enum tagTYPEFLAGS { TYPEFLAG_FAPPOBJECT = 1, TYPEFLAG_FCANCREATE = 2, TYPEFLAG_FLICENSED = 4, TYPEFLAG_FPREDECLID = 8, TYPEFLAG_FHIDDEN = 16, TYPEFLAG_FCONTROL = 32, TYPEFLAG_FDUAL = 64, TYPEFLAG_FNONEXTENSIBLE = 128, TYPEFLAG_FOLEAUTOMATION = 256, TYPEFLAG_FRESTRICTED = 512, TYPEFLAG_FAGGREGATABLE = 1024, TYPEFLAG_FREPLACEABLE = 2048, TYPEFLAG_FDISPATCHABLE = 4096, TYPEFLAG_FREVERSEBIND = 8192, TYPEFLAG_FPROXY = 16384 }; enum _PROC_THREAD_ATTRIBUTE_NUM { ProcThreadAttributeParentProcess = 0, ProcThreadAttributeExtendedFlags = 1, ProcThreadAttributeHandleList = 2, ProcThreadAttributeGroupAffinity = 3, ProcThreadAttributePreferredNode = 4, ProcThreadAttributeIdealProcessor = 5, ProcThreadAttributeUmsThread = 6, ProcThreadAttributeMitigationPolicy = 7, ProcThreadAttributePackageFullName = 8, ProcThreadAttributeSecurityCapabilities = 9, ProcThreadAttributeConsoleReference = 10, ProcThreadAttributeMax = 11 }; enum _SYSDBG_COMMAND { SysDbgQueryModuleInformation = 0, SysDbgQueryTraceInformation = 1, SysDbgSetTracepoint = 2, SysDbgSetSpecialCall = 3, SysDbgClearSpecialCalls = 4, SysDbgQuerySpecialCalls = 5, SysDbgBreakPoint = 6, SysDbgQueryVersion = 7, SysDbgReadVirtual = 8, SysDbgWriteVirtual = 9, SysDbgReadPhysical = 10, SysDbgWritePhysical = 11, SysDbgReadControlSpace = 12, SysDbgWriteControlSpace = 13, SysDbgReadIoSpace = 14, SysDbgWriteIoSpace = 15, SysDbgReadMsr = 16, SysDbgWriteMsr = 17, SysDbgReadBusData = 18, SysDbgWriteBusData = 19, SysDbgCheckLowMemory = 20, SysDbgEnableKernelDebugger = 21, SysDbgDisableKernelDebugger = 22, SysDbgGetAutoKdEnable = 23, SysDbgSetAutoKdEnable = 24, SysDbgGetPrintBufferSize = 25, SysDbgSetPrintBufferSize = 26, SysDbgGetKdUmExceptionEnable = 27, SysDbgSetKdUmExceptionEnable = 28, SysDbgGetTriageDump = 29, SysDbgGetKdBlockEnable = 30, SysDbgSetKdBlockEnable = 31, SysDbgRegisterForUmBreakInfo = 32, SysDbgGetUmBreakPid = 33, SysDbgClearUmBreakPid = 34, SysDbgGetUmAttachPid = 35, SysDbgClearUmAttachPid = 36 }; enum POWER_INFORMATION_LEVEL { SystemPowerPolicyAc = 0, SystemPowerPolicyDc = 1, VerifySystemPolicyAc = 2, VerifySystemPolicyDc = 3, SystemPowerCapabilities = 4, SystemBatteryState = 5, SystemPowerStateHandler = 6, ProcessorStateHandler = 7, SystemPowerPolicyCurrent = 8, AdministratorPowerPolicy = 9, SystemReserveHiberFile = 10, ProcessorInformation = 11, SystemPowerInformation = 12, ProcessorStateHandler2 = 13, LastWakeTime = 14, LastSleepTime = 15, SystemExecutionState = 16, SystemPowerStateNotifyHandler = 17, ProcessorPowerPolicyAc = 18, ProcessorPowerPolicyDc = 19, VerifyProcessorPowerPolicyAc = 20, VerifyProcessorPowerPolicyDc = 21, ProcessorPowerPolicyCurrent = 22, SystemPowerStateLogging = 23, SystemPowerLoggingEntry = 24, SetPowerSettingValue = 25, NotifyUserPowerSetting = 26, PowerInformationLevelUnused0 = 27, SystemMonitorHiberBootPowerOff = 28, SystemVideoState = 29, TraceApplicationPowerMessage = 30, TraceApplicationPowerMessageEnd = 31, ProcessorPerfStates = 32, ProcessorIdleStates = 33, ProcessorCap = 34, SystemWakeSource = 35, SystemHiberFileInformation = 36, TraceServicePowerMessage = 37, ProcessorLoad = 38, PowerShutdownNotification = 39, MonitorCapabilities = 40, SessionPowerInit = 41, SessionDisplayState = 42, PowerRequestCreate = 43, PowerRequestAction = 44, GetPowerRequestList = 45, ProcessorInformationEx = 46, NotifyUserModeLegacyPowerEvent = 47, GroupPark = 48, ProcessorIdleDomains = 49, WakeTimerList = 50, SystemHiberFileSize = 51, ProcessorIdleStatesHv = 52, ProcessorPerfStatesHv = 53, ProcessorPerfCapHv = 54, ProcessorSetIdle = 55, LogicalProcessorIdling = 56, UserPresence = 57, PowerSettingNotificationName = 58, GetPowerSettingValue = 59, IdleResiliency = 60, SessionRITState = 61, SessionConnectNotification = 62, SessionPowerCleanup = 63, SessionLockState = 64, SystemHiberbootState = 65, PlatformInformation = 66, PdcInvocation = 67, MonitorInvocation = 68, FirmwareTableInformationRegistered = 69, SetShutdownSelectedTime = 70, PowerInformationLevelMaximum = 71 }; enum _TOKEN_SECURITY_ATTRIBUTE_OPERATION { TOKEN_SECURITY_ATTRIBUTE_OPERATION_NONE = 0, TOKEN_SECURITY_ATTRIBUTE_OPERATION_REPLACE_ALL = 1, TOKEN_SECURITY_ATTRIBUTE_OPERATION_ADD = 2, TOKEN_SECURITY_ATTRIBUTE_OPERATION_DELETE = 3, TOKEN_SECURITY_ATTRIBUTE_OPERATION_REPLACE = 4 }; enum WELL_KNOWN_SID_TYPE { WinNullSid = 0, WinWorldSid = 1, WinLocalSid = 2, WinCreatorOwnerSid = 3, WinCreatorGroupSid = 4, WinCreatorOwnerServerSid = 5, WinCreatorGroupServerSid = 6, WinNtAuthoritySid = 7, WinDialupSid = 8, WinNetworkSid = 9, WinBatchSid = 10, WinInteractiveSid = 11, WinServiceSid = 12, WinAnonymousSid = 13, WinProxySid = 14, WinEnterpriseControllersSid = 15, WinSelfSid = 16, WinAuthenticatedUserSid = 17, WinRestrictedCodeSid = 18, WinTerminalServerSid = 19, WinRemoteLogonIdSid = 20, WinLogonIdsSid = 21, WinLocalSystemSid = 22, WinLocalServiceSid = 23, WinNetworkServiceSid = 24, WinBuiltinDomainSid = 25, WinBuiltinAdministratorsSid = 26, WinBuiltinUsersSid = 27, WinBuiltinGuestsSid = 28, WinBuiltinPowerUsersSid = 29, WinBuiltinAccountOperatorsSid = 30, WinBuiltinSystemOperatorsSid = 31, WinBuiltinPrintOperatorsSid = 32, WinBuiltinBackupOperatorsSid = 33, WinBuiltinReplicatorSid = 34, WinBuiltinPreWindows2000CompatibleAccessSid = 35, WinBuiltinRemoteDesktopUsersSid = 36, WinBuiltinNetworkConfigurationOperatorsSid = 37, WinAccountAdministratorSid = 38, WinAccountGuestSid = 39, WinAccountKrbtgtSid = 40, WinAccountDomainAdminsSid = 41, WinAccountDomainUsersSid = 42, WinAccountDomainGuestsSid = 43, WinAccountComputersSid = 44, WinAccountControllersSid = 45, WinAccountCertAdminsSid = 46, WinAccountSchemaAdminsSid = 47, WinAccountEnterpriseAdminsSid = 48, WinAccountPolicyAdminsSid = 49, WinAccountRasAndIasServersSid = 50, WinNTLMAuthenticationSid = 51, WinDigestAuthenticationSid = 52, WinSChannelAuthenticationSid = 53, WinThisOrganizationSid = 54, WinOtherOrganizationSid = 55, WinBuiltinIncomingForestTrustBuildersSid = 56, WinBuiltinPerfMonitoringUsersSid = 57, WinBuiltinPerfLoggingUsersSid = 58, WinBuiltinAuthorizationAccessSid = 59, WinBuiltinTerminalServerLicenseServersSid = 60, WinBuiltinDCOMUsersSid = 61, WinBuiltinIUsersSid = 62, WinIUserSid = 63, WinBuiltinCryptoOperatorsSid = 64, WinUntrustedLabelSid = 65, WinLowLabelSid = 66, WinMediumLabelSid = 67, WinHighLabelSid = 68, WinSystemLabelSid = 69, WinWriteRestrictedCodeSid = 70, WinCreatorOwnerRightsSid = 71, WinCacheablePrincipalsGroupSid = 72, WinNonCacheablePrincipalsGroupSid = 73, WinEnterpriseReadonlyControllersSid = 74, WinAccountReadonlyControllersSid = 75, WinBuiltinEventLogReadersGroup = 76, WinNewEnterpriseReadonlyControllersSid = 77, WinBuiltinCertSvcDComAccessGroup = 78, WinMediumPlusLabelSid = 79, WinLocalLogonSid = 80, WinConsoleLogonSid = 81, WinThisOrganizationCertificateSid = 82, WinApplicationPackageAuthoritySid = 83, WinBuiltinAnyPackageSid = 84, WinCapabilityInternetClientSid = 85, WinCapabilityInternetClientServerSid = 86, WinCapabilityPrivateNetworkClientServerSid = 87, WinCapabilityPicturesLibrarySid = 88, WinCapabilityVideosLibrarySid = 89, WinCapabilityMusicLibrarySid = 90, WinCapabilityDocumentsLibrarySid = 91, WinCapabilitySharedUserCertificatesSid = 92, WinCapabilityDefaultWindowsCredentialsSid = 93, WinCapabilityRemovableStorageSid = 94, WinBuiltinRDSRemoteAccessServersSid = 95, WinBuiltinRDSEndpointServersSid = 96, WinBuiltinRDSManagementServersSid = 97, WinUserModeDriversSid = 98, WinBuiltinHyperVAdminsSid = 99 }; enum VARENUM { VT_EMPTY = 0, VT_NULL = 1, VT_I2 = 2, VT_I4 = 3, VT_R4 = 4, VT_R8 = 5, VT_CY = 6, VT_DATE = 7, VT_BSTR = 8, VT_DISPATCH = 9, VT_ERROR = 10, VT_BOOL = 11, VT_VARIANT = 12, VT_UNKNOWN = 13, VT_DECIMAL = 14, VT_I1 = 16, VT_UI1 = 17, VT_UI2 = 18, VT_UI4 = 19, VT_I8 = 20, VT_UI8 = 21, VT_INT = 22, VT_UINT = 23, VT_VOID = 24, VT_HRESULT = 25, VT_PTR = 26, VT_SAFEARRAY = 27, VT_CARRAY = 28, VT_USERDEFINED = 29, VT_LPSTR = 30, VT_LPWSTR = 31, VT_RECORD = 36, VT_INT_PTR = 37, VT_UINT_PTR = 38, VT_FILETIME = 64, VT_BLOB = 65, VT_STREAM = 66, VT_STORAGE = 67, VT_STREAMED_OBJECT = 68, VT_STORED_OBJECT = 69, VT_BLOB_OBJECT = 70, VT_CF = 71, VT_CLSID = 72, VT_VERSIONED_STREAM = 73, VT_BSTR_BLOB = 4095, VT_VECTOR = 4096, VT_ARRAY = 8192, VT_BYREF = 16384, = 32770 }; enum POWER_ACTION { PowerActionNone = 0, PowerActionReserved = 1, PowerActionSleep = 2, PowerActionHibernate = 3, PowerActionShutdown = 4, PowerActionShutdownReset = 5, PowerActionShutdownOff = 6, PowerActionWarmEject = 7 }; enum tagMSHLFLAGS { MSHLFLAGS_NORMAL = 0, MSHLFLAGS_TABLESTRONG = 1, MSHLFLAGS_TABLEWEAK = 2, MSHLFLAGS_NOPING = 4, MSHLFLAGS_RESERVED1 = 8, MSHLFLAGS_RESERVED2 = 16, MSHLFLAGS_RESERVED3 = 32, MSHLFLAGS_RESERVED4 = 64 }; enum SHSTOCKICONID { SIID_DOCNOASSOC = 0, SIID_DOCASSOC = 1, SIID_APPLICATION = 2, SIID_FOLDER = 3, SIID_FOLDEROPEN = 4, SIID_DRIVE525 = 5, SIID_DRIVE35 = 6, SIID_DRIVEREMOVE = 7, SIID_DRIVEFIXED = 8, SIID_DRIVENET = 9, SIID_DRIVENETDISABLED = 10, SIID_DRIVECD = 11, SIID_DRIVERAM = 12, SIID_WORLD = 13, SIID_SERVER = 15, SIID_PRINTER = 16, SIID_MYNETWORK = 17, SIID_FIND = 22, SIID_HELP = 23, SIID_SHARE = 28, SIID_LINK = 29, SIID_SLOWFILE = 30, SIID_RECYCLER = 31, SIID_RECYCLERFULL = 32, SIID_MEDIACDAUDIO = 40, SIID_LOCK = 47, SIID_AUTOLIST = 49, SIID_PRINTERNET = 50, SIID_SERVERSHARE = 51, SIID_PRINTERFAX = 52, SIID_PRINTERFAXNET = 53, SIID_PRINTERFILE = 54, SIID_STACK = 55, SIID_MEDIASVCD = 56, SIID_STUFFEDFOLDER = 57, SIID_DRIVEUNKNOWN = 58, SIID_DRIVEDVD = 59, SIID_MEDIADVD = 60, SIID_MEDIADVDRAM = 61, SIID_MEDIADVDRW = 62, SIID_MEDIADVDR = 63, SIID_MEDIADVDROM = 64, SIID_MEDIACDAUDIOPLUS = 65, SIID_MEDIACDRW = 66, SIID_MEDIACDR = 67, SIID_MEDIACDBURN = 68, SIID_MEDIABLANKCD = 69, SIID_MEDIACDROM = 70, SIID_AUDIOFILES = 71, SIID_IMAGEFILES = 72, SIID_VIDEOFILES = 73, SIID_MIXEDFILES = 74, SIID_FOLDERBACK = 75, SIID_FOLDERFRONT = 76, SIID_SHIELD = 77, SIID_WARNING = 78, SIID_INFO = 79, SIID_ERROR = 80, SIID_KEY = 81, SIID_SOFTWARE = 82, SIID_RENAME = 83, SIID_DELETE = 84, SIID_MEDIAAUDIODVD = 85, SIID_MEDIAMOVIEDVD = 86, SIID_MEDIAENHANCEDCD = 87, SIID_MEDIAENHANCEDDVD = 88, SIID_MEDIAHDDVD = 89, SIID_MEDIABLURAY = 90, SIID_MEDIAVCD = 91, SIID_MEDIADVDPLUSR = 92, SIID_MEDIADVDPLUSRW = 93, SIID_DESKTOPPC = 94, SIID_MOBILEPC = 95, SIID_USERS = 96, SIID_MEDIASMARTMEDIA = 97, SIID_MEDIACOMPACTFLASH = 98, SIID_DEVICECELLPHONE = 99, SIID_DEVICECAMERA = 100, SIID_DEVICEVIDEOCAMERA = 101, SIID_DEVICEAUDIOPLAYER = 102, SIID_NETWORKCONNECT = 103, SIID_INTERNET = 104, SIID_ZIPFILE = 105, SIID_SETTINGS = 106, SIID_DRIVEHDDVD = 132, SIID_DRIVEBD = 133, SIID_MEDIAHDDVDROM = 134, SIID_MEDIAHDDVDR = 135, SIID_MEDIAHDDVDRAM = 136, SIID_MEDIABDROM = 137, SIID_MEDIABDR = 138, SIID_MEDIABDRE = 139, SIID_CLUSTEREDDRIVE = 140, SIID_MAX_ICONS = 175 }; enum _tagQUERYOPTION { QUERY_EXPIRATION_DATE = 1, QUERY_TIME_OF_LAST_CHANGE = 2, QUERY_CONTENT_ENCODING = 3, QUERY_CONTENT_TYPE = 4, QUERY_REFRESH = 5, QUERY_RECOMBINE = 6, QUERY_CAN_NAVIGATE = 7, QUERY_USES_NETWORK = 8, QUERY_IS_CACHED = 9, QUERY_IS_INSTALLEDENTRY = 10, QUERY_IS_CACHED_OR_MAPPED = 11, QUERY_USES_CACHE = 12, QUERY_IS_SECURE = 13, QUERY_IS_SAFE = 14, QUERY_USES_HISTORYFOLDER = 15, QUERY_IS_CACHED_AND_USABLE_OFFLINE = 16 }; enum _COPYFILE2_MESSAGE_TYPE { COPYFILE2_CALLBACK_NONE = 0, COPYFILE2_CALLBACK_CHUNK_STARTED = 1, COPYFILE2_CALLBACK_CHUNK_FINISHED = 2, COPYFILE2_CALLBACK_STREAM_STARTED = 3, COPYFILE2_CALLBACK_STREAM_FINISHED = 4, COPYFILE2_CALLBACK_POLL_CONTINUE = 5, COPYFILE2_CALLBACK_ERROR = 6, COPYFILE2_CALLBACK_MAX = 7 }; enum SYSGEOTYPE { GEO_NATION = 1, GEO_LATITUDE = 2, GEO_LONGITUDE = 3, GEO_ISO2 = 4, GEO_ISO3 = 5, GEO_RFC1766 = 6, GEO_LCID = 7, GEO_FRIENDLYNAME = 8, GEO_OFFICIALNAME = 9, GEO_TIMEZONES = 10, GEO_OFFICIALLANGUAGES = 11, GEO_ISO_UN_NUMBER = 12, GEO_PARENT = 13 }; enum _DPFLTR_TYPE { DPFLTR_SYSTEM_ID = 0, DPFLTR_SMSS_ID = 1, DPFLTR_SETUP_ID = 2, DPFLTR_NTFS_ID = 3, DPFLTR_FSTUB_ID = 4, DPFLTR_CRASHDUMP_ID = 5, DPFLTR_CDAUDIO_ID = 6, DPFLTR_CDROM_ID = 7, DPFLTR_CLASSPNP_ID = 8, DPFLTR_DISK_ID = 9, DPFLTR_REDBOOK_ID = 10, DPFLTR_STORPROP_ID = 11, DPFLTR_SCSIPORT_ID = 12, DPFLTR_SCSIMINIPORT_ID = 13, DPFLTR_CONFIG_ID = 14, DPFLTR_I8042PRT_ID = 15, DPFLTR_SERMOUSE_ID = 16, DPFLTR_LSERMOUS_ID = 17, DPFLTR_KBDHID_ID = 18, DPFLTR_MOUHID_ID = 19, DPFLTR_KBDCLASS_ID = 20, DPFLTR_MOUCLASS_ID = 21, DPFLTR_TWOTRACK_ID = 22, DPFLTR_WMILIB_ID = 23, DPFLTR_ACPI_ID = 24, DPFLTR_AMLI_ID = 25, DPFLTR_HALIA64_ID = 26, DPFLTR_VIDEO_ID = 27, DPFLTR_SVCHOST_ID = 28, DPFLTR_VIDEOPRT_ID = 29, DPFLTR_TCPIP_ID = 30, DPFLTR_DMSYNTH_ID = 31, DPFLTR_NTOSPNP_ID = 32, DPFLTR_FASTFAT_ID = 33, DPFLTR_SAMSS_ID = 34, DPFLTR_PNPMGR_ID = 35, DPFLTR_NETAPI_ID = 36, DPFLTR_SCSERVER_ID = 37, DPFLTR_SCCLIENT_ID = 38, DPFLTR_SERIAL_ID = 39, DPFLTR_SERENUM_ID = 40, DPFLTR_UHCD_ID = 41, DPFLTR_RPCPROXY_ID = 42, DPFLTR_AUTOCHK_ID = 43, DPFLTR_DCOMSS_ID = 44, DPFLTR_UNIMODEM_ID = 45, DPFLTR_SIS_ID = 46, DPFLTR_FLTMGR_ID = 47, DPFLTR_WMICORE_ID = 48, DPFLTR_BURNENG_ID = 49, DPFLTR_IMAPI_ID = 50, DPFLTR_SXS_ID = 51, DPFLTR_FUSION_ID = 52, DPFLTR_IDLETASK_ID = 53, DPFLTR_SOFTPCI_ID = 54, DPFLTR_TAPE_ID = 55, DPFLTR_MCHGR_ID = 56, DPFLTR_IDEP_ID = 57, DPFLTR_PCIIDE_ID = 58, DPFLTR_FLOPPY_ID = 59, DPFLTR_FDC_ID = 60, DPFLTR_TERMSRV_ID = 61, DPFLTR_W32TIME_ID = 62, DPFLTR_PREFETCHER_ID = 63, DPFLTR_RSFILTER_ID = 64, DPFLTR_FCPORT_ID = 65, DPFLTR_PCI_ID = 66, DPFLTR_DMIO_ID = 67, DPFLTR_DMCONFIG_ID = 68, DPFLTR_DMADMIN_ID = 69, DPFLTR_WSOCKTRANSPORT_ID = 70, DPFLTR_VSS_ID = 71, DPFLTR_PNPMEM_ID = 72, DPFLTR_PROCESSOR_ID = 73, DPFLTR_DMSERVER_ID = 74, DPFLTR_SR_ID = 75, DPFLTR_INFINIBAND_ID = 76, DPFLTR_IHVDRIVER_ID = 77, DPFLTR_IHVVIDEO_ID = 78, DPFLTR_IHVAUDIO_ID = 79, DPFLTR_IHVNETWORK_ID = 80, DPFLTR_IHVSTREAMING_ID = 81, DPFLTR_IHVBUS_ID = 82, DPFLTR_HPS_ID = 83, DPFLTR_RTLTHREADPOOL_ID = 84, DPFLTR_LDR_ID = 85, DPFLTR_TCPIP6_ID = 86, DPFLTR_ISAPNP_ID = 87, DPFLTR_SHPC_ID = 88, DPFLTR_STORPORT_ID = 89, DPFLTR_STORMINIPORT_ID = 90, DPFLTR_PRINTSPOOLER_ID = 91, DPFLTR_VSSDYNDISK_ID = 92, DPFLTR_VERIFIER_ID = 93, DPFLTR_VDS_ID = 94, DPFLTR_VDSBAS_ID = 95, DPFLTR_VDSDYN_ID = 96, DPFLTR_VDSDYNDR_ID = 97, DPFLTR_VDSLDR_ID = 98, DPFLTR_VDSUTIL_ID = 99, DPFLTR_DFRGIFC_ID = 100, DPFLTR_DEFAULT_ID = 101, DPFLTR_MM_ID = 102, DPFLTR_DFSC_ID = 103, DPFLTR_WOW64_ID = 104, DPFLTR_ALPC_ID = 105, DPFLTR_WDI_ID = 106, DPFLTR_PERFLIB_ID = 107, DPFLTR_KTM_ID = 108, DPFLTR_IOSTRESS_ID = 109, DPFLTR_HEAP_ID = 110, DPFLTR_WHEA_ID = 111, DPFLTR_USERGDI_ID = 112, DPFLTR_MMCSS_ID = 113, DPFLTR_TPM_ID = 114, DPFLTR_THREADORDER_ID = 115, DPFLTR_ENVIRON_ID = 116, DPFLTR_EMS_ID = 117, DPFLTR_WDT_ID = 118, DPFLTR_FVEVOL_ID = 119, DPFLTR_NDIS_ID = 120, DPFLTR_NVCTRACE_ID = 121, DPFLTR_LUAFV_ID = 122, DPFLTR_APPCOMPAT_ID = 123, DPFLTR_USBSTOR_ID = 124, DPFLTR_SBP2PORT_ID = 125, DPFLTR_COVERAGE_ID = 126, DPFLTR_CACHEMGR_ID = 127, DPFLTR_MOUNTMGR_ID = 128, DPFLTR_CFR_ID = 129, DPFLTR_TXF_ID = 130, DPFLTR_KSECDD_ID = 131, DPFLTR_FLTREGRESS_ID = 132, DPFLTR_MPIO_ID = 133, DPFLTR_MSDSM_ID = 134, DPFLTR_UDFS_ID = 135, DPFLTR_PSHED_ID = 136, DPFLTR_STORVSP_ID = 137, DPFLTR_LSASS_ID = 138, DPFLTR_SSPICLI_ID = 139, DPFLTR_CNG_ID = 140, DPFLTR_EXFAT_ID = 141, DPFLTR_FILETRACE_ID = 142, DPFLTR_XSAVE_ID = 143, DPFLTR_SE_ID = 144, DPFLTR_DRIVEEXTENDER_ID = 145, DPFLTR_POWER_ID = 146, DPFLTR_CRASHDUMPXHCI_ID = 147, DPFLTR_GPIO_ID = 148, DPFLTR_ENDOFTABLE_ID = 149 }; enum _PS_ATTRIBUTE_NUM { PsAttributeParentProcess = 0, PsAttributeDebugObject = 1, PsAttributeToken = 2, PsAttributeClientId = 3, PsAttributeTebAddress = 4, PsAttributeImageName = 5, PsAttributeImageInfo = 6, PsAttributeMemoryReserve = 7, PsAttributePriorityClass = 8, PsAttributeErrorMode = 9, PsAttributeStdHandleInfo = 10, PsAttributeHandleList = 11, PsAttributeGroupAffinity = 12, PsAttributePreferredNode = 13, PsAttributeIdealProcessor = 14, PsAttributeUmsThread = 15, PsAttributeMitigationOptions = 16, PsAttributeSecurityCapabilities = 17, PsAttributeMax = 18 }; enum _PROCESSINFOCLASS { ProcessBasicInformation = 0, ProcessQuotaLimits = 1, ProcessIoCounters = 2, ProcessVmCounters = 3, ProcessTimes = 4, ProcessBasePriority = 5, ProcessRaisePriority = 6, ProcessDebugPort = 7, ProcessExceptionPort = 8, ProcessAccessToken = 9, ProcessLdtInformation = 10, ProcessLdtSize = 11, ProcessDefaultHardErrorMode = 12, ProcessIoPortHandlers = 13, ProcessPooledUsageAndLimits = 14, ProcessWorkingSetWatch = 15, ProcessUserModeIOPL = 16, ProcessEnableAlignmentFaultFixup = 17, ProcessPriorityClass = 18, ProcessWx86Information = 19, ProcessHandleCount = 20, ProcessAffinityMask = 21, ProcessPriorityBoost = 22, ProcessDeviceMap = 23, ProcessSessionInformation = 24, ProcessForegroundInformation = 25, ProcessWow64Information = 26, ProcessImageFileName = 27, ProcessLUIDDeviceMapsEnabled = 28, ProcessBreakOnTermination = 29, ProcessDebugObjectHandle = 30, ProcessDebugFlags = 31, ProcessHandleTracing = 32, ProcessIoPriority = 33, ProcessExecuteFlags = 34, ProcessTlsInformation = 35, ProcessCookie = 36, ProcessImageInformation = 37, ProcessCycleTime = 38, ProcessPagePriority = 39, ProcessInstrumentationCallback = 40, ProcessThreadStackAllocation = 41, ProcessWorkingSetWatchEx = 42, ProcessImageFileNameWin32 = 43, ProcessImageFileMapping = 44, ProcessAffinityUpdateMode = 45, ProcessMemoryAllocationMode = 46, ProcessGroupInformation = 47, ProcessTokenVirtualizationEnabled = 48, ProcessConsoleHostProcess = 49, ProcessWindowInformation = 50, ProcessHandleInformation = 51, ProcessMitigationPolicy = 52, ProcessDynamicFunctionTableInformation = 53, ProcessHandleCheckingMode = 54, ProcessKeepAliveCount = 55, ProcessRevokeFileHandles = 56, MaxProcessInfoClass = 57 }; enum _tagPARSEACTION { PARSE_CANONICALIZE = 1, PARSE_FRIENDLY = 2, PARSE_SECURITY_URL = 3, PARSE_ROOTDOCUMENT = 4, PARSE_DOCUMENT = 5, PARSE_ANCHOR = 6, PARSE_ENCODE_IS_UNESCAPE = 7, PARSE_DECODE_IS_ESCAPE = 8, PARSE_PATH_FROM_URL = 9, PARSE_URL_FROM_PATH = 10, PARSE_MIME = 11, PARSE_SERVER = 12, PARSE_SCHEMA = 13, PARSE_SITE = 14, PARSE_DOMAIN = 15, PARSE_LOCATION = 16, PARSE_SECURITY_DOMAIN = 17, PARSE_ESCAPE = 18, PARSE_UNESCAPE = 19 }; enum _SYSTEM_INFORMATION_CLASS { SystemBasicInformation = 0, SystemProcessorInformation = 1, SystemPerformanceInformation = 2, SystemTimeOfDayInformation = 3, SystemPathInformation = 4, SystemProcessInformation = 5, SystemCallCountInformation = 6, SystemDeviceInformation = 7, SystemProcessorPerformanceInformation = 8, SystemFlagsInformation = 9, SystemCallTimeInformation = 10, SystemModuleInformation = 11, SystemLocksInformation = 12, SystemStackTraceInformation = 13, SystemPagedPoolInformation = 14, SystemNonPagedPoolInformation = 15, SystemHandleInformation = 16, SystemObjectInformation = 17, SystemPageFileInformation = 18, SystemVdmInstemulInformation = 19, SystemVdmBopInformation = 20, SystemFileCacheInformation = 21, SystemPoolTagInformation = 22, SystemInterruptInformation = 23, SystemDpcBehaviorInformation = 24, SystemFullMemoryInformation = 25, SystemLoadGdiDriverInformation = 26, SystemUnloadGdiDriverInformation = 27, SystemTimeAdjustmentInformation = 28, SystemSummaryMemoryInformation = 29, SystemMirrorMemoryInformation = 30, SystemPerformanceTraceInformation = 31, SystemObsolete0 = 32, SystemExceptionInformation = 33, SystemCrashDumpStateInformation = 34, SystemKernelDebuggerInformation = 35, SystemContextSwitchInformation = 36, SystemRegistryQuotaInformation = 37, SystemExtendServiceTableInformation = 38, SystemPrioritySeperation = 39, SystemVerifierAddDriverInformation = 40, SystemVerifierRemoveDriverInformation = 41, SystemProcessorIdleInformation = 42, SystemLegacyDriverInformation = 43, SystemCurrentTimeZoneInformation = 44, SystemLookasideInformation = 45, SystemTimeSlipNotification = 46, SystemSessionCreate = 47, SystemSessionDetach = 48, SystemSessionInformation = 49, SystemRangeStartInformation = 50, SystemVerifierInformation = 51, SystemVerifierThunkExtend = 52, SystemSessionProcessInformation = 53, SystemLoadGdiDriverInSystemSpace = 54, SystemNumaProcessorMap = 55, SystemPrefetcherInformation = 56, SystemExtendedProcessInformation = 57, SystemRecommendedSharedDataAlignment = 58, SystemComPlusPackage = 59, SystemNumaAvailableMemory = 60, SystemProcessorPowerInformation = 61, SystemEmulationBasicInformation = 62, SystemEmulationProcessorInformation = 63, SystemExtendedHandleInformation = 64, SystemLostDelayedWriteInformation = 65, SystemBigPoolInformation = 66, SystemSessionPoolTagInformation = 67, SystemSessionMappedViewInformation = 68, SystemHotpatchInformation = 69, SystemObjectSecurityMode = 70, SystemWatchdogTimerHandler = 71, SystemWatchdogTimerInformation = 72, SystemLogicalProcessorInformation = 73, SystemWow64SharedInformationObsolete = 74, SystemRegisterFirmwareTableInformationHandler = 75, SystemFirmwareTableInformation = 76, SystemModuleInformationEx = 77, SystemVerifierTriageInformation = 78, SystemSuperfetchInformation = 79, SystemMemoryListInformation = 80, SystemFileCacheInformationEx = 81, SystemThreadPriorityClientIdInformation = 82, SystemProcessorIdleCycleTimeInformation = 83, SystemVerifierCancellationInformation = 84, SystemProcessorPowerInformationEx = 85, SystemRefTraceInformation = 86, SystemSpecialPoolInformation = 87, SystemProcessIdInformation = 88, SystemErrorPortInformation = 89, SystemBootEnvironmentInformation = 90, SystemHypervisorInformation = 91, SystemVerifierInformationEx = 92, SystemTimeZoneInformation = 93, SystemImageFileExecutionOptionsInformation = 94, SystemCoverageInformation = 95, SystemPrefetchPatchInformation = 96, SystemVerifierFaultsInformation = 97, SystemSystemPartitionInformation = 98, SystemSystemDiskInformation = 99, SystemProcessorPerformanceDistribution = 100, SystemNumaProximityNodeInformation = 101, SystemDynamicTimeZoneInformation = 102, SystemCodeIntegrityInformation = 103, SystemProcessorMicrocodeUpdateInformation = 104, SystemProcessorBrandString = 105, SystemVirtualAddressInformation = 106, SystemLogicalProcessorAndGroupInformation = 107, SystemProcessorCycleTimeInformation = 108, SystemStoreInformation = 109, SystemRegistryAppendString = 110, SystemAitSamplingValue = 111, SystemVhdBootInformation = 112, SystemCpuQuotaInformation = 113, SystemNativeBasicInformation = 114, SystemErrorPortTimeouts = 115, SystemLowPriorityIoInformation = 116, SystemBootEntropyInformation = 117, SystemVerifierCountersInformation = 118, SystemPagedPoolInformationEx = 119, SystemSystemPtesInformationEx = 120, SystemNodeDistanceInformation = 121, SystemAcpiAuditInformation = 122, SystemBasicPerformanceInformation = 123, SystemQueryPerformanceCounterInformation = 124, SystemSessionBigPoolInformation = 125, SystemBootGraphicsInformation = 126, SystemScrubPhysicalMemoryInformation = 127, SystemBadPageInformation = 128, SystemProcessorProfileControlArea = 129, SystemCombinePhysicalMemoryInformation = 130, SystemEntropyInterruptTimingCallback = 131, SystemConsoleInformation = 132, SystemPlatformBinaryInformation = 133, SystemThrottleNotificationInformation = 134, SystemHypervisorProcessorCountInformation = 135, SystemDeviceDataInformation = 136, SystemDeviceDataEnumerationInformation = 137, SystemMemoryTopologyInformation = 138, SystemMemoryChannelInformation = 139, SystemBootLogoInformation = 140, MaxSystemInfoClass = 141 }; enum DISPLAYCONFIG_SCALING { DISPLAYCONFIG_SCALING_IDENTITY = 1, DISPLAYCONFIG_SCALING_CENTERED = 2, DISPLAYCONFIG_SCALING_STRETCHED = 3, DISPLAYCONFIG_SCALING_ASPECTRATIOCENTEREDMAX = 4, DISPLAYCONFIG_SCALING_CUSTOM = 5, DISPLAYCONFIG_SCALING_PREFERRED = 128, DISPLAYCONFIG_SCALING_FORCE_UINT32 = -1 }; enum DISPLAYCONFIG_DEVICE_INFO_TYPE { DISPLAYCONFIG_DEVICE_INFO_GET_SOURCE_NAME = 1, DISPLAYCONFIG_DEVICE_INFO_GET_TARGET_NAME = 2, DISPLAYCONFIG_DEVICE_INFO_GET_TARGET_PREFERRED_MODE = 3, DISPLAYCONFIG_DEVICE_INFO_GET_ADAPTER_NAME = 4, DISPLAYCONFIG_DEVICE_INFO_SET_TARGET_PERSISTENCE = 5, DISPLAYCONFIG_DEVICE_INFO_FORCE_UINT32 = -1 }; enum _PLUGPLAY_CONTROL_CLASS { PlugPlayControlEnumerateDevice = 0, PlugPlayControlRegisterNewDevice = 1, PlugPlayControlDeregisterDevice = 2, PlugPlayControlInitializeDevice = 3, PlugPlayControlStartDevice = 4, PlugPlayControlUnlockDevice = 5, PlugPlayControlQueryAndRemoveDevice = 6, PlugPlayControlUserResponse = 7, PlugPlayControlGenerateLegacyDevice = 8, PlugPlayControlGetInterfaceDeviceList = 9, PlugPlayControlProperty = 10, PlugPlayControlDeviceClassAssociation = 11, PlugPlayControlGetRelatedDevice = 12, PlugPlayControlGetInterfaceDeviceAlias = 13, PlugPlayControlDeviceStatus = 14, PlugPlayControlGetDeviceDepth = 15, PlugPlayControlQueryDeviceRelations = 16, PlugPlayControlTargetDeviceRelation = 17, PlugPlayControlQueryConflictList = 18, PlugPlayControlRetrieveDock = 19, PlugPlayControlResetDevice = 20, PlugPlayControlHaltDevice = 21, PlugPlayControlGetBlockedDriverList = 22, MaxPlugPlayControl = 23 }; enum ReplacesCorHdrNumericDefines { COMIMAGE_FLAGS_ILONLY = 1, COMIMAGE_FLAGS_32BITREQUIRED = 2, COMIMAGE_FLAGS_IL_LIBRARY = 4, COMIMAGE_FLAGS_STRONGNAMESIGNED = 8, COMIMAGE_FLAGS_NATIVE_ENTRYPOINT = 16, /* COMIMAGE_FLAGS_TRACKDEBUGDATA = Unavail */ }; enum _SYSTEM_VA_TYPE { SystemVaTypeAll = 0, SystemVaTypeNonPagedPool = 1, SystemVaTypePagedPool = 2, SystemVaTypeSystemCache = 3, SystemVaTypeSystemPtes = 4, SystemVaTypeSessionSpace = 5, SystemVaTypeMax = 6 }; enum _INTERFACE_TYPE { InterfaceTypeUndefined = -1, Internal = 0, Isa = 1, Eisa = 2, MicroChannel = 3, TurboChannel = 4, PCIBus = 5, VMEBus = 6, NuBus = 7, PCMCIABus = 8, CBus = 9, MPIBus = 10, MPSABus = 11, ProcessorInternal = 12, InternalPowerBus = 13, PNPISABus = 14, PNPBus = 15, Vmcs = 16, ACPIBus = 17, MaximumInterfaceType = 18 }; enum _KPROFILE_SOURCE { ProfileTime = 0, ProfileAlignmentFixup = 1, ProfileTotalIssues = 2, ProfilePipelineDry = 3, ProfileLoadInstructions = 4, ProfilePipelineFrozen = 5, ProfileBranchInstructions = 6, ProfileTotalNonissues = 7, ProfileDcacheMisses = 8, ProfileIcacheMisses = 9, ProfileCacheMisses = 10, ProfileBranchMispredictions = 11, ProfileStoreInstructions = 12, ProfileFpInstructions = 13, ProfileIntegerInstructions = 14, Profile2Issue = 15, Profile3Issue = 16, Profile4Issue = 17, ProfileSpecialInstructions = 18, ProfileTotalCycles = 19, ProfileIcacheIssues = 20, ProfileDcacheAccesses = 21, ProfileMemoryBarrierCycles = 22, ProfileLoadLinkedIssues = 23, ProfileMaximum = 24 }; enum _INSTALLSPECTYPE { APPNAME = 1, FILEEXT = 2, PROGID = 3, COMCLASS = 4 }; enum __MIDL_IInternetSecurityManager_0001 { PUAF_DEFAULT = 0, PUAF_NOUI = 1, PUAF_ISFILE = 2, PUAF_WARN_IF_DENIED = 4, PUAF_FORCEUI_FOREGROUND = 8, PUAF_CHECK_TIFS = 16, PUAF_DONTCHECKBOXINDIALOG = 32, PUAF_TRUSTED = 64, PUAF_ACCEPT_WILDCARD_SCHEME = 128, PUAF_ENFORCERESTRICTED = 256, PUAF_NOSAVEDFILECHECK = 512, PUAF_REQUIRESAVEDFILECHECK = 1024, PUAF_DONT_USE_CACHE = 4096, PUAF_RESERVED1 = 8192, PUAF_RESERVED2 = 16384, /* PUAF_LMZ_UNLOCKED = Unavail */ }; enum PROXY_PHASE { PROXY_CALCSIZE = 0, PROXY_GETBUFFER = 1, PROXY_MARSHAL = 2, PROXY_SENDRECEIVE = 3, PROXY_UNMARSHAL = 4 }; enum _IDL_CS_CONVERT { IDL_CS_NO_CONVERT = 0, IDL_CS_IN_PLACE_CONVERT = 1, IDL_CS_NEW_BUFFER_CONVERT = 2 }; enum _BUS_DATA_TYPE { ConfigurationSpaceUndefined = -1, Cmos = 0, EisaConfiguration = 1, Pos = 2, CbusConfiguration = 3, PCIConfiguration = 4, VMEConfiguration = 5, NuBusConfiguration = 6, PCMCIAConfiguration = 7, MPIConfiguration = 8, MPSAConfiguration = 9, PNPISAConfiguration = 10, SgiInternalConfiguration = 11, MaximumBusDataType = 12 }; enum tagSTGC { STGC_DEFAULT = 0, STGC_OVERWRITE = 1, STGC_ONLYIFCURRENT = 2, STGC_DANGEROUSLYCOMMITMERELYTODISKCACHE = 4, STGC_CONSOLIDATE = 8 }; enum _RTL_PATH_TYPE { RtlPathTypeUnknown = 0, RtlPathTypeUncAbsolute = 1, RtlPathTypeDriveAbsolute = 2, RtlPathTypeDriveRelative = 3, RtlPathTypeRooted = 4, RtlPathTypeRelative = 5, RtlPathTypeLocalDevice = 6, RtlPathTypeRootLocalDevice = 7 }; enum _WORKER_FACTORY_CALLBACK_CLASS { WorkerFactoryCallbackNormal = 0, WorkerFactoryCallbackLongRunning = 1, WorkerFactoryCallbackIndependent = 2, WorkerFactoryCallbackDetectedUnrecoverableError = 3 }; enum SYSTEM_POWER_CONDITION { PoAc = 0, PoDc = 1, PoHot = 2, PoConditionMaximum = 3 }; enum tagTYPEKIND { TKIND_ENUM = 0, TKIND_RECORD = 1, TKIND_MODULE = 2, TKIND_INTERFACE = 3, TKIND_DISPATCH = 4, TKIND_COCLASS = 5, TKIND_ALIAS = 6, TKIND_UNION = 7, TKIND_MAX = 8 }; enum _MUTANT_INFORMATION_CLASS { MutantBasicInformation = 0, MutantOwnerInformation = 1 }; enum tagBINDSTATUS { BINDSTATUS_FINDINGRESOURCE = 1, BINDSTATUS_CONNECTING = 2, BINDSTATUS_REDIRECTING = 3, BINDSTATUS_BEGINDOWNLOADDATA = 4, BINDSTATUS_DOWNLOADINGDATA = 5, BINDSTATUS_ENDDOWNLOADDATA = 6, BINDSTATUS_BEGINDOWNLOADCOMPONENTS = 7, BINDSTATUS_INSTALLINGCOMPONENTS = 8, BINDSTATUS_ENDDOWNLOADCOMPONENTS = 9, BINDSTATUS_USINGCACHEDCOPY = 10, BINDSTATUS_SENDINGREQUEST = 11, BINDSTATUS_CLASSIDAVAILABLE = 12, BINDSTATUS_MIMETYPEAVAILABLE = 13, BINDSTATUS_CACHEFILENAMEAVAILABLE = 14, BINDSTATUS_BEGINSYNCOPERATION = 15, BINDSTATUS_ENDSYNCOPERATION = 16, BINDSTATUS_BEGINUPLOADDATA = 17, BINDSTATUS_UPLOADINGDATA = 18, BINDSTATUS_ENDUPLOADDATA = 19, BINDSTATUS_PROTOCOLCLASSID = 20, BINDSTATUS_ENCODING = 21, BINDSTATUS_VERIFIEDMIMETYPEAVAILABLE = 22, BINDSTATUS_CLASSINSTALLLOCATION = 23, BINDSTATUS_DECODING = 24, BINDSTATUS_LOADINGMIMEHANDLER = 25, BINDSTATUS_CONTENTDISPOSITIONATTACH = 26, BINDSTATUS_FILTERREPORTMIMETYPE = 27, BINDSTATUS_CLSIDCANINSTANTIATE = 28, BINDSTATUS_IUNKNOWNAVAILABLE = 29, BINDSTATUS_DIRECTBIND = 30, BINDSTATUS_RAWMIMETYPE = 31, BINDSTATUS_PROXYDETECTING = 32, BINDSTATUS_ACCEPTRANGES = 33, BINDSTATUS_COOKIE_SENT = 34, BINDSTATUS_COMPACT_POLICY_RECEIVED = 35, BINDSTATUS_COOKIE_SUPPRESSED = 36, BINDSTATUS_COOKIE_STATE_UNKNOWN = 37, BINDSTATUS_COOKIE_STATE_ACCEPT = 38, BINDSTATUS_COOKIE_STATE_REJECT = 39, BINDSTATUS_COOKIE_STATE_PROMPT = 40, BINDSTATUS_COOKIE_STATE_LEASH = 41, BINDSTATUS_COOKIE_STATE_DOWNGRADE = 42, BINDSTATUS_POLICY_HREF = 43, BINDSTATUS_P3P_HEADER = 44, BINDSTATUS_SESSION_COOKIE_RECEIVED = 45, BINDSTATUS_PERSISTENT_COOKIE_RECEIVED = 46, BINDSTATUS_SESSION_COOKIES_ALLOWED = 47, BINDSTATUS_CACHECONTROL = 48, BINDSTATUS_CONTENTDISPOSITIONFILENAME = 49, BINDSTATUS_MIMETEXTPLAINMISMATCH = 50, BINDSTATUS_PUBLISHERAVAILABLE = 51, BINDSTATUS_DISPLAYNAMEAVAILABLE = 52, BINDSTATUS_SSLUX_NAVBLOCKED = 53, BINDSTATUS_SERVER_MIMETYPEAVAILABLE = 54, BINDSTATUS_SNIFFED_CLASSIDAVAILABLE = 55, BINDSTATUS_64BIT_PROGRESS = 56, BINDSTATUS_LAST = 56, BINDSTATUS_RESERVED_0 = 57, BINDSTATUS_RESERVED_1 = 58, BINDSTATUS_RESERVED_2 = 59, BINDSTATUS_RESERVED_3 = 60, BINDSTATUS_RESERVED_4 = 61, BINDSTATUS_RESERVED_5 = 62, BINDSTATUS_RESERVED_6 = 63, BINDSTATUS_RESERVED_7 = 64, BINDSTATUS_RESERVED_8 = 65, BINDSTATUS_RESERVED_9 = 66, BINDSTATUS_LAST_PRIVATE = 66 }; enum __MIDL_IUri_0001 { Uri_PROPERTY_ABSOLUTE_URI = 0, Uri_PROPERTY_STRING_START = 0, Uri_PROPERTY_AUTHORITY = 1, Uri_PROPERTY_DISPLAY_URI = 2, Uri_PROPERTY_DOMAIN = 3, Uri_PROPERTY_EXTENSION = 4, Uri_PROPERTY_FRAGMENT = 5, Uri_PROPERTY_HOST = 6, Uri_PROPERTY_PASSWORD = 7, Uri_PROPERTY_PATH = 8, Uri_PROPERTY_PATH_AND_QUERY = 9, Uri_PROPERTY_QUERY = 10, Uri_PROPERTY_RAW_URI = 11, Uri_PROPERTY_SCHEME_NAME = 12, Uri_PROPERTY_USER_INFO = 13, Uri_PROPERTY_USER_NAME = 14, Uri_PROPERTY_STRING_LAST = 14, Uri_PROPERTY_HOST_TYPE = 15, Uri_PROPERTY_DWORD_START = 15, Uri_PROPERTY_PORT = 16, Uri_PROPERTY_SCHEME = 17, Uri_PROPERTY_ZONE = 18, Uri_PROPERTY_DWORD_LAST = 18 }; enum _JOURNAL_CHANGE_INFORMATION_CLASS { JournalCreateKey = 0, JournalDeleteKey = 1, JournalRenameKey = 2, JournalSetValue = 3, JournalDeleteValue = 4, JournalSetKeySecurity = 5, JournalSetKeyUserFlags = 6, JournalSetLastWriteTime = 7, JournalBeginTransaction = 8, JournalCommitTransaction = 9, JournalAbortTransaction = 10, MaxJournalChangeAction = 11 }; enum _TP_TRACE_TYPE { TpTraceThreadPriority = 1, TpTraceThreadAffinity = 2, MaxTpTraceType = 3 }; enum tagOLERENDER { OLERENDER_NONE = 0, OLERENDER_DRAW = 1, OLERENDER_FORMAT = 2, OLERENDER_ASIS = 3 }; /* enum tagMKREDUCE { MKRREDUCE_ONE = Unavail }; */ enum POWER_STATE_HANDLER_TYPE { PowerStateSleeping1 = 0, PowerStateSleeping2 = 1, PowerStateSleeping3 = 2, PowerStateSleeping4 = 3, PowerStateShutdownOff = 4, PowerStateShutdownReset = 5, PowerStateSleeping4Firmware = 6, PowerStateMaximum = 7 }; enum _tagINTERNETFEATURELIST { FEATURE_OBJECT_CACHING = 0, FEATURE_ZONE_ELEVATION = 1, FEATURE_MIME_HANDLING = 2, FEATURE_MIME_SNIFFING = 3, FEATURE_WINDOW_RESTRICTIONS = 4, FEATURE_WEBOC_POPUPMANAGEMENT = 5, FEATURE_BEHAVIORS = 6, FEATURE_DISABLE_MK_PROTOCOL = 7, FEATURE_LOCALMACHINE_LOCKDOWN = 8, FEATURE_SECURITYBAND = 9, FEATURE_RESTRICT_ACTIVEXINSTALL = 10, FEATURE_VALIDATE_NAVIGATE_URL = 11, FEATURE_RESTRICT_FILEDOWNLOAD = 12, FEATURE_ADDON_MANAGEMENT = 13, FEATURE_PROTOCOL_LOCKDOWN = 14, FEATURE_HTTP_USERNAME_PASSWORD_DISABLE = 15, FEATURE_SAFE_BINDTOOBJECT = 16, FEATURE_UNC_SAVEDFILECHECK = 17, FEATURE_GET_URL_DOM_FILEPATH_UNENCODED = 18, FEATURE_TABBED_BROWSING = 19, FEATURE_SSLUX = 20, FEATURE_DISABLE_NAVIGATION_SOUNDS = 21, FEATURE_DISABLE_LEGACY_COMPRESSION = 22, FEATURE_FORCE_ADDR_AND_STATUS = 23, FEATURE_XMLHTTP = 24, FEATURE_DISABLE_TELNET_PROTOCOL = 25, FEATURE_FEEDS = 26, FEATURE_BLOCK_INPUT_PROMPTS = 27, FEATURE_ENTRY_COUNT = 28 }; enum _DMA_WIDTH { Width8Bits = 0, Width16Bits = 1, Width32Bits = 2, Width64Bits = 3, WidthNoWrap = 4, MaximumDmaWidth = 5 }; enum __MIDL_IBindStatusCallback_0006 { BSCF_FIRSTDATANOTIFICATION = 1, BSCF_INTERMEDIATEDATANOTIFICATION = 2, BSCF_LASTDATANOTIFICATION = 4, BSCF_DATAFULLYAVAILABLE = 8, BSCF_AVAILABLEDATASIZEUNKNOWN = 