Mini Kabibi Habibi
LJ9
X�6 99 BK CloseHandleCffi2 = 6 99 3 BK gcffi handleV
X�6 999 BK DestroyEnvironmentBlock userenv
Win32 core/ = 6 99 3 BK gcffienv1 6 99 BK RegCloseKeyCffi� < X�' X�) X�6 9996 99 B7 6 X�+ = 2 �6 9 '
B= 6 9 9 6 9
B6 99
9 X�+ = 2
�9 : = 6 99 3 BK K K gcERROR_SUCCESSWin32ErrorConstantsRegOpenKeyExAC
void*[1]newffi hKey rootKeyGetRootHKEYFromString
KEY_READRegistrySamConstants
Win32 core( 9 X�+ X�+ L hKey� n 9 B X�6 9 9' B6 9' B6 9' B6 99 9
, ,
B
6 9 9 9
X�6 9 96 9' 6 9 9 B A A4 ) : ) M5�6 9 '
: B 6
9
' : B
6 9 9 9
, B 6 9 9 9
X �6 9 6
9
B
A X �6 9 9 6
9
' 6 9 9 B A
A O� : J 7Failed to enumerate subkeys at index %d. Error: %s insert
tableRegEnumKeyExA char[?]GetWin32ErrorString8Failed to query registry key information. Error: %s format stringERROR_SUCCESSWin32ErrorConstants
Win32 hKeyRegQueryInfoKeyACunsigned long[1]newffi&ErrorInvalid registry key handle. info logger core IsValid� p 9 B X�6 9 9' B+ L 6 9' B6 9' B6 99 9
,
,
B
6 9 9 9
X�6 9 96 9' 6 9 9 B A A+ L 4 ) : ) M5�6 9 '
: B 6
9
' : B
6 9 9 9
, B 6 9 9 9
X �6 9 6
9
B
A X �6 9 9 6
9
' 6 9 9 B A
A O�L ;Failed to enumerate value names at index %d. Error: %s insert
tableRegEnumValueA char[?]GetWin32ErrorString;Failed to query registry key for value info. Error: %s format stringERROR_SUCCESSWin32ErrorConstants
Win32 hKeyRegQueryInfoKeyACunsigned long[1]newffi7ErrorInvalid registry key handle in GetValueNames. info logger core IsValid� �9 X�+ L
X�6 B X�+ L 6 9' B6 9' B6 9' ) B6 999 +
B6 9 9
9 X�+ L X �6 9 9
9 X �6 9 9
9: X�6 : D X�6 9 9
9 X�6 9 9
9 X�+ L : 4 6 9 9
96 9 99<6 9 9
96 9 99<6 9 9
96 9 99<6 9 9
96 9 99<6 9 9
96 9 99<6 9 9
96 9 99<6 9 9
96 9 99<6 9 9
96 9 99<6 9 9
96 9 99 <8 X�+ L 6 9 998 X)�: ) X"�6 9' : B6 9' B6 9 9 9
+
B 6 9 9
9 X �+ L 6 9
D X^�+ L X[�6 9 998 X&�: ) X �6 9' B6 9' B6 9 9 9
+
B 6 9 9
9 X �+ L 6 :
D X1�+ L X.�6 9 99 8 X%�: ) X �6 9' : B6 9' B6 9 9 9
+
B 6 9 9
9 X �+ L L X�+ L X�+ L K unsigned __int64[1] char[?] BINARYREG_BINARY REG_QWORD_LITTLE_ENDIANREG_QWORDREG_MULTI_SZREG_DWORD_BIG_ENDIAN REG_DWORD_LITTLE_ENDIAN NUMBERREG_EXPAND_SZ STRING RegistryValueTypeMapping REG_SZERROR_MORE_DATA
tonumberREG_DWORD RegistryValueTypeConstantsERROR_SUCCESSERROR_FILE_NOT_FOUNDWin32ErrorConstants
Win32 coreRegQueryValueExACunsigned long[1]newffi string type hKey�
� 9 B X�6 9 9' B, J 6 9' B6 9' B6 99 9
+ +
B6 9 9 9
X�6 9 9' B, J 6 9' : B6 99 9
+
B 6 9 9 9
X�6 9 9' B, J + : 6 9 99 X �6 9 99 X�6 9 99 X�6 9 B X5�6 9 99 X�6 9 99 X
�6 6 9'
B: B X �6 9 99 X�6 9 99 X
�6 6 9'
B: B X �6 9 99 X�+ X�+ J REG_BINARYunsigned __int64* REG_QWORD_LITTLE_ENDIANREG_QWORDunsigned long* cast
