Extended Key Usages
ExtKeyUsageCodeSigning
Static task
static1
Behavioral task
behavioral1
Sample
88be913370bc486fb6d20efa099f3e90N.dll
Resource
win10v2004-20240709-en
Target
88be913370bc486fb6d20efa099f3e90N.exe
Size
812KB
MD5
88be913370bc486fb6d20efa099f3e90
SHA1
e109b02bb941d5cc96854b50eb85db1b98858d25
SHA256
dd386ee271360fc4053837e7b64bda9cda4d11ad72f0b2a5c6c65677bfbeafcd
SHA512
fd13e575265d7454b167638c0b29ceb1e7dbb7c25edf183006e35ddaba77406b623dc7a1f2f1f1461f6ff7968b7c66fc4445bd58a8b55d138a31a3a5f5ca0dd7
SSDEEP
24576:60FPpmXEqXvwJc0Ly8wRwa1kRBPAR7UvPN:60BpvJ4UPAR7UvPN
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
TurboStack.pdb
_initterm
_initterm_e
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__wcsicmp
_o__wcsnicmp
_o__wsplitpath_s
memmove
_o_free
_o_isdigit
_o_malloc
_o_terminate
_o_tolower
_o_wcstoul
__C_specific_handler
wcschr
wcsrchr
wcsstr
__CxxFrameHandler3
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_CxxThrowException
memcmp
memcpy
wcsncmp
memset
?RtlTraceFormat_PCLUTF8_STRING_AsLiteralString@Rtl@WCP@Windows@@YAXPEAUIRtlFormattedOutputStream@13@PEBX@Z
?RtlTraceFormat_IRtlDefinitionAppId@Rtl@WCP@Windows@@YAXPEAUIRtlFormattedOutputStream@13@PEBX@Z
?ParseProcessorArchitecture@Rtl@Identity@Windows@@YAJAEBU_LUNICODE_STRING@@PEAVPSEUDO_ARCH@123@PEA_N@Z
?CompareIdentityAttributeValue@Rtl@Identity@Windows@@YAJPEBU_LUNICODE_STRING@@0PEAH@Z
RtlDuplicateLUnicodeString
RtlDecodeUtf16LE
RtlEncodeUtf16LE
?ParseFromBlob@WcpManifest@@QEAAJAEBU_LBLOB@@PEAVStopWatch@Rtl@Windows@@@Z
?Initialize@CComponentAccessor@@QEAAJPEAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@PEAUIRtlIdentityAuthority@345@@Z
RtlSmartUcsEncoder_Utf16LE
ApplyTransactionPOQsToSil
WriteWinnersFromChangelist
??0CRawInstallMap@InstallMap@@QEAA@XZ
??1CRawInstallMap@InstallMap@@QEAA@XZ
?Initialize@CRawInstallMap@InstallMap@@QEAAJ_NPEAUIRtlIdentityAuthority@Rtl@Identity@Windows@@PEAUIRtlKey@46@PEAUIRtlSystemIsolationLayer@46@@Z
?OpenFamilyMap@CRawInstallMap@InstallMap@@QEAAJ_NPEAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@PEAUMapForFamily@2@PEA_N@Z
?AddInstallMarkToFamily@CRawInstallMap@InstallMap@@QEAAJPEAUMapForFamily@2@AEBT_FOUR_PART_VERSION@@@Z
?RemoveInstallMarkFromFamily@CRawInstallMap@InstallMap@@QEAAJPEAUMapForFamily@2@AEBT_FOUR_PART_VERSION@@@Z
?GetComponentWinningVersion@CRawInstallMap@InstallMap@@QEAAJPEAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@PEAT_FOUR_PART_VERSION@@PEA_N_N@Z
?CleanupInstallMap@CRawInstallMap@InstallMap@@QEAAJXZ
RtlHashLUnicodeString
RtlCopyLUnicodeString
??1PrivilegeAcquisition@RtlSystemUtil@@QEAA@XZ
?Acquire@PrivilegeAcquisition@RtlSystemUtil@@QEAAJAEBU?$Vector@$$CBJ@Windows@@@Z
