlayScheme",
|
|
"UmpoRpcGetOverlaySchemes",
|
|
"UmpoRpcRestoreDefaultScheme",
|
|
"UmpoRpcRestoreDefaultSchemesAll",
|
|
"UmpoRpcDuplicateScheme",
|
|
"UmpoRpcDeleteScheme",
|
|
"UmpoRpcImportScheme",
|
|
"UmpoRpcReplaceDefaultPowerSchemes",
|
|
"UmpoRpcLegacyEventRegisterNotification",
|
|
"UmpoRpcEnumerate",
|
|
"UmpoRpcReadSecurityDescriptor",
|
|
"UmpoRpcWriteSecurityDescriptor",
|
|
"UmpoRpcSettingAccessCheck",
|
|
"UmpoRpcCreateSetting",
|
|
"UmpoRpcCreatePossibleSetting",
|
|
"UmpoRpcRemoveSetting",
|
|
"UmpoSetExpectedUserAwayIntervals",
|
|
"UmpoClearExpectedUserAwayIntervals",
|
|
"UmpoGetMinUserAwayPredictionInterval",
|
|
"UmpoRpcGetAdaptiveStandbyDiagnostics"
|
|
],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140708139495552,
|
|
"Service": "Power",
|
|
"IsServiceRunning": true
|
|
},
|
|
"0d47017b-b33b-46ad-9e18-fe96456c5078": {
|
|
"Module": "PsmServiceExtHost.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\PsmServiceExtHost.dll",
|
|
"InterfaceId": "0d47017b-b33b-46ad-9e18-fe96456c5078",
|
|
"InterfaceStructOffset": 564272,
|
|
"ProceduresCount": 4,
|
|
"Procedures": [
|
|
"HamRpcSrvConnectSessionState",
|
|
"HamRpcSrvDisconnect",
|
|
"HamRpcSrvSessionStateLogoffUser",
|
|
"HamRpcSrvSessionStateLogoffSession"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140708133531776,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"ddee8f08-c317-41b1-9f40-d0f57b8f6f20": {
|
|
"Module": "ResetEngine.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\ResetEngine.dll",
|
|
"InterfaceId": "ddee8f08-c317-41b1-9f40-d0f57b8f6f20",
|
|
"InterfaceStructOffset": 1223744,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"PbrCloudPluginDownloadProgressCallback"
|
|
],
|
|
"ProcStackSize": 8,
|
|
"DispatchFunction": 140707093109632,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"6bffd098-a112-3610-9833-012892020162": {
|
|
"Module": "browser.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\browser.dll",
|
|
"InterfaceId": "6bffd098-a112-3610-9833-012892020162",
|
|
"InterfaceStructOffset": 97664,
|
|
"ProceduresCount": 12,
|
|
"Procedures": [
|
|
"I_BrowserrServerEnum",
|
|
"I_BrowserrDebugCall",
|
|
"I_BrowserrQueryOtherDomains",
|
|
"I_BrowserrDebugCall",
|
|
"I_BrowserrDebugCall",
|
|
"I_BrowserrQueryStatistics",
|
|
"I_BrowserrResetStatistics",
|
|
"NetrBrowserStatisticsClear",
|
|
"NetrBrowserStatisticsClear",
|
|
"I_BrowserrDebugCall",
|
|
"I_BrowserrQueryEmulatedDomains",
|
|
"I_BrowserrServerEnumEx"
|
|
],
|
|
"ProcStackSize": 80,
|
|
"DispatchFunction": 140707594741024,
|
|
"Service": "Browser",
|
|
"IsServiceRunning": false
|
|
},
|
|
"4e25f4a2-21e8-40ce-b401-32050413143a": {
|
|
"Module": "ngcsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\ngcsvc.dll",
|
|
"InterfaceId": "4e25f4a2-21e8-40ce-b401-32050413143a",
|
|
"InterfaceStructOffset": 630320,
|
|
"ProceduresCount": 16,
|
|
"Procedures": [
|
|
"s_DeviceCredentialRpcInitializeProvisioning",
|
|
"s_DeviceCredentialRpcCompleteProvisioning",
|
|
"s_DeviceCredentialRpcAbortProvisioning",
|
|
"s_DeviceCredentialRpcInitializeAuthentication",
|
|
"s_DeviceCredentialRpcCompleteAuthentication",
|
|
"s_DeviceCredentialRpcShowNotificationMessage",
|
|
"s_DeviceCredentialRpcAbortAuthentication",
|
|
"s_DeviceCredentialRpcFindFirst",
|
|
"s_DeviceCredentialRpcFindNext",
|
|
"s_DeviceCredentialRpcGetDeviceInfo",
|
|
"s_DeviceCredentialRpcFindClose",
|
|
"s_DeviceCredentialRpcDeprovision",
|
|
"s_DeviceCredentialRpcSetOpaqueBlob",
|
|
"s_DeviceCredentialRpcSetFriendlyName",
|
|
"s_DeviceCredentialRpcScanDeploymentData",
|
|
"s_DeviceCredentialRpcUpdateDeploymentData"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140707094139024,
|
|
"Service": "NgcSvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"1fff8faa-ec23-4e3f-a8ce-4b2f8707e636": {
|
|
"Module": "iphlpsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\iphlpsvc.dll",
|
|
"InterfaceId": "1fff8faa-ec23-4e3f-a8ce-4b2f8707e636",
|
|
"InterfaceStructOffset": 483680,
|
|
"ProceduresCount": 2,
|
|
"Procedures": [
|
|
"TeredoCreateConsumerHandle",
|
|
"TeredoCloseConsumerHandle"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140707888011808,
|
|
"Service": "iphlpsvc",
|
|
"IsServiceRunning": true
|
|
},
|
|
"fb8a0729-2d04-4658-be93-27b4ad553fac": {
|
|
"Module": "lsass.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\lsass.exe",
|
|
"InterfaceId": "fb8a0729-2d04-4658-be93-27b4ad553fac",
|
|
"InterfaceStructOffset": 24576,
|
|
"ProceduresCount": 7,
|
|
"Procedures": [
|
|
"LsaLookuprOpenPolicy2",
|
|
"LsaLookuprClose",
|
|
"LsaLookuprTranslateSids2",
|
|
"LsaLookuprTranslateNames3",
|
|
"LsaLookuprManageCache",
|
|
"LsaLookuprGetDomainInfo",
|
|
"LsaLookuprUserAccountType"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140698808751088,
|
|
"Service": "VaultSvc",
|
|
"IsServiceRunning": true
|
|
},
|
|
"b50bf410-9fc9-4a20-ab6d-9c7453fe8f94": {
|
|
"Module": "DmApiSetExtImplDesktop.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\DmApiSetExtImplDesktop.dll",
|
|
"InterfaceId": "b50bf410-9fc9-4a20-ab6d-9c7453fe8f94",
|
|
"InterfaceStructOffset": 53808,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"RpcDmUI_SubmitUserInput"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140707880919632,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"4b183cf6-affd-4872-9da2-7564b683d027": {
|
|
"Module": "AppVEntSubsystemController.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\AppVEntSubsystemController.dll",
|
|
"InterfaceId": "4b183cf6-affd-4872-9da2-7564b683d027",
|
|
"InterfaceStructOffset": 900368,
|
|
"ProceduresCount": 6,
|
|
"Procedures": [
|
|
"jitv_server_get_package_for_process",
|
|
"jitv_find_ve_for_path",
|
|
"jitv_virtual_module_loaded",
|
|
"jitv_virtual_module_unloaded",
|
|
"jitv_activate_for_thread",
|
|
"jitv_deactivate_for_thread"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140706797674144,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"bde95fdf-eee0-45de-9e12-e5a61cd0d4fe": {
|
|
"Module": "termsrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\termsrv.dll",
|
|
"InterfaceId": "bde95fdf-eee0-45de-9e12-e5a61cd0d4fe",
|
|
"InterfaceStructOffset": 750928,
|
|
"ProceduresCount": 12,
|
|
"Procedures": [
|
|
"RpcGetClientData",
|
|
"RpcGetConfigData",
|
|
"RpcGetProtocolStatus",
|
|
"RpcGetLastInputTime",
|
|
"RpcGetRemoteAddress",
|
|
"RpcShadow",
|
|
"RpcShadowTarget",
|
|
"RpcShadowStop",
|
|
"RpcGetAllListeners",
|
|
"RpcGetSessionProtocolLastInputTime",
|
|
"RpcGetUserCertificates",
|
|
"RpcQuerySessionData"
|
|
],
|
|
"ProcStackSize": 80,
|
|
"DispatchFunction": 140708118828576,
|
|
"Service": "TermService",
|
|
"IsServiceRunning": true
|
|
},
|
|
"c100beac-d33a-4a4b-bf23-bbef4663d017": {
|
|
"Module": "wcncsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\wcncsvc.dll",
|
|
"InterfaceId": "c100beac-d33a-4a4b-bf23-bbef4663d017",
|
|
"InterfaceStructOffset": 352384,
|
|
"ProceduresCount": 4,
|
|
"Procedures": [
|
|
"WcnSinkOpenHandle",
|
|
"WcnSinkCloseHandle",
|
|
"WcnSinkDeliverMessage",
|
|
"WcnSinkAsyncGetNextAction"
|
|
],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140707580952704,
|
|
"Service": "wcncsvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"509bc7ae-77be-4ee8-b07c-0d096bb44345": {
|
|
"Module": "DispBroker.Desktop.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\DispBroker.Desktop.dll",
|
|
"InterfaceId": "509bc7ae-77be-4ee8-b07c-0d096bb44345",
|
|
"InterfaceStructOffset": 289696,
|
|
"ProceduresCount": 9,
|
|
"Procedures": [
|
|
"ColorManagementRpcServerOpenFromMonitorId",
|
|
"ColorManagementRpcServerClose",
|
|
"ColorManagementRpcServerGetDisplayActiveColorProfile",
|
|
"ColorManagementRpcServerSetDisplayColorGdiLut",
|
|
"ColorManagementRpcServerGetDisplayColorGdiLut",
|
|
"ColorManagementRpcServerSetDisplayColorLut",
|
|
"ColorManagementRpcServerGetDisplayColorLut",
|
|
"ColorManagementRpcServerSetDisplayColorMatrix",
|
|
"ColorManagementRpcServerGetDisplayColorMatrix"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140708076860416,
|
|
"Service": "DispBrokerDesktopSvc",
|
|
"IsServiceRunning": true
|
|
},
|
|
"ae33069b-a2a8-46ee-a235-ddfd339be281": {
|
|
"Module": "spoolsv.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\spoolsv.exe",
|
|
"InterfaceId": "ae33069b-a2a8-46ee-a235-ddfd339be281",
|
|
"InterfaceStructOffset": 580000,
|
|
"ProceduresCount": 2,
|
|
"Procedures": [
|
|
"IRPCRemoteObject_Create",
|
|
"IRPCRemoteObject_Delete"
|
|
],
|
|
"ProcStackSize": 8,
|
|
"DispatchFunction": 140698296505296,
|
|
"Service": "Spooler",
|
|
"IsServiceRunning": true
|
|
},
|
|
"085b0334-e454-4d91-9b8c-4134f9e793f3": {
|
|
"Module": "psmsrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\psmsrv.dll",
|
|
"InterfaceId": "085b0334-e454-4d91-9b8c-4134f9e793f3",
|
|
"InterfaceStructOffset": 168384,
|
|
"ProceduresCount": 13,
|
|
"Procedures": [
|
|
"PsmSrvOpenManagementChannel",
|
|
"PsmSrvSetApplicationState",
|
|
"PsmSrvSetApplicationPriority",
|
|
"PsmSrvReleaseCacheEntry",
|
|
"PsmSrvAcquireCachedEntries",
|
|
"PsmSrvQueryApplicationSwapState",
|
|
"PsmSrvCloseActivationChannel",
|
|
"PsmSrvSetApplicationProperties",
|
|
"PsmSrvQueryApplicationProperties",
|
|
"PsmSrvQueryApplicationResourceUsage",
|
|
"PsmSrvQueryMemoryUsage",
|
|
"PsmSrvResetMaxMemoryUsage",
|
|
"PsmSrvQuerySharedCommit"
|
|
],
|
|
"ProcStackSize": 64,
|
|
"DispatchFunction": 140708134215616,
|
|
"Service": "BrokerInfrastructure",
|
|
"IsServiceRunning": true
|
|
},
|
|
"45776b01-5956-4485-9f80-f428f7d60129": {
|
|
"Module": "dnsrslvr.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\dnsrslvr.dll",
|
|
"InterfaceId": "45776b01-5956-4485-9f80-f428f7d60129",
|
|
"InterfaceStructOffset": 249856,
|
|
"ProceduresCount": 25,
|
|
"Procedures": [
|
|
"R_ReadCache",
|
|
"R_ResolverGetConfig",
|
|
"R_ResolverFlushCache",
|
|
"R_ResolverFlushCacheEntry",
|
|
"R_ResolverQuery",
|
|
"R_DnsRegisterLocal",
|
|
"R_DnsDeRegisterLocal",
|
|
"R_DnsStartMulticastQuery",
|
|
"R_DnsGetMulticastData",
|
|
"R_DnsStopMulticastQuery",
|
|
"R_ResolverSimpleOp",
|
|
"R_DnsGetProxyInformation",
|
|
"R_DnsGetPolicyTableInfo",
|
|
"R_DnsSetConnectionPolicyInfo",
|
|
"R_DnsDeleteConnectionPolicyInfo",
|
|
"R_DnsGetSettings",
|
|
"R_DnsGetSettings",
|
|
"R_DnsSetSettings",
|
|
"R_DnsSetSettings",
|
|
"R_DnsGetInterfaceSettings",
|
|
"R_DnsGetInterfaceSettings",
|
|
"R_DnsSetInterfaceSettings",
|
|
"R_DnsSetInterfaceSettings",
|
|
"R_DnsGetAdaptersInfo",
|
|
"R_DnsSetNrptRules"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140708025509552,
|
|
"Service": "Dnscache",
|
|
"IsServiceRunning": true
|
|
},
|
|
"32507ba5-a647-4201-83a9-d3a02c0fb0f8": {
|
|
"Module": "Wex.Communication.dll",
|
|
"ModulePath": "C:\\Program Files (x86)\\Windows Kits\\10\\Testing\\Runtimes\\TAEF\\MinTe\\Wex.Communication.dll",
|
|
"InterfaceId": "32507ba5-a647-4201-83a9-d3a02c0fb0f8",
|
|
"InterfaceStructOffset": 214640,
|
|
"ProceduresCount": 4,
|
|
"Procedures": [
|
|
"RpcEntry_Initialize",
|
|
"RpcEntry_ReceiveData",
|
|
"RpcEntry_MoreData",
|
|
"RpcEntry_Close"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140707880289824,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"ba4aa15a-be94-47fb-9bfb-fef110e7efad": {
|
|
"Module": "DevQueryBroker.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\DevQueryBroker.dll",
|
|
"InterfaceId": "ba4aa15a-be94-47fb-9bfb-fef110e7efad",
|
|
"InterfaceStructOffset": 24464,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"DqbGetEvents"
|
|
],
|
|
"ProcStackSize": 80,
|
|
"DispatchFunction": 140707960198384,
|
|
"Service": "DevQueryBroker",
|
|
"IsServiceRunning": false
|
|
},
|
|
"082a3471-31b6-422a-b931-a54401960c62": {
|
|
"Module": "PsmServiceExtHost.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\PsmServiceExtHost.dll",
|
|
"InterfaceId": "082a3471-31b6-422a-b931-a54401960c62",
|
|
"InterfaceStructOffset": 570592,
|
|
"ProceduresCount": 13,
|
|
"Procedures": [
|
|
"HamRpcSrvConnectExtendedExecution",
|
|
"HamRpcSrvDisconnect",
|
|
"HamRpcSrvQueryTaskCompletionsForTerminateGraph",
|
|
"HamRpcSrvCreateExtendedExecution",
|
|
"HamRpcSrvStartExtendedExecutionAsync",
|
|
"HamRpcSrvCloseActivity",
|
|
"HamRpcSrvAddDependency",
|
|
"HamRpcSrvRemoveDependency",
|
|
"HamRpcSrvAddHostDependency",
|
|
"HamRpcSrvRemoveHostDependency",
|
|
"HamRpcSrvTerminateSelf",
|
|
"HamRpcSrvTerminateSelfOnRequiredProcessExit",
|
|
"HamRpcSrvTryEstimateRemainingQuiesceTime"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140708133527920,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"9cfeead6-6135-4fcf-831a-fd3b236023f8": {
|
|
"Module": "LsaIso.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\LsaIso.exe",
|
|
"InterfaceId": "9cfeead6-6135-4fcf-831a-fd3b236023f8",
|
|
"InterfaceStructOffset": 194400,
|
|
"ProceduresCount": 31,
|
|
"Procedures": [
|
|
"KerbIumGetClientContext",
|
|
"KerbIumEncryptPassword",
|
|
"KerbIumBuildPasswordList",
|
|
"KerbIumBuildAsReqAuthenticator",
|
|
"KerbIumVerifyServiceTicket",
|
|
"KerbIumCreateApReqAuthenticator",
|
|
"KerbIumDecryptApReply",
|
|
"KerbIumUnpackKdcReplyBody",
|
|
"KerbIumComputeTgsChecksum",
|
|
"KerbIumBuildEncryptedAuthData",
|
|
"KerbIumPackApReply",
|
|
"KerbIumHashS4UPreauth",
|
|
"KerbIumSignS4UPreauthData",
|
|
"KerbIumVerifyChecksum",
|
|
"KerbIumBuildTicketArmorKey",
|
|
"KerbIumBuildExplicitArmorKey",
|
|
"KerbIumVerifyFastArmoredTgsReply",
|
|
"KerbIumVerifyEncryptedChallengePaData",
|
|
"KerbIumBuildFastArmoredKdcRequest",
|
|
"KerbIumDecryptFastArmoredKerbError",
|
|
"KerbIumDecryptFastArmoredAsReply",
|
|
"KerbIumUpdateSharedConfiguration",
|
|
"KerbIumDecryptPacCredentials",
|
|
"KerbIumCreateECDHKeyAgreement",
|
|
"KerbIumCreateDHKeyAgreement",
|
|
"KerbIumDestroyKeyAgreement",
|
|
"KerbIumKeyAgreementGenerateNonce",
|
|
"KerbIumFinalizeKeyAgreement",
|
|
"KerbIumSignPkcsMessage",
|
|
"KerbIumConvertCredManPasswordToKerbPassword",
|
|
"KerbIumAreEncryptionKeysEqual"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140697528960176,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"f50aac00-c7f3-428e-a022-a6b71bfb9d43": {
|
|
"Module": "cryptcatsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\cryptcatsvc.dll",
|
|
"InterfaceId": "f50aac00-c7f3-428e-a022-a6b71bfb9d43",
|
|
"InterfaceStructOffset": 81920,
|
|
"ProceduresCount": 8,
|
|
"Procedures": [
|
|
"s_SSCatDBAddCatalog",
|
|
"s_SSCatDBDeleteCatalog",
|
|
"s_SSCatDBEnumCatalogs",
|
|
"s_SSCatDBPauseResumeService",
|
|
"s_SSCatDBRebuildDatabase",
|
|
"s_SSCatDBPrepareForCall",
|
|
"s_SSCatDBAddCatalog2",
|
|
"s_SSCatDBSmartlockerDefenderCheck"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140707994046912,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"25952c5d-7976-4aa1-a3cb-c35f7ae79d1b": {
|
|
"Module": "wlansvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\wlansvc.dll",
|
|
"InterfaceId": "25952c5d-7976-4aa1-a3cb-c35f7ae79d1b",
|
|
"InterfaceStructOffset": 2057984,
|
|
"ProceduresCount": 6,
|
|
"Procedures": [
|
|
"Srv_WDiagRpcInitSession",
|
|
"Srv_WDiagRpcEndSession",
|
|
"Srv_WDiagRpcQueryStatistics",
|
|
"Srv_WDiagRpcQueryConnectionContextInfo",
|
|
"Srv_WDiagRpcAutoConfigGetInterfaceInfo",
|
|
"Srv_WDiagRpcGetExtensibilityInfo"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140707603856032,
|
|
"Service": "WlanSvc",
|
|
"IsServiceRunning": true
|
|
},
|
|
"6bffd098-a112-3610-9833-46c3f87e345a": {
|
|
"Module": "wkssvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\wkssvc.dll",
|
|
"InterfaceId": "6bffd098-a112-3610-9833-46c3f87e345a",
|
|
"InterfaceStructOffset": 184688,
|
|
"ProceduresCount": 31,
|
|
"Procedures": [
|
|
"NetrWkstaGetInfo",
|
|
"NetrWkstaSetInfo",
|
|
"NetrWkstaUserEnum",
|
|
"NetrWkstaUserGetInfo",
|
|
"NetrWkstaUserSetInfo",
|
|
"NetrWkstaTransportEnum",
|
|
"NetrWkstaTransportAdd",
|
|
"NetrWkstaTransportDel",
|
|
"NetrUseAdd",
|
|
"NetrUseGetInfo",
|
|
"NetrUseDel",
|
|
"NetrUseEnum",
|
|
"I_NetrLogonDomainNameAdd",
|
|
"NetrWorkstationStatisticsGet",
|
|
"I_NetrLogonDomainNameAdd",
|
|
"I_NetrLogonDomainNameAdd",
|
|
"I_NetrLogonDomainNameAdd",
|
|
"I_NetrLogonDomainNameAdd",
|
|
"I_NetrLogonDomainNameAdd",
|
|
"I_NetrLogonDomainNameAdd",
|
|
"NetrGetJoinInformation",
|
|
"I_NetrLogonDomainNameAdd",
|
|
"NetrJoinDomain2",
|
|
"NetrUnjoinDomain2",
|
|
"NetrRenameMachineInDomain2",
|
|
"NetrValidateName2",
|
|
"NetrGetJoinableOUs2",
|
|
"NetrAddAlternateComputerName",
|
|
"NetrRemoveAlternateComputerName",
|
|
"NetrSetPrimaryComputerName",
|
|
"NetrEnumerateComputerNames"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140708036838992,
|
|
"Service": "LanmanWorkstation",
|
|
"IsServiceRunning": true
|
|
},
|
|
"5222821f-d5e2-4885-84f1-5f6185a0ec41": {
|
|
"Module": "ncbservice.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\ncbservice.dll",
|
|
"InterfaceId": "5222821f-d5e2-4885-84f1-5f6185a0ec41",
|
|
"InterfaceStructOffset": 233984,
|
|
"ProceduresCount": 2,
|
|
"Procedures": [
|
|
"RpcSrvRegisterControlChannelReset",
|
|
"RpcSrvUnregisterControlChannelReset"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140708099551856,
|
|
"Service": "NcbService",
|
|
"IsServiceRunning": true
|
|
},
|
|
"33d99c14-71e0-1487-8c43-9a8328b5ea30": {
|
|
"Module": "vmplatformca.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\vmplatformca.exe",
|
|
"InterfaceId": "33d99c14-71e0-1487-8c43-9a8328b5ea30",
|
|
"InterfaceStructOffset": 22512,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"RpcVmCaIssueCertificate"
|
|
],
|
|
"ProcStackSize": 104,
|
|
"DispatchFunction": 140696258621792,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"6770612b-b256-4b6e-891b-2ff9936755a1": {
|
|
"Module": "SmsRouterSvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\SmsRouterSvc.dll",
|
|
"InterfaceId": "6770612b-b256-4b6e-891b-2ff9936755a1",
|
|
"InterfaceStructOffset": 428336,
|
|
"ProceduresCount": 2,
|
|
"Procedures": [
|
|
"BriCreateEvent2",
|
|
"BriDeleteEvent2"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140707580796784,
|
|
"Service": "SmsRouter",
|
|
"IsServiceRunning": false
|
|
},
|
|
"e64b9aee-f372-4312-9a14-8f1502b5c8e3": {
|
|
"Module": "ipnathlp.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\ipnathlp.dll",
|
|
"InterfaceId": "e64b9aee-f372-4312-9a14-8f1502b5c8e3",
|
|
"InterfaceStructOffset": 530432,
|
|
"ProceduresCount": 16,
|
|
"Procedures": [
|
|
"IpNatHlpRpcServerGetConnectedDevices",
|
|
"IpNatHlpRpcServerStartSharing",
|
|
"IpNatHlpRpcServerStopSharing",
|
|
"IpNatHlpRpcServerStartDhcpServer",
|
|
"IpNatHlpRpcServerStopDhcpServer",
|
|
"IpNatHlpRpcServerUpdateSharingSettingsFromStorage",
|
|
"V2IpNatHlpRpcServerStartSharingByInternalPrefix",
|
|
"V2IpNatHlpRpcServerStopSharingByInternalPrefix",
|
|
"V2IpNatHlpRpcServerStartDhcpServer",
|
|
"V2IpNatHlpRpcServerStopDhcpServer",
|
|
"V2IpNatHlpRpcServerStartDnsServer",
|
|
"V2IpNatHlpRpcServerStopDnsServer",
|
|
"V2IpNatHlpRpcServerEnumDhcpState",
|
|
"V2IpNatHlpRpcServerEnumDnsState",
|
|
"V2IpNatHlpRpcServerCreateStaticMapping",
|
|
"V2IpNatHlpRpcServerDeleteStaticMapping"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140707971615808,
|
|
"Service": "SharedAccess",
|
|
"IsServiceRunning": true
|
|
},
|
|
"9ccb59aa-1358-4169-aebb-ed83357d6304": {
|
|
"Module": "edgehtml.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\edgehtml.dll",
|
|
"InterfaceId": "9ccb59aa-1358-4169-aebb-ed83357d6304",
|
|
"InterfaceStructOffset": 21370720,
|
|
"ProceduresCount": 173,
|
|
"Procedures": [
|
|
"ControlToEdgeServerIOleHostConnect",
|
|
"ControlToEdgeServerIOleHostDisconnect",
|
|
"ControlToEdgeServerIOleHostConnectUiThread",
|
|
"ControlToEdgeServerIOleHostDisconnectUiThread",
|
|
"ControlToEdgeServerIOleHostHandleGetWindowContext",
|
|
"ControlToEdgeServerIOleHostHandleGetMoniker",
|
|
"ControlToEdgeServerIOleHostHandleQueryServiceForWebBrowserObject",
|
|
"ControlToEdgeServerIOleHostClientAddRef",
|
|
"ControlToEdgeServerIOleHostClientRelease",
|
|
"ControlToEdgeServerIOleHostQueryServiceForWindowObject",
|
|
"ControlToEdgeServerDisconnectIDataObject",
|
|
"ControlToEdgeServerIDispatchGetDispatchHandleForParam",
|
|
"ControlToEdgeServerIDispatchInvokeWithHandle",
|
|
"ControlToEdgeServerIDispatchInvokeRequestHandle",
|
|
"ControlToEdgeServerIDispatchExGetDispID",
|
|
"ControlToEdgeServerIDispatchExDeleteMemberByName",
|
|
"ControlToEdgeServerIRemoteSurfacePresenterFrontBufferDisconnect",
|
|
"ControlToEdgeServerIFlashShimHandlerCreateIconFromBuffer",
|
|
"ControlToEdgeServerIFlashShimHandlerDestroyIcon",
|
|
"ControlToEdgeServerIFlashShimHandlerSetCursorById",
|
|
"ControlToEdgeServerIFlashShimHandlerSetCursorPos",
|
|
"ControlToEdgeServerIFlashShimHandlerGetPointerFrameInfoHistorySize",
|
|
"ControlToEdgeServerIFlashShimHandlerGetPointerFrameInfoHistory",
|
|
"ControlToEdgeServerIFlashShimHandlerGetPointerInfo",
|
|
"ControlToEdgeServerIFlashShimHandlerGetPointerFrameTouchInfo",
|
|
"ControlToEdgeServerIFlashShimHandlerGetCurrentInputMessageSource",
|
|
"ControlToEdgeServerIFlashShimHandlerImmGetContext",
|
|
"ControlToEdgeServerIFlashShimHandlerGetKeyboardLayout",
|
|
"ControlToEdgeServerIFlashShimHandlerActivateKeyboardLayout",
|
|
"ControlToEdgeServerIFlashShimHandlerOleGetClipboard",
|
|
"ControlToEdgeServerIFlashShimHandlerOleSetClipboard",
|
|
"ControlToEdgeServerIWebBrowser2HandleQueryServiceForTargetFrameObject",
|
|
"ControlToEdgeServerIWebBrowser2GetDocument",
|
|
"ControlToEdgeServerDisconnectIDataObject",
|
|
"ControlToEdgeServerITargetFrame2FindFrame",
|
|
"ControlToEdgeServerDisconnectIDataObject",
|
|
"ControlToEdgeServerDisconnectIDataObject",
|
|
"ControlToEdgeServerIHTMLDocument2get_Script",
|
|
"ControlToEdgeServerIHTMLDocument2get_parentWindow",
|
|
"ControlToEdgeServerDisconnectIDataObject",
|
|
"ControlToEdgeServerIHTMLWindow2get_parent",
|
|
"ControlToEdgeServerIHTMLWindow2get_document",
|
|
"ControlToEdgeServerIHTMLWindow2get_top",
|
|
"ControlToEdgeServerIHTMLWindow2get_location",