tonumber REG_DWORD_LITTLE_ENDIANREG_DWORD stringREG_MULTI_SZREG_EXPAND_SZ REG_SZ RegistryValueTypeConstants%Error retrieving the value data.unsigned char[?]2Error determining the size of the value data.ERROR_SUCCESSWin32ErrorConstants
Win32 hKeyRegQueryValueExACunsigned long[1]newffi(Error: Invalid registry key handle. info logger core IsValidI
X�6 999 BK FindClose
kernel32
Win32 core2 = 6 99 3 BK gcffi handle_
- 9 6 999 B C �FindFirstFileA
kernel32
Win32 coreFindHandleP 6 9999 BL handleFindNextFileA
kernel32
Win32 core�t & F6 9' B= 6 9' B= 6 9' B= 6 9' B= 6 9' B=
6 9 '
B6 93 B= 6 93 B= 6 93 B= 9 3 =9 3 =9 3 =9 3 = 9 3 = 6 93! B= 3# =" 3% =$ 2 �K FindNextFile FindFirstFile FindHandle QueryValueWithType QueryValue GetValueNames EnumSubKeys IsValid
Registry
EnvBlock
class coreWin32Handle�p void* OpenEventA(unsigned long dwDesiredAccess, bool bInheritHandle, const char* lpName);
bool SetEvent(void* hEvent);
unsigned long GetLastError();
unsigned long FormatMessageA(unsigned long dwFlags,
void* lpSource,
unsigned long dwMessageId,
unsigned long dwLanguageId,
char* lpBuffer,
unsigned long nSize,
va_list* Arguments);
void* LocalAlloc(unsigned int uFlags, size_t uBytes);
void* LocalFree(void* hMem);
void* GetModuleHandleA(const char* lpModuleName);
void* LoadResource(void* hModule, void* hResInfo);
void* FindResourceA(void* hModule, const char* lpName, const char* lpType);
void* FindResourceW(void* hModule, wchar_t* lpName, wchar_t* lpType);
void* LockResource(void* hResData);
long RegOpenKeyExA(void* hKey,
const char* lpSubKey,
unsigned long ulOptions,
unsigned long samDesired,
void** phkResult);
long RegQueryValueExA(void* hKey,
const char* lpValueName,
unsigned long* lpReserved,
unsigned long* lpType,
void* lpData,
unsigned long* lpcbData);
long RegCloseKey(void* hKey);
// Defined in verrsrc.h
typedef struct
{
unsigned long dwSignature; /* e.g. 0xfeef04bd */
unsigned long dwStrucVersion; /* e.g. 0x00000042 = "0.42" */
unsigned long dwFileVersionMS; /* e.g. 0x00030075 = "3.75" */
unsigned long dwFileVersionLS; /* e.g. 0x00000031 = "0.31" */
unsigned long dwProductVersionMS; /* e.g. 0x00030010 = "3.10" */
unsigned long dwProductVersionLS; /* e.g. 0x00000031 = "0.31" */
unsigned long dwFileFlagsMask; /* = 0x3F for version "0.42" */
unsigned long dwFileFlags; /* e.g. VFF_DEBUG | VFF_PRERELEASE */
unsigned long dwFileOS; /* e.g. VOS_DOS_WINDOWS16 */
unsigned long dwFileType; /* e.g. VFT_DRIVER */
unsigned long dwFileSubtype; /* e.g. VFT2_DRV_KEYBOARD */
unsigned long dwFileDateMS; /* e.g. 0 */
unsigned long dwFileDateLS; /* e.g. 0 */
} VS_FIXEDFILEINFO;
// Defined in shellapi.h
typedef struct _SHELLEXECUTEINFOA
{