?get_RebootIndicator@LocalInstallerServices@COM@WCP@Windows@@UEAAJPEAW4RebootIndicators@@@Z
DelayExecution
RtlGetEncodingSizeUtf16
RtlDowncaseUCSCharacter
?DoesTargetHaveTestRootCert@@YAJPEAUIRtlSystemIsolationLayerPublic@Rtl@Windows@@PEA_N@Z
?put_RebootIndicator@LocalInstallerServices@COM@WCP@Windows@@UEAAJW4RebootIndicators@@@Z
RtlDecodeUtf8
RtlCombineNtPathSegments
RtlConvertWin32FilePathToNtFilePath
?CoTaskMemFree@COM@Windows@@YAXPEBX@Z
?GetCurrentDllWin32Path@COM@Windows@@YAJPEAXPEAV?$Auto@U_LUNICODE_STRING@@@2@@Z
?VerifyAdvancedInstaller@LocalInstallerServices@COM@WCP@Windows@@UEAAJPEB_W00PEAK@Z
?GetWin32PathOfSiblingFile@COM@Windows@@YAJPEAXPEB_WPEAV?$Auto@U_LUNICODE_STRING@@@2@@Z
?MarkServicingStackCorruptHelper@LocalInstallerServices@COM@WCP@Windows@@UEAAJXZ
RtlCreateDefaultXmlWriter
?ReplaceMacros@LocalInstallerServices@COM@WCP@Windows@@UEAAJKPEB_WPEAPEA_WPEAUIDefinitionIdentity@@@Z
RtlGetAppIdAuthority
ConvertNtStatusToHResult
?Release@LocalInstallerServices@COM@WCP@Windows@@UEAAKXZ
?AddRef@LocalInstallerServices@COM@WCP@Windows@@UEAAKXZ
?QueryInterface@LocalInstallerServices@COM@WCP@Windows@@UEAAJAEBU_GUID@@PEAPEAX@Z
GetFriendlyInstallerName
RtlReportErrorPropagation
RtlReportErrorOrigination
?FileHashAlgorithmToDigest@Rtl@Cms@Windows@@YA?AW4_CMS_HASH_DIGESTMETHOD@23@K@Z
?Close@?$Auto@U_SECURITY_DESCRIPTOR@@@Windows@@QEAAXXZ
?SilCreateKeys@Rtl@Windows@@YAJPEAUIRtlSystemIsolationLayerPublic@12@AEBU_LUNICODE_STRING@@@Z
?SilCreateDirectories@Rtl@Windows@@YAJPEAUIRtlSystemIsolationLayerPublic@12@AEBU_LUNICODE_STRING@@@Z
RtlReplaceSystemPathMappings
RtlGetSystem
?SilGetRegistryDWORD@Rtl@Windows@@YAJKPEAUIRtlKey@12@AEBU_LUNICODE_STRING@@PEAK2@Z
SilCreateBufferedSil
?GetUTF8FileWriterStream@Rtl@Windows@@YAJPEAUIRtlFile@12@PEAV?$Auto@PEAUIRtlWOFOUCSStream@Rtl@Windows@@@2@@Z
MergeTwoChangeLists
?TraceChangeList@Rtl@ComponentStore@Windows@@YAXPEAUIRtlFormattedOutputStream@13@PEBX@Z
??$ReplaceVariablesInStringCallthrough@U_LUNICODE_STRING@@@Rtl@Implementation@WCP@Windows@@YAJPEAXP6A?AU_RTL_UCSCHAR_DECODER_RETURN_VALUE@@PEBE1@ZPEBU_LBLOB@@PEAU_RTL_SMART_LBLOB_UCSCHAR_WRITING_CONTEXT@@@Z
ConvertHResultToNtStatus
?CompareSecurityDescriptorFromObjectAgainstManifest@Rtl@Implementation@WCP@Windows@@YAJKPEBU_SECURITY_DESCRIPTOR@@0PEA_N@Z
?ResolvePendingPhases@COM@Windows@@YAJKPEAVCQueueExecutor@12@PEA_N@Z
??0AIAsimovProvider@COM@Windows@@QEAA@XZ
?ConvertIn@COM@Windows@@YAJPEAUIDefinitionIdentity@@PEAPEAUIRtlDefinitionIdentity@Rtl@Identity@2@@Z
?FinalizeValue@CComponentInformationTableTraits@COM@Windows@@SAXAEAV?$Auto@PEAVCComponentInformation@COM@Windows@@@3@@Z
?Initialize@CQueueExecutor@COM@Windows@@QEAAJKPEB_WPEAVIComponentStoreHelper@23@PEAUIRtlSystemIsolationLayer@Rtl@3@PEAVCTransactionContent@23@@Z