|
|
"ControlToEdgeServerIHTMLWindow2ExecuteEvalScriptWithResultWrapper",
|
|
"ControlToEdgeServerIHTMLWindow2get_userAgent",
|
|
"ControlToEdgeServerDisconnectIDataObject",
|
|
"ControlToEdgeServerIActiveXUIHandlerSiteHandleSaveFilePickerAndGetResult",
|
|
"ControlToEdgeServerIOleHostHandleChainPlayToSources",
|
|
"ControlToEdgeServerDisconnectIDataObject",
|
|
"ControlToEdgeServerIEnumFORMATETCNext",
|
|
"ControlToEdgeServerDisconnectIDataObject",
|
|
"ControlToEdgeServerIDataObjectGetData",
|
|
"ControlToEdgeServerIDataObjectEnumFormatEtc",
|
|
"ControlToEdgeServerIHGlobalHolderGetGlobalData",
|
|
"ControlToEdgeServerDisconnectIHGlobalHolder",
|
|
"ControlToEdgeServerCallBlockTabForDialogUntilActive",
|
|
"ControlToEdgeServerIOleHostHandleDeactivateAndUndo",
|
|
"ControlToEdgeServerIOleHostHandleDiscardUndoState",
|
|
"ControlToEdgeServerIOleHostHandleOnInPlaceActivateEx",
|
|
"ControlToEdgeServerIOleHostHandleOnInPlaceDeactivateEx",
|
|
"ControlToEdgeServerIOleHostHandleOnInPlaceDeactivate",
|
|
"ControlToEdgeServerIOleHostHandleOnUIActivate",
|
|
"ControlToEdgeServerIOleHostHandleOnUIDeactivate",
|
|
"ControlToEdgeServerIOleHostHandleRequestUIActivate",
|
|
"ControlToEdgeServerIOleHostHandleCanWindowlessActivate",
|
|
"ControlToEdgeServerIOleHostHandleGetCapture",
|
|
"ControlToEdgeServerIOleHostHandleSetCapture",
|
|
"ControlToEdgeServerIOleHostHandleGetFocus",
|
|
"ControlToEdgeServerIOleHostHandleSetFocus",
|
|
"ControlToEdgeServerIOleHostHandleInvalidateRect",
|
|
"ControlToEdgeServerIOleHostHandleIsHardwareComposition",
|
|
"ControlToEdgeServerIOleHostHandleRequestFrame",
|
|
"ControlToEdgeServerIOleHostGetSurfacePresenterFlipMode",
|
|
"ControlToEdgeServerIOleHostHandleCreateIndependentSurfacePresenterFlip",
|
|
"ControlToEdgeServerIOleHostHandleCreateDependentSurfacePresenterFlip",
|
|
"ControlToEdgeServerIOleHostHandleGetDeviceLuid",
|
|
"ControlToEdgeServerIOleHostHandleEnterFullScreen",
|
|
"ControlToEdgeServerIOleHostHandleExitFullScreen",
|
|
"ControlToEdgeServerIOleHostHandleIsFullScreen",
|
|
"ControlToEdgeServerIOleHostHandleGetMetrics",
|
|
"ControlToEdgeServerIOleHostHandleGetFullScreenSize",
|
|
"ControlToEdgeServerIOleHostHandleGetRotationForCurrentOutput",
|
|
"ControlToEdgeServerIOleHostHandleLockInPlaceActive",
|
|
"ControlToEdgeServerIOleHostHandleGetExtendedControl",
|
|
"ControlToEdgeServerIOleHostHandleTranslateAccelerator",
|
|
"ControlToEdgeServerIOleHostHandleShowPropertyFrame",
|
|
"ControlToEdgeServerIOleHostPopulatePersistPropertyBag",
|
|
"ControlToEdgeServerIOleHostHandleAcquireObjectIdRange",
|
|
"ControlToEdgeServerIOleHostHandleReleaseObjectIdRange",
|
|
"ControlToEdgeServerIOleHostHandleGetWindow",
|
|
"ControlToEdgeServerIOleHostHandleOnDataChange",
|
|
"ControlToEdgeServerIOleHostHandleOnViewChange",
|
|
"ControlToEdgeServerIOleHostHandleViewStatusChange",
|
|
"ControlToEdgeServerIOleHostHandleShowObject",
|
|
"ControlToEdgeServerIOleHostHandleOnShowWindow",
|
|
"ControlToEdgeServerIOleHostHandleRequestNewObjectLayout",
|
|
"ControlToEdgeServerIOleHostHandleValidateSecureUrl",
|
|
"ControlToEdgeServerIOleHostHandleEventNotify",
|
|
"ControlToEdgeServerIOleHostGetPlayToObjectStateIsMuted",
|
|
"ControlToEdgeServerIOleHostHandleAddSuspensionExemption",
|
|
"ControlToEdgeServerIOleHostHandleRemoveSuspensionExemption",
|
|
"ControlToEdgeServerIOleHostHandleMessageBoxW",
|
|
"ControlToEdgeServerIOleHostHandleSetManipulationMode",
|
|
"ControlToEdgeServerIOleHostHandleZoomToPoint",
|
|
"ControlToEdgeServerIOleHostHandleOnMediaActivityStarted",
|
|
"ControlToEdgeServerIOleHostHandleOnMediaActivityStopped",
|
|
"ControlToEdgeServerIOleHostHandleGetAudioSessionGuid",
|
|
"ControlToEdgeServerIOleHostHandleOnAudioStreamCreated",
|
|
"ControlToEdgeServerIOleHostHandleOnAudioStreamDestroyed",
|
|
"ControlToEdgeServerIOleHostHandleGetOpticalZoomPercent",
|
|
"ControlToEdgeServerIOleHostHandleITridentHostWindowInfoSiteGetWindowRect",
|
|
"ControlToEdgeServerIOleHostHandleITridentHostWindowInfoSiteGetClientRect",
|
|
"ControlToEdgeServerIOleHostHandleITridentHostWindowInfoSiteScreenToClient",
|
|
"ControlToEdgeServerIOleHostHandleITridentHostWindowInfoSiteClientToScreen",
|
|
"ControlToEdgeServerIOleHostHandleITridentHostWindowInfoSiteMapWindowPoints",
|
|
"ControlToEdgeServerIOleHostHandleITridentHostWindowInfoSiteWindowFromPoint",
|
|
"ControlToEdgeServerIOleHostHandleITridentHostWindowInfoSiteGetFocus",
|
|
"ControlToEdgeServerIOleHostHandleITridentHostWindowInfoSiteSetFocus",
|
|
"ControlToEdgeServerIOleHostHandleImmGetContext",
|
|
"ControlToEdgeServerIOleHostHandleImmReleaseContext",
|
|
"ControlToEdgeServerIOleHostHandleImmAssociateContextEx",
|
|
"ControlToEdgeServerIOleHostGetUrlForCreateMoniker",
|
|
"ControlToEdgeServerIOleHostHandleIsClientRectTopMost",
|
|
"ControlToEdgeServerIOleHostHandleOnChanged",
|
|
"ControlToEdgeServerIOleHostHandleFireRequestEdit",
|
|
"ControlToEdgeServerIOleHostHandleReportOutOfMemoryShutdown",
|
|
"ControlToEdgeServerIOleHostGetAmbientProp",
|
|
"ControlToEdgeServerIOleHostCallFocus",
|
|
"ControlToEdgeServerIOleHostGetObjectIDHelper",
|
|
"ControlToEdgeServerIOleHostHandleSetBorderSpace",
|
|
"ControlToEdgeServerIOleHostHandleSetActiveObject",
|
|
"ControlToEdgeServerIOleHostGetObjectIdRangesCount",
|
|
"ControlToEdgeServerIOleHostGetObjectIdRanges",
|
|
"ControlToEdgeServerIOleHostConnectCrossProcessWindows",
|
|
"ControlToEdgeServerIOleHostHandleAllowSetForegroundWindow",
|
|
"ControlToEdgeServerIDispatchGetTypeInfoCount",
|
|
"ControlToEdgeServerIDispatchGetTypeInfo",
|
|
"ControlToEdgeServerIDispatchGetIDsOfNames",
|
|
"ControlToEdgeServerIDispatchInvoke",
|
|
"ControlToEdgeServerIRemoteSurfacePresenterFrontBufferPresentBackBuffer",
|
|
"ControlToEdgeServerIFlashShimHandlerGetKeyState",
|
|
"ControlToEdgeServerIFlashShimHandlerShowJSONContextMenu",
|
|
"ControlToEdgeServerIFlashShimHandlerGetQueueStatus",
|
|
"ControlToEdgeServerIFlashShimHandlerImmReleaseContext",
|
|
"ControlToEdgeServerIFlashShimHandlerImmSetCompositionWindow",
|
|
"ControlToEdgeServerIFlashShimHandlerImmSetCompositionFontW",
|
|
"ControlToEdgeServerIFlashShimHandlerImmGetCompositionFontW",
|
|
"ControlToEdgeServerIFlashShimHandlerImmGetCompositionStringW",
|
|
"ControlToEdgeServerIFlashShimHandlerImmSetCompositionStringW",
|
|
"ControlToEdgeServerIFlashShimHandlerImmSetCandidateWindow",
|
|
"ControlToEdgeServerIFlashShimHandlerImmGetOpenStatus",
|
|
"ControlToEdgeServerIFlashShimHandlerImmSetOpenStatus",
|
|
"ControlToEdgeServerIFlashShimHandlerImmNotifyIME",
|
|
"ControlToEdgeServerIFlashShimHandlerImmAssociateContextEx",
|
|
"ControlToEdgeServerIFlashShimHandlerImmGetConversionStatus",
|
|
"ControlToEdgeServerIFlashShimHandlerImmSetConversionStatus",
|
|
"ControlToEdgeServerIFlashShimHandlerImmIsIME",
|
|
"ControlToEdgeServerIFlashShimHandlerImmGetProperty",
|
|
"ControlToEdgeServerIFlashShimHandlerDefWindowProcW",
|
|
"ControlToEdgeServerIFlashShimHandlerSendMessageW",
|
|
"ControlToEdgeServerIFlashShimHandlerSendMessageTimeoutW",
|
|
"ControlToEdgeServerIWebBrowser2Navigate",
|
|
"ControlToEdgeServerIOleHostHandleGetFullScreenSize",
|
|
"ControlToEdgeServerIHTMLLocationput_href",
|
|
"ControlToEdgeServerIHTMLLocationget_href",
|
|
"ControlToEdgeServerIHTMLLocationget_hash",
|
|
"ControlToEdgeServerIHTMLDocument2put_title",
|
|
"ControlToEdgeServerIHTMLDocument2get_title",
|
|
"ControlToEdgeServerIHTMLDocument2get_referrer",
|
|
"ControlToEdgeServerIHTMLDocument2get_URL",
|
|
"ControlToEdgeServerIEnumFORMATETCReset",
|
|
"ControlToEdgeServerIEnumFORMATETCSkip"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140707340390160,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"b58aa02e-2884-4e97-8176-4ee06d794184": {
|
|
"Module": "sysmain.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\sysmain.dll",
|
|
"InterfaceId": "b58aa02e-2884-4e97-8176-4ee06d794184",
|
|
"InterfaceStructOffset": 816288,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"PfRpcServerExecuteCommand"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140708066601600,
|
|
"Service": "SysMain",
|
|
"IsServiceRunning": true
|
|
},
|
|
"eef58ec9-6367-47f8-b7f2-b272e4032af9": {
|
|
"Module": "hvsimgr.exe",
|
|
"ModulePath": "C:\\Windows\\WinSxS\\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.18362.1832_none_158049e1d563edb9\\hvsimgr.exe",
|
|
"InterfaceId": "eef58ec9-6367-47f8-b7f2-b272e4032af9",
|
|
"InterfaceStructOffset": 403680,
|
|
"ProceduresCount": 11,
|
|
"Procedures": [
|
|
"s_ProxyTaskBarMessage",
|
|
"s_ProxyTaskBarMessage",
|
|
"s_ProxyTaskBarMessage",
|
|
"s_ProxyTaskBarMessage",
|
|
"s_ProxyTaskBarMessage",
|
|
"s_ProxyTaskBarMessage",
|
|
"s_ProxyTaskBarMessage",
|
|
"s_ProxyTaskBarMessage",
|
|
"s_ProxyTaskBarMessage",
|
|
"s_ProxyTaskBarMessage",
|
|
"s_ProxyTaskBarMessage"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140697792740080,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"497d95a6-2d27-4bf5-9bbd-a6046957133c": {
|
|
"Module": "termsrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\termsrv.dll",
|
|
"InterfaceId": "497d95a6-2d27-4bf5-9bbd-a6046957133c",
|
|
"InterfaceStructOffset": 749904,
|
|
"ProceduresCount": 5,
|
|
"Procedures": [
|
|
"RpcOpenListener",
|
|
"RpcCloseListener",
|
|
"RpcStopListener",
|
|
"RpcStartListener",
|
|
"RpcIsListening"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140708118767520,
|
|
"Service": "TermService",
|
|
"IsServiceRunning": true
|
|
},
|
|
"7419cf08-91a7-4afd-8f5e-1dd76de094fd": {
|
|
"Module": "dab.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\dab.dll",
|
|
"InterfaceId": "7419cf08-91a7-4afd-8f5e-1dd76de094fd",
|
|
"InterfaceStructOffset": 81920,
|
|
"ProceduresCount": 3,
|
|
"Procedures": [
|
|
"s_DabRpcRegisterTriggerConsumer",
|
|
"s_DabRpcUnregisterTriggerConsumer",
|
|
"s_DabRpcGetLastScheduledRunTime"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140708125807648,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"b37f900a-eae4-4304-a2ab-12bb668c0188": {
|
|
"Module": "wcmsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\wcmsvc.dll",
|
|
"InterfaceId": "b37f900a-eae4-4304-a2ab-12bb668c0188",
|
|
"InterfaceStructOffset": 768464,
|
|
"ProceduresCount": 12,
|
|
"Procedures": [
|
|
"RpcRegisterForNotifications",
|
|
"RpcGetPendingNotification",
|
|
"RpcCloseNotificationsHandle",
|
|
"RpcAcquireSelectableConnectionAsync",
|
|
"RpcReleaseSelectableConnection",
|
|
"RpcGetSelectableConnectionList",
|
|
"RpcGetInterfaceContextTable",
|
|
"RpcAddRoutePolicy",
|
|
"RpcRemoveRoutePolicy",
|
|
"RpcRemoveMatchingRoutePolicy",
|
|
"RpcGetRoutingHint",
|
|
"RpcCheckCapabilityStatus"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140708018990976,
|
|
"Service": "Wcmsvc",
|
|
"IsServiceRunning": true
|
|
},
|
|
"d9844ed9-f72a-4745-a4a1-ee71f950781d": {
|
|
"Module": "ngcsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\ngcsvc.dll",
|
|
"InterfaceId": "d9844ed9-f72a-4745-a4a1-ee71f950781d",
|
|
"InterfaceStructOffset": 630032,
|
|
"ProceduresCount": 2,
|
|
"Procedures": [
|
|
"s_NgcMgmtEnumContainers",
|
|
"s_NgcMgmtIsAnyContainerInVsm"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140707093723280,
|
|
"Service": "NgcSvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"1257b580-ce2f-4109-82d6-a9459d0bf6bc": {
|
|
"Module": "SessEnv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\SessEnv.dll",
|
|
"InterfaceId": "1257b580-ce2f-4109-82d6-a9459d0bf6bc",
|
|
"InterfaceStructOffset": 333952,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"RpcShadow2"
|
|
],
|
|
"ProcStackSize": 64,
|
|
"DispatchFunction": 140708025010752,
|
|
"Service": "SessionEnv",
|
|
"IsServiceRunning": true
|
|
},
|
|
"1377d115-98fd-4034-b574-111156ca239c": {
|
|
"Module": "SystemEventsBrokerServer.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\SystemEventsBrokerServer.dll",
|
|
"InterfaceId": "1377d115-98fd-4034-b574-111156ca239c",
|
|
"InterfaceStructOffset": 154064,
|
|
"ProceduresCount": 3,
|
|
"Procedures": [
|
|
"_CSebiRegisterPublisher",
|
|
"CSebiPublisherUpdateLevelEvent",
|
|
"CSebiUnregisterPublisher"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140708127099312,
|
|
"Service": "SystemEventsBroker",
|
|
"IsServiceRunning": true
|
|
},
|
|
"2f59a331-bf7d-48cb-9e5c-7c090d76e8b8": {
|
|
"Module": "termsrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\termsrv.dll",
|
|
"InterfaceId": "2f59a331-bf7d-48cb-9e5c-7c090d76e8b8",
|
|
"InterfaceStructOffset": 767792,
|
|
"ProceduresCount": 13,
|
|
"Procedures": [
|
|
"RpcLicensingOpenServer",
|
|
"RpcLicensingCloseServer",
|
|
"RpcLicensingLoadPolicy",
|
|
"RpcLicensingLoadPolicy",
|
|
"RpcLicensingSetPolicy",
|
|
"RpcLicensingGetAvailablePolicyIds",
|
|
"RpcLicensingGetPolicy",
|
|
"RpcLicensingGetPolicyInformation",
|
|
"RpcLicensingDeactivateCurrentPolicy",
|
|
"RpcLicensingServerPing",
|
|
"RpcGetSessionUnderArbitration",
|
|
"RpcLicensingSetAadInfo",
|
|
"RpcLicensingGetAadInfo"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140708119277488,
|
|
"Service": "TermService",
|
|
"IsServiceRunning": true
|
|
},
|
|
"52d9f704-d3c6-4748-ad11-2550209e80af": {
|
|
"Module": "IMEPADSM.DLL",
|
|
"ModulePath": "C:\\Windows\\System32\\IME\\SHARED\\IMEPADSM.DLL",
|
|
"InterfaceId": "52d9f704-d3c6-4748-ad11-2550209e80af",
|
|
"InterfaceStructOffset": 79888,
|
|
"ProceduresCount": 4,
|
|
"Procedures": [
|
|
"s_OpenContext",
|
|
"s_CloseContext",
|
|
"s_PingServerFromClient",
|
|
"s_ToServerFromClient"
|
|
],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140707880930496,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"ff9fd3c4-742e-45e0-91dd-2f5bc632a1df": {
|
|
"Module": "AppXDeploymentServer.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\AppXDeploymentServer.dll",
|
|
"InterfaceId": "ff9fd3c4-742e-45e0-91dd-2f5bc632a1df",
|
|
"InterfaceStructOffset": 2613024,
|
|
"ProceduresCount": 3,
|
|
"Procedures": [
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder",
|
|
"AppXApplyTrustLabelToFolder"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140706734131232,
|
|
"Service": "AppXSvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"39730ec4-82ea-4fdf-8a45-c408e393e212": {
|
|
"Module": "LsaIso.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\LsaIso.exe",
|
|
"InterfaceId": "39730ec4-82ea-4fdf-8a45-c408e393e212",
|
|
"InterfaceStructOffset": 184224,
|
|
"ProceduresCount": 2,
|
|
"Procedures": [
|
|
"CredManIumProtectCredential",
|
|
"CredManIumCheckProtectedCredential"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140697528904608,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"64fe0b7f-9ef5-4553-a7db-9a1975777554": {
|
|
"Module": "RpcRtRemote.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\RpcRtRemote.dll",
|
|
"InterfaceId": "64fe0b7f-9ef5-4553-a7db-9a1975777554",
|
|
"InterfaceStructOffset": 36912,
|
|
"ProceduresCount": 3,
|
|
"Procedures": [
|
|
"FwConnectToManager",
|
|
"FwSubscribeForNewRulesNotification",
|
|
"FwInterfaceRegistered"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140708134351008,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"c7ce3826-891f-4376-b161-c63d2403142c": {
|
|
"Module": "audiosrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\audiosrv.dll",
|
|
"InterfaceId": "c7ce3826-891f-4376-b161-c63d2403142c",
|
|
"InterfaceStructOffset": 1381024,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"s_RequestHrtfData"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140708026150320,
|
|
"Service": "Audiosrv",
|
|
"IsServiceRunning": true
|
|
},
|
|
"8f09f000-b7ed-11ce-bbd2-00001a181cad": {
|
|
"Module": "mprdim.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\mprdim.dll",
|
|
"InterfaceId": "8f09f000-b7ed-11ce-bbd2-00001a181cad",
|
|
"InterfaceStructOffset": 360624,
|
|
"ProceduresCount": 72,
|
|
"Procedures": [
|
|
"RMprAdminServerGetInfo",
|
|
"RRasAdminConnectionEnum",
|
|
"RRasAdminConnectionGetInfo",
|
|
"RRasAdminConnectionClearStats",
|
|
"RRasAdminPortEnum",
|
|
"RRasAdminPortGetInfo",
|
|
"RRasAdminPortClearStats",
|
|
"RRasAdminPortReset",
|
|
"RRasAdminPortDisconnect",
|
|
"RRouterInterfaceTransportSetGlobalInfo",
|
|
"RRouterInterfaceTransportGetGlobalInfo",
|
|
"RRouterInterfaceGetHandle",
|
|
"RRouterInterfaceCreate",
|
|
"RRouterInterfaceGetInfo",
|
|
"RRouterInterfaceSetInfo",
|
|
"RRouterInterfaceDelete",
|
|
"RRouterInterfaceTransportRemove",
|
|
"RRouterInterfaceTransportAdd",
|
|
"RRouterInterfaceTransportGetInfo",
|
|
"RRouterInterfaceTransportSetInfo",
|
|
"RRouterInterfaceEnum",
|
|
"RRouterInterfaceConnect",
|
|
"RRouterInterfaceDisconnect",
|
|
"RRouterInterfaceUpdateRoutes",
|
|
"RRouterInterfaceQueryUpdateResult",
|
|
"RRouterInterfaceUpdatePhonebookInfo",
|
|
"RMIBEntryCreate",
|
|
"RMIBEntryDelete",
|
|
"RMIBEntrySet",
|
|
"RMIBEntryGet",
|
|
"RMIBEntryGetFirst",
|
|
"RMIBEntryGetNext",
|
|
"RMIBGetTrapInfo",
|
|
"RMIBSetTrapInfo",
|
|
"RRasAdminConnectionNotification",
|
|
"RRasAdminSendUserMessage",
|
|
"RRouterDeviceEnum",
|
|
"RRouterInterfaceTransportCreate",
|
|
"RRouterInterfaceDeviceGetInfo",
|
|
"RRouterInterfaceDeviceSetInfo",
|
|
"RRouterInterfaceSetCredentialsEx",
|
|
"RRouterInterfaceGetCredentialsEx",
|
|
"RRasAdminConnectionRemoveQuarantine",
|
|
"RMprAdminServerSetInfo",
|
|
"RMprAdminServerGetInfoEx",
|
|
"RRasAdminConnectionEnumEx",
|
|
"RRasAdminConnectionGetInfoEx",
|
|
"RMprAdminServerSetInfoEx",
|
|
"RRasAdminUpdateConnection",
|
|
"RRouterInterfaceSetCredentialsLocal",
|
|
"RRouterInterfaceGetCredentialsLocal",
|
|
"RRouterInterfaceGetCustomInfoEx",
|
|
"RRouterInterfaceSetCustomInfoEx",
|
|
"RRouterAdminIsMultiTenancyEnabled",
|
|
"RRouterAdminGetRoutingDomainId",
|
|
"RRouterAdminInterfaceEnumEx",
|
|
"RRouterAdminInterfaceCreateEx",
|
|
"RRouterAdminInterfaceGetInfoEx",
|
|
"RRouterAdminInterfaceSetInfoEx",
|
|
"RRouterAdminInterfaceGetStatisticsEx",
|
|
"RRouterAdminInterfaceClearStatisticsEx",
|
|
"RRouterMarkServerOffline",
|
|
"RRouterAdminRoutingDomainsEnumEx",
|
|
"RRouterAdminRoutingDomainGetConfigEx",
|
|
"RRouterAdminRoutingDomainSetConfigEx",
|
|
"RRouterAdminAddRoutingDomainEx",
|
|
"RRouterAdminDeleteRoutingDomainEx",
|
|
"RRasAdminRoutingDomainConnectionEnumEx",
|
|
"RRouterProtocolAction",
|
|
"RRouterGetProtocolStatistics",
|
|
"RRouterAdminIsModernStackEnabled",
|
|
"RRouterInterfaceAddIkev2Policy"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140707580693408,
|
|
"Service": "RemoteAccess",
|
|
"IsServiceRunning": false
|
|
},
|
|
"795b6bf9-97b6-4f89-bd8d-2f42bbbe996e": {
|
|
"Module": "DMPushRouterCore.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\DMPushRouterCore.dll",
|
|
"InterfaceId": "795b6bf9-97b6-4f89-bd8d-2f42bbbe996e",
|
|
"InterfaceStructOffset": 152784,
|
|
"ProceduresCount": 4,
|
|
"Procedures": [
|
|
"RpcPushRouter_Open",
|
|
"RpcPushRouter_Close",
|
|
"RpcPushRouter_GetPushMessage",
|
|
"RpcPushRouter_SubmitPush"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140707581018112,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"fae436b0-b864-4a87-9eda-298547cd82f2": {
|
|
"Module": "PsmServiceExtHost.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\PsmServiceExtHost.dll",
|
|
"InterfaceId": "fae436b0-b864-4a87-9eda-298547cd82f2",
|
|
"InterfaceStructOffset": 572064,
|
|
"ProceduresCount": 8,
|
|
"Procedures": [
|
|
"HamRpcSrvConnectDebugging",
|
|
"HamRpcSrvDisconnect",
|
|
"HamRpcSrvDebugOpenPackageHandle",
|
|
"HamRpcSrvDebugClosePackageHandle",
|
|
"HamRpcSrvDebugModeEnable",
|
|
"HamRpcSrvDebugTerminatePackage",
|
|
"HamRpcSrvDebugQueryPackageState",
|
|
"HamRpcSrvDebugSuspendPackage"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140708133773216,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"378e52b0-c0a9-11cf-822d-00aa0051e40f": {
|
|
"Module": "taskcomp.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\taskcomp.dll",
|
|
"InterfaceId": "378e52b0-c0a9-11cf-822d-00aa0051e40f",
|
|
"InterfaceStructOffset": 294256,
|
|
"ProceduresCount": 4,
|
|
"Procedures": [
|
|
"SASetAccountInformation",
|
|
"SASetNSAccountInformation",
|
|
"SAGetNSAccountInformation",
|
|
"SAGetAccountInformation"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140708043119952,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"eb081a0d-10ee-478a-a1dd-50995283e7a8": {
|
|
"Module": "wkssvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\wkssvc.dll",
|
|
"InterfaceId": "eb081a0d-10ee-478a-a1dd-50995283e7a8",
|
|
"InterfaceStructOffset": 195120,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"GetWitnessNodes"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140708036939680,
|
|
"Service": "LanmanWorkstation",
|
|
"IsServiceRunning": true
|
|
},
|
|
"2e7d4935-59d2-4312-a2c8-41900aa5495f": {
|
|
"Module": "das.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\das.dll",
|
|
"InterfaceId": "2e7d4935-59d2-4312-a2c8-41900aa5495f",
|
|
"InterfaceStructOffset": 368832,
|
|
"ProceduresCount": 3,
|
|
"Procedures": [
|
|
"DasCreateChallengeContext",
|
|
"DasStartChallengeDevicePresence",
|
|
"DasCloseChallengeContext"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140707580857088,
|
|
"Service": "DeviceAssociationService",
|
|
"IsServiceRunning": false
|
|
},
|
|
"697dcda9-3ba9-4eb2-9247-e11f1901b0d2": {
|
|
"Module": "SystemEventsBrokerServer.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\SystemEventsBrokerServer.dll",
|
|
"InterfaceId": "697dcda9-3ba9-4eb2-9247-e11f1901b0d2",
|
|
"InterfaceStructOffset": 156032,
|
|
"ProceduresCount": 6,
|
|
"Procedures": [
|
|
"CSebiCreateWellKnownEvent",
|
|
"_CSebiCreatePrivateEvent",
|
|
"_CSebiDeleteEvent",
|
|
"CSebiEnumerateEvents",
|
|
"CSebiQueryEventData",
|
|
"CSebiCreateCustomEvent"
|
|
],
|
|
"ProcStackSize": 64,
|
|
"DispatchFunction": 140708127169888,
|
|
"Service": "SystemEventsBroker",
|
|
"IsServiceRunning": true
|
|
},
|
|
"0d72a7d4-6148-11d1-b4aa-00c04fb66ea0": {
|
|
"Module": "cryptsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\cryptsvc.dll",