unsigned long cbSize; // in, required, sizeof of this structure
unsigned long fMask; // in, SEE_MASK_XXX values
void* hwnd; // in, optional
const char* lpVerb; // in, optional when unspecified the default verb is choosen
const char* lpFile; // in, either this value or lpIDList must be specified
const char* lpParameters; // in, optional
const char* lpDirectory; // in, optional
int nShow; // in, required
void* hInstApp; // out when SEE_MASK_NOCLOSEPROCESS is specified
void* lpIDList; // in, valid when SEE_MASK_IDLIST is specified, PCIDLIST_ABSOLUTE, for use with SEE_MASK_IDLIST & SEE_MASK_INVOKEIDLIST
const char* lpClass; // in, valid when SEE_MASK_CLASSNAME is specified
void* hkeyClass; // in, valid when SEE_MASK_CLASSKEY is specified
unsigned long dwHotKey; // in, valid when SEE_MASK_HOTKEY is specified
void* hMonitor; // in, valid when SEE_MASK_HMONITOR specified
void* hProcess; // out, valid when SEE_MASK_NOCLOSEPROCESS specified
} SHELLEXECUTEINFOA, *LPSHELLEXECUTEINFOA;
int ShellExecuteExA(SHELLEXECUTEINFOA *pExecInfo);
// http://msdn.microsoft.com/en-us/library/windows/desktop/ms647001(v=vs.85).aspx
typedef struct {
unsigned short wLength;
unsigned short wValueLength;
unsigned short wType;
char szKey[sizeof("VS_VERSION_INFO")*sizeof(wchar_t)];
unsigned short Padding1;
VS_FIXEDFILEINFO Value;
unsigned short Padding2;
unsigned short Children;
} VS_VERSIONINFO;
typedef struct _WTS_PROCESS_INFO {
unsigned long SessionId;
unsigned long ProcessId;
const char* pProcessName;
void* pUserSid;
} WTS_PROCESS_INFO, *PWTS_PROCESS_INFO;
typedef enum _WTS_CONNECTSTATE_CLASS {
WTSActive,
WTSConnected,
WTSConnectQuery,
WTSShadow,
WTSDisconnected,
WTSIdle,
WTSListen,
WTSReset,
WTSDown,
WTSInit
} WTS_CONNECTSTATE_CLASS;
typedef struct _WTS_SESSION_INFO {
unsigned long SessionId;
char* pWinStationName;
WTS_CONNECTSTATE_CLASS State;
} WTS_SESSION_INFO, *PWTS_SESSION_INFO;
void* OpenProcess(unsigned long dwDesiredAccess, int bInheritedHandle, unsigned long dwProcessId);
int CloseHandle(void* hObject);
unsigned long WTSGetActiveConsoleSessionId();
int WTSEnumerateProcessesA(void* hServer,
unsigned long Reserved,
unsigned long Version,
PWTS_PROCESS_INFO* ppProcessInfo,
unsigned long* pCount);
void WTSFreeMemory(void* pMemory);
int WTSEnumerateSessionsA(void* hServer,
unsigned long Reserved,
unsigned long Version,
PWTS_SESSION_INFO *ppSessionInfo,
unsigned long* pCount);
typedef struct _SID_AND_ATTRIBUTES {
void* Sid;
unsigned long Attributes;
} SID_AND_ATTRIBUTES, * PSID_AND_ATTRIBUTES;
typedef struct _TOKEN_USER {
SID_AND_ATTRIBUTES User;
} TOKEN_USER, *PTOKEN_USER;
typedef enum _TOKEN_INFORMATION_CLASS {
TokenUser = 1,