16, BSCF_SKIPDRAINDATAFORFILEURLS = 32, BSCF_64BITLENGTHDOWNLOAD = 64 }; enum DISPLAYCONFIG_PIXELFORMAT { DISPLAYCONFIG_PIXELFORMAT_8BPP = 1, DISPLAYCONFIG_PIXELFORMAT_16BPP = 2, DISPLAYCONFIG_PIXELFORMAT_24BPP = 3, DISPLAYCONFIG_PIXELFORMAT_32BPP = 4, DISPLAYCONFIG_PIXELFORMAT_NONGDI = 5, DISPLAYCONFIG_PIXELFORMAT_FORCE_UINT32 = -1 }; enum _SAFER_POLICY_INFO_CLASS { SaferPolicyLevelList = 1, SaferPolicyEnableTransparentEnforcement = 2, SaferPolicyDefaultLevel = 3, SaferPolicyEvaluateUserScope = 4, SaferPolicyScopeFlags = 5, SaferPolicyDefaultLevelFlags = 6, SaferPolicyAuthenticodeEnabled = 7 }; enum TrustLevel { BaseTrust = 0, PartialTrust = 1, FullTrust = 2 }; enum tagBINDSTRING { BINDSTRING_HEADERS = 1, BINDSTRING_ACCEPT_MIMES = 2, BINDSTRING_EXTRA_URL = 3, BINDSTRING_LANGUAGE = 4, BINDSTRING_USERNAME = 5, BINDSTRING_PASSWORD = 6, BINDSTRING_UA_PIXELS = 7, BINDSTRING_UA_COLOR = 8, BINDSTRING_OS = 9, BINDSTRING_USER_AGENT = 10, BINDSTRING_ACCEPT_ENCODINGS = 11, BINDSTRING_POST_COOKIE = 12, BINDSTRING_POST_DATA_MIME = 13, BINDSTRING_URL = 14, BINDSTRING_IID = 15, BINDSTRING_FLAG_BIND_TO_OBJECT = 16, BINDSTRING_PTR_BIND_CONTEXT = 17, BINDSTRING_XDR_ORIGIN = 18, BINDSTRING_DOWNLOADPATH = 19, BINDSTRING_ROOTDOC_URL = 20, BINDSTRING_INITIAL_FILENAME = 21 }; enum tagORIENTATION_PREFERENCE { ORIENTATION_PREFERENCE_NONE = 0, ORIENTATION_PREFERENCE_LANDSCAPE = 1, ORIENTATION_PREFERENCE_PORTRAIT = 2, ORIENTATION_PREFERENCE_LANDSCAPE_FLIPPED = 4, ORIENTATION_PREFERENCE_PORTRAIT_FLIPPED = 8 }; enum _FP_IEEE_OPERATION_CODE { FpCodeUnspecified = 0, FpCodeAdd = 1, FpCodeSubtract = 2, FpCodeMultiply = 3, FpCodeDivide = 4, FpCodeSquareRoot = 5, FpCodeRemainder = 6, FpCodeCompare = 7, FpCodeConvert = 8, FpCodeRound = 9, FpCodeTruncate = 10, FpCodeFloor = 11, FpCodeCeil = 12, FpCodeAcos = 13, FpCodeAsin = 14, FpCodeAtan = 15, FpCodeAtan2 = 16, FpCodeCabs = 17, FpCodeCos = 18, FpCodeCosh = 19, FpCodeExp = 20, FpCodeFabs = 21, FpCodeFmod = 22, FpCodeFrexp = 23, FpCodeHypot = 24, FpCodeLdexp = 25, FpCodeLog = 26, FpCodeLog10 = 27, FpCodeModf = 28, FpCodePow = 29, FpCodeSin = 30, FpCodeSinh = 31, FpCodeTan = 32, FpCodeTanh = 33, FpCodeY0 = 34, FpCodeY1 = 35, FpCodeYn = 36 }; enum tagLIBFLAGS { LIBFLAG_FRESTRICTED = 1, LIBFLAG_FCONTROL = 2, LIBFLAG_FHIDDEN = 4, LIBFLAG_FHASDISKIMAGE = 8 }; enum tagCOMCALLTYPE { CALLTYPE_OUTGOING_CALL = 0, CALLTYPE_INCOMING_CALL = 1, CALLTYPE_ACTIVATION = 2 }; enum _RTL_RXACT_OPERATION { RtlRXactOperationDelete = 1, RtlRXactOperationSetValue = 2, RtlRXactOperationDelAttribute = 3, RtlRXactOperationSetAttribute = 4 }; enum _IRQ_PRIORITY { IrqPriorityUndefined = 0, IrqPriorityLow = 1, IrqPriorityNormal = 2, IrqPriorityHigh = 3 }; enum PO_FIXED_WAKE_SOURCE_TYPE { FixedWakeSourcePowerButton = 0, FixedWakeSourceSleepButton = 1, FixedWakeSourceRtc = 2, FixedWakeSourceDozeToHibernate = 3 }; enum _THREADINFOCLASS { ThreadBasicInformation = 0, ThreadTimes = 1, ThreadPriority = 2, ThreadBasePriority = 3, ThreadAffinityMask = 4, ThreadImpersonationToken = 5, ThreadDescriptorTableEntry = 6, ThreadEnableAlignmentFaultFixup = 7, ThreadEventPair_Reusable = 8, ThreadQuerySetWin32StartAddress = 9, ThreadZeroTlsCell = 10, ThreadPerformanceCount = 11, ThreadAmILastThread = 12, ThreadIdealProcessor = 13, ThreadPriorityBoost = 14, ThreadSetTlsArrayAddress = 15, ThreadIsIoPending = 16, ThreadHideFromDebugger = 17, ThreadBreakOnTermination = 18, ThreadSwitchLegacyState = 19, ThreadIsTerminated = 20, ThreadLastSystemCall = 21, ThreadIoPriority = 22, ThreadCycleTime = 23, ThreadPagePriority = 24, ThreadActualBasePriority = 25, ThreadTebInformation = 26, ThreadCSwitchMon = 27, ThreadCSwitchPmu = 28, ThreadWow64Context = 29, ThreadGroupInformation = 30, ThreadUmsInformation = 31, ThreadCounterProfiling = 32, ThreadIdealProcessorEx = 33, ThreadCpuAccountingInformation = 34, ThreadSwitchStackCheck = 35, MaxThreadInfoClass = 36 }; enum _SE_AUDIT_OPERATION { AuditPrivilegeObject = 0, AuditPrivilegeService = 1, AuditAccessCheck = 2, AuditOpenObject = 3, AuditOpenObjectWithTransaction = 4, AuditCloseObject = 5, AuditDeleteObject = 6, AuditOpenObjectForDelete = 7, AuditOpenObjectForDeleteWithTransaction = 8, AuditCloseNonObject = 9, AuditOpenNonObject = 10, AuditObjectReference = 11, AuditHandleCreation = 12 }; enum _SAFER_OBJECT_INFO_CLASS { SaferObjectLevelId = 1, SaferObjectScopeId = 2, SaferObjectFriendlyName = 3, SaferObjectDescription = 4, SaferObjectBuiltin = 5, SaferObjectDisallowed = 6, SaferObjectDisableMaxPrivilege = 7, SaferObjectInvertDeletedPrivileges = 8, SaferObjectDeletedPrivileges = 9, SaferObjectDefaultOwner = 10, SaferObjectSidsToDisable = 11, SaferObjectRestrictedSidsInverted = 12, SaferObjectRestrictedSidsAdded = 13, SaferObjectAllIdentificationGuids = 14, SaferObjectSingleIdentification = 15, SaferObjectExtendedError = 16 }; enum DCOM_ENDPOINT_FLAGS { fUseInternetPorts = 1 }; enum _TOKEN_INFORMATION_CLASS { TokenUser = 1, TokenGroups = 2, TokenPrivileges = 3, TokenOwner = 4, TokenPrimaryGroup = 5, TokenDefaultDacl = 6, TokenSource = 7, TokenType = 8, TokenImpersonationLevel = 9, TokenStatistics = 10, TokenRestrictedSids = 11, TokenSessionId = 12, TokenGroupsAndPrivileges = 13, TokenSessionReference = 14, TokenSandBoxInert = 15, TokenAuditPolicy = 16, TokenOrigin = 17, TokenElevationType = 18, TokenLinkedToken = 19, TokenElevation = 20, TokenHasRestrictions = 21, TokenAccessInformation = 22, TokenVirtualizationAllowed = 23, TokenVirtualizationEnabled = 24, TokenIntegrityLevel = 25, TokenUIAccess = 26, TokenMandatoryPolicy = 27, TokenLogonSid = 28, TokenIsAppContainer = 29, TokenCapabilities = 30, TokenAppContainerSid = 31, TokenAppContainerNumber = 32, TokenUserClaimAttributes = 33, TokenDeviceClaimAttributes = 34, TokenRestrictedUserClaimAttributes = 35, TokenRestrictedDeviceClaimAttributes = 36, TokenDeviceGroups = 37, TokenRestrictedDeviceGroups = 38, TokenSecurityAttributes = 39, TokenIsRestricted = 40, MaxTokenInfoClass = 41 }; enum _SUITE_TYPE { SmallBusiness = 0, Enterprise = 1, BackOffice = 2, CommunicationServer = 3, TerminalServer = 4, SmallBusinessRestricted = 5, EmbeddedNT = 6, DataCenter = 7, SingleUserTS = 8, Personal = 9, Blade = 10, EmbeddedRestricted = 11, SecurityAppliance = 12, StorageServer = 13, ComputeServer = 14, WHServer = 15, MaxSuiteType = 16 }; enum tagMKSYS { MKSYS_NONE = 0, MKSYS_GENERICCOMPOSITE = 1, MKSYS_FILEMONIKER = 2, MKSYS_ANTIMONIKER = 3, MKSYS_ITEMMONIKER = 4, MKSYS_POINTERMONIKER = 5, MKSYS_CLASSMONIKER = 7, MKSYS_OBJREFMONIKER = 8, MKSYS_SESSIONMONIKER = 9, MKSYS_LUAMONIKER = 10 }; enum _BOOT_ENTROPY_SOURCE_ID { BootEntropySourceNone = 0, BootEntropySourceSeedfile = 1, BootEntropySourceExternal = 2, BootEntropySourceTpm = 3, BootEntropySourceRdrand = 4, BootEntropySourceTime = 5, BootEntropySourceAcpiOem0 = 6, BootEntropySourceUefi = 7, BootMaxEntropySources = 7 }; enum _FILE_INFO_BY_HANDLE_CLASS { FileBasicInfo = 0, FileStandardInfo = 1, FileNameInfo = 2, FileRenameInfo = 3, FileDispositionInfo = 4, FileAllocationInfo = 5, FileEndOfFileInfo = 6, FileStreamInfo = 7, FileCompressionInfo = 8, FileAttributeTagInfo = 9, FileIdBothDirectoryInfo = 10, FileIdBothDirectoryRestartInfo = 11, FileIoPriorityHintInfo = 12, FileRemoteProtocolInfo = 13, FileFullDirectoryInfo = 14, FileFullDirectoryRestartInfo = 15, FileStorageInfo = 16, FileAlignmentInfo = 17, MaximumFileInfoByHandleClass = 18 }; enum _WNF_USER_DELIVERY_STATE { WNF_USER_DELIVERY_STATE_READY = 0, WNF_USER_DELIVERY_STATE_CANCELLED = 1, WNF_USER_DELIVERY_STATE_IN_PROGRESS = 2, WNF_USER_DELIVERY_STATE_SUCCEEDED = 3, WNF_USER_DELIVERY_STATE_FAILED = 4, WNF_USER_DELIVERY_STATE_REQUIRES_RETRY = 5, WNF_USER_DELIVERY_STATE_COMPLETE = 6 }; enum _TIMER_INFORMATION_CLASS { TimerBasicInformation = 0 }; enum tagPOINTER_DEVICE_CURSOR_TYPE { POINTER_DEVICE_CURSOR_TYPE_UNKNOWN = 0, POINTER_DEVICE_CURSOR_TYPE_TIP = 1, POINTER_DEVICE_CURSOR_TYPE_ERASER = 2, POINTER_DEVICE_CURSOR_TYPE_MAX = -1 }; enum tagCOINIT { COINIT_APARTMENTTHREADED = 2, COINIT_MULTITHREADED = 0, COINIT_DISABLE_OLE1DDE = 4, COINIT_SPEED_OVER_MEMORY = 8 }; enum _PNP_VETO_TYPE { PNP_VetoTypeUnknown = 0, PNP_VetoLegacyDevice = 1, PNP_VetoPendingClose = 2, PNP_VetoWindowsApp = 3, PNP_VetoWindowsService = 4, PNP_VetoOutstandingOpen = 5, PNP_VetoDevice = 6, PNP_VetoDriver = 7, PNP_VetoIllegalDeviceRequest = 8, PNP_VetoInsufficientPower = 9, PNP_VetoNonDisableable = 10, PNP_VetoLegacyDriver = 11, PNP_VetoInsufficientRights = 12 }; enum _OBJECT_INFORMATION_CLASS { ObjectBasicInformation = 0, ObjectNameInformation = 1, ObjectTypeInformation = 2, ObjectTypesInformation = 3, ObjectHandleFlagInformation = 4, ObjectSessionInformation = 5, MaxObjectInfoClass = 6 }; enum _IO_SESSION_STATE { IoSessionStateCreated = 1, IoSessionStateInitialized = 2, IoSessionStateConnected = 3, IoSessionStateDisconnected = 4, IoSessionStateDisconnectedLoggedOn = 5, IoSessionStateLoggedOn = 6, IoSessionStateLoggedOff = 7, IoSessionStateTerminated = 8, IoSessionStateMax = 9 }; enum tagURLTEMPLATE { URLTEMPLATE_CUSTOM = 0, /* URLTEMPLATE_PREDEFINED_MIN = Unavail */ }; enum _RTL_VERIFIER_REDIRECT_TYPE { VerifierGPALookup = 0, VerifierDelayloadLookup = 1, VerifierLegacyLookup = 2, VerifierMaxLookupType = 3 }; enum _PNP_QUERY_RELATION { PnpQueryEjectRelations = 0, PnpQueryRemovalRelations = 1, PnpQueryPowerRelations = 2, PnpQueryBusRelations = 3, PnpQueryTransportRelations = 4, MaxPnpQueryRelations = 5 }; enum _JOBOBJECTINFOCLASS { JobObjectBasicAccountingInformation = 1, JobObjectBasicLimitInformation = 2, JobObjectBasicProcessIdList = 3, JobObjectBasicUIRestrictions = 4, JobObjectSecurityLimitInformation = 5, JobObjectEndOfJobTimeInformation = 6, JobObjectAssociateCompletionPortInformation = 7, JobObjectBasicAndIoAccountingInformation = 8, JobObjectExtendedLimitInformation = 9, JobObjectJobSetInformation = 10, JobObjectGroupInformation = 11, JobObjectNotificationLimitInformation = 12, JobObjectLimitViolationInformation = 13, JobObjectGroupInformationEx = 14, JobObjectCpuRateControlInformation = 15, JobObjectCompletionFilter = 16, JobObjectCompletionCounter = 17, JobObjectFreezeInformation = 18, JobObjectExtendedAccountingInformation = 19, JobObjectWakeInformation = 20, JobObjectIdleAwareInformation = 21, JobObjectSchedulingRankBiasInformation = 22, JobObjectTimerVirtualizationInformation = 23, JobObjectCycleTimeNotification = 24, JobObjectReserved1Information = 18, JobObjectReserved2Information = 19, JobObjectReserved3Information = 20, JobObjectReserved4Information = 21, JobObjectReserved5Information = 22, JobObjectReserved6Information = 23, JobObjectReserved7Information = 24, MaxJobObjectInfoClass = 25 }; enum _COMPUTER_NAME_FORMAT { ComputerNameNetBIOS = 0, ComputerNameDnsHostname = 1, ComputerNameDnsDomain = 2, ComputerNameDnsFullyQualified = 3, ComputerNamePhysicalNetBIOS = 4, ComputerNamePhysicalDnsHostname = 5, ComputerNamePhysicalDnsDomain = 6, ComputerNamePhysicalDnsFullyQualified = 7, ComputerNameMax = 8 }; enum _IO_SESSION_EVENT { IoSessionEventIgnore = 0, IoSessionEventCreated = 1, IoSessionEventTerminated = 2, IoSessionEventConnected = 3, IoSessionEventDisconnected = 4, IoSessionEventLogon = 5, IoSessionEventLogoff = 6, IoSessionEventMax = 7 }; enum _FILE_INFORMATION_CLASS { FileDirectoryInformation = 1, FileFullDirectoryInformation = 2, FileBothDirectoryInformation = 3, FileBasicInformation = 4, FileStandardInformation = 5, FileInternalInformation = 6, FileEaInformation = 7, FileAccessInformation = 8, FileNameInformation = 9, FileRenameInformation = 10, FileLinkInformation = 11, FileNamesInformation = 12, FileDispositionInformation = 13, FilePositionInformation = 14, FileFullEaInformation = 15, FileModeInformation = 16, FileAlignmentInformation = 17, FileAllInformation = 18, FileAllocationInformation = 19, FileEndOfFileInformation = 20, FileAlternateNameInformation = 21, FileStreamInformation = 22, FilePipeInformation = 23, FilePipeLocalInformation = 24, FilePipeRemoteInformation = 25, FileMailslotQueryInformation = 26, FileMailslotSetInformation = 27, FileCompressionInformation = 28, FileObjectIdInformation = 29, FileCompletionInformation = 30, FileMoveClusterInformation = 31, FileQuotaInformation = 32, FileReparsePointInformation = 33, FileNetworkOpenInformation = 34, FileAttributeTagInformation = 35, FileTrackingInformation = 36, FileIdBothDirectoryInformation = 37, FileIdFullDirectoryInformation = 38, FileValidDataLengthInformation = 39, FileShortNameInformation = 40, FileIoCompletionNotificationInformation = 41, FileIoStatusBlockRangeInformation = 42, FileIoPriorityHintInformation = 43, FileSfioReserveInformation = 44, FileSfioVolumeInformation = 45, FileHardLinkInformation = 46, FileProcessIdsUsingFileInformation = 47, FileNormalizedNameInformation = 48, FileNetworkPhysicalNameInformation = 49, FileIdGlobalTxDirectoryInformation = 50, FileIsRemoteDeviceInformation = 51, FileAttributeCacheInformation = 52, FileNumaNodeInformation = 53, FileStandardLinkInformation = 54, FileRemoteProtocolInformation = 55, FileRenameInformationBypassAccessCheck = 56, FileLinkInformationBypassAccessCheck = 57, FileIntegrityStreamInformation = 58, FileVolumeNameInformation = 59, FileMaximumInformation = 60 }; enum _ALPC_PORT_INFORMATION_CLASS { AlpcBasicInformation = 0, AlpcPortInformation = 1, AlpcAssociateCompletionPortInformation = 2, AlpcConnectedSIDInformation = 3, AlpcServerInformation = 4, AlpcMessageZoneInformation = 5, AlpcRegisterCompletionListInformation = 6, AlpcUnregisterCompletionListInformation = 7, AlpcAdjustCompletionListConcurrencyCountInformation = 8, AlpcRegisterCallbackInformation = 9, AlpcCompletionListRundownInformation = 10 }; enum tagVARFLAGS { VARFLAG_FREADONLY = 1, VARFLAG_FSOURCE = 2, VARFLAG_FBINDABLE = 4, VARFLAG_FREQUESTEDIT = 8, VARFLAG_FDISPLAYBIND = 16, VARFLAG_FDEFAULTBIND = 32, VARFLAG_FHIDDEN = 64, VARFLAG_FRESTRICTED = 128, VARFLAG_FDEFAULTCOLLELEM = 256, VARFLAG_FUIDEFAULT = 512, VARFLAG_FNONBROWSABLE = 1024, VARFLAG_FREPLACEABLE = 2048, VARFLAG_FIMMEDIATEBIND = 4096 }; enum __MIDL_IBindStatusCallback_0002 { BINDINFOF_URLENCODESTGMEDDATA = 1, BINDINFOF_URLENCODEDEXTRAINFO = 2 }; enum _SC_STATUS_TYPE { SC_STATUS_PROCESS_INFO = 0 }; enum _FP__IEEE_FORMAT { FpFormatFp32 = 0, FpFormatFp64 = 1, FpFormatFp80 = 2, FpFormatFp128 = 3, FpFormatI16 = 4, FpFormatI32 = 5, FpFormatI64 = 6, FpFormatU16 = 7, FpFormatU32 = 8, FpFormatU64 = 9, FpFormatCompare = 10, FpFormatString = 11 }; enum _LEARNING_MODE_LOG_LEVEL { LearningModeLogLevelPassive = 0, LearningModeLogLevelNormalApc = 1, LearningModeLogLevelSpecialApc = 2, LearningModeLogLevelMax = 3 }; enum DISPLAYCONFIG_SCANLINE_ORDERING { DISPLAYCONFIG_SCANLINE_ORDERING_UNSPECIFIED = 0, DISPLAYCONFIG_SCANLINE_ORDERING_PROGRESSIVE = 1, DISPLAYCONFIG_SCANLINE_ORDERING_INTERLACED = 2, DISPLAYCONFIG_SCANLINE_ORDERING_INTERLACED_UPPERFIELDFIRST = 2, DISPLAYCONFIG_SCANLINE_ORDERING_INTERLACED_LOWERFIELDFIRST = 3, DISPLAYCONFIG_SCANLINE_ORDERING_FORCE_UINT32 = -1 }; enum _CM_SERVICE_NODE_TYPE { DriverType = 1, FileSystemType = 2, Win32ServiceOwnProcess = 16, Win32ServiceShareProcess = 32, AdapterType = 4, RecognizerType = 8 }; enum _APTTYPE { APTTYPE_CURRENT = -1, APTTYPE_STA = 0, APTTYPE_MTA = 1, APTTYPE_NA = 2, APTTYPE_MAINSTA = 3 }; enum _CM_SERVICE_LOAD_TYPE { BootLoad = 0, SystemLoad = 1, AutoLoad = 2, DemandLoad = 3, DisableLoad = 4 }; enum _THREAD_INFORMATION_CLASS { ThreadMemoryPriority = 0, ThreadInformationClassMax = 1 }; enum _SID_NAME_USE { SidTypeUser = 1, SidTypeGroup = 2, SidTypeDomain = 3, SidTypeAlias = 4, SidTypeWellKnownGroup = 5, SidTypeDeletedAccount = 6, SidTypeInvalid = 7, SidTypeUnknown = 8, SidTypeComputer = 9, SidTypeLabel = 10 }; enum tagFUNCFLAGS { FUNCFLAG_FRESTRICTED = 1, FUNCFLAG_FSOURCE = 2, FUNCFLAG_FBINDABLE = 4, FUNCFLAG_FREQUESTEDIT = 8, FUNCFLAG_FDISPLAYBIND = 16, FUNCFLAG_FDEFAULTBIND = 32, FUNCFLAG_FHIDDEN = 64, FUNCFLAG_FUSESGETLASTERROR = 128, FUNCFLAG_FDEFAULTCOLLELEM = 256, FUNCFLAG_FUIDEFAULT = 512, FUNCFLAG_FNONBROWSABLE = 1024, FUNCFLAG_FREPLACEABLE = 2048, FUNCFLAG_FIMMEDIATEBIND = 4096 }; enum tagOLEMISC { OLEMISC_RECOMPOSEONRESIZE = 1, OLEMISC_ONLYICONIC = 2, OLEMISC_INSERTNOTREPLACE = 4, OLEMISC_STATIC = 8, OLEMISC_CANTLINKINSIDE = 16, OLEMISC_CANLINKBYOLE1 = 32, OLEMISC_ISLINKOBJECT = 64, OLEMISC_INSIDEOUT = 128, OLEMISC_ACTIVATEWHENVISIBLE = 256, OLEMISC_RENDERINGISDEVICEINDEPENDENT = 512, OLEMISC_INVISIBLEATRUNTIME = 1024, OLEMISC_ALWAYSRUN = 2048, OLEMISC_ACTSLIKEBUTTON = 4096, OLEMISC_ACTSLIKELABEL = 8192, OLEMISC_NOUIACTIVATE = 16384, = 32770 }; enum _THREAD_UMS_INFORMATION_COMMAND { UmsInformationCommandInvalid = 0, UmsInformationCommandAttach = 1, UmsInformationCommandDetach = 2 }; enum tagCALLCATEGORY { CALLCAT_NOCALL = 0, CALLCAT_SYNCHRONOUS = 1, CALLCAT_ASYNC = 2, CALLCAT_INPUTSYNC = 3, CALLCAT_INTERNALSYNC = 4, CALLCAT_INTERNALINPUTSYNC = 5, CALLCAT_SCMCALL = 6 }; enum tagGLOBALOPT_EH_VALUES { COMGLB_EXCEPTION_HANDLE = 0, COMGLB_EXCEPTION_DONOT_HANDLE_FATAL = 1, COMGLB_EXCEPTION_DONOT_HANDLE = 1, COMGLB_EXCEPTION_DONOT_HANDLE_ANY = 2 }; enum tagXMLEMEM_TYPE { XMLELEMTYPE_ELEMENT = 0, XMLELEMTYPE_TEXT = 1, XMLELEMTYPE_COMMENT = 2, XMLELEMTYPE_DOCUMENT = 3, XMLELEMTYPE_DTD = 4, XMLELEMTYPE_PI = 5, XMLELEMTYPE_OTHER = 6 }; enum _MEMORY_INFORMATION_CLASS { MemoryBasicInformation = 0, MemoryWorkingSetInformation = 1, MemoryMappedFilenameInformation = 2, MemoryRegionInformation = 3, MemoryWorkingSetExInformation = 4 }; enum _tagPI_FLAGS { PI_PARSE_URL = 1, PI_FILTER_MODE = 2, PI_FORCE_ASYNC = 4, PI_USE_WORKERTHREAD = 8, PI_MIMEVERIFICATION = 16, PI_CLSIDLOOKUP = 32, PI_DATAPROGRESS = 64, PI_SYNCHRONOUS = 128, PI_APARTMENTTHREADED = 256, PI_CLASSINSTALL = 512, PI_PASSONBINDCTX = 8192, = 32770 }; enum _SECTION_INFORMATION_CLASS { SectionBasicInformation = 0, SectionImageInformation = 1, SectionRelocationInformation = 2, MaxSectionInfoClass = 3 }; enum IMPORT_OBJECT_NAME_TYPE { IMPORT_OBJECT_ORDINAL = 0, IMPORT_OBJECT_NAME = 1, IMPORT_OBJECT_NAME_NO_PREFIX = 2, IMPORT_OBJECT_NAME_UNDECORATE = 3 }; enum XLAT_SIDE { XLAT_SERVER = 1, XLAT_CLIENT = 2 }; enum _DEVICE_POWER_STATE { PowerDeviceUnspecified = 0, PowerDeviceD0 = 1, PowerDeviceD1 = 2, PowerDeviceD2 = 3, PowerDeviceD3 = 4, PowerDeviceMaximum = 5 }; enum _TRANSACTIONMANAGER_INFORMATION_CLASS { TransactionManagerBasicInformation = 0, TransactionManagerLogInformation = 1, TransactionManagerLogPathInformation = 2, TransactionManagerRecoveryInformation = 4, TransactionManagerOnlineProbeInformation = 3, TransactionManagerOldestTransactionInformation = 5 }; /* enum <unnamed-tag> { LdrpNoDevice = 0, LdrpWebDAV = 1, LdrpRemote = 2, LdrpAnyDevice = -1, LdrpAnyDevice2bit = 3 }; */ enum _NT_PRODUCT_TYPE { NtProductWinNt = 1, NtProductLanManNt = 2, NtProductServer = 3 }; enum _COPYFILE2_COPY_PHASE { COPYFILE2_PHASE_NONE = 0, COPYFILE2_PHASE_PREPARE_SOURCE = 1, COPYFILE2_PHASE_PREPARE_DEST = 2, COPYFILE2_PHASE_READ_SOURCE = 3, COPYFILE2_PHASE_WRITE_DESTINATION = 4, COPYFILE2_PHASE_SERVER_COPY = 5, COPYFILE2_PHASE_NAMEGRAFT_COPY = 6, COPYFILE2_PHASE_MAX = 7 }; enum __MIDL_IBindStatusCallback_0003 { BINDF_ASYNCHRONOUS = 1, BINDF_ASYNCSTORAGE = 2, BINDF_NOPROGRESSIVERENDERING = 4, BINDF_OFFLINEOPERATION = 8, BINDF_GETNEWESTVERSION = 16, BINDF_NOWRITECACHE = 32, BINDF_NEEDFILE = 64, BINDF_PULLDATA = 128, BINDF_IGNORESECURITYPROBLEM = 256, BINDF_RESYNCHRONIZE = 512, BINDF_HYPERLINK = 1024, BINDF_NO_UI = 2048, BINDF_SILENTOPERATION = 4096, BINDF_PRAGMA_NO_CACHE = 8192, BINDF_GETCLASSOBJECT = 16384, = 32770 }; enum _RTL_GENERIC_COMPARE_RESULTS { GenericLessThan = 0, GenericGreaterThan = 1, GenericEqual = 2 }; enum tagCOWAIT_FLAGS { COWAIT_WAITALL = 1, COWAIT_ALERTABLE = 2, COWAIT_INPUTAVAILABLE = 4, COWAIT_DISPATCH_CALLS = 8, COWAIT_DISPATCH_WINDOW_MESSAGES = 16, REAL_COWAIT_ENABLECALLREENTRANCY = 8, COWAIT_ENABLEWINDOWMESSAGES = 16, COWAIT_ENABLECALLREENTRANCY = 24 }; enum _AUDIT_EVENT_TYPE { AuditEventObjectAccess = 0, AuditEventDirectoryServiceAccess = 1 }; enum tagDOMNodeType { NODE_INVALID = 0, NODE_ELEMENT = 1, NODE_ATTRIBUTE = 2, NODE_TEXT = 3, NODE_CDATA_SECTION = 4, NODE_ENTITY_REFERENCE = 5, NODE_ENTITY = 6, NODE_PROCESSING_INSTRUCTION = 7, NODE_COMMENT = 8, NODE_DOCUMENT = 9, NODE_DOCUMENT_TYPE = 10, NODE_DOCUMENT_FRAGMENT = 11, NODE_NOTATION = 12 }; enum _TRANSACTION_INFORMATION_CLASS { TransactionBasicInformation = 0, TransactionPropertiesInformation = 1, TransactionEnlistmentInformation = 2, TransactionSuperiorEnlistmentInformation = 3, TransactionBindInformation = 4, TransactionDTCPrivateInformation = 5 }; enum _PLUGPLAY_EVENT_CATEGORY { HardwareProfileChangeEvent = 0, TargetDeviceChangeEvent = 1, DeviceClassChangeEvent = 2, CustomDeviceEvent = 3, DeviceInstallEvent = 4, DeviceArrivalEvent = 5, VetoEvent = 6, BlockedDriverEvent = 7, InvalidIDEvent = 8, DevicePropertyChangeEvent = 9, DeviceInstanceRemovalEvent = 10, DeviceInstanceStartedEvent = 11, MaxPlugEventCategory = 12 }; enum tagCALLCONV { CC_FASTCALL = 0, CC_CDECL = 1, CC_MSCPASCAL = 2, CC_PASCAL = 2, CC_MACPASCAL = 3, CC_STDCALL = 4, CC_FPFASTCALL = 5, CC_SYSCALL = 6, CC_MPWCDECL = 7, CC_MPWPASCAL = 8, CC_MAX = 9 }; enum tagSTATFLAG { STATFLAG_DEFAULT = 0, STATFLAG_NONAME = 1, STATFLAG_NOOPEN = 2 }; enum tagRpcCallType { rctInvalid = 0, rctNormal = 1, rctTraining = 2, rctGuaranteed = 3 }; enum _IRQ_DEVICE_POLICY { IrqPolicyMachineDefault = 0, IrqPolicyAllCloseProcessors = 1, IrqPolicyOneCloseProcessor = 2, IrqPolicyAllProcessorsInMachine = 3, IrqPolicySpecifiedProcessors = 4, IrqPolicySpreadMessagesAcrossAllProcessors = 5 }; enum _KSPIN_LOCK_QUEUE_NUMBER { LockQueueUnusedSpare0 = 0, LockQueueExpansionLock = 1, LockQueueUnusedSpare2 = 2, LockQueueSystemSpaceLock = 3, LockQueueVacbLock = 4, LockQueueMasterLock = 5, LockQueueNonPagedPoolLock = 6, LockQueueIoCancelLock = 7, LockQueueWorkQueueLock = 8, LockQueueIoVpbLock = 9, LockQueueIoDatabaseLock = 10, LockQueueIoCompletionLock = 11, LockQueueNtfsStructLock = 12, LockQueueAfdWorkQueueLock = 13, LockQueueBcbLock = 14, LockQueueMmNonPagedPoolLock = 15, LockQueueUnusedSpare16 = 16, LockQueueMaximumLock = 17 }; enum tagACTIVATION_FLAGS { ACTVFLAGS_NONE = 0, ACTVFLAGS_DISABLE_AAA = 2, ACTVFLAGS_ACTIVATE_32_BIT_SERVER = 4, ACTVFLAGS_ACTIVATE_64_BIT_SERVER = 8, ACTVFLAGS_SERVERSIDE_ACTIVATION = 16, ACTVFLAGS_NO_FAILURE_LOG = 32, ACTVFLAGS_ENABLE_CLOAKING = 64, ACTVFLAGS_REG_CATALOG_ONLY = 256, ACTVFLAGS_SXS_CATALOG_ONLY = 512, ACTVFLAGS_WINRT_LOCAL_SERVER = 1024, ACTVFLAGS_WINRT_PER_USER_OK = 2048, ACTVFLAGS_ACTIVATE_PSCLSID_FROM_PACKAGE = 4096, ACTVFLAGS_APPCONTAINER = 8192, ACTVFLAGS_IS_SXS_CLASS = 16384, = 32770 }; enum _LDR_DDAG_STATE { LdrModulesMerged = -1, LdrModulesInitError = -1, LdrModulesSnapError = -1, LdrModulesUnloaded = -1, LdrModulesUnloading = -1, LdrModulesPlaceHolder = 0, LdrModulesMapping = 1, LdrModulesMapped = 2, LdrModulesWaitingForDependencies = 3, LdrModulesSnapping = 4, LdrModulesSnapped = 5, LdrModulesCondensed = 6, LdrModulesReadyToInit = 7, LdrModulesInitializing = 8, LdrModulesReadyToRun = 9 }; enum tagOLETLSFLAGS { OLETLS_LOCALTID = 1, OLETLS_UUIDINITIALIZED = 2, OLETLS_INTHREADDETACH = 4, OLETLS_CHANNELTHREADINITIALZED = 8, OLETLS_WOWTHREAD = 16, OLETLS_THREADUNINITIALIZING = 32, OLETLS_DISABLE_OLE1DDE = 64, OLETLS_APARTMENTTHREADED = 128, OLETLS_MULTITHREADED = 256, OLETLS_IMPERSONATING = 512, OLETLS_DISABLE_EVENTLOGGER = 1024, OLETLS_INNEUTRALAPT = 2048, OLETLS_DISPATCHTHREAD = 4096, OLETLS_HOSTTHREAD = 8192, OLETLS_ALLOWCOINIT = 16384, = 32770 }; enum _ACTIVATION_CONTEXT_INFO_CLASS { ActivationContextBasicInformation = 1, ActivationContextDetailedInformation = 2, AssemblyDetailedInformationInActivationContext = 3, FileInformationInAssemblyOfAssemblyInActivationContext = 4, RunlevelInformationInActivationContext = 5, CompatibilityInformationInActivationContext = 6, ActivationContextManifestResourceName = 7, MaxActivationContextInfoClass = 8, AssemblyDetailedInformationInActivationContxt = 3, FileInformationInAssemblyOfAssemblyInActivationContxt = 4 }; /* enum __MIDL_IBindStatusCallback_0005 { BINDINFO_OPTIONS_WININETFLAG = Unavail }; */ enum _SYSTEM_MEMORY_LIST_COMMAND { MemoryCaptureAccessedBits = 0, MemoryCaptureAndResetAccessedBits = 1, MemoryEmptyWorkingSets = 2, MemoryFlushModifiedList = 3, MemoryPurgeStandbyList = 4, MemoryPurgeLowPriorityStandbyList = 5, MemoryCommandMax = 6 }; enum _FSINFOCLASS { FileFsVolumeInformation = 1, FileFsLabelInformation = 2, FileFsSizeInformation = 3, FileFsDeviceInformation = 4, FileFsAttributeInformation = 5, FileFsControlInformation = 6, FileFsFullSizeInformation = 7, FileFsObjectIdInformation = 8, FileFsDriverPathInformation = 9, FileFsVolumeFlagsInformation = 10, FileFsSectorSizeInformation = 11, FileFsMaximumInformation = 12 }; enum _PROCESS_MITIGATION_POLICY { ProcessDEPPolicy = 0, ProcessASLRPolicy = 1, ProcessStackCheckPolicy = 2, ProcessStrictHandleCheckPolicy = 3, ProcessSystemCallDisablePolicy = 4, MaxProcessMitigationPolicy = 5 }; enum _WATCHDOG_HANDLER_ACTION { WdActionSetTimeoutValue = 0, WdActionQueryTimeoutValue = 1, WdActionResetTimer = 2, WdActionStopTimer = 3, WdActionStartTimer = 4, WdActionSetTriggerAction = 5, WdActionQueryTriggerAction = 6, WdActionQueryState = 7, WdActionSleep = 8, WdActionWake = 9, WdActionMarkHiberPhase = 10 }; enum _WORKERFACTORYINFOCLASS { WorkerFactoryTimeout = 0, WorkerFactoryRetryTimeout = 1, WorkerFactoryIdleTimeout = 2, WorkerFactoryBindingCount = 3, WorkerFactoryThreadMinimum = 4, WorkerFactoryThreadMaximum = 5, WorkerFactoryPaused = 6, WorkerFactoryBasicInformation = 7, WorkerFactoryAdjustThreadGoal = 8, WorkerFactoryCallbackType = 9, WorkerFactoryStackInformation = 10, MaxWorkerFactoryInfoClass = 11 }; enum PO_WAKE_SOURCE_TYPE { DeviceWakeSourceType = 0, FixedWakeSourceType = 1, TimerWakeSourceType = 2 }; enum _RPC_NOTIFICATIONS { RpcNotificationCallNone = 0, RpcNotificationClientDisconnect = 1, RpcNotificationCallCancel = 2 }; enum tagVARKIND { VAR_PERINSTANCE = 0, VAR_STATIC = 1, VAR_CONST = 2, VAR_DISPATCH = 3 }; enum _DEP_SYSTEM_POLICY_TYPE { DEPPolicyAlwaysOff = 0, DEPPolicyAlwaysOn = 1, DEPPolicyOptIn = 2, DEPPolicyOptOut = 3, DEPTotalPolicyCount = 4 }; enum tagCPFLAGS { CPFLAG_NONE = 0, CPFLAG_PROPAGATE = 1, CPFLAG_EXPOSE = 2, CPFLAG_ENVOY = 4, CPFLAG_MONITORSTUB = 8, CPFLAG_MONITORPROXY = 16, CPFLAG_DONTCOMPARE = 32 }; enum tagEOLE_AUTHENTICATION_CAPABILITIES { EOAC_NONE = 0, EOAC_MUTUAL_AUTH = 1, EOAC_STATIC_CLOAKING = 32, EOAC_DYNAMIC_CLOAKING = 64, EOAC_ANY_AUTHORITY = 128, EOAC_MAKE_FULLSIC = 256, EOAC_DEFAULT = 2048, EOAC_SECURE_REFS = 2, EOAC_ACCESS_CONTROL = 4, EOAC_APPID = 8, EOAC_DYNAMIC = 16, EOAC_REQUIRE_FULLSIC = 512, EOAC_AUTO_IMPERSONATE = 1024, EOAC_NO_CUSTOM_MARSHAL = 8192, EOAC_DISABLE_AAA = 4096 }; enum _KEY_SET_INFORMATION_CLASS { KeyWriteTimeInformation = 0, KeyWow64FlagsInformation = 1, KeyControlFlagsInformation = 2, KeySetVirtualizationInformation = 3, KeySetDebugInformation = 4, KeySetHandleTagsInformation = 5, MaxKeySetInfoClass = 6 }; enum DISPLAYCONFIG_VIDEO_OUTPUT_TECHNOLOGY { DISPLAYCONFIG_OUTPUT_TECHNOLOGY_OTHER = -1, DISPLAYCONFIG_OUTPUT_TECHNOLOGY_HD15 = 0, DISPLAYCONFIG_OUTPUT_TECHNOLOGY_SVIDEO = 1, DISPLAYCONFIG_OUTPUT_TECHNOLOGY_COMPOSITE_VIDEO = 2, DISPLAYCONFIG_OUTPUT_TECHNOLOGY_COMPONENT_VIDEO = 3, DISPLAYCONFIG_OUTPUT_TECHNOLOGY_DVI = 4, DISPLAYCONFIG_OUTPUT_TECHNOLOGY_HDMI = 5, DISPLAYCONFIG_OUTPUT_TECHNOLOGY_LVDS = 6, DISPLAYCONFIG_OUTPUT_TECHNOLOGY_D_JPN = 8, DISPLAYCONFIG_OUTPUT_TECHNOLOGY_SDI = 9, DISPLAYCONFIG_OUTPUT_TECHNOLOGY_DISPLAYPORT_EXTERNAL = 10, DISPLAYCONFIG_OUTPUT_TECHNOLOGY_DISPLAYPORT_EMBEDDED = 11, DISPLAYCONFIG_OUTPUT_TECHNOLOGY_UDI_EXTERNAL = 12, DISPLAYCONFIG_OUTPUT_TECHNOLOGY_UDI_EMBEDDED = 13, DISPLAYCONFIG_OUTPUT_TECHNOLOGY_SDTVDONGLE = 14, = 32771 }; enum VERIFIER_MODE { VERIFIER_MODE_UNUSED = 0, VERIFIER_MODE_TRIAGE = 1, VERIFIER_MODE_FIELD = 2, VERIFIER_MODE_LOGO = 3, VERIFIER_MODE_TEST = 4 }; enum _SHRINK_VOLUME_REQUEST_TYPES { ShrinkPrepare = 1, ShrinkCommit = 2, ShrinkAbort = 3 }; enum __MIDL_IBindStatusCallbackEx_0001 { BINDF2_DISABLEBASICOVERHTTP = 1, BINDF2_DISABLEAUTOCOOKIEHANDLING = 2, BINDF2_READ_DATA_GREATER_THAN_4GB = 4, BINDF2_DISABLE_HTTP_REDIRECT_XSECURITYID = 8, BINDF2_SETDOWNLOADMODE = 32, BINDF2_DISABLE_HTTP_REDIRECT_CACHING = 64, /* BINDF2_RESERVED_E = Unavail */ }; enum _RTL_UMS_SCHEDULER_REASON { UmsSchedulerStartup = 0, UmsSchedulerThreadBlocked = 1, UmsSchedulerThreadYield = 2 }; enum _KTMOBJECT_TYPE { KTMOBJECT_TRANSACTION = 0, KTMOBJECT_TRANSACTION_MANAGER = 1, KTMOBJECT_RESOURCE_MANAGER = 2, KTMOBJECT_ENLISTMENT = 3, KTMOBJECT_INVALID = 4 }; enum _SE_LEARNING_MODE_DATA_TYPE { SeLearningModeInvalidType = 0, SeLearningModeSettings = 1, SeLearningModeMax = 2 }; enum tagPOINTER_DEVICE_TYPE { POINTER_DEVICE_TYPE_INTEGRATED_PEN = 1, POINTER_DEVICE_TYPE_EXTERNAL_PEN = 2, POINTER_DEVICE_TYPE_TOUCH = 3, POINTER_DEVICE_TYPE_MAX = -1 }; enum _TABLE_SEARCH_RESULT { TableEmptyTree = 0, TableFoundNode = 1, TableInsertAsLeft = 2, TableInsertAsRight = 3 }; enum _SYSTEM_POWER_STATE { PowerSystemUnspecified = 0, PowerSystemWorking = 1, PowerSystemSleeping1 = 2, PowerSystemSleeping2 = 3, PowerSystemSleeping3 = 4, PowerSystemHibernate = 5, PowerSystemShutdown = 6, PowerSystemMaximum = 7 }; enum _WNF_STATE_NAME_INFORMATION { WnfInfoStateNameExist = 0, WnfInfoSubscribersPresent = 1, WnfInfoIsQuiescent = 2 }; enum _SHUTDOWN_ACTION { ShutdownNoReboot = 0, ShutdownReboot = 1, ShutdownPowerOff = 2 }; enum tagOLECLOSE { OLECLOSE_SAVEIFDIRTY = 0, OLECLOSE_NOSAVE = 1, OLECLOSE_PROMPTSAVE = 2 }; enum tagExtendedErrorParamTypes { eeptAnsiString = 1, eeptUnicodeString = 2, eeptLongVal = 3, eeptShortVal = 4, eeptPointerVal = 5, eeptNone = 6, eeptBinary = 7 }; enum __MIDL_IInternetZoneManager_0002 { ZAFLAGS_CUSTOM_EDIT = 1, ZAFLAGS_ADD_SITES = 2, ZAFLAGS_REQUIRE_VERIFICATION = 4, ZAFLAGS_INCLUDE_PROXY_OVERRIDE = 8, ZAFLAGS_INCLUDE_INTRANET_SITES = 16, ZAFLAGS_NO_UI = 32, ZAFLAGS_SUPPORTS_VERIFICATION = 64, ZAFLAGS_UNC_AS_INTRANET = 128, ZAFLAGS_DETECT_INTRANET = 256, /* ZAFLAGS_USE_LOCKED_ZONES = Unavail */ }; enum _FINDEX_SEARCH_OPS { FindExSearchNameMatch = 0, FindExSearchLimitToDirectories = 1, FindExSearchLimitToDevices = 2, FindExSearchMaxSearchOp = 3 }; enum _RTL_VERIFIER_INFORMATION_CLASS { VerifierAllInformation = 0, VerifierPageHeapsInformation = 1, VerifierRuntimeFlagsInformation = 2, VerifierFaultInjectInformation = 3, MaxVerifierInformation = 4 }; enum _PORT_INFORMATION_CLASS { PortBasicInformation = 0, PortDumpInformation = 1 }; enum tagINPUT_MESSAGE_DEVICE_TYPE { IMDT_UNAVAILABLE = 0, IMDT_KEYBOARD = 1, IMDT_MOUSE = 2, IMDT_TOUCH = 4, IMDT_PEN = 8 }; enum tagSYSKIND { SYS_WIN16 = 0, SYS_WIN32 = 1, SYS_MAC = 2, SYS_WIN64 = 3 }; enum _HARDERROR_RESPONSE_OPTION { OptionAbortRetryIgnore = 0, OptionOk = 1, OptionOkCancel = 2, OptionRetryCancel = 3, OptionYesNo = 4, OptionYesNoCancel = 5, OptionShutdownSystem = 6, OptionOkNoWait = 7, OptionCancelTryContinue = 8 }; enum DISPLAYCONFIG_TOPOLOGY_ID { DISPLAYCONFIG_TOPOLOGY_INTERNAL = 1, DISPLAYCONFIG_TOPOLOGY_CLONE = 2, DISPLAYCONFIG_TOPOLOGY_EXTEND = 4, DISPLAYCONFIG_TOPOLOGY_EXTERNAL = 8, DISPLAYCONFIG_TOPOLOGY_FORCE_UINT32 = -1 }; enum _PROCESS_INFORMATION_CLASS { ProcessMemoryPriority = 0, ProcessInformationClassMax = 1 }; enum _SAFER_IDENTIFICATION_TYPES { SaferIdentityDefault = 0, SaferIdentityTypeImageName = 1, SaferIdentityTypeImageHash = 2, SaferIdentityTypeUrlZone = 3, SaferIdentityTypeCertificate = 4 }; enum tagApplicationType { ServerApplication = 0, LibraryApplication = 1 }; enum __MIDL_IUri_0002 { Uri_HOST_UNKNOWN = 0, Uri_HOST_DNS = 1, Uri_HOST_IPV4 = 2, Uri_HOST_IPV6 = 3, Uri_HOST_IDN = 4 }; enum tagDESCKIND { DESCKIND_NONE = 0, DESCKIND_FUNCDESC = 1, DESCKIND_VARDESC = 2, DESCKIND_TYPECOMP = 3, DESCKIND_IMPLICITAPPOBJ = 4, DESCKIND_MAX = 5 }; enum tagPENDINGTYPE { PENDINGTYPE_TOPLEVEL = 1, PENDINGTYPE_NESTED = 2 }; enum _MANDATORY_LEVEL { MandatoryLevelUntrusted = 0, MandatoryLevelLow = 1, MandatoryLevelMedium = 2, MandatoryLevelHigh = 3, MandatoryLevelSystem = 4, MandatoryLevelSecureProcess = 5, MandatoryLevelCount = 6 }; enum _SYSTEM_PIXEL_FORMAT { SystemPixelFormatUnknown = 0, SystemPixelFormatR8G8B8 = 1, SystemPixelFormatR8G8B8X8 = 2, SystemPixelFormatB8G8R8 = 3, SystemPixelFormatB8G8R8X8 = 4 }; enum tagGLOBALOPT_PROPERTIES { COMGLB_EXCEPTION_HANDLING = 1, COMGLB_APPID = 2, COMGLB_RPC_THREADPOOL_SETTING = 3, COMGLB_RO_SETTINGS = 4 }; enum __MIDL_IInternetSecurityManager_0002 { PUAFOUT_DEFAULT = 0, PUAFOUT_ISLOCKZONEPOLICY = 1 }; enum _CALLSOURCE { CALLSOURCE_CROSSAPT = 0, CALLSOURCE_CROSSCTX = 1 }; enum __MIDL_IBindStatusCallback_0004 { URL_ENCODING_NONE = 0, /* URL_ENCODING_ENABLE_UTF8 = Unavail */ }; enum STUB_PHASE { STUB_UNMARSHAL = 0, STUB_CALL_SERVER = 1, STUB_MARSHAL = 2, STUB_CALL_SERVER_NO_HRESULT = 3 }; enum tagThreadingModel { ApartmentThreaded = 0, FreeThreaded = 1, SingleThreaded = 2, BothThreaded = 3, NeutralThreaded = 4 }; enum tagCLSCTX { CLSCTX_INPROC_SERVER = 1, CLSCTX_INPROC_HANDLER = 2, CLSCTX_LOCAL_SERVER = 4, CLSCTX_INPROC_SERVER16 = 8, CLSCTX_REMOTE_SERVER = 16, CLSCTX_INPROC_HANDLER16 = 32, CLSCTX_RESERVED1 = 64, CLSCTX_RESERVED2 = 128, CLSCTX_RESERVED3 = 256, CLSCTX_RESERVED4 = 512, CLSCTX_NO_CODE_DOWNLOAD = 1024, CLSCTX_RESERVED5 = 2048, CLSCTX_NO_CUSTOM_MARSHAL = 4096, CLSCTX_ENABLE_CODE_DOWNLOAD = 8192, CLSCTX_NO_FAILURE_LOG = 16384, = 32770 }; enum _REG_ACTION { KeyAdded = 0, KeyRemoved = 1, KeyModified = 2 }; enum _BOOT_ENTROPY_SOURCE_RESULT_CODE { BootEntropySourceStructureUninitialized = 0, BootEntropySourceDisabledByPolicy = 1, BootEntropySourceNotPresent = 2, BootEntropySourceError = 