diff --git a/ctypes_generation/definitions/winfunc.txt b/ctypes_generation/definitions/winfunc.txt index 0fb7535..a585764 100644 --- a/ctypes_generation/definitions/winfunc.txt +++ b/ctypes_generation/definitions/winfunc.txt @@ -1000,6 +1000,16 @@ NTSTATUS WINAPI NtAlpcQueryInformation( _Out_opt_ PULONG ReturnLength ); + +NTSTATUS WINAPI NtAlpcQueryInformationMessage( + _In_ HANDLE PortHandle, + _In_ PPORT_MESSAGE PortMessage, + _In_ ALPC_MESSAGE_INFORMATION_CLASS MessageInformationClass, + _Out_opt_ PVOID MessageInformation, + _In_ ULONG Length, + _Out_opt_ PULONG ReturnLength +); + NTSTATUS WINAPI NtAlpcConnectPort( _Out_ PHANDLE PortHandle, _In_ PUNICODE_STRING PortName, diff --git a/ctypes_generation/definitions/winstruct.txt b/ctypes_generation/definitions/winstruct.txt index 212d75d..ecbcbdc 100644 --- a/ctypes_generation/definitions/winstruct.txt +++ b/ctypes_generation/definitions/winstruct.txt @@ -14,17 +14,60 @@ typedef struct _PEB_LDR_DATA { typedef struct _LSA_UNICODE_STRING { USHORT Length; USHORT MaximumLength; - PWSTR Buffer; + PVOID Buffer; // PVOID to prevent ctypes to automatically read the content of the buffer till a \0 } LSA_UNICODE_STRING, *PLSA_UNICODE_STRING, UNICODE_STRING, *PUNICODE_STRING; -typedef struct _RTL_USER_PROCESS_PARAMETERS { - BYTE Reserved1[16]; - PVOID Reserved2[10]; - UNICODE_STRING ImagePathName; - UNICODE_STRING CommandLine; +typedef struct _CURDIR +{ + UNICODE_STRING DosPath; + PVOID Handle; +} CURDIR, *PCURDIR; + +typedef struct _RTL_DRIVE_LETTER_CURDIR +{ + WORD Flags; + WORD Length; + ULONG TimeStamp; + UNICODE_STRING DosPath; +} RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR; + +/* This is the part of RTL_USER_PROCESS_PARAMETERS that works from XP to Windows 10 + http://terminus.rewolf.pl/terminus/structures/ntdll/_RTL_USER_PROCESS_PARAMETERS_x86.html +*/ +typedef struct _RTL_USER_PROCESS_PARAMETERS +{ + ULONG MaximumLength; + ULONG Length; + ULONG Flags; + ULONG DebugFlags; + PVOID ConsoleHandle; + ULONG ConsoleFlags; + PVOID StandardInput; + PVOID StandardOutput; + PVOID StandardError; + CURDIR CurrentDirectory; + UNICODE_STRING DllPath; + UNICODE_STRING ImagePathName; + UNICODE_STRING CommandLine; + PVOID Environment; + ULONG StartingX; + ULONG StartingY; + ULONG CountX; + ULONG CountY; + ULONG CountCharsX; + ULONG CountCharsY; + ULONG FillAttribute; + ULONG WindowFlags; + ULONG ShowWindowFlags; + UNICODE_STRING WindowTitle; + UNICODE_STRING DesktopInfo; + UNICODE_STRING ShellInfo; + UNICODE_STRING RuntimeData; + RTL_DRIVE_LETTER_CURDIR CurrentDirectores[32]; } RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS; + typedef struct _PEB { BYTE Reserved1[2]; BYTE BeingDebugged; diff --git a/ctypes_generation/definitions/winstruct_alpc.txt b/ctypes_generation/definitions/winstruct_alpc.txt index b9075d4..f6862f2 100644 --- a/ctypes_generation/definitions/winstruct_alpc.txt +++ b/ctypes_generation/definitions/winstruct_alpc.txt @@ -16,6 +16,13 @@ typedef enum _ALPC_PORT_INFORMATION_CLASS MaxAlpcPortInfoClass } ALPC_PORT_INFORMATION_CLASS; +typedef enum _ALPC_MESSAGE_INFORMATION_CLASS +{ + AlpcMessageSidInformation, + AlpcMessageTokenModifiedIdInformation, + MaxAlpcMessageInfoClass, + AlpcMessageHandleInformation, +} ALPC_MESSAGE_INFORMATION_CLASS, *PALPC_MESSAGE_INFORMATION_CLASS; typedef struct _ALPC_PORT_ATTRIBUTES32 { diff --git a/docs/source/winstructs_generated.rst b/docs/source/winstructs_generated.rst index f7b1f57..75a6363 100644 --- a/docs/source/winstructs_generated.rst +++ b/docs/source/winstructs_generated.rst @@ -85,7 +85,59 @@ _LSA_UNICODE_STRING .. attribute:: Buffer - :class:`PWSTR` + :class:`PVOID` + +_CURDIR +''''''' +.. class:: PCURDIR + + Pointer to :class:`_CURDIR` + +.. class:: CURDIR + + Alias for :class:`_CURDIR` + +.. class:: _CURDIR + + .. attribute:: DosPath + + :class:`UNICODE_STRING` + + + .. attribute:: Handle + + :class:`PVOID` + +_RTL_DRIVE_LETTER_CURDIR +'''''''''''''''''''''''' +.. class:: PRTL_DRIVE_LETTER_CURDIR + + Pointer to :class:`_RTL_DRIVE_LETTER_CURDIR` + +.. class:: RTL_DRIVE_LETTER_CURDIR + + Alias for :class:`_RTL_DRIVE_LETTER_CURDIR` + +.. class:: _RTL_DRIVE_LETTER_CURDIR + + .. attribute:: Flags + + :class:`WORD` + + + .. attribute:: Length + + :class:`WORD` + + + .. attribute:: TimeStamp + + :class:`ULONG` + + + .. attribute:: DosPath + + :class:`UNICODE_STRING` _RTL_USER_PROCESS_PARAMETERS '''''''''''''''''''''''''''' @@ -99,14 +151,59 @@ _RTL_USER_PROCESS_PARAMETERS .. class:: _RTL_USER_PROCESS_PARAMETERS - .. attribute:: Reserved1 + .. attribute:: MaximumLength - :class:`BYTE` ``[16]`` + :class:`ULONG` - .. attribute:: Reserved2 + .. attribute:: Length - :class:`PVOID` ``[10]`` + :class:`ULONG` + + + .. attribute:: Flags + + :class:`ULONG` + + + .. attribute:: DebugFlags + + :class:`ULONG` + + + .. attribute:: ConsoleHandle + + :class:`PVOID` + + + .. attribute:: ConsoleFlags + + :class:`ULONG` + + + .. attribute:: StandardInput + + :class:`PVOID` + + + .. attribute:: StandardOutput + + :class:`PVOID` + + + .. attribute:: StandardError + + :class:`PVOID` + + + .. attribute:: CurrentDirectory + + :class:`CURDIR` + + + .. attribute:: DllPath + + :class:`UNICODE_STRING` .. attribute:: ImagePathName @@ -118,6 +215,81 @@ _RTL_USER_PROCESS_PARAMETERS :class:`UNICODE_STRING` + + .. attribute:: Environment + + :class:`PVOID` + + + .. attribute:: StartingX + + :class:`ULONG` + + + .. attribute:: StartingY + + :class:`ULONG` + + + .. attribute:: CountX + + :class:`ULONG` + + + .. attribute:: CountY + + :class:`ULONG` + + + .. attribute:: CountCharsX + + :class:`ULONG` + + + .. attribute:: CountCharsY + + :class:`ULONG` + + + .. attribute:: FillAttribute + + :class:`ULONG` + + + .. attribute:: WindowFlags + + :class:`ULONG` + + + .. attribute:: ShowWindowFlags + + :class:`ULONG` + + + .. attribute:: WindowTitle + + :class:`UNICODE_STRING` + + + .. attribute:: DesktopInfo + + :class:`UNICODE_STRING` + + + .. attribute:: ShellInfo + + :class:`UNICODE_STRING` + + + .. attribute:: RuntimeData + + :class:`UNICODE_STRING` + + + .. attribute:: CurrentDirectores + + :class:`RTL_DRIVE_LETTER_CURDIR` ``[32]`` + _PEB '''' .. class:: PPEB @@ -13076,3 +13248,27 @@ _ALPC_PORT_INFORMATION_CLASS .. attribute:: MaxAlpcPortInfoClass(12) +_ALPC_MESSAGE_INFORMATION_CLASS +''''''''''''''''''''''''''''''' +.. class:: ALPC_MESSAGE_INFORMATION_CLASS + + Alias for :class:`_ALPC_MESSAGE_INFORMATION_CLASS` + +.. class:: PALPC_MESSAGE_INFORMATION_CLASS + + Pointer to :class:`_ALPC_MESSAGE_INFORMATION_CLASS` + +.. class:: _ALPC_MESSAGE_INFORMATION_CLASS + + + .. attribute:: AlpcMessageSidInformation(0) + + + .. attribute:: AlpcMessageTokenModifiedIdInformation(1) + + + .. attribute:: MaxAlpcMessageInfoClass(2) + + + .. attribute:: AlpcMessageHandleInformation(3) + diff --git a/windows/alpc.py b/windows/alpc.py index 2785bb8..d63259b 100644 --- a/windows/alpc.py +++ b/windows/alpc.py @@ -357,7 +357,7 @@ class AlpcClient(AlpcTransportBase): def _alpc_port_to_unicode_string(self, name): utf16_len = len(name) * 2 - return gdef.UNICODE_STRING(utf16_len, utf16_len, name) + return gdef.UNICODE_STRING(utf16_len, utf16_len, ctypes.cast(gdef.PWSTR(name), gdef.PVOID)) def connect_to_port(self, port_name, connect_message=None, port_attr=None, port_attr_flags=0x10000, obj_attr=None, @@ -453,7 +453,7 @@ class AlpcServer(AlpcTransportBase): def _alpc_port_to_unicode_string(self, name): utf16_len = len(name) * 2 - return gdef.UNICODE_STRING(utf16_len, utf16_len, name) + return gdef.UNICODE_STRING(utf16_len, utf16_len, ctypes.cast(gdef.PWSTR(name), gdef.PVOID)) def create_port(self, port_name, msglen=None, port_attr_flags=0, obj_attr=None, port_attr=None): """Create the ALPC port ``port_name``. Most of the parameters have defauls value is ``None`` is passed. diff --git a/windows/generated_def/meta.py b/windows/generated_def/meta.py index c56cd7e..ecce799 100644 --- a/windows/generated_def/meta.py +++ b/windows/generated_def/meta.py @@ -1,6 +1,6 @@ -functions = set(['GetFileVersionInfoSizeA', 'NtOpenSection', 'GetStdHandle', 'GetDriveTypeW', 'GetModuleBaseNameA', 'ConvertSidToStringSidW', 'GetComputerNameA', 'NtQuerySymbolicLinkObject', 'AddVectoredContinueHandler', 'GetDriveTypeA', 'CertAddCertificateContextToStore', 'DebugBreak', 'GetFileVersionInfoSizeW', 'ConvertSidToStringSidA', 'DuplicateHandle', 'GetExtendedTcpTable', 'GetProcessId', 'GetSidSubAuthorityCount', 'GetCurrentProcess', 'NtReadVirtualMemory', 'ShellExecuteA', 'CertEnumCertificateContextProperties', 'NtWow64ReadVirtualMemory64', 'DebugActiveProcessStop', 'GetClipboardFormatNameW', 'RegOpenKeyExW', 'WindowFromPoint', 'InitializeProcThreadAttributeList', 'CryptMsgGetParam', 'NtOpenSymbolicLinkObject', 'CryptCATAdminEnumCatalogFromHash', 'NtAlpcCreateSecurityContext', 'RegOpenKeyExA', 'QueryWorkingSetEx', 'CertEnumCTLsInStore', 'MessageBoxW', 'GetThreadContext', 'GetTokenInformation', 'SetStdHandle', 'PFXImportCertStore', 'WaitForDebugEvent', 'GetNamedSecurityInfoA', 'LocalFree', 'OpenThreadToken', 'NtAlpcDisconnectPort', 'WriteFile', 'GetCursorPos', 'NtCreateFile', 'WaitForSingleObject', 'GetLogicalDriveStringsW', 'CertStrToNameA', 'Thread32First', 'AlpcInitializeMessageAttribute', 'CryptAcquireCertificatePrivateKey', 'NtQueryObject', 'ResumeThread', 'NtAlpcConnectPortEx', 'QueryDosDeviceA', 'AddVectoredExceptionHandler', 'GetMappedFileNameW', 'GetLogicalDriveStringsA', 'LoadResource', 'GetWindowTextW', 'EnumClipboardFormats', 'AllocConsole', 'CryptCATEnumerateMember', 'QueryDosDeviceW', 'CryptCATEnumerateCatAttr', 'GetWindowTextA', 'GetProcessImageFileNameA', 'RtlGetUnloadEventTraceEx', 'CryptDestroyKey', 'OpenThread', 'GetProcessImageFileNameW', 'NtAlpcDeleteSecurityContext', 'OpenServiceA', 'WriteProcessMemory', 'NtSetContextThread', 'GetProcessDEPPolicy', 'GetModuleFileNameW', 'EnumWindows', 'CertStrToNameW', 'OpenServiceW', 'ExitProcess', 'CoInitializeSecurity', 'GetSecurityInfo', 'GetModuleFileNameA', 'CryptExportKey', 'NtAlpcDeletePortSection', 'RegQueryValueExW', 'NtQueryVirtualMemory', 'WinVerifyTrust', 'CloseServiceHandle', 'CryptCATGetAttrInfo', 'GetSidSubAuthority', 'GetPriorityClass', 'LoadLibraryExA', 'GetMappedFileNameA', 'NtAlpcConnectPort', 'SetConsoleCtrlHandler', 'NtAlpcCreateSectionView', 'CertDuplicateCertificateContext', 'TpCallbackSendAlpcMessageOnCompletion', 'SymInitialize', 'LoadLibraryExW', 'CryptEncryptMessage', 'GetClipboardData', 'MapViewOfFile', 'GetModuleBaseNameW', 'CryptGenKey', 'RtlDecompressBuffer', 'NtQuerySystemInformation', 'GetVolumeNameForVolumeMountPointA', 'CreateThread', 'SetClipboardData', 'CreateProcessAsUserA', 'DebugSetProcessKillOnExit', 'StartServiceW', 'GetExitCodeThread', 'SetTcpEntry', 'CryptCATCatalogInfoFromContext', 'CryptCATAdminAcquireContext', 'GetIpAddrTable', 'GetVolumeNameForVolumeMountPointW', 'CertEnumCertificatesInStore', 'ExitThread', 'CreateProcessAsUserW', 'CryptDecodeObject', 'NtProtectVirtualMemory', 'SetPriorityClass', 'SetThreadContext', 'SymSetOptions', 'TerminateProcess', 'NtGetContextThread', 'NtAlpcCreatePortSection', 'GetWindowsDirectoryW', 'CryptCATGetMemberInfo', 'NtAlpcCreateResourceReserve', 'VirtualQuery', 'DebugActiveProcess', 'VirtualQueryEx', 'NtOpenDirectoryObject', 'SymGetTypeInfo', 'CryptCATAdminReleaseContext', 'LdrLoadDll', 'GetCurrentThreadId', 'GetExtendedUdpTable', 'CreateWellKnownSid', 'CryptCATAdminCalcHashFromFileHandle', 'CreateToolhelp32Snapshot', 'StartServiceA', 'RtlInitUnicodeString', 'RegCloseKey', 'LookupAccountSidW', 'NtOpenEvent', 'Process32First', 'TerminateThread', 'LoadLibraryW', 'LookupPrivilegeValueA', 'GetVersionExW', 'GetExitCodeProcess', 'LookupAccountSidA', 'RegQueryValueExA', 'Wow64SetThreadContext', 'VirtualProtect', 'GetVersionExA', 'LoadLibraryA', 'GetSystemMetrics', 'Process32Next', 'CreateRemoteThread', 'NtAlpcSendWaitReceivePort', 'NtCreateThreadEx', 'OpenProcessToken', 'GetWindowRect', 'QueryWorkingSet', 'OpenProcess', 'CryptDecryptMessage', 'GetWindowsDirectoryA', 'DeviceIoControl', 'ReadProcessMemory', 'GetProcAddress', 'CryptCATEnumerateAttr', 'VirtualProtectEx', 'CreateFileMappingW', 'RtlAnsiStringToUnicodeString', 'CryptAcquireContextA', 'GetCurrentProcessorNumber', 'GetSidIdentifierAuthority', 'CertCompareCertificate', 'Wow64GetThreadContext', 'DebugBreakProcess', 'CertFreeCTLContext', 'NtQueryInformationThread', 'CoInitializeEx', 'CertFindCertificateInStore', 'CertGetNameStringA', 'FreeConsole', 'CreateFileMappingA', 'Thread32Next', 'lstrcmpW', 'SymLoadModuleEx', 'GlobalAlloc', 'CertGetCertificateContextProperty', 'NtQueryDirectoryObject', 'SuspendThread', 'NtCreateSection', 'NtAlpcQueryInformation', 'ShellExecuteW', 'CertOpenStore', 'VerQueryValueW', 'CreateFileW', 'UpdateProcThreadAttribute', 'NtWow64WriteVirtualMemory64', 'CryptCATAdminReleaseCatalogContext', 'CreateFileA', 'LookupPrivilegeValueW', 'RemoveVectoredExceptionHandler', 'OpenClipboard', 'EmptyClipboard', 'GetLastError', 'PFXExportCertStoreEx', 'GetComputerNameW', 'GetShortPathNameW', 'VirtualAllocEx', 'NtAlpcDeleteResourceReserve', 'GlobalFree', 'OpenEventW', 'AlpcGetMessageAttribute', 'AdjustTokenPrivileges', 'GetInterfaceInfo', 'CryptReleaseContext', 'GetProcessTimes', 'GetIfTable', 'GetVolumeInformationW', 'GlobalUnlock', 'SymFromName', 'CertCreateSelfSignCertificate', 'GetShortPathNameA', 'NtMapViewOfSection', 'Process32NextW', 'VirtualFree', 'NtAlpcAcceptConnectPort', 'CryptEncodeObjectEx', 'ConvertStringSidToSidW', 'SizeofResource', 'Wow64DisableWow64FsRedirection', 'VirtualFreeEx', 'RegGetValueW', 'LockResource', 'ContinueDebugEvent', 'ConvertStringSidToSidA', 'GetLongPathNameA', 'SetTokenInformation', 'CertDuplicateCTLContext', 'Wow64EnableWow64FsRedirection', 'NtAlpcDeleteSectionView', 'SetThreadAffinityMask', 'RegGetValueA', 'VerQueryValueA', 'Process32FirstW', 'GetCurrentThread', 'LookupPrivilegeNameW', 'CoCreateInstance', 'GetWindowModuleFileNameA', 'NtAlpcRevokeSecurityContext', 'GetNamedSecurityInfoW', 'EnumServicesStatusExW', 'lstrcmpA', 'CertCreateCertificateContext', 'NtUnmapViewOfSection', 'ReadFile', 'CryptQueryObject', 'ZwDuplicateObject', 'GetWindowModuleFileNameW', 'Wow64RevertWow64FsRedirection', 'CloseHandle', 'LookupPrivilegeNameA', 'GetLengthSid', 'GetClipboardFormatNameA', 'CertGetCertificateChain', 'GlobalLock', 'GetVersion', 'EnumServicesStatusExA', 'OpenSCManagerA', 'CryptAcquireContextW', 'DeleteProcThreadAttributeList', 'OpenEventA', 'GetFileVersionInfoA', 'GetLongPathNameW', 'CreateProcessA', 'MessageBoxA', 'GetThreadId', 'NtAlpcCreatePort', 'OpenSCManagerW', 'FindResourceW', 'CreateProcessW', 'CryptUIDlgViewContext', 'GetFileVersionInfoW', 'GetVolumeInformationA', 'CertGetNameStringW', 'CloseClipboard', 'RtlInitString', 'FindResourceA', 'VirtualAlloc', 'NtQueryInformationProcess']) -enums = set(['_BG_JOB_TYPE', 'VARENUM', 'INTERNAL_IF_OPER_STATUS', 'NET_FW_RULE_DIRECTION', 'TYPEKIND', '_BG_JOB_PROXY_USAGE', '_TCP_TABLE_CLASS', 'BG_JOB_PROXY_USAGE', 'SE_OBJECT_TYPE', '_TOKEN_INFORMATION_CLASS', '_IMAGEHLP_SYMBOL_TYPE_INFO', 'tagTYPEKIND', '_THREAD_INFORMATION_CLASS', 'SC_ENUM_TYPE', 'tagCLSCTX', 'BG_JOB_STATE', '_VARENUM', 'NET_FW_ACTION', 'NET_FW_PROFILE_TYPE2_', 'BG_JOB_TYPE', '_WELL_KNOWN_SID_TYPE', 'NET_FW_ACTION_', '_MEMORY_INFORMATION_CLASS', 'PTHREAD_INFORMATION_CLASS', '_INTERNAL_IF_OPER_STATUS', 'OBJECT_INFORMATION_CLASS', '_BG_ERROR_CONTEXT', 'UDP_TABLE_CLASS', 'PSID_NAME_USE', 'SC_STATUS_TYPE', 'CLSCTX', '_BG_JOB_STATE', 'tagCOINIT', '_SECURITY_IMPERSONATION_LEVEL', 'MIB_TCP_STATE', 'ALPC_PORT_INFORMATION_CLASS', '_SC_ENUM_TYPE', 'PROCESSINFOCLASS', 'TCP_TABLE_CLASS', '_SE_OBJECT_TYPE', '_UDP_TABLE_CLASS', '_SYSTEM_INFORMATION_CLASS', 'SYSTEM_INFORMATION_CLASS', 'IMAGEHLP_SYMBOL_TYPE_INFO', '_BG_JOB_PRIORITY', '_MIB_TCP_STATE', '_PROCESSINFOCLASS', 'WBEMSTATUS', 'NET_FW_MODIFY_STATE_', '_SECTION_INHERIT', 'PTOKEN_INFORMATION_CLASS', 'SID_NAME_USE', 'SECURITY_IMPERSONATION_LEVEL', 'BG_JOB_PRIORITY', 'BG_ERROR_CONTEXT', '_SC_STATUS_TYPE', '_ALPC_PORT_INFORMATION_CLASS', 'tag_WBEMSTATUS', 'NET_FW_PROFILE_TYPE2', '_OBJECT_INFORMATION_CLASS', 'WELL_KNOWN_SID_TYPE', 'TOKEN_INFORMATION_CLASS', 'MEMORY_INFORMATION_CLASS', 'COINIT', '_SID_NAME_USE', 'NET_FW_IP_PROTOCOL_', 'NET_FW_MODIFY_STATE', 'SECTION_INHERIT', 'NET_FW_IP_PROTOCOL', 'NET_FW_RULE_DIRECTION_', 'THREAD_INFORMATION_CLASS', 'PSECURITY_IMPERSONATION_LEVEL']) -structs = set(['PCRYPT_ATTRIBUTE_TYPE_VALUE', 'PALPC_HANDLE_ATTR', '_DEBUG_STACK_FRAME', 'CERT_INFO', 'PCRYPT_ATTRIBUTES', 'MIB_UDPTABLE_OWNER_PID', 'CRYPT_KEY_PROV_PARAM', 'PORT_MESSAGE_TMP_UNION', 'DEBUG_PROCESSOR_IDENTIFICATION_IA64', 'LPUNLOAD_DLL_DEBUG_INFO', 'PACCESS_DENIED_CALLBACK_ACE', 'LPEXCEPTION_DEBUG_INFO', '__tagVARIANT', '_CERT_TRUST_LIST_INFO', '_ALPC_MESSAGE_ATTRIBUTES', 'PALPC_PORT_ATTRIBUTES64', '_MIB_IFTABLE', 'NPRGBTRIPLE', 'LPRIP_INFO', '__PUBLIC_OBJECT_TYPE_INFORMATION', 'PFILETIME', 'IP_ADAPTER_INDEX_MAP', 'PANSI_STRING', 'PRTL_UNLOAD_EVENT_TRACE64', '_ALPC_PORT_ATTRIBUTES64', '_PSAPI_WORKING_SET_EX_BLOCK32', 'CRYPT_UINT_BLOB', '_RIP_INFO', '_ACCESS_DENIED_ACE', '_SYSTEMTIME', 'PCERT_RDN_VALUE_BLOB', 'PPSAPI_WORKING_SET_EX_INFORMATION', '_FILETIME', 'SERVICE_STATUS', 'PDEBUG_REGISTER_DESCRIPTION', 'GUID', 'PDEBUG_MODULE_AND_ID', 'SYSTEM_HANDLE_INFORMATION', 'PUNICODE_STRING', 'PBITMAPCOREINFO', 'CRL_CONTEXT', 'SERVICE_STATUS_PROCESS', 'WINTRUST_FILE_INFO_', 'PIMAGE_OPTIONAL_HEADER32', '_CMSG_SIGNER_INFO', '_IP_INTERFACE_INFO', 'SYSTEM_MANDATORY_LABEL_ACE', 'PSPC_SP_OPUS_INFO', 