|
|
"InterfaceId": "0d72a7d4-6148-11d1-b4aa-00c04fb66ea0",
|
|
"InterfaceStructOffset": 69632,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"s_SSCertProtectFunction"
|
|
],
|
|
"ProcStackSize": 72,
|
|
"DispatchFunction": 140707994358480,
|
|
"Service": "CryptSvc",
|
|
"IsServiceRunning": true
|
|
},
|
|
"2513bcbe-6cd4-4348-855e-7efb3c336dd3": {
|
|
"Module": "bisrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\bisrv.dll",
|
|
"InterfaceId": "2513bcbe-6cd4-4348-855e-7efb3c336dd3",
|
|
"InterfaceStructOffset": 552256,
|
|
"ProceduresCount": 5,
|
|
"Procedures": [
|
|
"SrvOdbCreateSession",
|
|
"SrvOdbCompleteSession",
|
|
"SrvOdbLaunchBackgroundTask",
|
|
"SrvOdbCancelBackgroundTask",
|
|
"SrvOdbCancelBackgroundTasksForPackage"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140708131134752,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"c604b99f-725f-43d8-a6b8-185086c09c9c": {
|
|
"Module": "WpAXHolder.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\WpAXHolder.dll",
|
|
"InterfaceId": "c604b99f-725f-43d8-a6b8-185086c09c9c",
|
|
"InterfaceStructOffset": 297248,
|
|
"ProceduresCount": 123,
|
|
"Procedures": [
|
|
"EdgeToControlServerIOleControlWrapperConnect",
|
|
"EdgeToControlServerIOleControlWrapperDisconnect",
|
|
"EdgeToControlServerIOleControlWrapperConnectUiThread",
|
|
"EdgeToControlServerIOleControlWrapperDisconnectUiThread",
|
|
"EdgeToControlServerIOleControlWrapperHandleNextThreadMessage",
|
|
"EdgeToControlServerIOleControlWrapperShutdown",
|
|
"EdgeToControlServerIOleControlWrapperCallPersistPropertyBagLoad",
|
|
"EdgeToControlServerIOleControlWrapperGetControlReference",
|
|
"EdgeToControlServerIOleControlWrapperCallPersistPropertyBagSave",
|
|
"EdgeToControlServerIOleControlWrapperCallIMERequestReconvertString",
|
|
"EdgeToControlServerIOleControlWrapperCallIMERequestQueryCharPosition",
|
|
"EdgeToControlServerDisconnectIPlayToSource",
|
|
"EdgeToControlServerIOleControlWrapperGetPlayToSource",
|
|
"EdgeToControlServerIPlayToSourceput_Next",
|
|
"EdgeToControlServerIPlayToSourcePlayNext",
|
|
"EdgeToControlServerGetChainPlayToSources",
|
|
"EdgeToControlServerDisconnectIDataObject",
|
|
"EdgeToControlServerGetSupportedMediaTypes",
|
|
"EdgeToControlServerEnsureIEdgeOutOfProcessCastingHelper",
|
|
"EdgeToControlServerDisconnectIDataObject",
|
|
"EdgeToControlServerDisconnectIDataObject",
|
|
"EdgeToControlServerIDispatchGetDispatchHandleForParam",
|
|
"EdgeToControlServerIDispatchInvokeWithHandle",
|
|
"EdgeToControlServerIDispatchInvokeRequestHandle",
|
|
"EdgeToControlServerIDispatchExGetDispID",
|
|
"EdgeToControlServerIDispatchExDeleteMemberByName",
|
|
"EdgeToControlServerDisconnectIDataObject",
|
|
"EdgeToControlServerIDataObjectGetData",
|
|
"EdgeToControlServerIDataObjectQueryGetData",
|
|
"EdgeToControlServerIDataObjectEnumFormatEtc",
|
|
"EdgeToControlServerDisconnectIDataObject",
|
|
"EdgeToControlServerIEnumFORMATETCNext",
|
|
"EdgeToControlServerGetDataObject",
|
|
"EdgeToControlServerIHGlobalHolderGetGlobalData",
|
|
"EdgeToControlServerDisconnectIHGlobalHolder",
|
|
"EdgeToControlServerDisconnectIDataObject",
|
|
"EdgeToControlServerIOleControlWrapperTestOleObjectPtr",
|
|
"EdgeToControlServerIOleControlWrapperCallDoVerb",
|
|
"EdgeToControlServerIOleControlWrapperCallClose",
|
|
"EdgeToControlServerIOleControlWrapperCallOleRun",
|
|
"EdgeToControlServerIOleControlWrapperCallDoEmbedVerbs",
|
|
"EdgeToControlServerIOleControlWrapperCallGetExtent",
|
|
"EdgeToControlServerIOleControlWrapperCallSetExtent",
|
|
"EdgeToControlServerIOleControlWrapperSupportsViewObjectPresenterFlip",
|
|
"EdgeToControlServerIOleControlWrapperCallNotifyRender",
|
|
"EdgeToControlServerIOleControlWrapperHasViewObjectPresentNotify",
|
|
"EdgeToControlServerIOleControlWrapperCallOnPreRender",
|
|
"EdgeToControlServerIOleControlWrapperCreateControl",
|
|
"EdgeToControlServerIOleControlWrapperRemoveControl",
|
|
"EdgeToControlServerIOleControlWrapperSetControlVisibility",
|
|
"EdgeToControlServerIOleControlWrapperSetMediaPlaybackState",
|
|
"EdgeToControlServerIOleControlWrapperEnsureInPlaceObject",
|
|
"EdgeToControlServerIOleControlWrapperClearInPlaceObjectObject",
|
|
"EdgeToControlServerIOleControlWrapperSetInPlaceObjectWindowless",
|
|
"EdgeToControlServerIOleControlWrapperCallGetWindow",
|
|
"EdgeToControlServerIOleControlWrapperCallInPlaceDeactivate",
|
|
"EdgeToControlServerIOleControlWrapperCallUIDeactivate",
|
|
"EdgeToControlServerIOleControlWrapperCallSetObjectRects",
|
|
"EdgeToControlServerIOleControlWrapperCallOnWindowMessage",
|
|
"EdgeToControlServerIOleControlWrapperWindowlessControlWindowProc",
|
|
"EdgeToControlServerIOleControlWrapperHasViewObject",
|
|
"EdgeToControlServerIOleControlWrapperHasViewObjectEx",
|
|
"EdgeToControlServerIOleControlWrapperEnsureViewObject",
|
|
"EdgeToControlServerIOleControlWrapperClearViewObject",
|
|
"EdgeToControlServerIOleControlWrapperCallQueryHitPoint",
|
|
"EdgeToControlServerIOleControlWrapperHasPlayToSource",
|
|
"EdgeToControlServerIOleControlWrapperGetPlayToCapabilities",
|
|
"EdgeToControlServerIOleControlWrapperGetPlayToIsPlaying",
|
|
"EdgeToControlServerIOleControlWrapperGetPlayToIsMuted",
|
|
"EdgeToControlServerIOleControlWrapperGetCastingSource",
|
|
"EdgeToControlServerIOleControlWrapperGetId",
|
|
"EdgeToControlServerIOleControlWrapperCallGetDispID",
|
|
"EdgeToControlServerIOleControlWrapperGetLongProperty",
|
|
"EdgeToControlServerIOleControlWrapperGetBoolProperty",
|
|
"EdgeToControlServerIOleControlWrapperGetBstrProperty",
|
|
"EdgeToControlServerIOleControlWrapperCallGetNextDispID",
|
|
"EdgeToControlServerIOleControlWrapperCallGetMemberName",
|
|
"EdgeToControlServerIOleControlWrapperGetControlDispatch",
|
|
"EdgeToControlServerIOleControlWrapperCacheDispatch",
|
|
"EdgeToControlServerIOleControlWrapperClearDispatchCache",
|
|
"EdgeToControlServerIOleControlWrapperIsControlNotRepurposed",
|
|
"EdgeToControlServerIOleControlWrapperCallGetActivationPolicy",
|
|
"EdgeToControlServerIOleControlWrapperHasSurfacePresenterFlip",
|
|
"EdgeToControlServerIOleControlWrapperRenderObjectToSharedBuffer",
|
|
"EdgeToControlServerIOleControlWrapperReleasePresenter",
|
|
"EdgeToControlServerIOleControlWrapperSavePrintBitmapFromSurfacePresenterFlipControl",
|
|
"EdgeToControlServerIOleControlWrapperSupportsOleControl",
|
|
"EdgeToControlServerIOleControlWrapperCallFreezeEvents",
|
|
"EdgeToControlServerIOleControlWrapperCallGetMiscStatus",
|
|
"EdgeToControlServerIOleControlWrapperCallSetHostNames",
|
|
"EdgeToControlServerIOleControlWrapperCallUpdate",
|
|
"EdgeToControlServerIOleControlWrapperCallIsUpToDate",
|
|
"EdgeToControlServerIOleControlWrapperIsQuickActivateSupported",
|
|
"EdgeToControlServerIOleControlWrapperQuickActivate",
|
|
"EdgeToControlServerIOleControlWrapperSetClientSite",
|
|
"EdgeToControlServerIOleControlWrapperUnsetClientSite",
|
|
"EdgeToControlServerIOleControlWrapperIsActiveDesignerSupported",
|
|
"EdgeToControlServerIOleControlWrapperHasSaveFormatInterface",
|
|
"EdgeToControlServerIOleControlWrapperCallInitNew",
|
|
"EdgeToControlServerIOleControlWrapperCallGetClassID",
|
|
"EdgeToControlServerIOleControlWrapperCallNotifyLeavingView",
|
|
"EdgeToControlServerIOleControlWrapperCallOnPointerMessage",
|
|
"EdgeToControlServerIOleControlWrapperImplementsITridentTouchInput",
|
|
"EdgeToControlServerIOleControlWrapperHasObjectSafety",
|
|
"EdgeToControlServerIOleControlWrapperCallMakeObjectSafe",
|
|
"EdgeToControlServerIOleControlWrapperCallSetAccessibilityWindow",
|
|
"EdgeToControlServerIOleControlWrapperHasInterface",
|
|
"EdgeToControlServerIOleControlWrapperCallOnFrameWindowActivate",
|
|
"EdgeToControlServerIOleControlWrapperCallTranslateAccelerator",
|
|
"EdgeToControlServerIOleControlWrapperCallEnterBFCache",
|
|
"EdgeToControlServerIOleControlWrapperCallExitBFCache",
|
|
"EdgeToControlServerIOleControlWrapperCallLResultForObjectId",
|
|
"EdgeToControlServerIOleControlWrapperUpdateClickToPlayState",
|
|
"EdgeToControlServerIOleControlWrapperCallGetCaretPosition",
|
|
"EdgeToControlServerIOleControlWrapperCallSetExpandedUrls",
|
|
"EdgeToControlServerIDispatchGetTypeInfoCount",
|
|
"EdgeToControlServerIDispatchGetTypeInfo",
|
|
"EdgeToControlServerIDispatchGetIDsOfNames",
|
|
"EdgeToControlServerIDispatchInvoke",
|
|
"EdgeToControlServerIEdgeOutOfProcessCastingHelperCreateConnection",
|
|
"EdgeToControlServerIEdgeOutOfProcessCastingHelperStartDisconnectConnection",
|
|
"EdgeToControlServerIEnumFORMATETCReset",
|
|
"EdgeToControlServerIEnumFORMATETCSkip"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140707880192480,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"1b37ca91-76b1-4f5e-a3c7-2abfc61f2bb0": {
|
|
"Module": "bisrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\bisrv.dll",
|
|
"InterfaceId": "1b37ca91-76b1-4f5e-a3c7-2abfc61f2bb0",
|
|
"InterfaceStructOffset": 551680,
|
|
"ProceduresCount": 16,
|
|
"Procedures": [
|
|
"RBiRtSrvAddWaitableEvent",
|
|
"RBiRtSrvAssociateWorkItem",
|
|
"RBiRtSrvCreateEvent",
|
|
"RBiRtSrvCreateEventForApp",
|
|
"RBiRtSrvCreateStatusStateName",
|
|
"RBiRtSrvDeleteEvent",
|
|
"RBiRtSrvDisassociateWorkItem",
|
|
"RBiRtSrvEnumerateBrokeredEvents",
|
|
"RBiRtSrvEnumerateWorkItems",
|
|
"RBiRtSrvGetWorkItemProperties",
|
|
"RBiRtSrvInitiatePause",
|
|
"RBiRtSrvQueryBrokerEventId",
|
|
"RBiRtSrvQueryBrokerEventIdFromWorkItem",
|
|
"RBiRtSrvRegisterWorkItem",
|
|
"RBiRtSrvSignalEvent",
|
|
"RBiRtSrvUpdateEventParameters"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140708131133328,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"58b19028-b9a0-4c25-887f-aca58b584d1b": {
|
|
"Module": "mispace.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\mispace.dll",
|
|
"InterfaceId": "58b19028-b9a0-4c25-887f-aca58b584d1b",
|
|
"InterfaceStructOffset": 2853200,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"ClusterSpaceControl"
|
|
],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140707090917392,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"de79fc6c-dc6f-43c7-a48e-63bbc8d4009d": {
|
|
"Module": "rdpclip.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\rdpclip.exe",
|
|
"InterfaceId": "de79fc6c-dc6f-43c7-a48e-63bbc8d4009d",
|
|
"InterfaceStructOffset": 357584,
|
|
"ProceduresCount": 7,
|
|
"Procedures": [
|
|
"UMRDP_SHChangeNotify",
|
|
"UMRDP_WNetAddConnection2",
|
|
"UMRDP_WNetCancelConnection2",
|
|
"UMRDP_StorePrinterConfig",
|
|
"UMRDP_StoreDefaultPrinter",
|
|
"UMRDP_RestoreDefaultPrinter",
|
|
"UMRDP_SetDefaultPrinter"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140698142225440,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"11f25515-c879-400a-989e-b074d5f092fe": {
|
|
"Module": "lsm.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\lsm.dll",
|
|
"InterfaceId": "11f25515-c879-400a-989e-b074d5f092fe",
|
|
"InterfaceStructOffset": 479600,
|
|
"ProceduresCount": 9,
|
|
"Procedures": [
|
|
"RpcGetUserToken",
|
|
"RpcConnectTerminal",
|
|
"RpcSystemShutdownStarted",
|
|
"RpcConsumeCacheSession",
|
|
"RpcGetRequestForWinlogon",
|
|
"RpcReportWinlogonReply",
|
|
"RpcGetReconnectId",
|
|
"RpcCreateWorkerSession",
|
|
"RpcGetWorkerSessionGpuLuid"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140708131750400,
|
|
"Service": "LSM",
|
|
"IsServiceRunning": true
|
|
},
|
|
"a111f1c6-5923-47c0-9a68-d0bafb577901": {
|
|
"Module": "NetCfgNotifyObjectHost.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\NetCfgNotifyObjectHost.exe",
|
|
"InterfaceId": "a111f1c6-5923-47c0-9a68-d0bafb577901",
|
|
"InterfaceStructOffset": 55600,
|
|
"ProceduresCount": 18,
|
|
"Procedures": [
|
|
"RpcNetSetup_NotifyHost_Connect",
|
|
"RpcNetSetup_NotifyHost_Disconnect",
|
|
"RpcNetSetup_Isolation_ExecuteInfSection",
|
|
"RpcNetSetup_NotifyObject_Load",
|
|
"RpcNetSetup_NotifyObject_Unload",
|
|
"RpcNetSetup_ComponentControl_Initialize",
|
|
"RpcNetSetup_ComponentControl_ApplyChanges",
|
|
"RpcNetSetup_ComponentControl_ApplyPnpChanges",
|
|
"RpcNetSetup_ComponentControl_CancelChanges",
|
|
"RpcNetSetup_ComponentSetup_Install",
|
|
"RpcNetSetup_ComponentSetup_Upgrade",
|
|
"RpcNetSetup_ComponentSetup_Removing",
|
|
"RpcNetSetup_NotifyBinding_QueryBindingPath",
|
|
"RpcNetSetup_NotifyBinding_NotifyBindingPath",
|
|
"RpcNetSetup_NotifyGlobal_GetSupportedNotifications",
|
|
"RpcNetSetup_NotifyGlobal_SysQueryBindingPath",
|
|
"RpcNetSetup_NotifyGlobal_SysNotifyBindingPath",
|
|
"RpcNetSetup_NotifyGlobal_SysNotifyComponent"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140698387567008,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"88abcbc3-34ea-76ae-8215-767520655a23": {
|
|
"Module": "ResourcePolicyServer.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\ResourcePolicyServer.dll",
|
|
"InterfaceId": "88abcbc3-34ea-76ae-8215-767520655a23",
|
|
"InterfaceStructOffset": 104336,
|
|
"ProceduresCount": 21,
|
|
"Procedures": [
|
|
"GcsSrv_GetGameConfigSize",
|
|
"GcsSrv_GetGameConfig",
|
|
"GcsSrv_GetGameConfigSizeForClientProcess",
|
|
"GcsSrv_GetGameConfigForClientProcess",
|
|
"GcsSrv_ModifyGameConfig",
|
|
"GcsSrv_AddGameConfig",
|
|
"GcsSrv_RemoveGameConfig",
|
|
"GcsSrv_GetGameIdByAUMID",
|
|
"GcsSrv_GetGameIdByPID",
|
|
"GcsSrv_GetGameIdCount",
|
|
"GcsSrv_GetAllGameIds",
|
|
"GcsSrv_GetGameIdsByExeNameCount",
|
|
"GcsSrv_GetGameIdsByExeName",
|
|
"GcsSrv_GetGameProperty",
|
|
"GcsSrv_GetGamePropertySize",
|
|
"GcsSrv_SetGameProperty",
|
|
"GcsSrv_GetGlobalProperty",
|
|
"GcsSrv_GetGlobalPropertySize",
|
|
"GcsSrv_SetGlobalProperty",
|
|
"GcsSrv_SetGamePropertyUserOverride",
|
|
"GcsSrv_GetGamePropertyIsUserOverride"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140708127396576,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"5a0ce74d-f9cf-4dea-a4c1-2d5fe4c89d51": {
|
|
"Module": "d3d10warp.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\d3d10warp.dll",
|
|
"InterfaceId": "5a0ce74d-f9cf-4dea-a4c1-2d5fe4c89d51",
|
|
"InterfaceStructOffset": 6118256,
|
|
"ProceduresCount": 4,
|
|
"Procedures": [
|
|
"WARPJITOOPServerConnect",
|
|
"WARPJITOOPServerPassMessage",
|
|
"WARPJITOOPServerGetConnectionUUID",
|
|
"WARPJITOOPServerGetConnectionUUID2"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140708050490560,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"c681d488-d850-11d0-8c52-00c04fd90f7e": {
|
|
"Module": "efslsaext.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\efslsaext.dll",
|
|
"InterfaceId": "c681d488-d850-11d0-8c52-00c04fd90f7e",
|
|
"InterfaceStructOffset": 59440,
|
|
"ProceduresCount": 21,
|
|
"Procedures": [
|
|
"EfsRpcOpenFileRaw_Downlevel",
|
|
"EfsRpcReadFileRaw_Downlevel",
|
|
"EfsRpcWriteFileRaw_Downlevel",
|
|
"EfsRpcCloseRaw_Downlevel",
|
|
"EfsRpcEncryptFileSrv_Downlevel",
|
|
"EfsRpcDecryptFileSrv_Downlevel",
|
|
"EfsRpcQueryUsersOnFile_Downlevel",
|
|
"EfsRpcQueryRecoveryAgents_Downlevel",
|
|
"EfsRpcRemoveUsersFromFile_Downlevel",
|
|
"EfsRpcAddUsersToFile_Downlevel",
|
|
"EfsRpcFileKeyInfoEx_Downlevel",
|
|
"EfsRpcFileKeyInfoEx_Downlevel",
|
|
"EfsRpcFileKeyInfo_Downlevel",
|
|
"EfsRpcDuplicateEncryptionInfoFile_Downlevel",
|
|
"EfsRpcFileKeyInfoEx_Downlevel",
|
|
"EfsRpcAddUsersToFileEx_Downlevel",
|
|
"EfsRpcFileKeyInfoEx_Downlevel",
|
|
"EfsRpcFileKeyInfoEx_Downlevel",
|
|
"EfsRpcFileKeyInfoEx_Downlevel",
|
|
"EfsRpcFileKeyInfoEx_Downlevel",
|
|
"EfsRpcFlushEfsCache_Downlevel"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140708143182256,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"3573e5f2-cfe7-4a79-845f-fe7c68823738": {
|
|
"Module": "PhoneService.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\PhoneService.dll",
|
|
"InterfaceId": "3573e5f2-cfe7-4a79-845f-fe7c68823738",
|
|
"InterfaceStructOffset": 784304,
|
|
"ProceduresCount": 3,
|
|
"Procedures": [
|
|
"PhoneSvcImpl_PhoneRpcInitializeConnectionToOBA",
|
|
"PhoneSvcImpl_PhoneRpcEnableFiltering",
|
|
"PhoneSvcImpl_PhoneRpcSetCallBlockingPreferences"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140707094326704,
|
|
"Service": "PhoneSvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"35464382-ad29-4881-9392-b43e55b8f7ac": {
|
|
"Module": "audiosrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\audiosrv.dll",
|
|
"InterfaceId": "35464382-ad29-4881-9392-b43e55b8f7ac",
|
|
"InterfaceStructOffset": 1379568,
|
|
"ProceduresCount": 167,
|
|
"Procedures": [
|
|
"AudioServerGetMixFormat",
|
|
"AudioServerIsFormatSupported",
|
|
"AudioServerGetDevicePeriod",
|
|
"AudioServerIsOffloadCapable",
|
|
"AudioServerInitialize",
|
|
"AudioServerDisconnect",
|
|
"AudioServerGetAudioSession",
|
|
"AudioServerCreateStream",
|
|
"AudioServerStartStream",
|
|
"AudioServerStopStream",
|
|
"AudioServerPreStartStream",
|
|
"AudioServerStartStreamAborted",
|
|
"AudioServerResetEndpoint",
|
|
"AudioServerDestroyStream",
|
|
"AudioServerGetEndpointBufferSize",
|
|
"AudioServerGetStreamLatency",
|
|
"AudioServerSetStreamSampleRate",
|
|
"AudioServerGetChannelCount",
|
|
"AudioServerSetChannelVolume",
|
|
"AudioServerGetChannelVolume",
|
|
"AudioServerSetAllVolumes",
|
|
"AudioServerGetAllVolumes",
|
|
"AudioServerSetAllInitialVolumesWithRamp",
|
|
"AudioSessionGetId",
|
|
"AudioSessionGetInstanceId",
|
|
"AudioSessionGetStreamSwitchId",
|
|
"AudioSessionGetProcessId",
|
|
"AudioSessionGetState",
|
|
"AudioSessionGetLastActivation",
|
|
"AudioSessionGetLastInactivation",
|
|
"AudioSessionIsSystemSoundsSession",
|
|
"AudioSessionGetDisplayOptions",
|
|
"AudioSessionGetDisplayName",
|
|
"AudioSessionSetDisplayName",
|
|
"AudioSessionGetIconPath",
|
|
"AudioSessionSetIconPath",
|
|
"AudioSessionGetGroupingParam",
|
|
"AudioSessionSetGroupingParam",
|
|
"AudioSessionGetVolume",
|
|
"AudioSessionSetVolume",
|
|
"AudioSessionGetMute",
|
|
"AudioSessionSetMute",
|
|
"AudioSessionGetChannelCount",
|
|
"AudioSessionSetChannelVolume",
|
|
"AudioSessionGetChannelVolume",
|
|
"AudioSessionSetAllVolumes",
|
|
"AudioSessionGetAllVolumes",
|
|
"AudioSessionPropertyStoreCommit",
|
|
"AudioSessionPropertyStoreGetAt",
|
|
"AudioSessionPropertyStoreGetCount",
|
|
"AudioSessionPropertyStoreGetValue",
|
|
"AudioSessionPropertyStoreSetValue",
|
|
"AudioSessionSetDuckingPreference",
|
|
"AudioSessionGetDuckingState",
|
|
"AudioSessionGetIsComms",
|
|
"AudioSessionDestroy",
|
|
"AudioSessionMeterGetPeakValue",
|
|
"AudioSessionMeterGetMeteringChannelCount",
|
|
"AudioSessionMeterGetChannelsPeakValues",
|
|
"AudioSessionSetWindowId",
|
|
"PolicyConfigGetMixFormat",
|
|
"PolicyConfigGetDeviceFormat",
|
|
"PolicyConfigGetDeviceFormatForConnector",
|
|
"PolicyConfigSetDeviceFormat",
|
|
"PolicyConfigResetDeviceFormat",
|
|
"PolicyConfigGetProcessingPeriod",
|
|
"PolicyConfigSetProcessingPeriod",
|
|
"PolicyConfigGetShareMode",
|
|
"PolicyConfigSetShareMode",
|
|
"PolicyConfigGetPropertyValue",
|
|
"PolicyConfigSetPropertyValue",
|
|
"PolicyConfigSetDefaultEndpoint",
|
|
"PolicyConfigSetEndpointVisibility",
|
|
"PolicyConfigSetEndpointAbilityToBeDefault",
|
|
"PolicyConfigSetAccessibilityAudioMonoMixState",
|
|
"PolicyConfigGetAccessibilityAudioMonoMixState",
|
|
"PolicyConfigValidateSpatialAudioSettings",
|
|
"PolicyConfigReportSpatialLicenseChanged",
|
|
"PolicyConfigSetMixedRealitySpatialAudioFormatPolicy",
|
|
"PolicyConfigGetDeviceFormatAndSpatialSettings",
|
|
"PolicyConfigSetDeviceSpatialSettings",
|
|
"PolicyConfigAddDynamicRoutingRule",
|
|
"PolicyConfigRemoveDynamicRoutingRule",
|
|
"PolicyConfigUpdateDynamicRoutingRule",
|
|
"PolicyConfigGetDynamicRoutingRule",
|
|
"GetAudioSessionManager",
|
|
"AudioSessionManagerDestroy",
|
|
"AudioSessionManagerGetAudioSessions",
|
|
"AudioSessionManagerGetCurrentSession",
|
|
"AudioSessionManagerGetExistingSession",
|
|
"AudioSessionManagerGetSessionForStreamSwitch",
|
|
"AudioSessionManagerAddAudioSessionClientNotification",
|
|
"AudioSessionManagerDeleteAudioSessionClientNotification",
|
|
"AudioSessionManagerAddVolumeDuckNotification",
|
|
"AudioSessionManagerDeleteVolumeDuckNotification",
|
|
"AudioVolumeConnect",
|
|
"AudioVolumeDisconnect",
|
|
"AudioVolumeQueryHardwareSupport",
|
|
"AudioVolumeGetVolumeRange",
|
|
"AudioVolumeGetChannelCount",
|
|
"AudioVolumeSetMasterVolumeLevel",
|
|
"AudioVolumeSetMasterVolumeLevelScalar",
|
|
"AudioVolumeGetMasterVolumeLevel",
|
|
"AudioVolumeGetMasterVolumeLevelScalar",
|
|
"AudioVolumeSetChannelVolumeLevel",
|
|
"AudioVolumeSetChannelVolumeLevelScalar",
|
|
"AudioVolumeGetChannelVolumeLevel",
|
|
"AudioVolumeGetChannelVolumeLevelScalar",
|
|
"AudioVolumeSetMute",
|
|
"AudioVolumeGetMute",
|
|
"AudioVolumeAddMasterVolumeNotification",
|
|
"AudioVolumeDeleteMasterVolumeNotification",
|
|
"AudioMeterGetPeakValue",
|
|
"AudioMeterGetMeteringChannelCount",
|
|
"AudioMeterGetChannelsPeakValues",
|
|
"AudioVolumeGetStepInfo",
|
|
"AudioVolumeStepUp",
|
|
"AudioVolumeStepDown",
|
|
"AudioServerGetBufferSizeLimits",
|
|
"AudioServerSetLastBufferInProgress",
|
|
"AudioServerIsRawStreamSupported",
|
|
"AudioServerDeriveStreamCategory",
|
|
"AudioServerGetStreamVpoContext",
|
|
"AudioServerGetEndpointVpoContext",
|
|
"AudioServerCloseVpoContext",
|
|
"AudioServerGetCurrentSharedModeEnginePeriod",
|
|
"AudioServerGetSharedModeEnginePeriod",
|
|
"AudioServerRequestSpatialDynamicObjects",
|
|
"AudioServerSetAmbMetadata",
|
|
"AudioServerSetAmbHeadTracking",
|
|
"AudioServerGetAmbHeadTracking",
|
|
"AudioServerSetAmbRotation",
|
|
"asm_GetApplicationSubmixContext",
|
|
"asm_GetApplicationSubmixContextFromPID",
|
|
"asm_GetApplicationSubmixContextForProcessTree",
|
|
"asm_ApplicationSubmixContextDestroy",
|
|
"asm_GetApplicationSubmixes",
|
|
"asm_ApplicationSubmixDestroy",
|
|
"asm_AudioServerGetApplicationSubmixFormat",
|
|
"asm_AudioServerGetApplicationSubmixPeriod",
|
|
"asm_AudioServerGetApplicationSubmixId",
|
|
"asm_GetApplicationSubmixFromId",
|
|
"asm_AudioServerInitializeStream",
|
|
"AudioServerTelephonyControlStartSession",
|
|
"AudioServerTelephonyControlIsSessionStarted",
|
|