3, BootEntropySourceSuccess = 4 }; enum IMPORT_OBJECT_TYPE { IMPORT_OBJECT_CODE = 0, IMPORT_OBJECT_DATA = 1, IMPORT_OBJECT_CONST = 2 }; enum _CSV_INTERNAL_CONTROL_OP { CsvInternalControlPrefetchRetrievalPointers = 0, CsvInternalControlQueryRetrievalPointers = 1, CsvInternalControlStartRedirectFile = 2, CsvInternalControlStopRedirectFile = 3, CsvInternalControlQueryRedirectState = 4, CsvInternalControlQueryFileStatistic = 5 }; enum tagFUNCKIND { FUNC_VIRTUAL = 0, FUNC_PUREVIRTUAL = 1, FUNC_NONVIRTUAL = 2, FUNC_STATIC = 3, FUNC_DISPATCH = 4 }; enum tagACTIVATION_STAGE { CLIENT_CONTEXT_STAGE = 1, CLIENT_MACHINE_STAGE = 2, SERVER_MACHINE_STAGE = 3, SERVER_PROCESS_STAGE = 4, SERVER_CONTEXT_STAGE = 5 }; enum _TRANSACTION_OUTCOME { TransactionOutcomeUndetermined = 1, TransactionOutcomeCommitted = 2, TransactionOutcomeAborted = 3 }; enum tagADVF { ADVF_NODATA = 1, ADVF_PRIMEFIRST = 2, ADVF_ONLYONCE = 4, ADVF_DATAONSTOP = 64, ADVFCACHE_NOHANDLER = 8, ADVFCACHE_FORCEBUILTIN = 16, ADVFCACHE_ONSAVE = 32 }; enum tagSTGTY { STGTY_STORAGE = 1, STGTY_STREAM = 2, STGTY_LOCKBYTES = 3, STGTY_PROPERTY = 4 }; enum _CM_SHARE_DISPOSITION { CmResourceShareUndetermined = 0, CmResourceShareDeviceExclusive = 1, CmResourceShareDriverExclusive = 2, CmResourceShareShared = 3 }; enum tagShutdownType { IdleShutdown = 0, ForcedShutdown = 1 }; enum tagRpcCallClientLocality { rcclInvalid = 0, rcclLocal = 1, rcclRemote = 2, rcclClientUnknownLocality = 3 }; enum tagDATADIR { DATADIR_GET = 1, DATADIR_SET = 2 }; enum tagPOINTER_INPUT_TYPE { PT_POINTER = 1, PT_TOUCH = 2, PT_PEN = 3, PT_MOUSE = 4 }; enum _COVERAGE_REQUEST_CODES { CoverageAllModules = 0, CoverageSearchByHash = 1, CoverageSearchByName = 2 }; enum _IO_PRIORITY_HINT { IoPriorityVeryLow = 0, IoPriorityLow = 1, IoPriorityNormal = 2, IoPriorityHigh = 3, IoPriorityCritical = 4, MaxIoPriorityTypes = 5 }; enum tagRunAsType { RunAsSpecifiedUser = 0, RunAsInteractiveUser = 1, RunAsLaunchingUser = 2 }; enum _APTTYPEQUALIFIER { APTTYPEQUALIFIER_NONE = 0, APTTYPEQUALIFIER_IMPLICIT_MTA = 1, APTTYPEQUALIFIER_NA_ON_MTA = 2, APTTYPEQUALIFIER_NA_ON_STA = 3, APTTYPEQUALIFIER_NA_ON_IMPLICIT_MTA = 4, APTTYPEQUALIFIER_NA_ON_MAINSTA = 5, APTTYPEQUALIFIER_APPLICATION_STA = 6 }; enum _FINDEX_INFO_LEVELS { FindExInfoStandard = 0, FindExInfoBasic = 1, FindExInfoMaxInfoLevel = 2 }; enum tagTYMED { TYMED_HGLOBAL = 1, TYMED_FILE = 2, TYMED_ISTREAM = 4, TYMED_ISTORAGE = 8, TYMED_GDI = 16, TYMED_MFPICT = 32, TYMED_ENHMF = 64, TYMED_NULL = 0 }; enum _SECURITY_IMPERSONATION_LEVEL { SecurityAnonymous = 0, SecurityIdentification = 1, SecurityImpersonation = 2, SecurityDelegation = 3 }; enum _CM_ERROR_CONTROL_TYPE { IgnoreError = 0, NormalError = 1, SevereError = 2, CriticalError = 3 }; enum _TOKEN_ELEVATION_TYPE { TokenElevationTypeDefault = 1, TokenElevationTypeFull = 2, TokenElevationTypeLimited = 3 }; enum _HARDERROR_RESPONSE { ResponseReturnToCaller = 0, ResponseNotHandled = 1, ResponseAbort = 2, ResponseCancel = 3, ResponseIgnore = 4, ResponseNo = 5, ResponseOk = 6, ResponseRetry = 7, ResponseYes = 8, ResponseTryAgain = 9, ResponseContinue = 10 }; enum __MIDL___MIDL_itf_activate_0000_0011_0001 { ST_SERVER = 1, ST_OLDSURROGATE = 2, ST_COMPLUSAPP = 3, ST_SERVICE = 4 }; enum tagUSERCLASSTYPE { USERCLASSTYPE_FULL = 1, USERCLASSTYPE_SHORT = 2, USERCLASSTYPE_APPNAME = 3 }; enum tagSF_TYPE { SF_ERROR = 10, SF_I1 = 16, SF_I2 = 2, SF_I4 = 3, SF_I8 = 20, SF_BSTR = 8, SF_UNKNOWN = 13, SF_DISPATCH = 9, SF_VARIANT = 12, SF_RECORD = 36, €SF_HAVEIID = 32770 }; enum tagPreferredServerBitness { SERVER_BITNESS_DEFAULT = 0, SERVER_BITNESS_FOLLOW_CLIENT = 1, SERVER_BITNESS_32BIT = 2, SERVER_BITNESS_64BIT = 3 }; enum tagAR_STATE { AR_ENABLED = 0, AR_DISABLED = 1, AR_SUPPRESSED = 2, AR_REMOTESESSION = 4, AR_MULTIMON = 8, AR_NOSENSOR = 16, AR_NOT_SUPPORTED = 32 }; enum _RESOURCEMANAGER_INFORMATION_CLASS { ResourceManagerBasicInformation = 0, ResourceManagerCompletionInformation = 1 }; enum _DMA_SPEED { Compatible = 0, TypeA = 1, TypeB = 2, TypeC = 3, TypeF = 4, MaximumDmaSpeed = 5 }; enum _QUERY_FILE_LAYOUT_FILTER_TYPE { QUERY_FILE_LAYOUT_FILTER_TYPE_NONE = 0, QUERY_FILE_LAYOUT_FILTER_TYPE_CLUSTERS = 1, QUERY_FILE_LAYOUT_FILTER_TYPE_FILEID = 2, QUERY_FILE_LAYOUT_NUM_FILTER_TYPES = 3 }; enum _TIMER_SET_INFORMATION_CLASS { TimerSetCoalescableTimer = 0, MaxTimerInfoClass = 1 }; enum tagSTGMOVE { STGMOVE_MOVE = 0, STGMOVE_COPY = 1, STGMOVE_SHALLOWCOPY = 2 }; enum _IRQ_GROUP_POLICY { GroupAffinityAllGroupZero = 0, GroupAffinityDontCare = 1 }; enum _GET_FILEEX_INFO_LEVELS { GetFileExInfoStandard = 0, GetFileExMaxInfoLevel = 1 }; enum RTL_BSD_ITEM_TYPE { RtlBsdItemVersionNumber = 0, RtlBsdItemProductType = 1, RtlBsdItemAabEnabled = 2, RtlBsdItemAabTimeout = 3, RtlBsdItemBootGood = 4, RtlBsdItemBootShutdown = 5, RtlBsdSleepInProgress = 6, RtlBsdPowerTransition = 7, RtlBsdItemBootAttemptCount = 8, RtlBsdItemMax = 9 }; enum _PS_WAKE_REASON { PsWakeReasonUser = 0, PsWakeReasonDevice = 1, PsWakeReasonKernel = 2, PsWakeReasonPower = 3, PsMaxWakeReasons = 4 }; enum _FP_IEEE_COMPARE_RESULT { FpCompareEqual = 0, FpCompareGreater = 1, FpCompareLess = 2, FpCompareUnordered = 3 }; enum _tagOIBDG_FLAGS { OIBDG_APARTMENTTHREADED = 256, OIBDG_DATAONLY = 4096 }; enum DSAFIPSVERSION_ENUM { DSA_FIPS186_2 = 0, DSA_FIPS186_3 = 1 }; enum tagCoModuleType { CO_MODULE_UNKNOWN = 0, CO_MODULE_32BIT = 1, CO_MODULE_64BIT = 2 }; enum tagURLZONE { URLZONE_INVALID = -1, URLZONE_PREDEFINED_MIN = 0, URLZONE_LOCAL_MACHINE = 0, URLZONE_INTRANET = 1, URLZONE_TRUSTED = 2, URLZONE_INTERNET = 3, URLZONE_UNTRUSTED = 4, URLZONE_PREDEFINED_MAX = 999, URLZONE_USER_MIN = 1000, URLZONE_USER_MAX = 10000 }; enum RpcProxyPerfCounters { RpcCurrentUniqueUser = 1, RpcBackEndConnectionAttempts = 2, RpcBackEndConnectionFailed = 3, RpcRequestsPerSecond = 4, RpcIncomingConnections = 5, RpcIncomingBandwidth = 6, RpcOutgoingBandwidth = 7, RpcAttemptedLbsDecisions = 8, RpcFailedLbsDecisions = 9, RpcAttemptedLbsMessages = 10, RpcFailedLbsMessages = 11, RpcLastCounter = 12 }; enum ASSOCCLASS { ASSOCCLASS_SHELL_KEY = 0, ASSOCCLASS_PROGID_KEY = 1, ASSOCCLASS_PROGID_STR = 2, ASSOCCLASS_CLSID_KEY = 3, ASSOCCLASS_CLSID_STR = 4, ASSOCCLASS_APP_KEY = 5, ASSOCCLASS_APP_STR = 6, ASSOCCLASS_SYSTEM_STR = 7, ASSOCCLASS_FOLDER = 8, ASSOCCLASS_STAR = 9 }; enum tagFEEDBACK_TYPE { FEEDBACK_TOUCH_CONTACTVISUALIZATION = 1, FEEDBACK_PEN_BARRELVISUALIZATION = 2, FEEDBACK_PEN_TAP = 3, FEEDBACK_PEN_DOUBLETAP = 4, FEEDBACK_PEN_PRESSANDHOLD = 5, FEEDBACK_PEN_RIGHTTAP = 6, FEEDBACK_TOUCH_TAP = 7, FEEDBACK_TOUCH_DOUBLETAP = 8, FEEDBACK_TOUCH_PRESSANDHOLD = 9, FEEDBACK_TOUCH_RIGHTTAP = 10, FEEDBACK_GESTURE_PRESSANDTAP = 11, FEEDBACK_MAX = -1 }; enum PS_CREATE_STATE { PsCreateInitialState = 0, PsCreateFailOnFileOpen = 1, PsCreateFailOnSectionCreate = 2, PsCreateFailExeFormat = 3, PsCreateFailMachineMismatch = 4, PsCreateFailExeName = 5, PsCreateSuccess = 6, PsCreateMaximumStates = 7 }; enum POWER_USER_PRESENCE_TYPE { UserNotPresent = 0, UserPresent = 1, UserUnknown = 255 }; enum _RPC_ASYNC_EVENT { RpcCallComplete = 0, RpcSendComplete = 1, RpcReceiveComplete = 2, RpcClientDisconnect = 3, RpcClientCancel = 4 }; enum _RTL_STACK_TRACE_DATABASE_CONTROL { BackTraceDatabaseCreate = 0, BackTraceDatabaseDelete = 1, BackTraceDatabaseFlush = 2, BackTraceDatabaseMaxControl = 3 }; enum tagTYSPEC { TYSPEC_CLSID = 0, TYSPEC_FILEEXT = 1, TYSPEC_MIMETYPE = 2, TYSPEC_FILENAME = 3, TYSPEC_PROGID = 4, TYSPEC_PACKAGENAME = 5, TYSPEC_OBJECTID = 6 }; enum _RTL_UMS_THREAD_INFO_CLASS { UmsThreadInvalidInfoClass = 0, UmsThreadUserContext = 1, UmsThreadPriority = 2, UmsThreadAffinity = 3, UmsThreadTeb = 4, UmsThreadIsSuspended = 5, UmsThreadIsTerminated = 6, UmsThreadMaxInfoClass = 7 }; enum _POWER_PLATFORM_ROLE { PlatformRoleUnspecified = 0, PlatformRoleDesktop = 1, PlatformRoleMobile = 2, PlatformRoleWorkstation = 3, PlatformRoleEnterpriseServer = 4, PlatformRoleSOHOServer = 5, PlatformRoleAppliancePC = 6, PlatformRolePerformanceServer = 7, PlatformRoleSlate = 8, PlatformRoleMaximum = 9 }; enum _ACCESS_REASON_TYPE { AccessReasonNone = 0, /* AccessReasonAllowedAce = Unavail */ }; enum tagLOCKTYPE { LOCK_WRITE = 1, LOCK_EXCLUSIVE = 2, LOCK_ONLYONCE = 4 }; enum _JOURNAL_INFORMATION_CLASS { JournalAbsoluteInformation = 0, JournalClientInformation = 1, MaxJournalInformation = 2 }; enum PIDMSI_STATUS_VALUE { PIDMSI_STATUS_NORMAL = 0, PIDMSI_STATUS_NEW = 1, PIDMSI_STATUS_PRELIM = 2, PIDMSI_STATUS_DRAFT = 3, PIDMSI_STATUS_INPROGRESS = 4, PIDMSI_STATUS_EDIT = 5, PIDMSI_STATUS_REVIEW = 6, PIDMSI_STATUS_PROOF = 7, PIDMSI_STATUS_FINAL = 8, PIDMSI_STATUS_OTHER = 32767 }; enum __MIDL_IMonikerProp_0001 { MIMETYPEPROP = 0, USE_SRC_URL = 1, CLASSIDPROP = 2, TRUSTEDDOWNLOADPROP = 3, POPUPLEVELPROP = 4 }; enum tagINVOKEKIND { INVOKE_FUNC = 1, INVOKE_PROPERTYGET = 2, INVOKE_PROPERTYPUT = 4, INVOKE_PROPERTYPUTREF = 8 }; enum _WNF_STATE_NAME_LIFETIME { WnfWellKnownStateName = 0, WnfPermanentStateName = 1, WnfPersistentStateName = 2, WnfTemporaryStateName = 3 }; enum _USER_MARSHAL_CB_TYPE { USER_MARSHAL_CB_BUFFER_SIZE = 0, USER_MARSHAL_CB_MARSHALL = 1, USER_MARSHAL_CB_UNMARSHALL = 2, USER_MARSHAL_CB_FREE = 3 }; enum tagEventLogSD { EventLog_MACHINEACCESSRESTRICTIONS = 0, EventLog_MACHINELAUNCHRESTRICTIONS = 1, EventLog_DEFAULTLAUNCHPERMISSIONS = 2, EventLog_DEFAULTACCESSPERMISSIONS = 3, EventLog_SERVERLAUNCHPERMISSIONS = 4, EventLog_SERVERACCESSPERMISSIONSREG = 5, EventLog_SERVERACCESSPERMISSIONSPROG = 6, EventLog_DONTCARE = 7 }; enum APPSTATE { ABSENT = 0, ASSIGNED = 1, PUBLISHED = 2 }; enum _PRT { PRT_IGNORE = 0, PRT_CREATE_NEW = 1, PRT_USE_THIS = 2, PRT_USE_THIS_ONLY = 3 }; enum tagCALLSTATE { CALLSTATE_NOT_IN_CALL = -1, CALLSTATE_DATA_NOT_AVAILABLE = 0 }; enum SYSGEOCLASS { GEOCLASS_NATION = 16, GEOCLASS_REGION = 14, GEOCLASS_ALL = 0 }; enum COMPARTMENT_ID { UNSPECIFIED_COMPARTMENT_ID = 0, DEFAULT_COMPARTMENT_ID = 1 }; enum _JOBOBJECT_RATE_CONTROL_TOLERANCE_INTERVAL { ToleranceIntervalShort = 1, ToleranceIntervalMedium = 2, ToleranceIntervalLong = 3 }; enum _NORM_FORM { NormalizationOther = 0, NormalizationC = 1, NormalizationD = 2, NormalizationKC = 5, NormalizationKD = 6 }; enum tagCOMSD { SD_LAUNCHPERMISSIONS = 0, SD_ACCESSPERMISSIONS = 1, SD_LAUNCHRESTRICTIONS = 2, SD_ACCESSRESTRICTIONS = 3 }; enum tagRpcLocalAddressFormat { rlafInvalid = 0, rlafIPv4 = 1, rlafIPv6 = 2 }; enum _ALTERNATIVE_ARCHITECTURE_TYPE { StandardDesign = 0, NEC98x86 = 1, EndAlternatives = 2 }; enum tagGLOBALOPT_RPCTP_VALUES { COMGLB_RPC_THREADPOOL_SETTING_DEFAULT_POOL = 0, COMGLB_RPC_THREADPOOL_SETTING_PRIVATE_POOL = 1 }; enum _EVENT_INFORMATION_CLASS { EventBasicInformation = 0 }; enum tagGLOBALOPT_RO_FLAGS { COMGLB_STA_MODALLOOP_REMOVE_TOUCH_MESSAGES = 1, COMGLB_STA_MODALLOOP_SHARED_QUEUE_REMOVE_INPUT_MESSAGES = 2, COMGLB_STA_MODALLOOP_SHARED_QUEUE_DONOT_REMOVE_INPUT_MESSAGES = 4 }; enum _PS_STD_HANDLE_STATE { PsNeverDuplicate = 0, PsRequestDuplicate = 1, PsAlwaysDuplicate = 2, PsMaxStdHandleStates = 3 }; enum RPC_ADDRESS_CHANGE_TYPE { PROTOCOL_NOT_LOADED = 1, PROTOCOL_LOADED = 2, PROTOCOL_ADDRESS_CHANGE = 3 }; enum _LOGICAL_PROCESSOR_RELATIONSHIP { RelationProcessorCore = 0, RelationNumaNode = 1, RelationCache = 2, RelationProcessorPackage = 3, RelationGroup = 4, ÿÿRelationAll = 32770 }; enum _REQUESTER_TYPE { KernelRequester = 0, UserProcessRequester = 1, UserSharedServiceRequester = 2 }; enum __MIDL___MIDL_itf_activate_0000_0011_0002 { SIT_RUNAS_SPECIFIC_USER = 1, SIT_RUNAS_INTERACTIVE = 2 }; enum _TP_LOG_LEVEL { TP_LOG_LEVEL_ERROR = 0, TP_LOG_LEVEL_WARNING = 1, TP_LOG_LEVEL_INFO = 2, TP_LOG_LEVEL_TRACE_ENTER = 3, TP_LOG_LEVEL_TRACE_LEAVE = 4 }; enum tagCONTEXTEVENT { CONTEXTEVENT_NONE = 0, CONTEXTEVENT_CALL = 1, CONTEXTEVENT_ENTER = 2, CONTEXTEVENT_LEAVE = 4, CONTEXTEVENT_RETURN = 8, CONTEXTEVENT_CALLFILLBUFFER = 16, CONTEXTEVENT_ENTERWITHBUFFER = 32, CONTEXTEVENT_LEAVEFILLBUFFER = 64, CONTEXTEVENT_RETURNWITHBUFFER = 128, CONTEXTEVENT_BEGINCALL = 256, CONTEXTEVENT_BEGINENTER = 512, CONTEXTEVENT_BEGINLEAVE = 1024, CONTEXTEVENT_BEGINRETURN = 2048, CONTEXTEVENT_FINISHCALL = 4096, CONTEXTEVENT_FINISHENTER = 8192, CONTEXTEVENT_FINISHLEAVE = 16384, = 32770 }; enum CWMO_FLAGS { CWMO_DISPATCH_CALLS = 1, CWMO_DISPATCH_WINDOW_MESSAGES = 2, REAL_CWMO_ENABLE_CALL_REENTRANCY = 1, CWMO_ENABLE_WINDOW_MESSAGES = 2, CWMO_ENABLE_CALL_REENTRANCY = 3 }; enum __MIDL_IBindStatusCallback_0001 { BINDVERB_GET = 0, BINDVERB_POST = 1, BINDVERB_PUT = 2, BINDVERB_CUSTOM = 3, BINDVERB_RESERVED1 = 4 }; enum _PROCESSOR_CACHE_TYPE { CacheUnified = 0, CacheInstruction = 1, CacheData = 2, CacheTrace = 3 }; enum DISPLAYCONFIG_ROTATION { DISPLAYCONFIG_ROTATION_IDENTITY = 1, DISPLAYCONFIG_ROTATION_ROTATE90 = 2, DISPLAYCONFIG_ROTATION_ROTATE180 = 3, DISPLAYCONFIG_ROTATION_ROTATE270 = 4, DISPLAYCONFIG_ROTATION_FORCE_UINT32 = -1 }; enum _MEMORY_RESERVE_TYPE { MemoryReserveUserApc = 0, MemoryReserveIoCompletion = 1, MemoryReserveTypeMax = 2 }; enum ACTCTX_COMPATIBILITY_ELEMENT_TYPE { ACTCTX_COMPATIBILITY_ELEMENT_TYPE_UNKNOWN = 0, ACTCTX_COMPATIBILITY_ELEMENT_TYPE_OS = 1, ACTCTX_COMPATIBILITY_ELEMENT_TYPE_MITIGATION = 2 }; enum CreateStackTraceFlags { CREATESTACKTRACE_ONLYADDRESSES = 1 }; enum tagBINDSPEED { BINDSPEED_INDEFINITE = 1, BINDSPEED_MODERATE = 2, BINDSPEED_IMMEDIATE = 3 }; enum _EVENT_TYPE { NotificationEvent = 0, SynchronizationEvent = 1 }; enum _USER_ACTIVITY_PRESENCE { PowerUserPresent = 0, PowerUserNotPresent = 1, PowerUserInactive = 2, PowerUserMaximum = 3, PowerUserInvalid = 3 }; enum __MIDL___MIDL_itf_activate_0000_0011_0003 { SPIF_COMPLUS = 1, SPIF_SUSPENDED = 2, SPIF_RETIRED = 4, SPIF_READY = 8, SPIF_PAUSED = 16 }; enum tagOBJFLAGS { OBJFLAGS_LINK = 1, OBJFLAGS_DOCUMENT = 2, OBJFLAGS_CONVERT = 4, OBJFLAGS_CACHEEMPTY = 8 }; enum tagDVASPECT { DVASPECT_CONTENT = 1, DVASPECT_THUMBNAIL = 2, DVASPECT_ICON = 4, DVASPECT_DOCPRINT = 8 }; enum tagLOCALFLAG { LOCALF_NONE = 0, LOCALF_NONNDR = 2048 }; enum tagSTDMSHLFLAGS { SMEXF_SERVER = 1, SMEXF_HANDLER = 2 }; enum _FILE_ID_TYPE { FileIdType = 0, ObjectIdType = 1, MaximumFileIdType = 2 }; enum tagOLEWHICHMK { OLEWHICHMK_CONTAINER = 1, OLEWHICHMK_OBJREL = 2, OLEWHICHMK_OBJFULL = 3 }; enum tagRPCOPT_PROPERTIES { COMBND_RPCTIMEOUT = 1, COMBND_SERVER_LOCALITY = 2 }; enum _EXCEPTION_DISPOSITION { ExceptionContinueExecution = 0, ExceptionContinueSearch = 1, ExceptionNestedException = 2, ExceptionCollidedUnwind = 3 }; enum _LINK_TRACKING_INFORMATION_TYPE { NtfsLinkTrackingInformation = 0, DfsLinkTrackingInformation = 1 }; enum _TIMER_TYPE { NotificationTimer = 0, SynchronizationTimer = 1 }; enum tagCALLTYPE { CALLTYPE_TOPLEVEL = 1, CALLTYPE_NESTED = 2, CALLTYPE_ASYNC = 3, CALLTYPE_TOPLEVEL_CALLPENDING = 4, CALLTYPE_ASYNC_CALLPENDING = 5 }; enum _STREAM_INFO_LEVELS { FindStreamInfoStandard = 0, FindStreamInfoMaxInfoLevel = 1 }; enum _PSM_ACTIVATE_BACKGROUND_TYPE { PsmActNotBackground = 0, PsmActMixedHost = 1, PsmActPureHost = 2, PsmActSystemHost = 3, PsmActInvalidType = 4 }; enum _tagPSUACTION { PSU_DEFAULT = 1, PSU_SECURITY_URL_ONLY = 2 }; enum _SE_SIGNING_LEVEL { SE_SIGNING_LEVEL_UNCHECKED = 0, SE_SIGNING_LEVEL_PROTECTED_PROCESS = 1, SE_SIGNING_LEVEL_UNSIGNED = 2, SE_SIGNING_LEVEL_AUTHENTICODE = 4, SE_SIGNING_LEVEL_DRM_PROTECTED = 5, SE_SIGNING_LEVEL_WINDOWS = 6, SE_SIGNING_LEVEL_WINDOWS_PROTECTED = 7 }; enum _ENLISTMENT_INFORMATION_CLASS { EnlistmentBasicInformation = 0, EnlistmentRecoveryInformation = 1, EnlistmentCrmInformation = 2 }; enum tagOLEGETMONIKER { OLEGETMONIKER_ONLYIFTHERE = 1, OLEGETMONIKER_FORCEASSIGN = 2, OLEGETMONIKER_UNASSIGN = 3, OLEGETMONIKER_TEMPFORUSER = 4 }; enum _SYSTEM_CRASH_DUMP_CONFIGURATION_CLASS { SystemCrashDumpDisable = 0, SystemCrashDumpReconfigure = 1, SystemCrashDumpInitializationComplete = 2 }; enum _PROCESS_TLS_INFORMATION_TYPE { ProcessTlsReplaceIndex = 0, ProcessTlsReplaceVector = 1, MaxProcessTlsOperation = 2 }; enum ACTCTX_REQUESTED_RUN_LEVEL { ACTCTX_RUN_LEVEL_UNSPECIFIED = 0, ACTCTX_RUN_LEVEL_AS_INVOKER = 1, ACTCTX_RUN_LEVEL_HIGHEST_AVAILABLE = 2, ACTCTX_RUN_LEVEL_REQUIRE_ADMIN = 3, ACTCTX_RUN_LEVEL_NUMBERS = 4 }; enum tagResourceGateId { CreateProcessMemoryGate = 0, CreateObjectMemoryGate = 1 }; enum _HARDWARE_COUNTER_TYPE { PMCCounter = 0, MaxHardwareCounterType = 1 }; enum tagREGKIND { REGKIND_DEFAULT = 0, REGKIND_REGISTER = 1, REGKIND_NONE = 2 }; enum tagOLECONTF { OLECONTF_EMBEDDINGS = 1, OLECONTF_LINKS = 2, OLECONTF_OTHERS = 4, OLECONTF_ONLYUSER = 8, OLECONTF_ONLYIFRUNNING = 16 }; enum _EXCEPTION_LOG_TYPE { LogExceptionEmpty = 0, LogExceptionDispatch = 1, LogExceptionHandler = 2 }; enum _MEMORY_RESOURCE_NOTIFICATION_TYPE { LowMemoryResourceNotification = 0, HighMemoryResourceNotification = 1, PendingBadMemoryNotification = 2 }; enum _MEMORY_WORKING_SET_EX_LOCATION { MemoryLocationInvalid = 0, MemoryLocationResident = 1, MemoryLocationPagefile = 2, MemoryLocationReserved = 3 }; enum _PRIORITY_HINT { IoPriorityHintVeryLow = 0, IoPriorityHintLow = 1, IoPriorityHintNormal = 2, MaximumIoPriorityHintType = 3 }; enum _HEAP_INFORMATION_CLASS { HeapCompatibilityInformation = 0, HeapEnableTerminationOnCorruption = 1, HeapExtendedInformation = 2, = 32771 }; enum tagEXTCONN { EXTCONN_STRONG = 1, EXTCONN_WEAK = 2, EXTCONN_CALLABLE = 4 }; enum _FP__IEEE_ROUNDING_MODE { FpRoundNearest = 0, FpRoundMinusInfinity = 1, FpRoundPlusInfinity = 2, FpRoundChopped = 3 }; enum tagREGCLS { REGCLS_SINGLEUSE = 0, REGCLS_MULTIPLEUSE = 1, REGCLS_MULTI_SEPARATE = 2, REGCLS_SUSPENDED = 4, REGCLS_SURROGATE = 8 }; enum _RPC_NOTIFICATION_TYPES { RpcNotificationTypeNone = 0, RpcNotificationTypeEvent = 1, RpcNotificationTypeApc = 2, RpcNotificationTypeIoc = 3, RpcNotificationTypeHwnd = 4, RpcNotificationTypeCallback = 5 }; enum SYSNLS_FUNCTION { COMPARE_STRING = 1 }; enum IMAGE_AUX_SYMBOL_TYPE { IMAGE_AUX_SYMBOL_TYPE_TOKEN_DEF = 1 }; enum _WNF_DATA_SCOPE { WnfDataScopeSystem = 0, WnfDataScopeSession = 1, WnfDataScopeUser = 2, WnfDataScopeProcess = 3 }; enum tagRPCOPT_SERVER_LOCALITY_VALUES { SERVER_LOCALITY_PROCESS_LOCAL = 0, SERVER_LOCALITY_MACHINE_LOCAL = 1, SERVER_LOCALITY_REMOTE = 2 }; enum _SEMAPHORE_INFORMATION_CLASS { SemaphoreBasicInformation = 0 }; enum _POWER_STATE_TYPE { SystemPowerState = 0, DevicePowerState = 1 }; enum _ACL_INFORMATION_CLASS { AclRevisionInformation = 1, AclSizeInformation = 2 }; enum _TP_CALLBACK_PRIORITY { TP_CALLBACK_PRIORITY_HIGH = 0, TP_CALLBACK_PRIORITY_NORMAL = 1, TP_CALLBACK_PRIORITY_LOW = 2, TP_CALLBACK_PRIORITY_INVALID = 3, TP_CALLBACK_PRIORITY_COUNT = 3 }; enum QUERY_USER_NOTIFICATION_STATE { QUNS_NOT_PRESENT = 1, QUNS_BUSY = 2, QUNS_RUNNING_D3D_FULL_SCREEN = 3, QUNS_PRESENTATION_MODE = 4, QUNS_ACCEPTS_NOTIFICATIONS = 5, QUNS_QUIET_TIME = 6, QUNS_IMMERSIVE = 7 }; enum _MONITOR_DISPLAY_STATE { PowerMonitorOff = 0, PowerMonitorOn = 1, PowerMonitorDim = 2 }; enum _RPC_HTTP_REDIRECTOR_STAGE { RPCHTTP_RS_REDIRECT = 1, RPCHTTP_RS_ACCESS_1 = 2, RPCHTTP_RS_SESSION = 3, RPCHTTP_RS_ACCESS_2 = 4, RPCHTTP_RS_INTERFACE = 5 }; enum tagBIND_FLAGS { BIND_MAYBOTHERUSER = 1, BIND_JUSTTESTEXISTENCE = 2 }; enum _WATCHDOG_INFORMATION_CLASS { WdInfoTimeoutValue = 0, WdInfoResetTimer = 1, WdInfoStopTimer = 2, WdInfoStartTimer = 3, WdInfoTriggerAction = 4, WdInfoState = 5 }; enum DISPLAYCONFIG_MODE_INFO_TYPE { DISPLAYCONFIG_MODE_INFO_TYPE_SOURCE = 1, DISPLAYCONFIG_MODE_INFO_TYPE_TARGET = 2, DISPLAYCONFIG_MODE_INFO_TYPE_FORCE_UINT32 = -1 }; enum tagOLEUPDATE { OLEUPDATE_ALWAYS = 1, OLEUPDATE_ONCALL = 3 }; enum _SC_ACTION_TYPE { SC_ACTION_NONE = 0, SC_ACTION_RESTART = 1, SC_ACTION_REBOOT = 2, SC_ACTION_RUN_COMMAND = 3 }; enum tagOLEVERBATTRIB { OLEVERBATTRIB_NEVERDIRTIES = 1, OLEVERBATTRIB_ONCONTAINERMENU = 2 }; enum _TOKEN_TYPE { TokenPrimary = 1, TokenImpersonation = 2 }; enum _FIRMWARE_TYPE { FirmwareTypeUnknown = 0, FirmwareTypeBios = 1, FirmwareTypeUefi = 2, FirmwareTypeMax = 3 }; enum tagOLELINKBIND { OLELINKBIND_EVENIFCLASSDIFF = 1 }; enum _POWER_REQUEST_TYPE { PowerRequestDisplayRequired = 0, PowerRequestSystemRequired = 1, PowerRequestAwayModeRequired = 2, PowerRequestExecutionRequired = 3 }; enum __MIDL_IInternetSecurityManager_0003 { SZM_CREATE = 0, SZM_DELETE = 1 }; enum _THDTYPE { THDTYPE_BLOCKMESSAGES = 0, THDTYPE_PROCESSMESSAGES = 1 }; enum HASHALGORITHM_ENUM { DSA_HASH_ALGORITHM_SHA1 = 0, DSA_HASH_ALGORITHM_SHA256 = 1, DSA_HASH_ALGORITHM_SHA512 = 2 }; enum _JOBOBJECT_RATE_CONTROL_TOLERANCE { ToleranceLow = 1, ToleranceMedium = 2, ToleranceHigh = 3 }; enum _URLZONEREG { URLZONEREG_DEFAULT = 0, URLZONEREG_HKLM = 1, URLZONEREG_HKCU = 2 }; enum tagCHANGEKIND { CHANGEKIND_ADDMEMBER = 0, CHANGEKIND_DELETEMEMBER = 1, CHANGEKIND_SETNAMES = 2, CHANGEKIND_SETDOCUMENTATION = 3, CHANGEKIND_GENERAL = 4, CHANGEKIND_INVALIDATE = 5, CHANGEKIND_CHANGEFAILED = 6, CHANGEKIND_MAX = 7 }; enum tagDCOM_CALL_STATE { DCOM_NONE = 0, DCOM_CALL_COMPLETE = 1, DCOM_CALL_CANCELED = 2 }; enum _ATOM_INFORMATION_CLASS { AtomBasicInformation = 0, AtomTableInformation = 1 }; enum __MIDL_IInternetZoneManager_0001 { MAX_ZONE_PATH = 260, MAX_ZONE_DESCRIPTION = 200 }; enum _SYSTEM_FIRMWARE_TABLE_ACTION { SystemFirmwareTable_Enumerate = 0, SystemFirmwareTable_Get = 1 }; enum tagEventLogModes { Eventlog_ModeLaunch = 0, EventLog_ModeActivate = 1, EventLog_ModeAccess = 2, EventLog_ModeDontCare = 3 }; enum PIPE_ATTRIBUTE_TYPE { PipeAttribute = 0, PipeConnectionAttribute = 1, PipeHandleAttribute = 2 }; enum _WAIT_TYPE { WaitAll = 0, WaitAny = 1, WaitNotification = 2 }; enum tagPENDINGMSG { PENDINGMSG_CANCELCALL = 0, PENDINGMSG_WAITNOPROCESS = 1, PENDINGMSG_WAITDEFPROCESS = 2 }; enum tagLocalServerType { LocalServerType16 = 0, LocalServerType32 = 1 }; enum _COPYFILE2_MESSAGE_ACTION { COPYFILE2_PROGRESS_CONTINUE = 0, COPYFILE2_PROGRESS_CANCEL = 1, COPYFILE2_PROGRESS_STOP = 2, COPYFILE2_PROGRESS_QUIET = 3, COPYFILE2_PROGRESS_PAUSE = 4 }; enum _TP_DEBUG_CLASS { TP_DEBUG_CLASS_POOL = 0 }; enum _SECTION_INHERIT { ViewShare = 1, ViewUnmap = 2 }; enum __MIDL_IAuthenticateEx_0001 { AUTHENTICATEF_PROXY = 1, AUTHENTICATEF_BASIC = 2, AUTHENTICATEF_HTTP = 4 }; enum tagMEMCTX { MEMCTX_TASK = 1, MEMCTX_SHARED = 2, MEMCTX_MACSYSTEM = 3, MEMCTX_UNKNOWN = -1, MEMCTX_SAME = -1 }; enum __MIDL___MIDL_itf_privact_0000_0009_0001 { MARSHOPT_NO_OID_REGISTER = 1 }; enum _SC_EVENT_TYPE { SC_EVENT_DATABASE_CHANGE = 0, SC_EVENT_PROPERTY_CHANGE = 1, SC_EVENT_STATUS_CHANGE = 2 }; enum _WOW64_FUNCTION_CODE64 { WOW64_FUNCTION_NOP = 0, WOW64_FUNCTION_QUERY_PROCESS_DEBUG_INFO = 1, WOW64_FUNCTION_MAXIMUM = 2 }; enum tagSERVERCALL { SERVERCALL_ISHANDLED = 0, SERVERCALL_REJECTED = 1, SERVERCALL_RETRYLATER = 2 }; enum tagINPUT_MESSAGE_ORIGIN_ID { IMO_UNAVAILABLE = 0, IMO_HARDWARE = 1, IMO_INJECTED = 2, IMO_SYSTEM = 4 }; enum _TRANSACTION_STATE { TransactionStateNormal = 1, TransactionStateIndoubt = 2, TransactionStateCommittedNotify = 3 }; enum tagCOINITBASE { COINITBASE_MULTITHREADED = 0 }; enum _KEY_VALUE_INFORMATION_CLASS { KeyValueBasicInformation = 0, KeyValueFullInformation = 1, KeyValuePartialInformation = 2, KeyValueFullInformationAlign64 = 3, KeyValuePartialInformationAlign64 = 4, MaxKeyValueInfoClass = 5 }; enum tagDIMENSION { XDIMENSION = 88, YDIMENSION = 89 }; enum tagDISCARDCACHE { DISCARDCACHE_SAVEIFDIRTY = 0, DISCARDCACHE_NOSAVE = 1 }; enum OLETLS_CROSS_THREAD_FLAGS { OLETLS_CROSS_THREAD_PRIORITY_EVENT_PENDING = 1 }; enum _ALPC_MESSAGE_INFORMATION_CLASS { AlpcMessageSidInformation = 0, AlpcMessageTokenModifiedIdInformation = 1 }; enum _IO_COMPLETION_INFORMATION_CLASS { IoCompletionBasicInformation = 0 }; enum _SC_ENUM_TYPE { SC_ENUM_PROCESS_INFO = 0 }; enum MCA_EXCEPTION_TYPE { HAL_MCE_RECORD = 0, HAL_MCA_RECORD = 1 }; enum LATENCY_TIME { LT_DONT_CARE = 0, LT_LOWEST_LATENCY = 1 }; enum _KEY_INFORMATION_CLASS { KeyBasicInformation = 0, KeyNodeInformation = 1, KeyFullInformation = 2, KeyNameInformation = 3, KeyCachedInformation = 4, KeyFlagsInformation = 5, KeyVirtualizationInformation = 6, KeyHandleTagsInformation = 7, MaxKeyInfoClass = 8 }; enum tagProcessType { ProcessTypeNormal = 0, ProcessTypeService = 1, ProcessTypeComPlus = 2, ProcessTypeLegacySurrogate = 3, ProcessTypeComPlusService = 4 }; enum __MIDL_ICodeInstall_0001 { CIP_DISK_FULL = 0, CIP_ACCESS_DENIED = 1, CIP_NEWER_VERSION_EXISTS = 2, CIP_OLDER_VERSION_EXISTS = 3, CIP_NAME_CONFLICT = 4, CIP_TRUST_VERIFICATION_COMPONENT_MISSING = 5, CIP_EXE_SELF_REGISTERATION_TIMEOUT = 6, CIP_UNSAFE_TO_ABORT = 7, CIP_NEED_REBOOT = 8, CIP_NEED_REBOOT_UI_PERMISSION = 9 }; struct tagEMRTRANSPARENTBLT { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned char rclBounds[16]; /* +0x0008 d5 12 00 00 */ long xDest; /* +0x0018 */ long yDest; /* +0x001c */ long cxDest; /* +0x0020 */ long cyDest; /* +0x0024 */ unsigned long dwRop; /* +0x0028 */ long xSrc; /* +0x002c */ long ySrc; /* +0x0030 */ unsigned char xformSrc[24]; /* +0x0034 d6 12 00 00 */ unsigned long crBkColorSrc; /* +0x004c */ unsigned long iUsageSrc; /* +0x0050 */ unsigned long offBmiSrc; /* +0x0054 */ unsigned long cbBmiSrc; /* +0x0058 */ unsigned long offBitsSrc; /* +0x005c */ unsigned long cbBitsSrc; /* +0x0060 */ long cxSrc; /* +0x0064 */ long cySrc; /* +0x0068 */ }; struct _SERVICE_PRESHUTDOWN_INFO { unsigned long dwPreshutdownTimeout; /* +0x0000 */ }; struct _CM_DISK_GEOMETRY_DEVICE_DATA { unsigned long BytesPerSector; /* +0x0000 */ unsigned long NumberOfCylinders; /* +0x0004 */ unsigned long SectorsPerTrack; /* +0x0008 */ unsigned long NumberOfHeads; /* +0x000c */ }; struct _PLUGPLAY_CONTROL_CONFLICT_DATA { unsigned char DeviceInstance[8]; /* +0x0000 dd 12 00 00 */ unsigned char ResourceList[4]; /* +0x0008 df 12 00 00 */ unsigned long ResourceListSize; /* +0x000c */ unsigned char ConflictBuffer[4]; /* +0x0010 e1 12 00 00 */ unsigned long ConflictBufferSize; /* +0x0014 */ unsigned long Flags; /* +0x0018 */ long Status; /* +0x001c */ }; struct _FOUR_PART_VERSION { unsigned long long Version64; /* +0x0000 */ }; struct _FOUR_PART_VERSION::<unnamed-type-Version16> { unsigned short Revision; /* +0x0000 */ unsigned short Build; /* +0x0002 */ unsigned short Minor; /* +0x0004 */ unsigned short Major; /* +0x0006 */ }; struct _FOUR_PART_VERSION::<unnamed-type-Version32> { unsigned long BuildAndRevision; /* +0x0000 */ unsigned long MajorAndMinor; /* +0x0004 */ }; struct tagCBTACTIVATESTRUCT { unsigned char fMouse[4]; /* +0x0000 74 00 00 00 */ unsigned char hWndActive[4]; /* +0x0004 f1 12 00 00 */ }; struct _NETRESOURCEW { unsigned long dwScope; /* +0x0000 */ unsigned long dwType; /* +0x0004 */ unsigned long dwDisplayType; /* +0x0008 */ unsigned long dwUsage; /* +0x000c */ unsigned char lpLocalName[4]; /* +0x0010 71 04 00 00 */ unsigned char lpRemoteName[4]; /* +0x0014 71 04 00 00 */ unsigned char lpComment[4]; /* +0x0018 71 04 00 00 */ unsigned char lpProvider[4]; /* +0x001c 71 04 00 00 */ }; struct _DWORD_BLOB { unsigned long clSize; /* +0x0000 */ unsigned char alData[4]; /* +0x0004 f6 12 00 00 */ }; struct tagRemHGLOBAL { long fNullHGlobal; /* +0x0000 */ unsigned long cbData; /* +0x0004 */ unsigned char data[4]; /* +0x0008 f9 12 00 00 */ }; struct _QUERY_SERVICE_CONFIGW { unsigned long dwServiceType; /* +0x0000 */ unsigned long dwStartType; /* +0x0004 */ unsigned long dwErrorControl; /* +0x0008 */ unsigned char lpBinaryPathName[4]; /* +0x000c 71 04 00 00 */ unsigned char lpLoadOrderGroup[4]; /* +0x0010 71 04 00 00 */ unsigned long dwTagId; /* +0x0014 */ unsigned char lpDependencies[4]; /* +0x0018 71 04 00 00 */ unsigned char lpServiceStartName[4]; /* +0x001c 71 04 00 00 */ unsigned char lpDisplayName[4]; /* +0x0020 71 04 00 00 */ }; struct _CRYPT_ECC_PRIVATE_KEY_INFO { unsigned long dwVersion; /* +0x0000 */ unsigned char PrivateKey[8]; /* +0x0004 02 13 00 00 */ char *szCurveOid; /* +0x000c */ unsigned char PublicKey[12]; /* +0x0010 03 13 00 00 */ }; struct tagPLACEABLEMETAHEADER { unsigned long key; /* +0x0000 */ unsigned short hmf; /* +0x0004 */ unsigned char bbox[8]; /* +0x0006 06 13 00 00 */ unsigned short inch; /* +0x000e */ unsigned long reserved; /* +0x0010 */ unsigned short checksum; /* +0x0014 */ }; struct _FILE_INITIATE_REPAIR_OUTPUT_BUFFER { unsigned long long Hint1; /* +0x0000 */ unsigned long long Hint2; /* +0x0008 */ unsigned long long Clsn; /* +0x0010 */ long Status; /* +0x0018 */ }; struct _BOOT_ENTROPY_SOURCE_NT_RESULT { unsigned char SourceId[8]; /* +0x0000 11 13 00 00 */ unsigned long long Policy; /* +0x0008 */ unsigned char ResultCode[4]; /* +0x0010 12 13 00 00 */ long ResultStatus; /* +0x0014 */ unsigned long long Time; /* +0x0018 */ unsigned long EntropyLength; /* +0x0020 */ unsigned char EntropyData[68]; /* +0x0024 13 13 00 00 */ }; struct _MM_COMBINEDPAGE_IDENTITY { unsigned char PfnIdentity[16]; /* +0x0000 16 13 00 00 */ /* unsigned char SharedInitial[0]; +0x0010 17 13 00 00 */ unsigned long ProtoPte; /* +0x0010 */ }; struct _PROCESS_HEAP_ENTRY { void *lpData; /* +0x0000 */ unsigned long cbData; /* +0x0004 */ unsigned char cbOverhead; /* +0x0008 */ unsigned char iRegionIndex; /* +0x0009 */ unsigned short wFlags; /* +0x000a */ /* unsigned char Block[0]; +0x000c 1c 13 00 00 */ unsigned char Region[16]; /* +0x000c 1d 13 00 00 */ }; struct _PROCESS_HEAP_ENTRY::<unnamed-tag>::<unnamed-type-Region> { unsigned long dwCommittedSize; /* +0x0000 */ unsigned long dwUnCommittedSize; /* +0x0004 */ void *lpFirstBlock; /* +0x0008 */ void *lpLastBlock; /* +0x000c */ }; struct _PROCESS_HEAP_ENTRY::<unnamed-tag>::<unnamed-type-Block> { void *hMem; /* +0x0000 */ unsigned char dwReserved[12]; /* +0x0004 22 13 00 00 */ }; struct tagMETHODDATA { unsigned char szName[4]; /* +0x0000 71 04 00 00 */ unsigned char ppdata[4]; /* +0x0004 2a 13 00 00 */ long dispid; /* +0x0008 */ unsigned char iMeth[4]; /* +0x000c 75 00 00 00 */ unsigned char cc[4]; /* +0x0010 2b 13 00 00 */ unsigned char cArgs[4]; /* +0x0014 75 00 00 00 */ unsigned short wFlags; /* +0x0018 */ unsigned short vtReturn; /* +0x001a */ }; struct _CMSG_RECIPIENT_ENCRYPTED_KEY_INFO { unsigned char RecipientId[20]; /* +0x0000 30 13 00 00 */ unsigned char EncryptedKey[8]; /* +0x0014 02 13 00 00 */ unsigned char Date[8]; /* +0x001c 31 13 00 00 */ unsigned char pOtherAttr[4]; /* +0x0024 33 13 00 00 */ }; struct _SID_AND_ATTRIBUTES { void *Sid; /* +0x0000 */ unsigned long Attributes; /* +0x0004 */ }; struct _FILE_IO_COMPLETION_INFORMATION { void *KeyContext; /* +0x0000 */ void *ApcContext; /* +0x0004 */ unsigned char IoStatusBlock[8]; /* +0x0008 3a 13 00 00 */ }; struct _SYSTEM_THREAD_INFORMATION { unsigned char KernelTime[8]; /* +0x0000 3d 13 00 00 */ unsigned char UserTime[8]; /* +0x0008 3d 13 00 00 */ unsigned char CreateTime[8]; /* +0x0010 3d 13 00 00 */ unsigned long WaitTime; /* +0x0018 */ void *StartAddress; /* +0x001c */ unsigned char ClientId[8]; /* +0x0020 3e 13 00 00 */ long Priority; /* +0x0028 */ long BasePriority; /* +0x002c */ unsigned long ContextSwitches; /* +0x0030 */ unsigned long ThreadState; /* +0x0034 */ unsigned long WaitReason; /* +0x0038 */ }; struct _MEMORY_BASIC_INFORMATION64 { unsigned long long BaseAddress; /* +0x0000 */ unsigned long long AllocationBase; /* +0x0008 */ unsigned long AllocationProtect; /* +0x0010 */ unsigned long __alignment1; /* +0x0014 */ unsigned long long RegionSize; /* +0x0018 */ unsigned long State; /* +0x0020 */ unsigned long Protect; /* +0x0024 */ unsigned long Type; /* +0x0028 */ unsigned long __alignment2; /* +0x002c */ }; struct _SINGLE_LIST_ENTRY32 { unsigned long Next; /* +0x0000 */ }; struct _Wx86TIB { unsigned long Size; /* +0x0000 */ unsigned long InitialPc; /* +0x0004 */ void *StackBase; /* +0x0008 */ void *StackLimit; /* +0x000c */ void *DeallocationStack; /* +0x0010 */ unsigned long LogFlags; /* +0x0014 */ unsigned long InitialSp; /* +0x0018 */ unsigned char SimulationCount; /* +0x001c */ unsigned char InCpuSimulation; /* +0x001d */ unsigned char EmulateInitialPc; /* +0x001e */ unsigned char Initialized; /* +0x001f */ unsigned char ExceptionList[4]; /* +0x0020 56 13 00 00 */ void *CpuContext; /* +0x0024 */ unsigned char InitialExceptionContext[4]; /* +0x0028 58 13 00 00 */ void *pCallersRIID; /* +0x002c */ void *pCallersUnknown; /* +0x0030 */ unsigned long Flags; /* +0x0034 */ void *SelfRegDllName; /* +0x0038 */ void *SelfRegDllHandle; /* +0x003c */ }; struct _SYSTEM_SESSION_BIGPOOL_INFORMATION { unsigned long NextEntryOffset; /* +0x0000 */ unsigned long SessionId; /* +0x0004 */ unsigned long Count; /* +0x0008 */ unsigned char AllocatedInfo[12]; /* +0x000c 5e 13 00 00 */ }; struct tagRemHMETAFILEPICT { long mm; /* +0x0000 */ long xExt; /* +0x0004 */ long yExt; /* +0x0008 */ unsigned long cbData; /* +0x000c */ unsigned char data[4]; /* +0x0010 f9 12 00 00 */ }; struct _SE_ACCESS_REPLY { unsigned long Size; /* +0x0000 */ unsigned long ResultListCount; /* +0x0004 */ unsigned long *GrantedAccess; /* +0x0008 */ long *AccessStatus; /* +0x000c */ unsigned char AccessReason[4]; /* +0x0010 7e 13 00 00 */ unsigned char Privileges[4]; /* +0x0014 81 13 00 00 */ }; struct _SYSTEM_POWER_STATE_CONTEXT { /* unsigned char Reserved1[0]; +0x0000 84 13 00 00 */ /* unsigned char TargetSystemState[0]; +0x0000 85 13 00 00 */ /* unsigned char EffectiveSystemState[0]; +0x0000 86 13 00 00 */ /* unsigned char CurrentSystemState[0]; +0x0000 87 13 00 00 */ /* unsigned char IgnoreHibernationPath[0]; +0x0000 88 13 00 00 */ /* unsigned char PseudoTransition[0]; +0x0000 89 13 00 00 */ /* unsigned char Reserved2[0]; +0x0000 8a 13 00 00 */ unsigned long ContextAsUlong; /* +0x0000 */ }; struct _PROCESSOR_POWER_POLICY { unsigned long Revision; /* +0x0000 */ unsigned char DynamicThrottle; /* +0x0004 */ unsigned char Spare[3]; /* +0x0005 8d 13 00 00 */ /* unsigned char DisableCStates[0]; +0x0008 17 13 00 00 */ unsigned char Reserved[4]; /* +0x0008 8e 13 00 00 */ unsigned