TokenGroups,
TokenPrivileges,
TokenOwner,
TokenPrimaryGroup,
TokenDefaultDacl,
TokenSource,
TokenType,
TokenImpersonationLevel,
TokenStatistics,
TokenRestrictedSids,
TokenSessionId,
TokenGroupsAndPrivileges,
TokenSessionReference,
TokenSandBoxInert,
TokenAuditPolicy,
TokenOrigin,
TokenElevationType,
TokenLinkedToken,
TokenElevation,
TokenHasRestrictions,
TokenAccessInformation,
TokenVirtualizationAllowed,
TokenVirtualizationEnabled,
TokenIntegrityLevel,
TokenUIAccess,
TokenMandatoryPolicy,
TokenLogonSid,
MaxTokenInfoClass // MaxTokenInfoClass should always be the last enum
} TOKEN_INFORMATION_CLASS, *PTOKEN_INFORMATION_CLASS;
int OpenProcessToken(void* ProcessHandle, unsigned long DesiredAccess, void** TokenHandle);
int GetTokenInformation(void* TokenHandle,
TOKEN_INFORMATION_CLASS TokenInformationClass,
void* TokenInformation,
unsigned long TokenInformationLength,
unsigned long* ReturnLength);
int ConvertSidToStringSidA(void* Sid, char** StringSid);
int IsValidSid(void* pSid);
unsigned long GetEnvironmentVariableA(const char* lpName, char* lpBuffer, unsigned long nSize);
typedef struct _SECURITY_ATTRIBUTES {
unsigned long nLength;
void* lpSecurityDescriptor;
int bInheritHandle;
} SECURITY_ATTRIBUTES, *PSECURITY_ATTRIBUTES, *LPSECURITY_ATTRIBUTES;
typedef struct _STARTUPINFO {
unsigned long cb;
char* lpReserved;
char* lpDesktop;
char* lpTitle;
unsigned long dwX;
unsigned long dwY;
unsigned long dwXSize;
unsigned long dwYSize;
unsigned long dwXCountChars;
unsigned long dwYCountChars;
unsigned long dwFillAttribute;
unsigned long dwFlags;
unsigned short wShowWindow;
unsigned short cbReserved2;
char* lpReserved2;
void* hStdInput;
void* hStdOutput;
void* hStdError;
} STARTUPINFO, *LPSTARTUPINFO;
typedef struct _PROCESS_INFORMATION {
void* hProcess;
void* hThread;
unsigned long dwProcessId;
unsigned long dwThreadId;
} PROCESS_INFORMATION, *LPPROCESS_INFORMATION;
int CreateProcessA(const char* lpApplicationName, char* lpCommandLine, LPSECURITY_ATTRIBUTES lpProcessAttributes,
LPSECURITY_ATTRIBUTES lpThreadAttributes, int bInheritHandles, unsigned long dwCreationFlags,
void* lpEnvironment, const char* lpCurrentDirectory, LPSTARTUPINFO lpStartupInfo,
LPPROCESS_INFORMATION lpProcessInformation);
int CreateProcessAsUserA(void* hToken, const char* lpApplicationName, char* lpCommandLine, LPSECURITY_ATTRIBUTES lpProcessAttributes,
LPSECURITY_ATTRIBUTES lpThreadAttributes, int bInheritHandles, unsigned long dwCreationFlags, void* lpEnvironment,
const char* lpCurrentDirectory, LPSTARTUPINFO lpStartupInfo, LPPROCESS_INFORMATION lpProcessInformation);
typedef enum _SECURITY_IMPERSONATION_LEVEL {
SecurityAnonymous,