"AudioServerTelephonyControlEndSession",
|
|
"AudioServerTelephonyControlSetRoutingPolicy",
|
|
"AudioServerTelephonyControlGetRoutingPolicy",
|
|
"AudioServerTelephonyControlSetCallState",
|
|
"AudioServerTelephonyControlGetCallState",
|
|
"AudioServerTelephonyControlProviderChange",
|
|
"AudioServerTelephonyControlSetMute",
|
|
"AudioServerTelephonyControlGetMute",
|
|
"AudioServerTelephonyControlSetVOIPMute",
|
|
"AudioServerTelephonyControlGetVOIPMute",
|
|
"AudioServerTelephonyControlSetVolume",
|
|
"AudioServerTelephonyControlGetMaxCallInstanceCount",
|
|
"AudioServerTelephonyControlGetValidTelephonyInstance",
|
|
"AudioServerGetAudioHistoryProducerHandle",
|
|
"AudioServerReleaseAudioHistoryProducerHandle",
|
|
"AudioServerGetAudioHistoryProducerInfo",
|
|
"AudioServerPopulateAudioHistoryForStream",
|
|
"PolicyConfigGetEndpointExtendedSpatialLicenseInfo",
|
|
"PolicyConfigGetSpatialSpeakerProtectionOverrideValue",
|
|
"AudioServerCreateStreamConnection",
|
|
"AudioServerReleaseStreamConnection",
|
|
"AudioServerStartStopStreamConnection"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140708026687696,
|
|
"Service": "Audiosrv",
|
|
"IsServiceRunning": true
|
|
},
|
|
"3b338d89-6cfa-44b8-847e-531531bc9992": {
|
|
"Module": "psmsrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\psmsrv.dll",
|
|
"InterfaceId": "3b338d89-6cfa-44b8-847e-531531bc9992",
|
|
"InterfaceStructOffset": 168576,
|
|
"ProceduresCount": 2,
|
|
"Procedures": [
|
|
"PsmSrvQueryApplicationPerformanceInformation",
|
|
"PsmSrvQueryQuotaInformation"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140708134215520,
|
|
"Service": "BrokerInfrastructure",
|
|
"IsServiceRunning": true
|
|
},
|
|
"a111f1c5-5923-47c0-9a68-d0bafb577901": {
|
|
"Module": "NetSetupSvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\NetSetupSvc.dll",
|
|
"InterfaceId": "a111f1c5-5923-47c0-9a68-d0bafb577901",
|
|
"InterfaceStructOffset": 214768,
|
|
"ProceduresCount": 12,
|
|
"Procedures": [
|
|
"RpcNetSetupInitialize",
|
|
"RpcNetSetupValidateTransaction",
|
|
"RpcNetSetupRollback",
|
|
"RpcNetSetupCommit",
|
|
"RpcNetSetupClose",
|
|
"RpcNetSetupCreateObject",
|
|
"RpcNetSetupDeleteObject",
|
|
"RpcNetSetupGetObjectPropertyKeys",
|
|
"RpcNetSetupGetObjectProperties",
|
|
"RpcNetSetupSetObjectProperties",
|
|
"RpcNetSetupGetObjects",
|
|
"RpcNetSetupSynchronizeDevices"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140707580939392,
|
|
"Service": "NetSetupSvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"c27f3c08-92ba-478c-b446-b419c4cef0e2": {
|
|
"Module": "dusmsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\dusmsvc.dll",
|
|
"InterfaceId": "c27f3c08-92ba-478c-b446-b419c4cef0e2",
|
|
"InterfaceStructOffset": 246560,
|
|
"ProceduresCount": 25,
|
|
"Procedures": [
|
|
"DusmRpcEnumConnectionList",
|
|
"DusmRpcEnumProfileList",
|
|
"DusmRpcQueryConnectionProperties",
|
|
"DusmRpcQueryCost",
|
|
"DusmRpcQueryUserCost",
|
|
"DusmRpcQueryOperatorCost",
|
|
"DusmRpcSetUserCost",
|
|
"DusmRpcSetOperatorCost",
|
|
"DusmRpcQueryDataPlan",
|
|
"DusmRpcQueryUserDataPlan",
|
|
"DusmRpcQueryOperatorDataPlan",
|
|
"DusmRpcSetUserDataPlan",
|
|
"DusmRpcSetOperatorDataPlan",
|
|
"DusmRpcQuerySource",
|
|
"DusmRpcSetSource",
|
|
"DusmRpcQueryBackgroundRestriction",
|
|
"DusmRpcSetBackgroundRestriction",
|
|
"DusmRpcQueryGlobalDpuState",
|
|
"DusmRpcGetAttributedNetworkUsage",
|
|
"DusmRpcGetConnectionListNetworkUsage",
|
|
"DusmRpcGetNetworkUsage",
|
|
"DusmRpcGetProviderNetworkUsage",
|
|
"DusmRpcSetAttributionMapping",
|
|
"DusmRpcResetNetworkUsage",
|
|
"DusmRpcFlushCostCache"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140708018354432,
|
|
"Service": "DusmSvc",
|
|
"IsServiceRunning": true
|
|
},
|
|
"552d076a-cb29-4e44-8b6a-d15e59e2c0af": {
|
|
"Module": "iphlpsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\iphlpsvc.dll",
|
|
"InterfaceId": "552d076a-cb29-4e44-8b6a-d15e59e2c0af",
|
|
"InterfaceStructOffset": 483584,
|
|
"ProceduresCount": 4,
|
|
"Procedures": [
|
|
"IpTransitionProtocolApplyConfigChanges",
|
|
"IpTransitionProtocolApplyConfigChangesEx",
|
|
"IpTransitionCreatev6Inv4Tunnel",
|
|
"IpTransitionDeletev6Inv4Tunnel"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140707888009120,
|
|
"Service": "iphlpsvc",
|
|
"IsServiceRunning": true
|
|
},
|
|
"4be96a0f-9f52-4729-a51d-c70610f118b0": {
|
|
"Module": "wbiosrvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\wbiosrvc.dll",
|
|
"InterfaceId": "4be96a0f-9f52-4729-a51d-c70610f118b0",
|
|
"InterfaceStructOffset": 697248,
|
|
"ProceduresCount": 7,
|
|
"Procedures": [
|
|
"WinBioCredMgrSrvSetCredential",
|
|
"WinBioCredMgrSrvRemoveCredential",
|
|
"WinBioCredMgrSrvRemoveAllCredentials",
|
|
"WinBioCredMgrSrvRemoveAllDomainCredentials",
|
|
"WinBioCredMgrSrvGetCredentialState",
|
|
"WinBioCredMgrSrvGetCredentialWithTicket",
|
|
"WinBioSrvGetServiceMonitorEvent"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140707487436608,
|
|
"Service": "WbioSrvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"e53d94ca-7464-4839-b044-09a2fb8b3ae5": {
|
|
"Module": "PsmServiceExtHost.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\PsmServiceExtHost.dll",
|
|
"InterfaceId": "e53d94ca-7464-4839-b044-09a2fb8b3ae5",
|
|
"InterfaceStructOffset": 566112,
|
|
"ProceduresCount": 17,
|
|
"Procedures": [
|
|
"HamRpcSrvConnect",
|
|
"HamRpcSrvDisconnect",
|
|
"HamRpcSrvCreateActivity",
|
|
"HamRpcSrvCreateActivityForProcess",
|
|
"HamRpcSrvCreateAutoRestartActivity",
|
|
"HamRpcSrvStartActivityAsync",
|
|
"HamRpcSrvStopActivity",
|
|
"HamRpcSrvUpdateActivityProperties",
|
|
"HamRpcSrvTerminateActivityHost",
|
|
"HamRpcSrvSetExternalResourcePriority",
|
|
"HamRpcSrvResetExternalResourcePriority",
|
|
"HamRpcSrvCloseActivity",
|
|
"HamRpcSrvIsHostBeingDebugged",
|
|
"HamRpcSrvTerminateHostOnProcessExit",
|
|
"HamRpcSrvGetApplicationInterruptiveUIState",
|
|
"HamRpcSrvGetPackageInterruptiveUIState",
|
|
"HamRpcSrvGetInterruptiveUIStateForAumid"
|
|
],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140708133772736,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"7f1343fe-50a9-4927-a778-0c5859517bac": {
|
|
"Module": "wkssvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\wkssvc.dll",
|
|
"InterfaceId": "7f1343fe-50a9-4927-a778-0c5859517bac",
|
|
"InterfaceStructOffset": 194912,
|
|
"ProceduresCount": 4,
|
|
"Procedures": [
|
|
"DfsDsGetDcName",
|
|
"DfsDsIsDomainController",
|
|
"DfsCredWrite",
|
|
"DfsCredDelete"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140708036827040,
|
|
"Service": "LanmanWorkstation",
|
|
"IsServiceRunning": true
|
|
},
|
|
"c9ac6db5-82b7-4e55-ae8a-e464ed7b4277": {
|
|
"Module": "sysntfy.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\sysntfy.dll",
|
|
"InterfaceId": "c9ac6db5-82b7-4e55-ae8a-e464ed7b4277",
|
|
"InterfaceStructOffset": 17248,
|
|
"ProceduresCount": 15,
|
|
"Procedures": [
|
|
"s_OnInitialConnection",
|
|
"s_OnCreateSession",
|
|
"s_OnStartScreenSaverAsDefaultUser",
|
|
"s_OnStopScreenSaverAsDefaultUser",
|
|
"s_OnLogon",
|
|
"s_OnLock",
|
|
"s_OnUnlock",
|
|
"s_OnStartScreenSaverAsUser",
|
|
"s_OnStopScreenSaverAsUser",
|
|
"s_OnDisconnect",
|
|
"s_OnReconnect",
|
|
"s_OnLogoff",
|
|
"s_OnTerminateSession",
|
|
"s_OnStartShell",
|
|
"s_OnEndShell"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140708127709872,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"46f91c6b-1f95-4bff-8490-eb648ca0a9b9": {
|
|
"Module": "webplatstorageserver.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\webplatstorageserver.dll",
|
|
"InterfaceId": "46f91c6b-1f95-4bff-8490-eb648ca0a9b9",
|
|
"InterfaceStructOffset": 940384,
|
|
"ProceduresCount": 28,
|
|
"Procedures": [
|
|
"s_ServiceWorkerSession_Open",
|
|
"s_ServiceWorkerSession_Close",
|
|
"s_ServiceWorkerSession_EnumerateAllSessions",
|
|
"s_ServiceWorkerSession_CreateNewRegistration",
|
|
"s_ServiceWorkerSession_GetRegistrationWithScopeUrl",
|
|
"s_ServiceWorkerSession_GetRegistrationWithUniqueId",
|
|
"s_ServiceWorkerSession_FindActiveMatchingRegistration",
|
|
"s_ServiceWorkerSession_FindAllRegistrationsForOrigin",
|
|
"s_ServiceWorkerSession_FindAllRegistrationsWithPendingTaskTypes",
|
|
"s_ServiceWorkerRegistration_Close",
|
|
"s_ServiceWorkerRegistration_SetInstallingWorker",
|
|
"s_ServiceWorkerRegistration_UpdateState",
|
|
"s_ServiceWorkerRegistration_Unregister",
|
|
"s_ServiceWorkerRegistration_ClearWorkerUninstallingFlag",
|
|
"s_ServiceWorkerRegistration_Delete",
|
|
"s_ServiceWorkerRegistration_SetLastUpdateCheckTime",
|
|
"s_ServiceWorkerRegistration_SetHasRequestedUpdate",
|
|
"s_ServiceWorkerRegistration_SetUpdateViaCache",
|
|
"s_ServiceWorkerRegistration_HasPushSubscriptionPolicyViolation",
|
|
"s_ServiceWorkerRegistration_GetPolicyViolations",
|
|
"s_ServiceWorkerRegistration_IncrementPolicyViolations",
|
|
"s_ServiceWorkerRegistration_ResetPolicyViolations",
|
|
"s_ServiceWorkerRegistration_SetIsNavigationPreloadEnabled",
|
|
"s_ServiceWorkerRegistration_SetNavigationPreloadHeader",
|
|
"s_ServiceWorkerRegistration_GetNavigationPreloadState",
|
|
"s_ServiceWorkerRegistration_GetPushSubscription",
|
|
"s_ServiceWorkerRegistration_SetPushSubscription",
|
|
"s_ServiceWorkerRegistration_DeletePushSubscription"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140706992781888,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"44e10347-37a0-494c-871c-fb90f7145742": {
|
|
"Module": "AppVEntSubsystemController.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\AppVEntSubsystemController.dll",
|
|
"InterfaceId": "44e10347-37a0-494c-871c-fb90f7145742",
|
|
"InterfaceStructOffset": 901104,
|
|
"ProceduresCount": 10,
|
|
"Procedures": [
|
|
"s_vcom_server_GetVComPolicies",
|
|
"s_vcom_server_RegisterServer",
|
|
"s_vcom_server_ReleaseServer",
|
|
"s_vcom_server_RequestServerResource",
|
|
"s_vcom_server_AcceptServerResource",
|
|
"s_vcom_server_ReleaseServerResource",
|
|
"s_vcom_server_WaitForClsidRegistration",
|
|
"s_vcom_server_StartComVirtualService",
|
|
"s_vcom_server_ComVirtualService",
|
|
"s_vcom_server_MakeLowIntegrityCOMMap"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140706797823920,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"be7f785e-0e3a-4ab7-91de-7e46e443be29": {
|
|
"Module": "StorSvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\StorSvc.dll",
|
|
"InterfaceId": "be7f785e-0e3a-4ab7-91de-7e46e443be29",
|
|
"InterfaceStructOffset": 654768,
|
|
"ProceduresCount": 23,
|
|
"Procedures": [
|
|
"SvcMountVolume",
|
|
"SvcDismountVolume",
|
|
"SvcFormatVolume",
|
|
"SvcGetStorageInstanceCount",
|
|
"SvcGetStorageDeviceInfo",
|
|
"CleanupItem",
|
|
"SvcRebootToFlashingMode",
|
|
"SvcRebootToUosFlashing",
|
|
"SvcFinalizeVolume",
|
|
"SvcGetStorageSettings",
|
|
"SvcResetStoragePolicySettings",
|
|
"SvcSetStorageSettings",
|
|
"SvcTriggerStorageCleanup",
|
|
"SvcTriggerLowStorageNotification",
|
|
"SvcMoveFileInheritSecurity",
|
|
"SvcScanVolume",
|
|
"SvcProcessStorageCardChange",
|
|
"SvcProvisionForAppInstall",
|
|
"SvcGetStorageInstanceCountForMaps",
|
|
"SvcGetStoragePolicySettings",
|
|
"SvcSetStoragePolicySettings",
|
|
"SvcTriggerStoragePolicies",
|
|
"SvcPredictStorageHealth"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140707759709328,
|
|
"Service": "StorSvc",
|
|
"IsServiceRunning": true
|
|
},
|
|
"45527ae0-2a7d-4cec-b214-739f4159c392": {
|
|
"Module": "LsaIso.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\LsaIso.exe",
|
|
"InterfaceId": "45527ae0-2a7d-4cec-b214-739f4159c392",
|
|
"InterfaceStructOffset": 201376,
|
|
"ProceduresCount": 19,
|
|
"Procedures": [
|
|
"NtlmIumGetContext",
|
|
"NtlmIumProtectCredential",
|
|
"NtlmIumLm20GetNtlm3ChallengeResponse",
|
|
"NtlmIumCalculateNtResponse",
|
|
"NtlmIumCalculateUserSessionKeyNt",
|
|
"NtlmIumPasswordValidateInteractive",
|
|
"NtlmIumPasswordValidateNetwork",
|
|
"NtlmIumIsGMSACred",
|
|
"NtlmIumMakeSecretPasswordNT5",
|
|
"NtlmIumCompareCredentials",
|
|
"NtlmIumDecryptDpapiMasterKey",
|
|
"NtlmIumGenerateRootSecret",
|
|
"NtlmIumGetCredentialKey",
|
|
"NtlmIumUpdateSharedConfiguration",
|
|
"NtlmIumMakeOwfsFromIumSupplementalCredential",
|
|
"NtlmIumMakeOwfsFromIumEncryptedPassword",
|
|
"NtlmIumConvertCredManPasswordToSupplementalCredential",
|
|
"NtlmIumProtectSspCredentialPassword",
|
|
"NtlmIumComparePasswordToProtectedPassword"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140697529061744,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"c49a5a70-8a7f-4e70-ba16-1e8f1f193ef1": {
|
|
"Module": "adhsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\adhsvc.dll",
|
|
"InterfaceId": "c49a5a70-8a7f-4e70-ba16-1e8f1f193ef1",
|
|
"InterfaceStructOffset": 65776,
|
|
"ProceduresCount": 7,
|
|
"Procedures": [
|
|
"Rpc_AdhEngineOpen",
|
|
"Rpc_AdhEngineClose",
|
|
"Rpc_AdhStatusEventSubscribe",
|
|
"Rpc_AdhStatusEventSubscriptionGetLastEvent",
|
|
"Rpc_AdhStatusEventUnsubscribe",
|
|
"Rpc_AdhGetConfig",
|
|
"Rpc_AdhGetEvidenceCollectorResult"
|
|
],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140707878979392,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"3dde7c30-165d-11d1-ab8f-00805f14db40": {
|
|
"Module": "dpapisrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\dpapisrv.dll",
|
|
"InterfaceId": "3dde7c30-165d-11d1-ab8f-00805f14db40",
|
|
"InterfaceStructOffset": 189440,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"s_BackuprKey"
|
|
],
|
|
"ProcStackSize": 64,
|
|
"DispatchFunction": 140708143064640,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"76c217bc-c8b4-4201-a745-373ad9032b1a": {
|
|
"Module": "ResourcePolicyServer.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\ResourcePolicyServer.dll",
|
|
"InterfaceId": "76c217bc-c8b4-4201-a745-373ad9032b1a",
|
|
"InterfaceStructOffset": 106320,
|
|
"ProceduresCount": 3,
|
|
"Procedures": [
|
|
"Srv_QueryApplicationEnergyUsage",
|
|
"Srv_GetDeviceSpecificConversionFactor",
|
|
"Srv_ResetTotalEnergyUsage"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140708127422560,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"4bec6bb8-b5c2-4b6f-b2c1-5da5cf92d0d9": {
|
|
"Module": "psmsrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\psmsrv.dll",
|
|
"InterfaceId": "4bec6bb8-b5c2-4b6f-b2c1-5da5cf92d0d9",
|
|
"InterfaceStructOffset": 168288,
|
|
"ProceduresCount": 4,
|
|
"Procedures": [
|
|
"PsmSrvActivateApplication",
|
|
"PsmSrvCloseActivationChannel",
|
|
"PsmSrvOpenActivationChannel",
|
|
"PsmSrvRegisterProcess"
|
|
],
|
|
"ProcStackSize": 80,
|
|
"DispatchFunction": 140708134117536,
|
|
"Service": "BrokerInfrastructure",
|
|
"IsServiceRunning": true
|
|
},
|
|
"95095ec8-32ea-4eb0-a3e2-041f97b36168": {
|
|
"Module": "diagtrack.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\diagtrack.dll",
|
|
"InterfaceId": "95095ec8-32ea-4eb0-a3e2-041f97b36168",
|
|
"InterfaceStructOffset": 2709664,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"UtcTelemetryOptInApi_SetTelemetryOptIn"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140707991503344,
|
|
"Service": "DiagTrack",
|
|
"IsServiceRunning": true
|
|
},
|
|
"f47433c3-3e9d-4157-aad4-83aa1f5c2d4c": {
|
|
"Module": "MPSSVC.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\MPSSVC.dll",
|
|
"InterfaceId": "f47433c3-3e9d-4157-aad4-83aa1f5c2d4c",
|
|
"InterfaceStructOffset": 710704,
|
|
"ProceduresCount": 10,
|
|
"Procedures": [
|
|
"RPC_NetworkIsolationDiagnoseConnectFailure",
|
|
"RPC_NetworkIsolationGetEnterpriseIdAsync",
|
|
"RPC_NetworkIsolationCreateContainer",
|
|
"RPC_NetworkIsolationDeleteContainer",
|
|
"RPC_NetworkIsolationGetAppContainerConfig",
|
|
"RPC_NetworkIsolationSetAppContainerConfig",
|
|
"RPC_NetworkIsolationCreateAppContainer",
|
|
"RPC_NetworkIsolationDeleteAppContainer",
|
|
"RPC_NetworkIsolationCreateAppContainerLoopbackRules",
|
|
"RPC_NetworkIsolationDeleteAppContainerLoopbackRules"
|
|
],
|
|
"ProcStackSize": 64,
|
|
"DispatchFunction": 140708003537664,
|
|
"Service": "mpssvc",
|
|
"IsServiceRunning": true
|
|
},
|
|
"12345678-1234-abcd-ef00-0123456789ab": {
|
|
"Module": "IPSECSVC.DLL",
|
|
"ModulePath": "C:\\Windows\\System32\\IPSECSVC.DLL",
|
|
"InterfaceId": "12345678-1234-abcd-ef00-0123456789ab",
|
|
"InterfaceStructOffset": 372960,
|
|
"ProceduresCount": 71,
|
|
"Procedures": [
|
|
"RpcAddTransportFilter",
|
|
"RpcDeleteTransportFilter",
|
|
"RpcEnumTransportFilters",
|
|
"RpcSetTransportFilter",
|
|
"RpcGetTransportFilter",
|
|
"RpcAddQMPolicy",
|
|
"RpcDeleteQMPolicy",
|
|
"RpcEnumQMPolicies",
|
|
"RpcSetQMPolicy",
|
|
"RpcGetQMPolicy",
|
|
"RpcAddMMPolicy",
|
|
"RpcDeleteMMPolicy",
|
|
"RpcEnumMMPolicies",
|
|
"RpcSetMMPolicy",
|
|
"RpcGetMMPolicy",
|
|
"RpcAddMMFilter",
|
|
"RpcDeleteMMFilter",
|
|
"RpcEnumMMFilters",
|
|
"RpcSetMMFilter",
|
|
"RpcGetMMFilter",
|
|
"RpcMatchMMFilter",
|
|
"RpcMatchTransportFilter",
|
|
"RpcGetQMPolicyByID",
|
|
"RpcGetMMPolicyByID",
|
|
"RpcAddMMAuthMethods",
|
|
"RpcDeleteMMAuthMethods",
|
|
"RpcEnumMMAuthMethods",
|
|
"RpcSetMMAuthMethods",
|
|
"RpcGetMMAuthMethods",
|
|
"RpcAddSAs",
|
|
"RpcAddSAs",
|
|
"RpcAddSAs",
|
|
"RpcEnumMMSAs",
|
|
"RpcDeleteMMSAs",
|
|
"RpcDeleteQMSAs",
|
|
"RpcQueryIKEStatistics",
|
|
"RpcAddSAs",
|
|
"RpcAddSAs",
|
|
"RpcAddSAs",
|
|
"RpcQueryIPSecStatistics",
|
|
"RpcEnumQMSAs",
|
|
"RpcAddTunnelFilter",
|
|
"RpcDeleteTunnelFilter",
|
|
"RpcEnumTunnelFilters",
|
|
"RpcSetTunnelFilter",
|
|
"RpcGetTunnelFilter",
|
|
"RpcMatchTunnelFilter",
|
|
"RpcOpenMMFilterHandle",
|
|
"RpcCloseMMFilterHandle",
|
|
"RpcOpenTransportFilterHandle",
|
|
"RpcCloseTransportFilterHandle",
|
|
"RpcOpenTunnelFilterHandle",
|
|
"RpcCloseTunnelFilterHandle",
|
|
"RpcEnumIpsecInterfaces",
|
|
"RpcAddSAs",
|
|
"RpcSetConfigurationVariables",
|
|
"RpcGetConfigurationVariables",
|
|
"RpcQuerySpdPolicyState",
|
|
"RpcAddMMFilterEx",
|
|
"RpcEnumMMFiltersEx",
|
|
"RpcSetMMFilterEx",
|
|
"RpcGetMMFilterEx",
|
|
"RpcMatchMMFilterEx",
|
|
"RpcOpenMMFilterHandleEx",
|
|
"RpcAddTransportFilterEx",
|
|
"RpcEnumTransportFiltersEx",
|
|
"RpcSetTransportFilterEx",
|
|
"RpcGetTransportFilterEx",
|
|
"RpcMatchTransportFilterEx",
|
|
"RpcOpenTransportFilterHandleEx",
|
|
"RpcQueryRemoteFWRunning"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140707580797552,
|
|
"Service": "PolicyAgent",
|
|
"IsServiceRunning": false
|
|
},
|
|
"cba4c918-e55a-46ee-aa62-cade158e9165": {
|
|
"Module": "audiosrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\audiosrv.dll",
|
|
"InterfaceId": "cba4c918-e55a-46ee-aa62-cade158e9165",
|
|
"InterfaceStructOffset": 1381120,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"s_adGetDeviceGraphWnfStateName"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140708027005360,
|
|
"Service": "Audiosrv",
|
|
"IsServiceRunning": true
|
|
},
|
|
"0b0a6584-9e0f-11cf-a3cf-00805f68cb1b": {
|
|
"Module": "RpcEpMap.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\RpcEpMap.dll",
|
|
"InterfaceId": "0b0a6584-9e0f-11cf-a3cf-00805f68cb1b",
|
|
"InterfaceStructOffset": 45152,
|
|
"ProceduresCount": 6,
|
|
"Procedures": [
|
|
"OpenEndpointMapper",
|
|
"AllocateReservedIPPort",
|
|
"ept_insert_ex",
|
|
"ept_delete_ex",
|
|
"SetRestrictRemoteClients",
|
|
"ResetWithNoAuthException"
|
|
],
|
|
"ProcStackSize": 8,
|
|
"DispatchFunction": 140708134471696,
|
|
"Service": "RpcEptMapper",
|
|
"IsServiceRunning": true
|
|
},
|
|
"da5a86c5-12c2-4943-ab30-7f74a813d853": {
|
|
"Module": "regsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\regsvc.dll",
|
|
"InterfaceId": "da5a86c5-12c2-4943-ab30-7f74a813d853",
|
|
"InterfaceStructOffset": 126368,
|
|
"ProceduresCount": 8,
|
|
"Procedures": [
|
|
"PerflibV2EnumerateCounterSet",
|
|
"PerflibV2QueryCounterSetRegistrationInfo",
|
|
"PerflibV2EnumerateCounterSetInstances",
|
|
"PerflibV2OpenQueryHandle",
|
|
"PerflibV2CloseQueryHandle",
|
|
"PerflibV2QueryCounterInfo",
|
|
"PerflibV2QueryCounterData",
|
|
"PerflibV2ValidateCounters"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140707581089648,
|
|
"Service": "RemoteRegistry",
|
|
"IsServiceRunning": false
|
|
},
|
|
"66055171-882c-4625-8fd7-cc7c30e2b226": {
|
|
"Module": "AppVEntSubsystemController.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\AppVEntSubsystemController.dll",
|
|
"InterfaceId": "66055171-882c-4625-8fd7-cc7c30e2b226",
|
|
"InterfaceStructOffset": 901872,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"vshell_server_get_vshell_process_data"
|
|
],
|
|
"ProcStackSize": 64,
|
|
"DispatchFunction": 140706798058224,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"dd490425-5325-4565-b774-7e27d6c09c24": {
|
|
"Module": "BFE.DLL",
|
|
"ModulePath": "C:\\Windows\\System32\\BFE.DLL",
|
|
"InterfaceId": "dd490425-5325-4565-b774-7e27d6c09c24",
|
|
"InterfaceStructOffset": 473856,
|
|
"ProceduresCount": 195,
|
|
"Procedures": [
|
|
"BfeRpcGetNextNotificationBatch",
|
|
"BfeRpcNotifyComplete",
|
|
"BfeRpcEngineOpen",
|
|
"BfeRpcEngineClose",
|
|
"BfeRpcEngineGetOption",
|
|
"BfeRpcEngineSetOption",
|
|
"BfeRpcEngineGetSecurityInfo",
|
|
"BfeRpcEngineSetSecurityInfo",
|
|
"BfeRpcSessionCreateEnumHandle",
|
|
"BfeRpcAleEndpointEnum",
|
|
"BfeRpcAleEndpointDestroyEnumHandle",
|
|
"BfeRpcTransactionBegin",
|
|
"BfeRpcTransactionCommit",
|
|
"BfeRpcTransactionAbort",
|
|
"BfeRpcProviderAdd",
|
|
"BfeRpcProviderDeleteByKey",
|
|
"BfeRpcProviderGetByKey",
|
|
"BfeRpcProviderCreateEnumHandle",
|
|
"BfeRpcAleEndpointEnum",
|
|
"BfeRpcAleEndpointDestroyEnumHandle",
|
|
"BfeRpcProviderGetSecurityInfoByKey",
|
|
"BfeRpcProviderSetSecurityInfoByKey",
|
|
"BfeRpcProviderSubscribeChanges",
|
|
"BfeRpcProviderUnsubscribeChanges",
|
|
"BfeRpcProviderSubscriptionsGet",
|
|
"BfeRpcProviderContextAdd",
|
|
"BfeRpcProviderContextDeleteById",
|
|
"BfeRpcProviderContextDeleteByKey",
|
|
"BfeRpcProviderContextGetById",
|
|
"BfeRpcProviderContextGetByKey",
|
|
"BfeRpcProviderContextCreateEnumHandle",
|
|
"BfeRpcAleEndpointEnum",
|
|
"BfeRpcAleEndpointDestroyEnumHandle",
|
|
"BfeRpcProviderContextGetSecurityInfoByKey",