??1CQueueExecutor@COM@Windows@@QEAA@XZ
??1CComponentInformation@COM@Windows@@QEAA@XZ
ExecuteMidgroundInstallers
?CopyOutPath@COM@Windows@@YAJPEBU_LUNICODE_STRING@@PEAPEA_W@Z
??1CShortcutInstaller@@QEAA@XZ
??1CGacPrimitiveInstaller@@QEAA@XZ
??0CGacPrimitiveInstaller@@QEAA@XZ
?ParseBase16String@Rtl@Implementation@WCP@Windows@@YAJKPEBE0P6A?AU_RTL_UCSCHAR_DECODER_RETURN_VALUE@@00@ZPEAU_LBLOB@@PEA_N@Z
??0CSecurityDescriptorFactory@Rtl@Implementation@WCP@Windows@@QEAA@XZ
??1CSecurityDescriptorFactory@Rtl@Implementation@WCP@Windows@@QEAA@XZ
?DecomposeSecurityDescriptor@Rtl@Implementation@WCP@Windows@@YAJPEBU_SECURITY_DESCRIPTOR@@PEAKPEAV?$Auto@U_SID@@@4@2PEAV?$Auto@U_ACL@@@4@3PEAG@Z
?FormatFourPartVersion@Rtl@Implementation@WCP@Windows@@YAJKAEBT_FOUR_PART_VERSION@@PEAE1P6A?AU_RTL_UCSCHAR_ENCODER_RETURN_VALUE@@K11@ZPEAPEAE@Z
?DecompressManifest@Rtl@Implementation@WCP@Windows@@YAJKPEAV?$Auto@U_LBLOB@@@4@PEAK@Z
??1CSysprepInstaller@@QEAA@XZ
??0CXmlCursor@@QEAA@XZ
?SilGetRegistryString@Rtl@Windows@@YAJKPEAUIRtlSystemIsolationLayerPublic@12@AEBU_LUNICODE_STRING@@1PEAV?$Auto@U_LUNICODE_STRING@@@2@PEAK@Z
?RtlTraceFormat_PCFOUR_PART_VERSION@Rtl@WCP@Windows@@YAXPEAUIRtlFormattedOutputStream@13@PEBX@Z
?RtlTraceFormat_PCULONGLONG@Rtl@WCP@Windows@@YAXPEAUIRtlFormattedOutputStream@13@PEBX@Z
?RtlTraceFormat_PCNTSTATUS@Rtl@WCP@Windows@@YAXPEAUIRtlFormattedOutputStream@13@PEBX@Z
?RtlTraceFormat_PCLONG@Rtl@WCP@Windows@@YAXPEAUIRtlFormattedOutputStream@13@PEBX@Z
?RtlTraceFormat_PCWSTR_AsLiteralString@Rtl@WCP@Windows@@YAXPEAUIRtlFormattedOutputStream@13@PEBX@Z
??1CMigInfoInstaller@@QEAA@XZ
?RtlTraceFormat_PCLUNICODE_STRING_AsLiteralString@Rtl@WCP@Windows@@YAXPEAUIRtlFormattedOutputStream@13@PEBX@Z
?RtlTraceFormat_PCLBLOB@Rtl@WCP@Windows@@YAXPEAUIRtlFormattedOutputStream@13@PEBX@Z
??0CMigInfoInstaller@@QEAA@XZ
?RtlTraceFormat_PCSTR_AsLiteralString@Rtl@WCP@Windows@@YAXPEAUIRtlFormattedOutputStream@13@PEBX@Z
?RtlTraceFormat_PCbool@Rtl@WCP@Windows@@YAXPEAUIRtlFormattedOutputStream@13@PEBX@Z
??0CFileInstaller@@QEAA@XZ
?RtlTraceFormat_PCUSHORT_AsProcessorArchitecture@Rtl@WCP@Windows@@YAXPEAUIRtlFormattedOutputStream@13@PEBX@Z
?RtlTraceFormat_PCULONG@Rtl@WCP@Windows@@YAXPEAUIRtlFormattedOutputStream@13@PEBX@Z
??1CRegistryInstaller@@QEAA@XZ
?RtlTraceVa@Rtl@WCP@Windows@@YAXKKPEAU_RTL_TRACING_FACILITY@123@QEBD_KPEAD@Z
?RtlTraceFormat_PCHRESULT@Rtl@WCP@Windows@@YAXPEAUIRtlFormattedOutputStream@13@PEBX@Z
IsCompactOSEnabled
?RtlTraceFormat_IRtlBaseIdentity@Rtl@WCP@Windows@@YAXPEAUIRtlFormattedOutputStream@13@PEBX@Z
??0CRegistryInstaller@@QEAA@XZ
?RtlIsTracingEnabled@Rtl@WCP@Windows@@YA_NPEAU_RTL_TRACING_FACILITY@123@K@Z
RtlHashLUtf8String
