{ "path": "NVIDIA App\\CEF\\libcef.dll", "sha256": "29bb51e0fc7ebd1d41c7781d1068c60253647013e578053b8bb93a52ad33dca7", "method": "Capstone linear sweep over raw bytes of all IMAGE_SCN_MEM_EXECUTE sections; skipdata enabled; no reachability proof", "sections": [ { "name": ".text", "raw_bytes": 188039168, "processed_bytes": 188039168, "instructions": 51418058, "skipdata_bytes": 3913 }, { "name": ".rodata", "raw_bytes": 4608, "processed_bytes": 4608, "instructions": 1905, "skipdata_bytes": 386 }, { "name": "LZMADEC", "raw_bytes": 4608, "processed_bytes": 4608, "instructions": 1442, "skipdata_bytes": 0 }, { "name": "malloc_h", "raw_bytes": 512, "processed_bytes": 512, "instructions": 350, "skipdata_bytes": 0 } ], "utc": "2026-11-11T21:41:07.807218+00:00", "instructions": 51421755, "skipdata_bytes": 4299, "calls": 3807879, "api_reference_counts": { "KERNEL32.dll!RtlVirtualUnwind": 15, "KERNEL32.dll!TryAcquireSRWLockExclusive": 3608, "KERNEL32.dll!ReleaseSRWLockExclusive": 4036, "USER32.dll!GetWindowLongPtrW": 10, "KERNEL32.dll!GetCommandLineW": 5, "USER32.dll!MapWindowPoints": 8, "ole32.dll!CoInitialize": 1, "ole32.dll!CoUninitialize": 6, "USER32.dll!GetMenu": 2, "USER32.dll!AdjustWindowRectEx": 5, "KERNEL32.dll!GetModuleHandleW": 78, "KERNEL32.dll!GetProcAddress": 111, "KERNEL32.dll!InitializeCriticalSectionEx": 20, "KERNEL32.dll!GetLastError": 561, "KERNEL32.dll!GetProcessHeap": 9, "USER32.dll!LoadCursorW": 6, "USER32.dll!RegisterClassExW": 9, "USER32.dll!CreateWindowExW": 11, "USER32.dll!GetClientRect": 15, "USER32.dll!GetAncestor": 14, "USER32.dll!SetWindowLongPtrW": 9, "USER32.dll!PostMessageW": 9, "USER32.dll!SetFocus": 5, "USER32.dll!SetWindowPos": 23, "USER32.dll!DefWindowProcW": 19, "USER32.dll!MapVirtualKeyW": 5, "USER32.dll!IsWindowEnabled": 5, "dwmapi.dll!DwmGetWindowAttribute": 5, "dwmapi.dll!DwmSetWindowAttribute": 3, "USER32.dll!IsWindowVisible": 14, "USER32.dll!IsIconic": 7, "USER32.dll!GetWindowRect": 27, "USER32.dll!IsZoomed": 3, "USER32.dll!GetWindowPlacement": 5, "USER32.dll!BeginDeferWindowPos": 1, "USER32.dll!EndDeferWindowPos": 1, "KERNEL32.dll!GetLogicalProcessorInformation": 4, "KERNEL32.dll!InitializeSRWLock": 10, "KERNEL32.dll!InitializeConditionVariable": 11, "KERNEL32.dll!AcquireSRWLockExclusive": 69, "KERNEL32.dll!SleepConditionVariableSRW": 8, "KERNEL32.dll!WakeConditionVariable": 35, "KERNEL32.dll!GetModuleHandleA": 12, "KERNEL32.dll!VirtualAlloc": 28, "KERNEL32.dll!VirtualFree": 28, "KERNEL32.dll!WideCharToMultiByte": 20, "KERNEL32.dll!GetCurrentThread": 30, "KERNEL32.dll!LocalFree": 51, "KERNEL32.dll!GetCurrentProcessId": 66, "KERNEL32.dll!GetCurrentThreadId": 69, "KERNEL32.dll!TlsGetValue": 27, "KERNEL32.dll!SetLastError": 205, "KERNEL32.dll!GetCurrentProcess": 127, "KERNEL32.dll!DuplicateHandle": 56, "KERNEL32.dll!WriteFile": 25, "KERNEL32.dll!ReadFile": 19, "KERNEL32.dll!CancelIo": 5, "KERNEL32.dll!GetSystemDirectoryW": 6, "KERNEL32.dll!GetComputerNameExW": 4, "KERNEL32.dll!DeleteCriticalSection": 130, "KERNEL32.dll!EnterCriticalSection": 593, "KERNEL32.dll!LeaveCriticalSection": 626, "WINMM.dll!waveOutGetNumDevs": 1, "ole32.dll!CoCreateInstance": 83, "ole32.dll!CoInitializeEx": 6, "KERNEL32.dll!SetEvent": 12, "KERNEL32.dll!CreateEventW": 21, "KERNEL32.dll!CloseHandle": 103, "KERNEL32.dll!FindFirstFileA": 1, "KERNEL32.dll!VerifyVersionInfoW": 14, "ADVAPI32.dll!RegOpenKeyExW": 23, "ADVAPI32.dll!RegQueryValueExA": 3, "ADVAPI32.dll!RegCloseKey": 41, "KERNEL32.dll!WaitForMultipleObjects": 9, "KERNEL32.dll!LoadLibraryW": 28, "KERNEL32.dll!CreateMutexW": 7, "USER32.dll!RegisterDeviceNotificationW": 3, "ole32.dll!CoCreateFreeThreadedMarshaler": 3, "USER32.dll!ClientToScreen": 9, "USER32.dll!GetSystemMetrics": 21, "USER32.dll!GetCursorPos": 16, "USER32.dll!ScreenToClient": 13, "USER32.dll!GetDoubleClickTime": 2, "KERNEL32.dll!VirtualProtectEx": 3, "KERNEL32.dll!WriteProcessMemory": 10, "KERNEL32.dll!ReadProcessMemory": 17, "KERNEL32.dll!VirtualProtect": 10, "KERNEL32.dll!RtlAddFunctionTable": 1, "KERNEL32.dll!RtlDeleteFunctionTable": 1, "KERNEL32.dll!LoadLibraryExW": 29, "KERNEL32.dll!AddVectoredExceptionHandler": 2, "USERENV.dll!RegisterGPNotification": 2, "USERENV.dll!UnregisterGPNotification": 2, "USERENV.dll!GetProfileType": 2, "COMCTL32.dll!InitCommonControlsEx": 1, "ADVAPI32.dll!GetSecurityDescriptorDacl": 2, "KERNEL32.dll!CreateFileW": 61, "KERNEL32.dll!GetFileInformationByHandle": 7, "KERNEL32.dll!GetFinalPathNameByHandleW": 2, "ADVAPI32.dll!SetSecurityInfo": 2, "USER32.dll!GetThreadDesktop": 4, "WS2_32.dll!WSAGetLastError": 65, "WS2_32.dll!closesocket": 10, "KERNEL32.dll!GetProcessTimes": 5, "USER32.dll!SystemParametersInfoW": 16, "KERNEL32.dll!GetModuleFileNameW": 13, "USER32.dll!IsWindow": 36, "SHELL32.dll!SHGetSpecialFolderPathW": 1, "USER32.dll!GetDesktopWindow": 11, "USER32.dll!NotifyWinEvent": 8, "USER32.dll!RegisterTouchWindow": 2, "USER32.dll!DestroyWindow": 10, "USER32.dll!GetParent": 35, "USER32.dll!SetParent": 3, "USER32.dll!ShowWindow": 6, "USER32.dll!TrackMouseEvent": 2, "USER32.dll!GetCapture": 3, "USER32.dll!WindowFromPoint": 8, "USER32.dll!GetClassInfoExW": 4, "USER32.dll!GetWindowLongW": 34, "USER32.dll!SetWindowLongW": 8, "USER32.dll!BeginPaint": 3, "USER32.dll!EndPaint": 3, "USER32.dll!CallWindowProcW": 2, "USER32.dll!EnumThreadWindows": 4, "USER32.dll!GetWindow": 12, "KERNEL32.dll!GlobalMemoryStatusEx": 5, "KERNEL32.dll!GetTimeZoneInformation": 6, "KERNEL32.dll!PowerCreateRequest": 1, "KERNEL32.dll!PowerSetRequest": 1, "KERNEL32.dll!PowerClearRequest": 2, "USER32.dll!UnregisterPowerSettingNotification": 5, "KERNEL32.dll!GetSystemPowerStatus": 3, "CRYPT32.dll!CertCloseStore": 26, "KERNEL32.dll!WaitForSingleObject": 39, "KERNEL32.dll!ReleaseMutex": 4, "KERNEL32.dll!GetComputerNameW": 4, "ADVAPI32.dll!LookupAccountNameW": 