|
|
"BfeRpcProviderContextSetSecurityInfoByKey",
|
|
"BfeRpcProviderContextSubscribeChanges",
|
|
"BfeRpcProviderContextUnsubscribeChanges",
|
|
"BfeRpcProviderContextSubscriptionsGet",
|
|
"BfeRpcSubLayerAdd",
|
|
"BfeRpcSubLayerDeleteByKey",
|
|
"BfeRpcSubLayerGetByKey",
|
|
"BfeRpcSubLayerCreateEnumHandle",
|
|
"BfeRpcAleEndpointEnum",
|
|
"BfeRpcAleEndpointDestroyEnumHandle",
|
|
"BfeRpcSubLayerGetSecurityInfoByKey",
|
|
"BfeRpcSubLayerSetSecurityInfoByKey",
|
|
"BfeRpcSubLayerSubscribeChanges",
|
|
"BfeRpcSubLayerUnsubscribeChanges",
|
|
"BfeRpcSubLayerSubscriptionsGet",
|
|
"BfeRpcLayerGetById",
|
|
"BfeRpcLayerGetByKey",
|
|
"BfeRpcLayerCreateEnumHandle",
|
|
"BfeRpcAleEndpointEnum",
|
|
"BfeRpcAleEndpointDestroyEnumHandle",
|
|
"BfeRpcLayerGetSecurityInfoByKey",
|
|
"BfeRpcLayerSetSecurityInfoByKey",
|
|
"BfeRpcCalloutAdd",
|
|
"BfeRpcCalloutDeleteById",
|
|
"BfeRpcCalloutDeleteByKey",
|
|
"BfeRpcCalloutGetById",
|
|
"BfeRpcCalloutGetByKey",
|
|
"BfeRpcCalloutCreateEnumHandle",
|
|
"BfeRpcAleEndpointEnum",
|
|
"BfeRpcAleEndpointDestroyEnumHandle",
|
|
"BfeRpcCalloutGetSecurityInfoByKey",
|
|
"BfeRpcCalloutSetSecurityInfoByKey",
|
|
"BfeRpcCalloutSubscribeChanges",
|
|
"BfeRpcCalloutUnsubscribeChanges",
|
|
"BfeRpcCalloutSubscriptionsGet",
|
|
"BfeRpcFilterAdd",
|
|
"BfeRpcFilterDeleteById",
|
|
"BfeRpcFilterDeleteByKey",
|
|
"BfeRpcFilterGetById",
|
|
"BfeRpcFilterGetByKey",
|
|
"BfeRpcFilterCreateEnumHandle",
|
|
"BfeRpcAleEndpointEnum",
|
|
"BfeRpcAleEndpointDestroyEnumHandle",
|
|
"BfeRpcFilterGetSecurityInfoByKey",
|
|
"BfeRpcFilterSetSecurityInfoByKey",
|
|
"BfeRpcFilterSubscribeChanges",
|
|
"BfeRpcFilterUnsubscribeChanges",
|
|
"BfeRpcFilterSubscriptionsGet",
|
|
"BfeRpcBfeIPsecOffloadDone",
|
|
"BfeRpcBfeIPsecDosFWUsed",
|
|
"BfeRpcBfeIPsecGetStatistics",
|
|
"BfeRpcBfeIPsecSaContextCreate",
|
|
"BfeRpcBfeIPsecSaContextDeleteById",
|
|
"BfeRpcBfeIPsecSaContextGetById",
|
|
"BfeRpcBfeIPsecSaContextGetOrSetSpi",
|
|
"BfeRpcBfeIPsecSaContextAddInbound",
|
|
"BfeRpcBfeIPsecSaContextAddOutbound",
|
|
"BfeRpcBfeIPsecSaContextUpdate",
|
|
"BfeRpcBfeIPsecSaContextExpire",
|
|
"BfeRpcBfeIPsecSaContextCreateEnumHandle",
|
|
"BfeRpcAleEndpointEnum",
|
|
"BfeRpcAleEndpointDestroyEnumHandle",
|
|
"BfeRpcBfeIPsecSaContextSubscribe",
|
|
"BfeRpcBfeIPsecSaContextUnsubscribe",
|
|
"BfeRpcBfeIPsecSaContextSubscriptionsGet",
|
|
"BfeRpcBfeIPsecSaCreateEnumHandle",
|
|
"BfeRpcAleEndpointEnum",
|
|
"BfeRpcAleEndpointDestroyEnumHandle",
|
|
"BfeRpcBfeIPsecSaDbGetSecurityInfo",
|
|
"BfeRpcBfeIPsecSaDbSetSecurityInfo",
|
|
"BfeRpcBfeIPsecDospGetStatistics",
|
|
"BfeRpcBfeIPsecDospStateCreateEnumHandle",
|
|
"BfeRpcAleEndpointEnum",
|
|
"BfeRpcBfeIPsecDospStateDestroyEnumHandle",
|
|
"BfeRpcBfeIPsecDospGetSecurityInfo",
|
|
"BfeRpcBfeIPsecDospSetSecurityInfo",
|
|
"BfeRpcNetEventCreateEnumHandle",
|
|
"BfeRpcAleEndpointEnum",
|
|
"BfeRpcAleEndpointDestroyEnumHandle",
|
|
"BfeRpcNetEventsGetSecurityInfo",
|
|
"BfeRpcNetEventsSetSecurityInfo",
|
|
"BfeRpcNetEventSubscribe",
|
|
"BfeRpcNetEventUnsubscribe",
|
|
"BfeRpcNetEventSubscriptionsGet",
|
|
"BfeRpcNetEventsLost",
|
|
"BfeRpcConnectionGetById",
|
|
"BfeRpcConnectionGetByIPsecInfo",
|
|
"BfeRpcConnectionGetByS2STunnelId",
|
|
"BfeRpcConnectionCreateEnumHandle",
|
|
"BfeRpcAleEndpointEnum",
|
|
"BfeRpcAleEndpointDestroyEnumHandle",
|
|
"BfeRpcConnectionGetSecurityInfo",
|
|
"BfeRpcConnectionSetSecurityInfo",
|
|
"BfeRpcConnectionGetS2STunnelId",
|
|
"BfeRpcConnectionSubscribe",
|
|
"BfeRpcConnectionUnsubscribe",
|
|
"BfeRpcConnectionSubscriptionsGet",
|
|
"BfeRpcConnectionsLost",
|
|
"BfeRpcClassify",
|
|
"BfeRpcAddLayerReplica",
|
|
"BfeRpcDeleteLayerReplica",
|
|
"BfeRpcSecureSocketAdd",
|
|
"BfeRpcBfeIPsecTunnelDeleteByKey",
|
|
"BfeRpcBfeIPsecTunnelAdd",
|
|
"BfeRpcBfeIPsecTunnelAddConditions",
|
|
"BfeRpcBfeIPsecS2STunnelAddConditions",
|
|
"BfeRpcBfeIPsecS2STunnelRemoveConditions",
|
|
"BfeRpcBfeIPsecTunnelDeleteByKey",
|
|
"BfeRpcBfeIPsecS2STunnelAddInterfaceToCompartment",
|
|
"BfeRpcBfeIPsecS2STunnelGetInterfaceForCompartment",
|
|
"BfeRpcBfeIPsecS2STunnelRemoveInterfaceFromCompartment",
|
|
"BfeRpcBfeIPsecSaInitiateAsync",
|
|
"BfeRpcOpenToken",
|
|
"BfeRpcCloseToken",
|
|
"BfeRpcAleExplicitCredentialsQuery",
|
|
"BfeRpcAleEndpointGetById",
|
|
"BfeRpcAleEndpointCreateEnumHandle",
|
|
"BfeRpcAleEndpointEnum",
|
|
"BfeRpcAleEndpointDestroyEnumHandle",
|
|
"BfeRpcAleEndpointGetSecurityInfo",
|
|
"BfeRpcAleEndpointSetSecurityInfo",
|
|
"BfeRpcAleGetPortStatus",
|
|
"BfeRpcIsUserAuthConfigured",
|
|
"BfeRpcKeyModuleAdd",
|
|
"BfeRpcKeyModuleDeleteByKey",
|
|
"BfeRpcKeyModuleUpdateAcquire",
|
|
"BfeRpcKeyDictatorCheck",
|
|
"BfeRpcGetKeyFromDictator",
|
|
"BfeRpcNotifyKey",
|
|
"BfeRpcKeyManagerAdd",
|
|
"BfeRpcKeyManagerDeleteByKey",
|
|
"BfeRpcKeyManagersGet",
|
|
"BfeRpcKeyManagerGetSecurityInfoByKey",
|
|
"BfeRpcKeyManagerSetSecurityInfoByKey",
|
|
"BfeRpcvSwitchEventFire",
|
|
"BfeRpcvSwitchEventsGetSecurityInfo",
|
|
"BfeRpcvSwitchEventsSetSecurityInfo",
|
|
"BfeRpcvSwitchEventSubscribe",
|
|
"BfeRpcvSwitchEventUnsubscribe",
|
|
"BfeRpcvSwitchEventSubscriptionsGet",
|
|
"BfeRpcBfeIPsecDriverInitiateAcquire",
|
|
"BfeRpcBfeIPsecDriverExpire",
|
|
"BfeRpcBfeIPsecDriverSaOffloaded",
|
|
"BfeRpcBfeIPsecDriverProcessClearTextResponse",
|
|
"BfeRpcBfeProcessNameResolutionEvent",
|
|
"BfeRpcVpnTriggerEventFire",
|
|
"BfeRpcVpnTriggerEventSubscribe",
|
|
"BfeRpcVpnTriggerEventUnsubscribe",
|
|
"BfeRpcVpnTriggerAddAppSids",
|
|
"BfeRpcVpnTriggerRemoveAppSids",
|
|
"BfeRpcVpnTriggerAddFilePaths",
|
|
"BfeRpcVpnTriggerRemoveFilePaths",
|
|
"BfeRpcVpnTriggerAddSecurityDescriptor",
|
|
"BfeRpcVpnTriggerRemoveSecurityDescriptor",
|
|
"BfeRpcVpnTriggerSetStateDisconnected",
|
|
"BfeRpcVpnTriggerInitializeNrptTriggering",
|
|
"BfeRpcVpnTriggerUninitializeNrptTriggering",
|
|
"BfeRpcVpnTriggerResetNrptTriggering",
|
|
"BfeRpcVpnTriggerConfigureParameters",
|
|
"BfeRpcBitmapIndexGet",
|
|
"BfeRpcBitmapIndexFree"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140708010958864,
|
|
"Service": "BFE",
|
|
"IsServiceRunning": true
|
|
},
|
|
"43890c94-bfd7-4655-ad6a-b4a68397cdcb": {
|
|
"Module": "PimIndexMaintenance.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\PimIndexMaintenance.dll",
|
|
"InterfaceId": "43890c94-bfd7-4655-ad6a-b4a68397cdcb",
|
|
"InterfaceStructOffset": 146912,
|
|
"ProceduresCount": 14,
|
|
"Procedures": [
|
|
"PimIMService_UpdateStores",
|
|
"PimIMService_UpdateItems",
|
|
"PimIMService_RebuildAggregateCache",
|
|
"PimIMService_Suspend",
|
|
"PimIMService_Resume",
|
|
"PimIMService_CacheAggregateCacheFileMapping",
|
|
"PimIMService_LoadAggregateCache",
|
|
"PimIMService_CreateIndexedFilter",
|
|
"PimIMService_SetStaticFilter",
|
|
"PimIMService_GetIndexedProperties",
|
|
"PimIMService_FindNextServerMatch",
|
|
"PimIMService_SetFilter",
|
|
"PimIMService_Reset",
|
|
"PimIMService_CloseIndexedFilter"
|
|
],
|
|
"ProcStackSize": 8,
|
|
"DispatchFunction": 140706806864608,
|
|
"Service": "PimIndexMaintenanceSvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"4f32adc8-6052-4a04-8701-293ccf2096f0": {
|
|
"Module": "sspicli.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\sspicli.dll",
|
|
"InterfaceId": "4f32adc8-6052-4a04-8701-293ccf2096f0",
|
|
"InterfaceStructOffset": 123584,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"SspiClientCallback"
|
|
],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140708155972640,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"0b6edbfa-4a24-4fc6-8a23-942b1eca65d1": {
|
|
"Module": "spoolsv.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\spoolsv.exe",
|
|
"InterfaceId": "0b6edbfa-4a24-4fc6-8a23-942b1eca65d1",
|
|
"InterfaceStructOffset": 476336,
|
|
"ProceduresCount": 7,
|
|
"Procedures": [
|
|
"IRPCAsyncNotify_RegisterClient",
|
|
"IRPCAsyncNotify_UnregisterClient",
|
|
"IRPCAsyncNotify_GetServerRefferal",
|
|
"IRPCAsyncNotify_GetNewChannel",
|
|
"IRPCAsyncNotify_GetNotificationSendResponse",
|
|
"IRPCAsyncNotify_GetNotification",
|
|
"IRPCAsyncNotify_CloseChannel"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140698296497952,
|
|
"Service": "Spooler",
|
|
"IsServiceRunning": true
|
|
},
|
|
"c59c3bf4-7812-43e9-bc34-d369f1cf8416": {
|
|
"Module": "webplatstorageserver.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\webplatstorageserver.dll",
|
|
"InterfaceId": "c59c3bf4-7812-43e9-bc34-d369f1cf8416",
|
|
"InterfaceStructOffset": 943808,
|
|
"ProceduresCount": 4,
|
|
"Procedures": [
|
|
"s_WebPlatStorageEvents_CreateChannel",
|
|
"s_WebPlatStorageEvents_WaitForEvents",
|
|
"s_WebPlatStorageEvents_CloseChannel",
|
|
"s_WebPlatStorageEvents_Shutdown"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140706992862736,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"58b2a725-c4e2-43f0-956f-d9c3b6fa0c8b": {
|
|
"Module": "moshost.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\moshost.dll",
|
|
"InterfaceId": "58b2a725-c4e2-43f0-956f-d9c3b6fa0c8b",
|
|
"InterfaceStructOffset": 56432,
|
|
"ProceduresCount": 18,
|
|
"Procedures": [
|
|
"MosHostCreateContext",
|
|
"MosHostCloseContext",
|
|
"MosHostGetDataDirectory",
|
|
"MosHostGetResourceDirectory",
|
|
"MosHostGetBrowseCacheSizeInMBytes",
|
|
"MosHostCacheStateGetSizes",
|
|
"MosHostCacheStateGetSizes",
|
|
"MosHostCacheStateGetSizes",
|
|
"MosHostCacheStateGetSizes",
|
|
"MosHostCacheStateGetSizes",
|
|
"MosHostCacheStateGetSizes",
|
|
"MosHostCacheStateGetSizes",
|
|
"MosHostCacheStateGetSizes",
|
|
"MosHostCacheStateGetSizes",
|
|
"MosHostCacheStateGetSizes",
|
|
"MosHostGetDataAsync",
|
|
"MosHostDeleteDataAsync",
|
|
"MosHostGetCopyrightString"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140707880916016,
|
|
"Service": "MapsBroker",
|
|
"IsServiceRunning": false
|
|
},
|
|
"0d3e2735-cea0-4ecc-a9e2-41a2d81aed4e": {
|
|
"Module": "bisrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\bisrv.dll",
|
|
"InterfaceId": "0d3e2735-cea0-4ecc-a9e2-41a2d81aed4e",
|
|
"InterfaceStructOffset": 551488,
|
|
"ProceduresCount": 24,
|
|
"Procedures": [
|
|
"RBiPtSrvActivateDeferredWorkItem",
|
|
"RBiPtSrvActivateInBackground",
|
|
"RBiPtSrvActivateWorkItem",
|
|
"RBiPtSrvAssociateActivationProxy",
|
|
"RBiPtSrvAssociateApplicationEntryPoint",
|
|
"RBiPtSrvCancelWorkItem",
|
|
"RBiPtSrvCreateEvent",
|
|
"RBiPtSrvCreateEventForApp",
|
|
"RBiPtSrvCreateEventForPackageName",
|
|
"RBiPtSrvDeleteEvent",
|
|
"RBiPtSrvDisableWorkItem",
|
|
"RBiPtSrvDisassociateWorkItem",
|
|
"RBiPtSrvEnableWorkItem",
|
|
"RBiPtSrvEnumerateBrokeredEvents",
|
|
"RBiPtSrvEnumerateWorkItemsForPackageName",
|
|
"RBiPtSrvGetStatusStateNameFromBrokerEventId",
|
|
"RBiPtSrvQueryBrokeredEvent",
|
|
"RBiPtSrvQueryBrokerEventId",
|
|
"RBiPtSrvQuerySystemStateBroadcastChannels",
|
|
"RBiPtSrvQueryWorkItem",
|
|
"RBiPtSrvQueryWorkItemStatusStateName",
|
|
"RBiPtSrvSignalEvent",
|
|
"RBiPtSrvSignalMultipleEvents",
|
|
"RBiPtSrvSignalTriggerEvent"
|
|
],
|
|
"ProcStackSize": 64,
|
|
"DispatchFunction": 140708131130896,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"3d27921d-9a28-483f-a749-a48fde7d0c5f": {
|
|
"Module": "DeviceSetupManager.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\DeviceSetupManager.dll",
|
|
"InterfaceId": "3d27921d-9a28-483f-a749-a48fde7d0c5f",
|
|
"InterfaceStructOffset": 168128,
|
|
"ProceduresCount": 9,
|
|
"Procedures": [
|
|
"DsmRpcRefreshAllDevices",
|
|
"DsmRpcRefreshDevice",
|
|
"DsmRpcSetInstallBehavior",
|
|
"DsmRpcGetInstallBehavior",
|
|
"DsmRpcUnelevatedRemoveDevice",
|
|
"DsmRpcWaitServiceReady",
|
|
"DsmRpcSetCostedNetworkPolicy",
|
|
"DsmRpcRegisterDcaStateName",
|
|
"DsmRpcSetPairingUXInfo"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140707581089360,
|
|
"Service": "DsmSvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"8a7b5006-cc13-11db-9705-005056c00008": {
|
|
"Module": "appidsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\appidsvc.dll",
|
|
"InterfaceId": "8a7b5006-cc13-11db-9705-005056c00008",
|
|
"InterfaceStructOffset": 53904,
|
|
"ProceduresCount": 4,
|
|
"Procedures": [
|
|
"AppIDRpcVerifyFile",
|
|
"AppIDRpcVerifyPackageMoniker",
|
|
"AppIDRpcOnCreateProcess",
|
|
"AppIDRpcOnCreateFile"
|
|
],
|
|
"ProcStackSize": 72,
|
|
"DispatchFunction": 140707880933984,
|
|
"Service": "AppIDSvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"8ec21e98-b5ce-4916-a3d6-449fa428a007": {
|
|
"Module": "modernexecserver.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\modernexecserver.dll",
|
|
"InterfaceId": "8ec21e98-b5ce-4916-a3d6-449fa428a007",
|
|
"InterfaceStructOffset": 324304,
|
|
"ProceduresCount": 24,
|
|
"Procedures": [
|
|
"FmMuxSrvRegisterCoreUIEndpoints",
|
|
"FmMuxSrvGenerateTaskInstanceId",
|
|
"FmMuxSrvLaunchTask",
|
|
"FmMuxSrvResumeTask",
|
|
"FmMuxSrvPauseTask",
|
|
"FmMuxSrvCancelTask",
|
|
"FmMuxSrvAbortTask",
|
|
"FmMuxSrvGetTaskPid",
|
|
"FmMuxSrvSetTaskDehydrationEligibility",
|
|
"FmMuxSrvSetTaskProperty",
|
|
"FmMuxSrvResolveApplicationUri",
|
|
"FmMuxSrvGetActivationPolicy",
|
|
"FmMuxSrvLogoffUser",
|
|
"FmMuxSrvShutdown",
|
|
"FmMuxSrvSetForegroundTaskInstanceId",
|
|
"FmMuxSrvGenerateActivationInstanceId",
|
|
"FmMuxSrvActivationPrerequisitePhase",
|
|
"FmMuxSrvIsCBETask",
|
|
"FmMuxSrvIsValidTaskPid",
|
|
"FmMuxSrvResumePrerequisitePhase",
|
|
"FmMuxSrvGetForegroundTaskInstanceId",
|
|
"FmMuxSrvActivationBypass",
|
|
"FmMuxSrvIsActivationDehydrated",
|
|
"FmMuxSrvRequestResourceSet"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140707571598128,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"69c09ea0-4a09-101b-ae4b-08002b349a02": {
|
|
"Module": "combase.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\combase.dll",
|
|
"InterfaceId": "69c09ea0-4a09-101b-ae4b-08002b349a02",
|
|
"InterfaceStructOffset": 2338480,
|
|
"ProceduresCount": 0,
|
|
"Procedures": [],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140708189286624,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"338cd001-2244-31f1-aaaa-900038001003": {
|
|
"Module": "regsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\regsvc.dll",
|
|
"InterfaceId": "338cd001-2244-31f1-aaaa-900038001003",
|
|
"InterfaceStructOffset": 124320,
|
|
"ProceduresCount": 36,
|
|
"Procedures": [
|
|
"OpenClassesRoot",
|
|
"OpenCurrentUser",
|
|
"OpenLocalMachine",
|
|
"OpenPerformanceData",
|
|
"OpenUsers",
|
|
"BaseRegCloseKey",
|
|
"BaseRegCreateKey",
|
|
"BaseRegDeleteKey",
|
|
"BaseRegDeleteValue",
|
|
"SafeBaseRegEnumKey",
|
|
"SafeBaseRegEnumValue",
|
|
"BaseRegFlushKey",
|
|
"SafeBaseRegGetKeySecurity",
|
|
"BaseRegLoadKey",
|
|
"BaseRegNotifyChangeKeyValue",
|
|
"BaseRegOpenKey",
|
|
"SafeBaseRegQueryInfoKey",
|
|
"BaseRegQueryValue",
|
|
"BaseRegReplaceKey",
|
|
"BaseRegRestoreKey",
|
|
"BaseRegSaveKey",
|
|
"BaseRegSetKeySecurity",
|
|
"BaseRegSetValue",
|
|
"BaseRegUnLoadKey",
|
|
"BaseAbortSystemShutdown",
|
|
"BaseAbortSystemShutdown",
|
|
"BaseRegGetVersion",
|
|
"OpenCurrentConfig",
|
|
"BaseAbortSystemShutdown",
|
|
"SafeBaseRegQueryMultipleValues",
|
|
"BaseAbortSystemShutdown",
|
|
"BaseRegSaveKeyEx",
|
|
"OpenPerformanceText",
|
|
"OpenPerformanceNlsText",
|
|
"SafeBaseRegQueryMultipleValues2",
|
|
"BaseRegDeleteKeyEx"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140707581092976,
|
|
"Service": "RemoteRegistry",
|
|
"IsServiceRunning": false
|
|
},
|
|
"a4b8d482-80ce-40d6-934d-b22a01a44fe7": {
|
|
"Module": "LicenseManagerSvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\LicenseManagerSvc.dll",
|
|
"InterfaceId": "a4b8d482-80ce-40d6-934d-b22a01a44fe7",
|
|
"InterfaceStructOffset": 28672,
|
|
"ProceduresCount": 8,
|
|
"Procedures": [
|
|
"BeginAcquireLicense",
|
|
"PrecacheLicenseForPackageResume",
|
|
"EnsureLicenseForPackageActivation",
|
|
"EnsureLicenseForOptionalPackageUsage",
|
|
"PackageSuspendedNotification",
|
|
"PackageRundownNotification",
|
|
"OptionalPackageRundownNotification",
|
|
"Reset"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140707877972720,
|
|
"Service": "LicenseManager",
|
|
"IsServiceRunning": true
|
|
},
|
|
"0ff1f646-13bb-400a-ab50-9a78f2b7a85a": {
|
|
"Module": "PsmServiceExtHost.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\PsmServiceExtHost.dll",
|
|
"InterfaceId": "0ff1f646-13bb-400a-ab50-9a78f2b7a85a",
|
|
"InterfaceStructOffset": 568704,
|
|
"ProceduresCount": 3,
|
|
"Procedures": [
|
|
"HamRpcSrvFindOrCreateHostId",
|
|
"HamRpcSrvCreateSingleUseHostId",
|
|
"HamRpcSrvRetrieveDynamicIdForHostId"
|
|
],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140708133284816,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"b12fd546-c875-4b41-97d8-950487662202": {
|
|
"Module": "SessEnv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\SessEnv.dll",
|
|
"InterfaceId": "b12fd546-c875-4b41-97d8-950487662202",
|
|
"InterfaceStructOffset": 334048,
|
|
"ProceduresCount": 9,
|
|
"Procedures": [
|
|
"RpcCreateUserVhdTemplate",
|
|
"RpcGetCreateUserProfileVhd",
|
|
"RpcDestroyUserProfileVhd",
|
|
"RpcRepairUserProfileVhd",
|
|
"RpcReEncryptUserCredential",
|
|
"RpcDeleteFileFromVHD",
|
|
"RpcSetupVhdForRdv",
|
|
"RpcCopyRdvFolderFromVhdToHost",
|
|
"RpcQueryVhdOfflineInformation"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140708025006864,
|
|
"Service": "SessionEnv",
|
|
"IsServiceRunning": true
|
|
},
|
|
"0a533b58-0ed9-4085-b6e8-95795e147972": {
|
|
"Module": "Microsoft.Bluetooth.Service.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\Microsoft.Bluetooth.Service.dll",
|
|
"InterfaceId": "0a533b58-0ed9-4085-b6e8-95795e147972",
|
|
"InterfaceStructOffset": 3123168,
|
|
"ProceduresCount": 20,
|
|
"Procedures": [
|
|
"s_RpcBluetoothGattGetServicesCount",
|
|
"s_RpcBluetoothGattGetServices",
|
|
"s_RpcBluetoothGattGetIncludedServicesCount",
|
|
"s_RpcBluetoothGattGetIncludedServices",
|
|
"s_RpcBluetoothGattGetCharacteristicsCount",
|
|
"s_RpcBluetoothGattGetCharacteristics",
|
|
"s_RpcBluetoothGattGetDescriptorsCount",
|
|
"s_RpcBluetoothGattGetDescriptors",
|
|
"s_RpcBluetoothGattGetCharacteristicValueSize",
|
|
"s_RpcBluetoothGattGetCharacteristicValue",
|
|
"s_RpcBluetoothGattGetDescriptorValueSize",
|
|
"s_RpcBluetoothGattGetDescriptorValue",
|
|
"s_RpcBluetoothGattSetCharacteristicValue",
|
|
"s_RpcBluetoothGattSetDescriptorValue",
|
|
"s_RpcBluetoothGattBeginReliableWrite",
|
|
"s_RpcBluetoothGattEndReliableWrite",
|
|
"s_RpcBluetoothGattAbortReliableWrite",
|
|
"s_RpcBluetoothGattRegisterEvent",
|
|
"s_RpcBluetoothGattUnregisterEvent",
|
|
"s_RpcBluetoothGattGetEvents"
|
|
],
|
|
"ProcStackSize": 72,
|
|
"DispatchFunction": 140707091139984,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"12b81e99-f207-4a4c-85d3-77b42f76fd14": {
|
|
"Module": "seclogon.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\seclogon.dll",
|
|
"InterfaceId": "12b81e99-f207-4a4c-85d3-77b42f76fd14",
|
|
"InterfaceStructOffset": 20480,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"SeclCreateProcessWithLogonW"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140708037791760,
|
|
"Service": "seclogon",
|
|
"IsServiceRunning": false
|
|
},
|
|
"ae55c4c0-64ce-11dd-ad8b-0800200c9a66": {
|
|
"Module": "bdesvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\bdesvc.dll",
|
|
"InterfaceId": "ae55c4c0-64ce-11dd-ad8b-0800200c9a66",
|
|
"InterfaceStructOffset": 405616,
|
|
"ProceduresCount": 13,
|
|
"Procedures": [
|
|
"BdeSvcApipAddRecoveryPassword",
|
|
"BdeSvcApipConversionEncrypt",
|
|
"BdeSvcApipEventTrigger",
|
|
"BdeSvcApipChangeProtector",
|
|
"BdeSvcApipConversionEncryptEx",
|
|
"BdeSvcApipCheckADSchema",
|
|
"BdeSvcApipQueryCachedEASProtectionStatus",
|
|
"BdeSvcApipDoTurnOnDeviceEncryption",
|
|
"BdeSvcApipEnableSilentDeviceEncryption",
|
|
"BdeSvcApipEnableSilentBitLocker",
|
|
"BdeSvcApipIsEncryptableFDVPresent",
|
|
"BdeSvcApipRotateRecoveryPasswords",
|
|
"BdeSvcApipGetRotateRecoveryPasswordsStatus"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140707580956464,
|
|
"Service": "BDESVC",
|
|
"IsServiceRunning": false
|
|
},
|
|
"201ef99a-7fa0-444c-9399-19ba84f12a1a": {
|
|
"Module": "appinfo.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\appinfo.dll",
|
|
"InterfaceId": "201ef99a-7fa0-444c-9399-19ba84f12a1a",
|
|
"InterfaceStructOffset": 106880,
|
|
"ProceduresCount": 7,
|
|
"Procedures": [
|
|
"RAiLaunchAdminProcess",
|
|
"RAiProcessRunOnce",
|
|
"RAiLogonWithSmartCardCreds",
|
|
"RAiOverrideDesktopPromptPolicy",
|
|
"RAiDisableElevationForSession",
|
|
"RAiEnableElevationForSession",
|
|
"RAiForceElevationPromptForCOM"
|
|
],
|
|
"ProcStackSize": 112,
|
|
"DispatchFunction": 140707486597008,
|
|
"Service": "Appinfo",
|
|
"IsServiceRunning": true
|
|
},
|
|
"43d210c2-4dfb-44d0-ab40-31aab2e980f3": {
|
|
"Module": "ByteCodeGenerator.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\ByteCodeGenerator.exe",
|
|
"InterfaceId": "43d210c2-4dfb-44d0-ab40-31aab2e980f3",
|
|
"InterfaceStructOffset": 46560,
|
|
"ProceduresCount": 2,
|
|
"Procedures": [
|
|
"ShutdownRpcServer",
|
|
"GenerateByteCodeForPackage"
|
|
],
|
|
"ProcStackSize": 88,
|
|
"DispatchFunction": 140696553727600,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"c0e9671e-33c6-4438-9464-56b2e1b1c7b4": {
|
|
"Module": "wbiosrvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\wbiosrvc.dll",
|
|
"InterfaceId": "c0e9671e-33c6-4438-9464-56b2e1b1c7b4",
|
|
"InterfaceStructOffset": 686832,
|
|
"ProceduresCount": 43,
|
|
"Procedures": [
|
|
"WinBioSrvOpenFrameworkSession",
|
|
"WinBioSrvCloseFrameworkSession",
|
|
"WinBioSrvEnumBiometricUnits",
|
|
"WinBioSrvEnumServiceProviders",
|
|
"WinBioSrvMonitorFrameworkChanges",
|
|
"WinBioSrvOpenBiometricSession",
|
|
"WinBioSrvCloseBiometricSession",
|
|
"WinBioSrvCancel",
|
|
"WinBioSrvVerify",
|
|
"WinBioSrvIdentify",
|
|
"WinBioSrvVerifyAndReleaseTicket",
|
|
"WinBioSrvIdentifyAndReleaseTicket",
|
|
"WinBioSrvLocateSensor",
|
|
"WinBioSrvEnrollAuthorize",
|
|
"WinBioSrvEnrollRevoke",
|
|
"WinBioSrvEnrollBegin",
|
|
"WinBioSrvEnrollSelect",