'ALPC_DIRECT_ATTR64', '_IMAGE_OPTIONAL_HEADER', 'XSAVE_FORMAT_32', 'LPCONTEXT64', '_LOAD_DLL_DEBUG_INFO', 'PALPC_CONTEXT_ATTR', 'PDEBUG_PROCESSOR_IDENTIFICATION_ALL', 'LPJIT_DEBUG_INFO', 'PXSAVE_FORMAT_32', '_MIB_TCP6ROW_OWNER_PID', 'ALPC_CONTEXT_ATTR64', '_CRYPT_KEY_PROV_PARAM', 'PACE_HEADER', '_ALPC_CONTEXT_ATTR', 'WINTRUST_CATALOG_INFO_', '_DEBUG_OFFSET_REGION', 'PROCESS_BASIC_INFORMATION', 'CTL_INFO', 'BG_FILE_INFO', 'OSVERSIONINFOW', 'LPSECURITY_ATTRIBUTES', 'OSVERSIONINFOA', 'EXCEPTION_POINTERS64', '_PSAPI_WORKING_SET_BLOCK64', 'BG_FILE_PROGRESS', 'EXCEPINFO', 'ACCESS_ALLOWED_ACE', 'DEBUG_LAST_EVENT_INFO_EXIT_THREAD', 'PMIB_IFROW', 'LPLOAD_DLL_DEBUG_INFO', 'PCRYPT_BIT_BLOB', 'PSIP_INDIRECT_DATA', '_DEBUG_SYMBOL_ENTRY', 'PPROCESS_BASIC_INFORMATION', 'SPC_LINK_', '_ACCESS_ALLOWED_CALLBACK_OBJECT_ACE', '_ALPC_DATA_VIEW_ATTR32', '_JIT_DEBUG_INFO', '_DEBUG_EVENT', 'CONTEXT32', 'LPBITMAPFILEHEADER', 'PMIB_UDPROW_OWNER_PID', 'LPEXIT_THREAD_DEBUG_INFO', 'PSYMBOL_INFO', 'PUBLIC_OBJECT_BASIC_INFORMATION', '_ALPC_PORT_ATTRIBUTES32', '_ALPC_SERVER_INFORMATION_TMP_IN', 'ACCESS_DENIED_CALLBACK_ACE', '_DEBUG_SPECIFIC_FILTER_PARAMETERS', '_CRL_ENTRY', '_SYSTEM_MODULE64', '_DEBUG_VALUE', 'PPROCESSENTRY32', 'DEBUG_VALUE_TMP_UNION', '_TMP_signscale', 'WINTRUST_FILE_INFO', 'REFGUID', '_SERVICE_STATUS_PROCESS', 'TOKEN_PRIVILEGES', 'PMIB_TCPTABLE_OWNER_PID', 'REFIID', 'POSVERSIONINFOEXA', '_CREATE_THREAD_DEBUG_INFO', 'POINT', 'MIB_IPADDRROW_XP', 'MEMORY_BASIC_INFORMATION32', 'SECURITY_ATTRIBUTES', 'IMAGE_NT_HEADERS32', '_IMAGE_IMPORT_BY_NAME', 'PALPC_SECURITY_ATTR64', 'PALPC_HANDLE_ATTR32', 'PIMAGE_EXPORT_DIRECTORY', 'MIB_TCPTABLE_OWNER_PID', 'LPDEBUG_EVENT', 'PACCESS_DENIED_OBJECT_ACE', 'DISPPARAMS', '_TMP_CONTEXT64_SUBUNION', 'PCRYPTCATMEMBER', 'ALPC_HANDLE_ATTR', 'CRYPT_DIGEST_BLOB', 'TOKEN_ELEVATION', 'tagBITMAPINFOHEADER', '_ACCESS_DENIED_OBJECT_ACE', 'PDEBUG_PROCESSOR_IDENTIFICATION_ARM', '_ACCESS_ALLOWED_ACE', '_ALPC_DIRECT_ATTR32', 'PCCTL_CONTEXT', 'CTL_ENTRY', 'LPBITMAPCOREINFO', 'PCRL_INFO', '_ALPC_TOKEN_ATTR', 'CRYPT_ENCRYPT_MESSAGE_PARA', 'CERT_CHAIN_PARA', '_STARTUPINFOEXW', '_MIB_TCPROW', 'STARTUPINFOEXW', '_DEBUG_PROCESSOR_IDENTIFICATION_X86', 'PPORT_MESSAGE32', 'PALPC_DATA_VIEW_ATTR32', '_DEBUG_PROCESSOR_IDENTIFICATION_ALL', 'LPFILETIME', '_IMAGE_NT_HEADERS', 'ALPC_CONTEXT_ATTR32', 'STARTUPINFOEXA', 'PMIB_UDP6TABLE_OWNER_PID', 'MIB_IPADDRROW', '_RPC_IF_ID', 'SOLE_AUTHENTICATION_SERVICE', 'PSPC_SERIALIZED_OBJECT', 'ACCESS_ALLOWED_CALLBACK_OBJECT_ACE', '_TMP_lowmid', 'WINTRUST_BLOB_INFO', '_CLIENT_ID32', 'PALPC_DIRECT_ATTR32', 'PCRYPT_ATTR_BLOB', 'ALPC_SERVER_INFORMATION_TMP_IN', 'PPSAPI_WORKING_SET_INFORMATION32', 'PCTL_CONTEXT', 'PPUBLIC_OBJECT_BASIC_INFORMATION', 'REFCLSID', '_SECURITY_ATTRIBUTES', 'PCRL_CONTEXT', 'LSA_UNICODE_STRING', 'PCRYPT_UINT_BLOB', '_CRL_CONTEXT', 'OBJECT_DIRECTORY_INFORMATION', '_LUID', 'IID', 'CLIENT_ID32', 'PALPC_TOKEN_ATTR', 'CRYPTCATATTRIBUTE_', 'ALPC_DIRECT_ATTR', 'PSPC_LINK', 'PCERT_KEY_CONTEXT', 'LPTHREADENTRY32', 'CATALOG_INFO_', 'PSTRING', 'SAFEARRAY', '_ALPC_SECURITY_ATTR', 'PPSAPI_WORKING_SET_BLOCK64', 'PCANSI_STRING', '_MIB_TCPROW_OWNER_PID', '_CREATE_PROCESS_DEBUG_INFO', 'PDEBUG_MODULE_PARAMETERS', 'IO_STATUS_BLOCK', 'PTOKEN_MANDATORY_LABEL', 'EXIT_THREAD_DEBUG_INFO', 'PSID_AND_ATTRIBUTES', 'ALPC_SECURITY_ATTR32', 'CRYPTCATMEMBER', 'EVENTLOGRECORD', '_IMAGE_NT_HEADERS64', 'PCRYPT_KEY_PROV_INFO', '_DEBUG_VALUE_TMP_SUBSTRUCT2', 'DEBUG_LAST_EVENT_INFO_EXCEPTION', '_DEBUG_VALUE_TMP_SUBSTRUCT1', 'EXCEPTION_POINTERS32', '_TMP_UNION_DEBUG_INFO', 'PCERT_CHAIN_ELEMENT', 'RTL_OSVERSIONINFOEXW', 'PMEMORY_BASIC_INFORMATION', 'PMEMORY_BASIC_INFORMATION32', 'ALPC_SECURITY_ATTR64', '_IMAGE_DATA_DIRECTORY', 'TMP_UNION_DEBUG_INFO', 'PWINTRUST_CERT_INFO', 'VARIANT', 'OBJECT_ATTRIBUTES', 'PCRYPT_DATA_BLOB', '_PSAPI_WORKING_SET_INFORMATION64', '_THREAD_BASIC_INFORMATION', 'tagBITMAPFILEHEADER', '_PORT_MESSAGE32_TMP_UNION', 'LPCREATE_THREAD_DEBUG_INFO', 'PCRYPT_DER_BLOB', 'PALPC_DIRECT_ATTR64', 'tagTHREADENTRY32', 'PDEBUG_SYMBOL_SOURCE_ENTRY', 'LPBITMAPINFO', 'PCTL_USAGE', 'PSYSTEM_HANDLE_INFORMATION', 'DEBUG_OFFSET_REGION', '_EVENTLOGRECORD', 'EXCEPTION_DEBUG_INFO', 'PSAPI_WORKING_SET_BLOCK64', 'PSYSTEM_MODULE_INFORMATION32', 'PCERT_ENHKEY_USAGE', '_OSVERSIONINFOW', 'PALPC_CONTEXT_ATTR64', 'PRTL_USER_PROCESS_PARAMETERS', 'PCRYPTCATATTRIBUTE', '_SYSTEM_MODULE_INFORMATION32', 'CERT_ENHKEY_USAGE', '_CERT_REVOCATION_CRL_INFO', 'LPPOINT', '_OSVERSIONINFOA', 'CERT_REVOCATION_CRL_INFO', 'PSAPI_WORKING_SET_BLOCK', 'PBITMAPINFO', 'PRGBTRIPLE', 'FLOATING_SAVE_AREA', 'LPSTARTUPINFOEXA', 'PROCESSENTRY32', 'LUID_AND_ATTRIBUTES', 'PCCERT_CHAIN_ELEMENT', '_CERT_USAGE_MATCH', 'IMAGE_NT_HEADERS64', 'tagEXCEPINFO', 'CREATE_THREAD_DEBUG_INFO', 'LPSTARTUPINFOEXW', '_CRYPT_DECRYPT_MESSAGE_PARA', '_MIB_IFROW', 'PCERT_SIMPLE_CHAIN', '_MIB_TCPTABLE_OWNER_PID', '_ACCESS_ALLOWED_OBJECT_ACE', '_TMP_UNION_IO_STATUS_BLOCK', '_MEMORY_BASIC_INFORMATION', 'PRTL_OSVERSIONINFOEXW', 'FILETIME', '_CERT_CHAIN_PARA', 'PMIB_TCPROW_OWNER_PID', 'BG_JOB_TIMES', '_SYSTEM_VERIFIER_INFORMATION', '_TMP_WINTRUST_UNION_TYPE', 'PACL', 'RPC_IF_ID', '_CONTEXT32', 'CERT_EXTENSION', '_BG_FILE_INFO', '_EXCEPTION_POINTERS32', '_EXCEPTION_DEBUG_INFO', 'tagBITMAPCOREHEADER', 'PIMAGE_SECTION_HEADER', '_PEB_LDR_DATA', '_TMP_DUMMYSTRUCTNAME', 'SYSTEM_MODULE32', 'LOAD_DLL_DEBUG_INFO', 'CRYPT_ATTRIBUTES', 'CRYPTCATATTRIBUTE', '_DEBUG_EXCEPTION_FILTER_PARAMETERS', '_TOKEN_ELEVATION', '_GUID', 'ACCESS_ALLOWED_OBJECT_ACE', 'PCERT_REVOCATION_INFO', 'PCRYPT_DECRYPT_MESSAGE_PARA', '_MODLOAD_DATA', 'PCERT_CHAIN_CONTEXT', 'PPSAPI_WORKING_SET_INFORMATION64', 'MIB_TCP6ROW_OWNER_PID', 'THREAD_BASIC_INFORMATION', 'SID_IDENTIFIER_AUTHORITY', 'ALPC_DATA_VIEW_ATTR64', 'ALPC_PORT_ATTRIBUTES64', '_OVERLAPPED', 'OVERLAPPED', 'ALPC_DATA_VIEW_ATTR', 'RTL_OSVERSIONINFOW', 'IMAGE_IMPORT_BY_NAME', '_ALPC_DATA_VIEW_ATTR64', 'PBITMAPFILEHEADER', 'RGBTRIPLE', '_STARTUPINFOEXA', '_SYMBOL_INFO', '_IMAGE_IMPORT_DESCRIPTOR', 'ENUM_SERVICE_STATUS_PROCESSA', 'PSOLE_AUTHENTICATION_SERVICE', '_TOKEN_MANDATORY_LABEL', '_DEBUG_VALUE_TMP_SUBSTRUCT3', 'TMP_lowmid_union', 'CLIENT_ID64', '_MIB_UDPTABLE_OWNER_PID', 'CERT_USAGE_MATCH', 'DEBUG_MODULE_PARAMETERS', 'PMODLOAD_DATA', 'tagPROCESSENTRY32', 'SYSTEM_MODULE_INFORMATION32', 'PACCESS_ALLOWED_OBJECT_ACE', 'DEBUG_PROCESSOR_IDENTIFICATION_X86', 'PMIB_UDPTABLE_OWNER_PID', 'ACCESS_DENIED_ACE', '_OBJECT_DIRECTORY_INFORMATION', 'PIMAGE_DATA_DIRECTORY', 'PPSAPI_WORKING_SET_EX_BLOCK32', '_ALPC_DIRECT_ATTR64', 'THREADENTRY32', '_ALPC_HANDLE_ATTR64', '_PUBLIC_OBJECT_BASIC_INFORMATION', 'PPSAPI_WORKING_SET_BLOCK32', '_MIB_TCP6TABLE_OWNER_PID', '_CLIENT_ID', '_CERT_INFO', 'MODLOAD_DATA', 'MIB_IFTABLE', '_ALPC_SECURITY_ATTR32', 'POBJECT_DIRECTORY_INFORMATION', 'SYSTEM_VERIFIER_INFORMATION', 'PEXCEPTION_RECORD32', 'LPVARIANT', 'ALPC_HANDLE_ATTR32', 'PPROCESSENTRY32W', 'DECIMAL', 'SID_AND_ATTRIBUTES', '_ACL', 'EXCEPTION_RECORD64', 'tagSOLE_AUTHENTICATION_SERVICE', '_ENUM_SERVICE_STATUS_PROCESSW', '_MIB_UDPROW_OWNER_PID', 'SYMBOL_INFO', '_CRYPT_ENCODE_PARA', 'PDEBUG_VALUE', 'PSAPI_WORKING_SET_BLOCK32', 'PACCESS_ALLOWED_ACE', 'PSYSTEM_MODULE_INFORMATION64', 'PROCESSENTRY32W', '_PORT_MESSAGE_TMP_SUBSTRUCT_S1', 'PALPC_DIRECT_ATTR', 'PDEBUG_LAST_EVENT_INFO_SYSTEM_ERROR', '_LUID_AND_ATTRIBUTES', 'PALPC_SECURITY_ATTR', 'DEBUG_LAST_EVENT_INFO_LOAD_MODULE', 'PCRYPT_DIGEST_BLOB', '_SYSTEM_MODULE_INFORMATION64', 'PIMAGE_IMPORT_BY_NAME', 'PDEBUG_LAST_EVENT_INFO_EXCEPTION', 'SECURITY_QUALITY_OF_SERVICE', 'PPSAPI_WORKING_SET_INFORMATION', '_ALPC_HANDLE_ATTR', 'LPPROCESSENTRY32W', 'PRLIST_ENTRY', 'POSVERSIONINFOA', 'PLIST_ENTRY', 'tagPROCESSENTRY32W', 'LUID', '_RTL_UNLOAD_EVENT_TRACE64', 'TOKEN_USER', 'SIP_INDIRECT_DATA_', 'PCRYPT_OBJID_BLOB', 'CLIENT_ID', 'IMAGE_OPTIONAL_HEADER64', '_CERT_KEY_CONTEXT', '_PSAPI_WORKING_SET_EX_BLOCK64', '_ENUM_SERVICE_STATUS_PROCESSA', 'PCRL_BLOB', 'PCERT_EXTENSIONS', 'MIB_TCPROW', 'TMP_SPC_LINK_UNION', '_IMAGE_FILE_HEADER', 'ALPC_DATA_VIEW_ATTR32', 'LPOVERLAPPED', 'PALPC_DATA_VIEW_ATTR', 'PSID_IDENTIFIER_AUTHORITY', 'PLSA_UNICODE_STRING', '_CTL_INFO', '_EXCEPTION_POINTERS64', 'PDEBUG_LAST_EVENT_INFO_LOAD_MODULE', 'PALPC_CONTEXT_ATTR32', 'MIB_UDP6TABLE_OWNER_PID', 'PIMAGE_NT_HEADERS32', 'STRING', 'LPSAFEARRAYBOUND', '_CERT_CHAIN_ELEMENT', 'PCONTEXT32', 'ACCESS_ALLOWED_CALLBACK_ACE', 'PMIB_UDP6ROW_OWNER_PID', 'CRL_BLOB', 'BITMAPCOREHEADER', 'POBJECT_ATTRIBUTES', 'PCERT_CHAIN_ENGINE_CONFIG', '_DEBUG_LAST_EVENT_INFO_BREAKPOINT', 'PTOKEN_ELEVATION', '_CRL_INFO', 'WOW64_FLOATING_SAVE_AREA', '_LIST_ENTRY', '_PORT_MESSAGE32', 'PCERT_REVOCATION_CRL_INFO', 'CERT_EXTENSIONS', '_BG_FILE_PROGRESS', 'PSYSTEM_MODULE32', 'PDEBUG_BREAKPOINT_PARAMETERS', '_CTL_ENTRY', '_WOW64_FLOATING_SAVE_AREA', 'LPBITMAPINFOHEADER', '_IMAGE_OPTIONAL_HEADER64', '_SID_AND_ATTRIBUTES', 'MIB_IFROW', 'LPRECT', '_TOKEN_PRIVILEGES', '_PROCESS_INFORMATION', '_CERT_CHAIN_CONTEXT', '_SYSTEM_HANDLE_INFORMATION', '_MIB_UDP6ROW_OWNER_PID', 'LPSTARTUPINFOW', '_LSA_UNICODE_STRING', '_MIB_IPADDRTABLE', 'PM128A', 'LPSTARTUPINFOA', 'PPSAPI_WORKING_SET_EX_BLOCK', 'ALPC_PORT_ATTRIBUTES32', 'DEBUG_SYMBOL_ENTRY', '_WOW64_CONTEXT', 'ALPC_TOKEN_ATTR', '_UNLOAD_DLL_DEBUG_INFO', 'PWINTRUST_CATALOG_INFO', '_CRYPT_ATTRIBUTES', 'DEBUG_BREAKPOINT_PARAMETERS', 'tagRECT', 'CREATE_PROCESS_DEBUG_INFO', '_EXIT_THREAD_DEBUG_INFO', 'tagDISPPARAMS', 'PIP_INTERFACE_INFO', 'PCERT_PUBLIC_KEY_INFO', 'PPORT_MESSAGE64', 'PMIB_TCP6TABLE_OWNER_PID', 'ALPC_SERVER_INFORMATION_TMP_OUT', 'WINTRUST_SGNR_INFO', 'PCMSG_SIGNER_INFO', 'PALPC_HANDLE_ATTR64', '_CRYPT_KEY_PROV_INFO', 'RGBQUAD', 'PRTL_UNLOAD_EVENT_TRACE', 'PSECURITY_ATTRIBUTES', 'MEMORY_BASIC_INFORMATION64', 'BITMAPINFO', '_XSAVE_FORMAT_32', 'CERT_CONTEXT', 'LPRGBTRIPLE', '_OUTPUT_DEBUG_STRING_INFO', 'PDEBUG_PROCESSOR_IDENTIFICATION_AMD64', 'PPEB', '_PORT_MESSAGE64_TMP_UNION', 'PDEBUG_LAST_EVENT_INFO_EXIT_THREAD', '_CRYPT_ATTRIBUTE', 'PBITMAPINFOHEADER', 'SYSTEM_MODULE_INFORMATION64', 'tagSAFEARRAY', 'DEBUG_MODULE_AND_ID', '_DEBUG_LAST_EVENT_INFO_LOAD_MODULE', 'WINTRUST_BLOB_INFO_', 'PCERT_USAGE_MATCH', 'PWOW64_CONTEXT', 'CRYPT_BIT_BLOB', 'PIMAGE_IMPORT_DESCRIPTOR', 'DEBUG_EXCEPTION_FILTER_PARAMETERS', '_WINTRUST_DATA', 'PCRYPT_ENCODE_PARA', '_CRYPT_ENCRYPT_MESSAGE_PARA', 'PDEBUG_OFFSET_REGION', '_IP_ADAPTER_INDEX_MAP', 'MIB_TCPROW_OWNER_PID', 'CRYPT_KEY_PROV_INFO', 'PMIB_TCP6ROW_OWNER_PID', 'PROCESS_INFORMATION', 'PWINTRUST_SGNR_INFO', 'BITMAPFILEHEADER', 'CONTEXT64', 'PDEBUG_SYMBOL_ENTRY', 'JIT_DEBUG_INFO', '_ALPC_WORK_ON_BEHALF_ATTR', 'IMAGE_IMPORT_DESCRIPTOR', 'CRL_INFO', 'PEXCEPTION_RECORD64', 'PCERT_NAME_BLOB', 'PLUID', 'CRYPT_DECRYPT_MESSAGE_PARA', '_CERT_EXTENSIONS', 'WINTRUST_CATALOG_INFO', 'PCCERT_SIMPLE_CHAIN', 'SPC_LINK', 'PMIB_IFTABLE', 'IMAGE_OPTIONAL_HEADER32', '_SECURITY_QUALITY_OF_SERVICE', 'CRYPT_HASH_BLOB', '_DEBUG_PROCESSOR_IDENTIFICATION_IA64', 'PCCERT_CHAIN_CONTEXT', 'LPSERVICE_STATUS', '_CERT_REVOCATION_INFO', 'PCRYPT_ALGORITHM_IDENTIFIER', '_DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE', '_PSAPI_WORKING_SET_EX_INFORMATION', 'LPOUTPUT_DEBUG_STRING_INFO', 'PPSAPI_WORKING_SET_BLOCK', 'CERT_BLOB', 'PEXCEPTION_POINTERS64', 'WINTRUST_CERT_INFO_', 'PCTL_INFO', 'CERT_SIMPLE_CHAIN', '_RTL_UNLOAD_EVENT_TRACE32', 'PSYSTEMTIME', '_PSAPI_WORKING_SET_EX_INFORMATION64', 'PTHREAD_BASIC_INFORMATION', '_MIB_IPADDRROW_XP', 'UNICODE_STRING', '_MEMORY_BASIC_INFORMATION64', 'PCERT_TRUST_STATUS', '_CTL_CONTEXT', '_DEBUG_REGISTER_DESCRIPTION', 'TOKEN_MANDATORY_LABEL', 'PSAPI_WORKING_SET_EX_BLOCK64', '_ALPC_DIRECT_ATTR', '_IMAGE_EXPORT_DIRECTORY', '_DEBUG_LAST_EVENT_INFO_EXIT_PROCESS', 'DEBUG_LAST_EVENT_INFO_BREAKPOINT', 'DEBUG_LAST_EVENT_INFO_EXIT_PROCESS', 'RTL_UNLOAD_EVENT_TRACE32', 'PSYSTEM_MANDATORY_LABEL_ACE', 'PEB', 'ALPC_SECURITY_ATTR', '_SERVICE_STATUS', 'PPSAPI_WORKING_SET_EX_INFORMATION32', 'DEBUG_SYMBOL_SOURCE_ENTRY', 'CMSG_SIGNER_INFO', '_SYSTEM_MANDATORY_LABEL_ACE', 'PTOKEN_PRIVILEGES', 'PRTL_UNLOAD_EVENT_TRACE32', '_CERT_PUBLIC_KEY_INFO', 'ENUM_SERVICE_STATUS_PROCESSW', '_DEBUG_BREAKPOINT_PARAMETERS', 'PIMAGE_NT_HEADERS64', 'PXSAVE_FORMAT_64', 'PBITMAPCOREHEADER', '_DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR', 'PCRYPT_ATTRIBUTE', 'IMAGE_EXPORT_DIRECTORY', 'XSAVE_FORMAT_64', 'PIP_ADAPTER_INDEX_MAP', '_CERT_SIMPLE_CHAIN', 'CERT_KEY_CONTEXT', 'PCERT_TRUST_LIST_INFO', 'PMEMORY_BASIC_INFORMATION64', 'PCERT_INFO', '_OBJECT_ATTRIBUTES', 'CERT_RDN_VALUE_BLOB', '_SPC_SERIALIZED_OBJECT', '_tagVARIANT', 'CRYPT_ATTRIBUTE', 'BG_JOB_PROGRESS', 'CERT_TRUST_LIST_INFO', 'PCRYPT_ENCRYPT_MESSAGE_PARA', '_PSAPI_WORKING_SET_BLOCK32', '_PSAPI_WORKING_SET_INFORMATION32', 'PDEBUG_STACK_FRAME', 'DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR', 'LIST_ENTRY', 'M128A', 'CTL_USAGE', '_DEBUG_PROCESSOR_IDENTIFICATION_ALPHA', '_XSAVE_FORMAT_64', 'tagRGBTRIPLE', '_DEBUG_LAST_EVENT_INFO_EXIT_THREAD', '_RTL_UNLOAD_EVENT_TRACE', 'SIP_INDIRECT_DATA', 'PMIB_IPADDRTABLE', 'RECT', '_PEB', '_OSVERSIONINFOEXW', '_DEBUG_MODULE_AND_ID', '_FLOATING_SAVE_AREA', 'CATALOG_INFO', '_SYSTEM_MODULE32', 'MEMORY_BASIC_INFORMATION', '_OSVERSIONINFOEXA', 'POSVERSIONINFOW', 'PCRYPT_INTEGER_BLOB', 'PCERT_BLOB', '_ALPC_CONTEXT_ATTR32', 'PPUBLIC_OBJECT_TYPE_INFORMATION', '_PORT_MESSAGE_TMP_UNION_U2', '_CERT_CHAIN_ENGINE_CONFIG', '_PORT_MESSAGE_TMP_UNION_U1', '_tagBRECORD', '_LDR_DATA_TABLE_ENTRY', '_PSAPI_WORKING_SET_INFORMATION', 'DEBUG_PROCESSOR_IDENTIFICATION_ALPHA', 'CERT_CHAIN_CONTEXT', 'PALPC_MESSAGE_ATTRIBUTES', 'PTHREADENTRY32', 'DEBUG_VALUE', 'PSAPI_WORKING_SET_EX_INFORMATION32', 'DEBUG_PROCESSOR_IDENTIFICATION_ALL', 'BITMAPCOREINFO', 'PDEBUG_PROCESSOR_IDENTIFICATION_IA64', 'PORT_MESSAGE32', 'CRYPT_OBJID_BLOB', '_STARTUPINFOA', 'PALPC_DATA_VIEW_ATTR64', '_EXCEPTION_RECORD64', 'PALPC_SECURITY_ATTR32', '_STARTUPINFOW', '_CRYPT_BIT_BLOB', 'CERT_TRUST_STATUS', 'PPEB_LDR_DATA', 'PDEBUG_SYMBOL_PARAMETERS', 'CERT_CHAIN_ENGINE_CONFIG', 'CRL_ENTRY', 'PSAPI_WORKING_SET_EX_INFORMATION', 'PTOKEN_USER', 'PDEBUG_LAST_EVENT_INFO_UNLOAD_MODULE', 'DEBUG_PROCESSOR_IDENTIFICATION_ARM', 'LPPROCESSENTRY32', 'IP_INTERFACE_INFO', '_PSAPI_WORKING_SET_EX_INFORMATION32', 'BITMAPINFOHEADER', '_STRING', '_ACCESS_ALLOWED_CALLBACK_ACE', 'TMP_DUMMYSTRUCTNAME', 'LPEXIT_PROCESS_DEBUG_INFO', 'EXCEPTION_RECORD', '_DEBUG_PROCESSOR_IDENTIFICATION_AMD64', '_ALPC_SERVER_INFORMATION_TMP_OUT', 'TMP_signscale_union', 'CRYPT_ATTRIBUTE_TYPE_VALUE', '_MEMORY_BASIC_INFORMATION32', 'PSAPI_WORKING_SET_EX_BLOCK', 'PEXCEPTION_POINTERS32', 'PSECURITY_QUALITY_OF_SERVICE', 'IMAGE_FILE_HEADER', 'DEBUG_PROCESSOR_IDENTIFICATION_AMD64', 'PUBLIC_OBJECT_TYPE_INFORMATION', 'LPVARIANTARG', 'CERT_REVOCATION_INFO', 'ALPC_CONTEXT_ATTR', '_PROCESS_BASIC_INFORMATION', '_PSAPI_WORKING_SET_EX_BLOCK', 'CRYPT_DATA_BLOB', 'PEB_LDR_DATA', 'PWINTRUST_FILE_INFO', 'PLDR_DATA_TABLE_ENTRY', 'RTL_UNLOAD_EVENT_TRACE64', 'PEVENTLOGRECORD', 'ALPC_MESSAGE_ATTRIBUTES', '_CRYPT_ALGORITHM_IDENTIFIER', 'RTL_UNLOAD_EVENT_TRACE', 'PACCESS_DENIED_ACE', 'PSAPI_WORKING_SET_INFORMATION32', '_CLIENT_ID64', 'ACCESS_DENIED_OBJECT_ACE', 'PWINTRUST_BLOB_INFO', '_TOKEN_USER', 'OUTPUT_DEBUG_STRING_INFO', 'tagSAFEARRAYBOUND', 'PPSAPI_WORKING_SET_EX_INFORMATION64', 'PALPC_PORT_ATTRIBUTES32', 'LPOSVERSIONINFOA', 'PCTL_ENTRY', 'PSAPI_WORKING_SET_EX_BLOCK32', '_ALPC_HANDLE_ATTR32', '_EXIT_PROCESS_DEBUG_INFO', 'LPOSVERSIONINFOW', 'ALPC_SERVER_INFORMATION', '_ACCESS_DENIED_CALLBACK_ACE', 'PEXCEPTION_RECORD', '_PORT_MESSAGE_TMP_SUBSTRUCT_S2', '_ALPC_SECURITY_ATTR64', 'IMAGE_DATA_DIRECTORY', 'SPC_SERIALIZED_OBJECT', 'ALPC_HANDLE_ATTR64', 'MIB_IPADDRTABLE', '_CRYPT_ATTRIBUTE_TYPE_VALUE', '_MIB_UDP6TABLE_OWNER_PID', 'PMIB_IPADDRROW_XP', 'PACCESS_ALLOWED_CALLBACK_OBJECT_ACE', 'PCERT_CHAIN_PARA', 'LPPROCESS_INFORMATION', 'EXIT_PROCESS_DEBUG_INFO', '_TMP_SPC_LINK_UNION', 'ALPC_WORK_ON_BEHALF_ATTR', 'PCERT_EXTENSION', 'PSYSTEM_MODULE64', 'PBITMAP', 'MIB_UDPROW_OWNER_PID', 'VARIANTARG', 'PDEBUG_SPECIFIC_FILTER_PARAMETERS', 'PCRYPT_HASH_BLOB', '_CRYPTOAPI_BLOB', 'LPBITMAP', 'ALPC_DIRECT_ATTR32', '_DEBUG_LAST_EVENT_INFO_EXCEPTION', 'SAFEARRAYBOUND', 'LPGUID', '__tagBRECORD', '_PSAPI_WORKING_SET_BLOCK', 'WINTRUST_CERT_INFO', 'tagRGBQUAD', 'PMIB_TCPROW', 'TMP_variant_sub_union', '_ALPC_DATA_VIEW_ATTR', 'UNLOAD_DLL_DEBUG_INFO', 'CRYPT_DER_BLOB', 'PRECT', '_ALPC_CONTEXT_ATTR64', 'TMP_WINTRUST_UNION_TYPE', 'PPSAPI_WORKING_SET_EX_BLOCK64', 'PCONTEXT64', 'SYSTEMTIME', 'CERT_CHAIN_ELEMENT', 'SPC_SP_OPUS_INFO', 'PIMAGE_OPTIONAL_HEADER64', 'CERT_PUBLIC_KEY_INFO', 'DEBUG_SPECIFIC_FILTER_PARAMETERS', 'IMAGE_SECTION_HEADER', 'ACL', 'WOW64_CONTEXT', '_DEBUG_VALUE_TMP_UNION', 'DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE', 'PSAPI_WORKING_SET_EX_INFORMATION64', '_RTL_USER_PROCESS_PARAMETERS', 'PACCESS_ALLOWED_CALLBACK_ACE', 'PPROCESS_INFORMATION', 'TMP_CONTEXT64_SUBUNION', '_BG_JOB_TIMES', '_EXCEPTION_RECORD32', 'MIB_TCP6TABLE_OWNER_PID', 'LDR_DATA_TABLE_ENTRY', 'PDEBUG_LAST_EVENT_INFO_EXIT_PROCESS', '_CTL_USAGE', 'PCCRL_CONTEXT', 'LPOSVERSIONINFOEXW', '_SYSTEM_HANDLE', 'CERT_NAME_BLOB', 'PWINTRUST_DATA', 'PSYSTEM_VERIFIER_INFORMATION', 'CRYPTCATMEMBER_', '_CERT_CONTEXT', 'LPOSVERSIONINFOEXA', 'DEBUG_REGISTER_DESCRIPTION', 'POSVERSIONINFOEXW', 'LPBITMAPCOREHEADER', 'STARTUPINFOA', 'DATA_BLOB', 'PCRYPT_KEY_PROV_PARAM', 'tagDEC', 'STARTUPINFOW', 'EXCEPTION_RECORD32', '_CERT_EXTENSION', '_IO_STATUS_BLOCK', 'BITMAP', 'PLUID_AND_ATTRIBUTES', 'MIB_UDP6ROW_OWNER_PID', 'PDEBUG_PROCESSOR_IDENTIFICATION_ALPHA', 'RIP_INFO', 'PCERT_CONTEXT', '_CONTEXT64', '_SID_IDENTIFIER_AUTHORITY', '_CERT_TRUST_STATUS', 