4, "KERNEL32.dll!GetVolumeInformationW": 3, "KERNEL32.dll!SetPriorityClass": 4, "USER32.dll!PostThreadMessageW": 1, "USER32.dll!PeekMessageW": 6, "KERNEL32.dll!SetConsoleCtrlHandler": 4, "KERNEL32.dll!QueryFullProcessImageNameA": 3, "KERNEL32.dll!GetProcessMitigationPolicy": 5, "chrome_elf.dll!GetInstallDetailsPayload": 1, "KERNEL32.dll!GetTempPathA": 3, "KERNEL32.dll!InitializeCriticalSection": 80, "KERNEL32.dll!OpenThread": 6, "KERNEL32.dll!CreateThread": 10, "KERNEL32.dll!GetThreadPriority": 6, "KERNEL32.dll!SetThreadPriority": 16, "KERNEL32.dll!ResumeThread": 6, "KERNEL32.dll!GetTempFileNameA": 2, "KERNEL32.dll!GetCommandLineA": 3, "KERNEL32.dll!DebugBreak": 2, "KERNEL32.dll!GetStdHandle": 9, "KERNEL32.dll!GetConsoleScreenBufferInfo": 1, "KERNEL32.dll!WakeAllConditionVariable": 14, "KERNEL32.dll!HeapLock": 1, "KERNEL32.dll!HeapWalk": 1, "KERNEL32.dll!HeapUnlock": 1, "KERNEL32.dll!GetModuleHandleExA": 2, "ole32.dll!CoSetProxyBlanket": 8, "KERNEL32.dll!GetVersionExW": 6, "KERNEL32.dll!GetProductInfo": 2, "KERNEL32.dll!GetNativeSystemInfo": 7, "KERNEL32.dll!IsWow64Process": 2, "api-ms-win-core-winrt-l1-1-0.dll!RoGetActivationFactory": 2, "ole32.dll!CoTaskMemAlloc": 25, "ole32.dll!PropVariantClear": 33, "SHLWAPI.dll!#437": 1, "USER32.dll!RemovePropW": 4, "USER32.dll!SetPropW": 3, "USER32.dll!SetProcessDPIAware": 1, "USER32.dll!GetUserObjectInformationW": 4, "USER32.dll!GetPointerDevices": 2, "USER32.dll!RegisterPointerDeviceNotifications": 1, "KERNEL32.dll!ProcessIdToSessionId": 3, "KERNEL32.dll!ExpandEnvironmentStringsW": 8, "ADVAPI32.dll!IsValidSid": 10, "ADVAPI32.dll!GetLengthSid": 11, "ADVAPI32.dll!EqualSid": 2, "ntdll.dll!NtQueryObject": 2, "ADVAPI32.dll!IsValidSecurityDescriptor": 1, "ADVAPI32.dll!GetSecurityDescriptorControl": 1, "ADVAPI32.dll!GetSecurityDescriptorOwner": 1, "ADVAPI32.dll!GetSecurityDescriptorGroup": 1, "ADVAPI32.dll!GetSecurityDescriptorSacl": 1, "ADVAPI32.dll!GetNamedSecurityInfoW": 2, "ADVAPI32.dll!GetSecurityInfo": 1, "ADVAPI32.dll!SetNamedSecurityInfoW": 2, "ADVAPI32.dll!MapGenericMask": 1, "ADVAPI32.dll!AccessCheck": 1, "OLEAUT32.dll!VariantClear": 8, "OLEAUT32.dll!SysAllocStringLen": 3, "OLEAUT32.dll!SysFreeString": 7, "OLEAUT32.dll!SysStringLen": 11, "ADVAPI32.dll!RegNotifyChangeKeyValue": 1, "ADVAPI32.dll!RegCreateKeyExW": 4, "ADVAPI32.dll!RegQueryValueExW": 12, "ADVAPI32.dll!RegDeleteKeyExW": 3, "ADVAPI32.dll!RegDeleteValueW": 2, "ADVAPI32.dll!RegSetValueExW": 6, "ADVAPI32.dll!RegQueryInfoKeyW": 11, "ADVAPI32.dll!RegEnumValueW": 2, "ADVAPI32.dll!RegEnumKeyExW": 2, "KERNEL32.dll!RegisterWaitForSingleObject": 8, "USER32.dll!FindWindowExW": 2, "USER32.dll!UnregisterClassW": 5, "api-ms-win-core-winrt-l1-1-0.dll!RoActivateInstance": 1, "ADVAPI32.dll!OpenProcessToken": 7, "ADVAPI32.dll!DuplicateTokenEx": 3, "ADVAPI32.dll!OpenThreadToken": 2, "ADVAPI32.dll!SetTokenInformation": 2, "ADVAPI32.dll!GetTokenInformation": 20, "ADVAPI32.dll!CreateRestrictedToken": 1, "ADVAPI32.dll!LookupPrivilegeValueW": 2, "ADVAPI32.dll!AdjustTokenPrivileges": 2, "KERNEL32.dll!GetSystemTimeAsFileTime": 17, "KERNEL32.dll!QueryPerformanceCounter": 41, "WINMM.dll!timeEndPeriod": 2, "WINMM.dll!timeBeginPeriod": 2, "KERNEL32.dll!SystemTimeToFileTime": 5, "KERNEL32.dll!TzSpecificLocalTimeToSystemTime": 2, "KERNEL32.dll!FileTimeToSystemTime": 7, "KERNEL32.dll!SystemTimeToTzSpecificLocalTime": 4, "KERNEL32.dll!QueryPerformanceFrequency": 27, "api-ms-win-core-realtime-l1-1-1.dll!QueryUnbiasedInterruptTimePrecise": 1, "KERNEL32.dll!QueryThreadCycleTime": 3, "KERNEL32.dll!IsDebuggerPresent": 8, "KERNEL32.dll!RaiseException": 44, "KERNEL32.dll!GetThreadId": 2, "KERNEL32.dll!SetThreadInformation": 3, "KERNEL32.dll!GetLogicalProcessorInformationEx": 6, "KERNEL32.dll!GetDiskFreeSpaceExW": 3, "KERNEL32.dll!ConnectNamedPipe": 5, "KERNEL32.dll!GetOverlappedResult": 7, "KERNEL32.dll!MultiByteToWideChar": 30, "KERNEL32.dll!OpenProcess": 11, "KERNEL32.dll!TerminateProcess": 23, "KERNEL32.dll!GetExitCodeProcess": 5, "KERNEL32.dll!GetPriorityClass": 2, "KERNEL32.dll!SetProcessInformation": 1, "KERNEL32.dll!QueryProcessCycleTime": 1, "KERNEL32.dll!GetProcessId": 2, "KERNEL32.dll!HeapSetInformation": 3, "KERNEL32.dll!CreateProcessW": 2, "KERNEL32.dll!GetEnvironmentStringsW": 4, "KERNEL32.dll!FreeEnvironmentStringsW": 5, "USER32.dll!AllowSetForegroundWindow": 2, "ADVAPI32.dll!CreateProcessAsUserW": 2, "KERNEL32.dll!AssignProcessToJobObject": 1, "KERNEL32.dll!FreeLibrary": 38, "KERNEL32.dll!GetModuleHandleExW": 8, "USER32.dll!GetQueueStatus": 2, "USER32.dll!PostQuitMessage": 1, "USER32.dll!TranslateMessage": 2, "USER32.dll!DispatchMessageW": 2, "KERNEL32.dll!CreateIoCompletionPort": 8, "ADVAPI32.dll!InitializeAcl": 2, "ADVAPI32.dll!InitializeSecurityDescriptor": 1, "ADVAPI32.dll!SetSecurityDescriptorDacl": 1, "KERNEL32.dll!CreateFileMappingW": 8, "KERNEL32.dll!RtlCaptureStackBackTrace": 2, "KERNEL32.dll!MapViewOfFile": 11, "KERNEL32.dll!UnmapViewOfFile": 9, "KERNEL32.dll!GetFileSizeEx": 4, "KERNEL32.dll!SetFilePointerEx": 10, "KERNEL32.dll!SetEndOfFile": 8, "KERNEL32.dll!LockFileEx": 4, "KERNEL32.dll!UnlockFileEx": 4, "KERNEL32.dll!FlushFileBuffers": 8, "KERNEL32.dll!GetFileAttributesW": 30, "KERNEL32.dll!DeleteFileW": 10, "KERNEL32.dll!RemoveDirectoryW": 7, "KERNEL32.dll!SetFileAttributesW": 8, "KERNEL32.dll!ReplaceFileW": 1, "KERNEL32.dll!MoveFileW": 7, "KERNEL32.dll!GetTempPathW": 2, "SHELL32.dll!SHGetFolderPathW": 18, "KERNEL32.dll!GetLongPathNameW": 6, "KERNEL32.dll!CreateDirectoryW": 8, "KERNEL32.dll!GetLogicalDriveStringsW": 1, "KERNEL32.dll!GetFileAttributesExW": 3, "KERNEL32.dll!GetCurrentDirectoryW": 6, "KERNEL32.dll!SetCurrentDirectoryW": 1, "KERNEL32.dll!GetVolumePathNameW": 2, "WS2_32.dll!ioctlsocket": 3, "KERNEL32.dll!PrefetchVirtualMemory": 1, "SHELL32.dll!