SecurityIdentification,
SecurityImpersonation,
SecurityDelegation
} SECURITY_IMPERSONATION_LEVEL, *PSECURITY_IMPERSONATION_LEVEL;
typedef enum tagTOKEN_TYPE {
TokenPrimary = 1,
TokenImpersonation
} TOKEN_TYPE, *PTOKEN_TYPE;
int DuplicateTokenEx(void* hExistingToken, unsigned long dwDesiredAccess, LPSECURITY_ATTRIBUTES lpTokenAttributes,
SECURITY_IMPERSONATION_LEVEL ImpersonationLevel, TOKEN_TYPE TokenType, void** phNewToken);
int CreateEnvironmentBlock(void** lpEnvironment, void* hToken, int bInherit);
int DestroyEnvironmentBlock(void* lpEnvironment);
typedef int (__stdcall *WNDENUMPROC)(void *hwnd, long lParam);
int EnumWindows(WNDENUMPROC lpEnumFunc, long lParam);
unsigned long GetWindowThreadProcessId(void* hwnd, unsigned long* lpdwProcessId);
int SetWindowPos(void* hwnd, void* hWindInsertAfter, int X, int Y, int cx, int cy, unsigned int uFlags);
void* OpenEventA(unsigned long dwDesiredAccess, int bInheritHandle, const char* lpName);
int SetEvent(void* hEvent);
typedef struct _FILETIME {
unsigned long dwLowDateTime;
unsigned long dwHighDateTime;
} FILETIME, *LPFILETIME;
typedef struct _WIN32_FIND_DATA {
unsigned long dwFileAttributes;
FILETIME ftCreationTime;
FILETIME ftLastAccessTime;
FILETIME ftLastWriteTime;
unsigned long nFileSizeHigh;
unsigned long nFileSizeLow;
unsigned long dwReserved0;
unsigned long dwReserved1;
char cFileName[260];
char cAlternateFileName[14];
} WIN32_FIND_DATA, *PWIN32_FIND_DATA, *LPWIN32_FIND_DATA;
void* FindFirstFileA(const char* lpFileName, LPWIN32_FIND_DATA lpFindFileData);
int FindNextFileA(void* hFindFile, LPWIN32_FIND_DATA lpFindFileData);
int FindClose(void* hFindFile);
long GetUserGeoID(unsigned long GeoClass);
int GetGeoInfoA(long Location, unsigned long GeoType, char* lpGeoData, int cchData, unsigned short LangId);
void* OpenMutexA(unsigned long dwDesiredAccess, int bInheritHandle, const char* lpName);
long RegQueryInfoKeyA(
void* hKey,
char* lpClass,
unsigned long* lpcClass,
unsigned long* lpReserved,
unsigned long* lpcSubKeys,
unsigned long* lpcMaxSubKeyLen,
unsigned long* lpcMaxClassLen,
unsigned long* lpcValues,
unsigned long* lpcMaxValueNameLen,
unsigned long* lpcbMaxValueLen,
unsigned long* lpcbSecurityDescriptor,
void* lpftLastWriteTime
);
long RegEnumKeyExA(
void* hKey,
unsigned long dwIndex,
char* lpName,
unsigned long* lpcName,
unsigned long* lpReserved,
char* lpClass,
unsigned long* lpcClass,
void* lpftLastWriteTime
);
long RegEnumValueA(
void* hKey,
unsigned long dwIndex,
char* lpValueName,
unsigned long* lpcValueName,
unsigned long* lpReserved,
unsigned long* lpType,
unsigned char* lpData,
unsigned long* lpcbData
);
cdef
Kernel32