RtlFreeLUtf8String
?RtlTraceFormat@Rtl@WCP@Windows@@YAXPEAUIRtlFormattedOutputStream@13@PEBUIRtlSystemIsolationLayerWithPOQ@13@@Z
?RtlFormatIntoStreamFromParameterList@Rtl@WCP@Windows@@YAXPEAUIRtlFormattedOutputStream@13@QEBD_KQEBU_RTL_TRACING_PARAMETER@123@@Z
?RtlTraceFormat_PCULONG_AsWin32Error@Rtl@WCP@Windows@@YAXPEAUIRtlFormattedOutputStream@13@PEBX@Z
??1CSettingsInstaller@@QEAA@XZ
??1CBackupFileCreator@PrimitiveInstaller@@QEAA@XZ
?Close@?$Auto@U_SID@@@Windows@@QEAAXXZ
??0CBackupFileCreator@PrimitiveInstaller@@QEAA@XZ
IsIdentityPnPDriver
RtlGetIdentityAuthority
?GetOutputStreamStreamFromSink@Tracing@Windows@@YAXPEAUIRtlOutputSink@Rtl@2@PEAPEAUIRtlFormattedOutputStream@42@@Z
?DestroyOutputStream@Tracing@Windows@@YAXPEAUIRtlFormattedOutputStream@Rtl@2@@Z
?Close@?$Auto@U_ACL@@@Windows@@QEAAXXZ
??0CBaseInstaller@PrimitiveInstaller@@IEAA@XZ
RtlGetPendingXmlVersion
RtlSplitNtPath
RtlReallocateLUnicodeString
?Close@CApplicationAccessor@@QEAAXXZ
?Initialize@CApplicationAccessor@@QEAAJPEAUIRtlDefinitionAppId@Rtl@AppId@Windows@@PEAUIRtlAppIdAuthority@345@@Z
?GenerateCatalogThumbprint@@YAJPEBU_LBLOB@@PEAV?$Auto@U_LUNICODE_STRING@@@Windows@@@Z
RtlSmartMultiUcsEncoder_Utf16LE
?RtlRunPrimitiveOperationsInXmlAgainstSil@@YAJW4RtlRunPrimitivesFlags@@_KPEAUIRtlSystemIsolationLayer@Rtl@Windows@@PEBU_LBLOB@@AEBU?$Vector@QEBU_UNICODE_STRING@@@4@P6AJPEBU_UNICODE_STRING@@PEAX@ZPEBU_POQ_PROGRESS_INFORMATION@@PEAU_POQ_CHECKPOINT_INFORMATION@@PEAU_POQ_FAILURE_INFORMATION@@PEAW4RtlRunPrimitivesDisposition@@@Z
RtlSplitLUnicodeString
RtlCompareLUnicodeStrings
??0CRawStoreLayout@ComponentStore@@QEAA@XZ
??1CRawStoreLayout@ComponentStore@@QEAA@XZ
?IsComponentFileStaged@CRawStoreLayout@ComponentStore@@SAJKAEBUComponentData@2@AEBU_LUNICODE_STRING@@PEA_N@Z
?GetTemporaryDirectory@CRawStoreLayout@ComponentStore@@QEAAJKPEAV?$Auto@PEAUIRtlDirectory@Rtl@Windows@@@Windows@@@Z
?InitializeTlcCanonicalData@CRawStoreLayout@ComponentStore@@QEAAJAEBVCApplicationAccessor@@PEAUTlcData@2@PEA_N@Z
?AddComponentImplication@CRawStoreLayout@ComponentStore@@QEAAJAEBUComponentData@2@PEAUTlcData@2@@Z
?RemoveComponentImplication@CRawStoreLayout@ComponentStore@@QEAAJAEBUComponentData@2@PEAUTlcData@2@@Z
?AddTlcMark@CRawStoreLayout@ComponentStore@@QEAAJKAEBUTlcInstaller@2@PEAUTlcData@2@@Z
?RemoveTlcMark@CRawStoreLayout@ComponentStore@@QEAAJKAEBUTlcInstaller@2@PEAUTlcData@2@@Z
?AddCatalogMarkFromTlc@CRawStoreLayout@ComponentStore@@QEAAJAEBU_LUNICODE_STRING@@PEAUTlcData@2@@Z
?Scavenge@CRawStoreLayout@ComponentStore@@QEAAJ_NAEBUScavengeControl@12@PEAUIRtlDirectory@Rtl@Windows@@PEAUIScavengeLastDitch@12@@Z
?DeletePendingFiles@CRawStoreLayout@ComponentStore@@QEAAJXZ