long PolicyCount; /* +0x000c */ unsigned char Policy[60]; /* +0x0010 90 13 00 00 */ }; struct tagTOGGLEKEYS { unsigned char cbSize[4]; /* +0x0000 75 00 00 00 */ unsigned long dwFlags; /* +0x0004 */ }; struct _FULL_PTR_XLAT_TABLES { void *RefIdToPointer; /* +0x0000 */ void *PointerToRefId; /* +0x0004 */ unsigned long NextRefId; /* +0x0008 */ unsigned char XlatSide[4]; /* +0x000c 99 13 00 00 */ }; struct DISPLAYCONFIG_SOURCE_MODE { unsigned char width[4]; /* +0x0000 75 00 00 00 */ unsigned char height[4]; /* +0x0004 75 00 00 00 */ unsigned char pixelFormat[4]; /* +0x0008 9e 13 00 00 */ unsigned char position[8]; /* +0x000c 9f 13 00 00 */ }; struct tagNMHDR { unsigned char hwndFrom[4]; /* +0x0000 f1 12 00 00 */ unsigned char idFrom[4]; /* +0x0004 75 00 00 00 */ unsigned char code[4]; /* +0x0008 75 00 00 00 */ }; struct _currencyfmtW { unsigned char NumDigits[4]; /* +0x0000 75 00 00 00 */ unsigned char LeadingZero[4]; /* +0x0004 75 00 00 00 */ unsigned char Grouping[4]; /* +0x0008 75 00 00 00 */ unsigned char lpDecimalSep[4]; /* +0x000c 71 04 00 00 */ unsigned char lpThousandSep[4]; /* +0x0010 71 04 00 00 */ unsigned char NegativeOrder[4]; /* +0x0014 75 00 00 00 */ unsigned char PositiveOrder[4]; /* +0x0018 75 00 00 00 */ unsigned char lpCurrencySymbol[4]; /* +0x001c 71 04 00 00 */ }; struct CO_MTA_USAGE_COOKIE__ { unsigned char unused[4]; /* +0x0000 74 00 00 00 */ }; struct _CERT_CHAIN_ELEMENT { unsigned long cbSize; /* +0x0000 */ unsigned char pCertContext[4]; /* +0x0004 b9 13 00 00 */ unsigned char TrustStatus[8]; /* +0x0008 ba 13 00 00 */ unsigned char pRevocationInfo[4]; /* +0x0010 bc 13 00 00 */ unsigned char pIssuanceUsage[4]; /* +0x0014 be 13 00 00 */ unsigned char pApplicationUsage[4]; /* +0x0018 be 13 00 00 */ unsigned char pwszExtendedErrorInfo[4]; /* +0x001c c0 13 00 00 */ }; struct _ACTIVATION_CONTEXT_QUERY_INDEX { unsigned long ulAssemblyIndex; /* +0x0000 */ unsigned long ulFileIndexInAssembly; /* +0x0004 */ }; struct _CRYPT_PROVIDER_REG { unsigned long cAliases; /* +0x0000 */ unsigned char rgpszAliases[4]; /* +0x0004 d0 13 00 00 */ unsigned char pUM[4]; /* +0x0008 d2 13 00 00 */ unsigned char pKM[4]; /* +0x000c d2 13 00 00 */ }; struct _CERT_ECC_SIGNATURE { unsigned char r[8]; /* +0x0000 02 13 00 00 */ unsigned char s[8]; /* +0x0008 02 13 00 00 */ }; struct _CRYPT_ATTRIBUTES { unsigned long cAttr; /* +0x0000 */ unsigned char rgAttr[4]; /* +0x0004 d8 13 00 00 */ }; struct _TOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE { void *pValue; /* +0x0000 */ unsigned long ValueLength; /* +0x0004 */ }; struct _COVERAGE_MODULE_INFO { unsigned long ModuleInfoSize; /* +0x0000 */ unsigned long IsBinaryLoaded; /* +0x0004 */ unsigned char ModulePathName[8]; /* +0x0008 dd 12 00 00 */ unsigned long CoverageSectionSize; /* +0x0010 */ unsigned char CoverageSection[4]; /* +0x0014 f9 12 00 00 */ }; struct _SYSTEM_PREFETCH_PATCH_INFORMATION { unsigned long PrefetchPatchCount; /* +0x0000 */ }; struct tagRAWHID { unsigned long dwSizeHid; /* +0x0000 */ unsigned long dwCount; /* +0x0004 */ unsigned char bRawData[4]; /* +0x0008 f9 12 00 00 */ }; struct _CRYPT_URL_ARRAY { unsigned long cUrl; /* +0x0000 */ unsigned char rgwszUrl[4]; /* +0x0004 d0 13 00 00 */ }; struct _FILE_FS_VOLUME_INFORMATION { unsigned char VolumeCreationTime[8]; /* +0x0000 3d 13 00 00 */ unsigned long VolumeSerialNumber; /* +0x0008 */ unsigned long VolumeLabelLength; /* +0x000c */ unsigned char SupportsObjects; /* +0x0010 */ unsigned char VolumeLabel[6]; /* +0x0012 f7 13 00 00 */ }; struct _EFI_DRIVER_ENTRY_LIST { unsigned long NextEntryOffset; /* +0x0000 */ unsigned char DriverEntry[20]; /* +0x0004 fa 13 00 00 */ }; struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO { unsigned short UniqueProcessId; /* +0x0000 */ unsigned short CreatorBackTraceIndex; /* +0x0002 */ unsigned char ObjectTypeIndex; /* +0x0004 */ unsigned char HandleAttributes; /* +0x0005 */ unsigned short HandleValue; /* +0x0006 */ void *Object; /* +0x0008 */ unsigned long GrantedAccess; /* +0x000c */ }; struct _COMMCONFIG { unsigned long dwSize; /* +0x0000 */ unsigned short wVersion; /* +0x0004 */ unsigned short wReserved; /* +0x0006 */ unsigned char dcb[28]; /* +0x0008 01 14 00 00 */ unsigned long dwProviderSubType; /* +0x0024 */ unsigned long dwProviderOffset; /* +0x0028 */ unsigned long dwProviderSize; /* +0x002c */ unsigned char wcProviderData[4]; /* +0x0030 f7 13 00 00 */ }; struct tagEMREXTCREATEFONTINDIRECTW { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned long ihFont; /* +0x0008 */ unsigned char elfw[320]; /* +0x000c 06 14 00 00 */ }; struct tagRPC_CALL_ATTRIBUTES_V1_A { unsigned char Version[4]; /* +0x0000 75 00 00 00 */ unsigned long Flags; /* +0x0004 */ unsigned long ServerPrincipalNameBufferLength; /* +0x0008 */ unsigned char *ServerPrincipalName; /* +0x000c */ unsigned long ClientPrincipalNameBufferLength; /* +0x0010 */ unsigned char *ClientPrincipalName; /* +0x0014 */ unsigned long AuthenticationLevel; /* +0x0018 */ unsigned long AuthenticationService; /* +0x001c */ unsigned char NullSession[4]; /* +0x0020 74 00 00 00 */ }; struct _CERT_QC_STATEMENT { char *pszStatementId; /* +0x0000 */ unsigned char StatementInfo[8]; /* +0x0004 02 13 00 00 */ }; struct _CRL_CONTEXT { unsigned long dwCertEncodingType; /* +0x0000 */ unsigned char *pbCrlEncoded; /* +0x0004 */ unsigned long cbCrlEncoded; /* +0x0008 */ unsigned char pCrlInfo[4]; /* +0x000c 0e 14 00 00 */ void *hCertStore; /* +0x0010 */ }; struct _CRYPT_KEY_PROV_INFO { unsigned char pwszContainerName[4]; /* +0x0000 71 04 00 00 */ unsigned char pwszProvName[4]; /* +0x0004 71 04 00 00 */ unsigned long dwProvType; /* +0x0008 */ unsigned long dwFlags; /* +0x000c */ unsigned long cProvParam; /* +0x0010 */ unsigned char rgProvParam[4]; /* +0x0014 12 14 00 00 */ unsigned long dwKeySpec; /* +0x0018 */ }; struct _PROCESS_FOREGROUND_BACKGROUND { unsigned char Foreground; /* +0x0000 */ }; struct _STORAGE_QUERY_DEPENDENT_VOLUME_LEV1_ENTRY { unsigned long EntryLength; /* +0x0000 */ unsigned long DependencyTypeFlags; /* +0x0004 */ unsigned long ProviderSpecificFlags; /* +0x0008 */ unsigned char VirtualStorageType[20]; /* +0x000c 1b 14 00 00 */ }; struct _GENERATE_NAME_CONTEXT { unsigned short Checksum; /* +0x0000 */ unsigned char ChecksumInserted; /* +0x0002 */ unsigned char NameLength; /* +0x0003 */ unsigned char NameBuffer[16]; /* +0x0004 1e 14 00 00 */ unsigned long ExtensionLength; /* +0x0014 */ unsigned char ExtensionBuffer[8]; /* +0x0018 1f 14 00 00 */ unsigned long LastIndexValue; /* +0x0020 */ }; struct _HEAP_EXTENDED_INFORMATION { void *Process; /* +0x0000 */ unsigned long Heap; /* +0x0004 */ unsigned long Level; /* +0x0008 */ unsigned char CallbackRoutine[4]; /* +0x000c 26 14 00 00 */ void *CallbackContext; /* +0x0010 */ /* unsigned char ProcessHeapInformation[0]; +0x0014 27 14 00 00 */ unsigned char HeapInformation[24]; /* +0x0014 45 13 00 00 */ }; struct tagEMROFFSETCLIPRGN { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned char ptlOffset[8]; /* +0x0008 9f 13 00 00 */ }; struct tagSCROLLINFO { unsigned char cbSize[4]; /* +0x0000 75 00 00 00 */ unsigned char fMask[4]; /* +0x0004 75 00 00 00 */ unsigned char nMin[4]; /* +0x0008 74 00 00 00 */ unsigned char nMax[4]; /* +0x000c 74 00 00 00 */ unsigned char nPage[4]; /* +0x0010 75 00 00 00 */ unsigned char nPos[4]; /* +0x0014 74 00 00 00 */ unsigned char nTrackPos[4]; /* +0x0018 74 00 00 00 */ }; struct tagREGISTERWORDW { unsigned char lpReading[4]; /* +0x0000 71 04 00 00 */ unsigned char lpWord[4]; /* +0x0004 71 04 00 00 */ }; struct _BCRYPT_KEY_BLOB { unsigned long Magic; /* +0x0000 */ }; struct _CMSG_MAIL_LIST_RECIPIENT_ENCODE_INFO { unsigned long cbSize; /* +0x0000 */ unsigned char KeyEncryptionAlgorithm[12]; /* +0x0004 55 14 00 00 */ void *pvKeyEncryptionAuxInfo; /* +0x0010 */ unsigned long hCryptProv; /* +0x0014 */ unsigned long dwKeyChoice; /* +0x0018 */ unsigned long hKeyEncryptionKey; /* +0x001c */ void *pvKeyEncryptionKey; /* +0x001c */ unsigned char KeyId[8]; /* +0x0020 02 13 00 00 */ unsigned char Date[8]; /* +0x0028 31 13 00 00 */ unsigned char pOtherAttr[4]; /* +0x0030 33 13 00 00 */ }; struct _CERT_SERVER_OCSP_RESPONSE_CONTEXT { unsigned long cbSize; /* +0x0000 */ unsigned char *pbEncodedOcspResponse; /* +0x0004 */ unsigned long cbEncodedOcspResponse; /* +0x0008 */ }; struct _BOOT_ENTRY_LIST { unsigned long NextEntryOffset; /* +0x0000 */ unsigned char BootEntry[32]; /* +0x0004 c8 13 00 00 */ }; struct _KCRM_MARSHAL_HEADER { unsigned long VersionMajor; /* +0x0000 */ unsigned long VersionMinor; /* +0x0004 */ unsigned long NumProtocols; /* +0x0008 */ unsigned long Unused; /* +0x000c */ }; struct tagPOLYTEXTA { unsigned char x[4]; /* +0x0000 74 00 00 00 */ unsigned char y[4]; /* +0x0004 74 00 00 00 */ unsigned char n[4]; /* +0x0008 75 00 00 00 */ unsigned char lpstr[4]; /* +0x000c 62 14 00 00 */ unsigned char uiFlags[4]; /* +0x0010 75 00 00 00 */ unsigned char rcl[16]; /* +0x0014 63 14 00 00 */ unsigned char pdx[4]; /* +0x0024 74 04 00 00 */ }; struct _LUTF8_STRING { unsigned long Length; /* +0x0000 */ unsigned long MaximumLength; /* +0x0004 */ unsigned char *Buffer; /* +0x0008 */ }; struct _IO_RESOURCE_DESCRIPTOR { unsigned char Option; /* +0x0000 */ unsigned char Type; /* +0x0001 */ unsigned char ShareDisposition; /* +0x0002 */ unsigned char Spare1; /* +0x0003 */ unsigned short Flags; /* +0x0004 */ unsigned short Spare2; /* +0x0006 */ }; struct tagMINMAXINFO { unsigned char ptReserved[8]; /* +0x0000 8a 14 00 00 */ unsigned char ptMaxSize[8]; /* +0x0008 8a 14 00 00 */ unsigned char ptMaxPosition[8]; /* +0x0010 8a 14 00 00 */ unsigned char ptMinTrackSize[8]; /* +0x0018 8a 14 00 00 */ unsigned char ptMaxTrackSize[8]; /* +0x0020 8a 14 00 00 */ }; struct _SERVICE_TABLE_ENTRYW { unsigned char lpServiceName[4]; /* +0x0000 71 04 00 00 */ unsigned char lpServiceProc[4]; /* +0x0004 a8 14 00 00 */ }; struct _JOBOBJECT_END_OF_JOB_TIME_INFORMATION { unsigned long EndOfJobTimeAction; /* +0x0000 */ }; struct _FILE_MAILSLOT_QUERY_INFORMATION { unsigned long MaximumMessageSize; /* +0x0000 */ unsigned long MailslotQuota; /* +0x0004 */ unsigned long NextMessageSize; /* +0x0008 */ unsigned long MessagesAvailable; /* +0x000c */ unsigned char ReadTimeout[8]; /* +0x0010 3d 13 00 00 */ }; struct _ENCRYPTED_DATA_INFO { unsigned long long StartingFileOffset; /* +0x0000 */ unsigned long OutputBufferOffset; /* +0x0008 */ unsigned long BytesWithinFileSize; /* +0x000c */ unsigned long BytesWithinValidDataLength; /* +0x0010 */ unsigned short CompressionFormat; /* +0x0014 */ unsigned char DataUnitShift; /* +0x0016 */ unsigned char ChunkShift; /* +0x0017 */ unsigned char ClusterShift; /* +0x0018 */ unsigned char EncryptionFormat; /* +0x0019 */ unsigned short NumberOfDataBlocks; /* +0x001a */ unsigned char DataBlockSize[4]; /* +0x001c f6 12 00 00 */ }; struct _MUILANGUAGES { unsigned char TotalSize[4]; /* +0x0000 75 00 00 00 */ unsigned short MaxNumLanguages; /* +0x0004 */ unsigned short NumLanguages; /* +0x0006 */ unsigned short NumInstalledLanguages; /* +0x0008 */ unsigned char LangInfos[4]; /* +0x000c b4 14 00 00 */ }; struct _HEAP_PERFORMANCE_COUNTERS_INFORMATION { unsigned long Size; /* +0x0000 */ unsigned long Version; /* +0x0004 */ unsigned long HeapIndex; /* +0x0008 */ unsigned long LastHeapIndex; /* +0x000c */ unsigned long BaseAddress; /* +0x0010 */ unsigned long ReserveSize; /* +0x0014 */ unsigned long CommitSize; /* +0x0018 */ unsigned long SegmentCount; /* +0x001c */ unsigned long LargeUCRMemory; /* +0x0020 */ unsigned long UCRLength; /* +0x0024 */ unsigned long AllocatedSpace; /* +0x0028 */ unsigned long FreeSpace; /* +0x002c */ unsigned long FreeListLength; /* +0x0030 */ unsigned long Contention; /* +0x0034 */ unsigned long VirtualBlocks; /* +0x0038 */ unsigned long CommitRate; /* +0x003c */ unsigned long DecommitRate; /* +0x0040 */ }; struct tagDEBUGHOOKINFO { unsigned long idThread; /* +0x0000 */ unsigned long idThreadInstaller; /* +0x0004 */ long lParam; /* +0x0008 */ unsigned char wParam[4]; /* +0x000c 75 00 00 00 */ unsigned char code[4]; /* +0x0010 74 00 00 00 */ }; struct _PLUGPLAY_CONTROL_RELATED_DEVICE_DATA { unsigned char TargetDeviceInstance[8]; /* +0x0000 dd 12 00 00 */ unsigned long Relation; /* +0x0008 */ unsigned char RelatedDeviceInstance[4]; /* +0x000c 71 04 00 00 */ unsigned long RelatedDeviceInstanceLength; /* +0x0010 */ }; struct _MUILANGINFO { unsigned short Flags; /* +0x0000 */ unsigned short Reserved; /* +0x0002 */ unsigned short LangId; /* +0x0004 */ short LangNameIndex; /* +0x0006 */ unsigned short FallbackTypes; /* +0x0008 */ short NeutralLangSpec; /* +0x000a */ unsigned char FallbackSpecs[8]; /* +0x000c f7 14 00 00 */ unsigned char AlternateCodePage[8]; /* +0x0014 f7 14 00 00 */ }; struct _CREATEFILE2_EXTENDED_PARAMETERS { unsigned long dwSize; /* +0x0000 */ unsigned long dwFileAttributes; /* +0x0004 */ unsigned long dwFileFlags; /* +0x0008 */ unsigned long dwSecurityQosFlags; /* +0x000c */ unsigned char lpSecurityAttributes[4]; /* +0x0010 fb 14 00 00 */ void *hTemplateFile; /* +0x0014 */ }; struct tagRGBTRIPLE { unsigned char rgbtBlue; /* +0x0000 */ unsigned char rgbtGreen; /* +0x0001 */ unsigned char rgbtRed; /* +0x0002 */ }; struct _CERT_CHAIN_FIND_BY_ISSUER_PARA { unsigned long cbSize; /* +0x0000 */ unsigned char pszUsageIdentifier[4]; /* +0x0004 62 14 00 00 */ unsigned long dwKeySpec; /* +0x0008 */ unsigned long dwAcquirePrivateKeyFlags; /* +0x000c */ unsigned long cIssuer; /* +0x0010 */ unsigned char rgIssuer[4]; /* +0x0014 47 13 00 00 */ unsigned char pfnFindCallback[4]; /* +0x0018 0e 15 00 00 */ void *pvFindArg; /* +0x001c */ }; struct _TXFS_CREATE_MINIVERSION_INFO { unsigned short StructureVersion; /* +0x0000 */ unsigned short StructureLength; /* +0x0002 */ unsigned long BaseVersion; /* +0x0004 */ unsigned short MiniVersion; /* +0x0008 */ }; struct _VARIABLE_NAME { unsigned long NextEntryOffset; /* +0x0000 */ unsigned char VendorGuid[16]; /* +0x0004 dc 14 00 00 */ unsigned char Name[4]; /* +0x0014 f7 13 00 00 */ }; struct _SYSTEM_POOLTAG_INFORMATION { unsigned long Count; /* +0x0000 */ unsigned char TagInfo[28]; /* +0x0004 16 15 00 00 */ }; struct _SYSDBG_CONTROL_SPACE { unsigned long long Address; /* +0x0000 */ void *Buffer; /* +0x0008 */ unsigned long Request; /* +0x000c */ unsigned long Processor; /* +0x0010 */ }; struct _HMAC_Info { unsigned char HashAlgid[4]; /* +0x0000 75 00 00 00 */ unsigned char *pbInnerString; /* +0x0004 */ unsigned long cbInnerString; /* +0x0008 */ unsigned char *pbOuterString; /* +0x000c */ unsigned long cbOuterString; /* +0x0010 */ }; struct _TOKEN_CONTROL { unsigned char TokenId[8]; /* +0x0000 21 15 00 00 */ unsigned char AuthenticationId[8]; /* +0x0008 21 15 00 00 */ unsigned char ModifiedId[8]; /* +0x0010 21 15 00 00 */ unsigned char TokenSource[16]; /* +0x0018 22 15 00 00 */ }; struct _CLAIM_SECURITY_ATTRIBUTES_INFORMATION { unsigned short Version; /* +0x0000 */ unsigned short Reserved; /* +0x0002 */ unsigned long AttributeCount; /* +0x0004 */ }; struct _FAT_STATISTICS { unsigned long CreateHits; /* +0x0000 */ unsigned long SuccessfulCreates; /* +0x0004 */ unsigned long FailedCreates; /* +0x0008 */ unsigned long NonCachedReads; /* +0x000c */ unsigned long NonCachedReadBytes; /* +0x0010 */ unsigned long NonCachedWrites; /* +0x0014 */ unsigned long NonCachedWriteBytes; /* +0x0018 */ unsigned long NonCachedDiskReads; /* +0x001c */ unsigned long NonCachedDiskWrites; /* +0x0020 */ }; struct tagREGISTERWORDA { char *lpReading; /* +0x0000 */ char *lpWord; /* +0x0004 */ }; struct tagSECURITYBINDING { unsigned short wAuthnSvc; /* +0x0000 */ unsigned short wAuthzSvc; /* +0x0002 */ unsigned short aPrincName; /* +0x0004 */ }; struct _SYSTEM_PROCESS_INFORMATION_EXTENSION { unsigned char DiskCounters[40]; /* +0x0000 35 15 00 00 */ unsigned long Flags; /* +0x0028 */ /* unsigned char HasStrongId[0]; +0x0028 17 13 00 00 */ unsigned char Spare[8]; /* +0x0028 8e 13 00 00 */ }; struct _JOURNAL_SET_KEY_SECURITY_INFORMATION { unsigned char Action[8]; /* +0x0000 38 15 00 00 */ unsigned long long RecordNumber; /* +0x0008 */ unsigned char TimeStamp[8]; /* +0x0010 3d 13 00 00 */ unsigned char KeyPathName[8]; /* +0x0018 dd 12 00 00 */ unsigned long OldSecurityDescriptorLength; /* +0x0020 */ void *OldSecurityDescriptor; /* +0x0024 */ unsigned long NewSecurityDescriptorLength; /* +0x0028 */ void *NewSecurityDescriptor; /* +0x002c */ }; struct tagABORTPATH { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ }; struct _CRYPT_OID_FUNC_ENTRY { unsigned char pszOID[4]; /* +0x0000 62 14 00 00 */ void *pvFuncAddr; /* +0x0004 */ }; struct _SYSDBG_VIRTUAL { void *Address; /* +0x0000 */ void *Buffer; /* +0x0004 */ unsigned long Request; /* +0x0008 */ }; struct tagCREATESTRUCTW { void *lpCreateParams; /* +0x0000 */ unsigned char hInstance[4]; /* +0x0004 ba 14 00 00 */ unsigned char hMenu[4]; /* +0x0008 4c 15 00 00 */ unsigned char hwndParent[4]; /* +0x000c f1 12 00 00 */ unsigned char cy[4]; /* +0x0010 74 00 00 00 */ unsigned char cx[4]; /* +0x0014 74 00 00 00 */ unsigned char y[4]; /* +0x0018 74 00 00 00 */ unsigned char x[4]; /* +0x001c 74 00 00 00 */ long style; /* +0x0020 */ unsigned char lpszName[4]; /* +0x0024 c0 13 00 00 */ unsigned char lpszClass[4]; /* +0x0028 c0 13 00 00 */ unsigned long dwExStyle; /* +0x002c */ }; struct _s__CatchableTypeArray { unsigned char nCatchableTypes[4]; /* +0x0000 74 00 00 00 */ /* unsigned char arrayOfCatchableTypes[0]; +0x0004 5c 15 00 00 */ }; struct _STRING64 { unsigned short Length; /* +0x0000 */ unsigned short MaximumLength; /* +0x0002 */ unsigned long long Buffer; /* +0x0008 */ }; struct _STORAGE_QUERY_DEPENDENT_VOLUME_LEV2_ENTRY { unsigned long EntryLength; /* +0x0000 */ unsigned long DependencyTypeFlags; /* +0x0004 */ unsigned long ProviderSpecificFlags; /* +0x0008 */ unsigned char VirtualStorageType[20]; /* +0x000c 1b 14 00 00 */ unsigned long AncestorLevel; /* +0x0020 */ unsigned long HostVolumeNameOffset; /* +0x0024 */ unsigned long HostVolumeNameSize; /* +0x0028 */ unsigned long DependentVolumeNameOffset; /* +0x002c */ unsigned long DependentVolumeNameSize; /* +0x0030 */ unsigned long RelativePathOffset; /* +0x0034 */ unsigned long RelativePathSize; /* +0x0038 */ unsigned long DependentDeviceNameOffset; /* +0x003c */ unsigned long DependentDeviceNameSize; /* +0x0040 */ }; struct _CSV_NAMESPACE_INFO { unsigned long Version; /* +0x0000 */ unsigned long DeviceNumber; /* +0x0004 */ unsigned char StartingOffset[8]; /* +0x0008 3d 13 00 00 */ unsigned long SectorSize; /* +0x0010 */ }; struct _SYSTEM_VERIFIER_ISSUE { unsigned long IssueType; /* +0x0000 */ void *Address; /* +0x0004 */ unsigned char Parameters[8]; /* +0x0008 69 15 00 00 */ }; struct _CPTABLEINFO { unsigned short CodePage; /* +0x0000 */ unsigned short MaximumCharacterSize; /* +0x0002 */ unsigned short DefaultChar; /* +0x0004 */ unsigned short UniDefaultChar; /* +0x0006 */ unsigned short TransDefaultChar; /* +0x0008 */ unsigned short TransUniDefaultChar; /* +0x000a */ unsigned short DBCSCodePage; /* +0x000c */ unsigned char LeadByte[14]; /* +0x000e 6e 15 00 00 */ unsigned short *MultiByteTable; /* +0x001c */ void *WideCharTable; /* +0x0020 */ unsigned short *DBCSRanges; /* +0x0024 */ unsigned short *DBCSOffsets; /* +0x0028 */ }; struct _RECTL { long left; /* +0x0000 */ long top; /* +0x0004 */ long right; /* +0x0008 */ long bottom; /* +0x000c */ }; struct _CTL_VERIFY_USAGE_STATUS { unsigned long cbSize; /* +0x0000 */ unsigned long dwError; /* +0x0004 */ unsigned long dwFlags; /* +0x0008 */ unsigned char ppCtl[4]; /* +0x000c 85 15 00 00 */ unsigned long dwCtlEntryIndex; /* +0x0010 */ unsigned char ppSigner[4]; /* +0x0014 86 15 00 00 */ unsigned long dwSignerIndex; /* +0x0018 */ }; struct _CERT_CHAIN_CONTEXT { unsigned long cbSize; /* +0x0000 */ unsigned char TrustStatus[8]; /* +0x0004 ba 13 00 00 */ unsigned long cChain; /* +0x000c */ unsigned char rgpChain[4]; /* +0x0010 8d 15 00 00 */ unsigned long cLowerQualityChainContext; /* +0x0014 */ unsigned char rgpLowerQualityChainContext[4]; /* +0x0018 91 15 00 00 */ unsigned char fHasRevocationFreshnessTime[4]; /* +0x001c 74 00 00 00 */ unsigned long dwRevocationFreshnessTime; /* +0x0020 */ unsigned long dwCreateFlags; /* +0x0024 */ unsigned char ChainId[16]; /* +0x0028 dc 14 00 00 */ }; struct _SYSTEM_LEGACY_DRIVER_INFORMATION { unsigned long VetoType; /* +0x0000 */ unsigned char VetoList[8]; /* +0x0004 dd 12 00 00 */ }; struct tagMULTIKEYHELPW { unsigned long mkSize; /* +0x0000 */ unsigned char mkKeylist[2]; /* +0x0004 71 00 00 00 */ unsigned char szKeyphrase[2]; /* +0x0006 f7 13 00 00 */ }; struct tagRemHENHMETAFILE { unsigned long cbData; /* +0x0000 */ unsigned char data[4]; /* +0x0004 f9 12 00 00 */ }; struct _TIME_DYNAMIC_ZONE_INFORMATION { long Bias; /* +0x0000 */ unsigned char StandardName[64]; /* +0x0004 a5 15 00 00 */ unsigned char StandardDate[16]; /* +0x0044 a6 15 00 00 */ long StandardBias; /* +0x0054 */ unsigned char DaylightName[64]; /* +0x0058 a5 15 00 00 */ unsigned char DaylightDate[16]; /* +0x0098 a6 15 00 00 */ long DaylightBias; /* +0x00a8 */ unsigned char TimeZoneKeyName[256]; /* +0x00ac a7 15 00 00 */ unsigned char DynamicDaylightTimeDisabled; /* +0x01ac */ }; struct tagEMRFRAMERGN { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned char rclBounds[16]; /* +0x0008 d5 12 00 00 */ unsigned long cbRgnData; /* +0x0018 */ unsigned long ihBrush; /* +0x001c */ unsigned char szlStroke[8]; /* +0x0020 aa 15 00 00 */ unsigned char RgnData[4]; /* +0x0028 f9 12 00 00 */ }; struct _wireSAFEARR_BRECORD { unsigned long Size; /* +0x0000 */ unsigned char aRecord[4]; /* +0x0004 b3 15 00 00 */ }; struct tagDUALSTRINGARRAY { unsigned short wNumEntries; /* +0x0000 */ unsigned short wSecurityOffset; /* +0x0002 */ unsigned char aStringArray[2]; /* +0x0004 ba 15 00 00 */ }; struct _TRANSACTION_ENLISTMENTS_INFORMATION { unsigned long NumberOfEnlistments; /* +0x0000 */ unsigned char EnlistmentPair[32]; /* +0x0004 c0 15 00 00 */ }; struct _CREATE_PROCESS_DEBUG_INFO { void *hFile; /* +0x0000 */ void *hProcess; /* +0x0004 */ void *hThread; /* +0x0008 */ void *lpBaseOfImage; /* +0x000c */ unsigned long dwDebugInfoFileOffset; /* +0x0010 */ unsigned long nDebugInfoSize; /* +0x0014 */ void *lpThreadLocalBase; /* +0x0018 */ unsigned char lpStartAddress[4]; /* +0x001c c4 15 00 00 */ void *lpImageName; /* +0x0020 */ unsigned short fUnicode; /* +0x0024 */ }; struct _SMALL_RECT { short Left; /* +0x0000 */ short Top; /* +0x0002 */ short Right; /* +0x0004 */ short Bottom; /* +0x0006 */ }; struct _CERT_POLICY_QUALIFIER_USER_NOTICE { unsigned char pNoticeReference[4]; /* +0x0000 ca 15 00 00 */ unsigned char pszDisplayText[4]; /* +0x0004 71 04 00 00 */ }; struct _CERT_OTHER_LOGOTYPE_INFO { char *pszObjId; /* +0x0000 */ unsigned char LogotypeInfo[8]; /* +0x0004 cd 15 00 00 */ }; struct _ACE_HEADER { unsigned char AceType; /* +0x0000 */ unsigned char AceFlags; /* +0x0001 */ unsigned short AceSize; /* +0x0002 */ }; struct _THREAD_BASIC_INFORMATION { long ExitStatus; /* +0x0000 */ unsigned char TebBaseAddress[4]; /* +0x0004 d8 15 00 00 */ unsigned char ClientId[8]; /* +0x0008 3e 13 00 00 */ unsigned long AffinityMask; /* +0x0010 */ long Priority; /* +0x0014 */ long BasePriority; /* +0x0018 */ }; struct _RTL_UMS_SCHEDULER_STARTUP_INFO { unsigned long UmsVersion; /* +0x0000 */ unsigned char CompletionList[4]; /* +0x0004 dc 15 00 00 */ unsigned char SchedulerProc[4]; /* +0x0008 e0 15 00 00 */ void *SchedulerParam; /* +0x000c */ }; struct _wfinddata64i32_t { unsigned char attrib[8]; /* +0x0000 75 00 00 00 */ long long time_create; /* +0x0008 */ long long time_access; /* +0x0010 */ long long time_write; /* +0x0018 */ unsigned long size; /* +0x0020 */ unsigned char name[524]; /* +0x0024 e4 15 00 00 */ }; struct tagEMRPOLYPOLYLINE { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned char rclBounds[16]; /* +0x0008 d5 12 00 00 */ unsigned long nPolys; /* +0x0018 */ unsigned long cptl; /* +0x001c */ unsigned char aPolyCounts[4]; /* +0x0020 f6 12 00 00 */ unsigned char aptl[8]; /* +0x0024 e9 15 00 00 */ }; struct tagUSEROBJECTFLAGS { unsigned char fInherit[4]; /* +0x0000 74 00 00 00 */ unsigned char fReserved[4]; /* +0x0004 74 00 00 00 */ unsigned long dwFlags; /* +0x0008 */ }; struct _NON_PAGED_DEBUG_INFO { unsigned short Signature; /* +0x0000 */ unsigned short Flags; /* +0x0002 */ unsigned long Size; /* +0x0004 */ unsigned short Machine; /* +0x0008 */ unsigned short Characteristics; /* +0x000a */ unsigned long TimeDateStamp; /* +0x000c */ unsigned long CheckSum; /* +0x0010 */ unsigned long SizeOfImage; /* +0x0014 */ unsigned long long ImageBase; /* +0x0018 */ }; struct _ALPC_PORT_MESSAGE_ZONE_INFORMATION { void *Buffer; /* +0x0000 */ unsigned long Size; /* +0x0004 */ }; struct _SCRUB_DATA_INPUT { unsigned long Flags; /* +0x0000 */ unsigned long MaximumIos; /* +0x0004 */ unsigned char Reserved[8]; /* +0x0008 69 15 00 00 */ unsigned char ResumeContext[816]; /* +0x0010 f8 15 00 00 */ }; struct _CERT_ACCESS_DESCRIPTION { char *pszAccessMethod; /* +0x0000 */ unsigned char AccessLocation[12]; /* +0x0004 ff 15 00 00 */ }; struct _FILE_FS_DRIVER_PATH_INFORMATION { unsigned char DriverInPath; /* +0x0000 */ unsigned long DriverNameLength; /* +0x0004 */ unsigned char DriverName[4]; /* +0x0008 f7 13 00 00 */ }; struct _userHENHMETAFILE { long fContext; /* +0x0000 */ }; struct _userHENHMETAFILE::__MIDL_IWinTypes_0006 { long hInproc; /* +0x0000 */ /* unsigned char hRemote[0]; +0x0000 0e 16 00 00 */ long long hInproc64; /* +0x0000 */ }; struct _CRL_INFO { unsigned long dwVersion; /* +0x0000 */ unsigned char SignatureAlgorithm[12]; /* +0x0004 55 14 00 00 */ unsigned char Issuer[8]; /* +0x0010 02 13 00 00 */ unsigned char ThisUpdate[8]; /* +0x0018 31 13 00 00 */ unsigned char NextUpdate[8]; /* +0x0020 31 13 00 00 */ unsigned long cCRLEntry; /* +0x0028 */ unsigned char rgCRLEntry[4]; /* +0x002c 20 16 00 00 */ unsigned long cExtension; /* +0x0030 */ unsigned char rgExtension[4]; /* +0x0034 22 16 00 00 */ }; struct _CRYPT_TIMESTAMP_CONTEXT { unsigned long cbEncoded; /* +0x0000 */ unsigned char *pbEncoded; /* +0x0004 */ unsigned char pTimeStamp[4]; /* +0x0008 26 16 00 00 */ }; struct _NLSTABLEINFO { unsigned char OemTableInfo[44]; /* +0x0000 2b 16 00 00 */ unsigned char AnsiTableInfo[44]; /* +0x002c 2b 16 00 00 */ unsigned short *UpperCaseTable; /* +0x0058 */ unsigned short *LowerCaseTable; /* +0x005c */ }; struct _USER_MARSHAL_ROUTINE_QUADRUPLE { unsigned char pfnBufferSize[4]; /* +0x0000 30 16 00 00 */ unsigned char pfnMarshall[4]; /* +0x0004 33 16 00 00 */ unsigned char pfnUnmarshall[4]; /* +0x0008 33 16 00 00 */ unsigned char pfnFree[4]; /* +0x000c 36 16 00 00 */ }; struct _tagpropertykey { unsigned char fmtid[16]; /* +0x0000 dc 14 00 00 */ unsigned long pid; /* +0x0010 */ }; struct _CERT_SIGNED_CONTENT_INFO { unsigned char ToBeSigned[8]; /* +0x0000 02 13 00 00 */ unsigned char SignatureAlgorithm[12]; /* +0x0008 55 14 00 00 */ unsigned char Signature[12]; /* +0x0014 03 13 00 00 */ }; struct _CMC_TAGGED_ATTRIBUTE { unsigned long dwBodyPartID; /* +0x0000 */ unsigned char Attribute[12]; /* +0x0004 d7 13 00 00 */ }; struct _JOBOBJECT_JOBSET_INFORMATION { unsigned long MemberLevel; /* +0x0000 */ }; struct _SYSTEM_OBJECTTYPE_INFORMATION { unsigned long NextEntryOffset; /* +0x0000 */ unsigned long NumberOfObjects; /* +0x0004 */ unsigned long NumberOfHandles; /* +0x0008 */ unsigned long TypeIndex; /* +0x000c */ unsigned long InvalidAttributes; /* +0x0010 */ unsigned char GenericMapping[16]; /* +0x0014 41 16 00 00 */ unsigned long ValidAccessMask; /* +0x0024 */ unsigned long PoolType; /* +0x0028 */ unsigned char SecurityRequired; /* +0x002c */ unsigned char WaitableObject; /* +0x002d */ unsigned char TypeName[8]; /* +0x0030 dd 12 00 00 */ }; struct _PLUGPLAY_CONTROL_INTERFACE_ALIAS_DATA { unsigned char SymbolicLinkName[8]; /* +0x0000 dd 12 00 00 */ unsigned char AliasClassGuid[4]; /* +0x0008 44 16 00 00 */ unsigned char AliasSymbolicLinkName[4]; /* +0x000c 71 04 00 00 */ unsigned long AliasSymbolicLinkNameLength; /* +0x0010 */ }; struct _RTL_HEAP_ENTRY { unsigned long Size; /* +0x0000 */ unsigned short Flags; /* +0x0004 */ unsigned short AllocatorBackTraceIndex; /* +0x0006 */ }; struct _FINDFIRSTACTIVATIONCONTEXTSECTION { unsigned long Size; /* +0x0000 */ unsigned long Flags; /* +0x0004 */ unsigned char ExtensionGuid[4]; /* +0x0008 4a 16 00 00 */ unsigned long Id; /* +0x000c */ unsigned long Depth; /* +0x0010 */ unsigned long OutFlags; /* +0x0014 */ }; struct DISPLAYCONFIG_PATH_SOURCE_INFO { unsigned char adapterId[8]; /* +0x0000 21 15 00 00 */ unsigned char id[4]; /* +0x0008 75 00 00 00 */ unsigned char modeInfoIdx[4]; /* +0x000c 75 00 00 00 */ unsigned char statusFlags[4]; /* +0x0010 75 00 00 00 */ }; struct tagRAWINPUT { unsigned char header[40]; /* +0x0000 4f 16 00 00 */ }; struct _SET_PURGE_FAILURE_MODE_INPUT { unsigned long Flags; /* +0x0000 */ }; struct CM_Power_Data_s { unsigned long PD_Size; /* +0x0000 */ unsigned char PD_MostRecentPowerState[4]; /* +0x0004 58 16 00 00 */ unsigned long PD_Capabilities; /* +0x0008 */ unsigned long PD_D1Latency; /* +0x000c */ unsigned long PD_D2Latency; /* +0x0010 */ unsigned long PD_D3Latency; /* +0x0014 */ unsigned char PD_PowerStateMapping[28]; /* +0x0018 59 16 00 00 */ unsigned char PD_DeepestSystemWake[4]; /* +0x0034 5a 16 00 00 */ }; struct tagANIMATIONINFO { unsigned char cbSize[4]; /* +0x0000 75 00 00 00 */ unsigned char iMinAnimate[4]; /* +0x0004 74 00 00 00 */ }; struct _CTL_FIND_SUBJECT_PARA { unsigned long cbSize; /* +0x0000 */ unsigned char pUsagePara[4]; /* +0x0004 62 16 00 00 */ unsigned long dwSubjectType; /* +0x0008 */ void *pvSubject; /* +0x000c */ }; struct _VIDEOPARAMETERS { unsigned char Guid[16]; /* +0x0000 dc 14 00 00 */ unsigned long dwOffset; /* +0x0010 */ unsigned long dwCommand; /* +0x0014 */ unsigned long dwFlags; /* +0x0018 */ unsigned long dwMode; /* +0x001c */ unsigned long dwTVStandard; /* +0x0020 */ unsigned long dwAvailableModes; /* +0x0024 */ unsigned long dwAvailableTVStandard; /* +0x0028 */ unsigned long dwFlickerFilter; /* +0x002c */ unsigned long dwOverScanX; /* +0x0030 */ unsigned long dwOverScanY; /* +0x0034 */ unsigned long dwMaxUnscaledX; /* +0x0038 */ unsigned long dwMaxUnscaledY; /* +0x003c */ unsigned long dwPositionX; /* +0x0040 */ unsigned long dwPositionY; /* +0x0044 */ unsigned long dwBrightness; /* +0x0048 */ unsigned long dwContrast; /* +0x004c */ unsigned long dwCPType; /* +0x0050 */ unsigned long dwCPCommand; /* +0x0054 */ unsigned long dwCPStandard; /* +0x0058 */ unsigned long dwCPKey; /* +0x005c */ unsigned long bCP_APSTriggerBits; /* +0x0060 */ unsigned char bOEMCopyProtection[256]; /* +0x0064 74 16 00 00 */ }; struct _OCSP_CERT_ID { unsigned char HashAlgorithm[12]; /* +0x0000 55 14 00 00 */ unsigned char IssuerNameHash[8]; /* +0x000c 02 13 00 00 */ unsigned char IssuerKeyHash[8]; /* +0x0014 02 13 00 00 */ unsigned char SerialNumber[8]; /* +0x001c 02 13 00 00 */ }; struct _GROUP_RELATIONSHIP { unsigned short MaximumGroupCount; /* +0x0000 */ unsigned short ActiveGroupCount; /* +0x0002 */ unsigned char Reserved[20]; /* +0x0004 7b 16 00 00 */ unsigned char GroupInfo[44]; /* +0x0018 7d 16 00 00 */ }; struct _RTL_TRACE_BLOCK { unsigned long Magic; /* +0x0000 */ unsigned long Count; /* +0x0004 */ unsigned long Size; /* +0x0008 */ unsigned long UserCount; /* +0x000c */ unsigned long UserSize; /* +0x0010 */ void *UserContext; /* +0x0014 */ unsigned char Next[4]; /* +0x0018 81 16 00 00 */ unsigned char Trace[4]; /* +0x001c 4f 13 00 00 */ }; struct tagBITMAPCOREINFO { unsigned char bmciHeader[12]; /* +0x0000 84 16 00 00 */ unsigned char bmciColors[4]; /* +0x000c 86 16 00 00 */ }; struct tagPIXELFORMATDESCRIPTOR { unsigned short nSize; /* +0x0000 */ unsigned short nVersion; /* +0x0002 */ unsigned long dwFlags; /* +0x0004 */ unsigned char iPixelType; /* +0x0008 */ unsigned char cColorBits; /* +0x0009 */ unsigned char cRedBits; /* +0x000a */ unsigned char cRedShift; /* +0x000b */ unsigned char cGreenBits; /* +0x000c */ unsigned char cGreenShift; /* +0x000d */ unsigned char cBlueBits; /* +0x000e */ unsigned char cBlueShift; /* +0x000f */ unsigned char cAlphaBits; /* +0x0010 */ unsigned char cAlphaShift; /* +0x0011 */ unsigned char cAccumBits; /* +0x0012 */ unsigned char cAccumRedBits; /* +0x0013 */ unsigned char cAccumGreenBits; /* +0x0014 */ unsigned char cAccumBlueBits; /* +0x0015 */ unsigned char cAccumAlphaBits; /* +0x0016 */ unsigned char cDepthBits; /* +0x0017 */ unsigned char cStencilBits; /* +0x0018 */ unsigned char cAuxBuffers; /* +0x0019 */ unsigned char iLayerType; /* +0x001a */ unsigned char bReserved; /* +0x001b */ unsigned long dwLayerMask; /* +0x001c */ unsigned long dwVisibleMask; /* +0x0020 */ unsigned long dwDamageMask; /* +0x0024 */ }; struct tagEMRFILLPATH { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned char rclBounds[16]; /* +0x0008 d5 12 00 00 */ }; struct _FLOAT128 { long long LowPart; /* +0x0000 */ long long HighPart; /* +0x0008 */ }; struct _STRING { unsigned short Length; /* +0x0000 */ unsigned short MaximumLength; /* +0x0002 */ char *Buffer; /* +0x0004 */ }; struct _LDT_ENTRY { unsigned short LimitLow; /* +0x0000 */ unsigned short BaseLow; /* +0x0002 */ }; struct tagEMRFILLRGN { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned char rclBounds[16]; /* +0x0008 d5 12 00 00 */ unsigned long cbRgnData; /* +0x0018 */ unsigned long ihBrush; /* +0x001c */ unsigned char RgnData[4]; /* +0x0020 f9 12 00 00 */ }; struct _CRYPT_SMIME_CAPABILITIES { unsigned long cCapability; /* +0x0000 */ unsigned char rgCapability[4]; /* +0x0004 aa 16 00 00 */ }; struct _PS_MEMORY_RESERVE { void *ReserveAddress; /* +0x0000 */ unsigned long ReserveSize; /* +0x0004 */ }; struct _SYSTEM_SET_TIME_ADJUST_INFORMATION { unsigned long TimeAdjustment; /* +0x0000 */ unsigned char Enable; /* +0x0004 */ }; struct _SERVICE_NOTIFY_2A { unsigned long dwVersion; /* +0x0000 */ unsigned char pfnNotifyCallback[4]; /* +0x0004 c7 13 00 00 */ void *pContext; /* +0x0008 */ unsigned long dwNotificationStatus; /* +0x000c */ unsigned char ServiceStatus[36]; /* +0x0010 c6 16 00 00 */ unsigned long dwNotificationTriggered; /* +0x0034 */ char *pszServiceNames; /* +0x0038 */ }; struct _FILE_PIPE_ASSIGN_EVENT_BUFFER { void *EventHandle; /* +0x0000 */ unsigned long KeyValue; /* +0x0004 */ }; struct _MEMORY_BASIC_INFORMATION32 { unsigned long BaseAddress; /* +0x0000 */ unsigned long AllocationBase; /* +0x0004 */ unsigned long AllocationProtect; /* +0x0008 */ unsigned long RegionSize; /* +0x000c */ unsigned long State; /* +0x0010 */ unsigned long Protect; /* +0x0014 */ unsigned long Type; /* +0x0018 */ }; struct tagTEXTMETRICA { long tmHeight; /* +0x0000 */ long tmAscent; /* +0x0004 */ long tmDescent; /* +0x0008 */ long tmInternalLeading; /* +0x000c */ long tmExternalLeading; /* +0x0010 */ long tmAveCharWidth; /* +0x0014 */ long tmMaxCharWidth; /* +0x0018 */ long tmWeight; /* +0x001c */ long tmOverhang; /* +0x0020 */ long tmDigitizedAspectX; /* +0x0024 */ long tmDigitizedAspectY; /* +0x0028 */ unsigned char tmFirstChar; /* +0x002c */ unsigned char tmLastChar; /* +0x002d */ unsigned char tmDefaultChar; /* +0x002e */ unsigned char tmBreakChar; /* +0x002f */ unsigned char tmItalic; /* +0x0030 */ unsigned char tmUnderlined; /* +0x0031 */ unsigned char tmStruckOut; /* +0x0032 */ unsigned char tmPitchAndFamily; /* +0x0033 */ unsigned char tmCharSet; /* +0x0034 */ }; struct _RDR_CALLOUT_STATE { long LastError; /* +0x0000 */ void *LastEEInfo; /* +0x0004 */ unsigned char LastCalledStage[4]; /* +0x0008 ea 16 00 00 */ unsigned short *ServerName; /* +0x000c */ unsigned short *ServerPort; /* +0x0010 */ unsigned short *RemoteUser; /* +0x0014 */ unsigned short *AuthType; /* +0x0018 */ unsigned char ResourceTypePresent; /* +0x001c */ unsigned char SessionIdPresent; /* +0x001d */ unsigned char InterfacePresent; /* +0x001e */ unsigned char ResourceType[16]; /* +0x0020 dc 14 00 00 */ unsigned char SessionId[16]; /* +0x0030 dc 14 00 00 */ unsigned char Interface[20]; /* +0x0040 eb 16 00 00 */ void *CertContext; /* +0x0054 */ }; struct _POINTL { long x; /* +0x0000 */ long y; /* +0x0004 */ }; struct _OFSTRUCT { unsigned char cBytes; /* +0x0000 */ unsigned char fFixedDisk; /* +0x0001 */ unsigned short nErrCode; /* +0x0002 */ unsigned short Reserved1; /* +0x0004 */ unsigned short Reserved2; /* +0x0006 */ unsigned char szPathName[128]; /* +0x0008 f7 16 00 00 */ }; struct DISPLAYCONFIG_RATIONAL { unsigned char Numerator[4]; /* +0x0000 75 00 00 00 */ unsigned char Denominator[4]; /* +0x0004 75 00 00 00 */ }; struct _MAT2 { unsigned char eM11[4]; /* +0x0000 fc 16 00 00 */ unsigned char eM12[4]; /* +0x0004 fc 16 00 00 */ unsigned char eM21[4]; /* +0x0008 fc 16 00 00 */ unsigned char eM22[4]; /* +0x000c fc 16 00 00 */ }; struct _PROTOGON_STATISTICS { unsigned long Unused; /* +0x0000 */ }; struct _MCA_EXCEPTION { unsigned long VersionNumber; /* +0x0000 */ unsigned char ExceptionType[4]; /* +0x0004 05 17 00 00 */ unsigned char TimeStamp[8]; /* +0x0008 3d 13 00 00 */ unsigned long ProcessorNumber; /* +0x0010 */ unsigned long Reserved1; /* +0x0014 */ }; struct tagEMRNAMEDESCAPE { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned char iEscape[4]; /* +0x0008 74 00 00 00 */ unsigned char cbDriver[4]; /* +0x000c 74 00 00 00 */ unsigned char cbEscData[4]; /* +0x0010 74 00 00 00 */ unsigned char EscData[4]; /* +0x0014 f9 12 00 00 */ }; struct _TOKEN_MANDATORY_LABEL { unsigned char Label[8]; /* +0x0000 12 17 00 00 */ }; struct _OUTPUT_DEBUG_STRING_INFO { char *lpDebugStringData; /* +0x0000 */ unsigned short fUnicode; /* +0x0004 */ unsigned short nDebugStringLength; /* +0x0006 */ }; struct _SE_PACKAGE_CAPABILITY_INFO { unsigned long Remaining; /* +0x0000 */ unsigned long PackageGrantedAccess; /* +0x0004 */ unsigned long CapabilityGrantedAccess; /* +0x0008 */ unsigned long UserGroupsRemaining; /* +0x000c */ unsigned char PackagesPresent; /* +0x0010 */ unsigned char PackageMatch; /* +0x0011 */ unsigned char CapabilityMatch; /* +0x0012 */ unsigned char LogPermissiveFailure; /* +0x0013 */ }; struct _UNIVERSAL_NAME_INFOW { unsigned char lpUniversalName[4]; /* +0x0000 71 04 00 00 */ }; struct _WORD_BLOB { unsigned long clSize; /* +0x0000 */ unsigned char asData[4]; /* +0x0004 ba 15 00 00 */ }; struct _IMAGE_OPTIONAL_HEADER64 { unsigned short Magic; /* +0x0000 */ unsigned char MajorLinkerVersion; /* +0x0002 */ unsigned char MinorLinkerVersion; /* +0x0003 */ unsigned long SizeOfCode; /* +0x0004 */ unsigned long SizeOfInitializedData; /* +0x0008 */ unsigned long SizeOfUninitializedData; /* +0x000c */ unsigned long AddressOfEntryPoint; /* +0x0010 */ unsigned long BaseOfCode; /* +0x0014 */ unsigned long long ImageBase; /* +0x0018 */ unsigned long SectionAlignment; /* +0x0020 */ unsigned long FileAlignment; /* +0x0024 */ unsigned short MajorOperatingSystemVersion; /* +0x0028 */ unsigned short MinorOperatingSystemVersion; /* +0x002a */ unsigned short MajorImageVersion; /* +0x002c */ unsigned short MinorImageVersion; /* +0x002e */ unsigned short MajorSubsystemVersion; /* +0x0030 */ unsigned short MinorSubsystemVersion; /* +0x0032 */ unsigned long Win32VersionValue; /* +0x0034 */ unsigned long SizeOfImage; /* +0x0038 */ unsigned long SizeOfHeaders; /* +0x003c */ unsigned long CheckSum; /* +0x0040 */ unsigned short Subsystem; /* +0x0044 */ unsigned short DllCharacteristics; /* +0x0046 */ unsigned long long SizeOfStackReserve; /* +0x0048 */ unsigned long long SizeOfStackCommit; /* +0x0050 */ unsigned long long SizeOfHeapReserve; /* +0x0058 */ unsigned long long SizeOfHeapCommit; /* +0x0060 */ unsigned long LoaderFlags; /* +0x0068 */ unsigned long NumberOfRvaAndSizes; /* +0x006c */ unsigned char DataDirectory[128]; /* +0x0070 34 17 00 00 */ }; struct _DRIVER_VERIFIER_THUNK_PAIRS { unsigned char PristineRoutine[4]; /* +0x0000 c4 15 00 00 */ unsigned char NewRoutine[4]; /* +0x0004 c4 15 00 00 */ }; struct _SYSTEM_VERIFIER_TRIAGE_INFORMATION { unsigned long ActionTaken; /* +0x0000 */ unsigned char CrashData[20]; /* +0x0004 3b 17 00 00 */ unsigned long VerifierMode; /* +0x0018 */ unsigned long VerifierFlags; /* +0x001c */ unsigned char VerifierTargets[512]; /* +0x0020 3c 17 00 00 */ }; struct _JOURNAL_RENAME_KEY_INFORMATION { unsigned char Action[8]; /* +0x0000 38 15 00 00 */ unsigned long long RecordNumber; /* +0x0008 */ unsigned char TimeStamp[8]; /* +0x0010 3d 13 00 00 */ unsigned char KeyPathName[8]; /* +0x0018 dd 12 00 00 */ unsigned char KeyKeyName[8]; /* +0x0020 dd 12 00 00 */ }; struct tagEMRSETVIEWPORTEXTEX { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned char szlExtent[8]; /* +0x0008 aa 15 00 00 */ }; struct tagTRACKMOUSEEVENT { unsigned long cbSize; /* +0x0000 */ unsigned long dwFlags; /* +0x0004 */ unsigned char hwndTrack[4]; /* +0x0008 f1 12 00 00 */ unsigned long dwHoverTime; /* +0x000c */ }; struct tagCOMBOBOXINFO { unsigned long cbSize; /* +0x0000 */ unsigned char rcItem[16]; /* +0x0004 63 14 00 00 */ unsigned char rcButton[16]; /* +0x0014 63 14 00 00 */ unsigned long stateButton; /* +0x0024 */ unsigned char hwndCombo[4]; /* +0x0028 f1 12 00 00 */ unsigned char hwndItem[4]; /* +0x002c f1 12 00 00 */ unsigned char hwndList[4]; /* +0x0030 f1 12 00 00 */ }; struct _RPC_SECURITY_QOS_V2_A { unsigned long Version; /* +0x0000 */ unsigned long Capabilities; /* +0x0004 */ unsigned long IdentityTracking; /* +0x0008 */ unsigned long ImpersonationType; /* +0x000c */ unsigned long AdditionalSecurityInfoType; /* +0x0010 */ }; struct _RPC_SECURITY_QOS_V2_A::<unnamed-type-u> { unsigned char HttpCredentials[4]; /* +0x0000 4e 17 00 00 */ }; struct _s__RTTICompleteObjectLocator { unsigned long signature; /* +0x0000 */ unsigned long offset; /* +0x0004 */ unsigned long cdOffset; /* +0x0008 */ unsigned char pTypeDescriptor[4]; /* +0x000c 52 17 00 00 */ unsigned char pClassDescriptor[4]; /* +0x0010 55 17 00 00 */ }; struct _FILE_PIPE_LOCAL_INFORMATION { unsigned long NamedPipeType; /* +0x0000 */ unsigned long NamedPipeConfiguration; /* +0x0004 */ unsigned long MaximumInstances; /* +0x0008 */ unsigned long CurrentInstances; /* +0x000c */ unsigned long InboundQuota; /* +0x0010 */ unsigned long ReadDataAvailable; /* +0x0014 */ unsigned long OutboundQuota; /* +0x0018 */ unsigned long WriteQuotaAvailable; /* +0x001c */ unsigned long NamedPipeState; /* +0x0020 */ unsigned long NamedPipeEnd; /* +0x0024 */ }; struct _MUILANGLIST { unsigned char TotalSize[4]; /* +0x0000 75 00 00 00 */ unsigned short NumLanguages; /* +0x0004 */ unsigned short MaxNumLanguages; /* +0x0006 */ unsigned char bUseUseMachineConfigList; /* +0x0008 */ unsigned char RegInfo[4]; /* +0x000c 62 17 00 00 */ unsigned char Languages[8]; /* +0x0010 64 17 00 00 */ unsigned long long ullMask; /* +0x0018 */ unsigned char uConsoleFlag[4]; /* +0x0020 75 00 00 00 */ unsigned char Checksum[20]; /* +0x0024 65 17 00 00 */ }; struct _ACTIVATION_CONTEXT_SECTION_KEYED_DATA { unsigned long Size; /* +0x0000 */ unsigned long DataFormatVersion; /* +0x0004 */ void *Data; /* +0x0008 */ unsigned long Length; /* +0x000c */ void *SectionGlobalData; /* +0x0010 */ unsigned long SectionGlobalDataLength; /* +0x0014 */ void *SectionBase; /* +0x0018 */ unsigned long SectionTotalLength; /* +0x001c */ unsigned char ActivationContext[4]; /* +0x0020 69 17 00 00 */ unsigned long AssemblyRosterIndex; /* +0x0024 */ unsigned long Flags; /* +0x0028 */ unsigned char AssemblyMetadata[20]; /* +0x002c 6a 17 00 00 */ }; struct _BY_HANDLE_FILE_INFORMATION { unsigned long dwFileAttributes; /* +0x0000 */ unsigned char ftCreationTime[8]; /* +0x0004 31 13 00 00 */ unsigned char ftLastAccessTime[8]; /* +0x000c 31 13 00 00 */ unsigned char ftLastWriteTime[8]; /* +0x0014 31 13 00 00 */ unsigned long dwVolumeSerialNumber; /* +0x001c */ unsigned long nFileSizeHigh; /* +0x0020 */ unsigned long nFileSizeLow; /* +0x0024 */ unsigned long nNumberOfLinks; /* +0x0028 */ unsigned long nFileIndexHigh; /* +0x002c */ unsigned long nFileIndexLow; /* +0x0030 */ }; struct _CERT_SELECT_CHAIN_PARA { void *hChainEngine; /* +0x0000 */ unsigned char pTime[4]; /* +0x0004 73 17 00 00 */ void *hAdditionalStore; /* +0x0008 */ unsigned char pChainPara[4]; /* +0x000c 75 17 00 00 */ unsigned long dwFlags; /* +0x0010 */ }; struct _PROCESSOR_IDLE_STATE { unsigned char StateType; /* +0x0000 */ unsigned long StateFlags; /* +0x0004 */ unsigned long HardwareLatency; /* +0x0008 */ unsigned long Power; /* +0x000c */ unsigned long Context; /* +0x0010 */ unsigned char Handler[4]; /* +0x0014 91 17 00 00 */ }; struct _EVENTLOGRECORD { unsigned long Length; /* +0x0000 */ unsigned long Reserved; /* +0x0004 */ unsigned long RecordNumber; /* +0x0008 */ unsigned long TimeGenerated; /* +0x000c */ unsigned long TimeWritten; /* +0x0010 */ unsigned long EventID; /* +0x0014 */ unsigned short EventType; /* +0x0018 */ unsigned short NumStrings; /* +0x001a */ unsigned short EventCategory; /* +0x001c */ unsigned short ReservedFlags; /* +0x001e */ unsigned long ClosingRecordNumber; /* +0x0020 */ unsigned long StringOffset; /* +0x0024 */ unsigned long UserSidLength; /* +0x0028 */ unsigned long UserSidOffset; /* +0x002c */ unsigned long DataLength; /* +0x0030 */ unsigned long DataOffset; /* +0x0034 */ }; struct _PLUGPLAY_CUSTOM_NOTIFICATION { unsigned char HeaderInfo[20]; /* +0x0000 98 17 00 00 */ void *FileObject; /* +0x0014 */ long NameBufferOffset; /* +0x0018 */ unsigned char CustomDataBuffer[4]; /* +0x001c f9 12 00 00 */ }; struct _UNICODE_PREFIX_TABLE_ENTRY { short NodeTypeCode; /* +0x0000 */ short NameLength; /* +0x0002 */ unsigned char NextPrefixTree[4]; /* +0x0004 a0 17 00 00 */ unsigned char CaseMatch[4]; /* +0x0008 a0 17 00 00 */ unsigned char Links[12]; /* +0x000c a1 17 00 00 */ unsigned char Prefix[4]; /* +0x0018 a2 17 00 00 */ }; struct tagSTYLESTRUCT { unsigned long styleOld; /* +0x0000 */ unsigned long styleNew; /* +0x0004 */ }; struct _cpinfoexW { unsigned char MaxCharSize[4]; /* +0x0000 75 00 00 00 */ unsigned char DefaultChar[2]; /* +0x0004 a7 17 00 00 */ unsigned char LeadByte[12]; /* +0x0006 6e 15 00 00 */ unsigned char UnicodeDefaultChar[2]; /* +0x0012 71 00 00 00 */ unsigned char CodePage[4]; /* +0x0014 75 00 00 00 */ unsigned char CodePageName[520]; /* +0x0018 e4 15 00 00 */ }; struct _SYSTEM_SPECIAL_POOL_INFORMATION { unsigned long PoolTag; /* +0x0000 */ unsigned long Flags; /* +0x0004 */ }; struct _COVERAGE_MODULE_REQUEST { unsigned char RequestType[20]; /* +0x0000 cc 16 00 00 */ }; struct _RTL_PROCESS_VERIFIER_OPTIONS { unsigned long SizeStruct; /* +0x0000 */ unsigned long Option; /* +0x0004 */ unsigned char OptionData[4]; /* +0x0008 f9 12 00 00 */ }; struct _tagSOFTDISTINFO { unsigned long cbSize; /* +0x0000 */ unsigned long dwFlags; /* +0x0004 */ unsigned long dwAdState; /* +0x0008 */ unsigned char szTitle[4]; /* +0x000c 71 04 00 00 */ unsigned char szAbstract[4]; /* +0x0010 71 04 00 00 */ unsigned char szHREF[4]; /* +0x0014 71 04 00 00 */ unsigned long dwInstalledVersionMS; /* +0x0018 */ unsigned long dwInstalledVersionLS; /* +0x001c */ unsigned long dwUpdateVersionMS; /* +0x0020 */ unsigned long dwUpdateVersionLS; /* +0x0024 */ unsigned long dwAdvertisedVersionMS; /* +0x0028 */ unsigned long dwAdvertisedVersionLS; /* +0x002c */ unsigned long dwReserved; /* +0x0030 */ }; struct _BCRYPT_DSA_PARAMETER_HEADER { unsigned long cbLength; /* +0x0000 */ unsigned long dwMagic; /* +0x0004 */ unsigned long cbKeyLength; /* +0x0008 */ unsigned char Count[4]; /* +0x000c b7 17 00 00 */ unsigned char Seed[20]; /* +0x0010 7b 16 00 00 */ unsigned char q[20]; /* +0x0024 7b 16 00 00 */ }; struct _RTL_UMS_CONTEXT { unsigned char Link[4]; /* +0x0000 ba 17 00 00 */ unsigned char Context[716]; /* +0x0004 57 13 00 00 */ void *Teb; /* +0x02d0 */ void *UserContext; /* +0x02d4 */ /* unsigned char ScheduledThread[0]; +0x02d8 bc 17 00 00 */ /* unsigned char Suspended[0]; +0x02d8 bd 17 00 00 */ /* unsigned char VolatileContext[0]; +0x02d8 be 17 00 00 */ /* unsigned char Terminated[0]; +0x02d8 bf 17 00 00 */ /* unsigned char DebugActive[0]; +0x02d8 c0 17 00 00 */ /* unsigned char RunningOnSelfThread[0]; +0x02d8 c1 17 00 00 */ /* unsigned char DenyRunningOnSelfThread[0]; +0x02d8 c2 17 00 00 */ unsigned char Flags[8]; /* +0x02d8 c3 17 00 00 */ /* unsigned char KernelUpdateLock[0]; +0x02e0 c5 17 00 00 */ /* unsigned char PrimaryClientID[0]; +0x02e0 c6 17 00 00 */ unsigned char ContextLock[8]; /* +0x02e0 c4 17 00 00 */ unsigned char PrimaryUmsContext[4]; /* +0x02e8 c8 17 00 00 */ unsigned long SwitchCount; /* +0x02ec */ unsigned long KernelYieldCount; /* +0x02f0 */ unsigned long MixedYieldCount; /* +0x02f4 */ unsigned long YieldCount; /* +0x02f8 */ }; struct XSAVE_CPU_INFO { unsigned char Processor; /* +0x0000 */ unsigned short Family; /* +0x0002 */ unsigned short Model; /* +0x0004 */ unsigned short Stepping; /* +0x0006 */ unsigned short ExtendedModel; /* +0x0008 */ unsigned long ExtendedFamily; /* +0x000c */ unsigned long long MicrocodeVersion; /* +0x0010 */ unsigned long Reserved; /* +0x0018 */ }; struct _OBJECT_DIRECTORY_INFORMATION { unsigned char Name[8]; /* +0x0000 dd 12 00 00 */ unsigned char TypeName[8]; /* +0x0008 dd 12 00 00 */ }; struct _JOURNAL_CLIENT_INFORMATION { unsigned char StartTimeStamp[8]; /* +0x0000 3d 13 00 00 */ unsigned char CurrentTimeStamp[8]; /* +0x0008 3d 13 00 00 */ unsigned long long RecordsToProcess; /* +0x0010 */ unsigned long RelativeFillLevel; /* +0x0018 */ }; struct tagEMRMODIFYWORLDTRANSFORM { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned char xform[24]; /* +0x0008 d6 12 00 00 */ unsigned long iMode; /* +0x0020 */ }; struct SChannelHookCallInfo { unsigned char iid[16]; /* +0x0000 dc 14 00 00 */ unsigned long cbSize; /* +0x0010 */ unsigned char uCausality[16]; /* +0x0014 dc 14 00 00 */ unsigned long dwServerPid; /* +0x0024 */ unsigned long iMethod; /* +0x0028 */ void *pObject; /* +0x002c */ }; struct __MIDL_XmitDefs_0001 { unsigned long dwFlags; /* +0x0000 */ unsigned long dwClientThread; /* +0x0004 */ }; struct _RTL_BITMAP { unsigned long SizeOfBitMap; /* +0x0000 */ unsigned long *Buffer; /* +0x0004 */ }; struct tagEXTLOGFONTA { unsigned char elfLogFont[60]; /* +0x0000 c2 16 00 00 */ unsigned char elfFullName[64]; /* +0x003c 13 13 00 00 */ unsigned char elfStyle[32]; /* +0x007c e5 17 00 00 */ unsigned long elfVersion; /* +0x009c */ unsigned long elfStyleSize; /* +0x00a0 */ unsigned long elfMatch; /* +0x00a4 */ unsigned long elfReserved; /* +0x00a8 */ unsigned char elfVendorId[4]; /* +0x00ac b7 17 00 00 */ unsigned long elfCulture; /* +0x00b0 */ unsigned char elfPanose[12]; /* +0x00b4 e6 17 00 00 */ }; struct _tagPROTOCOLDATA { unsigned long grfFlags; /* +0x0000 */ unsigned long dwState; /* +0x0004 */ void *pData; /* +0x0008 */ unsigned long cbData; /* +0x000c */ }; struct _FILE_FULL_DIR_INFORMATION { unsigned long NextEntryOffset; /* +0x0000 */ unsigned long FileIndex; /* +0x0004 */ unsigned char CreationTime[8]; /* +0x0008 3d 13 00 00 */ unsigned char LastAccessTime[8]; /* +0x0010 3d 13 00 00 */ unsigned char LastWriteTime[8]; /* +0x0018 3d 13 00 00 */ unsigned char ChangeTime[8]; /* +0x0020 3d 13 00 00 */ unsigned char EndOfFile[8]; /* +0x0028 3d 13 00 00 */ unsigned char AllocationSize[8]; /* +0x0030 3d 13 00 00 */ unsigned long FileAttributes; /* +0x0038 */ unsigned long FileNameLength; /* +0x003c */ unsigned long EaSize; /* +0x0040 */ unsigned char FileName[4]; /* +0x0044 f7 13 00 00 */ }; struct _FILE_REPARSE_POINT_INFORMATION { long long FileReference; /* +0x0000 */ unsigned long Tag; /* +0x0008 */ }; struct _RTL_STACK_CONTEXT_ENTRY { unsigned long Address; /* +0x0000 */ unsigned long Data; /* +0x0004 */ }; struct _TRIPLE_LIST_ITERATOR { unsigned char List[4]; /* +0x0000 00 18 00 00 */ unsigned char NextEntry[4]; /* +0x0004 42 17 00 00 */ unsigned char ActiveList; /* +0x0008 */ unsigned char ProbeReads; /* +0x0009 */ unsigned char ReturnDataOffset; /* +0x000a */ unsigned char Wow64List; /* +0x000b */ }; struct _ICONINFOEXW { unsigned long cbSize; /* +0x0000 */ unsigned char fIcon[4]; /* +0x0004 74 00 00 00 */ unsigned long xHotspot; /* +0x0008 */ unsigned long yHotspot; /* +0x000c */ unsigned char hbmMask[4]; /* +0x0010 06 18 00 00 */ unsigned char hbmColor[4]; /* +0x0014 06 18 00 00 */ unsigned short wResID; /* +0x0018 */ unsigned char szModName[520]; /* +0x001a e4 15 00 00 */ unsigned char szResName[522]; /* +0x0222 e4 15 00 00 */ }; struct _PO_WAKE_SOURCE_TIMER { unsigned char Header[8]; /* +0x0000 0b 18 00 00 */ unsigned char Reason[24]; /* +0x0008 0c 18 00 00 */ }; struct _CM_PNP_BIOS_INSTALLATION_CHECK { unsigned char Signature[4]; /* +0x0000 b7 17 00 00 */ unsigned char Revision; /* +0x0004 */ unsigned char Length; /* +0x0005 */ unsigned short ControlField; /* +0x0006 */ unsigned char Checksum; /* +0x0008 */ unsigned long EventFlagAddress; /* +0x0009 */ unsigned short RealModeEntryOffset; /* +0x000d */ unsigned short RealModeEntrySegment; /* +0x000f */ unsigned short ProtectedModeEntryOffset; /* +0x0011 */ unsigned long ProtectedModeCodeBaseAddress; /* +0x0013 */ unsigned long OemDeviceId; /* +0x0017 */ unsigned short RealModeDataBaseAddress; /* +0x001b */ unsigned long ProtectedModeDataBaseAddress; /* +0x001d */ }; struct _CERT_ALT_NAME_INFO { unsigned long cAltEntry; /* +0x0000 */ unsigned char rgAltEntry[4]; /* +0x0004 11 18 00 00 */ }; struct _XSAVE_AREA_HEADER { unsigned long long Mask; /* +0x0000 */ unsigned char Reserved[56]; /* +0x0008 14 18 00 00 */ }; struct _PROCESS_TLS_INFORMATION { unsigned long Flags; /* +0x0000 */ unsigned long OperationType; /* +0x0004 */ unsigned long ThreadDataCount; /* +0x0008 */ unsigned long TlsIndex; /* +0x000c */ unsigned long PreviousCount; /* +0x000c */ unsigned char ThreadData[12]; /* +0x0010 18 18 00 00 */ }; struct tagEMRCREATECOLORSPACEW { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned long ihCS; /* +0x0008 */ unsigned char lcs[588]; /* +0x000c 1b 18 00 00 */ unsigned long dwFlags; /* +0x0258 */ unsigned long cbData; /* +0x025c */ unsigned char Data[4]; /* +0x0260 f9 12 00 00 */ }; struct _SERVICE_REQUIRED_PRIVILEGES_INFOW { unsigned char pmszRequiredPrivileges[4]; /* +0x0000 71 04 00 00 */ }; struct _CERT_BASIC_CONSTRAINTS2_INFO { unsigned char fCA[4]; /* +0x0000 74 00 00 00 */ unsigned char fPathLenConstraint[4]; /* +0x0004 74 00 00 00 */ unsigned long dwPathLenConstraint; /* +0x0008 */ }; struct _SYSTEM_ACPI_AUDIT_INFORMATION { unsigned long RsdpCount; /* +0x0000 */ /* unsigned char SameRsdt[0]; +0x0004 17 13 00 00 */ /* unsigned char SlicPresent[0]; +0x0004 7e 18 00 00 */ unsigned char SlicDifferent[4]; /* +0x0004 7f 18 00 00 */ }; struct _TRANSACTION_SUPERIOR_ENLISTMENT_INFORMATION { unsigned char SuperiorEnlistmentPair[32]; /* +0x0000 bf 15 00 00 */ }; struct tagEMRLINETO { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned char ptl[8]; /* +0x0008 9f 13 00 00 */ }; struct _SERVICE_TRIGGER_SPECIFIC_DATA_ITEM { unsigned long dwDataType; /* +0x0000 */ unsigned long cbData; /* +0x0004 */ unsigned char *pData; /* +0x0008 */ }; struct _CERT_LOGOTYPE_EXT_INFO { unsigned long cCommunityLogo; /* +0x0000 */ unsigned char rgCommunityLogo[4]; /* +0x0004 8b 18 00 00 */ unsigned char pIssuerLogo[4]; /* +0x0008 8b 18 00 00 */ unsigned char pSubjectLogo[4]; /* +0x000c 8b 18 00 00 */ unsigned long cOtherLogo; /* +0x0010 */ unsigned char rgOtherLogo[4]; /* +0x0014 8d 18 00 00 */ }; struct _INSTALLDATA { unsigned char Type[4]; /* +0x0000 90 18 00 00 */ unsigned char Spec[20]; /* +0x0004 91 18 00 00 */ }; struct _IMAGE_RESOURCE_DIRECTORY_ENTRY { /* unsigned char NameOffset[0]; +0x0000 94 18 00 00 */ /* unsigned char NameIsString[0]; +0x0000 95 18 00 00 */ unsigned long Name; /* +0x0000 */ unsigned short Id; /* +0x0000 */ unsigned long OffsetToData; /* +0x0004 */ /* unsigned char OffsetToDirectory[0]; +0x0004 94 18 00 00 */ unsigned char DataIsDirectory[4]; /* +0x0004 95 18 00 00 */ }; struct tagEMRROUNDRECT { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned char rclBox[16]; /* +0x0008 d5 12 00 00 */ unsigned char szlCorner[8]; /* +0x0018 aa 15 00 00 */ }; struct tagRPC_CALL_ATTRIBUTES_V2_W { unsigned char Version[4]; /* +0x0000 75 00 00 00 */ unsigned long Flags; /* +0x0004 */ unsigned long ServerPrincipalNameBufferLength; /* +0x0008 */ unsigned short *ServerPrincipalName; /* +0x000c */ unsigned long ClientPrincipalNameBufferLength; /* +0x0010 */ unsigned short *ClientPrincipalName; /* +0x0014 */ unsigned long AuthenticationLevel; /* +0x0018 */ unsigned long AuthenticationService; /* +0x001c */ unsigned char NullSession[4]; /* +0x0020 74 00 00 00 */ unsigned char KernelModeCaller[4]; /* +0x0024 74 00 00 00 */ unsigned long ProtocolSequence; /* +0x0028 */ unsigned char IsClientLocal[4]; /* +0x002c 9f 18 00 00 */ void *ClientPID; /* +0x0030 */ unsigned long CallStatus; /* +0x0034 */ unsigned char CallType[4]; /* +0x0038 a0 18 00 00 */ unsigned char CallLocalAddress[4]; /* +0x003c a2 18 00 00 */ unsigned short OpNum; /* +0x0040 */ unsigned char InterfaceUuid[16]; /* +0x0044 dc 14 00 00 */ }; struct _CERT_LOGOTYPE_AUDIO { unsigned char LogotypeDetails[12]; /* +0x0000 a5 18 00 00 */ unsigned char pLogotypeAudioInfo[4]; /* +0x000c a7 18 00 00 */ }; struct _IMAGE_NT_HEADERS { unsigned long Signature; /* +0x0000 */ unsigned char FileHeader[20]; /* +0x0004 aa 18 00 00 */ unsigned char OptionalHeader[224]; /* +0x0018 ab 18 00 00 */ }; struct _POWER_SESSION_WINLOGON { unsigned long SessionId; /* +0x0000 */ unsigned char Console; /* +0x0004 */ unsigned char Locked; /* +0x0005 */ }; struct _UNLOAD_DLL_DEBUG_INFO { void *lpBaseOfDll; /* +0x0000 */ }; struct tagEMRPOLYLINE { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned char rclBounds[16]; /* +0x0008 d5 12 00 00 */ unsigned long cptl; /* +0x0018 */ unsigned char aptl[8]; /* +0x001c e9 15 00 00 */ }; struct _IO_SESSION_CONNECT_INFO { unsigned long SessionId; /* +0x0000 */ unsigned char LocalSession; /* +0x0004 */ }; struct _CONSOLE_READCONSOLE_CONTROL { unsigned long nLength; /* +0x0000 */ unsigned long nInitialChars; /* +0x0004 */ unsigned long dwCtrlWakeupMask; /* +0x0008 */ unsigned long dwControlKeyState; /* +0x000c */ }; struct _RPC_HTTP_TRANSPORT_CREDENTIALS_A { unsigned char TransportCredentials[4]; /* +0x0000 cc 18 00 00 */ unsigned long Flags; /* +0x0004 */ unsigned long AuthenticationTarget; /* +0x0008 */ unsigned long NumberOfAuthnSchemes; /* +0x000c */ unsigned long *AuthnSchemes; /* +0x0010 */ unsigned char *ServerCertificateSubject; /* +0x0014 */ }; struct _CMSG_SIGNER_INFO { unsigned long dwVersion; /* +0x0000 */ unsigned char Issuer[8]; /* +0x0004 02 13 00 00 */ unsigned char SerialNumber[8]; /* +0x000c 02 13 00 00 */ unsigned char HashAlgorithm[12]; /* +0x0014 55 14 00 00 */ unsigned char HashEncryptionAlgorithm[12]; /* +0x0020 55 14 00 00 */ unsigned char EncryptedHash[8]; /* +0x002c 02 13 00 00 */ unsigned char AuthAttrs[8]; /* +0x0034 ea 18 00 00 */ unsigned char UnauthAttrs[8]; /* +0x003c ea 18 00 00 */ }; struct _RIP_INFO { unsigned long dwError; /* +0x0000 */ unsigned long dwType; /* +0x0004 */ }; struct tagCWPRETSTRUCT { long lResult; /* +0x0000 */ long lParam; /* +0x0004 */ unsigned char wParam[4]; /* +0x0008 75 00 00 00 */ unsigned char message[4]; /* +0x000c 75 00 00 00 */ unsigned char hwnd[4]; /* +0x0010 f1 12 00 00 */ }; struct tagKBDLLHOOKSTRUCT { unsigned long vkCode; /* +0x0000 */ unsigned long scanCode; /* +0x0004 */ unsigned long flags; /* +0x0008 */ unsigned long time; /* +0x000c */ unsigned long dwExtraInfo; /* +0x0010 */ }; struct _FILE_LEVEL_TRIM_RANGE { unsigned long long Offset; /* +0x0000 */ unsigned long long Length; /* +0x0008 */ }; struct _REQUEST_OPLOCK_INPUT_BUFFER { unsigned short StructureVersion; /* +0x0000 */ unsigned short StructureLength; /* +0x0002 */ unsigned long RequestedOplockLevel; /* +0x0004 */ unsigned long Flags; /* +0x0008 */ }; struct _AVRF_CLIENT_ID_WOW64 { unsigned long long UniqueProcess; /* +0x0000 */ unsigned long long UniqueThread; /* +0x0008 */ }; struct _CRYPT_PROVIDER_REF { unsigned long dwInterface; /* +0x0000 */ unsigned char pszFunction[4]; /* +0x0004 71 04 00 00 */ unsigned char pszProvider[4]; /* +0x0008 71 04 00 00 */ unsigned long cProperties; /* +0x000c */ unsigned char rgpProperties[4]; /* +0x0010 28 19 00 00 */ unsigned char pUM[4]; /* +0x0014 2a 19 00 00 */ unsigned char pKM[4]; /* +0x0018 2a 19 00 00 */ }; struct _PHYSICAL_CHANNEL_RUN { unsigned long NodeNumber; /* +0x0000 */ unsigned long ChannelNumber; /* +0x0004 */ unsigned long long BasePage; /* +0x0008 */ unsigned long long PageCount; /* +0x0010 */ unsigned long Flags; /* +0x0018 */ }; struct _PLUGPLAY_CONTROL_USER_RESPONSE_DATA { unsigned long Response; /* +0x0000 */ unsigned char VetoType[4]; /* +0x0004 31 19 00 00 */ unsigned char VetoName[4]; /* +0x0008 71 04 00 00 */ unsigned long VetoNameLength; /* +0x000c */ }; struct _NETINFOSTRUCT { unsigned long cbStructure; /* +0x0000 */ unsigned long dwProviderVersion; /* +0x0004 */ unsigned long dwStatus; /* +0x0008 */ unsigned long dwCharacteristics; /* +0x000c */ unsigned long dwHandle; /* +0x0010 */ unsigned short wNetType; /* +0x0014 */ unsigned long dwPrinters; /* +0x0018 */ unsigned long dwDrives; /* +0x001c */ }; struct _MIDL_SYNTAX_INFO { unsigned char TransferSyntax[20]; /* +0x0000 eb 16 00 00 */ unsigned char DispatchTable[4]; /* +0x0014 37 19 00 00 */ unsigned char ProcString[4]; /* +0x0018 39 19 00 00 */ unsigned char FmtStringOffset[4]; /* +0x001c 3b 19 00 00 */ unsigned char TypeString[4]; /* +0x0020 39 19 00 00 */ unsigned char aUserMarshalQuadruple[4]; /* +0x0024 3d 19 00 00 */ unsigned long pReserved1; /* +0x0028 */ unsigned long pReserved2; /* +0x002c */ }; struct _SAFER_URLZONE_IDENTIFICATION { unsigned char header[32]; /* +0x0000 44 19 00 00 */ unsigned long UrlZoneId; /* +0x0020 */ unsigned long dwSaferFlags; /* +0x0024 */ }; struct _ACCESS_ALLOWED_CALLBACK_OBJECT_ACE { unsigned char Header[4]; /* +0x0000 47 19 00 00 */ unsigned long Mask; /* +0x0004 */ unsigned long Flags; /* +0x0008 */ unsigned char ObjectType[16]; /* +0x000c dc 14 00 00 */ unsigned char InheritedObjectType[16]; /* +0x001c dc 14 00 00 */ unsigned long SidStart; /* +0x002c */ }; struct _SAFER_HASH_IDENTIFICATION2 { unsigned char hashIdentification[1144]; /* +0x0000 50 19 00 00 */ unsigned long HashSize; /* +0x0478 */ unsigned char ImageHash[64]; /* +0x047c 13 13 00 00 */ unsigned char HashAlgorithm[4]; /* +0x04bc 75 00 00 00 */ }; struct _FILE_ZERO_DATA_INFORMATION { unsigned char FileOffset[8]; /* +0x0000 3d 13 00 00 */ unsigned char BeyondFinalZero[8]; /* +0x0008 3d 13 00 00 */ }; struct _OVERLAPPED_ENTRY { unsigned long lpCompletionKey; /* +0x0000 */ unsigned char lpOverlapped[4]; /* +0x0004 5a 19 00 00 */ unsigned long Internal; /* +0x0008 */ unsigned long dwNumberOfBytesTransferred; /* +0x000c */ }; struct tagEMRSELECTPALETTE { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned long ihPal; /* +0x0008 */ }; struct _NDR_USER_MARSHAL_INFO_LEVEL1 { void *Buffer; /* +0x0000 */ unsigned long BufferSize; /* +0x0004 */ unsigned char pfnAllocate[4]; /* +0x0008 66 19 00 00 */ unsigned char pfnFree[4]; /* +0x000c c7 13 00 00 */ unsigned char pRpcChannelBuffer[4]; /* +0x0010 68 19 00 00 */ unsigned char Reserved[20]; /* +0x0014 3b 17 00 00 */ }; struct _GDI_OBJECT { unsigned long ObjectType; /* +0x0000 */ }; struct _PUBKEYVER3 { unsigned long magic; /* +0x0000 */ unsigned long bitlenP; /* +0x0004 */ unsigned long bitlenQ; /* +0x0008 */ unsigned long bitlenJ; /* +0x000c */ unsigned char DSSSeed[24]; /* +0x0010 6e 19 00 00 */ }; struct _CERT_REGISTRY_STORE_ROAMING_PARA { unsigned char hKey[4]; /* +0x0000 72 19 00 00 */ unsigned char pwszStoreDirectory[4]; /* +0x0004 71 04 00 00 */ }; struct _CONTEXT { unsigned long ContextFlags; /* +0x0000 */ unsigned long Dr0; /* +0x0004 */ unsigned long Dr1; /* +0x0008 */ unsigned long Dr2; /* +0x000c */ unsigned long Dr3; /* +0x0010 */ unsigned long Dr6; /* +0x0014 */ unsigned long Dr7; /* +0x0018 */ unsigned char FloatSave[112]; /* +0x001c 75 19 00 00 */ unsigned long SegGs; /* +0x008c */ unsigned long SegFs; /* +0x0090 */ unsigned long SegEs; /* +0x0094 */ unsigned long SegDs; /* +0x0098 */ unsigned long Edi; /* +0x009c */ unsigned long Esi; /* +0x00a0 */ unsigned long Ebx; /* +0x00a4 */ unsigned long Edx; /* +0x00a8 */ unsigned long Ecx; /* +0x00ac */ unsigned long Eax; /* +0x00b0 */ unsigned long Ebp; /* +0x00b4 */ unsigned long Eip; /* +0x00b8 */ unsigned long SegCs; /* +0x00bc */ unsigned long EFlags; /* +0x00c0 */ unsigned long Esp; /* +0x00c4 */ unsigned long SegSs; /* +0x00c8 */ unsigned char ExtendedRegisters[512]; /* +0x00cc 76 19 00 00 */ }; struct _JOBOBJECT_LIMIT_VIOLATION_INFORMATION { unsigned long LimitFlags; /* +0x0000 */ unsigned long ViolationLimitFlags; /* +0x0004 */ unsigned long long IoReadBytes; /* +0x0008 */ unsigned long long IoReadBytesLimit; /* +0x0010 */ unsigned long long IoWriteBytes; /* +0x0018 */ unsigned long long IoWriteBytesLimit; /* +0x0020 */ unsigned char PerJobUserTime[8]; /* +0x0028 3d 13 00 00 */ unsigned char PerJobUserTimeLimit[8]; /* +0x0030 3d 13 00 00 */ unsigned long long JobMemory; /* +0x0038 */ unsigned long long JobMemoryLimit; /* +0x0040 */ unsigned char RateControlTolerance[4]; /* +0x0048 79 19 00 00 */ unsigned char RateControlToleranceLimit[4]; /* +0x004c 7a 19 00 00 */ }; struct _ENCRYPTION_BUFFER { unsigned long EncryptionOperation; /* +0x0000 */ unsigned char Private[4]; /* +0x0004 f9 12 00 00 */ }; struct _SYSTEM_POWER_STATE_DISABLE_REASON { unsigned char AffectedState[8]; /* +0x0000 7f 19 00 00 */ unsigned long PowerReasonCode; /* +0x0008 */ unsigned long PowerReasonLength; /* +0x000c */ }; struct _PLUGPLAY_CONTROL_DEPTH_DATA { unsigned char DeviceInstance[8]; /* +0x0000 dd 12 00 00 */ unsigned long DeviceDepth; /* +0x0008 */ }; struct _RPC_SECURITY_QOS_V3_A { unsigned long Version; /* +0x0000 */ unsigned long Capabilities; /* +0x0004 */ unsigned long IdentityTracking; /* +0x0008 */ unsigned long ImpersonationType; /* +0x000c */ unsigned long AdditionalSecurityInfoType; /* +0x0010 */ }; struct _RPC_BINDING_HANDLE_OPTIONS_V1 { unsigned long Version; /* +0x0000 */ unsigned long Flags; /* +0x0004 */ unsigned long ComTimeout; /* +0x0008 */ unsigned long CallTimeout; /* +0x000c */ }; struct _OLESTREAMVTBL { unsigned char Get[4]; /* +0x0000 ad 19 00 00 */ unsigned char Put[4]; /* +0x0004 b0 19 00 00 */ }; struct _PROCESSOR_POWER_POLICY_INFO { unsigned long TimeCheck; /* +0x0000 */ unsigned long DemoteLimit; /* +0x0004 */ unsigned long PromoteLimit; /* +0x0008 */ unsigned char DemotePercent; /* +0x000c */ unsigned char PromotePercent; /* +0x000d */ unsigned char Spare[2]; /* +0x000e a7 17 00 00 */ /* unsigned char AllowDemotion[0]; +0x0010 17 13 00 00 */ /* unsigned char AllowPromotion[0]; +0x0010 7e 18 00 00 */ unsigned char Reserved[4]; /* +0x0010 b3 19 00 00 */ }; struct _WOW64_CONTEXT { unsigned long ContextFlags; /* +0x0000 */ unsigned long Dr0; /* +0x0004 */ unsigned long Dr1; /* +0x0008 */ unsigned long Dr2; /* +0x000c */ unsigned long Dr3; /* +0x0010 */ unsigned long Dr6; /* +0x0014 */ unsigned long Dr7; /* +0x0018 */ unsigned char FloatSave[112]; /* +0x001c b6 19 00 00 */ unsigned long SegGs; /* +0x008c */ unsigned long SegFs; /* +0x0090 */ unsigned long SegEs; /* +0x0094 */ unsigned long SegDs; /* +0x0098 */ unsigned long