kernel32 User32 user32 Userenv userenv
Advapi32 advapi
Wtsapi32 loadffi wtsapi: 6 96 9 )
B D lshiftborbit4 9 ' ' BL %1^%s*(.-)%s*$ gsub� )6 B X�' L ) 6 9' B) 7 6 996 + ) +
B X�+ L 6 9 B7
6 9 9
6
D trim
Win32 coreerrorMessage stringFormatMessageAC FORMAT_MESSAGE_FROM_SYSTEM char[?]newffi number type � 6 9' B6 999 9 B X�+ L 6 99: D
EnvBlock handleCreateEnvironmentBlock userenv
Win32 core
void*[1]newffi \ 6 996 99 B C OpenProcessCffiWin32Handle
Win32 core� 6 9' B6 999 B X�+ L 6 99: D Win32Handle
Win32 core handleOpenProcessTokenC
void*[1]newffi �
6 9' B6 9999
B X�+ L 6 99: D Win32Handle handleDuplicateTokenEx advapi
Win32 core
void*[1]newffi 1 6 99 BK RegCloseKeyCffi� J6 6 B X�+ X�+ B+ X�6 999X4� X�6 999 X-�
X(�6 99 )��B X�+ 2 $�6 9
' B6 996 999
B6 999 X�+ 2
�: 6 9 3 BX�+ 2 �L 2 �L L L gcERROR_SUCCESSWin32ErrorConstantsHKEY_USERSRegOpenKeyExAC
void*[1]newffiGetHKeyUserSidString HKCUHKEY_CLASSES_ROOT HKCRHKEY_LOCAL_MACHINERegistryKeyConstants
Win32 core HKLM string type assertC 6 999: BK WTSFreeMemory wtsapi
Win32 core� ;6 9 6 9' B3 B 6 9' B6 999 + ) ) B
X� X�: ) X�+ 2 �L ) : ) M�: 8
X
�: 89
6 9 9 X�: 89
2 �L O�+ 2 �L SessionIdWTSActiveC
StateWTSEnumerateSessionsA wtsapi
Win32 coreunsigned long[1] PWTS_SESSION_INFO[1]newgcffi C 6 999: BK WTSFreeMemory wtsapi
Win32 core�
V
X� X�+ 2 O�6 96 9' B3 B6 9' B6 999 + ) ) B
X� X�: ) X�+ 2 �L ) : ) M&�6 9 9
9 X �: 8 9 X �: 8 9
X �6 9 :
8
9
B 6
9
B
6 9 B
X
�:
8
9
2 �L
O�+ 2 �L L ProcessId
upper stringpProcessNameSessionIdALL_CURRENT_SESSIONSMcUtilsConstantsWTSEnumerateProcessesA wtsapi
Win32 coreunsigned long[1] PWTS_PROCESS_INFO[1]newgcffi � X�' 6 99 B X�6 99 6 999B X�+ L L ALL_CURRENT_SESSIONSMcUtilsConstants
GetPIDOf
Win32 coreexplorer.exe� 6 996 96 9996 999B) B
X�9 X�+ L L handlePROCESS_VM_READ PROCESS_QUERY_INFORMATIONProcessConstantsborbitOpenProcess
Win32 core�
O X�+ L 6 99 6 999B
X�9 X�+ L 6 9' B6 99 9
96 9 9 + ) B X�+ L ) 6 9
6 9 9 : B6 9 9B6 9' B6 99 9
96 9 9
: B X�+ L 6 9' D TOKEN_USER* castLocalFreeLocalAllocgcTokenUserCGetTokenInformation advapiunsigned long[1]newffi handleTOKEN_QUERYTokenAccessConstantsOpenProcessToken
Win32 core � $ X �6 99B X�+ L 6 99 + B X�+ L 6 99 B6 99 B X�+ L L GetProcessToken GetProcessHandleGivenPid!GetProcessIDBasedOnSessionIDGetActiveSessionID
Win32 core���� / 6 99: BK LocalFreeCffi� ,6 99 B7 6 X�+ 2 �6 9' B7 6 999 6 9
9 6 B7 6 X�+ 2 �6 9
6 3 B6 96 : 2 �D L L string gc resultSid UserConvertSidToStringSidA advapisidString
char*[1]newffiprocessTokenGetTokenUser
Win32 core + 6 X�)��7 K dwSessionId�/ U{6 9 X �6 ' B 6 ' B 6 ' B 7 6 5 5 = 5
= 5 =