'PORT_MESSAGE64', '_DEBUG_SYMBOL_PARAMETERS', 'PPOINT', 'SYSTEM_MODULE64', 'PDEBUG_EXCEPTION_FILTER_PARAMETERS', 'WINTRUST_DATA', 'SYSTEM_HANDLE', '_DEBUG_MODULE_PARAMETERS', '_ACE_HEADER', 'OSVERSIONINFOEXW', '_M128A', 'PCCERT_CONTEXT', 'CRYPT_INTEGER_BLOB', 'CTL_CONTEXT', 'PCRL_ENTRY', 'LPENUM_SERVICE_STATUS_PROCESSW', 'tagPOINT', 'OSVERSIONINFOEXA', '_DEBUG_SYMBOL_SOURCE_ENTRY', 'PRTL_OSVERSIONINFOW', 'tagBITMAPINFO', 'LPENUM_SERVICE_STATUS_PROCESSA', 'PSAPI_WORKING_SET_INFORMATION64', 'CRYPT_ATTR_BLOB', 'LPCREATE_PROCESS_DEBUG_INFO', '_SPC_SP_OPUS_INFO', 'DEBUG_STACK_FRAME', 'PDEBUG_PROCESSOR_IDENTIFICATION_X86', 'tagBITMAPCOREINFO', 'PSAPI_WORKING_SET_INFORMATION', '_EXCEPTION_RECORD', 'DEBUG_VALUE_TMP_SUBSTRUCT1', '_PORT_MESSAGE64', 'TMP_UNION_IO_STATUS_BLOCK', 'LPCONTEXT32', '_IMAGE_SECTION_HEADER', '_BG_JOB_PROGRESS', 'DEBUG_EVENT', 'LPSERVICE_STATUS_PROCESS', 'PALPC_WORK_ON_BEHALF_ATTR', 'CRYPT_ENCODE_PARA', 'WINTRUST_SGNR_INFO_', 'PIO_STATUS_BLOCK', 'ACE_HEADER', '_DEBUG_PROCESSOR_IDENTIFICATION_ARM', 'PIMAGE_FILE_HEADER', 'RTL_USER_PROCESS_PARAMETERS', 'tagBITMAP', 'NPRECT', 'DEBUG_SYMBOL_PARAMETERS', 'PDEBUG_LAST_EVENT_INFO_BREAKPOINT', 'CRYPT_ALGORITHM_IDENTIFIER', 'NPBITMAP', 'PDATA_BLOB', 'DEBUG_VALUE_TMP_SUBSTRUCT3', 'DEBUG_VALUE_TMP_SUBSTRUCT2']) +functions = set(['GetFileVersionInfoSizeA', 'NtOpenSection', 'GetStdHandle', 'GetDriveTypeW', 'GetModuleBaseNameA', 'ConvertSidToStringSidW', 'GetComputerNameA', 'NtQuerySymbolicLinkObject', 'AddVectoredContinueHandler', 'GetDriveTypeA', 'CertAddCertificateContextToStore', 'DebugBreak', 'GetFileVersionInfoSizeW', 'ConvertSidToStringSidA', 'DuplicateHandle', 'GetExtendedTcpTable', 'GetProcessId', 'GetSidSubAuthorityCount', 'GetCurrentProcess', 'NtReadVirtualMemory', 'ShellExecuteA', 'CertEnumCertificateContextProperties', 'NtWow64ReadVirtualMemory64', 'DebugActiveProcessStop', 'GetClipboardFormatNameW', 'RegOpenKeyExW', 'WindowFromPoint', 'InitializeProcThreadAttributeList', 'CryptMsgGetParam', 'NtOpenSymbolicLinkObject', 'CryptCATAdminEnumCatalogFromHash', 'NtAlpcCreateSecurityContext', 'RegOpenKeyExA', 'QueryWorkingSetEx', 'CertEnumCTLsInStore', 'MessageBoxW', 'GetThreadContext', 'GetTokenInformation', 'SetStdHandle', 'PFXImportCertStore', 'WaitForDebugEvent', 'GetNamedSecurityInfoA', 'LocalFree', 'OpenThreadToken', 'NtAlpcDisconnectPort', 'WriteFile', 'GetCursorPos', 'NtCreateFile', 'WaitForSingleObject', 'GetLogicalDriveStringsW', 'CertStrToNameA', 'Thread32First', 'AlpcInitializeMessageAttribute', 'CryptAcquireCertificatePrivateKey', 'NtQueryObject', 'ResumeThread', 'NtAlpcConnectPortEx', 'QueryDosDeviceA', 'AddVectoredExceptionHandler', 'GetMappedFileNameW', 'GetLogicalDriveStringsA', 'LoadResource', 'GetWindowTextW', 'EnumClipboardFormats', 'AllocConsole', 'CryptCATEnumerateMember', 'QueryDosDeviceW', 'CryptCATEnumerateCatAttr', 'GetWindowTextA', 'GetProcessImageFileNameA', 'RtlGetUnloadEventTraceEx', 'CryptDestroyKey', 'OpenThread', 'GetProcessImageFileNameW', 'NtAlpcDeleteSecurityContext', 'OpenServiceA', 'WriteProcessMemory', 'NtSetContextThread', 'GetProcessDEPPolicy', 'GetModuleFileNameW', 'EnumWindows', 'CertStrToNameW', 'NtAlpcQueryInformationMessage', 'ExitProcess', 'CoInitializeSecurity', 'GetSecurityInfo', 'GetModuleFileNameA', 'CryptExportKey', 'NtAlpcDeletePortSection', 'RegQueryValueExW', 'NtQueryVirtualMemory', 'WinVerifyTrust', 'CloseServiceHandle', 'CryptCATGetAttrInfo', 'GetSidSubAuthority', 'GetPriorityClass', 'LoadLibraryExA', 'GetMappedFileNameA', 'NtAlpcConnectPort', 'SetConsoleCtrlHandler', 'NtAlpcCreateSectionView', 'CertDuplicateCertificateContext', 'TpCallbackSendAlpcMessageOnCompletion', 'SymInitialize', 'LoadLibraryExW', 'CryptEncryptMessage', 'GetClipboardData', 'MapViewOfFile', 'GetModuleBaseNameW', 'CryptGenKey', 'RtlDecompressBuffer', 'NtQuerySystemInformation', 'GetVolumeNameForVolumeMountPointA', 'CreateThread', 'SetClipboardData', 'CreateProcessAsUserA', 'DebugSetProcessKillOnExit', 'StartServiceW', 'GetExitCodeThread', 'SetTcpEntry', 'CryptCATCatalogInfoFromContext', 'CryptCATAdminAcquireContext', 'GetIpAddrTable', 'GetVolumeNameForVolumeMountPointW', 'CertEnumCertificatesInStore', 'ExitThread', 'CreateProcessAsUserW', 'CryptDecodeObject', 'NtProtectVirtualMemory', 'SetPriorityClass', 'SetThreadContext', 'SymSetOptions', 'TerminateProcess', 'NtGetContextThread', 'NtAlpcCreatePortSection', 'GetWindowsDirectoryW', 'CryptCATGetMemberInfo', 'NtAlpcCreateResourceReserve', 'VirtualQuery', 'DebugActiveProcess', 'VirtualQueryEx', 'NtOpenDirectoryObject', 'SymGetTypeInfo', 'CryptCATAdminReleaseContext', 'LdrLoadDll', 'GetCurrentThreadId', 'GetExtendedUdpTable', 'CreateWellKnownSid', 'CryptCATAdminCalcHashFromFileHandle', 'CreateToolhelp32Snapshot', 'StartServiceA', 'RtlInitUnicodeString', 'RegCloseKey', 'LookupAccountSidW', 'NtOpenEvent', 'Process32First', 'TerminateThread', 'LoadLibraryW', 'LookupPrivilegeValueA', 'GetVersionExW', 'GetExitCodeProcess', 'LookupAccountSidA', 'RegQueryValueExA', 'Wow64SetThreadContext', 'VirtualProtect', 'GetVersionExA', 'LoadLibraryA', 'GetSystemMetrics', 'Process32Next', 'CreateRemoteThread', 'NtAlpcSendWaitReceivePort', 'NtCreateThreadEx', 'OpenProcessToken', 'GetWindowRect', 'QueryWorkingSet', 'OpenProcess', 'CryptDecryptMessage', 'GetWindowsDirectoryA', 'DeviceIoControl', 'ReadProcessMemory', 'GetProcAddress', 'CryptCATEnumerateAttr', 'VirtualProtectEx', 'CreateFileMappingW', 'RtlAnsiStringToUnicodeString', 'CryptAcquireContextA', 'GetCurrentProcessorNumber', 'GetSidIdentifierAuthority', 'CertCompareCertificate', 'Wow64GetThreadContext', 'DebugBreakProcess', 'CertFreeCTLContext', 'NtQueryInformationThread', 'CoInitializeEx', 'CertFindCertificateInStore', 'CertGetNameStringA', 'FreeConsole', 'CreateFileMappingA', 'Thread32Next', 'lstrcmpW', 'SymLoadModuleEx', 'GlobalAlloc', 'CertGetCertificateContextProperty', 'OpenServiceW', 'SuspendThread', 'NtCreateSection', 'NtAlpcQueryInformation', 'ShellExecuteW', 'CertOpenStore', 'VerQueryValueW', 'CreateFileW', 'UpdateProcThreadAttribute', 'NtWow64WriteVirtualMemory64', 'CryptCATAdminReleaseCatalogContext', 'CreateFileA', 'LookupPrivilegeValueW', 'RemoveVectoredExceptionHandler', 'OpenClipboard', 'EmptyClipboard', 'GetLastError', 'PFXExportCertStoreEx', 'GetComputerNameW', 'GetShortPathNameW', 'VirtualAllocEx', 'NtAlpcDeleteResourceReserve', 'GlobalFree', 'OpenEventW', 'AlpcGetMessageAttribute', 'AdjustTokenPrivileges', 'GetInterfaceInfo', 'CryptReleaseContext', 'GetProcessTimes', 'GetIfTable', 'GetVolumeInformationW', 'GlobalUnlock', 'SymFromName', 'CertCreateSelfSignCertificate', 'GetShortPathNameA', 'NtMapViewOfSection', 'Process32NextW', 'VirtualFree', 'NtAlpcAcceptConnectPort', 'CryptEncodeObjectEx', 'ConvertStringSidToSidW', 'SizeofResource', 'Wow64DisableWow64FsRedirection', 'VirtualFreeEx', 'RegGetValueW', 'LockResource', 'ContinueDebugEvent', 'ConvertStringSidToSidA', 'GetLongPathNameA', 'SetTokenInformation', 'CertDuplicateCTLContext', 'Wow64EnableWow64FsRedirection', 'NtAlpcDeleteSectionView', 'SetThreadAffinityMask', 'RegGetValueA', 'VerQueryValueA', 'Process32FirstW', 'GetCurrentThread', 'LookupPrivilegeNameW', 'NtQueryDirectoryObject', 'CoCreateInstance', 'GetWindowModuleFileNameA', 'NtAlpcRevokeSecurityContext', 'GetNamedSecurityInfoW', 'EnumServicesStatusExW', 'lstrcmpA', 'CertCreateCertificateContext', 'NtUnmapViewOfSection', 'ReadFile', 'CryptQueryObject', 'ZwDuplicateObject', 'GetWindowModuleFileNameW', 'Wow64RevertWow64FsRedirection', 'CloseHandle', 'LookupPrivilegeNameA', 'GetLengthSid', 'GetClipboardFormatNameA', 'CertGetCertificateChain', 'GlobalLock', 'GetVersion', 'EnumServicesStatusExA', 'OpenSCManagerA', 'CryptAcquireContextW', 'DeleteProcThreadAttributeList', 'OpenEventA', 'GetFileVersionInfoA', 'GetLongPathNameW', 'CreateProcessA', 'MessageBoxA', 'GetThreadId', 'NtAlpcCreatePort', 'OpenSCManagerW', 'FindResourceW', 'CreateProcessW', 'CryptUIDlgViewContext', 'GetFileVersionInfoW', 'GetVolumeInformationA', 'CertGetNameStringW', 'CloseClipboard', 'RtlInitString', 'FindResourceA', 'VirtualAlloc', 'NtQueryInformationProcess']) +enums = set(['_BG_JOB_TYPE', 'PALPC_MESSAGE_INFORMATION_CLASS', 'VARENUM', 'INTERNAL_IF_OPER_STATUS', 'NET_FW_RULE_DIRECTION', 'TYPEKIND', '_BG_JOB_PROXY_USAGE', '_TCP_TABLE_CLASS', 'ALPC_MESSAGE_INFORMATION_CLASS', 'BG_JOB_PROXY_USAGE', 'SE_OBJECT_TYPE', '_TOKEN_INFORMATION_CLASS', '_IMAGEHLP_SYMBOL_TYPE_INFO', 'tagTYPEKIND', '_THREAD_INFORMATION_CLASS', 'SC_ENUM_TYPE', 'tagCLSCTX', 'BG_JOB_STATE', '_VARENUM', 'NET_FW_ACTION', 'NET_FW_PROFILE_TYPE2_', 'BG_JOB_TYPE', '_WELL_KNOWN_SID_TYPE', 'NET_FW_ACTION_', '_MEMORY_INFORMATION_CLASS', 'PTHREAD_INFORMATION_CLASS', '_INTERNAL_IF_OPER_STATUS', 'OBJECT_INFORMATION_CLASS', '_BG_ERROR_CONTEXT', 'UDP_TABLE_CLASS', 'PSID_NAME_USE', 'SC_STATUS_TYPE', 'CLSCTX', '_ALPC_MESSAGE_INFORMATION_CLASS', '_BG_JOB_STATE', 'tagCOINIT', '_SECURITY_IMPERSONATION_LEVEL', 'MIB_TCP_STATE', 'ALPC_PORT_INFORMATION_CLASS', '_SC_ENUM_TYPE', 'PROCESSINFOCLASS', 'TCP_TABLE_CLASS', '_SE_OBJECT_TYPE', '_UDP_TABLE_CLASS', '_SYSTEM_INFORMATION_CLASS', 'SYSTEM_INFORMATION_CLASS', 'IMAGEHLP_SYMBOL_TYPE_INFO', '_BG_JOB_PRIORITY', '_MIB_TCP_STATE', '_PROCESSINFOCLASS', 'WBEMSTATUS', 'NET_FW_MODIFY_STATE_', '_SECTION_INHERIT', 'PTOKEN_INFORMATION_CLASS', 'SID_NAME_USE', 'SECURITY_IMPERSONATION_LEVEL', 'BG_JOB_PRIORITY', 'BG_ERROR_CONTEXT', '_SC_STATUS_TYPE', '_ALPC_PORT_INFORMATION_CLASS', 'tag_WBEMSTATUS', 'NET_FW_PROFILE_TYPE2', '_OBJECT_INFORMATION_CLASS', 'WELL_KNOWN_SID_TYPE', 'TOKEN_INFORMATION_CLASS', 'MEMORY_INFORMATION_CLASS', 'COINIT', '_SID_NAME_USE', 'NET_FW_IP_PROTOCOL_', 'NET_FW_MODIFY_STATE', 'SECTION_INHERIT', 'NET_FW_IP_PROTOCOL', 'NET_FW_RULE_DIRECTION_', 'THREAD_INFORMATION_CLASS', 'PSECURITY_IMPERSONATION_LEVEL']) +structs = set(['PCRYPT_ATTRIBUTE_TYPE_VALUE', 'PALPC_HANDLE_ATTR', '_DEBUG_STACK_FRAME', 'CERT_INFO', 'PCRYPT_ATTRIBUTES', 'MIB_UDPTABLE_OWNER_PID', 'CRYPT_KEY_PROV_PARAM', 'PORT_MESSAGE_TMP_UNION', 'DEBUG_PROCESSOR_IDENTIFICATION_IA64', 'LPUNLOAD_DLL_DEBUG_INFO', 'PACCESS_DENIED_CALLBACK_ACE', 'LPEXCEPTION_DEBUG_INFO', '__tagVARIANT', '_CERT_TRUST_LIST_INFO', '_ALPC_MESSAGE_ATTRIBUTES', 'PALPC_PORT_ATTRIBUTES64', '_MIB_IFTABLE', 'CURDIR', 'NPRGBTRIPLE', 'LPRIP_INFO', '__PUBLIC_OBJECT_TYPE_INFORMATION', 'PFILETIME', 'IP_ADAPTER_INDEX_MAP', 'PANSI_STRING', 'PRTL_UNLOAD_EVENT_TRACE64', '_ALPC_PORT_ATTRIBUTES64', '_PSAPI_WORKING_SET_EX_BLOCK32', 'CRYPT_UINT_BLOB', '_RIP_INFO', '_ACCESS_DENIED_ACE', '_SYSTEMTIME', 'PCERT_RDN_VALUE_BLOB', 'PPSAPI_WORKING_SET_EX_INFORMATION', '_FILETIME', 'SERVICE_STATUS', 'PDEBUG_REGISTER_DESCRIPTION', 'GUID', 'PDEBUG_MODULE_AND_ID', 'SYSTEM_HANDLE_INFORMATION', 'PUNICODE_STRING', 'PBITMAPCOREINFO', 'CRL_CONTEXT', 'SERVICE_STATUS_PROCESS', 'WINTRUST_FILE_INFO_', 'PIMAGE_OPTIONAL_HEADER32', '_CMSG_SIGNER_INFO', '_IP_INTERFACE_INFO', 'SYSTEM_MANDATORY_LABEL_ACE', 'PSPC_SP_OPUS_INFO', 'ALPC_DIRECT_ATTR64', '_IMAGE_OPTIONAL_HEADER', 'XSAVE_FORMAT_32', 'LPCONTEXT64', '_LOAD_DLL_DEBUG_INFO', 'PALPC_CONTEXT_ATTR', 'PDEBUG_PROCESSOR_IDENTIFICATION_ALL', 'LPJIT_DEBUG_INFO', 'PXSAVE_FORMAT_32', '_MIB_TCP6ROW_OWNER_PID', 'ALPC_CONTEXT_ATTR64', '_CRYPT_KEY_PROV_PARAM', 'PACE_HEADER', '_ALPC_CONTEXT_ATTR', 'WINTRUST_CATALOG_INFO_', '_DEBUG_OFFSET_REGION', 'PROCESS_BASIC_INFORMATION', 'CTL_INFO', 'BG_FILE_INFO', 'OSVERSIONINFOW', 'LPSECURITY_ATTRIBUTES', 'OSVERSIONINFOA', 'EXCEPTION_POINTERS64', '_PSAPI_WORKING_SET_BLOCK64', 'BG_FILE_PROGRESS', 'EXCEPINFO', 'ACCESS_ALLOWED_ACE', '_TMP_CONTEXT64_SUBUNION', 'PMIB_IFROW', 'LPLOAD_DLL_DEBUG_INFO', 'PCRYPT_BIT_BLOB', 'PSIP_INDIRECT_DATA', '_DEBUG_SYMBOL_ENTRY', 'PPROCESS_BASIC_INFORMATION', 'SPC_LINK_', '_ACCESS_ALLOWED_CALLBACK_OBJECT_ACE', '_ALPC_DATA_VIEW_ATTR32', '_JIT_DEBUG_INFO', '_DEBUG_EVENT', 'CONTEXT32', 'LPBITMAPFILEHEADER', 'PMIB_UDPROW_OWNER_PID', 'LPEXIT_THREAD_DEBUG_INFO', 'PSYMBOL_INFO', 'PUBLIC_OBJECT_BASIC_INFORMATION', '_ALPC_PORT_ATTRIBUTES32', '_ALPC_SERVER_INFORMATION_TMP_IN', 'ACCESS_DENIED_CALLBACK_ACE', '_DEBUG_SPECIFIC_FILTER_PARAMETERS', '_CRL_ENTRY', '_SYSTEM_MODULE64', '_DEBUG_VALUE', 'PPROCESSENTRY32', 'DEBUG_VALUE_TMP_UNION', '_TMP_signscale', 'WINTRUST_FILE_INFO', 'REFGUID', '_SERVICE_STATUS_PROCESS', 'TOKEN_PRIVILEGES', 'PMIB_TCPTABLE_OWNER_PID', 'REFIID', 'POSVERSIONINFOEXA', '_CREATE_THREAD_DEBUG_INFO', 'POINT', 'MIB_IPADDRROW_XP', 'MEMORY_BASIC_INFORMATION32', 'SECURITY_ATTRIBUTES', 'IMAGE_NT_HEADERS32', '_IMAGE_IMPORT_BY_NAME', 'PALPC_SECURITY_ATTR64', 'PALPC_HANDLE_ATTR32', 'PIMAGE_EXPORT_DIRECTORY', 'MIB_TCPTABLE_OWNER_PID', 'LPDEBUG_EVENT', 'PACCESS_DENIED_OBJECT_ACE', 'DISPPARAMS', 'LPCREATE_PROCESS_DEBUG_INFO', 'PCRYPTCATMEMBER', 'ALPC_HANDLE_ATTR', 'CRYPT_DIGEST_BLOB', 'TOKEN_ELEVATION', 'tagBITMAPINFOHEADER', '_ACCESS_DENIED_OBJECT_ACE', 'PDEBUG_PROCESSOR_IDENTIFICATION_ARM', '_ACCESS_ALLOWED_ACE', '_ALPC_DIRECT_ATTR32', 'PCCTL_CONTEXT', 'CTL_ENTRY', 'LPBITMAPCOREINFO', 'PCRL_INFO', '_ALPC_TOKEN_ATTR', 'CRYPT_ENCRYPT_MESSAGE_PARA', 'CERT_CHAIN_PARA', '_STARTUPINFOEXW', '_MIB_TCPROW', 'STARTUPINFOEXW', '_DEBUG_PROCESSOR_IDENTIFICATION_X86', 'PPORT_MESSAGE32', 'PALPC_DATA_VIEW_ATTR32', '_DEBUG_PROCESSOR_IDENTIFICATION_ALL', 'LPFILETIME', '_IMAGE_NT_HEADERS', 'ALPC_CONTEXT_ATTR32', 'STARTUPINFOEXA', 'PMIB_UDP6TABLE_OWNER_PID', 'MIB_IPADDRROW', '_RPC_IF_ID', 'SOLE_AUTHENTICATION_SERVICE', 'PSPC_SERIALIZED_OBJECT', 'ACCESS_ALLOWED_CALLBACK_OBJECT_ACE', '_TMP_lowmid', 'WINTRUST_BLOB_INFO', '_CLIENT_ID32', 'PALPC_DIRECT_ATTR32', 'PCRYPT_ATTR_BLOB', 'ALPC_SERVER_INFORMATION_TMP_IN', 'PPSAPI_WORKING_SET_INFORMATION32', 'PCTL_CONTEXT', 'PPUBLIC_OBJECT_BASIC_INFORMATION', 'REFCLSID', '_SECURITY_ATTRIBUTES', 'PCRL_CONTEXT', 'LSA_UNICODE_STRING', 'PCRYPT_UINT_BLOB', '_CRL_CONTEXT', 'OBJECT_DIRECTORY_INFORMATION', '_LUID', 'IID', 'CLIENT_ID32', 'PALPC_TOKEN_ATTR', 'CRYPTCATATTRIBUTE_', 'ALPC_DIRECT_ATTR', 'PDEBUG_SYMBOL_ENTRY', 'PCERT_KEY_CONTEXT', 'LPTHREADENTRY32', 'CATALOG_INFO_', 'PSTRING', 'SAFEARRAY', '_ALPC_SECURITY_ATTR', 'PPSAPI_WORKING_SET_BLOCK64', 'PCANSI_STRING', '_MIB_TCPROW_OWNER_PID', '_CREATE_PROCESS_DEBUG_INFO', 'PDEBUG_MODULE_PARAMETERS', 'IO_STATUS_BLOCK', 'PTOKEN_MANDATORY_LABEL', 'EXIT_THREAD_DEBUG_INFO', 'PSID_AND_ATTRIBUTES', 'ALPC_SECURITY_ATTR32', 'CRYPTCATMEMBER', 'EVENTLOGRECORD', '_IMAGE_NT_HEADERS64', 'PCRYPT_KEY_PROV_INFO', '_DEBUG_VALUE_TMP_SUBSTRUCT2', 'DEBUG_LAST_EVENT_INFO_EXCEPTION', '_DEBUG_VALUE_TMP_SUBSTRUCT1', 'EXCEPTION_POINTERS32', '_TMP_UNION_DEBUG_INFO', 'PCERT_CHAIN_ELEMENT', 'RTL_OSVERSIONINFOEXW', 'PMEMORY_BASIC_INFORMATION', 'PMEMORY_BASIC_INFORMATION32', 'ALPC_SECURITY_ATTR64', '_IMAGE_DATA_DIRECTORY', 'TMP_UNION_DEBUG_INFO', 'PWINTRUST_CERT_INFO', 'VARIANT', 'OBJECT_ATTRIBUTES', 'PCRYPT_DATA_BLOB', '_PSAPI_WORKING_SET_INFORMATION64', '_THREAD_BASIC_INFORMATION', 'tagBITMAPFILEHEADER', '_PORT_MESSAGE32_TMP_UNION', 'LPCREATE_THREAD_DEBUG_INFO', 'PCRYPT_DER_BLOB', 'PALPC_DIRECT_ATTR64', 'tagTHREADENTRY32', 'PDEBUG_SYMBOL_SOURCE_ENTRY', 'LPBITMAPINFO', 'PCTL_USAGE', 'PSYSTEM_HANDLE_INFORMATION', 'DEBUG_OFFSET_REGION', '_EVENTLOGRECORD', 'EXCEPTION_DEBUG_INFO', 'PSAPI_WORKING_SET_BLOCK64', 'PSYSTEM_MODULE_INFORMATION32', 'PCERT_ENHKEY_USAGE', '_OSVERSIONINFOW', 'PALPC_CONTEXT_ATTR64', 'PRTL_USER_PROCESS_PARAMETERS', 'PCRYPTCATATTRIBUTE', '_SYSTEM_MODULE_INFORMATION32', 'CERT_ENHKEY_USAGE', '_CERT_REVOCATION_CRL_INFO', 'LPPOINT', '_OSVERSIONINFOA', 'CERT_REVOCATION_CRL_INFO', 'PSAPI_WORKING_SET_BLOCK', 'PSPC_LINK', 'PBITMAPINFO', 'PRGBTRIPLE', 'FLOATING_SAVE_AREA', 'LPSTARTUPINFOEXA', 'PROCESSENTRY32', 'LUID_AND_ATTRIBUTES', 'PCCERT_CHAIN_ELEMENT', '_CERT_USAGE_MATCH', 'IMAGE_NT_HEADERS64', 'tagEXCEPINFO', 'CREATE_THREAD_DEBUG_INFO', 'LPSTARTUPINFOEXW', '_CRYPT_DECRYPT_MESSAGE_PARA', '_MIB_IFROW', 'PCERT_SIMPLE_CHAIN', '_MIB_TCPTABLE_OWNER_PID', '_ACCESS_ALLOWED_OBJECT_ACE', '_TMP_UNION_IO_STATUS_BLOCK', '_MEMORY_BASIC_INFORMATION', 'PRTL_OSVERSIONINFOEXW', 'FILETIME', '_CERT_CHAIN_PARA', 'PMIB_TCPROW_OWNER_PID', 'BG_JOB_TIMES', '_SYSTEM_VERIFIER_INFORMATION', '_TMP_WINTRUST_UNION_TYPE', 'PACL', 'RPC_IF_ID', '_CONTEXT32', 'CERT_EXTENSION', '_BG_FILE_INFO', '_EXCEPTION_POINTERS32', '_EXCEPTION_DEBUG_INFO', 'tagBITMAPCOREHEADER', 'PIMAGE_SECTION_HEADER', '_PEB_LDR_DATA', '_TMP_DUMMYSTRUCTNAME', 'SYSTEM_MODULE32', 'LOAD_DLL_DEBUG_INFO', 'CRYPT_ATTRIBUTES', 'CRYPTCATATTRIBUTE', '_DEBUG_EXCEPTION_FILTER_PARAMETERS', '_TOKEN_ELEVATION', '_GUID', 'ACCESS_ALLOWED_OBJECT_ACE', 'PCERT_REVOCATION_INFO', 'PCRYPT_DECRYPT_MESSAGE_PARA', '_MODLOAD_DATA', 'PCERT_CHAIN_CONTEXT', 'PPSAPI_WORKING_SET_INFORMATION64', 'MIB_TCP6ROW_OWNER_PID', 'THREAD_BASIC_INFORMATION', 'SID_IDENTIFIER_AUTHORITY', 'ALPC_DATA_VIEW_ATTR64', 'ALPC_PORT_ATTRIBUTES64', '_OVERLAPPED', 'OVERLAPPED', 'ALPC_DATA_VIEW_ATTR', 'RTL_OSVERSIONINFOW', 'IMAGE_IMPORT_BY_NAME', '_ALPC_DATA_VIEW_ATTR64', 'PBITMAPFILEHEADER', 'RGBTRIPLE', '_STARTUPINFOEXA', '_SYMBOL_INFO', '_IMAGE_IMPORT_DESCRIPTOR', 'ENUM_SERVICE_STATUS_PROCESSA', 'PSOLE_AUTHENTICATION_SERVICE', '_TOKEN_MANDATORY_LABEL', '_DEBUG_VALUE_TMP_SUBSTRUCT3', 'TMP_lowmid_union', 'CLIENT_ID64', '_MIB_UDPTABLE_OWNER_PID', 'CERT_USAGE_MATCH', 'DEBUG_MODULE_PARAMETERS', 'PMODLOAD_DATA', 'tagPROCESSENTRY32', 'SYSTEM_MODULE_INFORMATION32', 'PACCESS_ALLOWED_OBJECT_ACE', 'DEBUG_PROCESSOR_IDENTIFICATION_X86', 'PMIB_UDPTABLE_OWNER_PID', 'ACCESS_DENIED_ACE', '_OBJECT_DIRECTORY_INFORMATION', 'PIMAGE_DATA_DIRECTORY', 'PPSAPI_WORKING_SET_EX_BLOCK32', '_ALPC_DIRECT_ATTR64', 