|
|
"WinBioSrvEnrollCapture",
|
|
"WinBioSrvEnrollCommit",
|
|
"WinBioSrvEnrollDiscard",
|
|
"WinBioSrvEnumEnrollments",
|
|
"WinBioSrvGetEvent",
|
|
"WinBioSrvGetPresenceData",
|
|
"WinBioSrvCaptureSample",
|
|
"WinBioSrvDeleteTemplate",
|
|
"WinBioSrvLockUnit",
|
|
"WinBioSrvUnlockUnit",
|
|
"WinBioSrvControlUnit",
|
|
"WinBioSrvControlUnitPrivileged",
|
|
"WinBioSrvGetProperty",
|
|
"WinBioSrvSetProperty",
|
|
"WinBioSrvAcquireFocus",
|
|
"WinBioSrvReleaseFocus",
|
|
"WinBioSrvLogonIdentifiedUser",
|
|
"BioSrvGetLogonUserIdentity",
|
|
"WinBioSrvProtectData",
|
|
"WinBioSrvUnprotectData",
|
|
"WinBioSrvDiscardTicket",
|
|
"WinBioSrvGetGestureMetadata",
|
|
"WinBioSrvNgcOpenAuthorizationSession",
|
|
"WinBioSrvNgcAuthorizeEnrollment",
|
|
"WinBioSrvNgcCloseAuthorizationSession",
|
|
"WinBioSrvNgcGetAuthorizationWithTicket"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140707487243712,
|
|
"Service": "WbioSrvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"7ea70bcf-48af-4f6a-8968-6a440754d5fa": {
|
|
"Module": "nsisvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\nsisvc.dll",
|
|
"InterfaceId": "7ea70bcf-48af-4f6a-8968-6a440754d5fa",
|
|
"InterfaceStructOffset": 20480,
|
|
"ProceduresCount": 9,
|
|
"Procedures": [
|
|
"RpcNsiGetParameter",
|
|
"RpcNsiGetAllParameters",
|
|
"RpcNsiEnumerateObjectsAllParameters",
|
|
"RpcNsiSetParameter",
|
|
"RpcNsiSetAllParameters",
|
|
"RpcNsiRegisterChangeNotification",
|
|
"RpcNsiDeregisterChangeNotification",
|
|
"RpcNsiRequestChangeNotification",
|
|
"RpcNsiParameterChange"
|
|
],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140708082684992,
|
|
"Service": "nsi",
|
|
"IsServiceRunning": true
|
|
},
|
|
"afc07e2e-311c-4435-808c-c483ffeec7c9": {
|
|
"Module": "lsasrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\lsasrv.dll",
|
|
"InterfaceId": "afc07e2e-311c-4435-808c-c483ffeec7c9",
|
|
"InterfaceStructOffset": 1269952,
|
|
"ProceduresCount": 3,
|
|
"Procedures": [
|
|
"LsarGetAvailableCAPIDs",
|
|
"LsarSetCAPs",
|
|
"LsarQueryCAPs"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140708154023936,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"95406f0b-b239-4318-91bb-cea3a46ff0dc": {
|
|
"Module": "PsmServiceExtHost.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\PsmServiceExtHost.dll",
|
|
"InterfaceId": "95406f0b-b239-4318-91bb-cea3a46ff0dc",
|
|
"InterfaceStructOffset": 568896,
|
|
"ProceduresCount": 7,
|
|
"Procedures": [
|
|
"HamRpcSrvConnectServicing",
|
|
"HamRpcSrvDisconnect",
|
|
"HamRpcSrvFullTrustOpenPackageHandle",
|
|
"HamRpcSrvDebugClosePackageHandle",
|
|
"HamRpcSrvServicingQueryActiveAppsInPackage",
|
|
"HamRpcSrvServicingEnableServicing",
|
|
"HamRpcSrvDebugTerminatePackage"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140708133772720,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"e5b92378-0c65-442c-a66b-f9714d2d7b00": {
|
|
"Module": "Spectrum.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\Spectrum.exe",
|
|
"InterfaceId": "e5b92378-0c65-442c-a66b-f9714d2d7b00",
|
|
"InterfaceStructOffset": 729008,
|
|
"ProceduresCount": 44,
|
|
"Procedures": [
|
|
"S_System_Internal_Connect",
|
|
"S_System_Internal_Disconnect",
|
|
"S_System_Internal_DrainSensorData",
|
|
"S_System_Internal_SetSensorRefs",
|
|
"S_Internal_HeadTracker_GetAugmentedPoseForTime",
|
|
"S_Internal_HeadTracker_GenerateRenderingMetadataForPose",
|
|
"S_Internal_HeadTracker_GetHeTLayoutBuffer",
|
|
"S_Debug_GetAnchorStatistics",
|
|
"S_Debug_GetHeTMapAndLocationData",
|
|
"S_Debug_GetHeTDepthData",
|
|
"S_Debug_GetAppSpatialAnchors",
|
|
"S_Light_GetSensorData",
|
|
"S_Environment_GetCurrent",
|
|
"S_Environment_SetCurrent",
|
|
"S_Environment_GetAvailable",
|
|
"S_Environment_Delete",
|
|
"S_Environment_SetMetadata",
|
|
"S_Environment_IsMapLocked",
|
|
"S_Environment_LockCurrentMap",
|
|
"S_Environment_UnlockCurrentMap",
|
|
"S_Environment_SaveCurrentMap",
|
|
"S_Environment_LoadMap",
|
|
"S_Environment_DeleteMap",
|
|
"S_Environment_DeleteSpatialNeighborhoodForSpatialAnchors",
|
|
"S_Environment_DeleteSpatialNeighborhoodForAllSpatialAnchors",
|
|
"S_Stage_SetCurrent",
|
|
"S_Stage_SetCurrentNull",
|
|
"S_HaT_MiniMonitor_Flush",
|
|
"S_Speech_GetActivationState",
|
|
"S_InternalGestures_SendHome",
|
|
"S_ViewCalibration_CalibrateHeadSize",
|
|
"S_DisplayMetadata_GetClientsAndSharedBuffers",
|
|
"S_Internal_SpatialDevice_FindById",
|
|
"S_Internal_SpatialDevice_GetAllDevices",
|
|
"S_Internal_SpatialDevice_GetOrCreateGlobal",
|
|
"S_Internal_SpatialDevice_CreateAppLocal",
|
|
"S_Internal_SpatialDevice_ComputeSpatialGraphBinding",
|
|
"S_Internal_SpatialDevice_SetDesiredTrackingLevel",
|
|
"S_Internal_SpatialDevice_GetLastKnownTrackerMode",
|
|
"S_Internal_SpatialDevice_GetDynamicNodePoseQueueLayoutBuffer",
|
|
"S_Display_SetMonitors",
|
|
"S_HolographicDevicesError_ToggleSendingUpdates",
|
|
"S_HolographicDevicesError_GetStatus",
|
|
"S_Semantics_CastRay"
|
|
],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140701106677168,
|
|
"Service": "spectrum",
|
|
"IsServiceRunning": false
|
|
},
|
|
"0fc77b1a-95d8-4a2e-a0c0-cff54237462b": {
|
|
"Module": "modernexecserver.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\modernexecserver.dll",
|
|
"InterfaceId": "0fc77b1a-95d8-4a2e-a0c0-cff54237462b",
|
|
"InterfaceStructOffset": 324208,
|
|
"ProceduresCount": 9,
|
|
"Procedures": [
|
|
"FmMuxSrvRegisterFGNotificationCoreUIEndpoint",
|
|
"FmMuxSrvUnRegisterFGNotificationCoreUIEndpoint",
|
|
"FmMuxSrvGetForegroundProductId",
|
|
"FmMuxSrvIsForegroundProductId",
|
|
"FmMuxSrvGetProductIdFromProcessId",
|
|
"FmMuxSrvGenerateWatsonReport",
|
|
"FmMuxSrvGetProcessProductId",
|
|
"FmMuxSrvDehydrateHost",
|
|
"FmMuxSrvIsCallingProcessForeground"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140707571597600,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"266f33b4-c7c1-4bd1-8f52-ddb8f2214eb0": {
|
|
"Module": "wlansvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\wlansvc.dll",
|
|
"InterfaceId": "266f33b4-c7c1-4bd1-8f52-ddb8f2214eb0",
|
|
"InterfaceStructOffset": 2051696,
|
|
"ProceduresCount": 39,
|
|
"Procedures": [
|
|
"RpcLowPrivOpenHandle",
|
|
"RpcLowPrivCloseHandle",
|
|
"RpcLowPrivRegisterNotification",
|
|
"RpcLowPrivAsyncGetNotification",
|
|
"RpcLowPrivSetInterface",
|
|
"RpcLowPrivQueryInterface",
|
|
"RpcLowPrivEnumInterfaces",
|
|
"RpcWfdLowPrivIsWfdSupported",
|
|
"RpcWfdLowPrivOpenHandle",
|
|
"RpcWfdLowPrivCancelOpenSession",
|
|
"RpcWfdLowPrivCloseSession",
|
|
"RpcWfdLowPrivGetSessionEndpointPairs",
|
|
"RpcWfdLowPrivConfigureFirewallForSession",
|
|
"RpcWfdLowPrivOpenLegacySessionWithProfile",
|
|
"RpcWfdLowPrivCloseLegacySession",
|
|
"RpcWfdLowPrivQueryProperty",
|
|
"RpcWfdLowPrivSetProperty",
|
|
"RpcWfdLowPrivStartUsingGroup",
|
|
"RpcWfdLowPrivStopUsingGroup",
|
|
"RpcWlanLowPrivNotifyVsIeProvider",
|
|
"RpcWfdLowPrivOpenSessionByDafObjectId",
|
|
"RpcWfdLowPrivDeclineDeviceApiConnectionRequest",
|
|
"RpcWfdLowPrivStartDeviceApiConnectionRequestListener",
|
|
"RpcWfdLowPrivStopDeviceApiConnectionRequestListener",
|
|
"RpcWFDSvcLowPrivPublishService",
|
|
"RpcWFDSvcLowPrivUnpublishService",
|
|
"RpcWfdSvcLowPrivOpenSeekerSession",
|
|
"RpcWfdSvcLowPrivOpenAdvertiserSession",
|
|
"RpcWfdSvcLowPrivGetProvisioningInfo",
|
|
"RpcWfdSvcLowPrivConnectSession",
|
|
"RpcWfdSvcLowPrivCancelSession",
|
|
"RpcWfdSvcLowPrivAcceptSession",
|
|
"RpcWfdSvcLowPrivConfigureSession",
|
|
"RpcWfdSvcLowPrivCloseSession",
|
|
"RpcWfdSvcLowPrivGetSessionEndpointPairs",
|
|
"RpcWfdLowPrivRegisterVMgrCaller",
|
|
"RpcWfdLowPrivUnregisterVMgrCaller",
|
|
"RpcWlanVMgrQueryCurrentScenarios",
|
|
"RpcWfdLowPrivGetPendingGroupRequestDetails"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140707602716720,
|
|
"Service": "WlanSvc",
|
|
"IsServiceRunning": true
|
|
},
|
|
"8782d3b9-ebbd-4644-a3d8-e8725381919b": {
|
|
"Module": "psmsrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\psmsrv.dll",
|
|
"InterfaceId": "8782d3b9-ebbd-4644-a3d8-e8725381919b",
|
|
"InterfaceStructOffset": 168480,
|
|
"ProceduresCount": 3,
|
|
"Procedures": [
|
|
"PsmSrvRegisterQuiesceResumeApp",
|
|
"PsmSrvQuiesceCallbacksComplete",
|
|
"PsmSrvCloseActivationChannel"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140708134134848,
|
|
"Service": "BrokerInfrastructure",
|
|
"IsServiceRunning": true
|
|
},
|
|
"2e6035b2-e8f1-41a7-a044-656b439c4c34": {
|
|
"Module": "httpprxm.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\httpprxm.dll",
|
|
"InterfaceId": "2e6035b2-e8f1-41a7-a044-656b439c4c34",
|
|
"InterfaceStructOffset": 69904,
|
|
"ProceduresCount": 6,
|
|
"Procedures": [
|
|
"ProxyMgrProviderRegisterForEventNotification",
|
|
"ProxyMgrProviderUnregisterEventNotification",
|
|
"ProxyMgrProviderGetNotification",
|
|
"ProxyMgrGetProxyEventInformation",
|
|
"ProxyMgrSetProxyConfiguration",
|
|
"ProxyMgrSetProxyCredentials"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140707879109728,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"83da4c30-ea3a-11cf-9cc1-08003601e506": {
|
|
"Module": "nfsclnt.exe",
|
|
"ModulePath": "C:\\Windows\\WinSxS\\amd64_microsoft-windows-nfs-clientcore_31bf3856ad364e35_10.0.18362.1714_none_ba50c263a597cfbe\\nfsclnt.exe",
|
|
"InterfaceId": "83da4c30-ea3a-11cf-9cc1-08003601e506",
|
|
"InterfaceStructOffset": 80080,
|
|
"ProceduresCount": 10,
|
|
"Procedures": [
|
|
"Ping",
|
|
"DaRpcAddConnectedDevice",
|
|
"DaRpcRemoveConnectedDevice",
|
|
"DaRpcFetchConnectedDevice",
|
|
"DaRpcFetchConnectionNameForConnectedDevice",
|
|
"DaRpcListConnectedDevice",
|
|
"DaRpcListHostsInLan",
|
|
"DaRpcIsLanName",
|
|
"DaRpcListConfiguredLans",
|
|
"DaRpcGetExportList"
|
|
],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140695726692960,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"4c9dbf19-d39e-4bb9-90ee-8f7179b20283": {
|
|
"Module": "diagtrack.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\diagtrack.dll",
|
|
"InterfaceId": "4c9dbf19-d39e-4bb9-90ee-8f7179b20283",
|
|
"InterfaceStructOffset": 2709472,
|
|
"ProceduresCount": 37,
|
|
"Procedures": [
|
|
"UtcApi_IsScenarioActive",
|
|
"UtcApi_EscalateScenario",
|
|
"UtcApi_EscalateScenarioAsync",
|
|
"UtcApi_IsEscalationRunning",
|
|
"UtcApi_DownloadLatestSettingsForNamespace",
|
|
"UtcApi_DownloadLatestSettingsForNamespaceAsync",
|
|
"UtcApi_GetActiveScenarioList",
|
|
"UtcApi_ForceUpload",
|
|
"UtcApi_ResetUsageMetrics",
|
|
"UtcApi_IsTraceRunning",
|
|
"UtcApi_GetActiveTraceRuntime",
|
|
"UtcApi_GetKnownTraceList",
|
|
"UtcApi_DownloadLatestSettings",
|
|
"UtcApi_ReloadSettings",
|
|
"UtcApi_UpdateTimerConfiguration",
|
|
"UtcApi_ClearTimerConfiguration",
|
|
"UtcApi_GetNextScheduledFireTime",
|
|
"UtcApi_GetTimerConfiguration",
|
|
"UtcApi_GetCustomTraceList",
|
|
"UtcApi_StartCustomTrace",
|
|
"UtcApi_SnapCustomTrace",
|
|
"UtcApi_StopCustomTrace",
|
|
"UtcApi_EscalateScenario2",
|
|
"UtcApi_EscalateScenarioAsync2",
|
|
"UtcApi_GetActiveTraceInfo",
|
|
"UtcApi_EnableWERLocalReports",
|
|
"UtcApi_RestoreWERLocalReportsSettings",
|
|
"UtcApi_QueryWERLocalReportsEnabled",
|
|
"UtcApi_IsEscalationRunningEx",
|
|
"UtcApi_QueryDiagnosticCollectionState",
|
|
"UtcApi_EscalateScenario3",
|
|
"UtcApi_GetIdsFromCategory",
|
|
"UtcApi_GetRunningTraces",
|
|
"UtcApi_GetContextProperty",
|
|
"UtcApi_GetRunningEscalationsForContext",
|
|
"UtcApi_EscalateScenarioAsync3",
|
|
"UtcApi_GetApiVersion"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140707991494352,
|
|
"Service": "DiagTrack",
|
|
"IsServiceRunning": true
|
|
},
|
|
"af1e812f-2d47-4c99-9b36-15984de66d89": {
|
|
"Module": "AppVEntSubsystemController.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\AppVEntSubsystemController.dll",
|
|
"InterfaceId": "af1e812f-2d47-4c99-9b36-15984de66d89",
|
|
"InterfaceStructOffset": 901424,
|
|
"ProceduresCount": 2,
|
|
"Procedures": [
|
|
"vfonts_server_GetListOfVirtualFonts",
|
|
"vfonts_server_StageFontFile"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140706797869280,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"b18fbab6-56f8-4702-84e0-41053293a869": {
|
|
"Module": "usermgr.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\usermgr.dll",
|
|
"InterfaceId": "b18fbab6-56f8-4702-84e0-41053293a869",
|
|
"InterfaceStructOffset": 695952,
|
|
"ProceduresCount": 40,
|
|
"Procedures": [
|
|
"svcQueryUserToken",
|
|
"svcGetConstrainedUserToken",
|
|
"svcIsAllowedToActivateAsUser",
|
|
"svcQueryDefaultAccountToken",
|
|
"svcQuerySessionVirtualAccountToken",
|
|
"svcLaunchShell",
|
|
"svcLaunchShellInfrastructureHost",
|
|
"svcSetShellInformation",
|
|
"svcInformUserLogon",
|
|
"svcInformUserLogoff",
|
|
"svcQueryUserContext",
|
|
"svcUMLogonUser",
|
|
"svcQuerySessionUserToken",
|
|
"svcGetConstrainedUserTokenFromAppcontainer",
|
|
"svcEnumerateSessionUsers",
|
|
"svcQueryUserTokenFromName",
|
|
"svcQueryUserContextFromName",
|
|
"svcQueryUserTokenFromSid",
|
|
"svcQueryUserContextFromSid",
|
|
"svcOpenProcessHandleForAccess",
|
|
"svcOpenProcessTokenForQuery",
|
|
"svcUMSetCachedCredentials",
|
|
"svcUMGetCachedCredentials",
|
|
"svcInformFlags",
|
|
"svcChangeSessionUserToken",
|
|
"svcConnectLocalUser",
|
|
"svcDisconnectLocalUser",
|
|
"svcGetImpersonationTokenForContext",
|
|
"svcGetDefaultSignInAccount",
|
|
"svcClearDefaultSignInAccount",
|
|
"svcGetSessionActiveShellUserToken",
|
|
"svcChangeSessionActiveShellUser",
|
|
"svcIsCandidateUser",
|
|
"svcIsEphemeralCandidateUser",
|
|
"svcGetCandidateAccountCredz",
|
|
"svcConnectCandidateUser",
|
|
"svcGetNonCandidateUserSessionIds",
|
|
"svcGetCandidateUserSessionIds",
|
|
"svcRefreshCandidateUser",
|
|
"svcCleanupDisardedCandidateAccounts"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140708013770016,
|
|
"Service": "UserManager",
|
|
"IsServiceRunning": true
|
|
},
|
|
"41baa680-50ce-4967-a8fa-0596343a7ccf": {
|
|
"Module": "lsasrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\lsasrv.dll",
|
|
"InterfaceId": "41baa680-50ce-4967-a8fa-0596343a7ccf",
|
|
"InterfaceStructOffset": 1327728,
|
|
"ProceduresCount": 2,
|
|
"Procedures": [
|
|
"LsarSetMachineCertificate",
|
|
"LsarDeleteMachineCertificate"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140708153899648,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"04eeb297-cbf4-466b-8a2a-bfd6a2f10bba": {
|
|
"Module": "efssvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\efssvc.dll",
|
|
"InterfaceId": "04eeb297-cbf4-466b-8a2a-bfd6a2f10bba",
|
|
"InterfaceStructOffset": 59200,
|
|
"ProceduresCount": 7,
|
|
"Procedures": [
|
|
"EfsKRpcEstablishRpcConnection",
|
|
"EfsKRpcDecryptFek",
|
|
"EfsKRpcGenerateKey",
|
|
"EfsKRpcGenerateDirEfs",
|
|
"EfsKRpcNotifyEnterpriseFileWrite",
|
|
"EfsKRpcNotifyEnterpriseFileCleanup",
|
|
"EdpKRpcWriteNetworkAppLearningEvt"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140707880079504,
|
|
"Service": "EFS",
|
|
"IsServiceRunning": false
|
|
},
|
|
"945693c4-3648-4966-b2aa-37d66e24495f": {
|
|
"Module": "DMPushRouterCore.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\DMPushRouterCore.dll",
|
|
"InterfaceId": "945693c4-3648-4966-b2aa-37d66e24495f",
|
|
"InterfaceStructOffset": 154144,
|
|
"ProceduresCount": 4,
|
|
"Procedures": [
|
|
"CreateContext",
|
|
"CloseContext",
|
|
"CreateNamedProvisioningLock",
|
|
"ReleaseNamedProvisioningLock"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140707581064480,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"1be3206b-2e03-4ea1-9321-12f4dfcd41d0": {
|
|
"Module": "webplatstorageserver.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\webplatstorageserver.dll",
|
|
"InterfaceId": "1be3206b-2e03-4ea1-9321-12f4dfcd41d0",
|
|
"InterfaceStructOffset": 942672,
|
|
"ProceduresCount": 3,
|
|
"Procedures": [
|
|
"s_DeleteAllStorages",
|
|
"s_DeleteAllStoragesForOrigin",
|
|
"s_DetachAllDatabasesForAppPackage"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140706992850944,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"4a72bfe1-9294-11da-a72b-0800200c9a66": {
|
|
"Module": "rdpinit.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\rdpinit.exe",
|
|
"InterfaceId": "4a72bfe1-9294-11da-a72b-0800200c9a66",
|
|
"InterfaceStructOffset": 289120,
|
|
"ProceduresCount": 20,
|
|
"Procedures": [
|
|
"RpcAcquireContextHandle",
|
|
"RpcReleaseContextHandle",
|
|
"RpcRailShellExecute",
|
|
"RpcOnTaskbarPosition",
|
|
"RpcOnDisplayChange",
|
|
"RpcStartRailTray",
|
|
"RpcStopRailTray",
|
|
"RpcOnTrayNotifyEvent",
|
|
"RpcNotifyLogoffParameterChange",
|
|
"RpcUpdateMaxIconSize",
|
|
"RpcRailActivateApplication",
|
|
"RpcUpdateAppBarRemotingSupport",
|
|
"RpcWindowCloakingTrackerAddWindow",
|
|
"RpcWindowCloakingTrackerRemoveWindow",
|
|
"RpcWindowCloakingTrackerReset",
|
|
"RpcOnWindowCloakStateChanged",
|
|
"RpcGetMarkerWindow",
|
|
"RpcDestroyMarkerWindow",
|
|
"RpcSetWindowSnapArrangement",
|
|
"RpcAcquireRdpInitPID"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140695030147136,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"461e6f82-89d8-4b7b-95ca-2e5c965953fc": {
|
|
"Module": "AppVEntSubsystemController.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\AppVEntSubsystemController.dll",
|
|
"InterfaceId": "461e6f82-89d8-4b7b-95ca-2e5c965953fc",
|
|
"InterfaceStructOffset": 901712,
|
|
"ProceduresCount": 22,
|
|
"Procedures": [
|
|
"s_vservices_server_GetVeProcessRuntimeSettings",
|
|
"s_vservices_server_OpenSCManager",
|
|
"s_vservices_server_OpenService",
|
|
"s_vservices_server_StartService",
|
|
"s_vservices_server_StartServiceControlDispatcher",
|
|
"s_vservices_server_SetServiceStatus",
|
|
"s_vservices_server_ControlService",
|
|
"s_vservices_server_QueryServiceStatusEx",
|
|
"s_vservices_server_EnumServicesStatusW",
|
|
"s_vservices_server_EnumServicesStatusA",
|
|
"s_vservices_server_EnumServicesStatusExW",
|
|
"s_vservices_server_EnumServicesStatusExA",
|
|
"s_vservices_server_EnumDependentServicesW",
|
|
"s_vservices_server_EnumDependentServicesA",
|
|
"s_vservices_server_CloseServiceHandle",
|
|
"s_vservices_server_GetServiceKeyName",
|
|
"s_vservices_server_GetServiceDisplayName",
|
|
"s_vservices_server_QueryServiceConfigW",
|
|
"s_vservices_server_QueryServiceConfigA",
|
|
"s_vservices_server_QueryServiceConfig2W",
|
|
"s_vservices_server_QueryServiceConfig2A",
|
|
"s_vservices_server_QueryServiceObjectSecurity"
|
|
],
|
|
"ProcStackSize": 72,
|
|
"DispatchFunction": 140706797979552,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"f3cc53ae-499d-47d9-929b-a51b1176affb": {
|
|
"Module": "hvsirpcd.exe",
|
|
"ModulePath": "C:\\Windows\\WinSxS\\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.18362.1832_none_158049e1d563edb9\\hvsirpcd.exe",
|
|
"InterfaceId": "f3cc53ae-499d-47d9-929b-a51b1176affb",
|
|
"InterfaceStructOffset": 67712,
|
|
"ProceduresCount": 2,
|
|
"Procedures": [
|
|
"s_HvsiWinHttpGetProxyForUrl",
|
|
"s_HvsiWinHttpReadProxySettings"
|
|
],
|
|
"ProcStackSize": 64,
|
|
"DispatchFunction": 140698086710848,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"bb8b98e8-84dd-45e7-9f34-c3fb6155eeed": {
|
|
"Module": "vaultsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\vaultsvc.dll",
|
|
"InterfaceId": "bb8b98e8-84dd-45e7-9f34-c3fb6155eeed",
|
|
"InterfaceStructOffset": 266240,
|
|
"ProceduresCount": 19,
|
|
"Procedures": [
|
|
"VltCreateItemType",
|
|
"VltDeleteItemType",
|
|
"VltEnumerateItemTypes",
|
|
"VltAddItem",
|
|
"VltFindItems",
|
|
"VltEnumerateItems",
|
|
"VltGetItem",
|
|
"VltRemoveItem",
|
|
"VltGetItemType",
|
|
"VltOpenVault",
|
|
"VltCloseVault",
|
|
"VltGetInformation",
|
|
"VltEnumerateVaults",
|
|
"VltEnumerateSettingUnits",
|
|
"VltGetSettingUnit",
|
|
"VltApplySettingUnit",
|
|
"VltRemoveSettingUnit",
|
|
"VltTriggerSync",
|
|
"VltGetSettingUnitInfo"
|
|
],
|
|
"ProcStackSize": 64,
|
|
"DispatchFunction": 140707205764480,
|
|
"Service": "VaultSvc",
|
|
"IsServiceRunning": true
|
|
},
|
|
"bbdc1d6b-35d9-480e-b5d2-c07545d32641": {
|
|
"Module": "moshost.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\moshost.dll",
|
|
"InterfaceId": "bbdc1d6b-35d9-480e-b5d2-c07545d32641",
|
|
"InterfaceStructOffset": 58416,
|
|
"ProceduresCount": 20,
|
|
"Procedures": [
|
|
"OdmlSvcOpen",
|
|
"OdmlSvcClose",
|
|
"OdmlSvcStartCheckForUpdates",
|
|
"OdmlSvcStartInstallUpdate",
|
|
"OdmlSvcGetUserPackages",
|
|
"OdmlSvcGetAvailablePackages",
|
|
"OdmlSvcFindNearbyPackagesAsync",
|
|
"OdmlSvcAddMapPackages",
|
|
"OdmlSvcRemoveMapPackages",
|
|
"OdmlSvcCancelMapPackage",
|
|
"OdmlSvcDeleteAllMaps",
|
|
"OdmlSvcGetCopyrightString",
|
|
"OdmlSvcSetAutoUpdateEnabled",
|
|
"OdmlSvcGetAutoUpdateEnabled",
|
|
"OdmlSvcSetUpdateOnlyOnWifi",
|
|
"OdmlSvcGetUpdateOnlyOnWifi",
|
|
"OdmlSvcGetShouldUseWlanString",
|
|
"OdmlSvcGetIsStorageStateValid",
|
|
"OdmlSvcStartMapDataMigration",
|
|
"OdmlSvcCancelMapDataMigration"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140707880920224,
|
|
"Service": "MapsBroker",
|
|
"IsServiceRunning": false
|
|
},
|
|
"5a7ccda5-1cd7-4693-a8d6-4bdded80c32f": {
|
|
"Module": "splwow64.exe",
|
|
"ModulePath": "C:\\Windows\\WinSxS\\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.18362.1854_none_e3b31a0c2490fffd\\splwow64.exe",
|
|
"InterfaceId": "5a7ccda5-1cd7-4693-a8d6-4bdded80c32f",
|
|
"InterfaceStructOffset": 57104,
|
|
"ProceduresCount": 18,
|
|
"Procedures": [
|
|
"RPCSplWOW64RefreshLifeSpan",
|
|
"RPCSplWOW64GetProcessID",
|
|
"RPCSplWOW64GetProcessHndl",
|
|
"RPCSplWOW64AddPort",
|
|
"RPCSplWOW64DeletePort",
|
|
"RPCSplWOW64ConfigurePort",
|
|
"RPCSplWOW64DeviceCapabilities",
|
|
"RPCSplWOW64DocumentProperties",
|
|
"RPCSplWOW64PrintUIDocumentProperties",
|
|
"RPCSplWOW64PrinterProperties",
|
|
"RPCSplWOW64SpoolerPrinterEvent",
|
|
"RPCSplWOW64DocumentEvent",
|
|
"RPCSplWOW64PrintUIQueueCreate",
|
|
"RPCSplWOW64PrintUIPrinterPropPages",
|
|
"RPCSplWOW64PrintUIDocumentDefaults",
|
|
"RPCSplWOW64PrintUIPrinterSetup",
|
|
"RPCSplWOW64PrintUIServerPropPages",
|
|
"RPCSplGetSaveFileInfo"
|
|