5 6 9' * B=6 9' * B=6 9' * B=6 9' * B=6 9' * B==5 =5 =5 = 5 = 5 = 5! ="5# =$5% =&5' 6( =)=*5+ =,5- =.5/ =051 =233 =435 =637 =839 =:3; =<3= =>3? =@3A =B3C =D3E =F3G =H3I =J3K =L3M =N3O =P3Q =R3S =T= 6 9 9 4 B K GetHKeyUserBySessionID GetHKeyUserSidString GetTokenUser GetProcessToken GetProcessHandleGivenPid !GetProcessIDBasedOnSessionID
GetPIDOf GetActiveSessionID GetRootHKEYFromString DuplicateTokenEx OpenProcessToken OpenProcess CreateEnvironmentBlock GetWin32ErrorString trim MAKELANGID
_init SYSGEOTYPE
GEO_LONGITUDEGEO_LATITUDEGEO_NATIONGEO_PARENT
GEO_ISO_UN_NUMBER GEO_OFFICIALLANGUAGES GEO_TIMEZONES
GEO_OFFICIALNAME GEO_FRIENDLYNAME
GEO_LCIDGEO_RFC1766
GEO_ISO3
GEO_ISO2SYSGEOCLASS GEOCLASS_ALL GEOCLASS_REGIONGEOCLASS_NATIONSynchronizationFlags EVENT_MODIFY_STATEEVENT_ALL_ACCESS��|ProcessCreateFlags CREATE_DEFAULT_ERROR_MODE��� %CREATE_PRESERVE_CODE_AUTHZ_LEVEL��� CREATE_BREAKAWAY_FROM_JOB��� PROCESS_MODE_BACKGROUND_END���"PROCESS_MODE_BACKGROUND_BEGIN��@!EXTENDED_STARTUPINFO_PRESENT�� CREATE_PROTECTED_PROCESS�� INHERIT_CALLER_PRIORITY�� INHERIT_PARENT_AFFINITY�� ABOVE_NORMAL_PRIORITY_CLASS�� BELOW_NORMAL_PRIORITY_CLASS��CREATE_FORCEDOS�@CREATE_SHARED_WOW_VDM� CREATE_SEPARATE_WOW_VDM� CREATE_UNICODE_ENVIRONMENT� CREATE_NEW_PROCESS_GROUP� REALTIME_PRIORITY_CLASS�HIGH_PRIORITY_CLASS�IDLE_PRIORITY_CLASS@NORMAL_PRIORITY_CLASS CREATE_NEW_CONSOLEDETACHED_PROCESSCREATE_SUSPENDED DEBUG_ONLY_THIS_PROCESSDEBUG_PROCESS!CREATE_IGNORE_SYSTEM_DEFAULT ����PROFILE_SERVER����PROFILE_KERNEL����PROFILE_USER����CREATE_NO_WINDOW���@ShellExecuteConstantsSEE_MASK_FLAG_DDEWAITSEE_MASK_NOASYNC SEE_MASK_ICONSEE_MASK_INVOKEIDLIST SEE_MASK_IDLISTSEE_MASK_CLASSKEYSEE_MASK_CLASSNAMESEE_MASK_DEFAULT SEE_MASK_HMONITOR���SEE_MASK_NOZONECHECKS��� SEE_MASK_NOQUERYCLASSSTORE��� SEE_MASK_WAITFORINPUTIDLE��� SEE_MASK_FLAG_LOG_USAGE��� SEE_MASK_ASYNCOK��@SEE_MASK_NO_CONSOLE��SEE_MASK_UNICODE��SEE_MASK_FLAG_NO_UI�SEE_MASK_DOENVSUBST�SEE_MASK_FLAG_DDEWAIT SEE_MASK_NOASYNC�SEE_MASK_CONNECTNETDRV� SEE_MASK_NOCLOSEPROCESS@SEE_MASK_HOTKEY StartupInfoFlagValues STARTF_TITLEISAPPID� STARTF_RUNFULLSCREEN STARTF_PREVENTPINNING�@ STARTF_FORCEOFFFEEDBACK�STARTF_FORCEONFEEDBACK@STARTF_USESTDHANDLES�STARTF_USESIZESTARTF_USESHOWWINDOWSTARTF_USEPOSITIONSTARTF_USEHOTKEY� STARTF_USEFILLATTRIBUTESTARTF_USECOUNTCHARSSTARTF_UNTRUSTEDSOURCE��STARTF_TITLEISLINKNAME�ShowWindowConstants SW_SHOWMAXIMIZEDSW_SHOWMINIMIZEDSW_NORMALSW_SHOWNORMAL SW_HIDE SW_MAX SW_FORCEMINIMIZE SW_SHOWDEFAULT
SW_RESTORE SW_SHOWNASW_SHOWMINNOACTIVESW_MINIMIZE SW_SHOWSW_SHOWNOACTIVATESW_MAXIMIZEMcUtilsConstants ALL_CURRENT_SESSIONS��������TokenTypeConstants TokenImpersonationTokenPrimary#SecurityImpersonationConstants SecurityImpersonationSecurityIdentificationSecurityAnonymous SecurityDelegationTokenAccessConstants