#680": 4, "KERNEL32.dll!ReadDirectoryChangesW": 3, "KERNEL32.dll!FindClose": 7, "SHLWAPI.dll!PathMatchSpecW": 1, "KERNEL32.dll!FindFirstFileExW": 4, "KERNEL32.dll!GetLocalTime": 1, "KERNEL32.dll!GetTickCount": 5, "KERNEL32.dll!OutputDebugStringA": 5, "KERNEL32.dll!SetEnvironmentVariableW": 4, "KERNEL32.dll!GetEnvironmentVariableW": 17, "SHELL32.dll!CommandLineToArgvW": 1, "KERNEL32.dll!TlsSetValue": 9, "KERNEL32.dll!CreateNamedPipeW": 5, "WS2_32.dll!WSAStartup": 1, "IPHLPAPI.DLL!GetAdaptersAddresses": 2, "WS2_32.dll!WSASocketW": 2, "WS2_32.dll!setsockopt": 20, "KERNEL32.dll!FormatMessageA": 4, "KERNEL32.dll!InitOnceBeginInitialize": 27, "KERNEL32.dll!InitOnceComplete": 20, "KERNEL32.dll!GetModuleFileNameA": 2, "KERNEL32.dll!LoadLibraryA": 5, "USER32.dll!GetWindowThreadProcessId": 19, "DWrite.dll!DWriteCreateFactory": 3, "USER32.dll!GetDC": 18, "GDI32.dll!GetDeviceCaps": 13, "USER32.dll!ReleaseDC": 23, "GDI32.dll!CreateFontIndirectW": 2, "GDI32.dll!SelectObject": 31, "GDI32.dll!GetObjectW": 7, "GDI32.dll!GetTextMetricsW": 3, "GDI32.dll!DeleteObject": 59, "USER32.dll!GetSysColor": 1, "USER32.dll!MonitorFromWindow": 35, "USER32.dll!EnumDisplayMonitors": 4, "USER32.dll!GetMonitorInfoW": 27, "USER32.dll!EnumDisplaySettingsW": 3, "USER32.dll!DisplayConfigGetDeviceInfo": 2, "USER32.dll!EnumDisplayDevicesW": 5, "USER32.dll!MonitorFromPoint": 3, "USER32.dll!MonitorFromRect": 9, "USER32.dll!DestroyIcon": 29, "SHELL32.dll!SHGetPropertyStoreForWindow": 2, "ole32.dll!OleInitialize": 1, "ole32.dll!OleUninitialize": 1, "USER32.dll!EnableWindow": 5, "USER32.dll!GetMessageExtraInfo": 2, "USER32.dll!UnregisterDeviceNotification": 3, "KERNEL32.dll!VirtualQuery": 6, "KERNEL32.dll!GetSystemInfo": 13, "KERNEL32.dll!CreateSemaphoreA": 2, "KERNEL32.dll!TryEnterCriticalSection": 4, "OLEAUT32.dll!SysAllocString": 61, "USER32.dll!LoadIconW": 3, "USER32.dll!LoadImageW": 4, "KERNEL32.dll!TlsAlloc": 7, "USER32.dll!GetLastInputInfo": 1, "UxTheme.dll!GetThemePartSize": 1, "UxTheme.dll!CloseThemeData": 48, "USER32.dll!GetCaretBlinkTime": 1, "GDI32.dll!CreateRectRgn": 7, "USER32.dll!GetWindowRgn": 3, "GDI32.dll!EqualRgn": 1, "USER32.dll!SetWindowRgn": 2, "GDI32.dll!CombineRgn": 2, "USER32.dll!OffsetRect": 3, "GDI32.dll!CreateRectRgnIndirect": 2, "USER32.dll!SetWindowPlacement": 1, "USER32.dll!SetForegroundWindow": 9, "USER32.dll!GetActiveWindow": 6, "USER32.dll!SetCursor": 2, "USER32.dll!SendMessageW": 18, "USER32.dll!RedrawWindow": 3, "USER32.dll!GetPointerType": 3, "USER32.dll!IsChild": 5, "USER32.dll!GetForegroundWindow": 8, "USER32.dll!GetMessageTime": 7, "dwmapi.dll!DwmDefWindowProc": 2, "USER32.dll!GetSystemMenu": 4, "dwmapi.dll!DwmExtendFrameIntoClientArea": 5, "GDI32.dll!CreateSolidBrush": 6, "USER32.dll!FillRect": 10, "USER32.dll!EnumChildWindows": 1, "USER32.dll!GetWindowDC": 2, "GDI32.dll!SelectClipRgn": 3, "GDI32.dll!GetRgnBox": 2, "USER32.dll!IntersectRect": 2, "USER32.dll!IsRectEmpty": 3, "GDI32.dll!GetStockObject": 4, "ole32.dll!CoTaskMemFree": 59, "ADVAPI32.dll!GetUserNameW": 1, "KERNEL32.dll!SetUnhandledExceptionFilter": 7, "KERNEL32.dll!SetProcessShutdownParameters": 1, "KERNEL32.dll!SetErrorMode": 1, "ADVAPI32.dll!IsValidAcl": 1, "ADVAPI32.dll!AddMandatoryAce": 1, "ADVAPI32.dll!BuildTrusteeWithSidW": 1, "ADVAPI32.dll!SetEntriesInAclW": 2, "KERNEL32.dll!DeleteProcThreadAttributeList": 1, "KERNEL32.dll!InitializeProcThreadAttributeList": 2, "KERNEL32.dll!UpdateProcThreadAttribute": 1, "ADVAPI32.dll!UnregisterTraceGuids": 2, "ADVAPI32.dll!RegisterTraceGuidsW": 1, "KERNEL32.dll!FindResourceW": 4, "KERNEL32.dll!SizeofResource": 4, "KERNEL32.dll!LoadResource": 4, "KERNEL32.dll!LockResource": 3, "KERNEL32.dll!Sleep": 26, "KERNEL32.dll!FlushViewOfFile": 2, "KERNEL32.dll!GetWindowsDirectoryW": 1, "USER32.dll!RegisterSuspendResumeNotification": 1, "KERNEL32.dll!AcquireSRWLockShared": 2, "KERNEL32.dll!ReleaseSRWLockShared": 2, "KERNEL32.dll!InitOnceExecuteOnce": 131, "KERNEL32.dll!GetLocaleInfoEx": 1, "WS2_32.dll!WSACreateEvent": 5, "WS2_32.dll!WSAEventSelect": 7, "WS2_32.dll!htonl": 37, "WS2_32.dll!connect": 4, "WS2_32.dll!WSACloseEvent": 6, "WS2_32.dll!WSAEnumNetworkEvents": 5, "WS2_32.dll!shutdown": 1, "WS2_32.dll!bind": 4, "WS2_32.dll!listen": 2, "WS2_32.dll!accept": 2, "WS2_32.dll!recv": 8, "WS2_32.dll!WSASend": 1, "WS2_32.dll!getsockname": 4, "WS2_32.dll!WSAIoctl": 5, "CRYPT32.dll!CertOpenStore": 7, "CRYPT32.dll!CertAddStoreToCollection": 3, "CRYPT32.dll!CertControlStore": 3, "WS2_32.dll!WSALookupServiceBeginW": 2, "WS2_32.dll!WSALookupServiceNextW": 2, "WS2_32.dll!WSALookupServiceEnd": 3, "IPHLPAPI.DLL!CancelIPChangeNotify": 1, "IPHLPAPI.DLL!NotifyAddrChange": 1, "GDI32.dll!SetWorldTransform": 6, "GDI32.dll!CreateDIBSection": 9, "GDI32.dll!CreateDCW": 4, "GDI32.dll!GetICMProfileW": 1, "GDI32.dll!DeleteDC": 26, "KERNEL32.dll!GetThreadPreferredUILanguages": 2, "USER32.dll!GetKeyState": 14, "KERNEL32.dll!GetQueuedCompletionStatus": 6, "KERNEL32.dll!TerminateJobObject": 4, "KERNEL32.dll!PostQueuedCompletionStatus": 5, "KERNEL32.dll!SetInformationJobObject": 5, "USER32.dll!GetPropW": 3, "USER32.dll!UpdateLayeredWindow": 1, "USER32.dll!GetKeyboardLayout": 4, "USER32.dll!RegisterWindowMessageW": 1, "KERNEL32.dll!GetThreadTimes": 3, "SETUPAPI.dll!SetupDiDestroyDeviceInfoList": 16, "SETUPAPI.dll!SetupDiCreateDeviceInfoList": 3, "SETUPAPI.dll!SetupDiOpenDeviceInfoW": 1, "SETUPAPI.dll!SetupDiOpenDevRegKey": 3, "ole32.dll!CLSIDFromString": 7, "SETUPAPI.dll!SetupDiGetDeviceInterfaceDetailW": 11, "SETUPAPI.dll!SetupDiGetClassDevsW": 13, "SETUPAPI.dll!SetupDiEnumDeviceInterfaces": 5, "SETUPAPI.dll!SetupDiGetDevicePropertyW": 10, "GDI32.dll!CreateCompatibleDC": 12, "GDI32.dll!SetGraphicsMode": 3, "KERNEL32.dll!GetUserGeoID": 2, "KERNEL32.dll!GetGeoInfoW": 2, "USER32.dll!GetFocus": 3, "USER32.dll!SetWindowDisplayAffinity": 1, "KERNEL32.dll!GetFileType": 15, "KERNEL32.dll!GetFileInformationByHandleEx": 1, "ADVAPI32.dll!ImpersonateNamedPipeClient": 1, "ADVAPI32.dll!RevertToSelf": 3, "USER32.dll!RegisterClassW": 1, "SHELL32.dll!