'THREADENTRY32', '_ALPC_HANDLE_ATTR64', '_PUBLIC_OBJECT_BASIC_INFORMATION', 'PPSAPI_WORKING_SET_BLOCK32', '_MIB_TCP6TABLE_OWNER_PID', '_CLIENT_ID', '_CERT_INFO', 'MODLOAD_DATA', 'MIB_IFTABLE', '_ALPC_SECURITY_ATTR32', 'POBJECT_DIRECTORY_INFORMATION', 'SYSTEM_VERIFIER_INFORMATION', 'PEXCEPTION_RECORD32', 'LPVARIANT', 'ALPC_HANDLE_ATTR32', 'PPROCESSENTRY32W', 'DECIMAL', 'SID_AND_ATTRIBUTES', '_ACL', 'EXCEPTION_RECORD64', 'tagSOLE_AUTHENTICATION_SERVICE', '_ENUM_SERVICE_STATUS_PROCESSW', '_MIB_UDPROW_OWNER_PID', 'SYMBOL_INFO', '_CRYPT_ENCODE_PARA', 'PDEBUG_VALUE', 'PSAPI_WORKING_SET_BLOCK32', 'PACCESS_ALLOWED_ACE', 'PSYSTEM_MODULE_INFORMATION64', 'PROCESSENTRY32W', '_PORT_MESSAGE_TMP_SUBSTRUCT_S1', 'PALPC_DIRECT_ATTR', 'PDEBUG_LAST_EVENT_INFO_SYSTEM_ERROR', '_LUID_AND_ATTRIBUTES', 'PALPC_SECURITY_ATTR', 'DEBUG_LAST_EVENT_INFO_LOAD_MODULE', 'PCRYPT_DIGEST_BLOB', '_SYSTEM_MODULE_INFORMATION64', 'PIMAGE_IMPORT_BY_NAME', 'PDEBUG_LAST_EVENT_INFO_EXCEPTION', 'SECURITY_QUALITY_OF_SERVICE', 'PPSAPI_WORKING_SET_INFORMATION', '_ALPC_HANDLE_ATTR', 'LPPROCESSENTRY32W', 'PRLIST_ENTRY', 'POSVERSIONINFOA', 'PLIST_ENTRY', 'tagPROCESSENTRY32W', 'LUID', '_RTL_UNLOAD_EVENT_TRACE64', 'TOKEN_USER', 'SIP_INDIRECT_DATA_', 'PCRYPT_OBJID_BLOB', 'CLIENT_ID', 'IMAGE_OPTIONAL_HEADER64', '_CERT_KEY_CONTEXT', '_PSAPI_WORKING_SET_EX_BLOCK64', '_ENUM_SERVICE_STATUS_PROCESSA', 'PCRL_BLOB', 'PCERT_EXTENSIONS', 'MIB_TCPROW', 'TMP_SPC_LINK_UNION', '_IMAGE_FILE_HEADER', 'ALPC_DATA_VIEW_ATTR32', 'LPOVERLAPPED', 'PALPC_DATA_VIEW_ATTR', 'PSID_IDENTIFIER_AUTHORITY', 'PLSA_UNICODE_STRING', '_CTL_INFO', 'PPEB_LDR_DATA', 'PDEBUG_LAST_EVENT_INFO_LOAD_MODULE', 'PALPC_CONTEXT_ATTR32', 'MIB_UDP6TABLE_OWNER_PID', 'PIMAGE_NT_HEADERS32', 'STRING', 'LPSAFEARRAYBOUND', '_CERT_CHAIN_ELEMENT', 'PCONTEXT32', 'ACCESS_ALLOWED_CALLBACK_ACE', 'PMIB_UDP6ROW_OWNER_PID', 'CRL_BLOB', 'BITMAPCOREHEADER', 'POBJECT_ATTRIBUTES', 'PCERT_CHAIN_ENGINE_CONFIG', '_DEBUG_LAST_EVENT_INFO_BREAKPOINT', 'PTOKEN_ELEVATION', '_CRL_INFO', 'WOW64_FLOATING_SAVE_AREA', '_LIST_ENTRY', '_PORT_MESSAGE32', 'PCERT_REVOCATION_CRL_INFO', 'CERT_EXTENSIONS', '_BG_FILE_PROGRESS', 'PSYSTEM_MODULE32', 'PDEBUG_BREAKPOINT_PARAMETERS', '_CTL_ENTRY', '_WOW64_FLOATING_SAVE_AREA', 'LPBITMAPINFOHEADER', '_IMAGE_OPTIONAL_HEADER64', '_SID_AND_ATTRIBUTES', 'MIB_IFROW', 'LPRECT', '_TOKEN_PRIVILEGES', '_PROCESS_INFORMATION', '_CERT_CHAIN_CONTEXT', '_SYSTEM_HANDLE_INFORMATION', '_MIB_UDP6ROW_OWNER_PID', 'LPSTARTUPINFOW', '_LSA_UNICODE_STRING', '_MIB_IPADDRTABLE', 'PM128A', 'LPSTARTUPINFOA', 'PPSAPI_WORKING_SET_EX_BLOCK', 'ALPC_PORT_ATTRIBUTES32', 'DEBUG_SYMBOL_ENTRY', '_WOW64_CONTEXT', 'ALPC_TOKEN_ATTR', '_UNLOAD_DLL_DEBUG_INFO', 'PWINTRUST_CATALOG_INFO', '_CRYPT_ATTRIBUTES', 'DEBUG_BREAKPOINT_PARAMETERS', 'tagRECT', 'CREATE_PROCESS_DEBUG_INFO', '_EXIT_THREAD_DEBUG_INFO', 'tagDISPPARAMS', 'PIP_INTERFACE_INFO', 'PCERT_PUBLIC_KEY_INFO', 'PPORT_MESSAGE64', 'PMIB_TCP6TABLE_OWNER_PID', 'ALPC_SERVER_INFORMATION_TMP_OUT', 'WINTRUST_SGNR_INFO', 'PCMSG_SIGNER_INFO', 'PALPC_HANDLE_ATTR64', '_CRYPT_KEY_PROV_INFO', 'RGBQUAD', 'PRTL_UNLOAD_EVENT_TRACE', 'PSECURITY_ATTRIBUTES', 'MEMORY_BASIC_INFORMATION64', 'BITMAPINFO', '_XSAVE_FORMAT_32', 'CERT_CONTEXT', 'LPRGBTRIPLE', '_OUTPUT_DEBUG_STRING_INFO', 'PDEBUG_PROCESSOR_IDENTIFICATION_AMD64', 'PPEB', 'PRTL_DRIVE_LETTER_CURDIR', '_PORT_MESSAGE64_TMP_UNION', 'PDEBUG_LAST_EVENT_INFO_EXIT_THREAD', '_CRYPT_ATTRIBUTE', 'PBITMAPINFOHEADER', 'SYSTEM_MODULE_INFORMATION64', 'tagSAFEARRAY', 'DEBUG_MODULE_AND_ID', '_DEBUG_LAST_EVENT_INFO_LOAD_MODULE', 'WINTRUST_BLOB_INFO_', 'PCERT_USAGE_MATCH', 'PWOW64_CONTEXT', 'CRYPT_BIT_BLOB', 'PIMAGE_IMPORT_DESCRIPTOR', 'DEBUG_EXCEPTION_FILTER_PARAMETERS', '_WINTRUST_DATA', 'DEBUG_LAST_EVENT_INFO_EXIT_THREAD', 'PCRYPT_ENCODE_PARA', '_CRYPT_ENCRYPT_MESSAGE_PARA', 'PDEBUG_OFFSET_REGION', '_IP_ADAPTER_INDEX_MAP', 'MIB_TCPROW_OWNER_PID', 'CRYPT_KEY_PROV_INFO', 'PMIB_TCP6ROW_OWNER_PID', 'PROCESS_INFORMATION', 'PWINTRUST_SGNR_INFO', 'BITMAPFILEHEADER', 'CONTEXT64', 'RTL_DRIVE_LETTER_CURDIR', 'JIT_DEBUG_INFO', '_ALPC_WORK_ON_BEHALF_ATTR', 'IMAGE_IMPORT_DESCRIPTOR', 'CRL_INFO', 'PEXCEPTION_RECORD64', 'PCERT_NAME_BLOB', 'PLUID', 'CRYPT_DECRYPT_MESSAGE_PARA', '_CERT_EXTENSIONS', 'WINTRUST_CATALOG_INFO', 'PCCERT_SIMPLE_CHAIN', 'SPC_LINK', 'PMIB_IFTABLE', 'IMAGE_OPTIONAL_HEADER32', '_SECURITY_QUALITY_OF_SERVICE', 'CRYPT_HASH_BLOB', '_DEBUG_PROCESSOR_IDENTIFICATION_IA64', 'PCCERT_CHAIN_CONTEXT', 'LPSERVICE_STATUS', '_CERT_REVOCATION_INFO', 'PCRYPT_ALGORITHM_IDENTIFIER', '_DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE', '_PSAPI_WORKING_SET_EX_INFORMATION', 'LPOUTPUT_DEBUG_STRING_INFO', 'PPSAPI_WORKING_SET_BLOCK', 'CERT_BLOB', 'PEXCEPTION_POINTERS64', 'WINTRUST_CERT_INFO_', 'PCTL_INFO', 'CERT_SIMPLE_CHAIN', '_RTL_UNLOAD_EVENT_TRACE32', 'PSYSTEMTIME', '_PSAPI_WORKING_SET_EX_INFORMATION64', 'PTHREAD_BASIC_INFORMATION', '_MIB_IPADDRROW_XP', 'UNICODE_STRING', '_MEMORY_BASIC_INFORMATION64', 'PCERT_TRUST_STATUS', '_CTL_CONTEXT', '_DEBUG_REGISTER_DESCRIPTION', 'TOKEN_MANDATORY_LABEL', 'PSAPI_WORKING_SET_EX_BLOCK64', '_ALPC_DIRECT_ATTR', '_IMAGE_EXPORT_DIRECTORY', '_DEBUG_LAST_EVENT_INFO_EXIT_PROCESS', 'DEBUG_LAST_EVENT_INFO_BREAKPOINT', 'DEBUG_LAST_EVENT_INFO_EXIT_PROCESS', 'RTL_UNLOAD_EVENT_TRACE32', 'PSYSTEM_MANDATORY_LABEL_ACE', 'PEB', 'ALPC_SECURITY_ATTR', '_SERVICE_STATUS', 'PPSAPI_WORKING_SET_EX_INFORMATION32', 'DEBUG_SYMBOL_SOURCE_ENTRY', 'CMSG_SIGNER_INFO', '_SYSTEM_MANDATORY_LABEL_ACE', 'PTOKEN_PRIVILEGES', 'PRTL_UNLOAD_EVENT_TRACE32', '_CERT_PUBLIC_KEY_INFO', 'ENUM_SERVICE_STATUS_PROCESSW', '_DEBUG_BREAKPOINT_PARAMETERS', 'PIMAGE_NT_HEADERS64', 'PXSAVE_FORMAT_64', 'PBITMAPCOREHEADER', '_DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR', 'PCRYPT_ATTRIBUTE', 'IMAGE_EXPORT_DIRECTORY', 'XSAVE_FORMAT_64', 'PIP_ADAPTER_INDEX_MAP', '_CERT_SIMPLE_CHAIN', 'CERT_KEY_CONTEXT', 'PCERT_TRUST_LIST_INFO', 'PMEMORY_BASIC_INFORMATION64', 'PCERT_INFO', '_OBJECT_ATTRIBUTES', 'CERT_RDN_VALUE_BLOB', '_SPC_SERIALIZED_OBJECT', '_tagVARIANT', 'CRYPT_ATTRIBUTE', 'BG_JOB_PROGRESS', 'CERT_TRUST_LIST_INFO', 'PCRYPT_ENCRYPT_MESSAGE_PARA', '_PSAPI_WORKING_SET_BLOCK32', '_PSAPI_WORKING_SET_INFORMATION32', 'PDEBUG_STACK_FRAME', 'DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR', 'LIST_ENTRY', 'M128A', 'CTL_USAGE', '_DEBUG_PROCESSOR_IDENTIFICATION_ALPHA', '_XSAVE_FORMAT_64', 'tagRGBTRIPLE', '_DEBUG_LAST_EVENT_INFO_EXIT_THREAD', '_RTL_UNLOAD_EVENT_TRACE', 'SIP_INDIRECT_DATA', 'PMIB_IPADDRTABLE', 'RECT', '_PEB', '_OSVERSIONINFOEXW', '_DEBUG_MODULE_AND_ID', 'PCURDIR', '_FLOATING_SAVE_AREA', 'CATALOG_INFO', '_SYSTEM_MODULE32', 'MEMORY_BASIC_INFORMATION', '_OSVERSIONINFOEXA', 'POSVERSIONINFOW', 'PCRYPT_INTEGER_BLOB', 'PCERT_BLOB', '_ALPC_CONTEXT_ATTR32', 'PPUBLIC_OBJECT_TYPE_INFORMATION', '_PORT_MESSAGE_TMP_UNION_U2', '_CERT_CHAIN_ENGINE_CONFIG', '_PORT_MESSAGE_TMP_UNION_U1', '_tagBRECORD', '_LDR_DATA_TABLE_ENTRY', '_PSAPI_WORKING_SET_INFORMATION', 'DEBUG_PROCESSOR_IDENTIFICATION_ALPHA', 'CERT_CHAIN_CONTEXT', 'PALPC_MESSAGE_ATTRIBUTES', 'PTHREADENTRY32', 'DEBUG_VALUE', 'PSAPI_WORKING_SET_EX_INFORMATION32', 'DEBUG_PROCESSOR_IDENTIFICATION_ALL', 'BITMAPCOREINFO', 'PDEBUG_PROCESSOR_IDENTIFICATION_IA64', 'PORT_MESSAGE32', 'CRYPT_OBJID_BLOB', '_STARTUPINFOA', 'PALPC_DATA_VIEW_ATTR64', '_EXCEPTION_RECORD64', 'PALPC_SECURITY_ATTR32', '_STARTUPINFOW', '_CRYPT_BIT_BLOB', 'CERT_TRUST_STATUS', '_EXCEPTION_POINTERS64', 'PDEBUG_SYMBOL_PARAMETERS', 'CERT_CHAIN_ENGINE_CONFIG', 'CRL_ENTRY', 'PSAPI_WORKING_SET_EX_INFORMATION', 'PTOKEN_USER', 'PDEBUG_LAST_EVENT_INFO_UNLOAD_MODULE', 'DEBUG_PROCESSOR_IDENTIFICATION_ARM', 'LPPROCESSENTRY32', 'IP_INTERFACE_INFO', '_PSAPI_WORKING_SET_EX_INFORMATION32', 'BITMAPINFOHEADER', '_STRING', '_ACCESS_ALLOWED_CALLBACK_ACE', 'TMP_DUMMYSTRUCTNAME', 'LPEXIT_PROCESS_DEBUG_INFO', 'EXCEPTION_RECORD', '_DEBUG_PROCESSOR_IDENTIFICATION_AMD64', '_ALPC_SERVER_INFORMATION_TMP_OUT', 'TMP_signscale_union', 'CRYPT_ATTRIBUTE_TYPE_VALUE', '_MEMORY_BASIC_INFORMATION32', 'PSAPI_WORKING_SET_EX_BLOCK', 'PEXCEPTION_POINTERS32', 'PSECURITY_QUALITY_OF_SERVICE', 'IMAGE_FILE_HEADER', 'DEBUG_PROCESSOR_IDENTIFICATION_AMD64', 'PUBLIC_OBJECT_TYPE_INFORMATION', '_CURDIR', 'LPVARIANTARG', 'CERT_REVOCATION_INFO', 'ALPC_CONTEXT_ATTR', '_PROCESS_BASIC_INFORMATION', '_PSAPI_WORKING_SET_EX_BLOCK', 'CRYPT_DATA_BLOB', 'PEB_LDR_DATA', 'PWINTRUST_FILE_INFO', 'PLDR_DATA_TABLE_ENTRY', 'RTL_UNLOAD_EVENT_TRACE64', 'PEVENTLOGRECORD', 'ALPC_MESSAGE_ATTRIBUTES', '_CRYPT_ALGORITHM_IDENTIFIER', 'RTL_UNLOAD_EVENT_TRACE', 'PACCESS_DENIED_ACE', 'PSAPI_WORKING_SET_INFORMATION32', '_CLIENT_ID64', 'ACCESS_DENIED_OBJECT_ACE', 'PWINTRUST_BLOB_INFO', '_TOKEN_USER', 'OUTPUT_DEBUG_STRING_INFO', 'tagSAFEARRAYBOUND', 'PPSAPI_WORKING_SET_EX_INFORMATION64', 'PALPC_PORT_ATTRIBUTES32', 'LPOSVERSIONINFOA', 'PCTL_ENTRY', 'PSAPI_WORKING_SET_EX_BLOCK32', '_ALPC_HANDLE_ATTR32', '_EXIT_PROCESS_DEBUG_INFO', 'LPOSVERSIONINFOW', 'ALPC_SERVER_INFORMATION', '_ACCESS_DENIED_CALLBACK_ACE', 'PEXCEPTION_RECORD', '_PORT_MESSAGE_TMP_SUBSTRUCT_S2', '_ALPC_SECURITY_ATTR64', 'IMAGE_DATA_DIRECTORY', 'SPC_SERIALIZED_OBJECT', 'ALPC_HANDLE_ATTR64', 'MIB_IPADDRTABLE', '_CRYPT_ATTRIBUTE_TYPE_VALUE', '_MIB_UDP6TABLE_OWNER_PID', 'PMIB_IPADDRROW_XP', 'PACCESS_ALLOWED_CALLBACK_OBJECT_ACE', 'PCERT_CHAIN_PARA', 'LPPROCESS_INFORMATION', 'EXIT_PROCESS_DEBUG_INFO', '_TMP_SPC_LINK_UNION', 'ALPC_WORK_ON_BEHALF_ATTR', 'PCERT_EXTENSION', 'PSYSTEM_MODULE64', 'PBITMAP', 'MIB_UDPROW_OWNER_PID', 'VARIANTARG', 'PDEBUG_SPECIFIC_FILTER_PARAMETERS', 'PCRYPT_HASH_BLOB', '_CRYPTOAPI_BLOB', 'LPBITMAP', 'ALPC_DIRECT_ATTR32', '_DEBUG_LAST_EVENT_INFO_EXCEPTION', 'SAFEARRAYBOUND', 'LPGUID', '__tagBRECORD', '_PSAPI_WORKING_SET_BLOCK', 'WINTRUST_CERT_INFO', 'tagRGBQUAD', 'PMIB_TCPROW', 'TMP_variant_sub_union', '_ALPC_DATA_VIEW_ATTR', 'UNLOAD_DLL_DEBUG_INFO', 'CRYPT_DER_BLOB', 'PRECT', '_ALPC_CONTEXT_ATTR64', 'TMP_WINTRUST_UNION_TYPE', 'PPSAPI_WORKING_SET_EX_BLOCK64', 'PCONTEXT64', 'SYSTEMTIME', 'CERT_CHAIN_ELEMENT', 'SPC_SP_OPUS_INFO', '_RTL_DRIVE_LETTER_CURDIR', 'PIMAGE_OPTIONAL_HEADER64', 'CERT_PUBLIC_KEY_INFO', 'DEBUG_SPECIFIC_FILTER_PARAMETERS', 'IMAGE_SECTION_HEADER', 'ACL', 'WOW64_CONTEXT', '_DEBUG_VALUE_TMP_UNION', 'DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE', 'PSAPI_WORKING_SET_EX_INFORMATION64', '_RTL_USER_PROCESS_PARAMETERS', 'PACCESS_ALLOWED_CALLBACK_ACE', 'PPROCESS_INFORMATION', 'TMP_CONTEXT64_SUBUNION', '_BG_JOB_TIMES', '_EXCEPTION_RECORD32', 'MIB_TCP6TABLE_OWNER_PID', 'LDR_DATA_TABLE_ENTRY', 'PDEBUG_LAST_EVENT_INFO_EXIT_PROCESS', '_CTL_USAGE', 'PCCRL_CONTEXT', 'LPOSVERSIONINFOEXW', '_SYSTEM_HANDLE', 'CERT_NAME_BLOB', 'PWINTRUST_DATA', 'PSYSTEM_VERIFIER_INFORMATION', 'CRYPTCATMEMBER_', '_CERT_CONTEXT', 'LPOSVERSIONINFOEXA', 'DEBUG_REGISTER_DESCRIPTION', 'POSVERSIONINFOEXW', 'LPBITMAPCOREHEADER', 'STARTUPINFOA', 'DATA_BLOB', 'PCRYPT_KEY_PROV_PARAM', 'tagDEC', 'STARTUPINFOW', 'EXCEPTION_RECORD32', '_CERT_EXTENSION', '_IO_STATUS_BLOCK', 'BITMAP', 'PLUID_AND_ATTRIBUTES', 'MIB_UDP6ROW_OWNER_PID', 'PDEBUG_PROCESSOR_IDENTIFICATION_ALPHA', 'RIP_INFO', 'PCERT_CONTEXT', '_CONTEXT64', '_SID_IDENTIFIER_AUTHORITY', '_CERT_TRUST_STATUS', 'PORT_MESSAGE64', '_DEBUG_SYMBOL_PARAMETERS', 'PPOINT', 'SYSTEM_MODULE64', 'PDEBUG_EXCEPTION_FILTER_PARAMETERS', 'WINTRUST_DATA', 'SYSTEM_HANDLE', '_DEBUG_MODULE_PARAMETERS', '_ACE_HEADER', 'OSVERSIONINFOEXW', '_M128A', 'PCCERT_CONTEXT', 'CRYPT_INTEGER_BLOB', 'CTL_CONTEXT', 'PCRL_ENTRY', 'LPENUM_SERVICE_STATUS_PROCESSW', 'tagPOINT', 'OSVERSIONINFOEXA', '_DEBUG_SYMBOL_SOURCE_ENTRY', 'PRTL_OSVERSIONINFOW', 'tagBITMAPINFO', 'LPENUM_SERVICE_STATUS_PROCESSA', 'PSAPI_WORKING_SET_INFORMATION64', 'CRYPT_ATTR_BLOB', '_SPC_SP_OPUS_INFO', 'DEBUG_STACK_FRAME', 'PDEBUG_PROCESSOR_IDENTIFICATION_X86', 'tagBITMAPCOREINFO', 'PSAPI_WORKING_SET_INFORMATION', '_EXCEPTION_RECORD', 'DEBUG_VALUE_TMP_SUBSTRUCT1', '_PORT_MESSAGE64', 'TMP_UNION_IO_STATUS_BLOCK', 'LPCONTEXT32', '_IMAGE_SECTION_HEADER', '_BG_JOB_PROGRESS', 'DEBUG_EVENT', 'LPSERVICE_STATUS_PROCESS', 'PALPC_WORK_ON_BEHALF_ATTR', 'CRYPT_ENCODE_PARA', 'WINTRUST_SGNR_INFO_', 'PIO_STATUS_BLOCK', 'ACE_HEADER', '_DEBUG_PROCESSOR_IDENTIFICATION_ARM', 'PIMAGE_FILE_HEADER', 'RTL_USER_PROCESS_PARAMETERS', 'tagBITMAP', 'NPRECT', 'DEBUG_SYMBOL_PARAMETERS', 'PDEBUG_LAST_EVENT_INFO_BREAKPOINT', 'CRYPT_ALGORITHM_IDENTIFIER', 'NPBITMAP', 'PDATA_BLOB', 'DEBUG_VALUE_TMP_SUBSTRUCT3', 'DEBUG_VALUE_TMP_SUBSTRUCT2']) windef = set(['ERROR_BAD_NET_NAME', 'STANDARD_RIGHTS_WRITE', 'RRF_RT_REG_QWORD', 'ERROR_SYSTEM_SHUTDOWN', 'PROV_FORTEZZA', 'AF_HYLINK', 'ERROR_INVALID_VARIANT', 'CMSG_HASH_DATA_PARAM', 'IMAGE_SCN_LNK_REMOVE', 'CONTEXT_FULL', 'szOID_RSA_certExtensions', 'CRYPT_ASN_ENCODING', 'EXCEPTION_FLT_UNDERFLOW', 'CMSG_CMS_RECIPIENT_INDEX_PARAM', 'ERROR_BAD_NETPATH', 'CERT_X500_NAME_STR', 'KEY_QUERY_VALUE', 'ERROR_NO_SPOOL_SPACE', 'CERT_QUERY_CONTENT_FLAG_PKCS10', 'ANYSIZE_ARRAY', 'szOID_OIWSEC_desEDE', 'AF_NS', 'ERROR_WOW_ASSERTION', 'ERROR_TOO_MANY_SESS', 'DIGSIG_E_CRYPTO', 'ERROR_DBG_TERMINATE_THREAD', 'PAGE_EXECUTE_READ', 'SEC_COMMIT', 'ERROR_SHARING_PAUSED', 'ERROR_BAD_UNIT', 'szOID_RSA_SHA384RSA', 'ERROR_PAGE_FAULT_TRANSITION', 'ERROR_HANDLE_DISK_FULL', 'CERT_PUBKEY_ALG_PARA_PROP_ID', 'ERROR_PWD_HISTORY_CONFLICT', 'CERT_TRUST_HAS_KEY_MATCH_ISSUER', 'szOID_OIWSEC_mdc2RSA', 'ERROR_REGISTRY_CORRUPT', 'ERROR_PROCESS_NOT_IN_JOB', 'SC_MANAGER_ENUMERATE_SERVICE', 'SERVICE_STOP_PENDING', 'ERROR_CANTOPEN', 'ERROR_INVALID_OPLOCK_PROTOCOL', 'EXCEPTION_ARRAY_BOUNDS_EXCEEDED', 'KEY_WOW64_32KEY', 'szOID_OIWSEC_desMAC', 'SM_IMMENABLED', 'CERT_E_VALIDITYPERIODNESTING', 'ERROR_NOTIFY_CLEANUP', 'ERROR_RESOURCE_REQUIREMENTS_CHANGED', 'SEC_IMAGE', 'CERT_SYSTEM_STORE_USERS_ID', 'CERT_TRUST_CTL_IS_NOT_VALID_FOR_USAGE', 'EXCEPTION_BREAKPOINT', 'EXCEPTION_POSSIBLE_DEADLOCK', 'CERT_MD5_HASH_PROP_ID', 'szOID_X957_SHA1DSA', 'ERROR_INVALID_AT_INTERRUPT_TIME', 'TRUST_E_EXPLICIT_DISTRUST', 'FILE_FLAG_POSIX_SEMANTICS', 'SERVICE_CONTROL_DEVICEEVENT', 'REPORT_NO_PRIVATE_KEY', 'ALPC_HANDLEFLG_DUPLICATE_SAME_ACCESS', 'szOID_PKCS_8', 'szOID_PKCS_9', 'szOID_PKCS_4', 'szOID_PKCS_5', 'szOID_PKCS_6', 'szOID_PKCS_7', 'szOID_PKCS_1', 'szOID_PKCS_2', 'szOID_PKCS_3', 'FILE_NOTIFY_CHANGE_SECURITY', 'FILE_ATTRIBUTE_REPARSE_POINT', 'ACCESS_MAX_MS_V4_ACE_TYPE', 'CERT_SYSTEM_STORE_LOCATION_SHIFT', 'ERROR_BACKUP_CONTROLLER', 'DEBUG_PROCESS', 'ACCESS_DENIED_CALLBACK_OBJECT_ACE_TYPE', 'szOID_RSA_envelopedData', 'DEBUG_EVENT_CHANGE_DEBUGGEE_STATE', 'ACCESS_ALLOWED_CALLBACK_OBJECT_ACE_TYPE', 'ERROR_NETNAME_DELETED', 'szOID_OIWDIR_HASH', 'CERT_NAME_EMAIL_TYPE', 'SYSTEM_ALARM_CALLBACK_OBJECT_ACE_TYPE', 'szOID_RSA_SMIMECapabilities', 'CERT_QUERY_CONTENT_FLAG_CERT_PAIR', 'ERROR_WAIT_63', 'ERROR_TIMER_RESUME_IGNORED', 'KEY_ENUMERATE_SUB_KEYS', 'IMAGE_SCN_MEM_WRITE', 'CERT_QUERY_CONTENT_PKCS7_SIGNED_EMBED', 'ERROR_INSUFFICIENT_LOGON_INFO', 'MS_DEF_PROV_A', 'ERROR_TRANSLATION_COMPLETE', 'TH32CS_SNAPHEAPLIST', 'szOID_OIWSEC_desCFB', 'IMAGE_SCN_MEM_DISCARDABLE', 'MS_DEF_PROV_W', 'FILE_SUPPORTS_TRANSACTIONS', 'MEM_4MB_PAGES', 'PKCS_7_NDR_ENCODING', 'ERROR_IO_PENDING', 'CERT_CHAIN_REVOCATION_CHECK_CACHE_ONLY', 'IMAGE_SCN_ALIGN_4096BYTES', 'ERROR_DBG_EXCEPTION_HANDLED', 'ERROR_SIGNAL_PENDING', 'X509_CERT_CRL_TO_BE_SIGNED', 'EXCEPTION_INVALID_DISPOSITION', 'CMSG_ENCRYPTED_DIGEST', 'CERT_FIND_SUBJECT_INFO_ACCESS', 'LPC_CLIENT_DIED', 'AT_KEYEXCHANGE', 'CERT_IE30_RESERVED_PROP_ID', 'szOID_RSA_unstructAddr', 'THREAD_SUSPEND_RESUME', 'LPC_ERROR_EVENT', 'TH32CS_INHERIT', 'IMAGE_SCN_LNK_NRELOC_OVFL', 'szOID_RSA_DH', 'ERROR_ACPI_ERROR', 'szOID_RSA_HASH', 'IMAGE_SCN_MEM_SHARED', 'EXCEPTION_FLT_INEXACT_RESULT', 'FILE_SHARE_READ', 'ACCESS_DENIED_OBJECT_ACE_TYPE', 'INHERIT_PARENT_AFFINITY', 'ERROR_BAD_THREADID_ADDR', 'ERROR_VOLSNAP_HIBERNATE_READY', 'SW_SHOWNOACTIVATE', 'CERT_OID_NAME_STR', 'FILE_ACTION_REMOVED', 'BIND_IF_SYNTAX_NDR64', 'CERT_FORTEZZA_DATA_PROP_ID', 'szOID_RSA_counterSign', 'CREATE_NEW_CONSOLE', 'X509_CERT', 'IMAGE_SCN_TYPE_GROUP', 'CERT_KEY_CONTEXT_PROP_ID', 'ANY_SIZE', 'CERT_STORE_PROV_COLLECTION', 'ERROR_WRITE_PROTECT', 'CERT_NAME_RDN_TYPE', 'szOID_INFOSEC_SuiteAConfidentiality', 'ERROR_LOST_WRITEBEHIND_DATA', 'CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID', 'SM_CYKANJIWINDOW', 'ERROR_SYSTEM_POWERSTATE_TRANSITION', 'CERT_KEY_SPEC_PROP_ID', 'SEC_WRITECOMBINE', 'DIRECTORY_TRAVERSE', 'SM_CYVIRTUALSCREEN', 'CERT_TRUST_HAS_PREFERRED_ISSUER', 'AF_IPX', 'X509_KEY_USAGE_RESTRICTION', 'SM_CYMAXTRACK', 'WTD_STATEACTION_IGNORE', 'CERT_TRUST_IS_EXPLICIT_DISTRUST', 'CERT_INFO_NOT_BEFORE_FLAG', 'DIGSIG_E_DECODE', 'ERROR_TOO_MANY_CMDS', 'OBJ_CASE_INSENSITIVE', 'THREAD_GET_CONTEXT', 'CERT_SYSTEM_STORE_LOCAL_MACHINE_GROUP_POLICY_ID', 'REG_RESOURCE_REQUIREMENTS_LIST', 'RPC_X_BAD_STUB_DATA', 'szOID_RSAES_OAEP', 'ERROR_FAIL_RESTART', 'SM_CXMENUSIZE', 'CERT_SYSTEM_STORE_SERVICES', 'MEM_RESET', 'DIGSIG_E_EXTENSIBILITY', 'EXCEPTION_FLT_INVALID_OPERATION', 'FILE_FLAG_OPEN_REPARSE_POINT', 'ERROR_IMAGE_NOT_AT_BASE', 'ERROR_CURRENT_DIRECTORY', 'RPC_S_UNSUPPORTED_TRANS_SYN', 'ERROR_DUP_NAME', 'ERROR_TIMER_NOT_CANCELED', 'FILE_ATTRIBUTE_ARCHIVE', 'CERT_QUERY_CONTENT_CERT_PAIR', 'IMAGE_SCN_ALIGN_512BYTES', 'CERT_ISSUER_PUBLIC_KEY_MD5_HASH_PROP_ID', 'ERROR_NOT_TINY_STREAM', 'ERROR_SECTOR_NOT_FOUND', 'ERROR_INVALID_ACCESS', 'RPC_C_AUTHN_LEVEL_DEFAULT', 'HKEY_USERS', 'szOID_RSA_MD2', 'szOID_RSA_MD5', 'szOID_RSA_MD4', 'DEBUG_EVENT_EXIT_THREAD', 'SM_CYDOUBLECLK', 'CERT_COMPARE_SHA1_HASH', 'WTD_UI_NOBAD', 'szOID_ECDSA_SHA1', 'DEBUG_EVENT_CHANGE_SYMBOL_STATE', 