?ManuallyMarkComponentStaged@CRawStoreLayout@ComponentStore@@QEAAJAEBVCComponentAccessor@@PEBU_LBLOB@@@Z
?SetComponentFlag@CRawStoreLayout@ComponentStore@@QEAAJ_NKAEBUComponentData@2@@Z
?QueryComponentFlag@CRawStoreLayout@ComponentStore@@SAJAEBUComponentData@2@PEA_NPEAK@Z
?IsComponentFileDeltaOrLZMSCompressed@CRawStoreLayout@ComponentStore@@QEAAJAEBUComponentData@2@AEBU_LUNICODE_STRING@@PEA_N@Z
?Initialize@VersionedIndexHelper@ComponentStore@@QEAAJPEAUIRtlKey@Rtl@Windows@@_NPEAVIStoreLayoutHelper@2@PEAUIRtlIdentityAuthority@4Identity@5@@Z
?OpenComponentDerivedData@VersionedIndexHelper@ComponentStore@@QEAAJ_NPEBU_LUNICODE_STRING@@1PEAUComponentData@2@PEA_N@Z
?InitComponentData@VersionedIndexHelper@ComponentStore@@QEAAJ_NPEAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@PEAUComponentData@2@PEA_N@Z
?QueryUnchangedFileVersions@VersionedIndexHelper@ComponentStore@@QEAAJ_N0PEAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@AEBU_LUNICODE_STRING@@AEBU_LBLOB@@PEAV?$CVector@T_FOUR_PART_VERSION@@VCCallDisposition@Rtl@BUCL@@@BUCL@@PEA_N@Z
?FinalizeChanges@CCoordinator@PrimitiveInstaller@@QEAAJXZ
?ProcessChange@CCoordinator@PrimitiveInstaller@@QEAAJAEBUComponentChange@2@@Z
?ReadKeyValue@ComponentStore@@YAJPEAUIRtlKey@Rtl@Windows@@PEBU_LUNICODE_STRING@@PEAV?$Auto@U_LBLOB@@@4@PEAPEBU_KEY_VALUE_PARTIAL_INFORMATION@@PEA_N@Z
RtlCopyLBlob
?Initialize@CCoordinator@PrimitiveInstaller@@QEAAJKKKPEAUIRtlPrimitiveInstallerSupport@Rtl@PrimitiveInstallers@Windows@@PEAUIRtlPrimitiveInstallerRepairCallback@456@PEAUIRtlSystemIsolationLayer@46@@Z
RtlTranscodeLBlobs
?Close@CCatalog@@QEAAJXZ
?ReplaceSystemPathStringWithDefaultMacro@Rtl@ComponentMacroReplacement@@YAJW4ReplaceSystemPathStringWithDefaultMacroFlags@12@AEBU_LUNICODE_STRING@@PEAV?$Auto@U_LUNICODE_STRING@@@Windows@@PEAW4ReplaceSystemPathStringWithDefaultMacroDisposition@12@@Z
?Create@CCatalog@@QEAAJKKPEBU_LBLOB@@PEAK@Z
?VerifySigner@CCatalog@@QEAAJPEAUIRtlSystemIsolationLayer@Rtl@Windows@@@Z
RtlCreateUtf8UCSStringBuilder
?VerifyCertChainRoot@CCatalog@@QEAAJKPEAK@Z
?FindSubject@CCatalog@@QEBAJKPEBU_LBLOB@@PEA_NPEAJ@Z
RtlXmlDestroyNextLogicalThing
?RtlWcpParseManifestFromXml@Rtl@Implementation@WCP@Windows@@YAJKPEBU_LBLOB@@PEAUIParseErrorCallback@1Microdom@4@PEAUIRtlManifestParseErrorCallback@1ManifestParser@4@PEAV?$Auto@PEAVIRtlCdf@Rtl@Cdf@Windows@@@4@@Z
?SilGetRegistryDWORD@Rtl@Windows@@YAJKPEAUIRtlSystemIsolationLayerPublic@12@AEBU_LUNICODE_STRING@@1PEAK2@Z
RtlAllocateLBlob
RtlParseDottedVersion
?ParseFromBlob@WcpManifest@@QEAAJW4ParseDocumentFlags@XmlParserGenerator@@AEBU_LBLOB@@PEAVStopWatch@Rtl@Windows@@@Z
RtlHashLBlob
?GetComponentAbsolutePath@CRawStoreLayout@ComponentStore@@QEAAJKPEAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@PEAV?$Auto@U_LUNICODE_STRING@@@6@@Z