#4": 1, "KERNEL32.dll!GetStartupInfoW": 6, "KERNEL32.dll!lstrcmpiA": 1, "USER32.dll!FindWindowW": 8, "USER32.dll!GetTopWindow": 1, "USER32.dll!SendInput": 4, "USER32.dll!SetWindowsHookExW": 4, "USER32.dll!CallNextHookEx": 5, "USER32.dll!UnhookWindowsHookEx": 7, "USER32.dll!GetLayeredWindowAttributes": 2, "USER32.dll!SetWinEventHook": 10, "USER32.dll!EnumWindows": 8, "ADVAPI32.dll!EventRegister": 2, "ADVAPI32.dll!EventSetInformation": 2, "USER32.dll!MsgWaitForMultipleObjectsEx": 3, "WINMM.dll!timeGetTime": 2, "KERNEL32.dll!GetDynamicTimeZoneInformation": 1, "WS2_32.dll!WSAResetEvent": 6, "KERNEL32.dll!SetFilePointer": 6, "KERNEL32.dll!SetDefaultDllDirectories": 1, "KERNEL32.dll!SetHandleInformation": 2, "ADVAPI32.dll!SetThreadToken": 1, "USER32.dll!CloseDesktop": 2, "USER32.dll!CloseWindowStation": 1, "USER32.dll!SetRect": 1, "KERNEL32.dll!DeviceIoControl": 23, "USER32.dll!GetKeyboardLayoutList": 6, "ole32.dll!RevokeDragDrop": 1, "KERNEL32.dll!SetNamedPipeHandleState": 2, "KERNEL32.dll!TransactNamedPipe": 1, "KERNEL32.dll!WaitNamedPipeW": 2, "ADVAPI32.dll!BuildExplicitAccessWithNameW": 1, "ADVAPI32.dll!BuildSecurityDescriptorW": 1, "KERNEL32.dll!GetLocaleInfoW": 18, "KERNEL32.dll!LocaleNameToLCID": 2, "KERNEL32.dll!GetACP": 7, "USER32.dll!RegisterPowerSettingNotification": 1, "api-ms-win-core-winrt-l1-1-0.dll!RoInitialize": 1, "api-ms-win-core-winrt-l1-1-0.dll!RoUninitialize": 1, "KERNEL32.dll!VirtualAllocEx": 3, "KERNEL32.dll!VirtualFreeEx": 1, "USERENV.dll!DeriveAppContainerSidFromAppContainerName": 2, "ADVAPI32.dll!FreeSid": 4, "KERNEL32.dll!CreateJobObjectW": 2, "KERNEL32.dll!QueryInformationJobObject": 1, "USER32.dll!GetProcessWindowStation": 2, "USER32.dll!CreateWindowStationW": 2, "USER32.dll!SetProcessWindowStation": 2, "USER32.dll!CreateDesktopW": 2, "ole32.dll!RegisterDragDrop": 1, "KERNEL32.dll!CreateSemaphoreW": 5, "KERNEL32.dll!ReleaseSemaphore": 12, "KERNEL32.dll!FormatMessageW": 7, "WINHTTP.dll!WinHttpGetIEProxyConfigForCurrentUser": 2, "KERNEL32.dll!GlobalFree": 14, "KERNEL32.dll!GetFirmwareType": 1, "ole32.dll!StringFromCLSID": 1, "bcryptprimitives.dll!ProcessPrng": 1, "KERNEL32.dll!UnregisterWaitEx": 2, "KERNEL32.dll!ResetEvent": 5, "USER32.dll!KillTimer": 2, "WS2_32.dll!WSADuplicateSocketW": 1, "KERNEL32.dll!TryAcquireSRWLockShared": 1, "USER32.dll!GetWindowTextLengthW": 5, "USER32.dll!GetWindowTextW": 6, "USER32.dll!SetWindowTextW": 1, "USER32.dll!QueryDisplayConfig": 1, "dwmapi.dll!DwmGetCompositionTimingInfo": 2, "KERNEL32.dll!InitializeSListHead": 2, "KERNEL32.dll!OutputDebugStringW": 2, "KERNEL32.dll!HeapAlloc": 15, "KERNEL32.dll!HeapFree": 15, "KERNEL32.dll!FlushInstructionCache": 1, "KERNEL32.dll!InterlockedPushEntrySList": 3, "KERNEL32.dll!InterlockedPopEntrySList": 2, "KERNEL32.dll!DecodePointer": 1, "KERNEL32.dll!LoadLibraryExA": 3, "KERNEL32.dll!EncodePointer": 6, "KERNEL32.dll!IsProcessorFeaturePresent": 6, "KERNEL32.dll!RtlCaptureContext": 4, "KERNEL32.dll!RtlLookupFunctionEntry": 6, "KERNEL32.dll!UnhandledExceptionFilter": 3, "KERNEL32.dll!RtlPcToFileHeader": 4, "KERNEL32.dll!RtlUnwindEx": 3, "KERNEL32.dll!InterlockedFlushSList": 1, "KERNEL32.dll!ExitProcess": 1, "KERNEL32.dll!GetCPInfo": 4, "KERNEL32.dll!ExitThread": 2, "KERNEL32.dll!FreeLibraryAndExitThread": 1, "KERNEL32.dll!GetDriveTypeW": 3, "KERNEL32.dll!PeekNamedPipe": 3, "KERNEL32.dll!SetStdHandle": 2, "KERNEL32.dll!GetFullPathNameW": 11, "KERNEL32.dll!GetConsoleMode": 2, "KERNEL32.dll!ReadConsoleW": 2, "KERNEL32.dll!GetConsoleOutputCP": 1, "KERNEL32.dll!GetStringTypeW": 2, "KERNEL32.dll!CompareStringW": 4, "KERNEL32.dll!FlsAlloc": 2, "KERNEL32.dll!FlsFree": 1, "KERNEL32.dll!FlsGetValue": 1, "KERNEL32.dll!FlsSetValue": 2, "KERNEL32.dll!GetDateFormatW": 2, "KERNEL32.dll!GetTimeFormatW": 1, "KERNEL32.dll!GetUserDefaultLCID": 4, "KERNEL32.dll!InitializeCriticalSectionAndSpinCount": 2, "KERNEL32.dll!IsValidLocale": 2, "KERNEL32.dll!LCMapStringW": 1, "KERNEL32.dll!EnumSystemLocalesW": 4, "KERNEL32.dll!IsValidCodePage": 3, "KERNEL32.dll!GetOEMCP": 1, "KERNEL32.dll!FindNextFileW": 2, "KERNEL32.dll!RtlUnwind": 2, "KERNEL32.dll!TlsFree": 3, "KERNEL32.dll!WriteConsoleW": 3, "USER32.dll!MessageBoxW": 3, "KERNEL32.dll!HeapDestroy": 5, "KERNEL32.dll!HeapReAlloc": 2, "KERNEL32.dll!HeapSize": 2, "dbghelp.dll!SymFromAddr": 2, "KERNEL32.dll!CreateEventA": 1, "WS2_32.dll!getaddrinfo": 2, "WS2_32.dll!freeaddrinfo": 2, "WS2_32.dll!socket": 4, "WS2_32.dll!ntohs": 25, "WS2_32.dll!htons": 12, "WS2_32.dll!ntohl": 37, "WINMM.dll!waveInGetNumDevs": 1, "KERNEL32.dll!LocalAlloc": 1, "WINMM.dll!waveOutOpen": 1, "WINMM.dll!waveOutPause": 1, "WINMM.dll!waveOutRestart": 1, "WINMM.dll!waveOutReset": 2, "WINMM.dll!waveOutClose": 1, "USER32.dll!RegisterRawInputDevices": 3, "KERNEL32.dll!GetSystemTime": 5, "PROPSYS.dll!PSCreateMemoryPropertyStore": 3, "ole32.dll!PropVariantCopy": 1, "KERNEL32.dll!SuspendThread": 4, "KERNEL32.dll!GetThreadContext": 4, "ADVAPI32.dll!EventWriteTransfer": 2, "SHELL32.dll!SHCreateItemFromParsingName": 4, "USERENV.dll!EnterCriticalPolicySection": 2, "USERENV.dll!LeaveCriticalPolicySection": 2, "KERNEL32.dll!CancelIoEx": 1, "USER32.dll!ClipCursor": 3, "KERNEL32.dll!CheckRemoteDebuggerPresent": 1, "OLEAUT32.dll!LoadRegTypeLib": 1, "OLEAUT32.dll!LoadTypeLib": 1, "USER32.dll!CharNextW": 2, "KERNEL32.dll!lstrcmpiW": 20, "ole32.dll!CoTaskMemRealloc": 1, "OLEAUT32.dll!VarUI4FromStr": 1, "ADVAPI32.dll!RegDeleteKeyW": 1, "KERNEL32.dll!LCIDToLocaleName": 1, "KERNEL32.dll!CreateMemoryResourceNotification": 2, "SETUPAPI.dll!SetupDiOpenDeviceInterfaceW": 4, "SETUPAPI.dll!SetupDiEnumDeviceInfo": 2, "KERNEL32.dll!SetCommTimeouts": 1, "KERNEL32.dll!ClearCommError": 