],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140699011929056,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"0d3c7f20-1c8d-4654-a1b3-51563b298bda": {
|
|
"Module": "usermgr.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\usermgr.dll",
|
|
"InterfaceId": "0d3c7f20-1c8d-4654-a1b3-51563b298bda",
|
|
"InterfaceStructOffset": 779872,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"svcGetUserMarshalData"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140708013377056,
|
|
"Service": "UserManager",
|
|
"IsServiceRunning": true
|
|
},
|
|
"2c7fd9ce-e706-4b40-b412-953107ef9bb0": {
|
|
"Module": "PsmServiceExtHost.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\PsmServiceExtHost.dll",
|
|
"InterfaceId": "2c7fd9ce-e706-4b40-b412-953107ef9bb0",
|
|
"InterfaceStructOffset": 559712,
|
|
"ProceduresCount": 9,
|
|
"Procedures": [
|
|
"RmgrSrv_RegisterWithServer",
|
|
"RmgrSrv_RmSetMemoryUsageLimit",
|
|
"RmgrSrv_RmRegisterResource",
|
|
"RmgrSrv_RmAccessCheck",
|
|
"RmgrSrv_RmAccessCheckOnCaller",
|
|
"RmgrSrv_RmAvailabilityCheck",
|
|
"RmgrSrv_RmAcquireResources",
|
|
"RmgrSrv_RmGetNotification",
|
|
"RmgrSrv_RmReleaseResources"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140708133524944,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"8fb74744-b2ff-4c00-be0d-9ef9a191fe1b": {
|
|
"Module": "keyiso.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\keyiso.dll",
|
|
"InterfaceId": "8fb74744-b2ff-4c00-be0d-9ef9a191fe1b",
|
|
"InterfaceStructOffset": 57440,
|
|
"ProceduresCount": 12,
|
|
"Procedures": [
|
|
"s_GetSymmetricPopKeyTransportKey",
|
|
"s_GetSymmetricPopKeyTransportKeyName",
|
|
"s_DeleteSymmetricPopKeyTransportKey",
|
|
"s_ImportSymmetricPopKey",
|
|
"s_SignWithSymmetricPopKey",
|
|
"s_VerifyWithSymmetricPopKey",
|
|
"s_DecryptWithSymmetricPopKey",
|
|
"s_EncryptWithSymmetricPopKey",
|
|
"s_GetKeyAttestationForContainerService",
|
|
"s_RenewKeyAttestation",
|
|
"s_GetPregenUserKey",
|
|
"s_GetPregenKeyState"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140707761381104,
|
|
"Service": "KeyIso",
|
|
"IsServiceRunning": true
|
|
},
|
|
"1cbcad78-df0b-4934-b558-87839ea501c9": {
|
|
"Module": "dsrolesrv.dll",
|
|
"ModulePath": "C:\\Windows\\WinSxS\\amd64_microsoft-windows-d..vices-dsrole-server_31bf3856ad364e35_10.0.18362.1_none_faf38a04e7aff2af\\dsrolesrv.dll",
|
|
"InterfaceId": "1cbcad78-df0b-4934-b558-87839ea501c9",
|
|
"InterfaceStructOffset": 166656,
|
|
"ProceduresCount": 12,
|
|
"Procedures": [
|
|
"DsRolerDnsNameToFlatName",
|
|
"DsRolerDcAsDc",
|
|
"DsRolerDcAsReplica",
|
|
"DsRolerDemoteDc",
|
|
"DsRolerGetDcOperationProgress",
|
|
"DsRolerGetDcOperationResults",
|
|
"DsRolerCancel",
|
|
"DsRolerIfmHandleFree",
|
|
"DsRolerServerSaveStateForUpgrade",
|
|
"DsRolerUpgradeDownlevelServer",
|
|
"DsRolerAbortDownlevelServerUpgrade",
|
|
"DsRolerGetDatabaseFacts"
|
|
],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140707880721328,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"33d84484-3626-47ee-8c6f-e7e98b113be1": {
|
|
"Module": "WPTaskScheduler.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\WPTaskScheduler.dll",
|
|
"InterfaceId": "33d84484-3626-47ee-8c6f-e7e98b113be1",
|
|
"InterfaceStructOffset": 111584,
|
|
"ProceduresCount": 13,
|
|
"Procedures": [
|
|
"s_TaskSchedulerCreateSchedule",
|
|
"s_TaskSchedulerDeleteSchedule",
|
|
"s_TaskSchedulerFindFirstSchedule",
|
|
"s_TaskSchedulerFindNextSchedule",
|
|
"s_TaskSchedulerFindScheduleClose",
|
|
"s_TaskSchedulerGetSchedule",
|
|
"s_TaskSchedulerEnableSchedule",
|
|
"s_TaskSchedulerExecuteSchedule",
|
|
"s_TaskSchedulerAdvanceSchedule",
|
|
"s_TaskSchedulerAdvanceScheduleIntervals",
|
|
"s_TaskSchedulerSnoozeSchedule",
|
|
"s_TaskSchedulerGetPublishStateName",
|
|
"s_TaskSchedulerServiceControl"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140708036372944,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"a2d47257-12f7-4beb-8981-0ebfa935c407": {
|
|
"Module": "pnrpsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\pnrpsvc.dll",
|
|
"InterfaceId": "a2d47257-12f7-4beb-8981-0ebfa935c407",
|
|
"InterfaceStructOffset": 309792,
|
|
"ProceduresCount": 13,
|
|
"Procedures": [
|
|
"PnrpRpcInitializeCloudList",
|
|
"PnrpRpcGetCloudList",
|
|
"PnrpRpcShutdownCloudList",
|
|
"PnrpRpcClientInitialize",
|
|
"PnrpRpcClientUninitialize",
|
|
"PnrpRpcRegister",
|
|
"PnrpRpcUnregister",
|
|
"PnrpRpcResolve",
|
|
"PnrpRpcGetResolveResult",
|
|
"PnrpRpcEndResolve",
|
|
"PnrpRpcPing",
|
|
"PnrpRpcDiagControl",
|
|
"PnrpRpcHandlePowerEvent"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140707581099104,
|
|
"Service": "PNRPsvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"4b324fc8-1670-01d3-1278-5a47bf6ee188": {
|
|
"Module": "srvsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\srvsvc.dll",
|
|
"InterfaceId": "4b324fc8-1670-01d3-1278-5a47bf6ee188",
|
|
"InterfaceStructOffset": 192512,
|
|
"ProceduresCount": 72,
|
|
"Procedures": [
|
|
"NetrCharDevControl",
|
|
"NetrCharDevControl",
|
|
"NetrCharDevControl",
|
|
"NetrCharDevControl",
|
|
"NetrCharDevControl",
|
|
"NetrCharDevControl",
|
|
"NetrCharDevControl",
|
|
"NetrCharDevControl",
|
|
"NetrConnectionEnum",
|
|
"NetrFileEnum",
|
|
"NetrFileGetInfo",
|
|
"NetrFileClose",
|
|
"NetrSessionEnum",
|
|
"NetrSessionDel",
|
|
"NetrShareAdd",
|
|
"NetrShareEnum",
|
|
"NetrShareGetInfo",
|
|
"NetrShareSetInfo",
|
|
"NetrShareDel",
|
|
"NetrShareDelSticky",
|
|
"NetrShareCheck",
|
|
"NetrServerGetInfo",
|
|
"NetrServerSetInfo",
|
|
"NetrServerDiskEnum",
|
|
"NetrServerStatisticsGet",
|
|
"NetrServerTransportAdd",
|
|
"NetrServerTransportEnum",
|
|
"NetrServerTransportDel",
|
|
"NetrRemoteTOD",
|
|
"I_NetrServerSetServiceBits",
|
|
"NetprPathType",
|
|
"NetprPathCanonicalize",
|
|
"NetprPathCompare",
|
|
"NetprNameValidate",
|
|
"NetprNameCanonicalize",
|
|
"NetprNameCompare",
|
|
"NetrShareEnumSticky",
|
|
"NetrShareDelStart",
|
|
"NetrShareDelCommit",
|
|
"NetrpGetFileSecurity",
|
|
"NetrpSetFileSecurity",
|
|
"NetrServerTransportAddEx",
|
|
"I_NetrServerSetServiceBitsEx",
|
|
"NetrDfsGetVersion",
|
|
"NetrCharDevControl",
|
|
"NetrCharDevControl",
|
|
"NetrCharDevControl",
|
|
"NetrCharDevControl",
|
|
"NetrCharDevControl",
|
|
"NetrCharDevControl",
|
|
"NetrCharDevControl",
|
|
"NetrCharDevControl",
|
|
"NetrCharDevControl",
|
|
"NetrServerTransportDelEx",
|
|
"NetrServerAliasAdd",
|
|
"NetrServerAliasEnum",
|
|
"NetrServerAliasDel",
|
|
"NetrShareDelEx",
|
|
"LocalrSessionEnum",
|
|
"LocalrSessionGetInfo",
|
|
"LocalrSessionDel",
|
|
"LocalrFileEnum",
|
|
"LocalrFileGetInfo",
|
|
"LocalrFileClose",
|
|
"LocalrShareEnum",
|
|
"LocalrShareGetInfo",
|
|
"LocalrShareSetInfo",
|
|
"LocalrShareAdd",
|
|
"LocalrShareDelEx",
|
|
"LocalrAliasGet",
|
|
"NetrServerTransportAddForInstance",
|
|
"NetrServerTransportDelForInstance"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140707955978944,
|
|
"Service": "LanmanServer",
|
|
"IsServiceRunning": true
|
|
},
|
|
"12e65dd8-887f-41ef-91bf-8d816c42c2e7": {
|
|
"Module": "winlogon.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\winlogon.exe",
|
|
"InterfaceId": "12e65dd8-887f-41ef-91bf-8d816c42c2e7",
|
|
"InterfaceStructOffset": 610992,
|
|
"ProceduresCount": 5,
|
|
"Procedures": [
|
|
"WlSecureDesktoprPromptingRequest",
|
|
"WlSecureDesktoprConfirmationRequest",
|
|
"WlSecureDesktoprCredmanBackupRequest",
|
|
"WlSecureDesktoprCredmanRestoreRequest",
|
|
"WlSecureDesktoprSimulateSAS"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140701228583248,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"7c44d7d4-31d5-424c-bd5e-2b3e1f323d22": {
|
|
"Module": "ntdsai.dll",
|
|
"ModulePath": "C:\\Windows\\WinSxS\\amd64_microsoft-windows-d..toryservices-ntdsai_31bf3856ad364e35_10.0.18362.1916_none_fe1eba331c36e95d\\ntdsai.dll",
|
|
"InterfaceId": "7c44d7d4-31d5-424c-bd5e-2b3e1f323d22",
|
|
"InterfaceStructOffset": 4346096,
|
|
"ProceduresCount": 2,
|
|
"Procedures": [
|
|
"IDL_DSAPrepareScript",
|
|
"IDL_DSAExecuteScript"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140706770989344,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"98cd761e-e77d-41c8-a3c0-0fb756d90ec2": {
|
|
"Module": "diagtrack.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\diagtrack.dll",
|
|
"InterfaceId": "98cd761e-e77d-41c8-a3c0-0fb756d90ec2",
|
|
"InterfaceStructOffset": 2709952,
|
|
"ProceduresCount": 7,
|
|
"Procedures": [
|
|
"UtcWerHelperApi_FetchReportCount",
|
|
"UtcEventTranscriptApi_FetchTranscriptRecordsPage",
|
|
"UtcWerHelperApi_EnableWerLocalReports",
|
|
"UtcWerHelperApi_RestoreWerLocalReportsSettings",
|
|
"UtcWerHelperApi_QueryWerLocalReportsEnabled",
|
|
"UtcWerHelperApi_FetchReportData2",
|
|
"UtcWerHelperApi_ExtractReport"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140707991505040,
|
|
"Service": "DiagTrack",
|
|
"IsServiceRunning": true
|
|
},
|
|
"f87e728f-2bf3-4358-9539-9b130ad71b54": {
|
|
"Module": "KeyboardFilterCore.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\KeyboardFilterCore.dll",
|
|
"InterfaceId": "f87e728f-2bf3-4358-9539-9b130ad71b54",
|
|
"InterfaceStructOffset": 22256,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"KBFKEYToScancode"
|
|
],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140707890538768,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"a80a054e-95a5-46b2-9b3b-afdb29f247fb": {
|
|
"Module": "AppVShNotify.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\AppVShNotify.exe",
|
|
"InterfaceId": "a80a054e-95a5-46b2-9b3b-afdb29f247fb",
|
|
"InterfaceStructOffset": 102976,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"s_IFTANotify_ShellNotify"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140702910017168,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"e40f7b57-7a25-4cd3-a135-7f7d3df9d16b": {
|
|
"Module": "ncbservice.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\ncbservice.dll",
|
|
"InterfaceId": "e40f7b57-7a25-4cd3-a135-7f7d3df9d16b",
|
|
"InterfaceStructOffset": 233472,
|
|
"ProceduresCount": 21,
|
|
"Procedures": [
|
|
"RpcSrvCreateSession",
|
|
"RpcSrvDestroySession",
|
|
"RpcSrvStartBrokeredActivation",
|
|
"RpcSrvSetServerKeepAliveInterval",
|
|
"RpcSrvGetCurrentKeepAliveInterval",
|
|
"RpcSrvDecreaseKeepAliveInterval",
|
|
"RpcSrvUsingTransport",
|
|
"RpcSrvIndicateSlotAllocation",
|
|
"RpcSrvSBCreatePushEnabledContext",
|
|
"RpcSrvSBTransferOwnership",
|
|
"RpcSrvSBRetrieveSocket",
|
|
"RpcSrvSBCompleteRetrieveSocket",
|
|
"RpcSrvSBRetrieveContext",
|
|
"RpcSrvSBEnumSockets",
|
|
"RpcSrvHotspotRegisterHotspotApp",
|
|
"RpcSrvHotspotFindEventForPackage",
|
|
"RpcSrvHotspotTriggerBackgroundEvent",
|
|
"RpcSrvHotspotIsAppInstalled",
|
|
"RpcSrvFirewallWcmSetFirewallRule",
|
|
"RpcSrvFirewallWcmSetFirewallRuleFlags",
|
|
"RpcSrvFirewallWcmDeleteFirewallRule"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140708099605296,
|
|
"Service": "NcbService",
|
|
"IsServiceRunning": true
|
|
},
|
|
"266f33b4-c7c1-4bd1-8f52-ddb8f2214ea9": {
|
|
"Module": "wlansvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\wlansvc.dll",
|
|
"InterfaceId": "266f33b4-c7c1-4bd1-8f52-ddb8f2214ea9",
|
|
"InterfaceStructOffset": 2051888,
|
|
"ProceduresCount": 151,
|
|
"Procedures": [
|
|
"RpcOpenHandle",
|
|
"RpcCloseHandle",
|
|
"RpcEnumInterfaces",
|
|
"RpcSetAutoConfigParameter",
|
|
"RpcQueryAutoConfigParameter",
|
|
"RpcGetInterfaceCapability",
|
|
"RpcSetInterface",
|
|
"RpcQueryInterface",
|
|
"RpcIhvControl",
|
|
"RpcScan",
|
|
"RpcGetLastScanTimeInTicks",
|
|
"RpcGetAvailableNetworkList",
|
|
"RpcPrivateGetAvailableNetworkList",
|
|
"RpcPrivateClearAnqpCache",
|
|
"RpcPrivateRefreshAnqpCache",
|
|
"RpcPrivateGetAnqpCacheResponse",
|
|
"RpcPrivateParseAnqpRawData",
|
|
"RpcPrivateGetAnqpOSUProviderList",
|
|
"RpcPrivateEnableAnqpOsuRegistration",
|
|
"RpcPrivateGetAnqpOsuRegistrationStatus",
|
|
"RpcGetNetworkBssList",
|
|
"RpcConnect",
|
|
"RpcConnectEx",
|
|
"RpcDisconnect",
|
|
"RpcRegisterNotification",
|
|
"RpcAsyncGetNotification",
|
|
"RpcSetProfileEapUserData",
|
|
"RpcSetProfile",
|
|
"RpcGetProfile",
|
|
"RpcDeleteProfile",
|
|
"RpcRenameProfile",
|
|
"RpcSetProfileList",
|
|
"RpcSetProfileListForOffload",
|
|
"RpcGetProfileList",
|
|
"RpcSetProfilePosition",
|
|
"RpcSetProfileCustomUserData",
|
|
"RpcGetProfileCustomUserData",
|
|
"RpcSetFilterList",
|
|
"RpcGetFilterList",
|
|
"RpcSetPsdIEDataList",
|
|
"RpcSaveTemporaryProfile",
|
|
"RpcIsUIRequestPending",
|
|
"RpcSetUIForwardingNetworkList",
|
|
"RpcIsNetworkSuppressed",
|
|
"RpcRemoveUIForwardingNetworkList",
|
|
"RpcQueryExtUIRequest",
|
|
"RpcUIResponse",
|
|
"RpcGetProfileKeyInfo",
|
|
"RpcCanDeleteProfile",
|
|
"RpcAsyncDoPlap",
|
|
"RpcQueryPlapCredentials",
|
|
"RpcCancelPlap",
|
|
"RpcSetSecuritySettings",
|
|
"RpcGetSecuritySettings",
|
|
"RpcHostedNetworkPerformOperation",
|
|
"RpcHostedNetworkHlpQueryEverUsed",
|
|
"RpcHostedNetworkSetProperty",
|
|
"RpcHostedNetworkQueryProperty",
|
|
"RpcHostedNetworkQueryStatus",
|
|
"RpcHostedNetworkQueryWCNSettings",
|
|
"RpcHostedNetworkSetWCNSettings",
|
|
"RpcGetProfileEapUserDataInfo",
|
|
"RpcQueryPreConnectInput",
|
|
"RpcConnectWithInput",
|
|
"RpcRefreshConnections",
|
|
"RpcInternalRequestFtm",
|
|
"RpcInternalScan",
|
|
"RpcHostedNetworkSetSecondaryKey",
|
|
"RpcHostedNetworkQuerySecondaryKey",
|
|
"RpcRegisterVirtualStationNotification",
|
|
"RpcEnumAllInterfaces",
|
|
"RpcQueryInterfacePortType",
|
|
"RpcStartMovementDetector",
|
|
"RpcStopMovementDetector",
|
|
"RpcSetProtectedScenario",
|
|
"RpcWFDDiscoverDevices",
|
|
"RpcWFDGetVisibleDevices",
|
|
"RpcWFDStopDiscoverDevices",
|
|
"RpcWFDStartBackgroundDiscovery",
|
|
"RpcWFDStopBackgroundDiscovery",
|
|
"RpcWFDDiscoverDeviceServiceInformation",
|
|
"RpcWFDOpenHandle",
|
|
"RpcWFDRegisterVMgrCaller",
|
|
"RpcWFDUnregisterVMgrCaller",
|
|
"RpcWFDQueryProperty",
|
|
"RpcWFDSetProperty",
|
|
"RpcWFDSetSecondaryDeviceTypeList",
|
|
"RpcWFDPairEnumerateCeremonies",
|
|
"RpcWFDPairSelectCeremony",
|
|
"RpcWFDPairWithDevice",
|
|
"RpcWFDPairCancel",
|
|
"RpcWFDPairCancelByDeviceAddress",
|
|
"RpcWFDOpenSession",
|
|
"RpcWFDGetSessionEndpointPairs",
|
|
"RpcWFDConfigureFirewallForSession",
|
|
"RpcWFDCancelOpenSession",
|
|
"RpcWFDCloseSession",
|
|
"RpcWFDAbortSession",
|
|
"RpcWFDForceDisconnect",
|
|
"RpcWFDForceDisconnectLegacyPeer",
|
|
"RpcWFDAcceptGroupRequestAndOpenSession",
|
|
"RpcWFDDeclineGroupRequest",
|
|
"RpcWFDSetWCNSettings",
|
|
"RpcWFDAcceptConnectRequestAndOpenSession",
|
|
"RpcWFDDeclineConnectRequest",
|
|
"RpcWFDGetPeerInfo",
|
|
"RpcWFDGetDefaultGroupProfile",
|
|
"RpcWFDGetProfileKeyInfo",
|
|
"RpcWFDStartUsingGroup",
|
|
"RpcWFDStopUsingGroup",
|
|
"RpcWFDOpenLegacySessionWithProfile",
|
|
"RpcWFDCloseLegacySession",
|
|
"RpcWFDIsInterfaceWiFiDirect",
|
|
"RpcIsWiFiDirectRunningOnWiFiAdapter",
|
|
"RpcWFDUpdateDeviceVisibility",
|
|
"RpcWFDOpenLegacySession",
|
|
"RpcWFDFlushVisibleDeviceList",
|
|
"RpcWlanNotifyVsIeProvider",
|
|
"RpcWlanNotifyVsIeProviderEx",
|
|
"RpcWFDGetDeviceDescriptorForPendingRequest",
|
|
"RpcWFDStartOffloadedDiscovery",
|
|
"RpcWFDStopOffloadedDiscovery",
|
|
"RpcWFDGetPrimaryAdapterState",
|
|
"RpcWFDDiscoverDevicesEx",
|
|
"RpcWFDGetVisibleDevicesEx",
|
|
"RpcWFDStopDiscoverDevicesEx",
|
|
"RpcWFDSetSelectedWfdMgr",
|
|
"RpcWFDSetSelectedWfdMgrWithoutClientContext",
|
|
"RpcWFDResetSelectedWfdMgr",
|
|
"RpcWiFiDisplaySetSinkClientHandle",
|
|
"RpcWiFiDisplaySetSinkState",
|
|
"RpcWiFiDisplayResetSinkState",
|
|
"RpcSetProfileMetadata",
|
|
"RpcGetProfileMetadata",
|
|
"RpcWCMGetProfileList",
|
|
"RpcWcmSetProfile",
|
|
"RpcWcmSetInterface",
|
|
"RpcWcmGetInterface",
|
|
"RpcWcmDisconnect",
|
|
"RpcStoreRadioState",
|
|
"RpcGetStoredRadioState",
|
|
"RpcGetRadioInformation",
|
|
"RpcGetProfileIndex",
|
|
"RpcGetMFPNegotiated",
|
|
"RpcPrivateQueryInterface",
|
|
"RpcPrivateSetInterface",
|
|
"RpcUpdateBasicProfileSecurity",
|
|
"RpcPrivateQuery11adPairedConfig",
|
|
"RpcGetSupportedDeviceServices",
|
|
"RpcDeviceServiceCommand",
|
|
"RpcRegisterDeviceServiceNotification"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140707602732992,
|
|
"Service": "WlanSvc",
|
|
"IsServiceRunning": true
|
|
},
|
|
"5cbe92cb-f4be-45c9-9fc9-33e73e557b20": {
|
|
"Module": "dpapisrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\dpapisrv.dll",
|
|
"InterfaceId": "5cbe92cb-f4be-45c9-9fc9-33e73e557b20",
|
|
"InterfaceStructOffset": 184320,
|
|
"ProceduresCount": 3,
|
|
"Procedures": [
|
|
"s_SSRecoverQueryStatus",
|
|
"s_SSRecoverImportRecoveryKey",
|
|
"s_SSRecoverPassword"
|
|
],
|
|
"ProcStackSize": 64,
|
|
"DispatchFunction": 140708143075392,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"fc48cd89-98d6-4628-9839-86f7a3e4161a": {
|
|
"Module": "ACPBackgroundManagerPolicy.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\ACPBackgroundManagerPolicy.dll",
|
|
"InterfaceId": "fc48cd89-98d6-4628-9839-86f7a3e4161a",
|
|
"InterfaceStructOffset": 121712,
|
|
"ProceduresCount": 9,
|
|
"Procedures": [
|
|
"MVoipSrvNotifyVoipActiveCall",
|
|
"MVoipSrvNotifyVoipActivityCompleted",
|
|
"MVoipSrvHoldActiveCall",
|
|
"MVoipSrvUnholdActiveCall",
|
|
"MVoipSrvNotifyIncomingCallDialogDisplayed",
|
|
"MVoipSrvNotifyIncomingCallDialogDismissed",
|
|
"MVoipSrvLaunchVoipRtcTask",
|
|
"MVoipSrvLaunchVoipActivity",
|
|
"MVoipSrvCancelVoipCall"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140707565913168,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"923c9623-db7f-4b34-9e6d-e86580f8ca2a": {
|
|
"Module": "SyncController.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\SyncController.dll",
|
|
"InterfaceId": "923c9623-db7f-4b34-9e6d-e86580f8ca2a",
|
|
"InterfaceStructOffset": 494608,
|
|
"ProceduresCount": 18,
|
|
"Procedures": [
|
|
"AccountsMgmtRpcCreateAccount",
|
|
"AccountsMgmtRpcDeleteAccount",
|
|
"AccountsMgmtRpcConvertWebAccountIdFromAppSpecificId",
|
|
"AccountsMgmtRpcConvertWebAccountIdToAppSpecificId",
|
|
"AccountsMgmtRpcSyncAccount",
|
|
"AccountsMgmtRpcSyncAccountAndWaitForCompletion",
|
|
"AccountsMgmtRpcQueryAccountProperties",
|
|
"AccountsMgmtRpcSaveAccountProperties",
|
|
"AccountsMgmtRpcEnumAccounts",
|
|
"AccountsMgmtRpcAdviseAccount",
|
|
"AccountsMgmtRpcUnadviseAccount",
|
|
"AccountsMgmtRpcGetNotifications",
|
|
"AccountsMgmtRpcDiscoverExchangeServerConfig",
|
|
"AccountsMgmtRpcDiscoverExchangeServerAuthType",
|
|
"AccountsMgmtRpcVerifyExchangeMailBoxTokenAuth",
|
|
"AccountsMgmtRpcDiscoverInternetMailServerConfig",
|
|
"AccountsMgmtRpcCancelDiscoverInternetMailServerConfig",
|
|
"AccountsMgmtRpcMayIgnoreInvalidServerCertificate"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140707460221856,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"00000136-0000-0000-c000-000000000046": {
|
|
"Module": "rpcss.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\rpcss.dll",
|
|
"InterfaceId": "00000136-0000-0000-c000-000000000046",
|
|
"InterfaceStructOffset": 959696,
|
|
"ProceduresCount": 5,
|
|
"Procedures": [
|
|
"DummyAddRefISCMActivator",
|
|
"DummyAddRefISCMActivator",
|
|
"DummyAddRefISCMActivator",
|
|
"SCMActivatorGetClassObject",
|
|
"SCMActivatorCreateInstance"
|
|
],
|
|
"ProcStackSize": 72,
|
|
"DispatchFunction": 140708134680352,
|
|
"Service": "RpcSs",
|
|
"IsServiceRunning": true
|
|
},
|
|
"a2c45f7c-7d32-46ad-96f5-adafb486be74": {
|
|
"Module": "services.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\services.exe",
|
|
"InterfaceId": "a2c45f7c-7d32-46ad-96f5-adafb486be74",
|
|
"InterfaceStructOffset": 501296,
|
|
"ProceduresCount": 3,
|
|
"Procedures": [
|
|
"RI_ScOpenServiceChannelHandle",
|
|
"RI_ScSendResponseReceiveControls",
|
|
"RI_ScCloseServiceChannelHandle"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140702191674768,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"8833d1d0-965f-4216-b3e9-fbe58cad3100": {
|
|
"Module": "SCardSvr.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\SCardSvr.dll",
|
|
"InterfaceId": "8833d1d0-965f-4216-b3e9-fbe58cad3100",
|
|
"InterfaceStructOffset": 171936,
|
|
"ProceduresCount": 2,
|
|
"Procedures": [
|
|
"s_RPC_SCardReadCache",
|
|
"s_RPC_SCardWriteCache"
|
|
],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140707581070336,
|
|
"Service": "SCardSvr",
|
|
"IsServiceRunning": false
|
|
},
|
|
"7d814569-35b3-4850-bb32-83035fcebf6e": {
|
|
"Module": "ias.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\ias.dll",
|
|
"InterfaceId": "7d814569-35b3-4850-bb32-83035fcebf6e",
|
|
"InterfaceStructOffset": 20720,
|
|
"ProceduresCount": 3,
|
|
"Procedures": [
|
|
"ServerDoRequest",
|
|
"ServerDoRequestAsync",
|
|
"ServerConfigureIas"
|
|
],
|
|
"ProcStackSize": 8,
|
|
"DispatchFunction": 140708037797984,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"f763c91c-2ab1-47fa-868f-7de7efd42194": {
|
|
"Module": "vmrdvcore.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\vmrdvcore.dll",
|
|
"InterfaceId": "f763c91c-2ab1-47fa-868f-7de7efd42194",
|
|
"InterfaceStructOffset": 307520,
|
|
"ProceduresCount": 2,
|
|
"Procedures": [
|
|
"VmGetAppAllowListEntryByAlias",
|
|
"VmVerifyAppAllowed"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140707581097632,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"d25576e4-00d2-43f7-98f9-b4c0724158f9": {
|
|
"Module": "lsasrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\lsasrv.dll",
|
|
"InterfaceId": "d25576e4-00d2-43f7-98f9-b4c0724158f9",
|
|
"InterfaceStructOffset": 1270240,
|
|
"ProceduresCount": 3,
|
|
"Procedures": [
|
|
"LsarEasMarkUserControlled",
|
|
"LsarEasGetCallerPasswordComplexity",
|
|
"LsarEasGetControlledUsersInfo"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140708154094704,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"57cce375-4430-47a6-bb96-2cad0d2fd140": {
|
|
"Module": "LsaIso.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\LsaIso.exe",
|
|
"InterfaceId": "57cce375-4430-47a6-bb96-2cad0d2fd140",
|
|
"InterfaceStructOffset": 188688,
|
|
"ProceduresCount": 26,
|
|
"Procedures": [