?InitializeStoreContext@CRawStoreLayout@ComponentStore@@QEAAJKPEAUIRtlIdentityAuthority@Rtl@Identity@Windows@@PEAUIRtlAppIdAuthority@4AppId@6@PEAUIRtlSystemIsolationLayer@46@2PEAUIRtlKey@46@3AEAVCRawInstallMap@InstallMap@@PEAUIRtlDirectory@46@5@Z
GetPrimitiveInstallerSupport
?Finalize@ExecutionQueueDeriver@AiQueue@@QEAAJPEAV?$Auto@U?$Vector@VExecutionQueueEntry@AiQueue@@@Windows@@@Windows@@PEAK@Z
?AddInspect@ExecutionQueueDeriver@AiQueue@@QEAAJAEBVWcpManifest@@@Z
?AddChange@ExecutionQueueDeriver@AiQueue@@QEAAJPEBVWcpManifest@@0@Z
?DoesManifestContainAIs@ExecutionQueueDeriver@AiQueue@@QEAAJAEBVWcpManifest@@PEA_N@Z
?ShouldRunAIs@ExecutionQueueDeriver@AiQueue@@QEAAJPEAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@PEA_N@Z
?Initialize@ExecutionQueueDeriver@AiQueue@@QEAAJKKK_KPEAUIRtlSystemIsolationLayer@Rtl@Windows@@1PEBV?$CVector@UTransformsChangeQueueEntry@AiQueue@@VCCallDisposition@Rtl@BUCL@@@BUCL@@@Z
IsSkuAssembly
?ConvertStringSecurityDescriptor@CSecurityDescriptorFactory@Rtl@Implementation@WCP@Windows@@QEBAJKAEBU_LUNICODE_STRING@@PEAV?$Auto@U_SECURITY_DESCRIPTOR@@@5@PEAK@Z
?ReplaceMacros@LocalTransformerServices@COM@WCP@Windows@@UEAAJKPEB_WPEAPEA_WK@Z
?GetParameter@LocalTransformerServices@COM@WCP@Windows@@UEAAJKPEB_WPEAPEA_WPEAK@Z
?TryGetRollbackStorageDirectory@LocalTransformerServices@COM@WCP@Windows@@UEAAJKPEAPEAUIRtlDirectory@Rtl@4@@Z
?TryGetRollbackStorageKey@LocalTransformerServices@COM@WCP@Windows@@UEAAJKPEAPEAUIRtlKey@Rtl@4@@Z
?GetUserProfile@LocalTransformerServices@COM@WCP@Windows@@UEAAJPEAPEAUIRtlUserProfile@Rtl@4@@Z
?GetSystem@LocalTransformerServices@COM@WCP@Windows@@UEAAJPEAPEAUIRtlSystemIsolationLayerPublic@Rtl@4@@Z
?GetIsolationAllocator@LocalTransformerServices@COM@WCP@Windows@@UEAAJPEAPEAUIMalloc@@@Z
?Release@LocalTransformerServices@COM@WCP@Windows@@UEAAKXZ
?AddRef@LocalTransformerServices@COM@WCP@Windows@@UEAAKXZ
?QueryInterface@LocalTransformerServices@COM@WCP@Windows@@UEAAJAEBU_GUID@@PEAPEAX@Z
?IsSafeMode@LocalInstallerServices@COM@WCP@Windows@@UEAAJPEA_N@Z
?IsPhysicallyOffline@LocalInstallerServices@COM@WCP@Windows@@UEAA_NXZ
?QuerySingleResourceOwnershipConfiguration@LocalInstallerServices@COM@WCP@Windows@@UEAAJPEA_N@Z
?QuerySmiHiveUpdatesConfiguration@LocalInstallerServices@COM@WCP@Windows@@UEAAJPEAK@Z
?IsSkuAssembly@LocalInstallerServices@COM@WCP@Windows@@UEAA_NXZ
?IsStateSeparated@LocalInstallerServices@COM@WCP@Windows@@UEAA_NXZ
?PoqWasExecutedInline@LocalInstallerServices@COM@WCP@Windows@@UEAA_NXZ
?IsMobileStore@LocalInstallerServices@COM@WCP@Windows@@UEAA_NXZ
?get_UserProfile@LocalInstallerServices@COM@WCP@Windows@@UEAAJPEAPEAUIRtlUserProfile@Rtl@4@@Z