'ERROR_BUSY', 'szOID_INFOSEC_SuiteASignature', 'SM_CYVSCROLL', 'ERROR_USER_PROFILE_LOAD', 'CERT_QUERY_CONTENT_FLAG_PKCS7_SIGNED', 'STD_INPUT_HANDLE', 'CRYPT_KEK', 'TH32CS_SNAPALL', 'ERROR_DOMAIN_CTRLR_CONFIG_ERROR', 'CMSG_ENCODED_MESSAGE', 'ERROR_NET_WRITE_FAULT', 'IMAGE_FILE_MACHINE_ARM', 'CREATE_DEFAULT_ERROR_MODE', 'CERT_SOURCE_LOCATION_PROP_ID', 'ERROR_SYNCHRONIZATION_REQUIRED', 'ERROR_DISK_CHANGE', 'SERVICE_START_PENDING', 'SERVICE_START', 'IMAGE_SCN_ALIGN_128BYTES', 'SW_SHOWMAXIMIZED', 'ERROR_PREDEFINED_HANDLE', 'ERROR_BADSTARTPOSITION', 'CERT_INFO_SERIAL_NUMBER_FLAG', 'CERT_FIND_PUBLIC_KEY', 'CERT_COMPARE_SHIFT', 'PROV_RSA_AES', 'CERT_COMPARE_MASK', 'ERROR_WAIT_3', 'ERROR_WAIT_2', 'ERROR_WAIT_1', 'ALPC_MESSAGE_TOKEN_ATTRIBUTE', 'szOID_NIST_sha256', 'CERT_QUERY_OBJECT_BLOB', 'ERROR_DRIVER_CANCEL_TIMEOUT', 'EXCEPTION_PRIV_INSTRUCTION', 'FILE_ACTION_RENAMED_NEW_NAME', 'DIRECTORY_QUERY', 'ERROR_DBG_PRINTEXCEPTION_C', 'AF_IRDA', 'CERT_ARCHIVED_PROP_ID', 'DIRECTORY_ALL_ACCESS', 'GROUP_SECURITY_INFORMATION', 'RPC_C_AUTHN_LEVEL_PKT', 'MAXIMUM_ALLOWED', 'EXCEPTION_DATATYPE_MISALIGNMENT', 'HIGH_PRIORITY_CLASS', 'NORMAL_PRIORITY_CLASS', 'ERROR_FAIL_SHUTDOWN', 'X509_CERT_TO_BE_SIGNED', 'szOID_RSA_RC4', 'szOID_DSALG_SIGN', 'ERROR_REPARSE', 'SERVICE_PAUSED', 'IMAGE_SIZEOF_SHORT_NAME', 'CMSG_RECIPIENT_COUNT_PARAM', 'szOID_RSA_challengePwd', 'SERVICE_ACCEPT_SESSIONCHANGE', 'CMSG_ENCODING_TYPE_MASK', 'IMAGE_SCN_ALIGN_64BYTES', 'ERROR_EA_LIST_INCONSISTENT', 'ERROR_CANT_ENABLE_DENY_ONLY', 'ERROR_EVALUATION_EXPIRATION', 'szOID_RSA_ENCRYPT', 'CERT_COMPARE_PUBKEY_MD5_HASH', 'STARTF_USESHOWWINDOW', 'ERROR_GUID_SUBSTITUTION_MADE', 'DEBUG_EVENT_CREATE_PROCESS', 'IMAGE_SCN_ALIGN_1BYTES', 'SECURITY_MANDATORY_PROTECTED_PROCESS_RID', 'EXCEPTION_CONTINUE_SEARCH', 'REG_FULL_RESOURCE_DESCRIPTOR', 'MEM_MAPPED', 'CERT_FIND_EXISTING', 'KEY_ALL_ACCESS', 'ERROR_INVALID_LEVEL', 'ERROR_THREAD_WAS_SUSPENDED', 'CERT_COMPARE_HASH', 'RRF_RT_REG_DWORD', 'TRUST_E_SUBJECT_FORM_UNKNOWN', 'RPC_C_IMP_LEVEL_IMPERSONATE', 'ERROR_FAILED_DRIVER_ENTRY', 'CRYPT_VERIFYCONTEXT', 'CERT_INFO_NOT_AFTER_FLAG', 'SERVICE_STATE_ALL', 'SERVICE_ACCEPT_PAUSE_CONTINUE', 'ERROR_ATOMIC_LOCKS_NOT_SUPPORTED', 'UNLOAD_DLL_DEBUG_EVENT', 'FILE_NAMED_STREAMS', 'szOID_OIWSEC_md5RSASign', 'RPC_C_QOS_CAPABILITIES_DEFAULT', 'IMAGE_FILE_BYTES_REVERSED_HI', 'FILE_SUPPORTS_SPARSE_FILES', 'ERROR_MEDIA_CHECK', 'ERROR_ELEVATION_REQUIRED', 'ERROR_PNP_BAD_MPS_TABLE', 'CRYPT_ACQUIRE_SILENT_FLAG', 'CERT_COMPARE_ISSUER_OF', 'CRYPT_ACQUIRE_NO_HEALING', 'GENERIC_ALL', 'THREAD_DIRECT_IMPERSONATION', 'szOID_RSA_hashedData', 'CERT_E_MALFORMED', 'WTD_UI_ALL', 'DEBUG_EVENT_SYSTEM_ERROR', 'CERT_SYSTEM_STORE_CURRENT_SERVICE', 'szOID_ANSI_X942_DH', 'CERT_STORE_PROV_SYSTEM_REGISTRY_A', 'ERROR_DLL_INIT_FAILED_LOGOFF', 'IMAGE_FILE_MACHINE_ARMNT', 'MEM_PRIVATE', 'szOID_RSA_extCertAttrs', 'szOID_ECC_CURVE_P521', 'SE_PRIVILEGE_REMOVED', 'WTD_CHOICE_FILE', 'ERROR_CARDBUS_NOT_SUPPORTED', 'CMSG_SIGNER_COUNT_PARAM', 'szOID_PKCS_12', 'CERT_INFO_EXTENSION_FLAG', 'SM_CXDOUBLECLK', 'ALPC_PORFLG_ALLOW_LPC_REQUESTS', 'SERVICE_ACCEPT_HARDWAREPROFILECHANGE', 'CERT_STORE_ADD_REPLACE_EXISTING', 'CMSG_COMPUTED_HASH_PARAM', 'AF_UNSPEC', 'CMSG_SIGNER_UNAUTH_ATTR_PARAM', 'RPC_RESPONSE_TYPE_BIND_OK', 'ERROR_NOT_SAME_DEVICE', 'ERROR_REQ_NOT_ACCEP', 'USAGE_MATCH_TYPE_AND', 'DRIVE_FIXED', 'SECTION_QUERY', 'ERROR_BUFFER_ALL_ZEROS', 'ERROR_INSUFFICIENT_RESOURCE_FOR_SPECIFIED_SHARED_SECTION_SIZE', 'STARTF_USESTDHANDLES', 'PROV_SPYRUS_LYNKS', 'AF_DECnet', 'PROCESS_CREATE_PROCESS', 'CERT_DATE_STAMP_PROP_ID', 'szOID_RSA_unstructName', 'ACCESS_MIN_MS_ACE_TYPE', 'SM_MENUDROPALIGNMENT', 'RRF_RT_REG_SZ', 'ERROR_BAD_FUNCTION_TABLE', 'PAGE_WRITECOPY', 'SEC_PROTECTED_IMAGE', 'SERVICE_RUNS_IN_SYSTEM_PROCESS', 'ACCESS_MAX_MS_V2_ACE_TYPE', 'ERROR_INVALID_HW_PROFILE', 'IMAGE_FILE_MACHINE_M32R', 'IMAGE_SCN_MEM_NOT_PAGED', 'SM_CXMENUCHECK', 'ERROR_BAD_SERVICE_ENTRYPOINT', 'ERROR_OPLOCK_SWITCHED_TO_NEW_HANDLE', 'ERROR_DBG_UNABLE_TO_PROVIDE_HANDLE', 'CERT_COMPARE_SUBJECT_INFO_ACCESS', 'IMAGE_SCN_ALIGN_16BYTES', 'CERT_COMPARE_NAME_STR_A', 'ERROR_INVALID_EXE_SIGNATURE', 'ERROR_TOO_MANY_OPEN_FILES', 'CERT_E_INVALID_POLICY', 'ERROR_BROKEN_PIPE', 'CREATE_IGNORE_SYSTEM_DEFAULT', 'CERT_TRUST_INVALID_POLICY_CONSTRAINTS', 'CERT_COMPARE_NAME_STR_W', 'FILE_ACTION_MODIFIED', 'ERROR_NETWORK_BUSY', 'ERROR_SEM_USER_LIMIT', 'szOID_INFOSEC_mosaicKMandSig', 'ERROR_SYSTEM_POWERSTATE_COMPLEX_TRANSITION', 'FILE_FLAG_OPEN_NO_RECALL', 'SM_MOUSEHORIZONTALWHEELPRESENT', 'ERROR_PIPE_LOCAL', 'X509_NAME_VALUE', 'ERROR_FILE_SYSTEM_LIMITATION', 'CERT_STORE_PROV_MEMORY', 'IMAGE_SCN_TYPE_NOLOAD', 'ALPC_PORFLG_SYSTEM_PROCESS', 'szOID_OIWSEC_keyHashSeal', 'ERROR_PAGE_FAULT_COPY_ON_WRITE', 'ERROR_EXE_MACHINE_TYPE_MISMATCH', 'LABEL_SECURITY_INFORMATION', 'RPC_C_IMP_LEVEL_ANONYMOUS', 'ERROR_INVALID_DRIVE', 'CERT_KEY_PROV_HANDLE_PROP_ID', 'IMAGE_SCN_MEM_FARDATA', 'GENERIC_READ', 'szOID_RSA_RC5_CBCPad', 'ERROR_FSFILTER_OP_COMPLETED_SUCCESSFULLY', 'CMSG_CMS_SIGNER_INFO_PARAM', 'ERROR_MAX_SESSIONS_REACHED', 'SECURITY_MANDATORY_HIGH_RID', 'CMSG_TYPE_PARAM', 'MS_STRONG_PROV', 'SEC_NOCACHE', 'ERROR_IP_ADDRESS_CONFLICT2', 'ERROR_IP_ADDRESS_CONFLICT1', 'REG_QWORD', 'ERROR_USER_APC', 'SM_CXMIN', 'CMSG_VERSION_PARAM', 'ERROR_CANNOT_MAKE', 'FILE_OPEN_IF', 'ERROR_UNEXPECTED_MM_MAP_ERROR', 'IMAGE_SCN_CNT_INITIALIZED_DATA', 'X509_EXTENSIONS', 'RPC_C_AUTHN_LEVEL_NONE', 'ERROR_ASSERTION_FAILURE', 'szOID_INFOSEC_sdnsIntegrity', 'CERT_NAME_FRIENDLY_DISPLAY_TYPE', 'ERROR_REM_NOT_LIST', 'SM_CXSMICON', 'ERROR_NO_ACE_CONDITION', 'ERROR_LOST_WRITEBEHIND_DATA_NETWORK_DISCONNECTED', 'CERT_STORE_PROV_SYSTEM_REGISTRY', 'MEM_IMAGE', 'CRYPT_USER_KEYSET', 'ERROR_SEGMENT_NOTIFICATION', 'szOID_RSA_preferSignedData', 'ERROR_SAME_DRIVE', 'ERROR_NOACCESS', 'FILE_SUPPORTS_ENCRYPTION', 'KEY_EXECUTE', 'EXCEPTION_INVALID_HANDLE', 'MS_DEF_RSA_SIG_PROV', 'RPC_S_UNKNOWN_IF', 'THREAD_TERMINATE', 'SW_SHOWNA', 'CERT_TRUST_HAS_NOT_SUPPORTED_NAME_CONSTRAINT', 'szOID_OIWSEC_md4RSA', 'CERT_CHAIN_REVOCATION_CHECK_END_CERT', 'S_OK', 'AF_DLI', 'IMAGE_FILE_MACHINE_MIPS16', 'EXCEPTION_FLT_STACK_CHECK', 'CMSG_BARE_CONTENT_PARAM', 'OBJ_OPENIF', 'ERROR_PROFILING_NOT_STOPPED', 'SERVICE_DEMAND_START', 'CONTROL_C_EXIT', 'MS_DEF_RSA_SIG_PROV_A', 'CERT_ENCODING_TYPE_MASK', 'ERROR_QUOTA_LIST_INCONSISTENT', 'ERROR_STACK_OVERFLOW', 'szOID_ECC_PUBLIC_KEY', 'ERROR_SEM_TIMEOUT', 'CMSG_UNPROTECTED_ATTR_PARAM', 'FILE_SUPPORTS_OBJECT_IDS', 'IMAGE_SCN_CNT_CODE', 'CERT_NAME_DISABLE_IE4_UTF8_FLAG', 'ABOVE_NORMAL_PRIORITY_CLASS', 'PROV_DSS', 'ERROR_INVALID_FLAG_NUMBER', 'CERT_AUTO_ENROLL_RETRY_PROP_ID', 'IMAGE_SCN_GPREL', 'szOID_RFC3161_counterSign', 'ERROR_FILE_INVALID', 'ERROR_OPLOCK_NOT_GRANTED', 'ERROR_INVALID_SEGDPL', 'ERROR_ABIOS_ERROR', 'RPC_RESPONSE_TYPE_SUCCESS', 'WTD_UI_NONE', 'FILE_ATTRIBUTE_SYSTEM', 'X509_OCTET_STRING', 'ERROR_NO_TOKEN', 'ERROR_INVALID_ORDINAL', 'IMAGE_SCN_MEM_READ', 'ERROR_MAX_THRDS_REACHED', 'SERVICE_CONTROL_NETBINDADD', 'X509_ANY_STRING', 'ERROR_EAS_NOT_SUPPORTED', 'CONTEXT_CONTROL', 'szOID_RSA_SHA256RSA', 'PAGE_EXECUTE_WRITECOPY', 'SM_CXSCREEN', 'SM_CXDLGFRAME', 'ERROR_REGISTRY_RECOVERED', 'SECURITY_MANDATORY_SYSTEM_RID', 'CREATE_SEPARATE_WOW_VDM', 'ERROR_ENVVAR_NOT_FOUND', 'ERROR_INVALID_FLAGS', 'STARTF_FORCEOFFFEEDBACK', 'ERROR_TOO_MANY_NAMES', 'SERVICE_INTERACTIVE_PROCESS', 'CREATE_THREAD_DEBUG_EVENT', 'SW_MAXIMIZE', 'X509_AUTHORITY_KEY_ID', 'ERROR_FORMS_AUTH_REQUIRED', 'ERROR_CALL_NOT_IMPLEMENTED', 'IMAGE_FILE_MACHINE_MIPSFPU', 'CERT_TRUST_IS_OFFLINE_REVOCATION', 'SM_ARRANGE', 'SW_SHOWNORMAL', 'CRYPT_ENCODE_DECODE_NONE', 'MS_ENHANCED_PROV_W', 'PROV_DSS_DH', 'CMSG_CERT_PARAM', 'ERROR_FILE_NOT_FOUND', 'CRYPT_DEFAULT_CONTAINER_OPTIONAL', 'ERROR_DBG_CONTROL_BREAK', 'CERT_TRUST_IS_PARTIAL_CHAIN', 'PROV_RSA_SCHANNEL', 'ERROR_FLOPPY_VOLUME', 'AF_UNKNOWN1', 'SERVICE_CONTROL_NETBINDENABLE', 'szOID_RSA_signEnvData', 'SECTION_MAP_READ', 'SECTION_MAP_EXECUTE', 'CERT_FIND_SUBJECT_ATTR', 'FILE_FLAG_FIRST_PIPE_INSTANCE', 'IMAGE_FILE_AGGRESIVE_WS_TRIM', 'ERROR_DIR_NOT_EMPTY', 'szOID_INFOSEC_mosaicConfidentiality', 'ERROR_NO_CALLBACK_ACTIVE', 'ERROR_GEN_FAILURE', 'CERT_QUERY_FORMAT_FLAG_BASE64_ENCODED', 'FILE_SHARE_DELETE', 'SM_CXFULLSCREEN', 'ERROR_CALLBACK_POP_STACK', 'CERT_TRUST_IS_NOT_TIME_VALID', 'SERVICE_ACCEPT_STOP', 'CERT_STORE_PROV_SYSTEM_W', 'STANDARD_RIGHTS_REQUIRED', 'CREATE_BREAKAWAY_FROM_JOB', 'SERVICE_RECOGNIZER_DRIVER', 'RRF_RT_ANY', 'CERT_INFO_VERSION_FLAG', 'CERT_TRUST_IS_COMPLEX_CHAIN', 'CRYPT_USER_PROTECTED', 'ERROR_FS_DRIVER_REQUIRED', 'FILE_CASE_SENSITIVE_SEARCH', 'FILE_SUPPORTS_OPEN_BY_FILE_ID', 'SW_SHOWMINIMIZED', 'ERROR_DRIVER_FAILED_PRIOR_UNLOAD', 'PROCESS_QUERY_LIMITED_INFORMATION', 'SM_CYCAPTION', 'CMSG_CMS_RECIPIENT_INFO_PARAM', 'CERT_INFO_ISSUER_UNIQUE_ID_FLAG', 'ERROR_UNSUPPORTED_COMPRESSION', 'szOID_RSA_SMIMEalgCMSRC2wrap', 'szOID_RSA_contentType', 'DRIVE_NO_ROOT_DIR', 'MS_ENHANCED_PROV', 'CERT_SUBJECT_NAME_MD5_HASH_PROP_ID', 'szOID_NIST_AES192_CBC', 'ERROR_OUT_OF_STRUCTURES', 'CMSG_RECIPIENT_INDEX_PARAM', 'IMAGE_FILE_MACHINE_R4000', 'SM_CLEANBOOT', 'LPC_DEBUG_EVENT', 'IMAGE_SCN_ALIGN_1024BYTES', 'ERROR_CANCEL_VIOLATION', 'ERROR_READ_FAULT', 'SERVICE_RUNNING', 'CERT_QUERY_FORMAT_ASN_ASCII_HEX_ENCODED', 'FILE_OVERWRITE_IF', 'SERVICE_CONTROL_SHUTDOWN', 'CERT_TRUST_HAS_NOT_SUPPORTED_CRITICAL_EXT', 'KEY_CREATE_LINK', 'szOID_INFOSEC_mosaicSignature', 'ERROR_INVALID_ADDRESS', 'PROV_DH_SCHANNEL', 'FILE_NOTIFY_CHANGE_FILE_NAME', 'ERROR_INVALID_LOCK_RANGE', 'RPC_C_QOS_IDENTITY_STATIC', 'CERT_STORE_CRL_CONTEXT', 'SECTION_EXTEND_SIZE', 'ERROR_REGISTRY_HIVE_RECOVERED', 'CERT_TRUST_NO_ISSUANCE_CHAIN_POLICY', 'SERVICE_CONTROL_NETBINDREMOVE', 'szOID_INFOSEC', 'PROCESS_VM_READ', 'TOKEN_ALL_ACCESS', 'szOID_INFOSEC_mosaicKMandUpdSig', 'ERROR_NO_PAGEFILE', 'ERROR_UNRECOGNIZED_VOLUME', 'CRYPT_NDR_ENCODING', 'ERROR_NOTIFY_ENUM_DIR', 'FILE_NOTIFY_CHANGE_LAST_ACCESS', 'ERROR_PORT_NOT_SET', 'SM_CXICONSPACING', 'CERT_SYSTEM_STORE_CURRENT_USER_ID', 'ERROR_CRASH_DUMP', 'ERROR_LOCK_VIOLATION', 'DEBUG_EVENT_EXIT_PROCESS', 'MEM_RELEASE', 'ALPC_HANDLEFLG_DUPLICATE_INHERIT', 'ALPC_MESSAGE_CONTEXT_ATTRIBUTE', 'INHERIT_CALLER_PRIORITY', 'IMAGE_SCN_NO_DEFER_SPEC_EXC', 'CERT_ISSUER_SERIAL_NUMBER_MD5_HASH_PROP_ID', 'ERROR_BAD_DRIVER_LEVEL', 'CERT_QUERY_FORMAT_FLAG_BINARY', 'ERROR_BUFFER_OVERFLOW', 'ERROR_ACCESS_DENIED', 'SERVICE_ACCEPT_TIMECHANGE', 'CERT_TRUST_IS_PEER_TRUSTED', 'szOID_OIWSEC_shaDSA', 'KEY_CREATE_SUB_KEY', 'SM_CXCURSOR', 'PKCS12_PREFER_CNG_KSP', 'SERVICE_AUTO_START', 'WTD_CHOICE_CATALOG', 'CERT_STORE_PROV_PKCS12', 'SM_CYMINSPACING', 'ALPC_MESSAGE_WORK_ON_BEHALF_ATTRIBUTE', 'SM_XVIRTUALSCREEN', 'TOKEN_ADJUST_GROUPS', 'CMSG_SIGNER_INFO_PARAM', 'FILE_SUPPORTS_EXTENDED_ATTRIBUTES', 'ACCESS_ALLOWED_ACE_TYPE', 'X509_MULTI_BYTE_INTEGER', 'ACCESS_DENIED_ACE_TYPE', 'szOID_INFOSEC_sdnsTokenProtection', 'HKEY_CLASSES_ROOT', 'IMAGE_FILE_MACHINE_TRICORE', 'EXCEPTION_ACCESS_VIOLATION', 'ACCESS_ALLOWED_COMPOUND_ACE_TYPE', 'X509_BASIC_CONSTRAINTS', 'PERSIST_E_SIZEDEFINITE', 'ERROR_BAD_ENVIRONMENT', 'REG_SZ', 'EXIT_THREAD_DEBUG_EVENT', 'CRYPT_SILENT', 'ERROR_DEVICE_ALREADY_ATTACHED', 'CERT_STORE_DELETE_FLAG', 'ERROR_NO_YIELD_PERFORMED', 'szOID_DSALG', 'SERVICE_KERNEL_DRIVER', 'SYSTEM_AUDIT_CALLBACK_OBJECT_ACE_TYPE', 'szOID_OIWSEC_desCBC', 'ERROR_HANDLES_CLOSED', 'SERVICE_CONTROL_TRIGGEREVENT', 'SERVICE_CONTROL_SESSIONCHANGE', 'CERT_ENROLLMENT_PROP_ID', 'IMAGE_SCN_ALIGN_32BYTES', 'szOID_NIST_AES256_WRAP', 'PAGE_READWRITE', 'MEM_TOP_DOWN', 'CERT_NAME_URL_TYPE', 'SM_YVIRTUALSCREEN', 'SM_MAXIMUMTOUCHES', 'ERROR_FT_READ_RECOVERY_FROM_BACKUP', 'SERVICE_CONTROL_PRESHUTDOWN', 'ERROR_DBG_CONTROL_C', 'ERROR_PIPE_LISTENING', 'ALPC_SECFLG_CREATE_HANDLE', 'szOID_INFOSEC_sdnsSignature', 'ERROR_BAD_STACK', 'CRYPT_NEWKEYSET', 'CERT_FIND_PROPERTY', 'FILE_ACTION_ADDED', 'szOID_NIST_sha512', 'CERT_REQUEST_ORIGINATOR_PROP_ID', 'FILE_ATTRIBUTE_READONLY', 'szOID_RSA_SHA1RSA', 'ERROR_BAD_ACCESSOR_FLAGS', 'SPECIFIC_RIGHTS_ALL', 'MEM_COMMIT', 'FILE_NOTIFY_CHANGE_CREATION', 'szOID_DH_SINGLE_PASS_STDDH_SHA256_KDF', 'ERROR_RELOC_CHAIN_XEEDS_SEGLIM', 'CERT_QUERY_CONTENT_FLAG_SERIALIZED_CERT', 'SC_MANAGER_CREATE_SERVICE', 'FILE_ATTRIBUTE_DIRECTORY', 'CERT_QUERY_CONTENT_SERIALIZED_CRL', 'szOID_RSA_SMIMEalgCMS3DESwrap', 'RRF_RT_DWORD', 'RPC_S_PROTOCOL_ERROR', 'X509_INTEGER', 'szOID_DSALG_HASH', 'DRIVE_RAMDISK', 'szOID_RSA_RC2CBC', 'ERROR_EA_TABLE_FULL', 'CERT_FIND_ISSUER_STR_W', 'PAGE_EXECUTE_READWRITE', 'ERROR_INVALID_CATEGORY', 'CMSG_CMS_RECIPIENT_COUNT_PARAM', 'CERT_FIND_ISSUER_STR_A', 'szOID_DSALG_CRPT', 'DUPLICATE_CLOSE_SOURCE', 'IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP', 'DACL_SECURITY_INFORMATION', 'OBJ_OPENLINK', 'THREAD_IMPERSONATE', 'CERT_SYSTEM_STORE_LOCAL_MACHINE_ENTERPRISE_ID', 'CERT_TRUST_IS_UNTRUSTED_ROOT', 'SW_RESTORE', 'ERROR_CORRUPT_SYSTEM_FILE', 'CRYPT_ACQUIRE_COMPARE_KEY_FLAG', 'ERROR_NETWORK_ACCESS_DENIED', 'SYSTEM_ALARM_CALLBACK_ACE_TYPE', 'PKCS_ATTRIBUTE', 'SM_CXEDGE', 'ERROR_FILENAME_EXCED_RANGE', 'AF_PUP', 'ERROR_DIRECT_ACCESS_HANDLE', 'ERROR_SYSTEM_HIVE_TOO_LARGE', 'szOID_RSA_MGF1', 'LPC_REPLY', 'ERROR_SEM_IS_SET', 'PROCESS_TERMINATE', 'SM_CYMINIMIZED', 'ALPC_MSGFLG_RELEASE_MESSAGE', 'WTD_REVOKE_NONE', 'szOID_NIST_AES192_WRAP', 'ERROR_DBG_EXCEPTION_NOT_HANDLED', 'X509_PUBLIC_KEY_INFO', 'CERT_STORE_PROV_SYSTEM', 'SM_CYSCREEN', 'CERT_STORE_PROV_MSG', 'ERROR_INSUFFICIENT_POWER', 'szOID_OIWSEC_dhCommMod', 'ERROR_EA_ACCESS_DENIED', 'CERT_SYSTEM_STORE_CURRENT_SERVICE_ID', 'SACL_SECURITY_INFORMATION', 'ERROR_NESTING_NOT_ALLOWED', 'CREATE_UNICODE_ENVIRONMENT', 'ERROR_NOT_SUBSTED', 'ERROR_BAD_LENGTH', 'RPC_C_AUTHN_LEVEL_CALL', 'IMAGE_SCN_MEM_PRELOAD', 'ERROR_BAD_FORMAT', 'szOID_OIWSEC_sha1RSASign', 'szOID_RSA_digestedData', 'szOID_ECDSA_SHA384', 'VER_NT_DOMAIN_CONTROLLER', 'CERT_TRUST_HAS_VALID_NAME_CONSTRAINTS', 'SERVICE_INTERROGATE', 'EXPORT_PRIVATE_KEYS', 'X509_UNICODE_ANY_STRING', 'IMAGE_FILE_MACHINE_R3000', 'TOKEN_QUERY', 'CERT_FIND_ISSUER_NAME', 'CERT_TRUST_HAS_EXCLUDED_NAME_CONSTRAINT', 'ERROR_ARENA_TRASHED', 'OPEN_EXISTING', 'FILE_MAP_READ', 'ACCESS_MAX_MS_V3_ACE_TYPE', 'PROV_REPLACE_OWF', 'STARTF_RUNFULLSCREEN', 'MAX_PATH', 'CERT_QUERY_CONTENT_FLAG_CRL', 'THREAD_QUERY_INFORMATION', 'ERROR_DBG_CONTINUE', 'IMAGE_SCN_LNK_COMDAT', 'SC_MANAGER_QUERY_LOCK_STATUS', 'ALPC_CANCELFLGP_FLUSH', 'ERROR_META_EXPANSION_TOO_LONG', 'szOID_INFOSEC_mosaicKeyManagement', 'szOID_INFOSEC_SuiteAKeyManagement', 'CERT_COMPARE_NAME', 'IMAGE_FILE_MACHINE_MIPSFPU16', 'IMAGE_FILE_MACHINE_WCEMIPSV2', 'ERROR_DELETE_PENDING', 'SM_CXBORDER', 'ERROR_DRIVER_DATABASE_ERROR', 'CERT_TRUST_REVOCATION_STATUS_UNKNOWN', 'SM_REMOTESESSION', 'ERROR_TOO_MANY_THREADS', 'szOID_TIMESTAMP_TOKEN', 'CERT_STORE_OPEN_EXISTING_FLAG', 'ERROR_CANTFETCHBACKWARDS', 'CERT_SMART_CARD_DATA_PROP_ID', 'CERT_COMPARE_SUBJECT_CERT', 'ERROR_SHARING_BUFFER_EXCEEDED', 'SERVICE_WIN32', 'SM_MOUSEWHEELPRESENT', 'EXTENDED_STARTUPINFO_PRESENT', 'FILE_OVERWRITE', 'SM_CXMAXTRACK', 'ERROR_NO_PROC_SLOTS', 'szOID_X957', 'ERROR_BAD_ARGUMENTS', 'FILE_FLAG_DELETE_ON_CLOSE', 'ERROR_CHILD_MUST_BE_VOLATILE', 'IMAGE_FILE_LOCAL_SYMS_STRIPPED', 'TOKEN_ADJUST_SESSIONID', 'CERT_TRUST_IS_SELF_SIGNED', 'ERROR_EAS_DIDNT_FIT', 'ERROR_INVALID_LDT_DESCRIPTOR', 'ERROR_MULTIPLE_FAULT_VIOLATION', 'TRUST_E_FAIL', 'CERT_COMPARE_CROSS_CERT_DIST_POINTS', 'SM_SERVERR2', 'ERROR_BAD_EXE_FORMAT', 'CERT_STORE_PROV_PHYSICAL_W', 'ERROR_HIBERNATED', 'DEBUG_EVENT_SESSION_STATUS', 'ERROR_LABEL_TOO_LONG', 'CERT_SYSTEM_STORE_LOCAL_MACHINE_ID', 'MS_DEF_RSA_SIG_PROV_W', 'CERT_AIA_URL_RETRIEVED_PROP_ID', 'ACCESS_ALLOWED_CALLBACK_ACE_TYPE', 'SM_CYMENUSIZE', 'AF_12844', 'SERVICE_ENUMERATE_DEPENDENTS', 'GENERIC_WRITE', 'ERROR_EVENT_DONE', 'szOID_INFOSEC_mosaicUpdatedSig', 'ERROR_RESUME_HIBERNATION', 'ERROR_NO_MORE_FILES', 'CERT_STORE_UPDATE_KEYID_FLAG', 'EXCEPTION_NONCONTINUABLE_EXCEPTION', 'SM_DBCSENABLED', 'IMAGE_FILE_BYTES_REVERSED_LO', 'ERROR_CANT_TERMINATE_SELF', 'X509_BASIC_CONSTRAINTS2', 'REG_MULTI_SZ', 'ERROR_OPERATION_ABORTED', 'AF_VOICEVIEW', 'szOID_NIST_sha384', 'SM_CXPADDEDBORDER', 'BIND_IF_SYNTAX_NDR32', 'ERROR_THREAD_1_INACTIVE', 'FILE_FLAG_WRITE_THROUGH', 'ERROR_WAKE_SYSTEM', 'ERROR_NO_SIGNAL_SENT', 'ERROR_INCOMPATIBLE_WITH_GLOBAL_SHORT_NAME_REGISTRY_SETTING', 'CREATE_SHARED_WOW_VDM', 'SM_CYSMSIZE', 'X509_CERT_REQUEST_TO_BE_SIGNED', 'ERROR_FIRMWARE_UPDATED', 'LPC_PORT_CLOSED', 'FILE_MAP_COPY', 'ERROR_ILLEGAL_CHARACTER', 'FILE_READ_ONLY_VOLUME', 'szOID_OIW', 'FILE_ATTRIBUTE_HIDDEN', 'ERROR_INVALID_EA_HANDLE', 'CERT_QUERY_FORMAT_BASE64_ENCODED', 'ALPC_MESSAGE_SECURITY_ATTRIBUTE', 'PROV_MS_EXCHANGE', 'CREATE_FORCEDOS', 'szOID_OIWSEC_md4RSA2', 'SYSTEM_MANDATORY_LABEL_ACE_TYPE', 'ERROR_CAN_NOT_COMPLETE', 'TH32CS_SNAPPROCESS', 'SM_CXMINTRACK', 'CERT_E_EXPIRED', 'ERROR_PRINT_CANCELLED', 'OBJ_KERNEL_HANDLE', 'CERT_STORE_PROV_PHYSICAL', 'szOID_OIWSEC_rsaXchg', 'szOID_ECC_CURVE_P384', 'ERROR_CONVERT_TO_LARGE', 'ERROR_INVALID_EVENT_COUNT', 'S_FALSE', 'AF_OSI', 'ERROR_BAD_MCFG_TABLE', 'ERROR_KEY_DELETED', 'FILE_MAP_EXECUTE', 'SM_CXDRAG', 'EXCEPTION_GUARD_PAGE', 'ALPC_MESSAGE_DIRECT_ATTRIBUTE', 'ERROR_FAIL_NOACTION_REBOOT', 'SM_PENWINDOWS', 'CERT_QUERY_CONTENT_PKCS7_SIGNED', 'ACCESS_MAX_MS_V5_ACE_TYPE', 'SERVICE_TYPE_ALL', 'ERROR_FAIL_I24', 'SERVICE_CONTROL_CONTINUE', 'CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT', 'SM_CYMAXIMIZED', 'X509_KEY_USAGE', 'VER_NT_SERVER', 'GENERIC_EXECUTE', 'CERT_TRUST_IS_NOT_TIME_NESTED', 'ERROR_REGISTRY_QUOTA_LIMIT', 'ERROR_IS_SUBST_PATH', 'FILE_ACTION_RENAMED_OLD_NAME', 