1, "KERNEL32.dll!PurgeComm": 3, "KERNEL32.dll!GetCommState": 2, "KERNEL32.dll!SetCommState": 1, "KERNEL32.dll!GetCommModemStatus": 1, "KERNEL32.dll!EscapeCommFunction": 3, "KERNEL32.dll!GetMaximumProcessorGroupCount": 1, "CRYPT32.dll!CryptQueryObject": 1, "CRYPT32.dll!CryptMsgGetParam": 2, "CRYPT32.dll!CertFindCertificateInStore": 2, "CRYPT32.dll!CertGetNameStringW": 2, "CRYPT32.dll!CertFreeCertificateContext": 6, "CRYPT32.dll!CryptMsgClose": 3, "KERNEL32.dll!GetNamedPipeServerProcessId": 1, "SHELL32.dll!SHGetFileInfoW": 2, "SHELL32.dll!SHChangeNotify": 17, "KERNEL32.dll!FindFirstFileW": 3, "ADVAPI32.dll!RegGetValueW": 1, "ADVAPI32.dll!GetSidSubAuthorityCount": 2, "ADVAPI32.dll!GetSidSubAuthority": 2, "SHELL32.dll!SHQueryUserNotificationState": 1, "KERNEL32.dll!AttachConsole": 2, "KERNEL32.dll!GetConsoleDisplayMode": 1, "KERNEL32.dll!FreeConsole": 2, "USER32.dll!EqualRect": 1, "OLEAUT32.dll!SafeArrayGetDim": 15, "OLEAUT32.dll!SafeArrayGetVartype": 18, "OLEAUT32.dll!SafeArrayAccessData": 21, "OLEAUT32.dll!SafeArrayGetLBound": 17, "OLEAUT32.dll!SafeArrayGetUBound": 17, "GDI32.dll!SaveDC": 3, "GDI32.dll!IntersectClipRect": 2, "GDI32.dll!RestoreDC": 2, "GDI32.dll!StretchDIBits": 5, "ADVAPI32.dll!CryptAcquireContextW": 1, "ADVAPI32.dll!CryptGenRandom": 1, "ADVAPI32.dll!CryptReleaseContext": 4, "KERNEL32.dll!FindFirstFileExA": 1, "KERNEL32.dll!FindNextFileA": 1, "GDI32.dll!CreateFontIndirectA": 2, "GDI32.dll!GetOutlineTextMetricsW": 2, "GDI32.dll!GetFontData": 3, "GDI32.dll!GetCharWidthW": 2, "GDI32.dll!GetObjectType": 2, "GDI32.dll!SetStretchBltMode": 4, "GDI32.dll!CreateBitmap": 4, "GDI32.dll!SetDIBitsToDevice": 2, "GDI32.dll!GetClipBox": 1, "GDI32.dll!MoveToEx": 3, "GDI32.dll!LineTo": 3, "GDI32.dll!SetMiterLimit": 1, "GDI32.dll!SetPolyFillMode": 3, "GDI32.dll!StrokeAndFillPath": 1, "GDI32.dll!FillPath": 2, "GDI32.dll!StrokePath": 1, "GDI32.dll!ExtCreatePen": 1, "GDI32.dll!BeginPath": 1, "GDI32.dll!EndPath": 1, "GDI32.dll!CloseFigure": 1, "GDI32.dll!PolyBezierTo": 1, "GDI32.dll!SelectClipPath": 2, "GDI32.dll!WidenPath": 1, "GDI32.dll!CreatePen": 1, "GDI32.dll!CreateCompatibleBitmap": 2, "GDI32.dll!BitBlt": 5, "GDI32.dll!GetDIBits": 4, "KERNEL32.dll!GetSystemDirectoryA": 1, "GDI32.dll!GetClipRgn": 1, "GDI32.dll!GetRegionData": 2, "GDI32.dll!GdiComment": 1, "KERNEL32.dll!GetWindowsDirectoryA": 1, "GDI32.dll!EnumFontFamiliesExA": 2, "GDI32.dll!CreateFontA": 3, "GDI32.dll!GetTextFaceA": 1, "GDI32.dll!EnumFontFamiliesExW": 1, "KERNEL32.dll!FindFirstVolumeW": 2, "KERNEL32.dll!FindVolumeClose": 3, "KERNEL32.dll!FindNextVolumeW": 1, "KERNEL32.dll!EnumResourceNamesW": 1, "USER32.dll!LoadStringW": 1, "KERNEL32.dll!WaitForSingleObjectEx": 5, "KERNEL32.dll!SwitchToThread": 1, "PROPSYS.dll!InitPropVariantFromCLSID": 1, "USER32.dll!GetPointerDevice": 1, "OLEAUT32.dll!VariantCopy": 3, "PROPSYS.dll!VariantCompare": 1, "OLEAUT32.dll!SysAllocStringByteLen": 1, "OLEAUT32.dll!SysStringByteLen": 1, "KERNEL32.dll!AllocConsole": 2, "SHELL32.dll!ShellExecuteExW": 3, "USER32.dll!SetTimer": 1, "KERNEL32.dll!SetFileTime": 5, "KERNEL32.dll!SetFileInformationByHandle": 1, "KERNEL32.dll!MoveFileExW": 3, "KERNEL32.dll!CreateHardLinkW": 2, "KERNEL32.dll!CopyFileW": 1, "KERNEL32.dll!HeapCreate": 2, "ADVAPI32.dll!RegisterEventSourceA": 1, "ADVAPI32.dll!ReportEventA": 1, "ADVAPI32.dll!DeregisterEventSource": 1, "KERNEL32.dll!GetCurrentProcessorNumber": 4, "ADVAPI32.dll!CryptGetProvParam": 2, "CRYPT32.dll!CryptAcquireCertificatePrivateKey": 1, "ADVAPI32.dll!CryptDestroyHash": 3, "ADVAPI32.dll!CryptCreateHash": 1, "ADVAPI32.dll!CryptGetHashParam": 1, "ADVAPI32.dll!CryptSetHashParam": 1, "ADVAPI32.dll!CryptSignHashW": 2, "WS2_32.dll!gethostname": 1, "WS2_32.dll!getsockopt": 5, "WS2_32.dll!getpeername": 2, "WS2_32.dll!recvfrom": 2, "WS2_32.dll!send": 1, "WS2_32.dll!sendto": 2, "WS2_32.dll!WSAWaitForMultipleEvents": 1, "WS2_32.dll!WSASetEvent": 1, "KERNEL32.dll!GetProcessAffinityMask": 2, "KERNEL32.dll!GetEnvironmentVariableA": 2, "KERNEL32.dll!SetEnvironmentVariableA": 2, "USER32.dll!RegisterClipboardFormatW": 1, "USER32.dll!RegisterHotKey": 1, "USER32.dll!UnregisterHotKey": 1, "api-ms-win-core-handle-l1-1-0.dll!CompareObjectHandles": 2, "USER32.dll!CreateIconIndirect": 2, "USER32.dll!GetIconInfo": 4, "USER32.dll!DrawIconEx": 2, "GDI32.dll!SetDIBits": 1, "GDI32.dll!SetBkMode": 2, "GDI32.dll!ModifyWorldTransform": 4, "USER32.dll!GetKeyboardState": 4, "USER32.dll!SetKeyboardState": 3, "ole32.dll!CoCreateGuid": 2, "KERNEL32.dll!DeleteFileA": 2, "KERNEL32.dll!MapViewOfFileEx": 1, "KERNEL32.dll!CreateWaitableTimerExW": 1, "KERNEL32.dll!SetWaitableTimer": 1, "OLEAUT32.dll!SafeArrayUnaccessData": 38, "OLEAUT32.dll!SafeArrayDestroy": 24, "USER32.dll!UnhookWinEvent": 2, "OLEAUT32.dll!SafeArrayCreateVector": 24, "OLEAUT32.dll!SafeArrayPutElement": 2, "SHLWAPI.dll!AssocQueryStringW": 2, "SHELL32.dll!SHCreateAssociationRegistration": 1, "SHELL32.dll!SHGetDesktopFolder": 2, "SHELL32.dll!SHOpenFolderAndSelectItems": 1, "SHELL32.dll!ShellExecuteA": 1, "KERNEL32.dll!SetConsoleTextAttribute": 1, "KERNEL32.dll!UnregisterWait": 1, "UxTheme.dll!OpenThemeData": 1, "UxTheme.dll!DrawThemeBackground": 6, "USER32.dll!DrawEdge": 2, "USER32.dll!DrawFrameControl": 5, "GDI32.dll!GetWorldTransform": 2, "USER32.dll!GetSysColorBrush": 2, "USER32.dll!FrameRect": 1, "USER32.dll!InflateRect": 3, "USER32.dll!DrawFocusRect": 1, "GDI32.dll!SetBkColor": 3, "GDI32.dll!SetTextColor": 3, "UxTheme.dll!#47": 2, "USER32.dll!InvertRect": 1, "UxTheme.dll!GetThemeBackgroundContentRect": 1, "USER32.dll!PrintWindow": 3, "USER32.dll!TrackPopupMenu": 1, "USER32.dll!GetMessagePos": 1, "USER32.dll!FlashWindowEx": 1, "USER32.dll!SetCapture": 1, "USER32.dll!ReleaseCapture": 1, "USER32.dll!CloseTouchInputHandle": 2, "USER32.dll!GetRawInputData": 2, "USER32.dll!DefRawInputProc": 1, "USER32.dll!InvalidateRect": 1, "USER32.dll!SetMenuDefaultItem": 1, "USER32.dll!GetPointerPenInfo": 1, "SHELL32.dll!