|
|
"BCryptIumGetClientContext",
|
|
"BCryptIumReleaseContext",
|
|
"BCryptIumOpenAlgorithmProvider",
|
|
"BCryptIumGetProperty",
|
|
"BCryptIumSetProperty",
|
|
"BCryptIumCloseAlgorithmProvider",
|
|
"BCryptIumGenerateSymmetricKey",
|
|
"BCryptIumGenerateKeyPair",
|
|
"BCryptIumEncrypt",
|
|
"BCryptIumDecrypt",
|
|
"BCryptIumExportKey",
|
|
"BCryptIumImportKey",
|
|
"BCryptIumImportKeyPair",
|
|
"BCryptIumDuplicateKey",
|
|
"BCryptIumFinalizeKeyPair",
|
|
"BCryptIumDestroyKey",
|
|
"BCryptIumDestroySecret",
|
|
"BCryptIumSignHash",
|
|
"BCryptIumVerifySignature",
|
|
"BCryptIumSecretAgreement",
|
|
"BCryptIumDeriveKey",
|
|
"BCryptIumKeyDerivation",
|
|
"BCryptIumCreateClaim",
|
|
"BCryptIumGetIdkSPub",
|
|
"BCryptIumCheckKey",
|
|
"BCryptIumPingTrustlet"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140697528931680,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"8fb6d884-2388-11d0-8c35-00c04fda2795": {
|
|
"Module": "w32time.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\w32time.dll",
|
|
"InterfaceId": "8fb6d884-2388-11d0-8c35-00c04fda2795",
|
|
"InterfaceStructOffset": 270496,
|
|
"ProceduresCount": 8,
|
|
"Procedures": [
|
|
"s_W32TimeSync",
|
|
"s_W32TimeGetNetlogonServiceBits",
|
|
"s_W32TimeQueryProviderStatus",
|
|
"s_W32TimeQuerySource",
|
|
"s_W32TimeQueryProviderConfiguration",
|
|
"s_W32TimeQueryConfiguration",
|
|
"s_W32TimeQueryStatus",
|
|
"s_W32TimeLog"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140707580926128,
|
|
"Service": "W32Time",
|
|
"IsServiceRunning": false
|
|
},
|
|
"a500d4c6-0dd1-4543-bc0c-d5f93486eaf8": {
|
|
"Module": "TimeBrokerServer.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\TimeBrokerServer.dll",
|
|
"InterfaceId": "a500d4c6-0dd1-4543-bc0c-d5f93486eaf8",
|
|
"InterfaceStructOffset": 117872,
|
|
"ProceduresCount": 6,
|
|
"Procedures": [
|
|
"TbiEnumerateEvents",
|
|
"TbiQueryEventData",
|
|
"TbiUpdateEvent",
|
|
"TbiQueryCEventData",
|
|
"_TbiQueryCEventTriggerTime",
|
|
"_TbiUpdateCEvent"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140708098182112,
|
|
"Service": "TimeBrokerSvc",
|
|
"IsServiceRunning": true
|
|
},
|
|
"03a04892-b1e0-4ca3-a5e4-097751b2b4c1": {
|
|
"Module": "vmsp.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\vmsp.exe",
|
|
"InterfaceId": "03a04892-b1e0-4ca3-a5e4-097751b2b4c1",
|
|
"InterfaceStructOffset": 114960,
|
|
"ProceduresCount": 8,
|
|
"Procedures": [
|
|
"RpcVmspOpenHandle",
|
|
"RpcVmspCloseHandle",
|
|
"RpcKmSetEncryptionKeys",
|
|
"RpcKmEgressKeyForDecryption",
|
|
"RpcVbsVmReleaseKeys",
|
|
"RpcVbsVmSetKeyProtector",
|
|
"RpcVbsVmUpdateKeyProtector",
|
|
"RpcVbsVmCreateVsmReport"
|
|
],
|
|
"ProcStackSize": 88,
|
|
"DispatchFunction": 140701201368400,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"7212a04b-b463-402e-9649-2ba477394676": {
|
|
"Module": "umrdp.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\umrdp.dll",
|
|
"InterfaceId": "7212a04b-b463-402e-9649-2ba477394676",
|
|
"InterfaceStructOffset": 272544,
|
|
"ProceduresCount": 7,
|
|
"Procedures": [
|
|
"AllowTSEvent",
|
|
"RpcOpenDevice",
|
|
"RpcCloseDevice",
|
|
"RpcGetSessionId",
|
|
"RpcGetInterfaceGuids",
|
|
"RpcGetClientDeviceId",
|
|
"RpcGetDeviceCaps"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140708067700656,
|
|
"Service": "UmRdpService",
|
|
"IsServiceRunning": true
|
|
},
|
|
"6d9fe472-30f1-4708-8fa8-678362b96155": {
|
|
"Module": "wimserv.exe",
|
|
"ModulePath": "C:\\Windows\\System32\\wimserv.exe",
|
|
"InterfaceId": "6d9fe472-30f1-4708-8fa8-678362b96155",
|
|
"InterfaceStructOffset": 424128,
|
|
"ProceduresCount": 3,
|
|
"Procedures": [
|
|
"AddImage",
|
|
"IsImageMounted",
|
|
"RemoveImage"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140700630591440,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"d09bdeb5-6171-4a34-bfe2-06fa82652568": {
|
|
"Module": "BrokerLib.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\BrokerLib.dll",
|
|
"InterfaceId": "d09bdeb5-6171-4a34-bfe2-06fa82652568",
|
|
"InterfaceStructOffset": 164064,
|
|
"ProceduresCount": 3,
|
|
"Procedures": [
|
|
"BriCreateEventForKernel",
|
|
"BriCreateEvent",
|
|
"BriDeleteEvent"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140708126600576,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"a1d4eae7-39f8-4bca-8e72-832767f5082a": {
|
|
"Module": "das.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\das.dll",
|
|
"InterfaceId": "a1d4eae7-39f8-4bca-8e72-832767f5082a",
|
|
"InterfaceStructOffset": 368928,
|
|
"ProceduresCount": 6,
|
|
"Procedures": [
|
|
"DasCreateInboundContext",
|
|
"DasStartListenForInboundAssociations",
|
|
"DasGetInboundAssociationResult",
|
|
"DasCloseInboundContext",
|
|
"DasRegisterForInboundAssociationsAppActivation",
|
|
"DasGetInboundAssociationResultForAppActivation"
|
|
],
|
|
"ProcStackSize": 48,
|
|
"DispatchFunction": 140707580865152,
|
|
"Service": "DeviceAssociationService",
|
|
"IsServiceRunning": false
|
|
},
|
|
"20c40295-8dba-48e6-aebf-3e78ef3bb144": {
|
|
"Module": "bisrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\bisrv.dll",
|
|
"InterfaceId": "20c40295-8dba-48e6-aebf-3e78ef3bb144",
|
|
"InterfaceStructOffset": 552160,
|
|
"ProceduresCount": 5,
|
|
"Procedures": [
|
|
"SrvOdbPtCreateSession",
|
|
"SrvOdbPtCompleteSession",
|
|
"SrvOdbPtLaunchBackgroundTask",
|
|
"SrvOdbPtCancelBackgroundTask",
|
|
"SrvOdbPtCancelBackgroundTasksForPackage"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140708131135040,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"3706415d-4987-4fcf-9e08-00742572bd5a": {
|
|
"Module": "fhsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\fhsvc.dll",
|
|
"InterfaceId": "3706415d-4987-4fcf-9e08-00742572bd5a",
|
|
"InterfaceStructOffset": 73728,
|
|
"ProceduresCount": 10,
|
|
"Procedures": [
|
|
"FhSvcApiOpenPipe",
|
|
"FhSvcApiClosePipe",
|
|
"FhSvcApiStartBackup",
|
|
"FhSvcApiStopBackup",
|
|
"FhSvcApiBlockUnblockBackup",
|
|
"FhSvcApiClearProtectionState",
|
|
"FhSvcApiEnterMaintenanceMode",
|
|
"FhSvcApiExitMaintenanceMode",
|
|
"FhSvcApiMigrationStarting",
|
|
"FhSvcApiMigrationFinished"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140707581103760,
|
|
"Service": "fhsvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"b25a52bf-e5dd-4f4a-aea6-8ca7272a0e86": {
|
|
"Module": "keyiso.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\keyiso.dll",
|
|
"InterfaceId": "b25a52bf-e5dd-4f4a-aea6-8ca7272a0e86",
|
|
"InterfaceStructOffset": 57536,
|
|
"ProceduresCount": 32,
|
|
"Procedures": [
|
|
"s_SrvRpcCreateContext",
|
|
"s_SrvRpcReleaseContext",
|
|
"s_SrvRpcCryptOpenStorageProvider",
|
|
"s_SrvRpcCryptIsAlgSupported",
|
|
"s_SrvRpcCryptEnumAlgorithms",
|
|
"s_SrvRpcCryptEnumKeys",
|
|
"s_SrvRpcCryptFreeBuffer",
|
|
"s_SrvRpcCryptFreeProvider",
|
|
"s_SrvRpcCryptFreeKey",
|
|
"s_SrvRpcCryptOpenKey",
|
|
"s_SrvRpcCryptCreatePersistedKey",
|
|
"s_SrvRpcCryptGetProviderProperty",
|
|
"s_SrvRpcCryptSetProviderProperty",
|
|
"s_SrvRpcCryptGetKeyProperty",
|
|
"s_SrvRpcCryptSetKeyProperty",
|
|
"s_SrvRpcCryptFinalizeKey",
|
|
"s_SrvRpcCryptEncrypt",
|
|
"s_SrvRpcCryptDecrypt",
|
|
"s_SrvRpcCryptImportKey",
|
|
"s_SrvRpcCryptExportKey",
|
|
"s_SrvRpcCryptSignHash",
|
|
"s_SrvRpcCryptVerifySignature",
|
|
"s_SrvRpcCryptDeleteKey",
|
|
"s_SrvRpcCryptNotifyChangeKey",
|
|
"s_SrvRpcCryptSecretAgreement",
|
|
"s_SrvRpcCryptDeriveKey",
|
|
"s_SrvRpcCryptFreeSecret",
|
|
"s_SrvRpcCryptCipherEncrypt",
|
|
"s_SrvRpcCryptCipherDecrypt",
|
|
"s_SrvRpcCryptKeyDerivation",
|
|
"s_SrvRpcCryptCreateClaim",
|
|
"s_SrvRpcCryptVerifyClaim"
|
|
],
|
|
"ProcStackSize": 96,
|
|
"DispatchFunction": 140707761401984,
|
|
"Service": "KeyIso",
|
|
"IsServiceRunning": true
|
|
},
|
|
"2a82bb21-e44f-4791-9aa1-dfae788e2f43": {
|
|
"Module": "ubpm.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\ubpm.dll",
|
|
"InterfaceId": "2a82bb21-e44f-4791-9aa1-dfae788e2f43",
|
|
"InterfaceStructOffset": 213792,
|
|
"ProceduresCount": 4,
|
|
"Procedures": [
|
|
"s_UbpmRpcOpenTaskHostChannel",
|
|
"s_UbpmRpcCloseTaskHostChannel",
|
|
"s_UbpmRpcTaskHostSendResponseReceiveCommand",
|
|
"s_UbpmRpcTaskHostReportTaskStatus"
|
|
],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140708046276672,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"edce686d-acae-4a2a-8945-24489443c35e": {
|
|
"Module": "AppVEntSubsystemController.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\AppVEntSubsystemController.dll",
|
|
"InterfaceId": "edce686d-acae-4a2a-8945-24489443c35e",
|
|
"InterfaceStructOffset": 901232,
|
|
"ProceduresCount": 1,
|
|
"Procedures": [
|
|
"vEnv_server_GetListOfVirtualEnvVars"
|
|
],
|
|
"ProcStackSize": 80,
|
|
"DispatchFunction": 140706797844832,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"3c4728c5-f0ab-448b-bda1-6ce01eb0a6d6": {
|
|
"Module": "dhcpcore6.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\dhcpcore6.dll",
|
|
"InterfaceId": "3c4728c5-f0ab-448b-bda1-6ce01eb0a6d6",
|
|
"InterfaceStructOffset": 204800,
|
|
"ProceduresCount": 13,
|
|
"Procedures": [
|
|
"RpcSrvRequestPrefixEx",
|
|
"RpcSrvRenewPrefixEx",
|
|
"RpcSrvReleasePrefixEx",
|
|
"RpcSrvCancelOperation",
|
|
"RpcSrvEnablev6Tracing",
|
|
"RpcSrvRequestParams",
|
|
"RpcSrvAcquireParametersv6",
|
|
"RpcSrvReleaseParametersv6",
|
|
"RpcSrvQueryLeaseInfov6",
|
|
"RpcSrvGetTraceArray",
|
|
"RpcSrvSetUserClass",
|
|
"RpcSrvQueryLeaseInfov6Array",
|
|
"RpcSrvEnableDhcpv6"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140708049621600,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"fd6b7e61-2bed-4d48-a267-d746fe449fed": {
|
|
"Module": "ngcsvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\ngcsvc.dll",
|
|
"InterfaceId": "fd6b7e61-2bed-4d48-a267-d746fe449fed",
|
|
"InterfaceStructOffset": 630416,
|
|
"ProceduresCount": 4,
|
|
"Procedures": [
|
|
"s_DeviceCredentialRpcRegisterPresenceMonitoring",
|
|
"s_DeviceCredentialRpcRegisterPresenceMonitoringOnExistingDevice",
|
|
"s_DeviceCredentialRpcUnregisterPresenceMonitoring",
|
|
"s_DeviceCredentialRpcUpdatePresenceState"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140707094139280,
|
|
"Service": "NgcSvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"0497b57d-2e66-424f-a0c6-157cd5d41700": {
|
|
"Module": "appinfo.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\appinfo.dll",
|
|
"InterfaceId": "0497b57d-2e66-424f-a0c6-157cd5d41700",
|
|
"InterfaceStructOffset": 106496,
|
|
"ProceduresCount": 4,
|
|
"Procedures": [
|
|
"RAiLaunchProcessWithIdentity",
|
|
"RAiGetPackageActivationToken",
|
|
"RAiFinishPackageActivation",
|
|
"RAiEnsurePackageShutdown"
|
|
],
|
|
"ProcStackSize": 40,
|
|
"DispatchFunction": 140707486581232,
|
|
"Service": "Appinfo",
|
|
"IsServiceRunning": true
|
|
},
|
|
"20610036-fa22-11cf-9823-00a0c911e5df": {
|
|
"Module": "rasmans.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\rasmans.dll",
|
|
"InterfaceId": "20610036-fa22-11cf-9823-00a0c911e5df",
|
|
"InterfaceStructOffset": 794960,
|
|
"ProceduresCount": 16,
|
|
"Procedures": [
|
|
"RasRpcPortEnum",
|
|
"RasRpcDeviceEnum",
|
|
"RasRpcGetDevConfig",
|
|
"RasRpcPortGetInfo",
|
|
"RasRpcEnumConnections",
|
|
"RasRpcDeleteEntry",
|
|
"RasRpcGetErrorString",
|
|
"RasRpcGetCountryInfo",
|
|
"RasRpcGetInstalledProtocols",
|
|
"RasRpcGetUserPreferences",
|
|
"RasRpcSetUserPreferences",
|
|
"RasRpcGetSystemDirectory",
|
|
"RasRpcSubmitRequest",
|
|
"RasRpcSubmitRequestLocal",
|
|
"RasRpcGetInstalledProtocolsEx",
|
|
"RasRpcGetVersion"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140707835672752,
|
|
"Service": "RasMan",
|
|
"IsServiceRunning": true
|
|
},
|
|
"41208ee0-e970-11d1-9b9e-00e02c064c39": {
|
|
"Module": "mqqm.dll",
|
|
"ModulePath": "C:\\Windows\\WinSxS\\amd64_microsoft-windows-msmq-queuemanager-core_31bf3856ad364e35_10.0.18362.1977_none_8d1646dec2a87b94\\mqqm.dll",
|
|
"InterfaceId": "41208ee0-e970-11d1-9b9e-00e02c064c39",
|
|
"InterfaceStructOffset": 984448,
|
|
"ProceduresCount": 2,
|
|
"Procedures": [
|
|
"R_QMMgmtGetInfo",
|
|
"R_QMMgmtAction"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140707093258608,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"30adc50c-5cbc-46ce-9a0e-91914789e23c": {
|
|
"Module": "nrpsrv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\nrpsrv.dll",
|
|
"InterfaceId": "30adc50c-5cbc-46ce-9a0e-91914789e23c",
|
|
"InterfaceStructOffset": 13632,
|
|
"ProceduresCount": 2,
|
|
"Procedures": [
|
|
"RpcNrpGetAddrInfo",
|
|
"RpcNrpGetNameInfo"
|
|
],
|
|
"ProcStackSize": 80,
|
|
"DispatchFunction": 140708027832832,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"000001a0-0000-0000-c000-000000000046": {
|
|
"Module": "rpcss.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\rpcss.dll",
|
|
"InterfaceId": "000001a0-0000-0000-c000-000000000046",
|
|
"InterfaceStructOffset": 959408,
|
|
"ProceduresCount": 5,
|
|
"Procedures": [
|
|
"CopyTo",
|
|
"CopyTo",
|
|
"CopyTo",
|
|
"RemoteGetClassObject",
|
|
"RemoteCreateInstance"
|
|
],
|
|
"ProcStackSize": 56,
|
|
"DispatchFunction": 140708135533424,
|
|
"Service": "RpcSs",
|
|
"IsServiceRunning": true
|
|
},
|
|
"9cd76d01-051c-44e7-a449-942a3ff90f7c": {
|
|
"Module": "KeyboardFilterSvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\KeyboardFilterSvc.dll",
|
|
"InterfaceId": "9cd76d01-051c-44e7-a449-942a3ff90f7c",
|
|
"InterfaceStructOffset": 100880,
|
|
"ProceduresCount": 3,
|
|
"Procedures": [
|
|
"RemoveFilteredKeys",
|
|
"KeyboardLayoutChange",
|
|
"DesktopChange"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140707581092000,
|
|
"Service": "MsKeyboardFilter",
|
|
"IsServiceRunning": false
|
|
},
|
|
"0f9719b5-6a85-4bad-abdf-d8a678600f9b": {
|
|
"Module": "NgcCtnrSvc.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\NgcCtnrSvc.dll",
|
|
"InterfaceId": "0f9719b5-6a85-4bad-abdf-d8a678600f9b",
|
|
"InterfaceStructOffset": 539632,
|
|
"ProceduresCount": 3,
|
|
"Procedures": [
|
|
"s_NgcIsoTpmSubmitCommandCallback",
|
|
"s_NgcIsoTpmGetResponseCallback",
|
|
"s_NgcIsoTpmCloseCallback"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140707093934512,
|
|
"Service": "NgcCtnrSvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"2acb9d68-b434-4b3e-b966-e06b4b3a84cb": {
|
|
"Module": "bthserv.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\bthserv.dll",
|
|
"InterfaceId": "2acb9d68-b434-4b3e-b966-e06b4b3a84cb",
|
|
"InterfaceStructOffset": 170672,
|
|
"ProceduresCount": 21,
|
|
"Procedures": [
|
|
"BthServOpen",
|
|
"BthServClose",
|
|
"BthServRegisterAuthenticationEvent",
|
|
"BthServDeregisterAuthenticationEvent",
|
|
"BthServGetAuthRequest",
|
|
"BthServGetDeviceInfo",
|
|
"BthServSetDeviceName",
|
|
"BthServGetDeviceList",
|
|
"BthServActivateService",
|
|
"BthServUpdateService",
|
|
"BthServGetSdpRecord",
|
|
"BthServSetSdpRecord",
|
|
"BthServSetSdpRecordWithInfo",
|
|
"BthServRemoveSdpRecord",
|
|
"BthServEnableDiscovery",
|
|
"BthServEnableIncomingConnections",
|
|
"BthServUninstallDevice",
|
|
"BthServEirGetRecords",
|
|
"BthServEirSetRecord",
|
|
"BthServEirUpdateRecord",
|
|
"BthServEirRemoveRecord"
|
|
],
|
|
"ProcStackSize": 32,
|
|
"DispatchFunction": 140707581041024,
|
|
"Service": "bthserv",
|
|
"IsServiceRunning": false
|
|
},
|
|
"8d17061c-534a-4f1b-bd77-f615421cf379": {
|
|
"Module": "AppVEntSubsystemController.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\AppVEntSubsystemController.dll",
|
|
"InterfaceId": "8d17061c-534a-4f1b-bd77-f615421cf379",
|
|
"InterfaceStructOffset": 900752,
|
|
"ProceduresCount": 4,
|
|
"Procedures": [
|
|
"vreg_server_GetConfiguration",
|
|
"vreg_server_IsPidInVE",
|
|
"vreg_server_AddDuplicatedKeyToProcess",
|
|
"vreg_server_IsDuplicatedKey"
|
|
],
|
|
"ProcStackSize": 72,
|
|
"DispatchFunction": 140706797782080,
|
|
"Service": null,
|
|
"IsServiceRunning": false
|
|
},
|
|
"30b044a5-a225-43f0-b3a4-e060df91f9c1": {
|
|
"Module": "certprop.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\certprop.dll",
|
|
"InterfaceId": "30b044a5-a225-43f0-b3a4-e060df91f9c1",
|
|
"InterfaceStructOffset": 143360,
|
|
"ProceduresCount": 2,
|
|
"Procedures": [
|
|
"s_RPC_SmartCardRootCertsNotifyService",
|
|
"s_RPC_SmartCardCertsNotifyService"
|
|
],
|
|
"ProcStackSize": 24,
|
|
"DispatchFunction": 140708042710576,
|
|
"Service": "SCPolicySvc",
|
|
"IsServiceRunning": false
|
|
},
|
|
"a69816f5-83b6-4d48-8633-067f99f5f2d3": {
|
|
"Module": "Microsoft.Graphics.Display.DisplayEnhancementService.dll",
|
|
"ModulePath": "C:\\Windows\\System32\\Microsoft.Graphics.Display.DisplayEnhancementService.dll",
|
|
"InterfaceId": "a69816f5-83b6-4d48-8633-067f99f5f2d3",
|
|
"InterfaceStructOffset": 895856,
|
|
"ProceduresCount": 77,
|
|
"Procedures": [
|
|
"DeManagementRpcServerOpenFromMonitorId",
|
|
"DeManagementRpcServerClose",
|
|
"DeManagementRpcServerGetIsNightLightCapable",
|
|
"DeManagementRpcServerGetIsNightLightOverridden",
|
|
"DeManagementRpcServerStartNightLightTransition",
|
|
"DeManagementRpcServerRegisterCallbackForIsNightLightCapableChanged",
|
|
"DeManagementRpcServerUnregisterCallbackForIsNightLightCapableChanged",
|
|
"DeManagementRpcServerRegisterCallbackForIsNightLightOverriddenChanged",
|
|
"DeManagementRpcServerUnregisterCallbackForIsNightLightOverriddenChanged",
|
|
"DeManagementRpcServerGetIsRealColorCapable",
|
|
"DeManagementRpcServerGetIsRealColorOverridden",
|
|
"DeManagementRpcServerGetIsRealColorOn",
|
|
"DeManagementRpcServerSetIsRealColorOn",
|
|
"DeManagementRpcServerGetColorLightSensorDeviceId",
|
|
"DeManagementRpcServerSetColorLightSensorDeviceId",
|
|
"DeManagementRpcServerGetRealColorAdaptationStrength",
|
|
"DeManagementRpcServerSetRealColorAdaptationStrength",
|
|
"DeManagementRpcServerGetAdaptiveColorPolicy",
|
|
"DeManagementRpcServerGetCurrentWhitePoint",
|
|
"DeManagementRpcServerSetCurrentWhitePoint",
|
|
"DeManagementRpcServerRegisterCallbackForIsRealColorCapableChanged",
|
|
"DeManagementRpcServerUnregisterCallbackForIsRealColorCapableChanged",
|
|
"DeManagementRpcServerRegisterCallbackForIsRealColorOnChanged",
|
|
"DeManagementRpcServerUnregisterCallbackForIsRealColorOnChanged",
|
|
"DeManagementRpcServerRegisterCallbackForIsRealColorAdaptationStrengthChanged",
|
|
"DeManagementRpcServerUnregisterCallbackForIsRealColorAdaptationStrengthChanged",
|
|
"DeManagementRpcServerRegisterCallbackForIsRealColorOverriddenChanged",
|
|
"DeManagementRpcServerUnregisterCallbackForIsRealColorOverriddenChanged",
|
|
"DeManagementRpcServerRegisterCallbackForColorLightSensorDeviceIdChanged",
|
|
"DeManagementRpcServerUnregisterCallbackForColorLightSensorDeviceIdChanged",
|
|
"DeManagementRpcServerRegisterCallbackForAdaptiveColorPolicyChanged",
|
|
"DeManagementRpcServerUnregisterCallbackForAdaptiveColorPolicyChanged",
|
|
"DeManagementRpcServerRegisterCallbackForCurrentWhitePointChanged",
|
|
"DeManagementRpcServerUnregisterCallbackForCurrentWhitePointChanged",
|
|
"DeManagementRpcServerGetIsBrightnessCapable",
|
|
"DeManagementRpcServerGetIsAutobrightnessCapable",
|
|
"DeManagementRpcServerGetIsAutobrightnessOn",
|
|
"DeManagementRpcServerSetIsAutobrightnessOn",
|
|
"DeManagementRpcServerGetIsBoostModeOn",
|
|
"DeManagementRpcServerGetBatterySaverBrightnessMultiplier",
|
|
"DeManagementRpcServerSetBatterySaverBrightnessMultiplier",
|
|
"DeManagementRpcServerGetDimBrightnessMultiplier",
|
|
"DeManagementRpcServerSetDimBrightnessMultiplier",
|
|
"DeManagementRpcServerGetUserBrightnessSettingPercent",
|
|
"DeManagementRpcServerSetUserBrightnessSettingPercent",
|
|
"DeManagementRpcServerGetScreenBrightnessPercent",
|
|
"DeManagementRpcServerGetIsBrightnessOverridden",
|
|
"DeManagementRpcServerGetThermalThrottlingMaxMilliNits",
|
|
"DeManagementRpcServerSetThermalThrottlingMaxMilliNits",
|
|
"DeManagementRpcServerGetIsThermalThrottlingOn",
|
|
"DeManagementRpcServerSetIsThermalThrottlingOn",
|
|
"DeManagementRpcServerGetAmbientLightSensorDeviceId",
|
|
"DeManagementRpcServerSetAmbientLightSensorDeviceId",
|
|
"DeManagementRpcServerRegisterCallbackForIsBrightnessCapableChanged",
|
|
"DeManagementRpcServerUnregisterCallbackForIsBrightnessCapableChanged",
|
|
"DeManagementRpcServerRegisterCallbackForIsAutobrightnessCapableChanged",
|
|
"DeManagementRpcServerUnregisterCallbackForIsAutobrightnessCapableChanged",
|
|
"DeManagementRpcServerRegisterCallbackForIsAutobrightnessOnChanged",
|
|
"DeManagementRpcServerUnregisterCallbackForIsAutobrightnessOnChanged",
|
|
"DeManagementRpcServerRegisterCallbackForIsBoostModeOnChanged",
|
|
"DeManagementRpcServerUnregisterCallbackForIsBoostModeOnChanged",
|
|
"DeManagementRpcServerRegisterCallbackForBatterySaverBrightnessMultiplierChanged",
|
|
"DeManagementRpcServerUnregisterCallbackForBatterySaverBrightnessMultiplierChanged",
|
|
"DeManagementRpcServerRegisterCallbackForDimBrightnessMultiplierChanged",
|
|
"DeManagementRpcServerUnregisterCallbackForDimBrightnessMultiplierChanged",
|
|
"DeManagementRpcServerRegisterCallbackForUserBrightnessSettingPercentChanged",
|
|
"DeManagementRpcServerUnregisterCallbackForUserBrightnessSettingPercentChanged",
|
|
"DeManagementRpcServerRegisterCallbackForScreenBrightnessPercentChanged",
|
|
"DeManagementRpcServerUnregisterCallbackForScreenBrightnessPercentChanged",
|
|
"DeManagementRpcServerRegisterCallbackForIsBrightnessOverriddenChanged",
|
|
"DeManagementRpcServerUnregisterCallbackForIsBrightnessOverriddenChanged",
|
|
"DeManagementRpcServerRegisterCallbackForThermalThrottlingMaxMilliNitsChanged",
|
|
"DeManagementRpcServerUnregisterCallbackForThermalThrottlingMaxMilliNitsChanged",
|
|
"DeManagementRpcServerRegisterCallbackForIsThermalThrottlingOnChanged",
|
|
"DeManagementRpcServerUnregisterCallbackForIsThermalThrottlingOnChanged",
|
|
"DeManagementRpcServerRegisterCallbackForAmbientLightSensorDeviceIdChanged",
|
|
"DeManagementRpcServerUnregisterCallbackForAmbientLightSensorDeviceIdChanged"
|
|
],
|
|
"ProcStackSize": 16,
|
|
"DispatchFunction": 140707093519792,
|
|
"Service": "DisplayEnhancementService",
|
|
"IsServiceRunning": false
|
|
}
|
|
} |