'CERT_QUERY_CONTENT_FLAG_PFX', 'FILE_NOTIFY_CHANGE_DIR_NAME', 'SM_CYVTHUMB', 'CERT_TRUST_INVALID_NAME_CONSTRAINTS', 'TOKEN_ADJUST_PRIVILEGES', 'ERROR_THREAD_MODE_NOT_BACKGROUND', 'SERVICE_PAUSE_CONTINUE', 'CERT_STORE_ENUM_ARCHIVED_FLAG', 'FILE_MAP_ALL_ACCESS', 'LPC_LOST_REPLY', 'CERT_STORE_MAXIMUM_ALLOWED_FLAG', 'CREATE_NEW', 'CERT_STORE_PROV_FILE', 'szOID_RSA_SHA512RSA', 'SW_SHOWDEFAULT', 'szOID_OIWDIR', 'CRYPT_ONLINE', 'szOID_INFOSEC_mosaicIntegrity', 'DIRECTORY_CREATE_SUBDIRECTORY', 'IMAGE_FILE_MACHINE_ALPHA64', 'FILE_ATTRIBUTE_NOT_CONTENT_INDEXED', 'ERROR_MISSING_SYSTEMFILE', 'X509_NAME', 'IMAGE_SCN_TYPE_DSECT', 'AF_CHAOS', 'ERROR_RECEIVE_EXPEDITED', 'PAGE_NOCACHE', 'SM_CYEDGE', 'CERT_STORE_PROV_LDAP', 'BELOW_NORMAL_PRIORITY_CLASS', 'PROV_EC_ECDSA_FULL', 'ERROR_IS_JOIN_TARGET', 'ERROR_MEMORY_HARDWARE', 'CERT_QUERY_CONTENT_FLAG_SERIALIZED_CTL', 'ERROR_WX86_ERROR', 'ERROR_INVALID_VERIFY_SWITCH', 'ERROR_BADDB', 'CREATE_NEW_PROCESS_GROUP', 'ERROR_VC_DISCONNECTED', 'CMSG_ENVELOPE_ALGORITHM_PARAM', 'DEBUG_EVENT_CHANGE_ENGINE_STATE', 'CERT_FIND_ISSUER_STR', 'IMAGE_FILE_DEBUG_STRIPPED', 'CMSG_RECIPIENT_INFO_PARAM', 'szOID_OIWSEC_mdc2', 'SERVICE_PAUSE_PENDING', 'CERT_FIND_PUBKEY_MD5_HASH', 'SM_CYDLGFRAME', 'ERROR_VOLUME_MOUNTED', 'CERT_FIND_HASH', 'CMSG_ENCRYPT_PARAM', 'ERROR_WRITE_FAULT', 'FILE_FILE_COMPRESSION', 'CERT_RENEWAL_PROP_ID', 'CERT_QUERY_CONTENT_SERIALIZED_CTL', 'SW_HIDE', 'szOID_OIWSEC_desECB', 'CRYPT_ACQUIRE_ONLY_NCRYPT_KEY_FLAG', 'ERROR_UNEXPECTED_MM_EXTEND_ERR', 'CERT_COMPARE_CERT_ID', 'szOID_RSA_signingTime', 'ERROR_LOST_WRITEBEHIND_DATA_NETWORK_SERVER_ERROR', 'CERT_E_PURPOSE', 'RPC_C_QOS_IDENTITY_DYNAMIC', 'ERROR_NOINTERFACE', 'CERT_E_REVOKED', 'szOID_OIWSEC_dsaCommSHA1', 'FILE_SUPPORTS_REPARSE_POINTS', 'IMAGE_SCN_TYPE_COPY', 'ERROR_VALIDATE_CONTINUE', 'ERROR_SUBST_TO_JOIN', 'LPC_CONNECTION_REQUEST', 'RPC_RESPONSE_TYPE_FAIL', 'EXCEPTION_DEBUG_EVENT', 'REPORT_NOT_ABLE_TO_EXPORT_PRIVATE_KEY', 'SM_CXSMSIZE', 'CMSG_CRL_COUNT_PARAM', 'SERVICE_CONTROL_PAUSE', 'ERROR_RANGE_LIST_CONFLICT', 'CONTEXT_ALL', 'ERROR_CHILD_NOT_COMPLETE', 'CERT_TRUST_NO_ERROR', 'CERT_FIND_CROSS_CERT_DIST_POINTS', 'ERROR_NOT_ALL_ASSIGNED', 'ERROR_CANTREAD', 'ERROR_VIRUS_DELETED', 'IMAGE_SCN_ALIGN_MASK', 'X509_KEYGEN_REQUEST_TO_BE_SIGNED', 'ERROR_FULLSCREEN_MODE', 'CERT_STORE_SHARE_CONTEXT_FLAG', 'ERROR_LOST_WRITEBEHIND_DATA_LOCAL_DISK_ERROR', 'SM_CYMINTRACK', 'SERVICE_ACCEPT_PARAMCHANGE', 'ERROR_RING2_STACK_IN_USE', 'STILL_ACTIVE', 'CERT_STORE_CTL_CONTEXT', 'CREATE_PROCESS_DEBUG_EVENT', 'CERT_NAME_UPN_TYPE', 'SERVICE_ERROR_SEVERE', 'szOID_ECDSA_SHA256', 'ERROR_INVALID_PARAMETER', 'szOID_RSA_MD4RSA', 'ALPC_MSGFLG_SYNC_REQUEST', 'PKCS12_INCLUDE_EXTENDED_PROPERTIES', 'RPC_REQUEST_TYPE_BIND', 'PROCESS_DUP_HANDLE', 'ERROR_COMPRESSION_DISABLED', 'FILE_FLAG_BACKUP_SEMANTICS', 'ERROR_OPEN_FAILED', 'CRYPT_CREATE_IV', 'FILE_VOLUME_QUOTAS', 'CERT_STORE_PROV_PKCS7', 'REG_EXPAND_SZ', 'ERROR_NOT_CAPABLE', 'CERT_FIND_SUBJECT_NAME', 'EXCEPTION_FLT_DENORMAL_OPERAND', 'szOID_OIWSEC_sha1', 'SM_CYFRAME', 'ERROR_WAS_LOCKED', 'EXCEPTION_STACK_OVERFLOW', 'CERT_TRUST_HAS_ISSUANCE_CHAIN_POLICY', 'szOID_OIWSEC_dsa', 'SERVICE_DISABLED', 'FILE_NOTIFY_CHANGE_LAST_WRITE', 'CERT_COMPARE_ATTR', 'CERT_STORE_CERTIFICATE_CONTEXT', 'CERT_ENHKEY_USAGE_PROP_ID', 'SE_PRIVILEGE_ENABLED', 'WTD_STATEACTION_AUTO_CACHE_FLUSH', 'szOID_OIWSEC_rsaSign', 'MAX_INTERFACE_NAME_LEN', 'ERROR_PATH_BUSY', 'ERROR_THREAD_MODE_ALREADY_BACKGROUND', 'szOID_OIWSEC_md2RSASign', 'MAX_ADAPTER_NAME', 'ERROR_TOO_MANY_POSTS', 'CONTEXT_SEGMENTS', 'ERROR_CLIENT_SERVER_PARAMETERS_INVALID', 'SM_DIGITIZER', 'CERT_QUERY_CONTENT_PKCS7_UNSIGNED', 'IMAGE_FILE_MACHINE_AMD64', 'ERROR_NET_OPEN_FAILED', 'CRYPT_CREATE_SALT', 'szOID_ANSI_X942', 'SM_CXFOCUSBORDER', 'SECURITY_MANDATORY_UNTRUSTED_RID', 'CERT_SHA1_HASH_PROP_ID', 'CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT', 'ERROR_EVENT_PENDING', 'EXCEPTION_INT_DIVIDE_BY_ZERO', 'IMAGE_FILE_SYSTEM', 'ERROR_NO_MORE_MATCHES', 'CERT_QUERY_CONTENT_SERIALIZED_STORE', 'CERT_FIND_KEY_IDENTIFIER', 'SM_CYSMICON', 'ERROR_THREAD_NOT_IN_PROCESS', 'PKCS12_ALWAYS_CNG_KSP', 'CERT_SYSTEM_STORE_USERS', 'OBJ_FORCE_ACCESS_CHECK', 'ERROR_EXE_CANNOT_MODIFY_STRONG_SIGNED_BINARY', 'CERT_COMPARE_SIGNATURE_HASH', 'szOID_INFOSEC_sdnsConfidentiality', 'ERROR_BAD_FILE_TYPE', 'ERROR_PNP_RESTART_ENUMERATION', 'ERROR_HANDLE_EOF', 'ERROR_RXACT_STATE_CREATED', 'RSA_CSP_PUBLICKEYBLOB', 'AF_INET', 'KEY_WOW64_RES', 'ERROR_TOO_MANY_MUXWAITERS', 'CONTEXT_EXTENDED_REGISTERS', 'ERROR_NO_VOLUME_LABEL', 'ALPC_PORFLG_WAITABLE_PORT', 'ERROR_PNP_REBOOT_REQUIRED', 'X509_NDR_ENCODING', 'THREAD_SET_THREAD_TOKEN', 'ERROR_DRIVE_LOCKED', 'ERROR_OBJECT_NAME_EXISTS', 'ERROR_ACCESS_AUDIT_BY_POLICY', 'AF_NETDES', 'ERROR_BAD_COMMAND', 'AF_SNA', 'CERT_QUERY_CONTENT_FLAG_PFX_AND_LOAD', 'szOID_RSA_SSA_PSS', 'PROV_RSA_FULL', 'SM_RESERVED4', 'SM_RESERVED1', 'SM_RESERVED3', 'SM_RESERVED2', 'ALPC_MSGFLG_WAIT_USER_MODE', 'RPC_C_QOS_CAPABILITIES_MAKE_FULLSIC', 'szOID_RSA_MD5RSA', 'MS_ENHANCED_PROV_A', 'ERROR_DIR_NOT_ROOT', 'szOID_INFOSEC_mosaicUpdatedInteg', 'CERT_TRUST_INVALID_EXTENSION', 'CERT_STORE_NO_CRYPT_RELEASE_FLAG', 'ERROR_DISK_FULL', 'ERROR_INTERRUPT_STILL_CONNECTED', 'ERROR_LONGJUMP', 'CERT_SYSTEM_STORE_CURRENT_USER_GROUP_POLICY', 'CERT_SYSTEM_STORE_LOCAL_MACHINE_GROUP_POLICY', 'szOID_OIWSEC_dsaCommSHA', 'MAILSLOT_NO_MESSAGE', 'szOID_RSA_data', 'ERROR_ALREADY_ASSIGNED', 'ERROR_WAKE_SYSTEM_DEBUGGER', 'CERT_E_UNTRUSTEDROOT', 'CERT_E_UNTRUSTEDCA', 'FILE_ATTRIBUTE_DEVICE', 'CERT_ARCHIVED_KEY_HASH_PROP_ID', 'ERROR_APP_INIT_FAILURE', 'szOID_OIWSEC_md5RSA', 'REG_LINK', 'FILE_ATTRIBUTE_ENCRYPTED', 'CERT_FRIENDLY_NAME_PROP_ID', 'CMSG_HASH_ALGORITHM_PARAM', 'STARTF_USESIZE', 'SERVICE_ACTIVE', 'ERROR_IO_INCOMPLETE', 'CERT_E_CN_NO_MATCH', 'SERVICE_WIN32_OWN_PROCESS', 'ERROR_UNWIND_CONSOLIDATE', 'RPC_C_AUTHN_LEVEL_PKT_INTEGRITY', 'ERROR_ILLEGAL_FLOAT_CONTEXT', 'SERVICE_ERROR_IGNORE', 'ERROR_CRC', 'SM_MOUSEPRESENT', 'ACCESS_ALLOWED_OBJECT_ACE_TYPE', 'CERT_STORE_PROV_REG', 'ERROR_SERVER_SID_MISMATCH', 'ERROR_DIRECTORY', 'EXCEPTION_SINGLE_STEP', 'CERT_AUTO_ENROLL_PROP_ID', 'ERROR_ABANDONED_WAIT_63', 'ERROR_VOLSNAP_PREPARE_HIBERNATE', 'SERVICE_CONTROL_STOP', 'DELETE', 'MS_STRONG_PROV_A', 'ERROR_FILE_TOO_LARGE', 'IMAGE_FILE_32BIT_MACHINE', 'MS_STRONG_PROV_W', 'SM_CXVSCROLL', 'ERROR_NOT_OWNER', 'PROFILE_KERNEL', 'IMAGE_FILE_UP_SYSTEM_ONLY', 'SM_SLOWMACHINE', 'ERROR_DRIVERS_LEAKING_LOCKED_PAGES', 'FILE_VOLUME_IS_COMPRESSED', 'SECTION_MAP_WRITE', 'CERT_EXTENDED_ERROR_INFO_PROP_ID', 'PKCS12_EXPORT_RESERVED_MASK', 'ERROR_OPLOCK_HANDLE_CLOSED', 'ERROR_INVALID_ACE_CONDITION', 'ERROR_PWD_TOO_RECENT', 'ERROR_PORT_MESSAGE_TOO_LONG', 'ERROR_UNWIND', 'ERROR_EXCL_SEM_ALREADY_OWNED', 'CERT_E_WRONG_USAGE', 'DUPLICATE_SAME_ACCESS', 'CERT_FIND_ANY', 'szOID_RSA', 'CERT_TRUST_CTL_IS_NOT_SIGNATURE_VALID', 'CERT_QUERY_CONTENT_FLAG_PKCS7_UNSIGNED', 'ERROR_INVALID_UNWIND_TARGET', 'ERROR_JOIN_TO_SUBST', 'PKCS_7_ASN_ENCODING', 'PROV_RSA_SIG', 'IMAGE_SCN_TYPE_OVER', 'ERROR_VERSION_PARSE_ERROR', 'ERROR_DEBUG_ATTACH_FAILED', 'IMAGE_SCN_MEM_16BIT', 'ERROR_BIOS_FAILED_TO_CONNECT_INTERRUPT', 'ERROR_FT_WRITE_RECOVERY', 'CERT_FIND_ISSUER_ATTR', 'AF_UNIX', 'ERROR_DEVICE_ENUMERATION_ERROR', 'CERT_INFO_SIGNATURE_ALGORITHM_FLAG', 'SERVICE_FILE_SYSTEM_DRIVER', 'TOKEN_DUPLICATE', 'CERT_COMPARE_CTL_USAGE', 'CRYPT_ACQUIRE_USE_PROV_INFO_FLAG', 'ERROR_INVALID_MINALLOCSIZE', 'CERT_INFO_SUBJECT_UNIQUE_ID_FLAG', 'STANDARD_RIGHTS_EXECUTE', 'MEM_ROTATE', 'ERROR_FILE_CHECKED_OUT', 'SM_CYSIZEFRAME', 'ERROR_SIGNAL_REFUSED', 'ERROR_REPLY_MESSAGE_MISMATCH', 'ERROR_PNP_IRQ_TRANSLATION_FAILED', 'ERROR_ALREADY_WIN32', 'ERROR_NO_MORE_SEARCH_HANDLES', 'ALPC_MESSAGE_HANDLE_ATTRIBUTE', 'VER_NT_WORKSTATION', 'ERROR_SYSTEM_IMAGE_BAD_SIGNATURE', 'szOID_ECDSA_SPECIFIED', 'PKCS12_ALLOW_OVERWRITE_KEY', 'PROCESS_MODE_BACKGROUND_END', 'AF_BAN', 'szOID_RSA_signedData', 'KEY_NOTIFY', 'ERROR_HIBERNATION_FAILURE', 'CMSG_SIGNER_CERT_INFO_PARAM', 'ERROR_PROCESS_MODE_ALREADY_BACKGROUND', 'ALPC_MSGFLG_WOW64_CALL', 'ERROR_DBG_RIPEXCEPTION', 'SC_MANAGER_MODIFY_BOOT_CONFIG', 'ERROR_RECEIVE_PARTIAL', 'CERT_QUERY_CONTENT_FLAG_SERIALIZED_CRL', 'SM_REMOTECONTROL', 'ERROR_AUDIT_FAILED', 'CERT_QUERY_OBJECT_FILE', 'CREATE_ALWAYS', 'ERROR_SCOPE_NOT_FOUND', 'PROCESS_SET_QUOTA', 'ERROR_MOUNT_POINT_NOT_RESOLVED', 'PROCESS_MODE_BACKGROUND_BEGIN', 'READ_CONTROL', 'EXCEPTION_FLT_OVERFLOW', 'ERROR_INVALID_SEGMENT_NUMBER', 'TRUST_E_ACTION_UNKNOWN', 'CERT_TRUST_HAS_NOT_DEFINED_NAME_CONSTRAINT', 'CERT_TRUST_HAS_CRL_VALIDITY_EXTENDED', 'ERROR_INVALID_STACKSEG', 'SM_CXSIZE', 'CERT_QUERY_FORMAT_BINARY', 'ERROR_BAD_CURRENT_DIRECTORY', 'SW_NORMAL', 'CERT_STORE_ADD_REPLACE_EXISTING_INHERIT_PROPERTIES', 'SERVICE_ERROR_CRITICAL', 'ERROR_VERIFIER_STOP', 'ERROR_UNHANDLED_EXCEPTION', 'CERT_NAME_ATTR_TYPE', 'ERROR_INVALID_PLUGPLAY_DEVICE_PATH', 'DIGSIG_E_ENCODE', 'MEM_RESERVE', 'ERROR_LOGON_SERVER_CONFLICT', 'CERT_TRUST_INVALID_BASIC_CONSTRAINTS', 'SERVICE_CONTINUE_PENDING', 'IMAGE_FILE_MACHINE_CEE', 'IMAGE_FILE_MACHINE_CEF', 'ERROR_INVALID_LDT_SIZE', 'ERROR_NOT_SUPPORTED', 'PROCESS_SET_SESSIONID', 'ERROR_TOO_MANY_SEM_REQUESTS', 'ERROR_NO_EVENT_PAIR', 'ERROR_INVALID_SIGNAL_NUMBER', 'CMSG_CRL_PARAM', 'CMSG_SIGNER_HASH_ALGORITHM_PARAM', 'STANDARD_RIGHTS_ALL', 'CERT_STORE_ADD_ALWAYS', 'ERROR_SERVICE_NOTIFICATION', 'REG_DWORD_LITTLE_ENDIAN', 'TRUST_E_NOSIGNATURE', 'OPEN_ALWAYS', 'CERT_QUERY_CONTENT_PFX_AND_LOAD', 'ERROR_ERRORS_ENCOUNTERED', 'AF_CLUSTER', 'SERVICE_USER_DEFINED_CONTROL', 'FILE_FLAG_OVERLAPPED', 'CRYPT_E_NOT_FOUND', 'PKCS12_NO_PERSIST_KEY', 'CERT_NAME_SIMPLE_DISPLAY_TYPE', 'ERROR_CANNOT_BREAK_OPLOCK', 'CERT_STORE_PROV_SYSTEM_A', 'SM_MIDEASTENABLED', 'ALPC_MSGFLG_LPC_MODE', 'FILE_SHARE_WRITE', 'ERROR_TOO_MANY_TCBS', 'ERROR_IOPL_NOT_ENABLED', 'CMSG_SIGNER_AUTH_ATTR_PARAM', 'ERROR_IMAGE_MACHINE_TYPE_MISMATCH', 'E_FAIL', 'EXCEPTION_NONCONTINUABLE', 'ERROR_ACCESS_DISABLED_NO_SAFER_UI_BY_POLICY', 'CERT_FIND_SIGNATURE_HASH', 'ERROR_TOO_MANY_MODULES', 'IMAGE_FILE_MACHINE_AM33', 'MAXLEN_PHYSADDR', 'WRITE_DAC', 'szOID_PKCS', 'ERROR_PROCESS_IN_JOB', 'IMAGE_SCN_MEM_EXECUTE', 'PROV_EC_ECNRA_FULL', 'szOID_INFOSEC_SuiteAIntegrity', 'FILE_ATTRIBUTE_COMPRESSED', 'CERT_COMPARE_PUBLIC_KEY', 'AF_NETBIOS', 'FILE_SUPERSEDE', 'IMAGE_NUMBEROF_DIRECTORY_ENTRIES', 'szOID_RSA_messageDigest', 'szOID_RSA_RSA', 'SERVICE_ADAPTER', 'ERROR_DISCARDED', 'ERROR_OUTOFMEMORY', 'szOID_RSA_MD2RSA', 'szOID_RSA_encryptedData', 'ERROR_SYSTEM_PROCESS_TERMINATED', 'WRITE_OWNER', 'FILE_MAXIMUM_DISPOSITION', 'ERROR_INFLOOP_IN_RELOC_CHAIN', 'SW_MAX', 'X509_UNICODE_NAME_VALUE', 'ERROR_BAD_PATHNAME', 'SM_CYDRAG', 'ERROR_INVALID_IMAGE_HASH', 'ERROR_IO_PRIVILEGE_FAILED', 'FILE_CREATE', 'ALPC_MESSAGE_VIEW_ATTRIBUTE', 'CERT_E_REVOCATION_FAILURE', 'ERROR_EXE_MARKED_INVALID', 'FILE_SUPPORTS_HARD_LINKS', 'ERROR_PAGEFILE_QUOTA_EXCEEDED', 'ERROR_MCA_OCCURED', 'WTD_CHOICE_CERT', 'IMAGE_FILE_MACHINE_R10000', 'SERVICE_CHANGE_CONFIG', 'ERROR_NOT_SAFE_MODE_DRIVER', 'CRYPT_ACQUIRE_ALLOW_NCRYPT_KEY_FLAG', 'REG_QWORD_LITTLE_ENDIAN', 'SERVICE_DRIVER', 'IMAGE_SCN_ALIGN_8BYTES', 'RRF_ZEROONFAILURE', 'ERROR_INVALID_QUOTA_LOWER', 'USAGE_MATCH_TYPE_OR', 'ERROR_SEM_NOT_FOUND', 'THREAD_ALL_ACCESS', 'szOID_OIWDIR_CRPT', 'ERROR_RXACT_COMMIT_NECESSARY', 'E_NOINTERFACE', 'TH32CS_SNAPTHREAD', 'CERT_STORE_SET_LOCALIZED_NAME_FLAG', 'SM_TABLETPC', 'PROV_INTEL_SEC', 'PROCESS_SET_INFORMATION', 'IMAGE_FILE_MACHINE_EBC', 'ERROR_INVALID_PASSWORD', 'szOID_OIWSEC_shaRSA', 'SM_CXICON', 'SM_CMONITORS', 'LPC_REQUEST', 'CERT_XML_NAME_STR', 'IMAGE_SCN_ALIGN_8192BYTES', 'PROCESS_ALL_ACCESS', 'DETACHED_PROCESS', 'SM_CYMIN', 'ERROR_TOO_MANY_SEMAPHORES', 'SW_MINIMIZE', 'CRYPT_E_FILE_ERROR', 'CERT_BACKED_UP_PROP_ID', 'CERT_TRUST_HAS_NAME_MATCH_ISSUER', 'CERT_SIMPLE_NAME_STR', 'CMSG_CERT_COUNT_PARAM', 'CERT_INFO_SUBJECT_PUBLIC_KEY_INFO_FLAG', 'szOID_NIST_AES256_CBC', 'CRYPT_SF', 'OWNER_SECURITY_INFORMATION', 'ERROR_IMAGE_SUBSYSTEM_NOT_PRESENT', 'SE_PRIVILEGE_ENABLED_BY_DEFAULT', 'ERROR_BAD_COMPRESSION_BUFFER', 'REG_RESOURCE_LIST', 'ERROR_INVALID_LIST_FORMAT', 'ERROR_PAGE_FAULT_PAGING_FILE', 'IMAGE_SCN_TYPE_REG', 'CERT_EFS_PROP_ID', 'CERT_E_UNTRUSTEDTESTROOT', 'SEC_FILE', 'IMAGE_FILE_MACHINE_SH3DSP', 'AF_APPLETALK', 'MAXLEN_IFDESCR', 'RRF_RT_QWORD', 'IMAGE_SCN_ALIGN_256BYTES', 'SEC_LARGE_PAGES', 'EXCEPTION_FLT_DIVIDE_BY_ZERO', 'FILE_SEQUENTIAL_WRITE_ONCE', 'EXCEPTION_INT_OVERFLOW', 'szOID_ECDSA_SHA512', 'ERROR_JOIN_TO_JOIN', 'szOID_PKCS_10', 'PROV_SSL', 'CERT_QUERY_CONTENT_FLAG_ALL', 'WTD_CHOICE_SIGNER', 'IMAGE_FILE_LINE_NUMS_STRIPPED', 'ERROR_ROWSNOTRELEASED', 'ERROR_FILE_EXISTS', 'IMAGE_FILE_MACHINE_SH3E', 'ERROR_ADAP_HDW_ERR', 'CERT_QUERY_CONTENT_CRL', 'IMAGE_SCN_ALIGN_2BYTES', 'DRIVE_CDROM', 'DRIVE_UNKNOWN', 'FILE_PERSISTENT_ACLS', 'CERT_FIND_MD5_HASH', 'CMSG_SIGNER_CERT_ID_PARAM', 'CERT_TRUST_IS_NOT_SIGNATURE_VALID', 'CERT_QUERY_CONTENT_PKCS10', 'PAGE_GUARD', 'LPC_DATAGRAM', 'DEBUG_ONLY_THIS_PROCESS', 'AF_FIREFOX', 'ERROR_PLUGPLAY_QUERY_VETOED', 'ERROR_DATA_NOT_ACCEPTED', 'ERROR_INVALID_BLOCK', 'SM_SECURE', 'ERROR_CONTROL_C_EXIT', 'EXIT_PROCESS_DEBUG_EVENT', 'TRUST_E_PROVIDER_UNKNOWN', 'CREATE_PRESERVE_CODE_AUTHZ_LEVEL', 'ERROR_WAIT_FOR_OPLOCK', 'KEY_READ', 'CERT_FIND_ISSUER_OF', 'IMAGE_FILE_DLL', 'CERT_STORE_PROV_FILENAME_A', 'MS_DEF_PROV', 'CERT_E_ISSUERCHAINING', 'FILE_ATTRIBUTE_SPARSE_FILE', 'CERT_STORE_PROV_FILENAME_W', 'ERROR_SUBST_TO_SUBST', 'FILE_ATTRIBUTE_OFFLINE', 'CERT_CHAIN_REVOCATION_CHECK_CHAIN', 'ERROR_CHECKING_FILE_SYSTEM', 'ERROR_FLOAT_MULTIPLE_TRAPS', 'ERROR_PATH_NOT_FOUND', 'SE_PRIVILEGE_USED_FOR_ACCESS', 'STD_OUTPUT_HANDLE', 'AF_INET6', 'ERROR_RANGE_NOT_FOUND', 'FILE_SUPPORTS_USN_JOURNAL', 'CRYPT_NO_SALT', 'ERROR_NOT_LOCKED', 'LPC_EXCEPTION', 'PAGE_READONLY', 'AF_ATM', 'EXCEPTION_IN_PAGE_ERROR', 'STARTF_USEFILLATTRIBUTE', 'STARTF_USECOUNTCHARS', 'IMAGE_SCN_LNK_INFO', 'FILE_SUPPORTS_REMOTE_STORAGE', 'CERT_QUERY_CONTENT_FLAG_SERIALIZED_STORE', 'ERROR_CACHE_PAGE_LOCKED', 'CERT_COMPARE_KEY_IDENTIFIER', 'SERVICE_ERROR_NORMAL', 'SM_CYFULLSCREEN', 'HKEY_LOCAL_MACHINE', 'ERROR_NOT_REGISTRY_FILE', 'ERROR_ILLEGAL_DLL_RELOCATION', 'MEM_PHYSICAL', 'szOID_DS', 'ERROR_NOT_JOINED', 'SM_CYSIZE', 'WTD_CHOICE_BLOB', 'CRYPT_FORCE_KEY_PROTECTION_HIGH', 'CERT_COMPARE_MD5_HASH', 'SERVICE_CONTROL_PARAMCHANGE', 'szOID_ECC_CURVE_P256', 'CERT_COMPARE_EXISTING', 'RRF_RT_REG_BINARY', 'AF_DATAKIT', 'ERROR_DBG_COMMAND_EXCEPTION', 'ALPC_VIEWFLG_NOT_SECURE', 'KEY_WRITE', 'SERVICE_ACCEPT_TRIGGEREVENT', 'ERROR_MARSHALL_OVERFLOW', 'SERVICE_STOPPED', 'SERVICE_QUERY_STATUS', 'CERT_TRUST_IS_FROM_EXCLUSIVE_TRUST_STORE', 'ERROR_PROFILING_AT_LIMIT', 'OBJ_PERMANENT', 'CERT_INFO_SUBJECT_FLAG', 'ERROR_PROFILING_NOT_STARTED', 'HKEY_PERFORMANCE_TEXT', 'TRUST_E_SUBJECT_NOT_TRUSTED', 'SM_CXFRAME', 'WTD_UI_NOGOOD', 'ERROR_ALLOCATE_BUCKET', 'szOID_RSA_emailAddr', 'CERT_STORE_UNSAFE_PHYSICAL_FLAG', 'ERROR_SHARING_VIOLATION', 'CONTEXT_DEBUG_REGISTERS', 'SM_CMOUSEBUTTONS', 'ERROR_REQUEST_OUT_OF_SEQUENCE', 'ERROR_INVALID_PORT_ATTRIBUTES', 'CMSG_ATTR_CERT_COUNT_PARAM', 'RPC_C_IMP_LEVEL_IDENTIFY', 'ERROR_PRINTQ_FULL', 'CERT_STORE_BACKUP_RESTORE_FLAG', 'ERROR_PNP_INVALID_ID', 'ERROR_PROC_NOT_FOUND', 'ERROR_OUT_OF_PAPER', 'SM_CXVIRTUALSCREEN', 'ALPC_MSGFLG_REPLY_MESSAGE', 'ACCESS_DENIED_CALLBACK_ACE_TYPE', 'ERROR_INVALID_MESSAGE', 'SM_STARTER', 'ERROR_EXTRANEOUS_INFORMATION', 'ERROR_RING2SEG_MUST_BE_MOVABLE', 'CERT_STORE_SHARE_STORE_FLAG', 'RRF_RT_REG_EXPAND_SZ', 'ERROR_PIPE_NOT_CONNECTED', 'ERROR_DBG_REPLY_LATER', 'SM_CXHSCROLL', 'ACCESS_MIN_MS_OBJECT_ACE_TYPE', 'szOID_OIWDIR_md2RSA', 'ERROR_PNP_TRANSLATION_FAILED', 'FILE_FLAG_SEQUENTIAL_SCAN', 'WARMING_NOT_SAME_FLAG_FOR_WINXP', 'ERROR_PIPE_CONNECTED', 'szOID_INFOSEC_sdnsKMandSig', 'IMAGE_SCN_TYPE_NO_PAD', 'ERROR_NOT_ENOUGH_MEMORY', 'SYSTEM_ALARM_OBJECT_ACE_TYPE', 'IMAGE_SCN_MEM_LOCKED', 'CONTEXT_FLOATING_POINT', 'ERROR_KEY_HAS_CHILDREN', 'CERT_CTL_USAGE_PROP_ID', 'ERROR_INSUFFICIENT_BUFFER', 'ERROR_INVALID_TARGET_HANDLE', 'ERROR_REDIR_PAUSED', 'SM_CXMINIMIZED', 'FILE_FLAG_NO_BUFFERING', 'DEBUG_EVENT_EXCEPTION', 'ERROR_COMMITMENT_MINIMUM', 'ERROR_INVALID_STARTING_CODESEG', 'WAIT_IO_COMPLETION', 'ERROR_INSTRUCTION_MISALIGNMENT', 'ERROR_INVALID_MODULETYPE', 'CRYPT_UPDATE_KEY', 'IMAGE_SCN_LNK_OTHER', 'CERT_COMPARE_ANY', 'CRYPT_DATA_KEY', 'SERVICE_STOP', 'RPC_REQUEST_TYPE_CALL', 'PERSIST_E_SIZEINDEFINITE', 'ERROR_DLL_MIGHT_BE_INSECURE', 'szOID_OIWSEC_dsaSHA1', 'DEBUG_EVENT_UNLOAD_MODULE', 'SERVICE_CONTROL_TIMECHANGE', 'CERT_TRUST_CTL_IS_NOT_TIME_VALID', 'PERSIST_E_NOTSELFSIZING', 'CERT_QUERY_FORMAT_FLAG_ASN_ASCII_HEX_ENCODED', 'SERVICE_BOOT_START', 'ERROR_WX86_WARNING', 'WTD_STATEACTION_AUTO_CACHE', 'KEY_WOW64_64KEY', 'IMAGE_SCN_CNT_UNINITIALIZED_DATA', 'WTD_STATEACTION_VERIFY', 'ERROR_PARTIAL_COPY', 'ERROR_PIPE_BUSY', 'CRYPT_ACQUIRE_NCRYPT_KEY_FLAGS_MASK', 'ALPC_HANDLEFLG_DUPLICATE_SAME_ATTRIBUTES', 'CERT_FIND_SUBJECT_CERT', 'PAGE_NOACCESS', 'CERT_COMPARE_ENHKEY_USAGE', 'KEY_SET_VALUE', 'ERROR_BAD_PIPE', 'szOID_OIWDIR_SIGN', 'ERROR_PAGEFILE_CREATE_FAILED', 'PKCS_UTC_TIME', 'SC_MANAGER_ALL_ACCESS', 'IMAGE_FILE_NET_RUN_FROM_SWAP', 'CERT_SYSTEM_STORE_CURRENT_USER_GROUP_POLICY_ID', 'X509_CHOICE_OF_TIME', 'IMAGE_FILE_MACHINE_I386', 'SECURITY_MANDATORY_LOW_RID', 'ERROR_FATAL_APP_EXIT', 'CREATE_SUSPENDED', 'CERT_E_INVALID_NAME', 'MEM_LARGE_PAGES', 'ERROR_DEV_NOT_EXIST', 'MEM_WRITE_WATCH', 'szOID_RSA_DES_EDE3_CBC', 'LOAD_DLL_DEBUG_EVENT', 'PROFILE_SERVER', 'CMSG_CONTENT_PARAM', 'CERT_INFO_ISSUER_FLAG', 'ERROR_DRIVER_FAILED_SLEEP', 'DRIVE_REMOVABLE', 'CERT_SYSTEM_STORE_LOCATION_MASK', 