?get_System@LocalInstallerServices@COM@WCP@Windows@@UEAAJPEAPEAUIRtlSystemIsolationLayerPublic@Rtl@4@@Z
?get_IsolationAllocator@LocalInstallerServices@COM@WCP@Windows@@UEAAJPEAPEAUIMalloc@@@Z
?AddInstallerFailureAnnotation@LocalInstallerServices@COM@WCP@Windows@@UEAAJKPEA_W@Z
?AcquireInstallerComponentPath@LocalInstallerServices@COM@WCP@Windows@@UEAAJKPEAUIDefinitionIdentity@@PEAPEA_WPEAK@Z
?VirtualPathToPhysical@LocalInstallerServices@COM@WCP@Windows@@UEAAJKPEB_WPEAPEA_W@Z
?CompressManifest@Rtl@Implementation@WCP@Windows@@YAJK_NPEBU_LBLOB@@PEAUIRtlFile@14@@Z
?get_TargetProcessorArchitecture@LocalInstallerServices@COM@WCP@Windows@@UEAAJPEAK@Z
RtlDestroyGrowingList
RtlIndexIntoGrowingList
RtlReallocateUnicodeString
ExpandAndNullTerminateEnvironmentVariableString
RtlConvertNtRegistryPathToWin32RegistryPath
?CoTaskMemAlloc@COM@Windows@@YAPEAX_K@Z
SilCreateRerootedSil
?IsManifestCompressed@Rtl@Implementation@WCP@Windows@@YAJPEBU_LBLOB@@PEA_N@Z
?RtlTraceFormat_PCULONG_AsHexadecimalOnly@Rtl@WCP@Windows@@YAXPEAUIRtlFormattedOutputStream@13@PEBX@Z
RtlConvertWin32RegistryPathToNtRegistryPathWithSid
RtlDeallocateUnicodeString
RtlFreeLUnicodeString
RtlFreeLBlob
RtlDecodeBase64LUtf8StringToLBlob
RtlInitLUnicodeStringFromNullTerminatedString
RtlGetEncodingSizeUtf8
RtlEncodeUtf8
RtlReallocateLUtf8String
RtlCopyLUtf8StringToLUnicodeString
RtlXmlExtentToUtf8String
RtlCalculateUtf16StringLengthFromLUtf8String
?Next@CXmlCursor@@QEAAJXZ
RtlMurmurHashLBlob
RtlConvertNtFilePathToWin32FilePath
?FsnpDowncaseChar@@YAKK@Z
ORAdvanceSubkeyEnumerator
ORSaveHive
ORQueryValueEnumerator
ORQueryInfoKey
ORStartSubkeyEnumerator
ORCleanupValueEnumerator
ORAdvanceValueEnumerator
ORSetKeySecurity
ORCreateHive
OROpenKey
ORDeleteValue
ORInitializeSubkeyEnumerator
ORInitializeValueEnumerator
ORCloseKey
ORQuerySubkeyEnumerator
OROpenHive
ORGetValue
ORCloseHive
ORCreateKey
ORCleanupSubkeyEnumerator
ORStartValueEnumerator
ORGetKeySecurity
ORSetValue
ORDeleteKey
WcpSetHelperCallback
?LookupStringReplacement@MacroReplacement@@YAJKKAEBU_LUNICODE_STRING@@PEAUIRtlSystemIsolationLayer@Rtl@Windows@@PEAXPEAUIRtlDefinitionIdentity@4Identity@5@PEAV?$Auto@U_LUNICODE_STRING@@@5@PEAK@Z
?ChooseBitnessFromIdentityAndTarget@MacroReplacement@@YAJKPEAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@PEAK@Z
RtlGetDirectSystem
?Initialize@CXmlCursor@@QEAAJPEAX_K@Z
?ReplaceVariablesInString@Rtl@Implementation@WCP@Windows@@YAJPEBU_LBLOB@@P6A?AU_RTL_UCSCHAR_DECODER_RETURN_VALUE@@PEBE1@ZPEAXP6AJ320PEAU_RTL_SMART_LBLOB_UCSCHAR_WRITING_CONTEXT@@@ZP6AJKPEAU_RTL_SMART_LBLOB_WRITING_CONTEXT@@@ZP6AJQEBK_K6@ZPEAU5@@Z
RtlInitUnicodeStringFromLUnicodeString
RtlNsDestroy
WIMCloseHandle
WIMUnmountImage
WIMExtractImagePath
WIMSetTemporaryPath
WIMApplyImage