#190": 3, "SHELL32.dll!#155": 3, "SHELL32.dll!ShellExecuteW": 4, "USER32.dll!MoveWindow": 1, "GDI32.dll!DeleteEnhMetaFile": 2, "GDI32.dll!CreateEnhMetaFileW": 1, "GDI32.dll!SetEnhMetaFileBits": 1, "GDI32.dll!CloseEnhMetaFile": 1, "GDI32.dll!PlayEnhMetaFile": 1, "GDI32.dll!EnumEnhMetaFile": 2, "GDI32.dll!GetEnhMetaFileHeader": 1, "GDI32.dll!GetEnhMetaFileBits": 2, "GDI32.dll!PlayEnhMetaFileRecord": 1, "GDI32.dll!ExtEscape": 8, "ole32.dll!CreateStreamOnHGlobal": 5, "WINSPOOL.DRV!DeviceCapabilitiesW": 6, "IPHLPAPI.DLL!IpReleaseAddress": 1, "IPHLPAPI.DLL!IpRenewAddress": 1, "IPHLPAPI.DLL!GetInterfaceInfo": 2, "GDI32.dll!GetCurrentObject": 3, "CRYPT32.dll!CertGetNameStringA": 2, "ole32.dll!CoRegisterInitializeSpy": 1, "ole32.dll!CoRevokeInitializeSpy": 1, "ADVAPI32.dll!GetTraceLoggerHandle": 1, "ADVAPI32.dll!GetTraceEnableFlags": 1, "ADVAPI32.dll!GetTraceEnableLevel": 1, "ADVAPI32.dll!TraceEvent": 1, "dbghelp.dll!SymCleanup": 2, "dbghelp.dll!SymSetOptions": 1, "dbghelp.dll!SymGetSearchPathW": 1, "dbghelp.dll!SymSetSearchPathW": 1, "dbghelp.dll!SymGetLineFromAddr64": 1, "dbghelp.dll!SymInitialize": 3, "USER32.dll!UnregisterSuspendResumeNotification": 1, "KERNEL32.dll!ResolveLocaleName": 2, "KERNEL32.dll!GetCurrencyFormatEx": 1, "KERNEL32.dll!GetNumberFormatEx": 1, "KERNEL32.dll!GetDateFormatEx": 3, "KERNEL32.dll!GetTimeFormatEx": 3, "KERNEL32.dll!CreateFileA": 2, "WS2_32.dll!WSAGetOverlappedResult": 3, "WS2_32.dll!WSARecvFrom": 1, "WS2_32.dll!WSASendTo": 1, "WS2_32.dll!WSASetLastError": 1, "CRYPT32.dll!CertGetEnhancedKeyUsage": 2, "ADVAPI32.dll!ProcessTrace": 1, "ADVAPI32.dll!OpenTraceW": 1, "KERNEL32.dll!SleepConditionVariableCS": 2, "KERNEL32.dll!GetThreadGroupAffinity": 1, "KERNEL32.dll!QueryFullProcessImageNameW": 2, "USER32.dll!GetClassNameW": 4, "USER32.dll!GetCursorInfo": 1, "USER32.dll!EnumDisplaySettingsExW": 2, "USER32.dll!GetClipboardData": 13, "KERNEL32.dll!GlobalSize": 17, "KERNEL32.dll!GlobalLock": 43, "KERNEL32.dll!GlobalUnlock": 43, "USER32.dll!OpenClipboard": 5, "ADVAPI32.dll!ImpersonateAnonymousToken": 1, "USER32.dll!CloseClipboard": 1, "USER32.dll!GetClipboardSequenceNumber": 1, "USER32.dll!IsClipboardFormatAvailable": 10, "USER32.dll!EmptyClipboard": 2, "SHELL32.dll!DragQueryFileW": 4, "KERNEL32.dll!GlobalAlloc": 11, "USER32.dll!SetClipboardData": 2, "USER32.dll!GetGuiResources": 1, "GDI32.dll!SetBrushOrgEx": 1, "GDI32.dll!SetArcDirection": 1, "GDI32.dll!SetDCBrushColor": 1, "GDI32.dll!SetDCPenColor": 1, "GDI32.dll!SetROP2": 1, "GDI32.dll!GdiAlphaBlend": 1, "USER32.dll!PtInRect": 1, "SHLWAPI.dll!#12": 2, "ole32.dll!CreateILockBytesOnHGlobal": 2, "ole32.dll!StgCreateDocfileOnILockBytes": 2, "ole32.dll!ReleaseStgMedium": 14, "ole32.dll!OleDuplicateData": 1, "ADVAPI32.dll!RegDisablePredefinedCache": 1, "KERNEL32.dll!GetUserDefaultLangID": 1, "KERNEL32.dll!GetUserDefaultLocaleName": 1, "WINMM.dll!midiInAddBuffer": 2, "WINMM.dll!midiOutUnprepareHeader": 2, "WINMM.dll!midiInGetNumDevs": 1, "WINMM.dll!midiOutGetNumDevs": 1, "WINMM.dll!midiOutClose": 3, "WINMM.dll!midiOutShortMsg": 1, "WINMM.dll!midiOutPrepareHeader": 1, "WINMM.dll!midiOutLongMsg": 1, "WINMM.dll!midiInReset": 1, "WINMM.dll!midiInUnprepareHeader": 2, "WINMM.dll!midiInClose": 3, "WINMM.dll!midiOutReset": 1, "WINMM.dll!midiInOpen": 1, "WINMM.dll!midiInPrepareHeader": 1, "WINMM.dll!midiInStart": 1, "WINMM.dll!midiOutOpen": 1, "PROPSYS.dll!PSGetPropertyKeyFromName": 1, "IPHLPAPI.DLL!GetAdaptersInfo": 2, "CRYPT32.dll!CertOpenSystemStoreW": 1, "CRYPT32.dll!CertFindChainInStore": 1, "CRYPT32.dll!CertGetIntendedKeyUsage": 1, "CRYPT32.dll!CertVerifyTimeValidity": 1, "CRYPT32.dll!CertGetCertificateContextProperty": 1, "USER32.dll!ShowCursor": 1, "USER32.dll!SetCursorPos": 2, "USER32.dll!GetWindowDisplayAffinity": 1, "ole32.dll!CoAllowSetForegroundWindow": 1, "GDI32.dll!SetAbortProc": 1, "GDI32.dll!StartDocW": 1, "GDI32.dll!StartPage": 1, "GDI32.dll!EndPage": 1, "GDI32.dll!EndDoc": 1, "GDI32.dll!CancelDC": 1, "ole32.dll!GetHGlobalFromStream": 2, "USER32.dll!CharToOemBuffW": 1, "KERNEL32.dll!SleepEx": 1, "SHELL32.dll!#2": 1, "USER32.dll!GetAsyncKeyState": 1, "USER32.dll!MessageBeep": 1, "ADVAPI32.dll!EventUnregister": 1, "ADVAPI32.dll!EventWrite": 1, "KERNEL32.dll!GetThreadPriorityBoost": 1, "KERNEL32.dll!SetThreadPriorityBoost": 2, "ADVAPI32.dll!ControlTraceW": 2, "ADVAPI32.dll!StartTraceW": 1, "USER32.dll!GetMonitorInfoA": 2, "USER32.dll!BringWindowToTop": 2, "USER32.dll!SendMessageTimeoutW": 6, "KERNEL32.dll!WTSGetActiveConsoleSessionId": 1, "SHLWAPI.dll!PathFindExtensionW": 1, "KERNEL32.dll!GetPrivateProfileStringW": 1, "SHLWAPI.dll!PathRemoveExtensionW": 1, "SHLWAPI.dll!PathFindFileNameW": 1, "ole32.dll!GetHGlobalFromILockBytes": 1, "WS2_32.dll!WSASetServiceW": 2, "KERNEL32.dll!SetProcessMitigationPolicy": 1, "KERNEL32.dll!SetThreadAffinityMask": 3, "KERNEL32.dll!GetProcessHandleCount": 1, "KERNEL32.dll!EnumSystemLocalesEx": 1, "Secur32.dll!AcquireCredentialsHandleW": 1, "Secur32.dll!InitializeSecurityContextW": 1, "Secur32.dll!QueryContextAttributesW": 1, "Secur32.dll!QuerySecurityPackageInfoW": 1, "Secur32.dll!FreeCredentialsHandle": 1, "Secur32.dll!DeleteSecurityContext": 1, "CFGMGR32.dll!CM_Locate_DevNodeW": 1, "CFGMGR32.dll!CM_Get_Parent": 1, "CFGMGR32.dll!CM_Get_DevNode_PropertyW": 2, "ADVAPI32.dll!AllocateLocallyUniqueId": 1, "ADVAPI32.dll!LogonUserW": 1, "CRYPT32.dll!CertAddEncodedCertificateToStore": 1, "CRYPT32.dll!CryptVerifyCertificateSignatureEx": 1, "CRYPT32.dll!CertCompareCertificateName": 1, "SHELL32.dll!Shell_NotifyIconW": 7, "USER32.dll!MapVirtualKeyExW": 1, "USER32.dll!ToUnicodeEx": 2, "ole32.dll!DoDragDrop": 1, "COMDLG32.dll!PrintDlgExW": 1, "ADVAPI32.dll!OpenSCManagerW": 1, "ADVAPI32.dll!CloseServiceHandle": 