'CERT_QUERY_CONTENT_PFX', 'ERROR_PAGE_FAULT_DEMAND_ZERO', 'CERT_TRUST_HAS_EXACT_MATCH_ISSUER', 'ERROR_SWAPERROR', 'EXCEPTION_MAXIMUM_PARAMETERS', 'WTD_REVOKE_WHOLECHAIN', 'INFINITE', 'CRYPT_INITIATOR', 'X509_ALTERNATE_NAME', 'MEM_FREE', 'ERROR_MOD_NOT_FOUND', 'REG_DWORD', 'IMAGE_FILE_RELOCS_STRIPPED', 'ERROR_OPLOCK_BREAK_IN_PROGRESS', 'SM_CYSMCAPTION', 'SM_SAMEDISPLAYFORMAT', 'ERROR_ITERATED_DATA_EXCEEDS_64k', 'CERT_STORE_PROV_SMART_CARD', 'CMSG_INNER_CONTENT_TYPE_PARAM', 'ERROR_SEEK', 'X509_ASN_ENCODING', 'IMAGE_FILE_EXECUTABLE_IMAGE', 'FILE_ATTRIBUTE_VIRTUAL', 'szOID_RSA_SMIMEalg', 'ERROR_ALREADY_EXISTS', 'szOID_INFOSEC_SuiteAKMandSig', 'CERT_FIND_CTL_USAGE', 'ERROR_IS_JOINED', 'CONTEXT_I386', 'SC_MANAGER_CONNECT', 'PROCESS_VM_WRITE', 'ERROR_INVALID_HANDLE', 'SM_CXMAXIMIZED', 'ERROR_INVALID_FUNCTION', 'CMSG_CMS_RECIPIENT_ENCRYPTED_KEY_INDEX_PARAM', 'CERT_STORE_ADD_NEWER_INHERIT_PROPERTIES', 'ERROR_LOG_HARD_ERROR', 'IMAGE_FILE_MACHINE_POWERPCFP', 'PROCESS_CREATE_THREAD', 'STARTF_USEPOSITION', 'CERT_TRUST_IS_REVOKED', 'ERROR_MCA_EXCEPTION', 'REG_NONE', 'SM_CARETBLINKINGENABLED', 'SECTION_MAP_EXECUTE_EXPLICIT', 'SM_CYCURSOR', 'SERVICE_ACCEPT_SHUTDOWN', 'SYSTEM_ALARM_ACE_TYPE', 'CERT_DESCRIPTION_PROP_ID', 'ERROR_BAD_REM_ADAP', 'szOID_INFOSEC_SuiteATokenProtection', 'FILE_FLAG_RANDOM_ACCESS', 'SM_CXFIXEDFRAME', 'ERROR_SECURITY_STREAM_IS_INCONSISTENT', 'CRYPT_VOLATILE', 'CERT_HASH_PROP_ID', 'ERROR_UNEXP_NET_ERR', 'CERT_STORE_ADD_USE_EXISTING', 'RPC_C_QOS_CAPABILITIES_MUTUAL_AUTH', 'CRYPT_DELETEKEYSET', 'IMAGE_FILE_LARGE_ADDRESS_AWARE', 'SERVICE_ACCEPT_NETBINDCHANGE', 'OBJ_INHERIT', 'IMAGE_FILE_MACHINE_UNKNOWN', 'PKCS_CONTENT_INFO_SEQUENCE_OF_ANY', 'RPC_C_QOS_CAPABILITIES_ANY_AUTHORITY', 'CRYPT_SGCKEY', 'RRF_RT_REG_NONE', 'CERT_QUERY_FORMAT_FLAG_ALL', 'CERT_SYSTEM_STORE_LOCAL_MACHINE', 'CERT_QUERY_CONTENT_CTL', 'X509_ENUMERATED', 'PROCESS_VM_OPERATION', 'SM_CYFOCUSBORDER', 'ERROR_AUTODATASEG_EXCEEDS_64k', 'ERROR_STACK_OVERFLOW_READ', 'CRYPT_RECIPIENT', 'SERVICE_ALL_ACCESS', 'szOID_NIST_AES128_CBC', 'MAILSLOT_WAIT_FOREVER', 'WTD_STATEACTION_CLOSE', 'CERT_SYSTEM_STORE_CURRENT_USER', 'ACCESS_MAX_MS_OBJECT_ACE_TYPE', 'szOID_OIWDIR_md2', 'RPC_C_AUTHN_LEVEL_CONNECT', 'SM_CYBORDER', 'ERROR_REGISTRY_IO_FAILED', 'CERT_SYSTEM_STORE_LOCAL_MACHINE_ENTERPRISE', 'PROFILE_USER', 'AF_LAT', 'ERROR_INVALID_DATA', 'AT_SIGNATURE', 'PAGE_WRITECOMBINE', 'CERT_AUTHORITY_INFO_ACCESS_PROP_ID', 'RPC_C_IMP_LEVEL_DEFAULT', 'ERROR_IS_SUBSTED', 'SYSTEM_AUDIT_OBJECT_ACE_TYPE', 'CERT_E_CHAINING', 'CMSG_ATTR_CERT_PARAM', 'CONTEXT_INTEGER', 'REG_DWORD_BIG_ENDIAN', 'ERROR_CANT_WAIT', 'SERVICE_ACCEPT_POWEREVENT', 'SW_SHOW', 'ERROR_NOT_READY', 'SECURITY_MANDATORY_MEDIUM_PLUS_RID', 'ERROR_DBG_TERMINATE_PROCESS', 'SM_CYFIXEDFRAME', 'CERT_COMPARE_KEY_SPEC', 'SM_NETWORK', 'EXCEPTION_CONTINUE_EXECUTION', 'ERROR_FLOAT_MULTIPLE_FAULTS', 'ERROR_PWD_TOO_SHORT', 'TOKEN_ALL_ACCESS_P', 'STARTF_FORCEONFEEDBACK', 'ERROR_LOCK_FAILED', 'HKEY_PERFORMANCE_NLSTEXT', 'IMAGE_SCN_MEM_PURGEABLE', 'CERT_STORE_ADD_NEWER', 'ERROR_BADKEY', 'ALPC_CANCELFLG_TRY_CANCEL', 'CRYPT_EXPORTABLE', 'RIP_EVENT', 'ERROR_CHECKOUT_REQUIRED', 'AF_IMPLINK', 'ERROR_NO_DATA', 'ERROR_NO_GUID_TRANSLATION', 'ERROR_DYNLINK_FROM_INVALID_RING', 'PROV_RNG', 'CREATE_NO_WINDOW', 'szOID_DSALG_RSA', 'ERROR_ABANDON_HIBERFILE', 'CERT_TRUST_IS_NOT_VALID_FOR_USAGE', 'AF_CCITT', 'SERVICE_CONTROL_HARDWAREPROFILECHANGE', 'TOKEN_QUERY_SOURCE', 'FILE_MAP_WRITE', 'X509_CERT_POLICIES', 'SM_SHUTTINGDOWN', 'szOID_OIWSEC_sha', 'CERT_SYSTEM_STORE_UNPROTECTED_FLAG', 'OUTPUT_DEBUG_STRING_EVENT', 'CERT_NAME_DNS_TYPE', 'ERROR_MORE_DATA', 'PKCS_TIME_REQUEST', 'ERROR_ABANDONED_WAIT_0', 'ERROR_WAS_UNLOCKED', 'ERROR_INTERRUPT_VECTOR_ALREADY_CONNECTED', 'AF_ISO', 'FILE_OPEN', 'STANDARD_RIGHTS_READ', 'CERT_SIGNATURE_HASH_PROP_ID', 'CONTEXT_XSTATE', 'SECTION_ALL_ACCESS', 'ERROR_INVALID_EA_NAME', 'CERT_PUBKEY_HASH_RESERVED_PROP_ID', 'SERVICE_CONTROL_POWEREVENT', 'REG_BINARY', 'SEC_RESERVE', 'CERT_STORE_PROV_FILENAME', 'MEM_DECOMMIT', 'DEBUG_EVENT_BREAKPOINT', 'IMAGE_SCN_MEM_NOT_CACHED', 'ERROR_TIMER_RESOLUTION_NOT_SET', 'szOID_INFOSEC_mosaicTokenProtection', 'SM_SWAPBUTTON', 'SM_DEBUG', 'CERT_TRUST_IS_CYCLIC', 'CERT_KEY_IDENTIFIER_PROP_ID', 'OBJ_VALID_ATTRIBUTES', 'ERROR_DS_VERSION_CHECK_FAILURE', 'SM_CYICONSPACING', 'ERROR_INVALID_DEVICE_OBJECT_PARAMETER', 'CERT_FIND_CERT_ID', 'PAGE_EXECUTE', 'SM_CYICON', 'TOKEN_IMPERSONATE', 'TOKEN_ASSIGN_PRIMARY', 'FILE_UNICODE_ON_DISK', 'CERT_STORE_READONLY_FLAG', 'RPC_C_AUTHN_LEVEL_PKT_PRIVACY', 'CERT_QUERY_CONTENT_FLAG_PKCS7_SIGNED_EMBED', 'szOID_OIWSEC_dsaComm', 'REALTIME_PRIORITY_CLASS', 'ACCESS_MAX_MS_ACE_TYPE', 'SM_CXSIZEFRAME', 'ERROR_MUTANT_LIMIT_EXCEEDED', 'DEBUG_EVENT_CREATE_THREAD', 'ERROR_BAD_NET_RESP', 'CERT_PVK_FILE_PROP_ID', 'ERROR_EXE_CANNOT_MODIFY_SIGNED_BINARY', 'ERROR_RXACT_COMMITTED', 'ERROR_ARBITRATION_UNHANDLED', 'SM_CXMINSPACING', 'ERROR_SHORT_NAMES_NOT_ENABLED_ON_VOLUME', 'CERT_QUERY_CONTENT_FLAG_CERT', 'TRUNCATE_EXISTING', 'SM_CXHTHUMB', 'CERT_KEY_PROV_INFO_PROP_ID', 'BIND_IF_SYNTAX_UNKNOWN', 'AF_ECMA', 'ERROR_SYSTEM_TRACE', 'DIRECTORY_CREATE_OBJECT', 'CERT_STORE_CREATE_NEW_FLAG', 'IMAGE_FILE_MACHINE_IA64', 'SW_FORCEMINIMIZE', 'ERROR_VDM_HARD_ERROR', 'ERROR_PRIMARY_TRANSPORT_CONNECT_FAILED', 'CRYPT_ACQUIRE_PREFER_NCRYPT_KEY_FLAG', 'ERROR_NOTHING_TO_TERMINATE', 'SYSTEM_AUDIT_ACE_TYPE', 'INVALID_HANDLE_VALUE', 'CERT_FIND_SHA1_HASH', 'IDLE_PRIORITY_CLASS', 'IMAGE_SCN_ALIGN_4BYTES', 'szOID_OIWSEC_desOFB', 'CERT_NEXT_UPDATE_LOCATION_PROP_ID', 'X509_BITS', 'CERT_STORE_PROV_SERIALIZED', 'ERROR_IS_SUBST_TARGET', 'szOID_X957_DSA', 'NULL', 'ERROR_INVALID_LDT_OFFSET', 'FILE_ATTRIBUTE_TEMPORARY', 'ERROR_MP_PROCESSOR_MISMATCH', 'ERROR_BAD_DEV_TYPE', 'CERT_STORE_PROV_LDAP_W', 'EXCEPTION_EXECUTE_HANDLER', 'CMSG_ENCODED_SIGNER', 'FILE_NOTIFY_CHANGE_ATTRIBUTES', 'ERROR_EA_FILE_CORRUPT', 'HKEY_CURRENT_USER', 'CERT_FIND_SUBJECT_STR_W', 'THREAD_SET_CONTEXT', 'ERROR_UNEXPECTED_MM_CREATE_ERR', 'ERROR_BUSY_DRIVE', 'SERVICE_QUERY_CONFIG', 'CERT_FIND_SUBJECT_STR_A', 'ERROR_REPARSE_OBJECT', 'OBJ_EXCLUSIVE', 'ERROR_DISK_TOO_FRAGMENTED', 'WOW64_MAXIMUM_SUPPORTED_EXTENSION', 'SERVICE_ACCEPT_PRESHUTDOWN', 'FILE_ATTRIBUTE_NORMAL', 'TH32CS_SNAPMODULE', 'IMAGE_FILE_MACHINE_AXP64', 'SM_CYHSCROLL', 'SYNCHRONIZE', 'CERT_COMPARE_PROPERTY', 'TOKEN_ADJUST_DEFAULT', 'SC_MANAGER_LOCK', 'SM_CYMENUCHECK', 'ERROR_CANTSCROLLBACKWARDS', 'WRITE_WATCH_FLAG_RESET', 'DEBUG_EVENT_LOAD_MODULE', 'SERVICE_CONTROL_INTERROGATE', 'ERROR_NO_LOG_SPACE', 'ALPC_MSGFLG_WAIT_ALERTABLE', 'ERROR_PAGE_FAULT_GUARD_PAGE', 'ALPC_CANCELFLG_NO_CONTEXT_CHECK', 'SERVICE_INACTIVE', 'ERROR_CANNOT_COPY', 'SERVICE_WIN32_SHARE_PROCESS', 'SYSTEM_AUDIT_CALLBACK_ACE_TYPE', 'SM_SHOWSOUNDS', 'szOID_RSA_PSPECIFIED', 'ERROR_IMAGE_MACHINE_TYPE_MISMATCH_EXE', 'ERROR_MR_MID_NOT_FOUND', 'ERROR_SUCCESS', 'ERROR_CANNOT_GRANT_REQUESTED_OPLOCK', 'SM_CYMENU', 'FILE_CASE_PRESERVED_NAMES', 'CERT_OCSP_RESPONSE_PROP_ID', 'ERROR_ALERTED', 'ERROR_INVALID_NAME', 'szOID_INFOSEC_sdnsKeyManagement', 'RPC_C_IMP_LEVEL_DELEGATE', 'CRYPT_ARCHIVABLE', 'X509_UNICODE_NAME', 'ERROR_WRONG_DISK', 'SM_MEDIACENTER', 'CERT_ACCESS_STATE_PROP_ID', 'ERROR_WAIT_NO_CHILDREN', 'CERT_NAME_ISSUER_FLAG', 'PROCESS_QUERY_INFORMATION', 'szOID_DH_SINGLE_PASS_STDDH_SHA1_KDF', 'IMAGE_FILE_MACHINE_THUMB', 'ERROR_COULD_NOT_INTERPRET', 'ERROR_ARITHMETIC_OVERFLOW', 'X509_KEY_ATTRIBUTES', 'EXCEPTION_ILLEGAL_INSTRUCTION', 'ERROR_UNDEFINED_CHARACTER', 'CERT_FIND_ENHKEY_USAGE', 'ERROR_SEM_OWNER_DIED', 'szOID_DH_SINGLE_PASS_STDDH_SHA384_KDF', 'CERT_QUERY_CONTENT_SERIALIZED_CERT', 'szOID_RSA_SETOAEP_RSA', 'ERROR_NOT_DOS_DISK', 'szOID_NIST_AES128_WRAP', 'CERT_STORE_PROV_SYSTEM_REGISTRY_W', 'ERROR_NEGATIVE_SEEK', 'CRYPT_MACHINE_KEYSET', 'CERT_FIND_SUBJECT_STR', 'WOW64_SIZE_OF_80387_REGISTERS', 'RRF_RT_REG_MULTI_SZ', 'CERT_STORE_PROV_SMART_CARD_W', 'HKEY_PERFORMANCE_DATA', 'IMAGE_FILE_MACHINE_POWERPC', 'DRIVE_REMOTE', 'ERROR_NOTIFICATION_GUID_ALREADY_DEFINED', 'ERROR_STOPPED_ON_SYMLINK', 'SERVICE_CONTROL_NETBINDDISABLE', 'THREAD_SET_INFORMATION', 'CERT_CROSS_CERT_DIST_POINTS_PROP_ID', 'PROV_EC_ECDSA_SIG', 'CERT_SYSTEM_STORE_SERVICES_ID', 'ERROR_DISK_REPAIR_DISABLED', 'CERT_STORE_MANIFOLD_FLAG', 'CERT_STORE_ADD_NEW', 'CERT_QUERY_CONTENT_FLAG_CTL', 'STD_ERROR_HANDLE', 'PROV_EC_ECNRA_SIG', 'PROCESS_SUSPEND_RESUME', 'szOID_RSA_SMIMEalgESDH', 'IMAGE_FILE_MACHINE_ALPHA', 'CERT_QUERY_CONTENT_CERT', 'ERROR_CANNOT_LOAD_REGISTRY_FILE', 'ERROR_LOCKED', 'ERROR_KERNEL_APC', 'SERVICE_SYSTEM_START', 'ERROR_VIRUS_INFECTED', 'FILE_NOTIFY_CHANGE_SIZE', 'CERT_FIND_KEY_SPEC', 'IMAGE_SCN_ALIGN_2048BYTES', 'ERROR_IS_JOIN_PATH', 'ERROR_DLL_MIGHT_BE_INCOMPATIBLE', 'ERROR_SEEK_ON_DEVICE', 'CERT_STORE_DEFER_CLOSE_UNTIL_LAST_FREE_FLAG', 'RRF_NOEXPAND', 'ERROR_BAD_DLL_ENTRYPOINT', 'IMAGE_FILE_MACHINE_SH4', 'IMAGE_FILE_MACHINE_SH5', 'IMAGE_FILE_MACHINE_SH3', 'ERROR_PROCESS_MODE_NOT_BACKGROUND', 'ERROR_CANTWRITE', 'SECURITY_MANDATORY_MEDIUM_RID', 'CRYPT_ACQUIRE_CACHE_FLAG', 'CRYPT_PREGEN', 'szOID_OIWSEC', 'ERROR_RECEIVE_PARTIAL_EXPEDITED', 'SW_SHOWMINNOACTIVE', 'TH32CS_SNAPMODULE32', 'RPC_S_PROCNUM_OUT_OF_RANGE', 'CREATE_PROTECTED_PROCESS', 'ERROR_NO_MORE_ITEMS', 'ERROR_FOUND_OUT_OF_SCOPE']) interfaces = set(['IUnknown', 'INetFwPolicy2', 'IBackgroundCopyJob', 'INetFwRules', 'IBackgroundCopyCallback', 'IWbemContext', 'INetFwServiceRestriction', 'IEnumVARIANT', 'IWbemObjectSink', 'IBackgroundCopyManager', 'IDispatch', 'IWbemQualifierSet', 'IWbemLocator', 'INetFwRule', 'IBackgroundCopyFile', 'IEnumWbemClassObject', 'IWbemServices', 'IEnumBackgroundCopyFiles', 'IEnumBackgroundCopyJobs', 'IBackgroundCopyError', 'COMInterface', 'IWbemClassObject', 'COMImplementation', 'IWbemCallResult']) diff --git a/windows/generated_def/winfuncs.py b/windows/generated_def/winfuncs.py index d69be4b..02ebc3e 100644 --- a/windows/generated_def/winfuncs.py +++ b/windows/generated_def/winfuncs.py @@ -6,7 +6,7 @@ from ctypes.wintypes import * from winstructs import * -functions = ['ExitProcess', 'TerminateProcess', 'GetLastError', 'GetCurrentProcess', 'CreateFileA', 'CreateFileW', 'NtCreateFile', 'LdrLoadDll', 'NtQuerySystemInformation', 'NtQueryInformationProcess', 'NtQueryVirtualMemory', 'NtCreateThreadEx', 'NtQueryInformationThread', 'GetExitCodeThread', 'GetExitCodeProcess', 'SetPriorityClass', 'GetPriorityClass', 'VirtualAlloc', 'VirtualAllocEx', 'NtProtectVirtualMemory', 'VirtualFree', 'VirtualFreeEx', 'VirtualProtect', 'VirtualProtectEx', 'VirtualQuery', 'VirtualQueryEx', 'QueryWorkingSet', 'QueryWorkingSetEx', 'GetModuleFileNameA', 'GetModuleFileNameW', 'CreateThread', 'CreateRemoteThread', 'VirtualProtect', 'CreateProcessA', 'CreateProcessW', 'CreateProcessAsUserA', 'CreateProcessAsUserW', 'GetThreadContext', 'NtGetContextThread', 'SetThreadContext', 'NtSetContextThread', 'OpenThread', 'OpenProcess', 'CloseHandle', 'ReadProcessMemory', 'NtWow64ReadVirtualMemory64', 'NtReadVirtualMemory', 'WriteProcessMemory', 'NtWow64WriteVirtualMemory64', 'CreateToolhelp32Snapshot', 'Thread32First', 'Thread32Next', 'Process32First', 'Process32Next', 'Process32FirstW', 'Process32NextW', 'GetProcAddress', 'LoadLibraryA', 'LoadLibraryW', 'OpenProcessToken', 'OpenThreadToken', 'LookupPrivilegeValueA', 'LookupPrivilegeValueW', 'LookupPrivilegeNameA', 'LookupPrivilegeNameW', 'AdjustTokenPrivileges', 'FindResourceA', 'FindResourceW', 'SizeofResource', 'LoadResource', 'LockResource', 'GetVersionExA', 'GetVersionExW', 'GetVersion', 'GetCurrentThread', 'GetCurrentThreadId', 'GetCurrentProcessorNumber', 'AllocConsole', 'FreeConsole', 'GetStdHandle', 'SetStdHandle', 'SetThreadAffinityMask', 'ReadFile', 'WriteFile', 'GetExtendedTcpTable', 'GetExtendedUdpTable', 'SetTcpEntry', 'AddVectoredContinueHandler', 'AddVectoredExceptionHandler', 'TerminateThread', 'ExitThread', 'RemoveVectoredExceptionHandler', 'ResumeThread', 'SuspendThread', 'WaitForSingleObject', 'GetThreadId', 'LoadLibraryExA', 'LoadLibraryExW', 'SymInitialize', 'SymFromName', 'SymLoadModuleEx', 'SymSetOptions', 'SymGetTypeInfo', 'DeviceIoControl', 'GetTokenInformation', 'RegOpenKeyExA', 'RegOpenKeyExW', 'RegGetValueA', 'RegGetValueW', 'RegCloseKey', 'Wow64DisableWow64FsRedirection', 'Wow64RevertWow64FsRedirection', 'Wow64EnableWow64FsRedirection', 'Wow64GetThreadContext', 'SetConsoleCtrlHandler', 'WinVerifyTrust', 'GlobalAlloc', 'GlobalFree', 'GlobalUnlock', 'GlobalLock', 'OpenClipboard', 'EmptyClipboard', 'CloseClipboard', 'SetClipboardData', 'GetClipboardData', 'EnumClipboardFormats', 'GetClipboardFormatNameA', 'GetClipboardFormatNameW', 'WinVerifyTrust', 'OpenProcessToken', 'OpenThreadToken', 'GetTokenInformation', 'SetTokenInformation', 'GetSidIdentifierAuthority', 'GetSidSubAuthority', 'GetSidSubAuthorityCount', 'GetLengthSid', 'CreateWellKnownSid', 'DebugBreak', 'WaitForDebugEvent', 'ContinueDebugEvent', 'DebugActiveProcess', 'DebugActiveProcessStop', 'DebugSetProcessKillOnExit', 'DebugBreakProcess', 'GetProcessId', 'Wow64SetThreadContext', 'GetMappedFileNameW', 'GetMappedFileNameA', 'RtlInitString', 'RtlInitUnicodeString', 'RtlAnsiStringToUnicodeString', 'RtlDecompressBuffer', 'NtCreateSection', 'NtOpenSection', 'NtMapViewOfSection', 'NtUnmapViewOfSection', 'OpenEventA', 'OpenEventW', 'NtOpenEvent', 'NtAlpcCreatePort', 'NtAlpcQueryInformation', 'NtAlpcConnectPort', 'NtAlpcConnectPortEx', 'NtAlpcAcceptConnectPort', 'AlpcInitializeMessageAttribute', 'AlpcGetMessageAttribute', 'NtAlpcSendWaitReceivePort', 'NtAlpcDisconnectPort', 'NtAlpcCreatePortSection', 'NtAlpcDeletePortSection', 'NtAlpcCreateResourceReserve', 'NtAlpcDeleteResourceReserve', 'NtAlpcCreateSectionView', 'NtAlpcDeleteSectionView', 'NtAlpcCreateSecurityContext', 'NtAlpcDeleteSecurityContext', 'NtAlpcRevokeSecurityContext', 'lstrcmpA', 'lstrcmpW', 'CreateFileMappingA', 'CreateFileMappingW', 'MapViewOfFile', 'OpenSCManagerA', 'OpenSCManagerW', 'CloseServiceHandle', 'EnumServicesStatusExA', 'EnumServicesStatusExW', 'StartServiceA', 'StartServiceW', 'OpenServiceA', 'OpenServiceW', 'EnumWindows', 'GetWindowTextA', 'GetWindowTextW', 'GetWindowModuleFileNameA', 'GetWindowModuleFileNameW', 'GetLogicalDriveStringsA', 'GetLogicalDriveStringsW', 'GetVolumeInformationA', 'GetVolumeInformationW', 'GetVolumeNameForVolumeMountPointA', 'GetVolumeNameForVolumeMountPointW', 'GetDriveTypeA', 'GetDriveTypeW', 'QueryDosDeviceA', 'QueryDosDeviceW', 'NtQueryObject', 'DuplicateHandle', 'ZwDuplicateObject', 'GetModuleBaseNameA', 'GetModuleBaseNameW', 'GetProcessImageFileNameA', 'GetProcessImageFileNameW', 'GetFileVersionInfoA', 'GetFileVersionInfoW', 'GetFileVersionInfoSizeA', 'GetFileVersionInfoSizeW', 'VerQueryValueA', 'VerQueryValueW', 'GetSystemMetrics', 'GetComputerNameA', 'GetComputerNameW', 'LookupAccountSidA', 'LookupAccountSidW', 'CoInitializeEx', 'CoInitializeSecurity', 'CoCreateInstance', 'GetInterfaceInfo', 'GetIfTable', 'GetIpAddrTable', 'NtOpenDirectoryObject', 'NtQueryDirectoryObject', 'NtQuerySymbolicLinkObject', 'NtOpenSymbolicLinkObject', 'GetProcessTimes', 'GetShortPathNameA', 'GetShortPathNameW', 'GetLongPathNameA', 'GetLongPathNameW', 'GetProcessDEPPolicy', 'GetCursorPos', 'WindowFromPoint', 'GetWindowRect', 'GetNamedSecurityInfoA', 'GetNamedSecurityInfoW', 'GetSecurityInfo', 'ConvertStringSidToSidA', 'ConvertStringSidToSidW', 'ConvertSidToStringSidA', 'ConvertSidToStringSidW', 'LocalFree', 'RegQueryValueExA', 'RegQueryValueExW', 'ShellExecuteA', 'ShellExecuteW', 'InitializeProcThreadAttributeList', 'UpdateProcThreadAttribute', 'DeleteProcThreadAttributeList', 'MessageBoxA', 'MessageBoxW', 'GetWindowsDirectoryA', 'GetWindowsDirectoryW', 'RtlGetUnloadEventTraceEx', 'CryptCATAdminCalcHashFromFileHandle', 'CryptCATAdminEnumCatalogFromHash', 'CryptCATAdminAcquireContext', 'CryptCATCatalogInfoFromContext', 'CryptCATAdminReleaseCatalogContext', 'CryptCATAdminReleaseContext', 'CryptCATGetAttrInfo', 'CryptCATGetMemberInfo', 'CryptCATGetAttrInfo', 'CryptCATEnumerateCatAttr', 'CryptCATEnumerateAttr', 'CryptCATEnumerateMember', 'CryptQueryObject', 'CryptMsgGetParam', 'CryptDecodeObject', 'CertFindCertificateInStore', 'CertGetNameStringA', 'CertGetNameStringW', 'CertGetCertificateChain', 'CertCreateSelfSignCertificate', 'CertStrToNameA', 'CertStrToNameW', 'CertOpenStore', 'CertAddCertificateContextToStore', 'PFXExportCertStoreEx', 'PFXImportCertStore', 'CryptGenKey', 'CryptDestroyKey', 'CryptAcquireContextA', 'CryptAcquireContextW', 'CryptReleaseContext', 'CryptExportKey', 'CertGetCertificateContextProperty', 'CertEnumCertificateContextProperties', 'CryptEncryptMessage', 'CryptDecryptMessage', 'CryptAcquireCertificatePrivateKey', 'CertDuplicateCertificateContext', 'CertEnumCertificatesInStore', 'CryptEncodeObjectEx', 'CertCreateCertificateContext', 'CertCompareCertificate', 'CertEnumCTLsInStore', 'CertDuplicateCTLContext', 'CertFreeCTLContext', 'CryptUIDlgViewContext', 'TpCallbackSendAlpcMessageOnCompletion'] +functions = ['ExitProcess', 'TerminateProcess', 'GetLastError', 'GetCurrentProcess', 'CreateFileA', 'CreateFileW', 'NtCreateFile', 'LdrLoadDll', 'NtQuerySystemInformation', 'NtQueryInformationProcess', 'NtQueryVirtualMemory', 'NtCreateThreadEx', 'NtQueryInformationThread', 'GetExitCodeThread', 'GetExitCodeProcess', 'SetPriorityClass', 'GetPriorityClass', 'VirtualAlloc', 'VirtualAllocEx', 'NtProtectVirtualMemory', 'VirtualFree', 'VirtualFreeEx', 'VirtualProtect', 'VirtualProtectEx', 'VirtualQuery', 'VirtualQueryEx', 'QueryWorkingSet', 'QueryWorkingSetEx', 'GetModuleFileNameA', 'GetModuleFileNameW', 'CreateThread', 'CreateRemoteThread', 