WIMLoadImage
WIMGetMountedImageInfo
WIMCreateFile
QueryPerformanceCounter
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentThread
CreateThread
GetVersionExW
GetWindowsDirectoryW
GlobalMemoryStatusEx
GetSystemWindowsDirectoryW
GetSystemTime
GetSystemInfo
GetSystemTimeAsFileTime
GetModuleFileNameW
GetProcAddress
LoadLibraryExA
FreeLibrary
DisableThreadLibraryCalls
GetModuleHandleW
GetModuleFileNameA
LoadLibraryExW
GetModuleHandleExW
InitializeSListHead
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
OutputDebugStringA
DebugBreak
OutputDebugStringW
IsDebuggerPresent
SetUnhandledExceptionFilter
SetLastError
RaiseException
GetLastError
UnhandledExceptionFilter
OpenProcess
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
DeleteCriticalSection
SetEvent
InitializeCriticalSection
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
CreateSemaphoreExW
CreateEventW
ReleaseMutex
WaitForSingleObject
ReleaseSemaphore
GetProcessHeap
HeapFree
HeapAlloc
StringFromGUID2
CoCreateGuid
CoGetMalloc
CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc
Sleep
FormatMessageW
CloseHandle
SetFileAttributesW
GetFileAttributesW
ReadFile
WriteFile
CreateFileW
CompareFileTime
FindFirstFileW
FindNextFileW
GetVolumeInformationByHandleW
FindFirstFileExW
FindClose
DeleteFileW
CreateDirectoryW
SetFileInformationByHandle
GetFileAttributesExW
RemoveDirectoryW
GetFinalPathNameByHandleW
GetFullPathNameW
WideCharToMultiByte
CompareStringOrdinal
RegCloseKey
RegQueryValueExW
RegSetValueExW
RegOpenKeyExW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
LoadLibraryW
GetFileInformationByHandleEx
MoveFileExW
DeviceIoControl
LocalFree
ConvertSecurityDescriptorToStringSecurityDescriptorW
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
GetSecurityInfo
lstrcmpW
PrivCopyFileExW
PathMatchSpecW
GetTempPathW
VerSetConditionMask
VerifyVersionInfoW
RtlNtStatusToDosError
LdrLoadDll
LdrUnloadDll
LdrGetProcedureAddress
NtWaitForSingleObject
RtlReleaseRelativeName
NtSetEaFile
RtlDosPathNameToRelativeNtPathName_U_WithStatus
RtlInitUnicodeString
NtQueryOpenSubKeysEx
NtQueryInformationProcess
RtlDestroyEnvironment
RtlCreateEnvironment
RtlSetEnvironmentVariable
NtOpenKey
NtLoadKey2
RtlFreeHeap
RtlAllocateHeap
NtCreateFile
RtlRaiseStatus
NtClose
NtUnloadKey2
NtFlushKey
NtQueryPerformanceCounter
BCryptGetProperty
BCryptFinishHash
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptHashData
BCryptCreateHash
BCryptOpenAlgorithmProvider
VirtualQuery
VirtualProtect
ApplyContainerChanges
CreateImageManifest
GetIServicingCommitter
GetIServicingFileHashProvider
GetIServicingQuerier
GetIServicingStager
InstallPackagesToFolder
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