3, "ADVAPI32.dll!OpenServiceW": 1, "ADVAPI32.dll!QueryServiceStatus": 1, "SHELL32.dll!SHGetMalloc": 1, "SHELL32.dll!SHGetPathFromIDListW": 3, "KERNEL32.dll!FoldStringW": 2, "KERNEL32.dll!LCMapStringEx": 3, "KERNEL32.dll!FileTimeToLocalFileTime": 1, "KERNEL32.dll!LocalFileTimeToFileTime": 1, "USER32.dll!OemToCharBuffA": 1, "USER32.dll!OemToCharA": 1, "KERNEL32.dll!SetThreadExecutionState": 1, "ADVAPI32.dll!AllocateAndInitializeSid": 1, "ADVAPI32.dll!CheckTokenMembership": 1, "ADVAPI32.dll!SetFileSecurityW": 3, "KERNEL32.dll!GetShortPathNameW": 2, "KERNEL32.dll!VirtualQueryEx": 1, "KERNEL32.dll!RemoveVectoredExceptionHandler": 1, "KERNEL32.dll!GetFileTime": 2, "KERNEL32.dll!GetVolumePathNamesForVolumeNameW": 1, "KERNEL32.dll!GetVolumeNameForVolumeMountPointW": 2, "KERNEL32.dll!QueryDosDeviceW": 2, "USER32.dll!GetClassLongPtrW": 4, "SHELL32.dll!SHGetStockIconInfo": 1, "USER32.dll!SetThreadDesktop": 1, "USER32.dll!OpenInputDesktop": 1, "KERNEL32.dll!GetProcessHeaps": 3, "USERENV.dll!CreateAppContainerProfile": 1, "WINHTTP.dll!WinHttpCloseHandle": 5, "WINHTTP.dll!WinHttpOpen": 3, "WINHTTP.dll!WinHttpSetTimeouts": 3, "WINHTTP.dll!WinHttpGetProxyForUrl": 2, "OLEAUT32.dll!VariantTimeToSystemTime": 1, "SHELL32.dll!SHAppBarMessage": 3, "WINHTTP.dll!WinHttpCrackUrl": 1, "WINHTTP.dll!WinHttpConnect": 1, "WINHTTP.dll!WinHttpOpenRequest": 1, "WINHTTP.dll!WinHttpAddRequestHeaders": 2, "WINHTTP.dll!WinHttpSendRequest": 1, "WINHTTP.dll!WinHttpReceiveResponse": 1, "WINHTTP.dll!WinHttpQueryHeaders": 1, "KERNEL32.dll!VerSetConditionMask": 1, "KERNEL32.dll!Wow64GetThreadContext": 1, "WS2_32.dll!WSAEnumNameSpaceProvidersW": 2, "WINHTTP.dll!WinHttpSetStatusCallback": 2, "WINHTTP.dll!WinHttpCreateProxyResolver": 1, "WINHTTP.dll!WinHttpGetProxyForUrlEx": 1, "WINHTTP.dll!WinHttpGetProxyResult": 1, "WINHTTP.dll!WinHttpFreeProxyResult": 1, "KERNEL32.dll!GetFileAttributesA": 2, "WININET.dll!GetUrlCacheEntryInfoExW": 2, "KERNEL32.dll!CreateRemoteThread": 1, "KERNEL32.dll!GetSystemDefaultLCID": 1, "KERNEL32.dll!GetThreadLocale": 1, "USER32.dll!DestroyMenu": 2, "USER32.dll!CreatePopupMenu": 1, "USER32.dll!SetMenuInfo": 1, "USER32.dll!InsertMenuItemW": 2, "USER32.dll!GetMenuInfo": 1, "USER32.dll!GetMenuItemInfoW": 2, "USER32.dll!SetMenuItemInfoW": 2, "USER32.dll!GetMenuItemCount": 1, "KERNEL32.dll!SetDllDirectoryW": 2, "CRYPT32.dll!CryptProtectMemory": 1, "CRYPT32.dll!CryptUnprotectMemory": 1, "KERNEL32.dll!K32GetPerformanceInfo": 1, "dxgi.dll!CreateDXGIFactory1": 1, "MFPlat.DLL!MFCreateDXGIDeviceManager": 1, "d3d11.dll!D3D11CreateDevice": 1, "MFPlat.DLL!MFCreateSample": 1, "MFPlat.DLL!MFCreateMemoryBuffer": 1, "MFPlat.DLL!MFCreateAlignedMemoryBuffer": 1, "MFPlat.DLL!MFCreateMediaType": 1, "MFPlat.DLL!MFInitMediaTypeFromWaveFormatEx": 1, "MFPlat.DLL!MFCreateDXGISurfaceBuffer": 1, "MFPlat.DLL!MFShutdown": 1, "MFPlat.DLL!MFStartup": 1, "MFPlat.DLL!MFCreateMediaEvent": 1, "MFPlat.DLL!MFTEnumEx": 1, "MFPlat.DLL!MFCreateWaveFormatExFromMFMediaType": 1, "MFPlat.DLL!MFCreateAsyncResult": 1, "MFPlat.DLL!MFCreateMediaBufferWrapper": 1, "MFPlat.DLL!MFUnlockDXGIDeviceManager": 1, "MFPlat.DLL!MFCreateAttributes": 1, "MFPlat.DLL!MFLockDXGIDeviceManager": 1, "MFPlat.DLL!MFCreateEventQueue": 1, "MFPlat.DLL!MFCreatePresentationDescriptor": 1, "MFPlat.DLL!MFCreateStreamDescriptor": 1, "MF.dll!MFCreateDeviceSource": 1, "MF.dll!MFEnumDeviceSources": 1, "MFReadWrite.dll!MFCreateSourceReaderFromMediaSource": 1, "MFPlat.DLL!MFGetSystemTime": 1, "NETAPI32.dll!NetGetJoinInformation": 1, "NETAPI32.dll!NetApiBufferFree": 1, "Secur32.dll!GetUserNameExW": 1, "ADVAPI32.dll!ConvertStringSecurityDescriptorToSecurityDescriptorW": 1, "UIAutomationCore.DLL!UiaRaiseAutomationEvent": 1, "UIAutomationCore.DLL!UiaRaiseAutomationPropertyChangedEvent": 1, "UIAutomationCore.DLL!UiaRaiseStructureChangedEvent": 1, "KERNEL32.dll!K32EnumProcessModules": 1, "OLEACC.dll!CreateStdAccessibleObject": 1, "UIAutomationCore.DLL!UiaReturnRawElementProvider": 1, "OLEACC.dll!LresultFromObject": 1, "WTSAPI32.dll!WTSRegisterSessionNotification": 1, "WTSAPI32.dll!WTSUnRegisterSessionNotification": 1, "pdh.dll!PdhAddEnglishCounterW": 1, "pdh.dll!PdhCollectQueryData": 1, "pdh.dll!PdhGetFormattedCounterValue": 1, "pdh.dll!PdhCloseQuery": 1, "HID.DLL!HidD_GetPreparsedData": 1, "HID.DLL!HidP_GetCaps": 1, "HID.DLL!HidD_FreePreparsedData": 1, "HID.DLL!HidD_GetAttributes": 1, "HID.DLL!HidD_GetProductString": 1, "HID.DLL!HidD_GetSerialNumberString": 1, "WINTRUST.dll!WinVerifyTrust": 1, "WINTRUST.dll!WTHelperProvDataFromStateData": 1, "WINTRUST.dll!CryptCATAdminAcquireContext": 1, "WINTRUST.dll!CryptCATAdminCalcHashFromFileHandle": 1, "WINTRUST.dll!CryptCATAdminEnumCatalogFromHash": 1, "WINTRUST.dll!CryptCATCatalogInfoFromContext": 1, "WINTRUST.dll!CryptCATAdminReleaseContext": 1, "WINTRUST.dll!CryptCATAdminReleaseCatalogContext": 1, "ADVAPI32.dll!ConvertSidToStringSidW": 1, "ADVAPI32.dll!ConvertSidToStringSidA": 1, "CRYPT32.dll!CryptProtectData": 1, "CRYPT32.dll!CryptUnprotectData": 1, "WTSAPI32.dll!WTSQuerySessionInformationW": 1, "WTSAPI32.dll!WTSFreeMemory": 1, "KERNEL32.dll!AreFileApisANSI": 1, "chrome_elf.dll!IsExtensionPointDisableSet": 1, "chrome_elf.dll!SignalChromeElf": 1, "chrome_elf.dll!SignalInitializeCrashReporting": 1, "KERNEL32.dll!K32QueryWorkingSetEx": 1, "api-ms-win-shcore-scaling-l1-1-1.dll!SetProcessDpiAwareness": 1, "api-ms-win-power-base-l1-1-0.dll!PowerDeterminePlatformRoleEx": 1, "ADVAPI32.dll!ConvertStringSidToSidW": 1, "OLEAUT32.dll!VarBstrCmp": 1, "pdh.dll!PdhOpenQueryW": 1, "api-ms-win-core-winrt-string-l1-1-0.dll!WindowsDeleteString": 1, "api-ms-win-core-winrt-string-l1-1-0.dll!WindowsCreateString": 1, "api-ms-win-core-winrt-string-l1-1-0.dll!WindowsGetStringRawBuffer": 1, "ntdll.dll!NtDeleteKey": 1, "ntdll.dll!RtlGetLastNtStatus": 