'VirtualProtect', 'CreateProcessA', 'CreateProcessW', 'CreateProcessAsUserA', 'CreateProcessAsUserW', 'GetThreadContext', 'NtGetContextThread', 'SetThreadContext', 'NtSetContextThread', 'OpenThread', 'OpenProcess', 'CloseHandle', 'ReadProcessMemory', 'NtWow64ReadVirtualMemory64', 'NtReadVirtualMemory', 'WriteProcessMemory', 'NtWow64WriteVirtualMemory64', 'CreateToolhelp32Snapshot', 'Thread32First', 'Thread32Next', 'Process32First', 'Process32Next', 'Process32FirstW', 'Process32NextW', 'GetProcAddress', 'LoadLibraryA', 'LoadLibraryW', 'OpenProcessToken', 'OpenThreadToken', 'LookupPrivilegeValueA', 'LookupPrivilegeValueW', 'LookupPrivilegeNameA', 'LookupPrivilegeNameW', 'AdjustTokenPrivileges', 'FindResourceA', 'FindResourceW', 'SizeofResource', 'LoadResource', 'LockResource', 'GetVersionExA', 'GetVersionExW', 'GetVersion', 'GetCurrentThread', 'GetCurrentThreadId', 'GetCurrentProcessorNumber', 'AllocConsole', 'FreeConsole', 'GetStdHandle', 'SetStdHandle', 'SetThreadAffinityMask', 'ReadFile', 'WriteFile', 'GetExtendedTcpTable', 'GetExtendedUdpTable', 'SetTcpEntry', 'AddVectoredContinueHandler', 'AddVectoredExceptionHandler', 'TerminateThread', 'ExitThread', 'RemoveVectoredExceptionHandler', 'ResumeThread', 'SuspendThread', 'WaitForSingleObject', 'GetThreadId', 'LoadLibraryExA', 'LoadLibraryExW', 'SymInitialize', 'SymFromName', 'SymLoadModuleEx', 'SymSetOptions', 'SymGetTypeInfo', 'DeviceIoControl', 'GetTokenInformation', 'RegOpenKeyExA', 'RegOpenKeyExW', 'RegGetValueA', 'RegGetValueW', 'RegCloseKey', 'Wow64DisableWow64FsRedirection', 'Wow64RevertWow64FsRedirection', 'Wow64EnableWow64FsRedirection', 'Wow64GetThreadContext', 'SetConsoleCtrlHandler', 'WinVerifyTrust', 'GlobalAlloc', 'GlobalFree', 'GlobalUnlock', 'GlobalLock', 'OpenClipboard', 'EmptyClipboard', 'CloseClipboard', 'SetClipboardData', 'GetClipboardData', 'EnumClipboardFormats', 'GetClipboardFormatNameA', 'GetClipboardFormatNameW', 'WinVerifyTrust', 'OpenProcessToken', 'OpenThreadToken', 'GetTokenInformation', 'SetTokenInformation', 'GetSidIdentifierAuthority', 'GetSidSubAuthority', 'GetSidSubAuthorityCount', 'GetLengthSid', 'CreateWellKnownSid', 'DebugBreak', 'WaitForDebugEvent', 'ContinueDebugEvent', 'DebugActiveProcess', 'DebugActiveProcessStop', 'DebugSetProcessKillOnExit', 'DebugBreakProcess', 'GetProcessId', 'Wow64SetThreadContext', 'GetMappedFileNameW', 'GetMappedFileNameA', 'RtlInitString', 'RtlInitUnicodeString', 'RtlAnsiStringToUnicodeString', 'RtlDecompressBuffer', 'NtCreateSection', 'NtOpenSection', 'NtMapViewOfSection', 'NtUnmapViewOfSection', 'OpenEventA', 'OpenEventW', 'NtOpenEvent', 'NtAlpcCreatePort', 'NtAlpcQueryInformation', 'NtAlpcQueryInformationMessage', 'NtAlpcConnectPort', 'NtAlpcConnectPortEx', 'NtAlpcAcceptConnectPort', 'AlpcInitializeMessageAttribute', 'AlpcGetMessageAttribute', 'NtAlpcSendWaitReceivePort', 'NtAlpcDisconnectPort', 'NtAlpcCreatePortSection', 'NtAlpcDeletePortSection', 'NtAlpcCreateResourceReserve', 'NtAlpcDeleteResourceReserve', 'NtAlpcCreateSectionView', 'NtAlpcDeleteSectionView', 'NtAlpcCreateSecurityContext', 'NtAlpcDeleteSecurityContext', 'NtAlpcRevokeSecurityContext', 'lstrcmpA', 'lstrcmpW', 'CreateFileMappingA', 'CreateFileMappingW', 'MapViewOfFile', 'OpenSCManagerA', 'OpenSCManagerW', 'CloseServiceHandle', 'EnumServicesStatusExA', 'EnumServicesStatusExW', 'StartServiceA', 'StartServiceW', 'OpenServiceA', 'OpenServiceW', 'EnumWindows', 'GetWindowTextA', 'GetWindowTextW', 'GetWindowModuleFileNameA', 'GetWindowModuleFileNameW', 'GetLogicalDriveStringsA', 'GetLogicalDriveStringsW', 'GetVolumeInformationA', 'GetVolumeInformationW', 'GetVolumeNameForVolumeMountPointA', 'GetVolumeNameForVolumeMountPointW', 'GetDriveTypeA', 'GetDriveTypeW', 'QueryDosDeviceA', 'QueryDosDeviceW', 'NtQueryObject', 'DuplicateHandle', 'ZwDuplicateObject', 'GetModuleBaseNameA', 'GetModuleBaseNameW', 'GetProcessImageFileNameA', 'GetProcessImageFileNameW', 'GetFileVersionInfoA', 'GetFileVersionInfoW', 'GetFileVersionInfoSizeA', 'GetFileVersionInfoSizeW', 'VerQueryValueA', 'VerQueryValueW', 'GetSystemMetrics', 'GetComputerNameA', 'GetComputerNameW', 'LookupAccountSidA', 'LookupAccountSidW', 'CoInitializeEx', 'CoInitializeSecurity', 'CoCreateInstance', 'GetInterfaceInfo', 'GetIfTable', 'GetIpAddrTable', 'NtOpenDirectoryObject', 'NtQueryDirectoryObject', 'NtQuerySymbolicLinkObject', 'NtOpenSymbolicLinkObject', 'GetProcessTimes', 'GetShortPathNameA', 'GetShortPathNameW', 'GetLongPathNameA', 'GetLongPathNameW', 'GetProcessDEPPolicy', 'GetCursorPos', 'WindowFromPoint', 'GetWindowRect', 'GetNamedSecurityInfoA', 'GetNamedSecurityInfoW', 'GetSecurityInfo', 'ConvertStringSidToSidA', 'ConvertStringSidToSidW', 'ConvertSidToStringSidA', 'ConvertSidToStringSidW', 'LocalFree', 'RegQueryValueExA', 'RegQueryValueExW', 'ShellExecuteA', 'ShellExecuteW', 'InitializeProcThreadAttributeList', 'UpdateProcThreadAttribute', 'DeleteProcThreadAttributeList', 'MessageBoxA', 'MessageBoxW', 'GetWindowsDirectoryA', 'GetWindowsDirectoryW', 'RtlGetUnloadEventTraceEx', 'CryptCATAdminCalcHashFromFileHandle', 'CryptCATAdminEnumCatalogFromHash', 'CryptCATAdminAcquireContext', 'CryptCATCatalogInfoFromContext', 'CryptCATAdminReleaseCatalogContext', 'CryptCATAdminReleaseContext', 'CryptCATGetAttrInfo', 'CryptCATGetMemberInfo', 'CryptCATGetAttrInfo', 'CryptCATEnumerateCatAttr', 'CryptCATEnumerateAttr', 'CryptCATEnumerateMember', 'CryptQueryObject', 'CryptMsgGetParam', 'CryptDecodeObject', 'CertFindCertificateInStore', 'CertGetNameStringA', 'CertGetNameStringW', 'CertGetCertificateChain', 'CertCreateSelfSignCertificate', 'CertStrToNameA', 'CertStrToNameW', 'CertOpenStore', 'CertAddCertificateContextToStore', 'PFXExportCertStoreEx', 'PFXImportCertStore', 'CryptGenKey', 'CryptDestroyKey', 'CryptAcquireContextA', 'CryptAcquireContextW', 'CryptReleaseContext', 'CryptExportKey', 'CertGetCertificateContextProperty', 'CertEnumCertificateContextProperties', 'CryptEncryptMessage', 'CryptDecryptMessage', 'CryptAcquireCertificatePrivateKey', 'CertDuplicateCertificateContext', 'CertEnumCertificatesInStore', 'CryptEncodeObjectEx', 'CertCreateCertificateContext', 'CertCompareCertificate', 'CertEnumCTLsInStore', 'CertDuplicateCTLContext', 'CertFreeCTLContext', 'CryptUIDlgViewContext', 'TpCallbackSendAlpcMessageOnCompletion'] #def ExitProcess(uExitCode): @@ -819,6 +819,11 @@ NtAlpcCreatePortParams = ((1, 'PortHandle'), (1, 'ObjectAttributes'), (1, 'PortA NtAlpcQueryInformationPrototype = WINFUNCTYPE(NTSTATUS, HANDLE, ALPC_PORT_INFORMATION_CLASS, PVOID, ULONG, PULONG) NtAlpcQueryInformationParams = ((1, 'PortHandle'), (1, 'PortInformationClass'), (1, 'PortInformation'), (1, 'Length'), (1, 'ReturnLength')) +#def NtAlpcQueryInformationMessage(PortHandle, PortMessage, MessageInformationClass, MessageInformation, Length, ReturnLength): +# return NtAlpcQueryInformationMessage.ctypes_function(PortHandle, PortMessage, MessageInformationClass, MessageInformation, Length, ReturnLength) +NtAlpcQueryInformationMessagePrototype = WINFUNCTYPE(NTSTATUS, HANDLE, PPORT_MESSAGE, ALPC_MESSAGE_INFORMATION_CLASS, PVOID, ULONG, PULONG) +NtAlpcQueryInformationMessageParams = ((1, 'PortHandle'), (1, 'PortMessage'), (1, 'MessageInformationClass'), (1, 'MessageInformation'), (1, 'Length'), (1, 'ReturnLength')) + #def NtAlpcConnectPort(PortHandle, PortName, ObjectAttributes, PortAttributes, Flags, RequiredServerSid, ConnectionMessage, BufferLength, OutMessageAttributes, InMessageAttributes, Timeout): # return NtAlpcConnectPort.ctypes_function(PortHandle, PortName, ObjectAttributes, PortAttributes, Flags, RequiredServerSid, ConnectionMessage, BufferLength, OutMessageAttributes, InMessageAttributes, Timeout) NtAlpcConnectPortPrototype = WINFUNCTYPE(NTSTATUS, PHANDLE, PUNICODE_STRING, POBJECT_ATTRIBUTES, PALPC_PORT_ATTRIBUTES, ULONG, PSID, PPORT_MESSAGE, PULONG, PALPC_MESSAGE_ATTRIBUTES, PALPC_MESSAGE_ATTRIBUTES, PLARGE_INTEGER) diff --git a/windows/generated_def/winstructs.py b/windows/generated_def/winstructs.py index 0e1f18c..65066ba 100644 --- a/windows/generated_def/winstructs.py +++ b/windows/generated_def/winstructs.py @@ -1015,6 +1015,17 @@ class _ALPC_PORT_INFORMATION_CLASS(EnumType): ALPC_PORT_INFORMATION_CLASS = _ALPC_PORT_INFORMATION_CLASS +AlpcMessageSidInformation = EnumValue("_ALPC_MESSAGE_INFORMATION_CLASS", "AlpcMessageSidInformation", 0x0) +AlpcMessageTokenModifiedIdInformation = EnumValue("_ALPC_MESSAGE_INFORMATION_CLASS", "AlpcMessageTokenModifiedIdInformation", 0x1) +MaxAlpcMessageInfoClass = EnumValue("_ALPC_MESSAGE_INFORMATION_CLASS", "MaxAlpcMessageInfoClass", 0x2) +AlpcMessageHandleInformation = EnumValue("_ALPC_MESSAGE_INFORMATION_CLASS", "AlpcMessageHandleInformation", 0x3) +class _ALPC_MESSAGE_INFORMATION_CLASS(EnumType): + values = [AlpcMessageSidInformation, AlpcMessageTokenModifiedIdInformation, MaxAlpcMessageInfoClass, AlpcMessageHandleInformation] + mapper = {x:x for x in values} +ALPC_MESSAGE_INFORMATION_CLASS = _ALPC_MESSAGE_INFORMATION_CLASS +PALPC_MESSAGE_INFORMATION_CLASS = POINTER(_ALPC_MESSAGE_INFORMATION_CLASS) + + # Self referencing struct tricks class _LIST_ENTRY(Structure): pass PLIST_ENTRY = POINTER(_LIST_ENTRY) @@ -1038,19 +1049,102 @@ class _LSA_UNICODE_STRING(Structure): _fields_ = [ ("Length", USHORT), ("MaximumLength", USHORT), - ("Buffer", PWSTR), + ("Buffer", PVOID), ] PUNICODE_STRING = POINTER(_LSA_UNICODE_STRING) UNICODE_STRING = _LSA_UNICODE_STRING LSA_UNICODE_STRING = _LSA_UNICODE_STRING PLSA_UNICODE_STRING = POINTER(_LSA_UNICODE_STRING) +INITIAL_LSA_UNICODE_STRING = _LSA_UNICODE_STRING + +class _LSA_UNICODE_STRING(INITIAL_LSA_UNICODE_STRING): + @property + def str(self): + """The python string of the LSA_UNICODE_STRING object + + :type: :class:`unicode` + """ + if not self.Length: + return "" + if getattr(self, "_target", None) is not None: # remote ctypes :D -> TRICKS OF THE YEAR + # raw_data = self._target.read_memory(self.Buffer, self.Length) + buffer_ptr = self._target.read_ptr(self._base_addr + type(self).Buffer.offset) + raw_data = self._target.read_memory(buffer_ptr, self.Length) + return raw_data.decode("utf16") + size = self.Length / 2 + buffer_ptr = PVOID.from_address(ctypes.addressof(self) + type(self).Buffer.offset).value + return (ctypes.c_wchar * size).from_address(buffer_ptr)[:] + + @property + def str(self): + """The python string of the LSA_UNICODE_STRING object + + :type: :class:`unicode` + """ + if not self.Length: + return "" + if getattr(self, "_target", None) is not None: #remote ctypes :D -> TRICKS OF THE YEAR + raw_data = self._target.read_memory(self.Buffer, self.Length) + return raw_data.decode("utf16") + size = self.Length / 2 + return (ctypes.c_wchar * size).from_address(self.Buffer)[:] + + def __repr__(self): + return """<{0} "{1}" at {2}>""".format(type(self).__name__, self.str, hex(id(self))) +PUNICODE_STRING = POINTER(_LSA_UNICODE_STRING) +UNICODE_STRING = _LSA_UNICODE_STRING +LSA_UNICODE_STRING = _LSA_UNICODE_STRING +PLSA_UNICODE_STRING = POINTER(_LSA_UNICODE_STRING) + +class _CURDIR(Structure): + _fields_ = [ + ("DosPath", UNICODE_STRING), + ("Handle", PVOID), + ] +PCURDIR = POINTER(_CURDIR) +CURDIR = _CURDIR + +class _RTL_DRIVE_LETTER_CURDIR(Structure): + _fields_ = [ + ("Flags", WORD), + ("Length", WORD), + ("TimeStamp", ULONG), + ("DosPath", UNICODE_STRING), + ] +PRTL_DRIVE_LETTER_CURDIR = POINTER(_RTL_DRIVE_LETTER_CURDIR) +RTL_DRIVE_LETTER_CURDIR = _RTL_DRIVE_LETTER_CURDIR + class _RTL_USER_PROCESS_PARAMETERS(Structure): _fields_ = [ - ("Reserved1", BYTE * 16), - ("Reserved2", PVOID * 10), + ("MaximumLength", ULONG), + ("Length", ULONG), + ("Flags", ULONG), + ("DebugFlags", ULONG), + ("ConsoleHandle", PVOID), + ("ConsoleFlags", ULONG), + ("StandardInput", PVOID), + ("StandardOutput", PVOID), + ("StandardError", PVOID), + ("CurrentDirectory", CURDIR), + ("DllPath", UNICODE_STRING), ("ImagePathName", UNICODE_STRING), ("CommandLine", UNICODE_STRING), + ("Environment", PVOID), + ("StartingX", ULONG), + ("StartingY", ULONG), + ("CountX", ULONG), + ("CountY", ULONG), + ("CountCharsX", ULONG), + ("CountCharsY", ULONG), + ("FillAttribute", ULONG), + ("WindowFlags", ULONG), + ("ShowWindowFlags", ULONG), + ("WindowTitle", UNICODE_STRING), + ("DesktopInfo", UNICODE_STRING), + ("ShellInfo", UNICODE_STRING), + ("RuntimeData", UNICODE_STRING), + ("CurrentDirectores", RTL_DRIVE_LETTER_CURDIR * 32), ] PRTL_USER_PROCESS_PARAMETERS = POINTER(_RTL_USER_PROCESS_PARAMETERS) RTL_USER_PROCESS_PARAMETERS = _RTL_USER_PROCESS_PARAMETERS diff --git a/windows/winobject/handle.py b/windows/winobject/handle.py index 0c099bf..30ec78b 100644 --- a/windows/winobject/handle.py +++ b/windows/winobject/handle.py @@ -4,11 +4,11 @@ import ctypes import windows from windows import winproxy from windows.generated_def import windef -from windows.winobject.process import WinUnicodeString from windows.generated_def.winstructs import * -class EPUBLIC_OBJECT_TYPE_INFORMATION(ctypes.Structure): - _fields_ = windows.utils.transform_ctypes_fields(PUBLIC_OBJECT_TYPE_INFORMATION, {"TypeName": windows.winobject.process.WinUnicodeString}) +# Remove this ? +class EPUBLIC_OBJECT_TYPE_INFORMATION(PUBLIC_OBJECT_TYPE_INFORMATION): + pass current_process_pid = os.getpid() @@ -47,7 +47,7 @@ class Handle(SYSTEM_HANDLE): size_needed = DWORD() yyy = ctypes.c_buffer(0x1000) winproxy.NtQueryObject(lh, ObjectNameInformation, ctypes.byref(yyy), ctypes.sizeof(yyy), ctypes.byref(size_needed)) - return WinUnicodeString.from_buffer_copy(yyy[:size_needed.value]).str + return LSA_UNICODE_STRING.from_buffer_copy(yyy[:size_needed.value]).str def _get_object_type(self): lh = self.local_handle diff --git a/windows/winobject/process.py b/windows/winobject/process.py index 85849de..d74a743 100644 --- a/windows/winobject/process.py +++ b/windows/winobject/process.py @@ -564,7 +564,7 @@ class Process(AutoHandle): if e.code not in [STATUS_FILE_INVALID, STATUS_INVALID_ADDRESS, STATUS_TRANSACTION_NOT_ACTIVE]: raise return None - remote_winstring = rctypes.transform_type_to_remote64bits(WinUnicodeString) + remote_winstring = rctypes.transform_type_to_remote64bits(gdef.LSA_UNICODE_STRING) mapped_filename = remote_winstring(ctypes.addressof(buffer), windows.current_process) return mapped_filename.str @@ -1240,32 +1240,7 @@ def transform_ctypes_fields(struct, replacement): return [(name, replacement.get(name, type)) for name, type in struct._fields_] -class WinUnicodeString(Structure): - """LSA_UNICODE_STRING with a nice `__repr__`""" - _fields_ = transform_ctypes_fields(LSA_UNICODE_STRING, {"Buffer": ctypes.c_void_p}) - fields = [f[0] for f in _fields_] - """The fields of the structure""" - - @property - def str(self): - """The python string of the LSA_UNICODE_STRING object - - :type: :class:`unicode` - """ - if not self.Length: - return "" - if getattr(self, "_target", None) is not None: #remote ctypes :D -> TRICKS OF THE YEAR - raw_data = self._target.read_memory(self.Buffer, self.Length) - return raw_data.decode("utf16") - size = self.Length / 2 - return (ctypes.c_wchar * size).from_address(self.Buffer)[:] - - def __repr__(self): - return """<{0} "{1}" at {2}>""".format(type(self).__name__, self.str, hex(id(self))) - - -class LoadedModule(Structure): - _fields_ = transform_ctypes_fields(LDR_DATA_TABLE_ENTRY, {"BaseDllName": WinUnicodeString, "FullDllName": WinUnicodeString}) +class LoadedModule(LDR_DATA_TABLE_ENTRY): """An entry in the PEB Ldr list""" @property def baseaddr(self): @@ -1308,18 +1283,8 @@ class LIST_ENTRY_PTR(PVOID): return LDR_DATA_TABLE_ENTRY.from_address(self.value - sizeof(PVOID) * 2) -class RTL_USER_PROCESS_PARAMETERS(Structure): - _fields_ = transform_ctypes_fields(RTL_USER_PROCESS_PARAMETERS, # The one in generated_def - {"ImagePathName": WinUnicodeString, - "CommandLine": WinUnicodeString} - ) - - -class PEB(Structure): +class PEB(gdef.PEB): """The PEB (Process Environment Block) of the current process""" - _fields_ = transform_ctypes_fields(PEB, # The one in generated_def - {"ProcessParameters": POINTER(RTL_USER_PROCESS_PARAMETERS)} - ) @property def exe(self): @@ -1333,7 +1298,7 @@ class PEB(Structure): def imagepath(self): """The ImagePathName of the PEB - :type: :class:`WinUnicodeString` + :type: :class:`~windows.generated_def.LSA_UNICODE_STRING` """ return self.ProcessParameters.contents.ImagePathName @@ -1341,9 +1306,8 @@ class PEB(Structure): def commandline(self): """The CommandLine of the PEB - :type: :class:`WinUnicodeString` + :type: :class:`~windows.generated_def.LSA_UNICODE_STRING` """ - # This or changing the __repr__ of LSA_UNICODE_STRING return self.ProcessParameters.contents.CommandLine @property diff --git a/windows/winproxy.py b/windows/winproxy.py index ec08c18..988577c 100644 --- a/windows/winproxy.py +++ b/windows/winproxy.py @@ -919,6 +919,11 @@ def NtAlpcDeleteSectionView(PortHandle, Flags, ViewBase): return NtAlpcDeleteSectionView.ctypes_function(PortHandle, Flags, ViewBase) +@NtdllProxy("NtAlpcQueryInformationMessage", error_ntstatus) +def NtAlpcQueryInformationMessage(PortHandle, PortMessage, MessageInformationClass, MessageInformation, Length, ReturnLength): + return NtAlpcQueryInformationMessage.ctypes_function(PortHandle, PortMessage, MessageInformationClass, MessageInformation, Length, ReturnLength) + + @NtdllProxy("NtOpenDirectoryObject", error_ntstatus) def NtOpenDirectoryObject(DirectoryHandle, DesiredAccess, ObjectAttributes): return NtOpenDirectoryObject.ctypes_function(DirectoryHandle, DesiredAccess, ObjectAttributes)