TOKEN_ALL_ACCESS��<TOKEN_ADJUST_SESSIONID�TOKEN_ADJUST_DEFAULT�TOKEN_ADJUST_GROUPS@ TOKEN_ADJUST_PRIVILEGES TOKEN_QUERY_SOURCETOKEN_QUERYTOKEN_IMPERSONATETOKEN_DUPLICATETOKEN_ASSIGN_PRIMARYProcessConstants
PROCESS_CREATE_PROCESS�PROCESS_DUP_HANDLE@PROCESS_VM_WRITE PROCESS_VM_READPROCESS_VM_OPERATIONPROCESS_SET_SESSIONIDPROCESS_CREATE_THREADPROCESS_TERMINATE&PROCESS_QUERY_LIMITED_INFORMATION� PROCESS_SUSPEND_RESUME� PROCESS_QUERY_INFORMATION� PROCESS_SET_INFORMATION�PROCESS_SET_QUOTA�RegistrySamConstants STANDARD_RIGHTS_READ�� STANDARD_RIGHTS_REQUIRED��<SYNCHRONIZE��@WRITE_OWNER�� WRITE_DAC��READ_CONTROL�� DELETE��KEY_ALL_ACCESS��<KEY_EXECUTE��KEY_WRITE��
KEY_READ��KEY_WOW64_RES�KEY_WOW64_64KEY�KEY_WOW64_32KEY�KEY_CREATE_LINK KEY_NOTIFYKEY_ENUMERATE_SUB_KEYSKEY_CREATE_SUB_KEYKEY_SET_VALUEKEY_QUERY_VALUEGENERIC_ALL����GENERIC_EXECUTE����GENERIC_WRITE����GENERIC_READ ����MAXIMUM_ALLOWED���ACCESS_SYSTEM_SECURITY���SPECIFIC_RIGHTS_ALL��STANDARD_RIGHTS_ALL��| STANDARD_RIGHTS_EXECUTE��STANDARD_RIGHTS_WRITE��RegistryKeyConstantsHKEY_CURRENT_CONFIGHKEY_USERSHKEY_LOCAL_MACHINEHKEY_CURRENT_USERHKEY_CLASSES_ROOT HKEY_CURRENT_CONFIG HKEY_USERS HKEY_LOCAL_MACHINE HKEY_CURRENT_USER HKEY_CLASSES_ROOT
void* cast RegistryValueTypeMapping NONE none NUMBER number STRING string BINARY binary RegistryValueTypeConstants REG_BINARYREG_EXPAND_SZ REG_SZ
REG_NONE REG_QWORD_LITTLE_ENDIAN REG_QWORD #REG_RESOURCE_REQUIREMENTS_LIST
!REG_FULL_RESOURCE_DESCRIPTOR REG_RESOURCE_LISTREG_MULTI_SZ
REG_LINKREG_DWORD_BIG_ENDIAN REG_DWORD_LITTLE_ENDIANREG_DWORDWin32ErrorConstants "CreateEnvironmentBlock SynchronizationFlags GetActiveSessionID DuplicateTokenEx RegistryValueTypeConstants
_init ShellExecuteConstants RegistrySamConstants ProcessConstants #SecurityImpersonationConstants trim
GetPIDOf GetHKeyUserSidString Win32ErrorConstants GetHKeyUserBySessionID GetWin32ErrorString SYSGEOTYPE StartupInfoFlagValues OpenProcessToken SYSGEOCLASS OpenProcess GetTokenUser GetRootHKEYFromString ShowWindowConstants McUtilsConstants MAKELANGID GetProcessToken TokenTypeConstants GetProcessHandleGivenPid RegistryKeyConstants !GetProcessIDBasedOnSessionID RegistryValueTypeMapping ProcessCreateFlags TokenAccessConstants ERROR_INVALID_HANDLEERROR_ACCESS_DENIEDERROR_PATH_NOT_FOUNDERROR_FILE_NOT_FOUNDERROR_SUCCESS ERROR_MORE_DATA�ERROR_ENVVAR_NOT_FOUND�ERROR_INVALID_DATA
Win32fficore.loggercore.class require core_G����������������������������
����
//84B33CB044C5B251FA149D25978491081F7594FA6BDD649621047EC163396068457D7EABD9392D02E77B72B3DB8CCDA33ECD1542A109C74AB38F249C83D74FF2++