1, "ntdll.dll!NtQuerySystemInformation": 1, "KERNEL32.dll!CreateToolhelp32Snapshot": 1, "KERNEL32.dll!Process32FirstW": 1, "KERNEL32.dll!Process32NextW": 1, "USERENV.dll!CreateEnvironmentBlock": 1, "USERENV.dll!DestroyEnvironmentBlock": 1, "VERSION.dll!GetFileVersionInfoSizeW": 1, "VERSION.dll!GetFileVersionInfoW": 1, "VERSION.dll!VerQueryValueW": 1, "api-ms-win-power-base-l1-1-0.dll!CallNtPowerInformation": 1, "ncrypt.dll!NCryptFreeObject": 1, "ncrypt.dll!NCryptGetProperty": 1, "ncrypt.dll!NCryptSignHash": 1, "WS2_32.dll!inet_ntop": 1, "api-ms-win-shcore-scaling-l1-1-1.dll!GetDpiForMonitor": 1, "KERNEL32.dll!K32GetProcessMemoryInfo": 1, "KERNEL32.dll!GetFileSize": 1, "OLEACC.dll!AccessibleObjectFromWindow": 1, "OLEACC.dll!WindowFromAccessibleObject": 1, "KERNEL32.dll!K32GetModuleInformation": 1, "UIAutomationCore.DLL!UiaGetReservedNotSupportedValue": 1, "UIAutomationCore.DLL!UiaGetReservedMixedAttributeValue": 1, "UIAutomationCore.DLL!UiaHostProviderFromHwnd": 1, "chrome_elf.dll!InjectDumpForHungInput_ExportThunk": 1, "chrome_elf.dll!SetMetricsClientId": 1, "SHELL32.dll!SHGetKnownFolderPath": 1, "WINSPOOL.DRV!ClosePrinter": 1, "WINSPOOL.DRV!OpenPrinterW": 1, "WINSPOOL.DRV!DocumentPropertiesW": 1, "chrome_elf.dll!GetCrashReports_ExportThunk": 1, "chrome_elf.dll!RequestSingleCrashUpload_ExportThunk": 1, "chrome_elf.dll!GetCrashpadDatabasePath_ExportThunk": 1, "chrome_elf.dll!ClearReportsBetween_ExportThunk": 1, "KERNEL32.dll!WerSetFlags": 1, "chrome_elf.dll!CrashForException_ExportThunk": 1, "WINTRUST.dll!WTHelperGetProvSignerFromChain": 1, "WINTRUST.dll!WTHelperGetProvCertFromChain": 1, "KERNEL32.dll!DiscardVirtualMemory": 1, "ncrypt.dll!NCryptOpenStorageProvider": 1, "ncrypt.dll!NCryptImportKey": 1, "ncrypt.dll!NCryptIsAlgSupported": 1, "ncrypt.dll!NCryptCreatePersistedKey": 1, "ncrypt.dll!NCryptFinalizeKey": 1, "ncrypt.dll!NCryptExportKey": 1, "ncrypt.dll!NCryptDeleteKey": 1, "ncrypt.dll!NCryptOpenKey": 1, "FONTSUB.dll!CreateFontPackage": 1, "KERNEL32.dll!GetDiskFreeSpaceA": 1, "KERNEL32.dll!GetDiskFreeSpaceW": 1, "KERNEL32.dll!GetFullPathNameA": 1, "KERNEL32.dll!HeapValidate": 1, "KERNEL32.dll!HeapCompact": 1, "KERNEL32.dll!LockFile": 1, "KERNEL32.dll!UnlockFile": 1, "OLEACC.dll!AccessibleChildren": 1, "api-ms-win-power-setting-l1-1-0.dll!PowerGetActiveScheme": 1, "api-ms-win-power-setting-l1-1-0.dll!PowerReadACValue": 1, "api-ms-win-power-setting-l1-1-0.dll!PowerReadDCValue": 1, "NETAPI32.dll!DsRoleGetPrimaryDomainInformation": 1, "NETAPI32.dll!DsRoleFreeMemory": 1, "chrome_elf.dll!SetUploadConsent_ExportThunk": 1, "urlmon.dll!CoInternetCreateSecurityManager": 1, "KERNEL32.dll!K32GetModuleFileNameExW": 1, "ntdll.dll!NtClose": 1, "ntdll.dll!RtlInitUnicodeString": 1, "ntdll.dll!NtSetValueKey": 1, "ntdll.dll!RtlFormatCurrentUserKeyPath": 1, "ntdll.dll!RtlFreeUnicodeString": 1, "ntdll.dll!NtCreateKey": 1, "WINSPOOL.DRV!EnumPrintersW": 1, "WINSPOOL.DRV!GetPrinterDriverW": 1, "WINSPOOL.DRV!GetPrinterW": 1, "WINSPOOL.DRV!#203": 1, "SHELL32.dll!SHGetSpecialFolderLocation": 1, "ntdll.dll!NtQueryInformationThread": 1, "Secur32.dll!FreeContextBuffer": 1, "NETAPI32.dll!NetUserGetInfo": 1, "Secur32.dll!LsaConnectUntrusted": 1, "Secur32.dll!LsaLogonUser": 1, "Secur32.dll!LsaFreeReturnBuffer": 1, "ADVAPI32.dll!LsaNtStatusToWinError": 1, "Secur32.dll!LsaDeregisterLogonProcess": 1, "api-ms-win-core-winrt-string-l1-1-0.dll!WindowsCreateStringReference": 1, "NDFAPI.DLL!NdfCreateWebIncident": 1, "NDFAPI.DLL!NdfExecuteDiagnosis": 1, "NDFAPI.DLL!NdfCloseIncident": 1, "chrome_elf.dll!IsThirdPartyInitialized": 1, "IMM32.dll!ImmGetIMEFileNameW": 1, "KERNEL32.dll!Module32FirstW": 1, "KERNEL32.dll!Module32NextW": 1, "chrome_elf.dll!DumpHungProcessWithPtype_ExportThunk": 1, "MFPlat.DLL!MFFrameRateToAverageTimePerFrame": 1, "SHLWAPI.dll!#219": 1, "CRYPTUI.dll!CryptUIDlgCertMgr": 1, "bthprops.cpl!BluetoothFindFirstRadio": 1, "bthprops.cpl!BluetoothGetRadioInfo": 1, "bthprops.cpl!BluetoothFindRadioClose": 1, "bthprops.cpl!BluetoothIsConnectable": 1, "bthprops.cpl!BluetoothFindFirstDevice": 1, "bthprops.cpl!BluetoothFindNextDevice": 1, "bthprops.cpl!BluetoothFindDeviceClose": 1, "bthprops.cpl!BluetoothEnableDiscovery": 1, "bthprops.cpl!BluetoothEnableIncomingConnections": 1, "bthprops.cpl!BluetoothSdpGetAttributeValue": 1, "bthprops.cpl!BluetoothSdpGetContainerElementData": 1, "wevtapi.dll!EvtRender": 1, "wevtapi.dll!EvtNext": 1, "wevtapi.dll!EvtQuery": 1, "wevtapi.dll!EvtCreateRenderContext": 1, "wevtapi.dll!EvtClose": 1, "CRYPTUI.dll!CryptUIDlgViewCertificateW": 1, "USER32.dll!DdeInitializeW": 1, "USER32.dll!DdeCreateStringHandleW": 1, "USER32.dll!DdeConnect": 1, "USER32.dll!DdeFreeStringHandle": 1, "USER32.dll!DdeClientTransaction": 1, "USER32.dll!DdeDisconnect": 1, "USER32.dll!DdeGetLastError": 1, "USER32.dll!DdeUninitialize": 1, "NETAPI32.dll!NetGetAadJoinInformation": 1, "NETAPI32.dll!NetFreeAadJoinInformation": 1, "WINUSB.DLL!WinUsb_ReadPipe": 1, "WINUSB.DLL!WinUsb_WritePipe": 1, "WINUSB.DLL!WinUsb_Initialize": 1, "WINUSB.DLL!WinUsb_GetAssociatedInterface": 1, "WINUSB.DLL!WinUsb_ControlTransfer": 1, "WINUSB.DLL!WinUsb_SetCurrentAlternateSetting": 1, "WINUSB.DLL!WinUsb_ResetPipe": 1, "WINUSB.DLL!WinUsb_GetOverlappedResult": 1, "WS2_32.dll!WSCEnumProtocols": 1, "WS2_32.dll!WSCGetProviderPath": 1, "dhcpcsvc.DLL!DhcpRequestParams": 1, "WINUSB.DLL!WinUsb_Free": 1, "dhcpcsvc.DLL!DhcpCApiInitialize": 1, "d3d12.dll!#101": 1, "ESENT.dll!JetCloseTable": 1, "ESENT.dll!JetMove": 1, "ESENT.dll!JetRetrieveColumn": 1, "ESENT.dll!JetGetTableColumnInfoW": 1, "ESENT.dll!JetTerm": 1, "ESENT.dll!JetSetSystemParameterW": 1, "ESENT.dll!JetCreateInstanceW": 1, "ESENT.dll!JetInit": 1, "ESENT.dll!JetBeginSessionW": 1, "ESENT.dll!JetAttachDatabase2W": 1, "ESENT.dll!JetOpenDatabaseW": 1, "ESENT.dll!JetOpenTableW": 1 }, "complete_linear_sweep": true }