Edi; /* +0x009c */ unsigned long Esi; /* +0x00a0 */ unsigned long Ebx; /* +0x00a4 */ unsigned long Edx; /* +0x00a8 */ unsigned long Ecx; /* +0x00ac */ unsigned long Eax; /* +0x00b0 */ unsigned long Ebp; /* +0x00b4 */ unsigned long Eip; /* +0x00b8 */ unsigned long SegCs; /* +0x00bc */ unsigned long EFlags; /* +0x00c0 */ unsigned long Esp; /* +0x00c4 */ unsigned long SegSs; /* +0x00c8 */ unsigned char ExtendedRegisters[512]; /* +0x00cc 76 19 00 00 */ }; struct tagDRAWTEXTPARAMS { unsigned char cbSize[4]; /* +0x0000 75 00 00 00 */ unsigned char iTabLength[4]; /* +0x0004 74 00 00 00 */ unsigned char iLeftMargin[4]; /* +0x0008 74 00 00 00 */ unsigned char iRightMargin[4]; /* +0x000c 74 00 00 00 */ unsigned char uiLengthDrawn[4]; /* +0x0010 75 00 00 00 */ }; struct _TOKEN_SECURITY_ATTRIBUTE_RELATIVE_V1 { unsigned long Name; /* +0x0000 */ unsigned short ValueType; /* +0x0004 */ unsigned short Reserved; /* +0x0006 */ unsigned long Flags; /* +0x0008 */ unsigned long ValueCount; /* +0x000c */ }; struct _XSAVE_POLICY { unsigned long Version; /* +0x0000 */ unsigned long Size; /* +0x0004 */ unsigned long Flags; /* +0x0008 */ unsigned long MaxSaveAreaLength; /* +0x000c */ unsigned long long FeatureBitmask; /* +0x0010 */ unsigned long NumberOfFeatures; /* +0x0018 */ unsigned char Features[16]; /* +0x0020 c6 19 00 00 */ }; struct _HARDWARE_COUNTER_DATA { unsigned char Type[4]; /* +0x0000 d0 19 00 00 */ unsigned long Reserved; /* +0x0004 */ unsigned long long Value; /* +0x0008 */ }; struct _RTL_VERIFIER_HELPER_TABLE { unsigned long Length; /* +0x0000 */ unsigned char VerifierEngGetStackTraceAddress[4]; /* +0x0004 d5 19 00 00 */ unsigned char VerifierEngNtdllHeapFreeCallback[4]; /* +0x0008 d8 19 00 00 */ unsigned char VerifierEngLogStackTrace[4]; /* +0x000c e4 16 00 00 */ unsigned char UnicodeImageName[4]; /* +0x0010 da 19 00 00 */ unsigned char VerifierEngCommitDebugInfo[4]; /* +0x0014 df 19 00 00 */ unsigned char VerifierEngSetProcessDebugInformation[4]; /* +0x0018 e2 19 00 00 */ unsigned char VerifierEngQueryImageFileExecutionOptionsEx[4]; /* +0x001c e5 19 00 00 */ unsigned long *AddressDphGlobalFlags; /* +0x0020 */ unsigned char VerifierTable[4]; /* +0x0024 fc 17 00 00 */ unsigned char VerifierDescriptor[4]; /* +0x0028 e7 19 00 00 */ void *OptionsKey; /* +0x002c */ unsigned char VerifierEngGetStackTraceAddressEx[4]; /* +0x0030 ea 19 00 00 */ unsigned char VerifierEngReleaseStackTrace[4]; /* +0x0034 c7 13 00 00 */ unsigned char VerifierEngStdInitializeStackTrace[4]; /* +0x0038 fa 17 00 00 */ unsigned char VerifierEngStdDeleteStackTrace[4]; /* +0x003c ed 19 00 00 */ unsigned char VerifierEngStdLogStackTrace[4]; /* +0x0040 f2 19 00 00 */ unsigned char VerifierEngStdReleaseStackTrace[4]; /* +0x0044 f5 19 00 00 */ }; struct _SECURITY_ATTRIBUTES { unsigned long nLength; /* +0x0000 */ void *lpSecurityDescriptor; /* +0x0004 */ unsigned char bInheritHandle[4]; /* +0x0008 74 00 00 00 */ }; struct _MIDL_STUB_DESC { void *RpcInterfaceInformation; /* +0x0000 */ unsigned char pfnAllocate[4]; /* +0x0004 66 19 00 00 */ unsigned char pfnFree[72]; /* +0x0008 c7 13 00 00 */ }; struct _FILE_FS_PERSISTENT_VOLUME_INFORMATION { unsigned long VolumeFlags; /* +0x0000 */ unsigned long FlagMask; /* +0x0004 */ unsigned long Version; /* +0x0008 */ unsigned long Reserved; /* +0x000c */ }; struct _PROCESSOR_RELATIONSHIP { unsigned char Flags; /* +0x0000 */ unsigned char Reserved[21]; /* +0x0001 24 1a 00 00 */ unsigned short GroupCount; /* +0x0016 */ unsigned char GroupMask[12]; /* +0x0018 26 1a 00 00 */ }; struct _SYSTEM_BASIC_INFORMATION64 { unsigned long Reserved; /* +0x0000 */ unsigned long TimerResolution; /* +0x0004 */ unsigned long PageSize; /* +0x0008 */ unsigned long NumberOfPhysicalPages; /* +0x000c */ unsigned long LowestPhysicalPageNumber; /* +0x0010 */ unsigned long HighestPhysicalPageNumber; /* +0x0014 */ unsigned long AllocationGranularity; /* +0x0018 */ unsigned long long MinimumUserModeAddress; /* +0x0020 */ unsigned long long MaximumUserModeAddress; /* +0x0028 */ unsigned long long ActiveProcessorsAffinityMask; /* +0x0030 */ char NumberOfProcessors; /* +0x0038 */ }; struct _SYSTEM_SPCALL2_INFORMATION { void *InputData; /* +0x0000 */ void *OutputData; /* +0x0004 */ unsigned long InputDataSize; /* +0x0008 */ unsigned long OutputDataSize; /* +0x000c */ long Status; /* +0x0010 */ }; struct _GLYPHMETRICSFLOAT { unsigned char gmfBlackBoxX[4]; /* +0x0000 40 00 00 00 */ unsigned char gmfBlackBoxY[4]; /* +0x0004 40 00 00 00 */ unsigned char gmfptGlyphOrigin[8]; /* +0x0008 2f 1a 00 00 */ unsigned char gmfCellIncX[4]; /* +0x0010 40 00 00 00 */ unsigned char gmfCellIncY[4]; /* +0x0014 40 00 00 00 */ }; struct _CERT_CONTEXT { unsigned long dwCertEncodingType; /* +0x0000 */ unsigned char *pbCertEncoded; /* +0x0004 */ unsigned long cbCertEncoded; /* +0x0008 */ unsigned char pCertInfo[4]; /* +0x000c 39 1a 00 00 */ void *hCertStore; /* +0x0010 */ }; struct _CERT_LDAP_STORE_OPENED_PARA { void *pvLdapSessionHandle; /* +0x0000 */ unsigned char pwszLdapUrl[4]; /* +0x0004 c0 13 00 00 */ }; struct _SYSTEM_ALARM_CALLBACK_ACE { unsigned char Header[4]; /* +0x0000 47 19 00 00 */ unsigned long Mask; /* +0x0004 */ unsigned long SidStart; /* +0x0008 */ }; struct _TOKEN_DEFAULT_DACL { unsigned char DefaultDacl[4]; /* +0x0000 43 1a 00 00 */ }; struct _FILE_FS_CONTROL_INFORMATION { unsigned char FreeSpaceStartFiltering[8]; /* +0x0000 3d 13 00 00 */ unsigned char FreeSpaceThreshold[8]; /* +0x0008 3d 13 00 00 */ unsigned char FreeSpaceStopFiltering[8]; /* +0x0010 3d 13 00 00 */ unsigned char DefaultQuotaThreshold[8]; /* +0x0018 3d 13 00 00 */ unsigned char DefaultQuotaLimit[8]; /* +0x0020 3d 13 00 00 */ unsigned long FileSystemControlFlags; /* +0x0028 */ }; struct tagFONTSIGNATURE { unsigned char fsUsb[16]; /* +0x0000 4f 1a 00 00 */ unsigned char fsCsb[8]; /* +0x0010 69 15 00 00 */ }; struct _RTL_UMS_COMPLETION_LIST { unsigned char ThreadListHead[4]; /* +0x0000 5a 1a 00 00 */ void *CompletionEvent; /* +0x0004 */ unsigned long CompletionFlags; /* +0x0008 */ unsigned char InternalListHead[4]; /* +0x000c ba 17 00 00 */ }; struct tagACTCTXA { unsigned long cbSize; /* +0x0000 */ unsigned long dwFlags; /* +0x0004 */ unsigned char lpSource[4]; /* +0x0008 62 14 00 00 */ unsigned short wProcessorArchitecture; /* +0x000c */ unsigned short wLangId; /* +0x000e */ unsigned char lpAssemblyDirectory[4]; /* +0x0010 62 14 00 00 */ unsigned char lpResourceName[4]; /* +0x0014 62 14 00 00 */ unsigned char lpApplicationName[4]; /* +0x0018 62 14 00 00 */ unsigned char hModule[4]; /* +0x001c ba 14 00 00 */ }; struct _RTL_PERTHREAD_CURDIR { unsigned char CurrentDirectories[4]; /* +0x0000 02 17 00 00 */ unsigned char ImageName[4]; /* +0x0004 a2 17 00 00 */ void *Environment; /* +0x0008 */ }; struct tagOBJECTDESCRIPTOR { unsigned long cbSize; /* +0x0000 */ unsigned char clsid[16]; /* +0x0004 dc 14 00 00 */ unsigned long dwDrawAspect; /* +0x0014 */ unsigned char sizel[8]; /* +0x0018 aa 15 00 00 */ unsigned char pointl[8]; /* +0x0020 9f 13 00 00 */ unsigned long dwStatus; /* +0x0028 */ unsigned long dwFullUserTypeName; /* +0x002c */ unsigned long dwSrcOfCopy; /* +0x0030 */ }; struct _SERVICE_DELAYED_AUTO_START_INFO { unsigned char fDelayedAutostart[4]; /* +0x0000 74 00 00 00 */ }; struct _SYSTEM_SYSTEM_PARTITION_INFORMATION { unsigned char SystemPartition[8]; /* +0x0000 dd 12 00 00 */ }; struct _SYSTEM_INFO { unsigned long dwOemId; /* +0x0000 */ unsigned short wProcessorArchitecture; /* +0x0000 */ unsigned short wReserved; /* +0x0002 */ unsigned long dwPageSize; /* +0x0004 */ void *lpMinimumApplicationAddress; /* +0x0008 */ void *lpMaximumApplicationAddress; /* +0x000c */ unsigned long dwActiveProcessorMask; /* +0x0010 */ unsigned long dwNumberOfProcessors; /* +0x0014 */ unsigned long dwProcessorType; /* +0x0018 */ unsigned long dwAllocationGranularity; /* +0x001c */ unsigned short wProcessorLevel; /* +0x0020 */ unsigned short wProcessorRevision; /* +0x0022 */ }; struct _EV_EXTRA_CERT_CHAIN_POLICY_STATUS { unsigned long cbSize; /* +0x0000 */ unsigned long dwQualifiers; /* +0x0004 */ unsigned long dwIssuanceUsageIndex; /* +0x0008 */ }; struct _IO_COMPLETION_BASIC_INFORMATION { long Depth; /* +0x0000 */ }; struct _RTL_USER_PROCESS_INFORMATION { unsigned long Length; /* +0x0000 */ void *Process; /* +0x0004 */ void *Thread; /* +0x0008 */ unsigned char ClientId[8]; /* +0x000c 3e 13 00 00 */ unsigned char ImageInformation[48]; /* +0x0014 7f 1a 00 00 */ }; struct NCryptProviderName { unsigned char pszName[4]; /* +0x0000 71 04 00 00 */ unsigned char pszComment[4]; /* +0x0004 71 04 00 00 */ }; struct _SYSTEM_WATCHDOG_TIMER_INFORMATION { unsigned char WdInfoClass[4]; /* +0x0000 8a 1a 00 00 */ unsigned long DataValue; /* +0x0004 */ }; struct _SYSTEM_BOOT_ENVIRONMENT_INFORMATION { unsigned char BootIdentifier[16]; /* +0x0000 dc 14 00 00 */ unsigned char FirmwareType[8]; /* +0x0010 8d 1a 00 00 */ unsigned long long BootFlags; /* +0x0018 */ }; struct val_context { unsigned char valuelen[4]; /* +0x0000 74 00 00 00 */ void *value_context; /* +0x0004 */ void *val_buff_ptr; /* +0x0008 */ }; struct _CLIENT_CALL_RETURN { void *Pointer; /* +0x0000 */ long Simple; /* +0x0000 */ }; struct _PLUGPLAY_NOTIFY_HDR { unsigned short Version; /* +0x0000 */ unsigned short Size; /* +0x0002 */ unsigned char Event[16]; /* +0x0004 dc 14 00 00 */ }; struct _CERT_STORE_PROV_INFO { unsigned long cbSize; /* +0x0000 */ unsigned long cStoreProvFunc; /* +0x0004 */ unsigned char rgpvStoreProvFunc[4]; /* +0x0008 4f 13 00 00 */ void *hStoreProv; /* +0x000c */ unsigned long dwStoreProvFlags; /* +0x0010 */ void *hStoreProvFuncAddr2; /* +0x0014 */ }; struct _SHRINK_VOLUME_INFORMATION { unsigned char ShrinkRequestType[8]; /* +0x0000 aa 1a 00 00 */ unsigned long long Flags; /* +0x0008 */ long long NewNumberOfSectors; /* +0x0010 */ }; struct _SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX { unsigned char Relationship[4]; /* +0x0000 af 1a 00 00 */ unsigned long Size; /* +0x0004 */ /* unsigned char Processor[0]; +0x0008 b0 1a 00 00 */ /* unsigned char NumaNode[0]; +0x0008 b1 1a 00 00 */ /* unsigned char Cache[0]; +0x0008 b2 1a 00 00 */ unsigned char Group[68]; /* +0x0008 b3 1a 00 00 */ }; struct _IMAGE_FUNCTION_ENTRY64 { unsigned long long StartingAddress; /* +0x0000 */ unsigned long long EndingAddress; /* +0x0008 */ unsigned long long EndOfPrologue; /* +0x0010 */ unsigned long long UnwindInfoAddress; /* +0x0010 */ }; struct _EXIT_THREAD_DEBUG_INFO { unsigned long dwExitCode; /* +0x0000 */ }; struct _GENERIC_BINDING_ROUTINE_PAIR { unsigned char pfnBind[4]; /* +0x0000 07 15 00 00 */ unsigned char pfnUnbind[4]; /* +0x0004 d5 1a 00 00 */ }; struct _ENUM_SERVICE_STATUS_PROCESSA { char *lpServiceName; /* +0x0000 */ char *lpDisplayName; /* +0x0004 */ unsigned char ServiceStatusProcess[36]; /* +0x0008 c6 16 00 00 */ }; struct _COMPOUND_ACCESS_ALLOWED_ACE { unsigned char Header[4]; /* +0x0000 47 19 00 00 */ unsigned long Mask; /* +0x0004 */ unsigned short CompoundAceType; /* +0x0008 */ unsigned short Reserved; /* +0x000a */ unsigned long SidStart; /* +0x000c */ }; struct _LDR_SERVICE_TAG_RECORD { unsigned char Next[4]; /* +0x0000 df 1a 00 00 */ unsigned long ServiceTag; /* +0x0004 */ }; struct _PROCESS_HEAP_INFORMATION { unsigned long ReserveSize; /* +0x0000 */ unsigned long CommitSize; /* +0x0004 */ unsigned long NumberOfHeaps; /* +0x0008 */ unsigned long FirstHeapInformationOffset; /* +0x000c */ }; struct _SERVICE_CUSTOM_SYSTEM_STATE_CHANGE_DATA_ITEM::<unnamed-type-u> { unsigned char CustomStateId[8]; /* +0x0000 fa 1a 00 00 */ }; struct _SERVICE_CUSTOM_SYSTEM_STATE_CHANGE_DATA_ITEM::<unnamed-type-u>::<unnamed-type-s> { unsigned long DataOffset; /* +0x0000 */ unsigned char Data[4]; /* +0x0004 f9 12 00 00 */ }; struct _SERVICE_STATUS_PROCESS { unsigned long dwServiceType; /* +0x0000 */ unsigned long dwCurrentState; /* +0x0004 */ unsigned long dwControlsAccepted; /* +0x0008 */ unsigned long dwWin32ExitCode; /* +0x000c */ unsigned long dwServiceSpecificExitCode; /* +0x0010 */ unsigned long dwCheckPoint; /* +0x0014 */ unsigned long dwWaitHint; /* +0x0018 */ unsigned long dwProcessId; /* +0x001c */ unsigned long dwServiceFlags; /* +0x0020 */ }; struct _SAFER_HASH_IDENTIFICATION { unsigned char header[32]; /* +0x0000 44 19 00 00 */ unsigned char Description[512]; /* +0x0020 3c 17 00 00 */ unsigned char FriendlyName[512]; /* +0x0220 3c 17 00 00 */ unsigned long HashSize; /* +0x0420 */ unsigned char ImageHash[64]; /* +0x0424 13 13 00 00 */ unsigned char HashAlgorithm[4]; /* +0x0464 75 00 00 00 */ unsigned char ImageSize[8]; /* +0x0468 3d 13 00 00 */ unsigned long dwSaferFlags; /* +0x0470 */ }; struct _SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION { unsigned long long CycleTime; /* +0x0000 */ }; struct _SERVICE_USERMODEREBOOT_INFO { unsigned long dwFlags; /* +0x0000 */ unsigned long eLowestRunLevel; /* +0x0004 */ unsigned long eHighestRunLevel; /* +0x0008 */ }; struct _QUOTA_LIMITS { unsigned long PagedPoolLimit; /* +0x0000 */ unsigned long NonPagedPoolLimit; /* +0x0004 */ unsigned long MinimumWorkingSetSize; /* +0x0008 */ unsigned long MaximumWorkingSetSize; /* +0x000c */ unsigned long PagefileLimit; /* +0x0010 */ unsigned char TimeLimit[8]; /* +0x0018 3d 13 00 00 */ }; struct _PORT_VIEW { unsigned long Length; /* +0x0000 */ void *SectionHandle; /* +0x0004 */ unsigned long SectionOffset; /* +0x0008 */ unsigned long ViewSize; /* +0x000c */ void *ViewBase; /* +0x0010 */ void *ViewRemoteBase; /* +0x0014 */ }; struct _RTL_VERIFIER_ALL_INFORMATION { unsigned long Size; /* +0x0000 */ unsigned long OffsetPageHeapsInformation; /* +0x0004 */ unsigned long OffsetRuntimeFlagsInformation; /* +0x0008 */ unsigned long OffsetFaultInjectInformation; /* +0x000c */ }; struct tagSERIALKEYSW { unsigned char cbSize[4]; /* +0x0000 75 00 00 00 */ unsigned long dwFlags; /* +0x0004 */ unsigned char lpszActivePort[4]; /* +0x0008 71 04 00 00 */ unsigned char lpszPort[4]; /* +0x000c 71 04 00 00 */ unsigned char iBaudRate[4]; /* +0x0010 75 00 00 00 */ unsigned char iPortState[4]; /* +0x0014 75 00 00 00 */ unsigned char iActive[4]; /* +0x0018 75 00 00 00 */ }; struct _CERT_BIOMETRIC_EXT_INFO { unsigned long cBiometricData; /* +0x0000 */ unsigned char rgBiometricData[4]; /* +0x0004 62 1b 00 00 */ }; struct _OBJECT_ATTRIBUTES32 { unsigned long Length; /* +0x0000 */ unsigned long RootDirectory; /* +0x0004 */ unsigned long ObjectName; /* +0x0008 */ unsigned long Attributes; /* +0x000c */ unsigned long SecurityDescriptor; /* +0x0010 */ unsigned long SecurityQualityOfService; /* +0x0014 */ }; struct _TOKEN_LINKED_TOKEN { void *LinkedToken; /* +0x0000 */ }; struct _NUMA_NODE_RELATIONSHIP { unsigned long NodeNumber; /* +0x0000 */ unsigned char Reserved[20]; /* +0x0004 7b 16 00 00 */ unsigned char GroupMask[12]; /* +0x0018 25 1a 00 00 */ }; struct _CMS_DH_KEY_INFO { unsigned long dwVersion; /* +0x0000 */ unsigned char Algid[4]; /* +0x0004 75 00 00 00 */ char *pszContentEncObjId; /* +0x0008 */ unsigned char PubInfo[8]; /* +0x000c 02 13 00 00 */ void *pReserved; /* +0x0014 */ }; struct _ACTIVATION_CONTEXT_ASSEMBLY_DETAILED_INFORMATION { unsigned long ulFlags; /* +0x0000 */ unsigned long ulEncodedAssemblyIdentityLength; /* +0x0004 */ unsigned long ulManifestPathType; /* +0x0008 */ unsigned long ulManifestPathLength; /* +0x000c */ unsigned char liManifestLastWriteTime[8]; /* +0x0010 3d 13 00 00 */ unsigned long ulPolicyPathType; /* +0x0018 */ unsigned long ulPolicyPathLength; /* +0x001c */ unsigned char liPolicyLastWriteTime[8]; /* +0x0020 3d 13 00 00 */ unsigned long ulMetadataSatelliteRosterIndex; /* +0x0028 */ unsigned long ulManifestVersionMajor; /* +0x002c */ unsigned long ulManifestVersionMinor; /* +0x0030 */ unsigned long ulPolicyVersionMajor; /* +0x0034 */ unsigned long ulPolicyVersionMinor; /* +0x0038 */ unsigned long ulAssemblyDirectoryNameLength; /* +0x003c */ unsigned char lpAssemblyEncodedAssemblyIdentity[4]; /* +0x0040 c0 13 00 00 */ unsigned char lpAssemblyManifestPath[4]; /* +0x0044 c0 13 00 00 */ unsigned char lpAssemblyPolicyPath[4]; /* +0x0048 c0 13 00 00 */ unsigned char lpAssemblyDirectoryName[4]; /* +0x004c c0 13 00 00 */ unsigned long ulFileCount; /* +0x0050 */ }; struct tagTouchPredictionParameters { unsigned char cbSize[4]; /* +0x0000 75 00 00 00 */ unsigned char dwLatency[4]; /* +0x0004 75 00 00 00 */ unsigned char dwSampleTime[4]; /* +0x0008 75 00 00 00 */ unsigned char bUseHWTimeStamp[4]; /* +0x000c 75 00 00 00 */ }; struct _FLAGGED_BYTE_BLOB { unsigned long fFlags; /* +0x0000 */ unsigned long clSize; /* +0x0004 */ unsigned char abData[4]; /* +0x0008 f9 12 00 00 */ }; struct _CRYPTOAPI_BLOB { unsigned long cbData; /* +0x0000 */ unsigned char *pbData; /* +0x0004 */ }; struct _CMC_ADD_EXTENSIONS_INFO { unsigned long dwCmcDataReference; /* +0x0000 */ unsigned long cCertReference; /* +0x0004 */ unsigned long *rgdwCertReference; /* +0x0008 */ unsigned long cExtension; /* +0x000c */ unsigned char rgExtension[4]; /* +0x0010 22 16 00 00 */ }; struct _ALPC_PORT_ASSOCIATE_COMPLETION_PORT { void *CompletionKey; /* +0x0000 */ void *CompletionPort; /* +0x0004 */ }; struct tagDROPSTRUCT { unsigned char hwndSource[4]; /* +0x0000 f1 12 00 00 */ unsigned char hwndSink[4]; /* +0x0004 f1 12 00 00 */ unsigned long wFmt; /* +0x0008 */ unsigned long dwData; /* +0x000c */ unsigned char ptDrop[8]; /* +0x0010 8a 14 00 00 */ unsigned long dwControlData; /* +0x0018 */ }; struct _TOKEN_GROUPS_AND_PRIVILEGES { unsigned long SidCount; /* +0x0000 */ unsigned long SidLength; /* +0x0004 */ unsigned char Sids[4]; /* +0x0008 be 1b 00 00 */ unsigned long RestrictedSidCount; /* +0x000c */ unsigned long RestrictedSidLength; /* +0x0010 */ unsigned char RestrictedSids[4]; /* +0x0014 be 1b 00 00 */ unsigned long PrivilegeCount; /* +0x0018 */ unsigned long PrivilegeLength; /* +0x001c */ unsigned char Privileges[4]; /* +0x0020 5c 14 00 00 */ unsigned char AuthenticationId[8]; /* +0x0024 21 15 00 00 */ }; struct _FILE_ATTRIBUTE_CACHE_PAIR { unsigned char Name[200]; /* +0x0000 c3 1b 00 00 */ unsigned char Value[12]; /* +0x00c8 c4 1b 00 00 */ }; struct _CM_EISA_SLOT_INFORMATION { unsigned char ReturnCode; /* +0x0000 */ unsigned char ReturnFlags; /* +0x0001 */ unsigned char MajorRevision; /* +0x0002 */ unsigned char MinorRevision; /* +0x0003 */ unsigned short Checksum; /* +0x0004 */ unsigned char NumberFunctions; /* +0x0006 */ unsigned char FunctionInformation; /* +0x0007 */ unsigned long CompressedId; /* +0x0008 */ }; struct _RTL_BITMAP_RUN { unsigned long StartingIndex; /* +0x0000 */ unsigned long NumberOfBits; /* +0x0004 */ }; struct _FILE_ALIGNMENT_INFO { unsigned long AlignmentRequirement; /* +0x0000 */ }; struct tagMSLLHOOKSTRUCT { unsigned char pt[8]; /* +0x0000 8a 14 00 00 */ unsigned long mouseData; /* +0x0008 */ unsigned long flags; /* +0x000c */ unsigned long time; /* +0x0010 */ unsigned long dwExtraInfo; /* +0x0014 */ }; struct tagMDICREATESTRUCTA { unsigned char szClass[4]; /* +0x0000 62 14 00 00 */ unsigned char szTitle[4]; /* +0x0004 62 14 00 00 */ void *hOwner; /* +0x0008 */ unsigned char x[4]; /* +0x000c 74 00 00 00 */ unsigned char y[4]; /* +0x0010 74 00 00 00 */ unsigned char cx[4]; /* +0x0014 74 00 00 00 */ unsigned char cy[4]; /* +0x0018 74 00 00 00 */ unsigned long style; /* +0x001c */ long lParam; /* +0x0020 */ }; struct _RPC_SECURITY_QOS_V2_W { unsigned long Version; /* +0x0000 */ unsigned long Capabilities; /* +0x0004 */ unsigned long IdentityTracking; /* +0x0008 */ unsigned long ImpersonationType; /* +0x000c */ unsigned long AdditionalSecurityInfoType; /* +0x0010 */ }; struct _RPC_SECURITY_QOS_V2_W::<unnamed-type-u> { unsigned char HttpCredentials[4]; /* +0x0000 d7 1b 00 00 */ }; struct _SYSTEM_VERIFIER_INFORMATION_EX { unsigned long VerifyMode; /* +0x0000 */ unsigned long OptionChanges; /* +0x0004 */ unsigned char PreviousBucketName[8]; /* +0x0008 dd 12 00 00 */ unsigned long IrpCancelTimeoutMsec; /* +0x0010 */ unsigned long VerifierExtensionEnabled; /* +0x0014 */ unsigned char Reserved[12]; /* +0x0018 22 13 00 00 */ }; struct _KEY_BASIC_INFORMATION { unsigned char LastWriteTime[8]; /* +0x0000 3d 13 00 00 */ unsigned long TitleIndex; /* +0x0008 */ unsigned long NameLength; /* +0x000c */ unsigned char Name[8]; /* +0x0010 f7 13 00 00 */ }; struct _RTL_AVL_ENTRY { unsigned char BalancedLinks[16]; /* +0x0000 e2 1b 00 00 */ long long UserData; /* +0x0010 */ }; struct tagEXTLOGPEN { unsigned long elpPenStyle; /* +0x0000 */ unsigned long elpWidth; /* +0x0004 */ unsigned char elpBrushStyle[4]; /* +0x0008 75 00 00 00 */ unsigned long elpColor; /* +0x000c */ unsigned long elpHatch; /* +0x0010 */ unsigned long elpNumEntries; /* +0x0014 */ unsigned char elpStyleEntry[4]; /* +0x0018 f6 12 00 00 */ }; struct _CERT_TRUST_STATUS { unsigned long dwErrorStatus; /* +0x0000 */ unsigned long dwInfoStatus; /* +0x0004 */ }; struct _MUISTRINGPOOL { unsigned char TotalSize[4]; /* +0x0000 75 00 00 00 */ unsigned short MaxNumStrings; /* +0x0004 */ unsigned short NumStrings; /* +0x0006 */ unsigned short MaxNumCharsInPool; /* +0x0008 */ unsigned short NumCharsInPool; /* +0x000a */ short *Strings; /* +0x000c */ unsigned char Pool[4]; /* +0x0010 71 04 00 00 */ }; struct _ACTIVATION_CONTEXT_ASSEMBLY_DATA { unsigned long Size; /* +0x0000 */ unsigned long Flags; /* +0x0004 */ unsigned char AssemblyName[4]; /* +0x0008 c0 13 00 00 */ unsigned long AssemblyNameLength; /* +0x000c */ unsigned long HashAlgorithm; /* +0x0010 */ unsigned long PseudoKey; /* +0x0014 */ }; struct _OUTLINETEXTMETRICA { unsigned char otmSize[4]; /* +0x0000 75 00 00 00 */ unsigned char otmTextMetrics[56]; /* +0x0004 f0 1b 00 00 */ unsigned char otmFiller; /* +0x003c */ unsigned char otmPanoseNumber[11]; /* +0x003d e6 17 00 00 */ unsigned char otmfsSelection[4]; /* +0x0048 75 00 00 00 */ unsigned char otmfsType[4]; /* +0x004c 75 00 00 00 */ unsigned char otmsCharSlopeRise[4]; /* +0x0050 74 00 00 00 */ unsigned char otmsCharSlopeRun[4]; /* +0x0054 74 00 00 00 */ unsigned char otmItalicAngle[4]; /* +0x0058 74 00 00 00 */ unsigned char otmEMSquare[4]; /* +0x005c 75 00 00 00 */ unsigned char otmAscent[4]; /* +0x0060 74 00 00 00 */ unsigned char otmDescent[4]; /* +0x0064 74 00 00 00 */ unsigned char otmLineGap[4]; /* +0x0068 75 00 00 00 */ unsigned char otmsCapEmHeight[4]; /* +0x006c 75 00 00 00 */ unsigned char otmsXHeight[4]; /* +0x0070 75 00 00 00 */ unsigned char otmrcFontBox[16]; /* +0x0074 63 14 00 00 */ unsigned char otmMacAscent[4]; /* +0x0084 74 00 00 00 */ unsigned char otmMacDescent[4]; /* +0x0088 74 00 00 00 */ unsigned char otmMacLineGap[4]; /* +0x008c 75 00 00 00 */ unsigned char otmusMinimumPPEM[4]; /* +0x0090 75 00 00 00 */ unsigned char otmptSubscriptSize[8]; /* +0x0094 8a 14 00 00 */ unsigned char otmptSubscriptOffset[8]; /* +0x009c 8a 14 00 00 */ unsigned char otmptSuperscriptSize[8]; /* +0x00a4 8a 14 00 00 */ unsigned char otmptSuperscriptOffset[8]; /* +0x00ac 8a 14 00 00 */ unsigned char otmsStrikeoutSize[4]; /* +0x00b4 75 00 00 00 */ unsigned char otmsStrikeoutPosition[4]; /* +0x00b8 74 00 00 00 */ unsigned char otmsUnderscoreSize[4]; /* +0x00bc 74 00 00 00 */ unsigned char otmsUnderscorePosition[4]; /* +0x00c0 74 00 00 00 */ char *otmpFamilyName; /* +0x00c4 */ char *otmpFaceName; /* +0x00c8 */ char *otmpStyleName; /* +0x00cc */ char *otmpFullName; /* +0x00d0 */ }; struct _userCLIPFORMAT { long fContext; /* +0x0000 */ }; struct _PS_CPU_QUOTA_QUERY_ENTRY { unsigned long SessionId; /* +0x0000 */ unsigned long Weight; /* +0x0004 */ }; struct _SYSTEM_SESSION_MAPPED_VIEW_INFORMATION { unsigned long NextEntryOffset; /* +0x0000 */ unsigned long SessionId; /* +0x0004 */ unsigned long ViewFailures; /* +0x0008 */ unsigned long NumberOfBytesAvailable; /* +0x000c */ unsigned long NumberOfBytesAvailableContiguous; /* +0x0010 */ }; struct _CERT_OR_CRL_BLOB { unsigned long dwChoice; /* +0x0000 */ unsigned long cbEncoded; /* +0x0004 */ unsigned char *pbEncoded; /* +0x0008 */ }; struct _CRYPT_RC2_CBC_PARAMETERS { unsigned long dwVersion; /* +0x0000 */ unsigned char fIV[4]; /* +0x0004 74 00 00 00 */ unsigned char rgbIV[8]; /* +0x0008 7f 19 00 00 */ }; struct _FILE_OBJECTID_BUFFER { unsigned char ObjectId[16]; /* +0x0000 09 1c 00 00 */ unsigned char BirthVolumeId[16]; /* +0x0010 09 1c 00 00 */ unsigned char BirthObjectId[16]; /* +0x0020 09 1c 00 00 */ /* unsigned char DomainId[-32]; +0x0030 09 1c 00 00 */ unsigned char ExtendedInfo[48]; /* +0x0010 0a 1c 00 00 */ }; struct _TXFS_SAVEPOINT_INFORMATION { void *KtmTransaction; /* +0x0000 */ unsigned long ActionCode; /* +0x0004 */ unsigned long SavepointId; /* +0x0008 */ }; struct _STORAGE_QUERY_DEPENDENT_VOLUME_REQUEST { unsigned long RequestLevel; /* +0x0000 */ unsigned long RequestFlags; /* +0x0004 */ }; struct _ATOM_BASIC_INFORMATION { unsigned short UsageCount; /* +0x0000 */ unsigned short Flags; /* +0x0002 */ unsigned short NameLength; /* +0x0004 */ unsigned char Name[2]; /* +0x0006 f7 13 00 00 */ }; struct _SL_APPX_CACHE_VALUE_DESCRIPTOR { unsigned char HashedName[32]; /* +0x0000 e5 17 00 00 */ unsigned long long Expiration; /* +0x0020 */ unsigned long DataSize; /* +0x0028 */ unsigned char Data[4]; /* +0x002c f9 12 00 00 */ }; struct _RASTERIZER_STATUS { short nSize; /* +0x0000 */ short wFlags; /* +0x0002 */ short nLanguageID; /* +0x0004 */ }; struct _CERT_FORTEZZA_DATA_PROP { unsigned char SerialNumber[8]; /* +0x0000 7f 19 00 00 */ unsigned char CertIndex[4]; /* +0x0008 74 00 00 00 */ unsigned char CertLabel[36]; /* +0x000c 1c 1c 00 00 */ }; struct _CMSG_CTRL_DEL_SIGNER_UNAUTH_ATTR_PARA { unsigned long cbSize; /* +0x0000 */ unsigned long dwSignerIndex; /* +0x0004 */ unsigned long dwUnauthAttrIndex; /* +0x0008 */ }; struct tagEMRPOLYTEXTOUTA { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned char rclBounds[16]; /* +0x0008 d5 12 00 00 */ unsigned long iGraphicsMode; /* +0x0018 */ unsigned char exScale[4]; /* +0x001c 40 00 00 00 */ unsigned char eyScale[4]; /* +0x0020 40 00 00 00 */ long cStrings; /* +0x0024 */ unsigned char aemrtext[40]; /* +0x0028 22 1c 00 00 */ }; struct _FSCTL_OFFLOAD_WRITE_OUTPUT { unsigned long Size; /* +0x0000 */ unsigned long Flags; /* +0x0004 */ unsigned long long LengthWritten; /* +0x0008 */ }; struct _SL_APPX_CACHE { unsigned long Version; /* +0x0000 */ unsigned long Flags; /* +0x0004 */ unsigned long DataSize; /* +0x0008 */ unsigned long long DataCheckSum; /* +0x0010 */ unsigned char Descriptors[48]; /* +0x0018 2e 1c 00 00 */ }; struct _MESSAGE_RESOURCE_BLOCK { unsigned long LowId; /* +0x0000 */ unsigned long HighId; /* +0x0004 */ unsigned long OffsetToEntries; /* +0x0008 */ }; struct _RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED { unsigned long Size; /* +0x0000 */ unsigned long Format; /* +0x0004 */ unsigned char Frame[12]; /* +0x0008 33 1c 00 00 */ void *Extra1; /* +0x0014 */ void *Extra2; /* +0x0018 */ void *Extra3; /* +0x001c */ void *Extra4; /* +0x0020 */ }; struct tagBITMAPINFOHEADER { unsigned long biSize; /* +0x0000 */ long biWidth; /* +0x0004 */ long biHeight; /* +0x0008 */ unsigned short biPlanes; /* +0x000c */ unsigned short biBitCount; /* +0x000e */ unsigned long biCompression; /* +0x0010 */ unsigned long biSizeImage; /* +0x0014 */ long biXPelsPerMeter; /* +0x0018 */ long biYPelsPerMeter; /* +0x001c */ unsigned long biClrUsed; /* +0x0020 */ unsigned long biClrImportant; /* +0x0024 */ }; struct _BCRYPT_ECCKEY_BLOB { unsigned long dwMagic; /* +0x0000 */ unsigned long cbKey; /* +0x0004 */ }; struct _CRYPT_ECC_CMS_SHARED_INFO { unsigned char Algorithm[12]; /* +0x0000 55 14 00 00 */ unsigned char EntityUInfo[8]; /* +0x000c 02 13 00 00 */ unsigned char rgbSuppPubInfo[4]; /* +0x0014 b7 17 00 00 */ }; struct _SE_AUDIT_INFO { unsigned long Size; /* +0x0000 */ unsigned char AuditType[4]; /* +0x0004 4f 1c 00 00 */ unsigned char AuditOperation[4]; /* +0x0008 50 1c 00 00 */ unsigned long AuditFlags; /* +0x000c */ unsigned char SubsystemName[8]; /* +0x0010 dd 12 00 00 */ unsigned char ObjectTypeName[8]; /* +0x0018 dd 12 00 00 */ unsigned char ObjectName[8]; /* +0x0020 dd 12 00 00 */ void *HandleId; /* +0x0028 */ unsigned char TransactionId[4]; /* +0x002c 44 16 00 00 */ unsigned char OperationId[4]; /* +0x0030 51 1c 00 00 */ unsigned char ObjectCreation; /* +0x0034 */ unsigned char GenerateOnClose; /* +0x0035 */ }; struct _JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION { unsigned char BasicInfo[48]; /* +0x0000 54 1c 00 00 */ unsigned char IoInfo[48]; /* +0x0030 55 1c 00 00 */ unsigned char DiskIoInfo[40]; /* +0x0060 35 15 00 00 */ unsigned long long ContextSwitches; /* +0x0088 */ unsigned char TotalCycleTime[8]; /* +0x0090 3d 13 00 00 */ }; struct _SYSTEM_POOLTAG { /* unsigned char Tag[0]; +0x0000 b7 17 00 00 */ unsigned long TagUlong; /* +0x0000 */ unsigned long PagedAllocs; /* +0x0004 */ unsigned long PagedFrees; /* +0x0008 */ unsigned long PagedUsed; /* +0x000c */ unsigned long NonPagedAllocs; /* +0x0010 */ unsigned long NonPagedFrees; /* +0x0014 */ unsigned long NonPagedUsed; /* +0x0018 */ }; struct _RC_CONFIG { unsigned long dwSignature; /* +0x0000 */ unsigned long dwLength; /* +0x0004 */ unsigned long dwRCConfigVersion; /* +0x0008 */ unsigned long dwFilePathType; /* +0x000c */ unsigned long dwFileType; /* +0x0010 */ unsigned long dwSystemAttributes; /* +0x0014 */ unsigned long dwUltimateFallbackLocation; /* +0x0018 */ unsigned char dwServiceCheckSum[16]; /* +0x001c 4f 1a 00 00 */ unsigned char dwChecksum[16]; /* +0x002c 4f 1a 00 00 */ unsigned long dwReserved1; /* +0x003c */ unsigned long dwReserved2; /* +0x0040 */ unsigned long dwMUIFileNameOffset; /* +0x0044 */ unsigned long dwMUIFileNameLength; /* +0x0048 */ unsigned long dwMUIFilePathOffset; /* +0x004c */ unsigned long dwMUIFilePathLength; /* +0x0050 */ unsigned long dwMainResNameTypesOffset; /* +0x0054 */ unsigned long dwMainResNameTypesLength; /* +0x0058 */ unsigned long dwMainResIDTypesOffset; /* +0x005c */ unsigned long dwMainResIDTypesLength; /* +0x0060 */ unsigned long dwMUIResNameTypesOffset; /* +0x0064 */ unsigned long dwMUIResNameTypesLength; /* +0x0068 */ unsigned long dwMUIResIDTypesOffset; /* +0x006c */ unsigned long dwMUIResIDTypesLength; /* +0x0070 */ unsigned long dwLanguageOffset; /* +0x0074 */ unsigned long dwLanguageLength; /* +0x0078 */ unsigned long dwUltimateFallbackLanguageOffset; /* +0x007c */ unsigned long dwUltimateFallbackLanguageLength; /* +0x0080 */ }; struct tagEMRSTRETCHDIBITS { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned char rclBounds[16]; /* +0x0008 d5 12 00 00 */ long xDest; /* +0x0018 */ long yDest; /* +0x001c */ long xSrc; /* +0x0020 */ long ySrc; /* +0x0024 */ long cxSrc; /* +0x0028 */ long cySrc; /* +0x002c */ unsigned long offBmiSrc; /* +0x0030 */ unsigned long cbBmiSrc; /* +0x0034 */ unsigned long offBitsSrc; /* +0x0038 */ unsigned long cbBitsSrc; /* +0x003c */ unsigned long iUsageSrc; /* +0x0040 */ unsigned long dwRop; /* +0x0044 */ long cxDest; /* +0x0048 */ long cyDest; /* +0x004c */ }; struct __GENERIC_BINDING_INFO { void *pObj; /* +0x0000 */ unsigned char Size[4]; /* +0x0004 75 00 00 00 */ unsigned char pfnBind[4]; /* +0x0008 07 15 00 00 */ unsigned char pfnUnbind[4]; /* +0x000c d5 1a 00 00 */ }; struct _WNF_DELIVERY_DESCRIPTOR { unsigned char StateName[8]; /* +0x0000 e5 13 00 00 */ unsigned long ChangeStamp; /* +0x0008 */ unsigned long DeliveryFlag; /* +0x000c */ unsigned long DeliveryState; /* +0x0010 */ unsigned long ReliableRetryDelay; /* +0x0014 */ unsigned long BatchRetry; /* +0x0018 */ unsigned long StateDataSize; /* +0x001c */ unsigned long EventMask; /* +0x0020 */ unsigned char TypeId[16]; /* +0x0024 70 1c 00 00 */ unsigned long StateDataOffset; /* +0x0034 */ }; struct _TRIVERTEX { long x; /* +0x0000 */ long y; /* +0x0004 */ unsigned short Red; /* +0x0008 */ unsigned short Green; /* +0x000a */ unsigned short Blue; /* +0x000c */ unsigned short Alpha; /* +0x000e */ }; struct _PUBLIC_OBJECT_BASIC_INFORMATION { unsigned long Attributes; /* +0x0000 */ unsigned long GrantedAccess; /* +0x0004 */ unsigned long HandleCount; /* +0x0008 */ unsigned long PointerCount; /* +0x000c */ unsigned char Reserved[40]; /* +0x0010 c4 1c 00 00 */ }; struct _FSCTL_OFFLOAD_READ_OUTPUT { unsigned long Size; /* +0x0000 */ unsigned long Flags; /* +0x0004 */ unsigned long long TransferLength; /* +0x0008 */ unsigned char Token[512]; /* +0x0010 76 19 00 00 */ }; struct _SYSTEM_PROCESSOR_INFORMATION { unsigned short ProcessorArchitecture; /* +0x0000 */ unsigned short ProcessorLevel; /* +0x0002 */ unsigned short ProcessorRevision; /* +0x0004 */ unsigned short MaximumProcessors; /* +0x0006 */ unsigned long ProcessorFeatureBits; /* +0x0008 */ }; struct _MEMORY_BASIC_INFORMATION { void *BaseAddress; /* +0x0000 */ void *AllocationBase; /* +0x0004 */ unsigned long AllocationProtect; /* +0x0008 */ unsigned long RegionSize; /* +0x000c */ unsigned long State; /* +0x0010 */ unsigned long Protect; /* +0x0014 */ unsigned long Type; /* +0x0018 */ }; struct DISPLAYCONFIG_TARGET_DEVICE_NAME_FLAGS { /* unsigned char friendlyNameFromEdid[0]; +0x0000 cf 1c 00 00 */ /* unsigned char friendlyNameForced[0]; +0x0000 d0 1c 00 00 */ /* unsigned char edidIdsValid[0]; +0x0000 d1 1c 00 00 */ /* unsigned char reserved[0]; +0x0000 d2 1c 00 00 */ unsigned char value[4]; /* +0x0000 75 00 00 00 */ }; struct _OUTLINETEXTMETRICW { unsigned char otmSize[4]; /* +0x0000 75 00 00 00 */ unsigned char otmTextMetrics[60]; /* +0x0004 d5 1c 00 00 */ unsigned char otmFiller; /* +0x0040 */ unsigned char otmPanoseNumber[11]; /* +0x0041 e6 17 00 00 */ unsigned char otmfsSelection[4]; /* +0x004c 75 00 00 00 */ unsigned char otmfsType[4]; /* +0x0050 75 00 00 00 */ unsigned char otmsCharSlopeRise[4]; /* +0x0054 74 00 00 00 */ unsigned char otmsCharSlopeRun[4]; /* +0x0058 74 00 00 00 */ unsigned char otmItalicAngle[4]; /* +0x005c 74 00 00 00 */ unsigned char otmEMSquare[4]; /* +0x0060 75 00 00 00 */ unsigned char otmAscent[4]; /* +0x0064 74 00 00 00 */ unsigned char otmDescent[4]; /* +0x0068 74 00 00 00 */ unsigned char otmLineGap[4]; /* +0x006c 75 00 00 00 */ unsigned char otmsCapEmHeight[4]; /* +0x0070 75 00 00 00 */ unsigned char otmsXHeight[4]; /* +0x0074 75 00 00 00 */ unsigned char otmrcFontBox[16]; /* +0x0078 63 14 00 00 */ unsigned char otmMacAscent[4]; /* +0x0088 74 00 00 00 */ unsigned char otmMacDescent[4]; /* +0x008c 74 00 00 00 */ unsigned char otmMacLineGap[4]; /* +0x0090 75 00 00 00 */ unsigned char otmusMinimumPPEM[4]; /* +0x0094 75 00 00 00 */ unsigned char otmptSubscriptSize[8]; /* +0x0098 8a 14 00 00 */ unsigned char otmptSubscriptOffset[8]; /* +0x00a0 8a 14 00 00 */ unsigned char otmptSuperscriptSize[8]; /* +0x00a8 8a 14 00 00 */ unsigned char otmptSuperscriptOffset[8]; /* +0x00b0 8a 14 00 00 */ unsigned char otmsStrikeoutSize[4]; /* +0x00b8 75 00 00 00 */ unsigned char otmsStrikeoutPosition[4]; /* +0x00bc 74 00 00 00 */ unsigned char otmsUnderscoreSize[4]; /* +0x00c0 74 00 00 00 */ unsigned char otmsUnderscorePosition[4]; /* +0x00c4 74 00 00 00 */ char *otmpFamilyName; /* +0x00c8 */ char *otmpFaceName; /* +0x00cc */ char *otmpStyleName; /* +0x00d0 */ char *otmpFullName; /* +0x00d4 */ }; struct tagRAWKEYBOARD { unsigned short MakeCode; /* +0x0000 */ unsigned short Flags; /* +0x0002 */ unsigned short Reserved; /* +0x0004 */ unsigned short VKey; /* +0x0006 */ unsigned char Message[4]; /* +0x0008 75 00 00 00 */ unsigned long ExtraInformation; /* +0x000c */ }; struct _SYSTEM_BIGPOOL_ENTRY { void *VirtualAddress; /* +0x0000 */ unsigned char NonPaged[4]; /* +0x0000 17 13 00 00 */ unsigned long SizeInBytes; /* +0x0004 */ /* unsigned char Tag[0]; +0x0008 b7 17 00 00 */ unsigned long TagUlong; /* +0x0008 */ }; struct _RTL_CRITICAL_SECTION_DEBUG64 { unsigned short Type; /* +0x0000 */ unsigned short CreatorBackTraceIndex; /* +0x0002 */ unsigned long long CriticalSection; /* +0x0008 */ unsigned char ProcessLocksList[16]; /* +0x0010 e7 1c 00 00 */ unsigned long EntryCount; /* +0x0020 */ unsigned long ContentionCount; /* +0x0024 */ unsigned char Spare[8]; /* +0x0028 69 15 00 00 */ }; struct _DOCINFOA { unsigned char cbSize[4]; /* +0x0000 74 00 00 00 */ unsigned char lpszDocName[4]; /* +0x0004 62 14 00 00 */ unsigned char lpszOutput[4]; /* +0x0008 62 14 00 00 */ unsigned char lpszDatatype[4]; /* +0x000c 62 14 00 00 */ unsigned long fwType; /* +0x0010 */ }; struct tagEMRSELECTCLIPPATH { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned long iMode; /* +0x0008 */ }; struct _BCRYPT_INTERFACE_VERSION { unsigned short MajorVersion; /* +0x0000 */ unsigned short MinorVersion; /* +0x0002 */ }; struct _CERT_ISSUER_SERIAL_NUMBER { unsigned char Issuer[8]; /* +0x0000 02 13 00 00 */ unsigned char SerialNumber[8]; /* +0x0008 02 13 00 00 */ }; struct _DEFERRED_REPAIR_EXTENT { unsigned char VolumeByteOffset[8]; /* +0x0000 3d 13 00 00 */ unsigned long Length; /* +0x0008 */ unsigned long RepairFlags; /* +0x000c */ }; struct _SYSTEM_MEMORY_TOPOLOGY_INFORMATION { unsigned long long NumberOfRuns; /* +0x0000 */ unsigned long NumberOfNodes; /* +0x0008 */ unsigned long NumberOfChannels; /* +0x000c */ unsigned char Run[32]; /* +0x0010 f7 1c 00 00 */ }; struct tagICEXYZTRIPLE { unsigned char ciexyzRed[12]; /* +0x0000 fc 1c 00 00 */ unsigned char ciexyzGreen[12]; /* +0x000c fc 1c 00 00 */ unsigned char ciexyzBlue[12]; /* +0x0018 fc 1c 00 00 */ }; struct _RPC_BINDING_HANDLE_SECURITY_V1_W { unsigned long Version; /* +0x0000 */ unsigned short *ServerPrincName; /* +0x0004 */ unsigned long AuthnLevel; /* +0x0008 */ unsigned long AuthnSvc; /* +0x000c */ unsigned char AuthIdentity[4]; /* +0x0010 01 1d 00 00 */ unsigned char SecurityQos[4]; /* +0x0014 03 1d 00 00 */ }; struct _CMC_TAGGED_CONTENT_INFO { unsigned long dwBodyPartID; /* +0x0000 */ unsigned char EncodedContentInfo[8]; /* +0x0004 02 13 00 00 */ }; struct _TOKEN_SOURCE { unsigned char SourceName[8]; /* +0x0000 0c 1d 00 00 */ unsigned char SourceIdentifier[8]; /* +0x0008 21 15 00 00 */ }; struct _KERNEL_USER_TIMES { unsigned char CreateTime[8]; /* +0x0000 3d 13 00 00 */ unsigned char ExitTime[8]; /* +0x0008 3d 13 00 00 */ unsigned char KernelTime[8]; /* +0x0010 3d 13 00 00 */ unsigned char UserTime[8]; /* +0x0018 3d 13 00 00 */ }; struct _DECRYPTION_STATUS_BUFFER { unsigned char NoEncryptedStreams; /* +0x0000 */ }; struct _RTL_VERIFIER_HEAP_TABLE { unsigned long Size; /* +0x0000 */ unsigned char VrfHeapAllocate[4]; /* +0x0004 15 1d 00 00 */ unsigned char VrfHeapReAllocate[4]; /* +0x0008 18 1d 00 00 */ unsigned char VrfHeapFree[4]; /* +0x000c 1a 1d 00 00 */ unsigned char VrfHeapCreate[4]; /* +0x0010 1f 1d 00 00 */ unsigned char VrfHeapDestroy[4]; /* +0x0014 07 15 00 00 */ unsigned char VrfHeapExtend[4]; /* +0x0018 21 1d 00 00 */ unsigned char VrfGetProcessHeaps[4]; /* +0x001c d1 16 00 00 */ unsigned char VrfHeapWalk[4]; /* +0x0020 26 1d 00 00 */ unsigned char VrfHeapLock[4]; /* +0x0024 28 1d 00 00 */ unsigned char VrfHeapUnlock[4]; /* +0x0028 28 1d 00 00 */ unsigned char VrfHeapIsLocked[4]; /* +0x002c 28 1d 00 00 */ unsigned char VrfHeapValidate[4]; /* +0x0030 1a 1d 00 00 */ unsigned char VrfHeapSetUserValue[4]; /* +0x0034 2b 1d 00 00 */ unsigned char VrfHeapGetUserInfo[4]; /* +0x0038 2e 1d 00 00 */ unsigned char VrfHeapSetUserFlags[4]; /* +0x003c 31 1d 00 00 */ unsigned char VrfHeapSerialize[4]; /* +0x0040 28 1d 00 00 */ unsigned char VrfHeapSize[4]; /* +0x0044 33 1d 00 00 */ unsigned char VrfHeapCompact[4]; /* +0x0048 35 1d 00 00 */ unsigned char VrfHeapZero[4]; /* +0x004c 37 1d 00 00 */ unsigned char VrfQueryVerifierOptions[4]; /* +0x0050 3a 1d 00 00 */ unsigned char VrfSetVerifierOptions[4]; /* +0x0054 3a 1d 00 00 */ }; struct _SYSTEM_HANDLE_INFORMATION_EX { unsigned long NumberOfHandles; /* +0x0000 */ unsigned long Reserved; /* +0x0004 */ unsigned char Handles[28]; /* +0x0008 56 1d 00 00 */ }; struct _BLENDFUNCTION { unsigned char BlendOp; /* +0x0000 */ unsigned char BlendFlags; /* +0x0001 */ unsigned char SourceConstantAlpha; /* +0x0002 */ unsigned char AlphaFormat; /* +0x0003 */ }; struct _RPC_PROTSEQ_VECTORW { unsigned char Count[4]; /* +0x0000 75 00 00 00 */ unsigned char Protseq[4]; /* +0x0004 5d 1d 00 00 */ }; struct _SERVICE_RUNLEVEL_INFO { unsigned long eLowestRunLevel; /* +0x0000 */ }; struct _PUBKEY { unsigned long magic; /* +0x0000 */ unsigned long bitlen; /* +0x0004 */ }; struct _CMSG_CONTENT_ENCRYPT_INFO { unsigned long cbSize; /* +0x0000 */ unsigned long hCryptProv; /* +0x0004 */ unsigned char ContentEncryptionAlgorithm[12]; /* +0x0008 55 14 00 00 */ void *pvEncryptionAuxInfo; /* +0x0014 */ unsigned long cRecipients; /* +0x0018 */ unsigned char rgCmsRecipients[4]; /* +0x001c 90 1d 00 00 */ unsigned char pfnAlloc[4]; /* +0x0020 66 19 00 00 */ unsigned char pfnFree[4]; /* +0x0024 c7 13 00 00 */ unsigned long dwEncryptFlags; /* +0x0028 */ unsigned long hContentEncryptKey; /* +0x002c */ void *hCNGContentEncryptKey; /* +0x002c */ unsigned long dwFlags; /* +0x0030 */ unsigned char fCNG[4]; /* +0x0034 74 00 00 00 */ unsigned char *pbCNGContentEncryptKeyObject; /* +0x0038 */ unsigned char *pbContentEncryptKey; /* +0x003c */ unsigned long cbContentEncryptKey; /* +0x0040 */ }; struct __PUBLIC_OBJECT_TYPE_INFORMATION { unsigned char TypeName[8]; /* +0x0000 dd 12 00 00 */ unsigned char Reserved[88]; /* +0x0008 93 1d 00 00 */ }; struct _SD_CHANGE_MACHINE_SID_INPUT { unsigned short CurrentMachineSIDOffset; /* +0x0000 */ unsigned short CurrentMachineSIDLength; /* +0x0002 */ unsigned short NewMachineSIDOffset; /* +0x0004 */ unsigned short NewMachineSIDLength; /* +0x0006 */ }; struct tagGESTURECONFIG { unsigned long dwID; /* +0x0000 */ unsigned long dwWant; /* +0x0004 */ unsigned long dwBlock; /* +0x0008 */ }; struct _PS_ATTRIBUTE { unsigned long Attribute; /* +0x0000 */ unsigned long Size; /* +0x0004 */ unsigned long Value; /* +0x0008 */ void *ValuePtr; /* +0x0008 */ unsigned long *ReturnLength; /* +0x000c */ }; struct _FILE_SFIO_RESERVE_INFORMATION { unsigned long RequestsPerPeriod; /* +0x0000 */ unsigned long Period; /* +0x0004 */ unsigned char RetryFailures; /* +0x0008 */ unsigned char Discardable; /* +0x0009 */ unsigned long RequestSize; /* +0x000c */ unsigned long NumOutstandingRequests; /* +0x0010 */ }; struct _MEMORY_WORKING_SET_BLOCK { /* unsigned char Protection[0]; +0x0000 c2 1d 00 00 */ /* unsigned char ShareCount[0]; +0x0000 c3 1d 00 00 */ /* unsigned char Shared[0]; +0x0000 c4 1d 00 00 */ /* unsigned char Node[0]; +0x0000 c5 1d 00 00 */ unsigned char VirtualPage[4]; /* +0x0000 c6 1d 00 00 */ }; struct _TRANSACTION_BIND_INFORMATION { void *TmHandle; /* +0x0000 */ }; struct _FILE_SET_SPARSE_BUFFER { unsigned char SetSparse; /* +0x0000 */ }; struct _PLUGPLAY_CONTROL_STATUS_DATA { unsigned char DeviceInstance[8]; /* +0x0000 dd 12 00 00 */ unsigned long Operation; /* +0x0008 */ unsigned long DeviceStatus; /* +0x000c */ unsigned long DeviceProblem; /* +0x0010 */ unsigned long Flags; /* +0x0014 */ }; struct _CERT_PRIVATE_KEY_VALIDITY { unsigned char NotBefore[8]; /* +0x0000 31 13 00 00 */ unsigned char NotAfter[8]; /* +0x0008 31 13 00 00 */ }; struct _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION { unsigned char IdleTime[8]; /* +0x0000 3d 13 00 00 */ unsigned char KernelTime[8]; /* +0x0008 3d 13 00 00 */ unsigned char UserTime[8]; /* +0x0010 3d 13 00 00 */ unsigned char DpcTime[8]; /* +0x0018 3d 13 00 00 */ unsigned char InterruptTime[8]; /* +0x0020 3d 13 00 00 */ unsigned long InterruptCount; /* +0x0028 */ }; struct _SYSTEM_PROCESSOR_IDLE_INFORMATION { unsigned long long IdleTime; /* +0x0000 */ unsigned long long C1Time; /* +0x0008 */ unsigned long long C2Time; /* +0x0010 */ unsigned long long C3Time; /* +0x0018 */ unsigned long C1Transitions; /* +0x0020 */ unsigned long C2Transitions; /* +0x0024 */ unsigned long C3Transitions; /* +0x0028 */ unsigned long Padding; /* +0x002c */ }; struct tagENUMTEXTMETRICA { unsigned char etmNewTextMetricEx[96]; /* +0x0000 fb 1d 00 00 */ unsigned char etmAxesList[392]; /* +0x0060 fc 1d 00 00 */ }; struct _KEY_TYPE_SUBTYPE { unsigned long dwKeySpec; /* +0x0000 */ unsigned char Type[16]; /* +0x0004 dc 14 00 00 */ unsigned char Subtype[16]; /* +0x0014 dc 14 00 00 */ }; struct _FIBER { void *FiberData; /* +0x0000 */ unsigned char ExceptionList[4]; /* +0x0004 56 13 00 00 */ void *StackBase; /* +0x0008 */ void *StackLimit; /* +0x000c */ void *DeallocationStack; /* +0x0010 */ unsigned char FiberContext[716]; /* +0x0014 57 13 00 00 */ unsigned char Wx86Tib[4]; /* +0x02e0 17 1e 00 00 */ unsigned char ActivationContextStackPointer[4]; /* +0x02e4 19 1e 00 00 */ void *FlsData; /* +0x02e8 */ unsigned long GuaranteedStackBytes; /* +0x02ec */ unsigned short TebFlags; /* +0x02f0 */ unsigned short ReservedPad; /* +0x02f2 */ }; struct _KAFFINITY_EX { unsigned short Count; /* +0x0000 */ unsigned short Size; /* +0x0002 */ unsigned long Reserved; /* +0x0004 */ unsigned char Bitmap[4]; /* +0x0008 f6 12 00 00 */ }; struct _ASSEMBLY_FILE_DETAILED_INFORMATION { unsigned long ulFlags; /* +0x0000 */ unsigned long ulFilenameLength; /* +0x0004 */ unsigned long ulPathLength; /* +0x0008 */ unsigned char lpFileName[4]; /* +0x000c c0 13 00 00 */ unsigned char lpFilePath[4]; /* +0x0010 c0 13 00 00 */ }; struct _RTL_SRWLOCK { /* unsigned char Locked[0]; +0x0000 17 13 00 00 */ /* unsigned char Waiting[0]; +0x0000 7e 18 00 00 */ /* unsigned char Waking[0]; +0x0000 7f 18 00 00 */ /* unsigned char MultipleShared[0]; +0x0000 27 1e 00 00 */ /* unsigned char Shared[0]; +0x0000 28 1e 00 00 */ unsigned long Value; /* +0x0000 */ void *Ptr; /* +0x0000 */ }; struct _SERVICE_NOTIFY_2W { unsigned long dwVersion; /* +0x0000 */ unsigned char pfnNotifyCallback[4]; /* +0x0004 c7 13 00 00 */ void *pContext; /* +0x0008 */ unsigned long dwNotificationStatus; /* +0x000c */ unsigned char ServiceStatus[36]; /* +0x0010 c6 16 00 00 */ unsigned long dwNotificationTriggered; /* +0x0034 */ unsigned char pszServiceNames[4]; /* +0x0038 71 04 00 00 */ }; enum tagAPTKIND { APTKIND_NEUTRALTHREADED = 1, APTKIND_MULTITHREADED = 2, APTKIND_APARTMENTTHREADED = 4, APTKIND_APPLICATION_STA = 8 }; struct _FILE_COMPLETION_INFORMATION { void *Port; /* +0x0000 */ void *Key; /* +0x0004 */ }; struct _KEY_VIRTUALIZATION_INFORMATION { /* unsigned char VirtualizationCandidate[0]; +0x0000 17 13 00 00 */ /* unsigned char VirtualizationEnabled[0]; +0x0000 7e 18 00 00 */ /* unsigned char VirtualTarget[0]; +0x0000 7f 18 00 00 */ /* unsigned char VirtualStore[0]; +0x0000 27 1e 00 00 */ /* unsigned char VirtualSource[0]; +0x0000 42 1e 00 00 */ unsigned char Reserved[4]; /* +0x0000 43 1e 00 00 */ }; struct _STARTUPINFOEXW { unsigned char StartupInfo[68]; /* +0x0000 6f 17 00 00 */ unsigned char lpAttributeList[4]; /* +0x0044 47 1e 00 00 */ }; struct tagEMR { unsigned long iType; /* +0x0000 */ unsigned long nSize; /* +0x0004 */ }; struct tagEMRCREATEDIBPATTERNBRUSHPT { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned long ihBrush; /* +0x0008 */ unsigned long iUsage; /* +0x000c */ unsigned long offBmi; /* +0x0010 */ unsigned long cbBmi; /* +0x0014 */ unsigned long offBits; /* +0x0018 */ unsigned long cbBits; /* +0x001c */ }; struct tagRemSTGMEDIUM { unsigned long tymed; /* +0x0000 */ unsigned long dwHandleType; /* +0x0004 */ unsigned long pData; /* +0x0008 */ unsigned long pUnkForRelease; /* +0x000c */ unsigned long cbData; /* +0x0010 */ unsigned char data[4]; /* +0x0014 f9 12 00 00 */ }; struct _KTMOBJECT_CURSOR { unsigned char LastQuery[16]; /* +0x0000 dc 14 00 00 */ unsigned long ObjectIdCount; /* +0x0010 */ unsigned char ObjectIds[16]; /* +0x0014 57 1e 00 00 */ }; struct _RTL_QUERY_REGISTRY_TABLE { unsigned char QueryRoutine[4]; /* +0x0000 5c 1e 00 00 */ unsigned long Flags; /* +0x0004 */ unsigned char Name[4]; /* +0x0008 71 04 00 00 */ void *EntryContext; /* +0x000c */ unsigned long DefaultType; /* +0x0010 */ void *DefaultData; /* +0x0014 */ unsigned long DefaultLength; /* +0x0018 */ }; struct tagPOINTS { short x; /* +0x0000 */ short y; /* +0x0002 */ }; struct tagINPUT { unsigned long type; /* +0x0000 */ /* unsigned char mi[0]; +0x0004 61 1e 00 00 */ /* unsigned char ki[0]; +0x0004 62 1e 00 00 */ unsigned char hi[24]; /* +0x0004 63 1e 00 00 */ }; struct _EISA_MEMORY_TYPE { /* unsigned char ReadWrite[0]; +0x0000 6f 1e 00 00 */ /* unsigned char Cached[0]; +0x0000 70 1e 00 00 */ /* unsigned char Reserved0[0]; +0x0000 71 1e 00 00 */ /* unsigned char Type[0]; +0x0000 72 1e 00 00 */ /* unsigned char Shared[0]; +0x0000 73 1e 00 00 */ /* unsigned char Reserved1[0]; +0x0000 74 1e 00 00 */ unsigned char MoreEntries[1]; /* +0x0000 75 1e 00 00 */ }; struct _RTL_TRACE_ENUMERATE { unsigned char Database[4]; /* +0x0000 79 1e 00 00 */ unsigned long Index; /* +0x0004 */ unsigned char Block[4]; /* +0x0008 81 16 00 00 */ }; struct _FILE_LEVEL_TRIM_OUTPUT { unsigned long NumRangesProccessed; /* +0x0000 */ }; struct _KCRM_PROTOCOL_BLOB { unsigned char ProtocolId[16]; /* +0x0000 dc 14 00 00 */ unsigned long StaticInfoLength; /* +0x0010 */ unsigned long TransactionIdInfoLength; /* +0x0014 */ unsigned long Unused1; /* +0x0018 */ unsigned long Unused2; /* +0x001c */ }; struct _CRYPT_AES_128_KEY_STATE { unsigned char Key[16]; /* +0x0000 09 1c 00 00 */ unsigned char IV[16]; /* +0x0010 09 1c 00 00 */ unsigned char EncryptionState[176]; /* +0x0020 8c 1e 00 00 */ unsigned char DecryptionState[176]; /* +0x00d0 8c 1e 00 00 */ unsigned char Feedback[16]; /* +0x0180 09 1c 00 00 */ }; struct _FILE_ACCESS_INFORMATION { unsigned long AccessFlags; /* +0x0000 */ }; struct tagEXTLOGFONTW { unsigned char elfLogFont[92]; /* +0x0000 a3 16 00 00 */ unsigned char elfFullName[128]; /* +0x005c 98 1e 00 00 */ unsigned char elfStyle[64]; /* +0x00dc a5 15 00 00 */ unsigned long elfVersion; /* +0x011c */ unsigned long elfStyleSize; /* +0x0120 */ unsigned long elfMatch; /* +0x0124 */ unsigned long elfReserved; /* +0x0128 */ unsigned char elfVendorId[4]; /* +0x012c b7 17 00 00 */ unsigned long elfCulture; /* +0x0130 */ unsigned char elfPanose[12]; /* +0x0134 e6 17 00 00 */ }; struct tagPOINTFX { unsigned char x[4]; /* +0x0000 fc 16 00 00 */ unsigned char y[4]; /* +0x0004 fc 16 00 00 */ }; struct _PROV_ENUMALGS_EX { unsigned char aiAlgid[4]; /* +0x0000 75 00 00 00 */ unsigned long dwDefaultLen; /* +0x0004 */ unsigned long dwMinLen; /* +0x0008 */ unsigned long dwMaxLen; /* +0x000c */ unsigned long dwProtocols; /* +0x0010 */ unsigned long dwNameLen; /* +0x0014 */ unsigned char szName[20]; /* +0x0018 b6 1e 00 00 */ unsigned long dwLongNameLen; /* +0x002c */ unsigned char szLongName[40]; /* +0x0030 b7 1e 00 00 */ }; struct _CERT_X942_DH_PARAMETERS { unsigned char p[8]; /* +0x0000 02 13 00 00 */ unsigned char g[8]; /* +0x0008 02 13 00 00 */ unsigned char q[8]; /* +0x0010 02 13 00 00 */ unsigned char j[8]; /* +0x0018 02 13 00 00 */ unsigned char pValidationParams[4]; /* +0x0020 bb 1e 00 00 */ }; struct _API_SET_VALUE_ENTRY { unsigned long NameOffset; /* +0x0000 */ unsigned long NameLength; /* +0x0004 */ unsigned long ValueOffset; /* +0x0008 */ unsigned long ValueLength; /* +0x000c */ }; struct _DMA_CONFIGURATION_BYTE1 { /* unsigned char Reserved0[0]; +0x0000 c4 1e 00 00 */ /* unsigned char TransferSize[0]; +0x0000 c5 1e 00 00 */ /* unsigned char Timing[0]; +0x0000 c6 1e 00 00 */ unsigned char Reserved1[1]; /* +0x0000 c7 1e 00 00 */ }; struct _COMMPROP { unsigned short wPacketLength; /* +0x0000 */ unsigned short wPacketVersion; /* +0x0002 */ unsigned long dwServiceMask; /* +0x0004 */ unsigned long dwReserved1; /* +0x0008 */ unsigned long dwMaxTxQueue; /* +0x000c */ unsigned long dwMaxRxQueue; /* +0x0010 */ unsigned long dwMaxBaud; /* +0x0014 */ unsigned long dwProvSubType; /* +0x0018 */ unsigned long dwProvCapabilities; /* +0x001c */ unsigned long dwSettableParams; /* +0x0020 */ unsigned long dwSettableBaud; /* +0x0024 */ unsigned short wSettableData; /* +0x0028 */ unsigned short wSettableStopParity; /* +0x002a */ unsigned long dwCurrentTxQueue; /* +0x002c */ unsigned long dwCurrentRxQueue; /* +0x0030 */ unsigned long dwProvSpec1; /* +0x0034 */ unsigned long dwProvSpec2; /* +0x0038 */ unsigned char wcProvChar[4]; /* +0x003c f7 13 00 00 */ }; struct _LDR_DATA_TABLE_ENTRY32 { unsigned char InLoadOrderLinks[8]; /* +0x0000 d9 1e 00 00 */ unsigned char InMemoryOrderLinks[8]; /* +0x0008 d9 1e 00 00 */ unsigned char InInitializationOrderLinks[8]; /* +0x0010 d9 1e 00 00 */ unsigned long DllBase; /* +0x0018 */ unsigned long EntryPoint; /* +0x001c */ unsigned long SizeOfImage; /* +0x0020 */ unsigned char FullDllName[8]; /* +0x0024 8b 17 00 00 */ unsigned char BaseDllName[8]; /* +0x002c 8b 17 00 00 */ unsigned long Flags; /* +0x0034 */ unsigned short LoadCount; /* +0x0038 */ unsigned short TlsIndex; /* +0x003a */ /* unsigned char HashLinks[0]; +0x003c d9 1e 00 00 */ unsigned long SectionPointer; /* +0x003c */ unsigned long CheckSum; /* +0x0040 */ unsigned long TimeDateStamp; /* +0x0044 */ unsigned long LoadedImports; /* +0x0044 */ }; struct _FILE_QUOTA_INFORMATION { unsigned long NextEntryOffset; /* +0x0000 */ unsigned long SidLength; /* +0x0004 */ unsigned char ChangeTime[8]; /* +0x0008 3d 13 00 00 */ unsigned char QuotaUsed[8]; /* +0x0010 3d 13 00 00 */ unsigned char QuotaThreshold[8]; /* +0x0018 3d 13 00 00 */ unsigned char QuotaLimit[8]; /* +0x0020 3d 13 00 00 */ unsigned char Sid[16]; /* +0x0028 dc 1e 00 00 */ }; struct _PLUGPLAY_CONTROL_CONFLICT_LIST { unsigned long Reserved1; /* +0x0000 */ unsigned long Reserved2; /* +0x0004 */ unsigned long ConflictsCounted; /* +0x0008 */ unsigned long ConflictsListed; /* +0x000c */ unsigned long RequiredBufferSize; /* +0x0010 */ unsigned char ConflictEntry[40]; /* +0x0018 e0 1e 00 00 */ }; struct _WIN32_MEMORY_RANGE_ENTRY { void *VirtualAddress; /* +0x0000 */ unsigned long NumberOfBytes; /* +0x0004 */ }; struct tagPAINTSTRUCT { unsigned char hdc[4]; /* +0x0000 f1 1e 00 00 */ unsigned char fErase[4]; /* +0x0004 74 00 00 00 */ unsigned char rcPaint[16]; /* +0x0008 63 14 00 00 */ unsigned char fRestore[4]; /* +0x0018 74 00 00 00 */ unsigned char fIncUpdate[4]; /* +0x001c 74 00 00 00 */ unsigned char rgbReserved[32]; /* +0x0020 e5 17 00 00 */ }; struct _DISCDLGSTRUCTA { unsigned long cbStructure; /* +0x0000 */ unsigned char hwndOwner[4]; /* +0x0004 f1 12 00 00 */ char *lpLocalName; /* +0x0008 */ char *lpRemoteName; /* +0x000c */ unsigned long dwFlags; /* +0x0010 */ }; struct _DCB { unsigned long DCBlength; /* +0x0000 */ unsigned long BaudRate; /* +0x0004 */ /* unsigned char fBinary[0]; +0x0008 17 13 00 00 */ /* unsigned char fParity[0]; +0x0008 7e 18 00 00 */ /* unsigned char fOutxCtsFlow[0]; +0x0008 7f 18 00 00 */ /* unsigned char fOutxDsrFlow[0]; +0x0008 27 1e 00 00 */ /* unsigned char fDtrControl[0]; +0x0008 fe 1e 00 00 */ /* unsigned char fDsrSensitivity[0]; +0x0008 ff 1e 00 00 */ /* unsigned char fTXContinueOnXoff[0]; +0x0008 00 1f 00 00 */ /* unsigned char fOutX[0]; +0x0008 c4 1d 00 00 */ /* unsigned char fInX[0]; +0x0008 01 1f 00 00 */ /* unsigned char fErrorChar[0]; +0x0008 02 1f 00 00 */ /* unsigned char fNull[0]; +0x0008 03 1f 00 00 */ /* unsigned char fRtsControl[0]; +0x0008 04 1f 00 00 */ /* unsigned char fAbortOnError[0]; +0x0008 05 1f 00 00 */ unsigned char fDummy2[4]; /* +0x0008 06 1f 00 00 */ unsigned short wReserved; /* +0x000c */ unsigned short XonLim; /* +0x000e */ unsigned short XoffLim; /* +0x0010 */ unsigned char ByteSize; /* +0x0012 */ unsigned char Parity; /* +0x0013 */ unsigned char StopBits; /* +0x0014 */ char XonChar; /* +0x0015 */ char XoffChar; /* +0x0016 */ char ErrorChar; /* +0x0017 */ char EofChar; /* +0x0018 */ char EvtChar; /* +0x0019 */ unsigned short wReserved1; /* +0x001a */ }; struct _SINGLE_LIST_ENTRY { unsigned char Next[4]; /* +0x0000 5a 1a 00 00 */ }; struct tagEMREXCLUDECLIPRECT { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned char rclClip[16]; /* +0x0008 d5 12 00 00 */ }; struct _CRYPT_ASYNC_RETRIEVAL_COMPLETION { unsigned char pfnCompletion[4]; /* +0x0000 15 1f 00 00 */ void *pvCompletion; /* +0x0004 */ }; struct tagEMRSETDIBITSTODEVICE { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned char rclBounds[16]; /* +0x0008 d5 12 00 00 */ long xDest; /* +0x0018 */ long yDest; /* +0x001c */ long xSrc; /* +0x0020 */ long ySrc; /* +0x0024 */ long cxSrc; /* +0x0028 */ long cySrc; /* +0x002c */ unsigned long offBmiSrc; /* +0x0030 */ unsigned long cbBmiSrc; /* +0x0034 */ unsigned long offBitsSrc; /* +0x0038 */ unsigned long cbBitsSrc; /* +0x003c */ unsigned long iUsageSrc; /* +0x0040 */ unsigned long iStartScan; /* +0x0044 */ unsigned long cScans; /* +0x0048 */ }; struct _SCHANNEL_ALG { unsigned long dwUse; /* +0x0000 */ unsigned char Algid[4]; /* +0x0004 75 00 00 00 */ unsigned long cBits; /* +0x0008 */ unsigned long dwFlags; /* +0x000c */ unsigned long dwReserved; /* +0x0010 */ }; struct _HEAP_INFORMATION { unsigned long Address; /* +0x0000 */ unsigned long Mode; /* +0x0004 */ unsigned long ReserveSize; /* +0x0008 */ unsigned long CommitSize; /* +0x000c */ unsigned long FirstRegionInformationOffset; /* +0x0010 */ unsigned long NextHeapInformationOffset; /* +0x0014 */ }; struct _RPC_SECURITY_QOS_V3_W { unsigned long Version; /* +0x0000 */ unsigned long Capabilities; /* +0x0004 */ unsigned long IdentityTracking; /* +0x0008 */ unsigned long ImpersonationType; /* +0x000c */ unsigned long AdditionalSecurityInfoType; /* +0x0010 */ }; struct _CMSG_ENCRYPTED_ENCODE_INFO { unsigned long cbSize; /* +0x0000 */ unsigned char ContentEncryptionAlgorithm[12]; /* +0x0004 55 14 00 00 */ void *pvEncryptionAuxInfo; /* +0x0010 */ }; struct _XSAVE_FORMAT { unsigned short ControlWord; /* +0x0000 */ unsigned short StatusWord; /* +0x0002 */ unsigned char TagWord; /* +0x0004 */ unsigned char Reserved1; /* +0x0005 */ unsigned short ErrorOpcode; /* +0x0006 */ unsigned long ErrorOffset; /* +0x0008 */ unsigned short ErrorSelector; /* +0x000c */ unsigned short Reserved2; /* +0x000e */ unsigned long DataOffset; /* +0x0010 */ unsigned short DataSelector; /* +0x0014 */ unsigned short Reserved3; /* +0x0016 */ unsigned long MxCsr; /* +0x0018 */ unsigned long MxCsr_Mask; /* +0x001c */ unsigned char FloatRegisters[128]; /* +0x0020 34 1f 00 00 */ unsigned char XmmRegisters[128]; /* +0x00a0 34 1f 00 00 */ unsigned char Reserved4[220]; /* +0x0120 35 1f 00 00 */ unsigned long Cr0NpxState; /* +0x01fc */ }; struct _WIN32_FIND_DATAW { unsigned long dwFileAttributes; /* +0x0000 */ unsigned char ftCreationTime[8]; /* +0x0004 31 13 00 00 */ unsigned char ftLastAccessTime[8]; /* +0x000c 31 13 00 00 */ unsigned char ftLastWriteTime[8]; /* +0x0014 31 13 00 00 */ unsigned long nFileSizeHigh; /* +0x001c */ unsigned long nFileSizeLow; /* +0x0020 */ unsigned long dwReserved0; /* +0x0024 */ unsigned long dwReserved1; /* +0x0028 */ unsigned char cFileName[520]; /* +0x002c e4 15 00 00 */ unsigned char cAlternateFileName[28]; /* +0x0234 39 1f 00 00 */ }; struct _BCRYPT_OID_LIST { unsigned long dwOIDCount; /* +0x0000 */ unsigned char pOIDs[4]; /* +0x0004 41 1f 00 00 */ }; struct _KLDR_DATA_TABLE_ENTRY { unsigned char InLoadOrderLinks[8]; /* +0x0000 44 1f 00 00 */ void *ExceptionTable; /* +0x0008 */ unsigned long ExceptionTableSize; /* +0x000c */ void *GpValue; /* +0x0010 */ unsigned char NonPagedDebugInfo[4]; /* +0x0014 46 1f 00 00 */ void *DllBase; /* +0x0018 */ void *EntryPoint; /* +0x001c */ unsigned long SizeOfImage; /* +0x0020 */ unsigned char FullDllName[8]; /* +0x0024 dd 12 00 00 */ unsigned char BaseDllName[8]; /* +0x002c dd 12 00 00 */ unsigned long Flags; /* +0x0034 */ unsigned short LoadCount; /* +0x0038 */ unsigned short __Unused5; /* +0x003a */ void *SectionPointer; /* +0x003c */ unsigned long CheckSum; /* +0x0040 */ unsigned long CoverageSectionSize; /* +0x0044 */ void *CoverageSection; /* +0x0048 */ void *LoadedImports; /* +0x004c */ void *PatchInformation; /* +0x0050 */ unsigned long SizeOfImageNotRounded; /* +0x0054 */ unsigned long TimeDateStamp; /* +0x0058 */ }; struct _WNF_STATE_NAME { unsigned char Data[8]; /* +0x0000 69 15 00 00 */ }; struct _RTL_VERIFIER_DLL_DESCRIPTOR { unsigned char DllName[4]; /* +0x0000 71 04 00 00 */ unsigned long DllFlags; /* +0x0004 */ void *DllAddress; /* +0x0008 */ unsigned char DllThunks[4]; /* +0x000c 4c 1f 00 00 */ }; struct _GRADIENT_TRIANGLE { unsigned long Vertex1; /* +0x0000 */ unsigned long Vertex2; /* +0x0004 */ unsigned long Vertex3; /* +0x0008 */ }; struct _MODEMSETTINGS { unsigned long dwActualSize; /* +0x0000 */ unsigned long dwRequiredSize; /* +0x0004 */ unsigned long dwDevSpecificOffset; /* +0x0008 */ unsigned long dwDevSpecificSize; /* +0x000c */ unsigned long dwCallSetupFailTimer; /* +0x0010 */ unsigned long dwInactivityTimeout; /* +0x0014 */ unsigned long dwSpeakerVolume; /* +0x0018 */ unsigned long dwSpeakerMode; /* +0x001c */ unsigned long dwPreferredModemOptions; /* +0x0020 */ unsigned long dwNegotiatedModemOptions; /* +0x0024 */ unsigned long dwNegotiatedDCERate; /* +0x0028 */ unsigned char abVariablePortion[4]; /* +0x002c f9 12 00 00 */ }; struct _IO_ERROR_LOG_MESSAGE { unsigned short Type; /* +0x0000 */ unsigned short Size; /* +0x0002 */ unsigned short DriverNameLength; /* +0x0004 */ unsigned char TimeStamp[8]; /* +0x0008 3d 13 00 00 */ unsigned long DriverNameOffset; /* +0x0010 */ unsigned char EntryData[48]; /* +0x0018 55 1f 00 00 */ }; struct _CM_RESOURCE_LIST { unsigned long Count; /* +0x0000 */ unsigned char List[32]; /* +0x0004 5b 1f 00 00 */ }; struct _PLUGPLAY_CONTROL_INTERFACE_LIST_DATA { unsigned char DeviceInstance[8]; /* +0x0000 dd 12 00 00 */ unsigned char InterfaceGuid[4]; /* +0x0008 44 16 00 00 */ unsigned char InterfaceList[4]; /* +0x000c 71 04 00 00 */ unsigned long InterfaceListSize; /* +0x0010 */ unsigned long Flags; /* +0x0014 */ }; struct _OCSP_BASIC_REVOKED_INFO { unsigned char RevocationDate[8]; /* +0x0000 31 13 00 00 */ unsigned long dwCrlReasonCode; /* +0x0008 */ }; struct _REMOTE_REPLY_SCM_INFO { unsigned long long Oxid; /* +0x0000 */ unsigned char pdsaOxidBindings[4]; /* +0x0008 65 1f 00 00 */ unsigned char ipidRemUnknown[16]; /* +0x000c dc 14 00 00 */ unsigned long authnHint; /* +0x001c */ unsigned char serverVersion[8]; /* +0x0020 66 1f 00 00 */ }; struct _LOOKUP_STREAM_FROM_CLUSTER_OUTPUT { unsigned long Offset; /* +0x0000 */ unsigned long NumberOfMatches; /* +0x0004 */ unsigned long BufferSizeRequired; /* +0x0008 */ }; struct _CACHE_RELATIONSHIP { unsigned char Level; /* +0x0000 */ unsigned char Associativity; /* +0x0001 */ unsigned short LineSize; /* +0x0002 */ unsigned long CacheSize; /* +0x0004 */ unsigned char Type[4]; /* +0x0008 6f 1f 00 00 */ unsigned char Reserved[20]; /* +0x000c 7b 16 00 00 */ unsigned char GroupMask[12]; /* +0x0020 25 1a 00 00 */ }; struct _NDR_CS_SIZE_CONVERT_ROUTINES { unsigned char pfnNetSize[4]; /* +0x0000 8c 1f 00 00 */ unsigned char pfnToNetCs[4]; /* +0x0004 8f 1f 00 00 */ unsigned char pfnLocalSize[4]; /* +0x0008 8c 1f 00 00 */ unsigned char pfnFromNetCs[4]; /* +0x000c 92 1f 00 00 */ }; struct _CERT_REVOCATION_PARA { unsigned long cbSize; /* +0x0000 */ unsigned char pIssuerCert[4]; /* +0x0004 b9 13 00 00 */ unsigned long cCertStore; /* +0x0008 */ unsigned char rgCertStore[4]; /* +0x000c 4f 13 00 00 */ void *hCrlStore; /* +0x0010 */ unsigned char pftTimeToUse[4]; /* +0x0014 73 17 00 00 */ }; struct _CRYPT_DES_KEY_STATE { unsigned char Key[8]; /* +0x0000 7f 19 00 00 */ unsigned char IV[8]; /* +0x0008 7f 19 00 00 */ unsigned char Feedback[8]; /* +0x0010 7f 19 00 00 */ }; struct _CMSG_CTRL_DECRYPT_PARA { unsigned long cbSize; /* +0x0000 */ unsigned long hCryptProv; /* +0x0004 */ unsigned long hNCryptKey; /* +0x0004 */ unsigned long dwKeySpec; /* +0x0008 */ unsigned long dwRecipientIndex; /* +0x000c */ }; struct _IMAGE_ROM_HEADERS { unsigned char FileHeader[20]; /* +0x0000 aa 18 00 00 */ unsigned char OptionalHeader[56]; /* +0x0014 9d 1f 00 00 */ }; struct _LDR_ENUM_RESOURCE_ENTRY::<unnamed-type-Path> { unsigned long NameOrId; /* +0x0000 */ /* unsigned char Name[0]; +0x0000 a5 1f 00 00 */ unsigned short Id; /* +0x0000 */ unsigned short NameIsPresent; /* +0x0002 */ }; struct tagSCROLLBARINFO { unsigned long cbSize; /* +0x0000 */ unsigned char rcScrollBar[16]; /* +0x0004 63 14 00 00 */ unsigned char dxyLineButton[4]; /* +0x0014 74 00 00 00 */ unsigned char xyThumbTop[4]; /* +0x0018 74 00 00 00 */ unsigned char xyThumbBottom[4]; /* +0x001c 74 00 00 00 */ unsigned char reserved[4]; /* +0x0020 74 00 00 00 */ unsigned char rgstate[24]; /* +0x0024 a8 1f 00 00 */ }; struct _IMAGE_DEBUG_DIRECTORY { unsigned long Characteristics; /* +0x0000 */ unsigned long TimeDateStamp; /* +0x0004 */ unsigned short MajorVersion; /* +0x0008 */ unsigned short MinorVersion; /* +0x000a */ unsigned long Type; /* +0x000c */ unsigned long SizeOfData; /* +0x0010 */ unsigned long AddressOfRawData; /* +0x0014 */ unsigned long PointerToRawData; /* +0x0018 */ }; struct _SYSTEM_PROCESSOR_MICROCODE_UPDATE_INFORMATION { unsigned long Operation; /* +0x0000 */ }; struct _RPC_BINDING_HANDLE_TEMPLATE_V1_A { unsigned long Version; /* +0x0000 */ unsigned long Flags; /* +0x0004 */ unsigned long ProtocolSequence; /* +0x0008 */ unsigned char *NetworkAddress; /* +0x000c */ unsigned char *StringEndpoint; /* +0x0010 */ }; struct _RPC_BINDING_HANDLE_TEMPLATE_V1_A::<unnamed-type-u1> { unsigned char *Reserved; /* +0x0000 */ }; struct _CRYPT_ATTRIBUTE_TYPE_VALUE { char *pszObjId; /* +0x0000 */ unsigned char Value[8]; /* +0x0004 02 13 00 00 */ }; struct _TOKEN_USER { unsigned char User[8]; /* +0x0000 12 17 00 00 */ }; struct _MUILANGCFGLIST { unsigned char TotalSize[4]; /* +0x0000 75 00 00 00 */ unsigned short NumLanguages; /* +0x0004 */ unsigned short MaxNumLanguages; /* +0x0006 */ unsigned char LanguageConfigs[4]; /* +0x0008 c5 1f 00 00 */ }; struct _CMSG_RECIPIENT_ENCODE_INFO { unsigned long dwRecipientChoice; /* +0x0000 */ /* unsigned char pKeyTrans[0]; +0x0004 cf 1f 00 00 */ /* unsigned char pKeyAgree[0]; +0x0004 2f 13 00 00 */ unsigned char pMailList[4]; /* +0x0004 d1 1f 00 00 */ }; struct tagEMRANGLEARC { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned char ptlCenter[8]; /* +0x0008 9f 13 00 00 */ unsigned long nRadius; /* +0x0010 */ unsigned char eStartAngle[4]; /* +0x0014 40 00 00 00 */ unsigned char eSweepAngle[4]; /* +0x0018 40 00 00 00 */ }; struct _CRYPT_TIMESTAMP_ACCURACY { unsigned long dwSeconds; /* +0x0000 */ unsigned long dwMillis; /* +0x0004 */ unsigned long dwMicros; /* +0x0008 */ }; struct _VM_COUNTERS { unsigned long PeakVirtualSize; /* +0x0000 */ unsigned long VirtualSize; /* +0x0004 */ unsigned long PageFaultCount; /* +0x0008 */ unsigned long PeakWorkingSetSize; /* +0x000c */ unsigned long WorkingSetSize; /* +0x0010 */ unsigned long QuotaPeakPagedPoolUsage; /* +0x0014 */ unsigned long QuotaPagedPoolUsage; /* +0x0018 */ unsigned long QuotaPeakNonPagedPoolUsage; /* +0x001c */ unsigned long QuotaNonPagedPoolUsage; /* +0x0020 */ unsigned long PagefileUsage; /* +0x0024 */ unsigned long PeakPagefileUsage; /* +0x0028 */ }; struct _SL_KMEM_CACHE { unsigned long TotalSize; /* +0x0000 */ unsigned long SizeOfData; /* +0x0004 */ unsigned long SignatureSize; /* +0x0008 */ unsigned long Flags; /* +0x000c */ unsigned long Version; /* +0x0010 */ unsigned char Descriptors[20]; /* +0x0014 f1 1f 00 00 */ }; struct tagEMRSETARCDIRECTION { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned long iArcDirection; /* +0x0008 */ }; struct tagOpaqueData { unsigned char guid[16]; /* +0x0000 dc 14 00 00 */ unsigned long dataLength; /* +0x0010 */ unsigned long reserved1; /* +0x0014 */ unsigned long reserved2; /* +0x0018 */ unsigned char *data; /* +0x001c */ }; struct _FILE_PIPE_EVENT_BUFFER { unsigned long NamedPipeState; /* +0x0000 */ unsigned long EntryType; /* +0x0004 */ unsigned long ByteCount; /* +0x0008 */ unsigned long KeyValue; /* +0x000c */ unsigned long NumberRequests; /* +0x0010 */ }; struct _SECTION_IMAGE_INFORMATION32 { unsigned long TransferAddress; /* +0x0000 */ unsigned long ZeroBits; /* +0x0004 */ unsigned long MaximumStackSize; /* +0x0008 */ unsigned long CommittedStackSize; /* +0x000c */ unsigned long SubSystemType; /* +0x0010 */ unsigned short SubSystemMinorVersion; /* +0x0014 */ unsigned short SubSystemMajorVersion; /* +0x0016 */ unsigned long SubSystemVersion; /* +0x0014 */ unsigned long GpValue; /* +0x0018 */ unsigned short ImageCharacteristics; /* +0x001c */ unsigned short DllCharacteristics; /* +0x001e */ unsigned short Machine; /* +0x0020 */ unsigned char ImageContainsCode; /* +0x0022 */ unsigned char ImageFlags; /* +0x0023 */ /* unsigned char ComPlus[0]; +0x0023 6f 1e 00 00 */ /* unsigned char ImageDynamicallyRelocated[0]; +0x0023 70 1e 00 00 */ unsigned char Reserved[1]; /* +0x0023 05 20 00 00 */ unsigned long LoaderFlags; /* +0x0024 */ unsigned long ImageFileSize; /* +0x0028 */ unsigned long CheckSum; /* +0x002c */ }; struct _RTL_RB_TREE { unsigned char Root[4]; /* +0x0000 0b 20 00 00 */ unsigned char Min[4]; /* +0x0004 0b 20 00 00 */ }; struct _CONNECTDLGSTRUCTA { unsigned long cbStructure; /* +0x0000 */ unsigned char hwndOwner[4]; /* +0x0004 f1 12 00 00 */ unsigned char lpConnRes[4]; /* +0x0008 00 1e 00 00 */ unsigned long dwFlags; /* +0x000c */ unsigned long dwDevNum; /* +0x0010 */ }; struct _CTL_ENTRY { unsigned char SubjectIdentifier[8]; /* +0x0000 02 13 00 00 */ unsigned long cAttribute; /* +0x0008 */ unsigned char rgAttribute[4]; /* +0x000c d8 13 00 00 */ }; struct _POWER_USER_PRESENCE { unsigned char UserPresence[4]; /* +0x0000 2b 20 00 00 */ }; struct _TOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE { unsigned long long Version; /* +0x0000 */ unsigned char Name[8]; /* +0x0008 dd 12 00 00 */ }; struct _THREAD_TLS_INFORMATION { unsigned long Flags; /* +0x0000 */ void *NewTlsData; /* +0x0004 */ void *OldTlsData; /* +0x0004 */ void *ThreadId; /* +0x0008 */ }; struct _CERT_REQUEST_INFO { unsigned long dwVersion; /* +0x0000 */ unsigned char Subject[8]; /* +0x0004 02 13 00 00 */ unsigned char SubjectPublicKeyInfo[24]; /* +0x000c 36 20 00 00 */ unsigned long cAttribute; /* +0x0024 */ unsigned char rgAttribute[4]; /* +0x0028 d8 13 00 00 */ }; struct _PRIV_RESOLVER_INFO { unsigned long long OxidServer; /* +0x0000 */ unsigned char pServerORBindings[4]; /* +0x0008 65 1f 00 00 */ unsigned char OxidInfo[44]; /* +0x000c 39 20 00 00 */ unsigned long long LocalMidOfRemote; /* +0x0038 */ unsigned long DllServerModel; /* +0x0040 */ unsigned char pwszDllServer[4]; /* +0x0044 71 04 00 00 */ unsigned char FoundInROT[8]; /* +0x0048 74 00 00 00 */ }; struct _RTL_VERIFIER_PAGEHEAP_INFORMATION { unsigned long Size; /* +0x0000 */ unsigned long Flags; /* +0x0004 */ unsigned long HeapFlags; /* +0x0008 */ unsigned long ExtraFlags; /* +0x000c */ unsigned long HeapHandle; /* +0x0010 */ }; struct _THREAD_LAST_SYSCALL_INFORMATION { void *FirstArgument; /* +0x0000 */ unsigned short SystemCallNumber; /* +0x0004 */ }; struct _RTL_PROCESS_LOCK_INFORMATION { void *Address; /* +0x0000 */ unsigned short Type; /* +0x0004 */ unsigned short CreatorBackTraceIndex; /* +0x0006 */ void *OwningThread; /* +0x0008 */ long LockCount; /* +0x000c */ unsigned long ContentionCount; /* +0x0010 */ unsigned long EntryCount; /* +0x0014 */ long RecursionCount; /* +0x0018 */ unsigned long NumberOfWaitingShared; /* +0x001c */ unsigned long NumberOfWaitingExclusive; /* +0x0020 */ }; struct _EXCEPTION_DEBUG_INFO { unsigned char ExceptionRecord[80]; /* +0x0000 4b 20 00 00 */ unsigned long dwFirstChance; /* +0x0050 */ }; struct _CERT_POLICIES_INFO { unsigned long cPolicyInfo; /* +0x0000 */ unsigned char rgPolicyInfo[4]; /* +0x0004 4f 20 00 00 */ }; struct _CMSG_CTRL_KEY_TRANS_DECRYPT_PARA { unsigned long cbSize; /* +0x0000 */ unsigned long hCryptProv; /* +0x0004 */ unsigned long hNCryptKey; /* +0x0004 */ unsigned long dwKeySpec; /* +0x0008 */ unsigned char pKeyTrans[4]; /* +0x000c 53 20 00 00 */ unsigned long dwRecipientIndex; /* +0x0010 */ }; struct tagNEWTEXTMETRICEXA { unsigned char ntmTm[72]; /* +0x0000 56 20 00 00 */ unsigned char ntmFontSig[24]; /* +0x0048 57 20 00 00 */ }; struct _FP_64 { unsigned char W[8]; /* +0x0000 69 15 00 00 */ }; struct _REPARSE_POINT_INFORMATION { unsigned short ReparseDataLength; /* +0x0000 */ unsigned short UnparsedNameLength; /* +0x0002 */ }; struct _SL_KMEM_CACHE_VALUE_DESCRIPTOR { unsigned short Size; /* +0x0000 */ unsigned short NameLength; /* +0x0002 */ unsigned short Type; /* +0x0004 */ unsigned short DataLength; /* +0x0006 */ unsigned long Attributes; /* +0x0008 */ unsigned long Reserved; /* +0x000c */ unsigned char Name[4]; /* +0x0010 f7 13 00 00 */ }; struct _SECTIONBASICINFO { void *BaseAddress; /* +0x0000 */ unsigned long AllocationAttributes; /* +0x0004 */ unsigned char MaximumSize[8]; /* +0x0008 3d 13 00 00 */ }; struct _TRANSACTION_LIST_ENTRY { unsigned char UOW[16]; /* +0x0000 dc 14 00 00 */ }; struct _THREAD_PERFORMANCE_DATA { unsigned short Size; /* +0x0000 */ unsigned short Version; /* +0x0002 */ unsigned char ProcessorNumber[4]; /* +0x0004 7e 20 00 00 */ unsigned long ContextSwitches; /* +0x0008 */ unsigned long HwCountersCount; /* +0x000c */ unsigned char UpdateCount[8]; /* +0x0010 c4 17 00 00 */ unsigned long long WaitReasonBitMap; /* +0x0018 */ unsigned long long HardwareCounters; /* +0x0020 */ unsigned char CycleTime[24]; /* +0x0028 7f 20 00 00 */ unsigned char HwCounters[384]; /* +0x0040 80 20 00 00 */ }; struct _FILESYSTEM_STATISTICS { unsigned short FileSystemType; /* +0x0000 */ unsigned short Version; /* +0x0002 */ unsigned long SizeOfCompleteStructure; /* +0x0004 */ unsigned long UserFileReads; /* +0x0008 */ unsigned long UserFileReadBytes; /* +0x000c */ unsigned long UserDiskReads; /* +0x0010 */ unsigned long UserFileWrites; /* +0x0014 */ unsigned long UserFileWriteBytes; /* +0x0018 */ unsigned long UserDiskWrites; /* +0x001c */ unsigned long MetaDataReads; /* +0x0020 */ unsigned long MetaDataReadBytes; /* +0x0024 */ unsigned long MetaDataDiskReads; /* +0x0028 */ unsigned long MetaDataWrites; /* +0x002c */ unsigned long MetaDataWriteBytes; /* +0x0030 */ unsigned long MetaDataDiskWrites; /* +0x0034 */ }; struct tagACCEL { unsigned char fVirt; /* +0x0000 */ unsigned short key; /* +0x0002 */ unsigned short cmd; /* +0x0004 */ }; struct _CERT_PHYSICAL_STORE_INFO { unsigned long cbSize; /* +0x0000 */ char *pszOpenStoreProvider; /* +0x0004 */ unsigned long dwOpenEncodingType; /* +0x0008 */ unsigned long dwOpenFlags; /* +0x000c */ unsigned char OpenParameters[8]; /* +0x0010 02 13 00 00 */ unsigned long dwFlags; /* +0x0018 */ unsigned long dwPriority; /* +0x001c */ }; struct _FXSAVE_FORMAT { unsigned short ControlWord; /* +0x0000 */ unsigned short StatusWord; /* +0x0002 */ unsigned short TagWord; /* +0x0004 */ unsigned short ErrorOpcode; /* +0x0006 */ unsigned long ErrorOffset; /* +0x0008 */ unsigned long ErrorSelector; /* +0x000c */ unsigned long DataOffset; /* +0x0010 */ unsigned long DataSelector; /* +0x0014 */ unsigned long MXCsr; /* +0x0018 */ unsigned long MXCsrMask; /* +0x001c */ unsigned char RegisterArea[128]; /* +0x0020 8c 20 00 00 */ unsigned char Reserved3[128]; /* +0x00a0 8c 20 00 00 */ unsigned char Reserved4[192]; /* +0x0120 8d 20 00 00 */ }; struct _MEMORY_WORKING_SET_EX_BLOCK { /* unsigned char Valid[0]; +0x0000 17 13 00 00 */ /* unsigned char ShareCount[0]; +0x0000 90 20 00 00 */ /* unsigned char Win32Protection[0]; +0x0000 91 20 00 00 */ /* unsigned char Shared[0]; +0x0000 92 20 00 00 */ /* unsigned char Node[0]; +0x0000 93 20 00 00 */ /* unsigned char Locked[0]; +0x0000 94 20 00 00 */ /* unsigned char LargePage[0]; +0x0000 95 20 00 00 */ /* unsigned char Priority[0]; +0x0000 96 20 00 00 */ /* unsigned char Reserved[0]; +0x0000 97 20 00 00 */ /* unsigned char Bad[0]; +0x0000 95 18 00 00 */ unsigned char Invalid[4]; /* +0x0000 98 20 00 00 */ }; struct tagLOGFONTW { long lfHeight; /* +0x0000 */ long lfWidth; /* +0x0004 */ long lfEscapement; /* +0x0008 */ long lfOrientation; /* +0x000c */ long lfWeight; /* +0x0010 */ unsigned char lfItalic; /* +0x0014 */ unsigned char lfUnderline; /* +0x0015 */ unsigned char lfStrikeOut; /* +0x0016 */ unsigned char lfCharSet; /* +0x0017 */ unsigned char lfOutPrecision; /* +0x0018 */ unsigned char lfClipPrecision; /* +0x0019 */ unsigned char lfQuality; /* +0x001a */ unsigned char lfPitchAndFamily; /* +0x001b */ unsigned char lfFaceName[64]; /* +0x001c a5 15 00 00 */ }; struct tagEMRARC { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned char rclBox[16]; /* +0x0008 d5 12 00 00 */ unsigned char ptlStart[8]; /* +0x0018 9f 13 00 00 */ unsigned char ptlEnd[8]; /* +0x0020 9f 13 00 00 */ }; struct tagCOPYDATASTRUCT { unsigned long dwData; /* +0x0000 */ unsigned long cbData; /* +0x0004 */ void *lpData; /* +0x0008 */ }; struct tagMINIMIZEDMETRICS { unsigned char cbSize[4]; /* +0x0000 75 00 00 00 */ unsigned char iWidth[4]; /* +0x0004 74 00 00 00 */ unsigned char iHorzGap[4]; /* +0x0008 74 00 00 00 */ unsigned char iVertGap[4]; /* +0x000c 74 00 00 00 */ unsigned char iArrange[4]; /* +0x0010 74 00 00 00 */ }; struct tagINPUT_MESSAGE_SOURCE { unsigned char deviceType[4]; /* +0x0000 a5 20 00 00 */ unsigned char originId[4]; /* +0x0004 a6 20 00 00 */ }; struct _CERT_KEYGEN_REQUEST_INFO { unsigned long dwVersion; /* +0x0000 */ unsigned char SubjectPublicKeyInfo[24]; /* +0x0004 36 20 00 00 */ unsigned char pwszChallengeString[4]; /* +0x001c 71 04 00 00 */ }; struct _IMAGE_ALPHA_RUNTIME_FUNCTION_ENTRY { unsigned long BeginAddress; /* +0x0000 */ unsigned long EndAddress; /* +0x0004 */ unsigned long ExceptionHandler; /* +0x0008 */ unsigned long HandlerData; /* +0x000c */ unsigned long PrologEndAddress; /* +0x0010 */ }; struct _SYSTEM_BASIC_PERFORMANCE_INFORMATION { unsigned long AvailablePages; /* +0x0000 */ unsigned long CommittedPages; /* +0x0004 */ unsigned long CommitLimit; /* +0x0008 */ unsigned long PeakCommitment; /* +0x000c */ }; struct _EISA_IRQ_CONFIGURATION { unsigned char ConfigurationByte[1]; /* +0x0000 d8 20 00 00 */ unsigned char Reserved; /* +0x0001 */ }; struct _RESOURCEMANAGER_BASIC_INFORMATION { unsigned char ResourceManagerId[16]; /* +0x0000 dc 14 00 00 */ unsigned long DescriptionLength; /* +0x0010 */ unsigned char Description[4]; /* +0x0014 f7 13 00 00 */ }; struct tagHELPWININFOA { unsigned char wStructSize[4]; /* +0x0000 74 00 00 00 */ unsigned char x[4]; /* +0x0004 74 00 00 00 */ unsigned char y[4]; /* +0x0008 74 00 00 00 */ unsigned char dx[4]; /* +0x000c 74 00 00 00 */ unsigned char dy[4]; /* +0x0010 74 00 00 00 */ unsigned char wMax[4]; /* +0x0014 74 00 00 00 */ unsigned char rgchMember[4]; /* +0x0018 dd 20 00 00 */ }; struct _TRIPLE_LIST { /* unsigned char ControlBits[0]; +0x0000 e0 20 00 00 */ unsigned char CombinedControlBits[4]; /* +0x0000 c3 17 00 00 */ unsigned char Head[16]; /* +0x0004 41 17 00 00 */ unsigned char Tail[12]; /* +0x0014 e1 20 00 00 */ unsigned char RemoveCallback[4]; /* +0x0020 10 20 00 00 */ void *RemoveContext; /* +0x0024 */ unsigned char PendingHead[4]; /* +0x0028 42 17 00 00 */ unsigned char PendingTailPtr[4]; /* +0x002c e2 20 00 00 */ unsigned long PendingListIndex; /* +0x0030 */ }; struct _TRIPLE_LIST::<unnamed-tag>::<unnamed-type-ControlBits> { /* unsigned char SwitchSelectorBit0[0]; +0x0000 bc 17 00 00 */ /* unsigned char ActiveListBit0[0]; +0x0000 bd 17 00 00 */ /* unsigned char OverflowActiveListBit0[0]; +0x0000 be 17 00 00 */ /* unsigned char SwitchSelectorBit1[0]; +0x0000 bf 17 00 00 */ /* unsigned char ActiveListBit1[0]; +0x0000 c0 17 00 00 */ /* unsigned char OverflowActiveListBit1[0]; +0x0000 c1 17 00 00 */ /* unsigned char ReaderDidTheSwitch[0]; +0x0000 c2 17 00 00 */ /* unsigned char Reserved[0]; +0x0000 e5 20 00 00 */ /* unsigned char ReaderBusy[0]; +0x0000 e6 20 00 00 */ /* unsigned char UpdateReady[0]; +0x0000 e7 20 00 00 */ unsigned char OverflowUpdateReady[4]; /* +0x0000 e8 20 00 00 */ }; struct _RTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION { void *ReflectionProcessHandle; /* +0x0000 */ void *ReflectionThreadHandle; /* +0x0004 */ unsigned char ReflectionClientId[8]; /* +0x0008 3e 13 00 00 */ }; struct _COMPATIBILITY_CONTEXT_ELEMENT { unsigned char Id[16]; /* +0x0000 dc 14 00 00 */ unsigned char Type[4]; /* +0x0010 ed 20 00 00 */ }; struct tagENUMLOGFONTEXDVA { unsigned char elfEnumLogfontEx[188]; /* +0x0000 00 21 00 00 */ unsigned char elfDesignVector[72]; /* +0x00bc 01 21 00 00 */ }; struct _SHFILEINFOW { unsigned char hIcon[4]; /* +0x0000 07 21 00 00 */ unsigned char iIcon[4]; /* +0x0004 74 00 00 00 */ unsigned long dwAttributes; /* +0x0008 */ unsigned char szDisplayName[520]; /* +0x000c e4 15 00 00 */ unsigned char szTypeName[160]; /* +0x0214 08 21 00 00 */ }; struct _SYSTEM_BOOT_GRAPHICS_INFORMATION { unsigned char FrameBuffer[8]; /* +0x0000 3d 13 00 00 */ unsigned long Width; /* +0x0008 */ unsigned long Height; /* +0x000c */ unsigned long PixelStride; /* +0x0010 */ unsigned long Flags; /* +0x0014 */ unsigned char Format[8]; /* +0x0018 0d 21 00 00 */ }; struct _SYSDBG_IO_SPACE { unsigned long long Address; /* +0x0000 */ void *Buffer; /* +0x0008 */ unsigned long Request; /* +0x000c */ unsigned char InterfaceType[4]; /* +0x0010 10 21 00 00 */ unsigned long BusNumber; /* +0x0014 */ unsigned long AddressSpace; /* +0x0018 */ }; struct tagTEXTMETRICW { long tmHeight; /* +0x0000 */ long tmAscent; /* +0x0004 */ long tmDescent; /* +0x0008 */ long tmInternalLeading; /* +0x000c */ long tmExternalLeading; /* +0x0010 */ long tmAveCharWidth; /* +0x0014 */ long tmMaxCharWidth; /* +0x0018 */ long tmWeight; /* +0x001c */ long tmOverhang; /* +0x0020 */ long tmDigitizedAspectX; /* +0x0024 */ long tmDigitizedAspectY; /* +0x0028 */ unsigned char tmFirstChar[2]; /* +0x002c 71 00 00 00 */ unsigned char tmLastChar[2]; /* +0x002e 71 00 00 00 */ unsigned char tmDefaultChar[2]; /* +0x0030 71 00 00 00 */ unsigned char tmBreakChar[2]; /* +0x0032 71 00 00 00 */ unsigned char tmItalic; /* +0x0034 */ unsigned char tmUnderlined; /* +0x0035 */ unsigned char tmStruckOut; /* +0x0036 */ unsigned char tmPitchAndFamily; /* +0x0037 */ unsigned char tmCharSet; /* +0x0038 */ }; struct _SCRUB_DATA_OUTPUT { unsigned long Flags; /* +0x0000 */ unsigned long ExtentCount; /* +0x0004 */ unsigned long Status; /* +0x0008 */ unsigned long Reserved; /* +0x000c */ unsigned char ResumeContext[816]; /* +0x0010 f8 15 00 00 */ unsigned char Extents[16]; /* +0x0340 18 21 00 00 */ }; struct _OSVERSIONINFOW { unsigned long dwOSVersionInfoSize; /* +0x0000 */ unsigned long dwMajorVersion; /* +0x0004 */ unsigned long dwMinorVersion; /* +0x0008 */ unsigned long dwBuildNumber; /* +0x000c */ unsigned long dwPlatformId; /* +0x0010 */ unsigned char szCSDVersion[256]; /* +0x0014 a7 15 00 00 */ }; struct _LARGE_INTEGER { unsigned long LowPart; /* +0x0000 */ long HighPart; /* +0x0004 */ }; struct _SYSTEM_POOL_INFORMATION { unsigned long TotalSize; /* +0x0000 */ void *FirstEntry; /* +0x0004 */ unsigned short EntryOverhead; /* +0x0008 */ unsigned char PoolTagPresent; /* +0x000a */ unsigned char Spare0; /* +0x000b */ unsigned long NumberOfEntries; /* +0x000c */ unsigned char Entries[12]; /* +0x0010 27 21 00 00 */ }; struct _HEAP_SUMMARY { unsigned long cb; /* +0x0000 */ unsigned long cbAllocated; /* +0x0004 */ unsigned long cbCommitted; /* +0x0008 */ unsigned long cbReserved; /* +0x000c */ unsigned long cbMaxReserve; /* +0x0010 */ }; struct _COMM_FAULT_OFFSETS { short CommOffset; /* +0x0000 */ short FaultOffset; /* +0x0002 */ }; struct __BCRYPT_KEY_LENGTHS_STRUCT { unsigned long dwMinLength; /* +0x0000 */ unsigned long dwMaxLength; /* +0x0004 */ unsigned long dwIncrement; /* +0x0008 */ }; struct _CRYPT_PROPERTY_REF { unsigned char pszProperty[4]; /* +0x0000 71 04 00 00 */ unsigned long cbValue; /* +0x0004 */ unsigned char *pbValue; /* +0x0008 */ }; struct _SYSTEM_PROCESS_INFORMATION { unsigned long NextEntryOffset; /* +0x0000 */ unsigned long NumberOfThreads; /* +0x0004 */ unsigned char WorkingSetPrivateSize[8]; /* +0x0008 3d 13 00 00 */ unsigned long HardFaultCount; /* +0x0010 */ unsigned long NumberOfThreadsHighWatermark; /* +0x0014 */ unsigned long long CycleTime; /* +0x0018 */ unsigned char CreateTime[8]; /* +0x0020 3d 13 00 00 */ unsigned char UserTime[8]; /* +0x0028 3d 13 00 00 */ unsigned char KernelTime[8]; /* +0x0030 3d 13 00 00 */ unsigned char ImageName[8]; /* +0x0038 dd 12 00 00 */ long BasePriority; /* +0x0040 */ void *UniqueProcessId; /* +0x0044 */ void *InheritedFromUniqueProcessId; /* +0x0048 */ unsigned long HandleCount; /* +0x004c */ unsigned long SessionId; /* +0x0050 */ unsigned long UniqueProcessKey; /* +0x0054 */ unsigned long PeakVirtualSize; /* +0x0058 */ unsigned long VirtualSize; /* +0x005c */ unsigned long PageFaultCount; /* +0x0060 */ unsigned long PeakWorkingSetSize; /* +0x0064 */ unsigned long WorkingSetSize; /* +0x0068 */ unsigned long QuotaPeakPagedPoolUsage; /* +0x006c */ unsigned long QuotaPagedPoolUsage; /* +0x0070 */ unsigned long QuotaPeakNonPagedPoolUsage; /* +0x0074 */ unsigned long QuotaNonPagedPoolUsage; /* +0x0078 */ unsigned long PagefileUsage; /* +0x007c */ unsigned long PeakPagefileUsage; /* +0x0080 */ unsigned long PrivatePageCount; /* +0x0084 */ unsigned char ReadOperationCount[8]; /* +0x0088 3d 13 00 00 */ unsigned char WriteOperationCount[8]; /* +0x0090 3d 13 00 00 */ unsigned char OtherOperationCount[8]; /* +0x0098 3d 13 00 00 */ unsigned char ReadTransferCount[8]; /* +0x00a0 3d 13 00 00 */ unsigned char WriteTransferCount[8]; /* +0x00a8 3d 13 00 00 */ unsigned char OtherTransferCount[8]; /* +0x00b0 3d 13 00 00 */ }; struct _KEY_VALUE_ENTRY { unsigned char ValueName[4]; /* +0x0000 a2 17 00 00 */ unsigned long DataLength; /* +0x0004 */ unsigned long DataOffset; /* +0x0008 */ unsigned long Type; /* +0x000c */ }; struct _CRYPT_ENCODE_PARA { unsigned long cbSize; /* +0x0000 */ unsigned char pfnAlloc[4]; /* +0x0004 66 19 00 00 */ unsigned char pfnFree[4]; /* +0x0008 c7 13 00 00 */ }; struct _REPAIR_COPIES_INPUT { unsigned long Flags; /* +0x0000 */ unsigned char FileOffset[8]; /* +0x0008 3d 13 00 00 */ unsigned long Length; /* +0x0010 */ unsigned long SourceCopy; /* +0x0014 */ unsigned long NumberOfRepairCopies; /* +0x0018 */ unsigned char RepairCopies[4]; /* +0x001c f6 12 00 00 */ }; struct _PEBS_DS_SAVE_AREA { unsigned long long BtsBufferBase; /* +0x0000 */ unsigned long long BtsIndex; /* +0x0008 */ unsigned long long BtsAbsoluteMaximum; /* +0x0010 */ unsigned long long BtsInterruptThreshold; /* +0x0018 */ unsigned long long PebsBufferBase; /* +0x0020 */ unsigned long long PebsIndex; /* +0x0028 */ unsigned long long PebsAbsoluteMaximum; /* +0x0030 */ unsigned long long PebsInterruptThreshold; /* +0x0038 */ unsigned long long PebsCounterReset0; /* +0x0040 */ unsigned long long PebsCounterReset1; /* +0x0048 */ unsigned long long PebsCounterReset2; /* +0x0050 */ unsigned long long PebsCounterReset3; /* +0x0058 */ }; struct _CERT_TEMPLATE_EXT { char *pszObjId; /* +0x0000 */ unsigned long dwMajorVersion; /* +0x0004 */ unsigned char fMinorVersion[4]; /* +0x0008 74 00 00 00 */ unsigned long dwMinorVersion; /* +0x000c */ }; struct _EFI_DRIVER_ENTRY { unsigned long Version; /* +0x0000 */ unsigned long Length; /* +0x0004 */ unsigned long Id; /* +0x0008 */ unsigned long FriendlyNameOffset; /* +0x000c */ unsigned long DriverFilePathOffset; /* +0x0010 */ }; struct _RTL_AVL_TABLE { unsigned char BalancedRoot[16]; /* +0x0000 e2 1b 00 00 */ void *OrderedPointer; /* +0x0010 */ unsigned long WhichOrderedElement; /* +0x0014 */ unsigned long NumberGenericTableElements; /* +0x0018 */ unsigned long DepthOfTree; /* +0x001c */ unsigned char RestartKey[4]; /* +0x0020 5e 21 00 00 */ unsigned long DeleteCount; /* +0x0024 */ unsigned char CompareRoutine[4]; /* +0x0028 61 21 00 00 */ unsigned char AllocateRoutine[4]; /* +0x002c a7 1b 00 00 */ unsigned char FreeRoutine[4]; /* +0x0030 64 21 00 00 */ void *TableContext; /* +0x0034 */ }; struct tagTITLEBARINFO { unsigned long cbSize; /* +0x0000 */ unsigned char rcTitleBar[16]; /* +0x0004 63 14 00 00 */ unsigned char rgstate[24]; /* +0x0014 a8 1f 00 00 */ }; struct _RPC_IF_ID { unsigned char Uuid[16]; /* +0x0000 dc 14 00 00 */ unsigned short VersMajor; /* +0x0010 */ unsigned short VersMinor; /* +0x0012 */ }; struct _PLUGPLAY_CONTROL_CONFLICT_ENTRY { unsigned long DeviceInstance; /* +0x0000 */ unsigned long DeviceFlags; /* +0x0004 */ unsigned long ResourceType; /* +0x0008 */ unsigned long long ResourceStart; /* +0x0010 */ unsigned long long ResourceEnd; /* +0x0018 */ unsigned long ResourceFlags; /* +0x0020 */ }; struct _FILE_NETWORK_OPEN_INFORMATION { unsigned char CreationTime[8]; /* +0x0000 3d 13 00 00 */ unsigned char LastAccessTime[8]; /* +0x0008 3d 13 00 00 */ unsigned char LastWriteTime[8]; /* +0x0010 3d 13 00 00 */ unsigned char ChangeTime[8]; /* +0x0018 3d 13 00 00 */ unsigned char AllocationSize[8]; /* +0x0020 3d 13 00 00 */ unsigned char EndOfFile[8]; /* +0x0028 3d 13 00 00 */ unsigned long FileAttributes; /* +0x0030 */ }; struct _PO_WAKE_SOURCE_INFO { unsigned long Count; /* +0x0000 */ unsigned char Offsets[4]; /* +0x0004 f6 12 00 00 */ }; struct _userHMETAFILE { long fContext; /* +0x0000 */ }; struct _APPCATEGORYINFOLIST { unsigned long cCategory; /* +0x0000 */ unsigned char pCategoryInfo[4]; /* +0x0004 84 21 00 00 */ }; struct _RTL_DEBUG_INFORMATION32 { unsigned long SectionHandleClient; /* +0x0000 */ unsigned long ViewBaseClient; /* +0x0004 */ unsigned long ViewBaseTarget; /* +0x0008 */ unsigned long ViewBaseDelta; /* +0x000c */ unsigned long EventPairClient; /* +0x0010 */ unsigned long EventPairTarget; /* +0x0014 */ unsigned long TargetProcessId; /* +0x0018 */ unsigned long TargetThreadHandle; /* +0x001c */ unsigned long Flags; /* +0x0020 */ unsigned long OffsetFree; /* +0x0024 */ unsigned long CommitSize; /* +0x0028 */ unsigned long ViewSize; /* +0x002c */ unsigned long Modules; /* +0x0030 */ unsigned long ModulesEx; /* +0x0030 */ unsigned long BackTraces; /* +0x0034 */ unsigned long Heaps; /* +0x0038 */ unsigned long Locks; /* +0x003c */ unsigned long SpecificHeap; /* +0x0040 */ unsigned long TargetProcessHandle; /* +0x0044 */ unsigned long VerifierOptions; /* +0x0048 */ unsigned long ProcessHeap; /* +0x004c */ unsigned long CriticalSectionHandle; /* +0x0050 */ unsigned long CriticalSectionOwnerThread; /* +0x0054 */ unsigned char Reserved[16]; /* +0x0058 4f 1a 00 00 */ }; struct tagAXISINFOW { long axMinValue; /* +0x0000 */ long axMaxValue; /* +0x0004 */ unsigned char axAxisName[32]; /* +0x0008 8c 21 00 00 */ }; struct tagRemFORMATETC { unsigned long cfFormat; /* +0x0000 */ unsigned long ptd; /* +0x0004 */ unsigned long dwAspect; /* +0x0008 */ long lindex; /* +0x000c */ unsigned long tymed; /* +0x0010 */ }; struct _TP_DIRECT { unsigned char Task[20]; /* +0x0000 93 21 00 00 */ unsigned long Lock; /* +0x0014 */ unsigned char IoCompletionInformationList[8]; /* +0x0018 44 1f 00 00 */ unsigned char Callback[4]; /* +0x0020 98 21 00 00 */ unsigned long NumaNode; /* +0x0024 */ unsigned char IdealProcessor; /* +0x0028 */ }; struct _RTL_CRITICAL_SECTION64 { unsigned long long DebugInfo; /* +0x0000 */ long LockCount; /* +0x0008 */ long RecursionCount; /* +0x000c */ unsigned long long OwningThread; /* +0x0010 */ unsigned long long LockSemaphore; /* +0x0018 */ unsigned long long SpinCount; /* +0x0020 */ }; struct tagENUMLOGFONTA { unsigned char elfLogFont[60]; /* +0x0000 c2 16 00 00 */ unsigned char elfFullName[64]; /* +0x003c 13 13 00 00 */ unsigned char elfStyle[32]; /* +0x007c e5 17 00 00 */ }; struct tagMOUSEHOOKSTRUCT { unsigned char pt[8]; /* +0x0000 8a 14 00 00 */ unsigned char hwnd[4]; /* +0x0008 f1 12 00 00 */ unsigned char wHitTestCode[4]; /* +0x000c 75 00 00 00 */ unsigned long dwExtraInfo; /* +0x0010 */ }; struct _REMOTE_REQUEST_SCM_INFO { unsigned long ClientImpLevel; /* +0x0000 */ unsigned short cRequestedProtseqs; /* +0x0004 */ unsigned short *pRequestedProtseqs; /* +0x0008 */ }; struct _PO_WAKE_SOURCE_FIXED { unsigned char Header[8]; /* +0x0000 0b 18 00 00 */ unsigned char FixedWakeSourceType[4]; /* +0x0008 29 16 00 00 */ }; struct _SYSTEM_PREFETCH_STATS { unsigned long DemandFilePageCount; /* +0x0000 */ unsigned long DemandFileIOCount; /* +0x0004 */ unsigned long TrickleFilePageCount; /* +0x0008 */ unsigned long TrickleFileIOCount; /* +0x000c */ unsigned long DemandPrivatePageCount; /* +0x0010 */ unsigned long DemandPrivateIOCount; /* +0x0014 */ unsigned long TricklePrivatePageCount; /* +0x0018 */ unsigned long TricklePrivateIOCount; /* +0x001c */ }; struct _AVRF_PROCESS_HANDLE_TRACING_QUERY_WOW64 { unsigned long long Handle; /* +0x0000 */ unsigned long TotalTraces; /* +0x0008 */ unsigned char HandleTrace[160]; /* +0x0010 b6 21 00 00 */ }; struct tagMOUSEKEYS { unsigned char cbSize[4]; /* +0x0000 75 00 00 00 */ unsigned long dwFlags; /* +0x0004 */ unsigned long iMaxSpeed; /* +0x0008 */ unsigned long iTimeToMaxSpeed; /* +0x000c */ unsigned long iCtrlSpeed; /* +0x0010 */ unsigned long dwReserved1; /* +0x0014 */ unsigned long dwReserved2; /* +0x0018 */ }; struct _PEB_LDR_DATA { unsigned long Length; /* +0x0000 */ unsigned char Initialized; /* +0x0004 */ void *SsHandle; /* +0x0008 */ unsigned char InLoadOrderModuleList[8]; /* +0x000c 44 1f 00 00 */ unsigned char InMemoryOrderModuleList[8]; /* +0x0014 44 1f 00 00 */ unsigned char InInitializationOrderModuleList[8]; /* +0x001c 44 1f 00 00 */ void *EntryInProgress; /* +0x0024 */ unsigned char ShutdownInProgress; /* +0x0028 */ void *ShutdownThreadId; /* +0x002c */ }; struct _MUICCENTRY { unsigned char lCultureNameOffset[4]; /* +0x0000 75 00 00 00 */ unsigned char ulCultureID[4]; /* +0x0004 75 00 00 00 */ unsigned long ulLanguageType; /* +0x0008 */ unsigned char pNeutralCulture[4]; /* +0x000c c0 21 00 00 */ unsigned char lBaseLanguageIndices[16]; /* +0x0010 c1 21 00 00 */ unsigned char lParentLanguageIndices[16]; /* +0x0020 c2 21 00 00 */ }; struct _RPC_POLICY { unsigned char Length[4]; /* +0x0000 75 00 00 00 */ unsigned long EndpointFlags; /* +0x0004 */ unsigned long NICFlags; /* +0x0008 */ }; struct _FILE_QUERY_SPARING_BUFFER { unsigned long SparingUnitBytes; /* +0x0000 */ unsigned char SoftwareSparing; /* +0x0004 */ unsigned long TotalSpareBlocks; /* +0x0008 */ unsigned long FreeSpareBlocks; /* +0x000c */ }; struct _SYSTEM_CONSOLE_INFORMATION { /* unsigned char DriverLoaded[0]; +0x0000 17 13 00 00 */ unsigned char Spare[4]; /* +0x0000 8e 13 00 00 */ }; struct _TRIPLE_LIST_ENTRY { unsigned char Flink[12]; /* +0x0000 e1 20 00 00 */ unsigned char Blink[4]; /* +0x000c 42 17 00 00 */ }; struct _JOBOBJECT_SECURITY_LIMIT_INFORMATION { unsigned long SecurityLimitFlags; /* +0x0000 */ void *JobToken; /* +0x0004 */ unsigned char SidsToDisable[4]; /* +0x0008 d8 21 00 00 */ unsigned char PrivilegesToDelete[4]; /* +0x000c da 21 00 00 */ unsigned char RestrictedSids[4]; /* +0x0010 d8 21 00 00 */ }; struct _JOBOBJECT_CPU_RATE_CONTROL_INFORMATION { unsigned long ControlFlags; /* +0x0000 */ unsigned long CpuRate; /* +0x0004 */ unsigned long Weight; /* +0x0004 */ }; struct tagAXISINFOA { long axMinValue; /* +0x0000 */ long axMaxValue; /* +0x0004 */ unsigned char axAxisName[16]; /* +0x0008 09 1c 00 00 */ }; struct _IMAGE_CE_RUNTIME_FUNCTION_ENTRY { unsigned long FuncStart; /* +0x0000 */ /* unsigned char PrologLen[0]; +0x0004 84 13 00 00 */ /* unsigned char FuncLen[0]; +0x0004 e8 21 00 00 */ /* unsigned char ThirtyTwoBit[0]; +0x0004 e9 21 00 00 */ unsigned char ExceptionFlag[4]; /* +0x0004 95 18 00 00 */ }; struct _SYSTEM_WORKINGSET_ENTRY { unsigned long UniqueProcessId; /* +0x0000 */ unsigned long SessionId; /* +0x0000 */ unsigned long WorkingSetPageCount; /* +0x0004 */ unsigned long CommitPageCount; /* +0x0008 */ unsigned long PagedPoolPageCount; /* +0x000c */ unsigned long VirtualSizeInPages; /* +0x000c */ unsigned long PrivateWorkingSetPageCount; /* +0x0010 */ }; struct _tagDdeClassInfo { unsigned long dwContextMask; /* +0x0000 */ unsigned char fClaimFactory[4]; /* +0x0004 74 00 00 00 */ unsigned long dwContext; /* +0x0008 */ unsigned long dwFlags; /* +0x000c */ unsigned long dwThreadId; /* +0x0010 */ unsigned long dwRegistrationKey; /* +0x0014 */ unsigned char punk[4]; /* +0x0018 7f 17 00 00 */ }; struct tagSERIALKEYSA { unsigned char cbSize[4]; /* +0x0000 75 00 00 00 */ unsigned long dwFlags; /* +0x0004 */ char *lpszActivePort; /* +0x0008 */ char *lpszPort; /* +0x000c */ unsigned char iBaudRate[4]; /* +0x0010 75 00 00 00 */ unsigned char iPortState[4]; /* +0x0014 75 00 00 00 */ unsigned char iActive[4]; /* +0x0018 75 00 00 00 */ }; struct _NDR_CS_ROUTINES { unsigned char pSizeConvertRoutines[4]; /* +0x0000 fa 21 00 00 */ unsigned char pTagGettingRoutines[4]; /* +0x0004 fe 21 00 00 */ }; struct tagSOAP_ACTIVATION_INFO { unsigned char bSoapActivated[4]; /* +0x0000 74 00 00 00 */ long lMode; /* +0x0004 */ unsigned char bstrVRoot[4]; /* +0x0008 71 04 00 00 */ unsigned char bstrMailTo[4]; /* +0x000c 71 04 00 00 */ unsigned char bstrAssemblyName[4]; /* +0x0010 71 04 00 00 */ unsigned char bstrTypeName[4]; /* +0x0014 71 04 00 00 */ unsigned char bstrBaseUrl[4]; /* +0x0018 71 04 00 00 */ }; struct _wireSAFEARR_HAVEIID { unsigned long Size; /* +0x0000 */ unsigned char apUnknown[4]; /* +0x0004 13 22 00 00 */ unsigned char iid[16]; /* +0x0008 dc 14 00 00 */ }; struct ANON_OBJECT_HEADER { unsigned short Sig1; /* +0x0000 */ unsigned short Sig2; /* +0x0002 */ unsigned short Version; /* +0x0004 */ unsigned short Machine; /* +0x0006 */ unsigned long TimeDateStamp; /* +0x0008 */ unsigned char ClassID[16]; /* +0x000c dc 14 00 00 */ unsigned long SizeOfData; /* +0x001c */ }; struct _TXFS_ROLLFORWARD_REDO_INFORMATION { unsigned char LastVirtualClock[8]; /* +0x0000 3d 13 00 00 */ unsigned long long LastRedoLsn; /* +0x0008 */ unsigned long long HighestRecoveryLsn; /* +0x0010 */ unsigned long Flags; /* +0x0018 */ }; struct _RTL_CRITICAL_SECTION_DEBUG { unsigned short Type; /* +0x0000 */ unsigned short CreatorBackTraceIndex; /* +0x0002 */ unsigned char CriticalSection[4]; /* +0x0004 61 1f 00 00 */ unsigned char ProcessLocksList[8]; /* +0x0008 44 1f 00 00 */ unsigned long EntryCount; /* +0x0010 */ unsigned long ContentionCount; /* +0x0014 */ unsigned long Flags; /* +0x0018 */ unsigned short CreatorBackTraceIndexHigh; /* +0x001c */ unsigned short SpareUSHORT; /* +0x001e */ }; struct _BYTE_BLOB { unsigned long clSize; /* +0x0000 */ unsigned char abData[4]; /* +0x0004 f9 12 00 00 */ }; struct tagEMREXTESCAPE { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned char iEscape[4]; /* +0x0008 74 00 00 00 */ unsigned char cbEscData[4]; /* +0x000c 74 00 00 00 */ unsigned char EscData[4]; /* +0x0010 f9 12 00 00 */ }; struct tagEVENTMSG { unsigned char message[4]; /* +0x0000 75 00 00 00 */ unsigned char paramL[4]; /* +0x0004 75 00 00 00 */ unsigned char paramH[4]; /* +0x0008 75 00 00 00 */ unsigned long time; /* +0x000c */ unsigned char hwnd[4]; /* +0x0010 f1 12 00 00 */ }; struct __NCRYPT_SUPPORTED_LENGTHS { unsigned long dwMinLength; /* +0x0000 */ unsigned long dwMaxLength; /* +0x0004 */ unsigned long dwIncrement; /* +0x0008 */ unsigned long dwDefaultLength; /* +0x000c */ }; struct _SID_IDENTIFIER_AUTHORITY { unsigned char Value[6]; /* +0x0000 3c 22 00 00 */ }; struct _GUID { unsigned long Data1; /* +0x0000 */ unsigned short Data2; /* +0x0004 */ unsigned short Data3; /* +0x0006 */ unsigned char Data4[8]; /* +0x0008 7f 19 00 00 */ }; struct _FILE_FS_FULL_SIZE_INFORMATION { unsigned char TotalAllocationUnits[8]; /* +0x0000 3d 13 00 00 */ unsigned char CallerAvailableAllocationUnits[8]; /* +0x0008 3d 13 00 00 */ unsigned char ActualAvailableAllocationUnits[8]; /* +0x0010 3d 13 00 00 */ unsigned long SectorsPerAllocationUnit; /* +0x0018 */ unsigned long BytesPerSector; /* +0x001c */ }; struct _SYSTEM_PROCESS_ID_INFORMATION { void *ProcessId; /* +0x0000 */ unsigned char ImageName[8]; /* +0x0004 dd 12 00 00 */ }; struct _SYSTEM_PREFETCH_OPTIONS { /* unsigned char LowerPriority[0]; +0x0000 17 13 00 00 */ /* unsigned char VirtualOffsets[0]; +0x0000 7e 18 00 00 */ /* unsigned char TrickleIOs[0]; +0x0000 7f 18 00 00 */ /* unsigned char SkipInStorePages[0]; +0x0000 27 1e 00 00 */ /* unsigned char PrefetchFilesByVa[0]; +0x0000 42 1e 00 00 */ /* unsigned char Spare[0]; +0x0000 c3 1d 00 00 */ unsigned char ScenarioType[4]; /* +0x0000 66 22 00 00 */ }; struct _CERT_POLICY_MAPPINGS_INFO { unsigned long cPolicyMapping; /* +0x0000 */ unsigned char rgPolicyMapping[4]; /* +0x0004 8b 22 00 00 */ }; struct _IMAGE_VXD_HEADER { unsigned short e32_magic; /* +0x0000 */ unsigned char e32_border; /* +0x0002 */ unsigned char e32_worder; /* +0x0003 */ unsigned long e32_level; /* +0x0004 */ unsigned short e32_cpu; /* +0x0008 */ unsigned short e32_os; /* +0x000a */ unsigned long e32_ver; /* +0x000c */ unsigned long e32_mflags; /* +0x0010 */ unsigned long e32_mpages; /* +0x0014 */ unsigned long e32_startobj; /* +0x0018 */ unsigned long e32_eip; /* +0x001c */ unsigned long e32_stackobj; /* +0x0020 */ unsigned long e32_esp; /* +0x0024 */ unsigned long e32_pagesize; /* +0x0028 */ unsigned long e32_lastpagesize; /* +0x002c */ unsigned long e32_fixupsize; /* +0x0030 */ unsigned long e32_fixupsum; /* +0x0034 */ unsigned long e32_ldrsize; /* +0x0038 */ unsigned long e32_ldrsum; /* +0x003c */ unsigned long e32_objtab; /* +0x0040 */ unsigned long e32_objcnt; /* +0x0044 */ unsigned long e32_objmap; /* +0x0048 */ unsigned long e32_itermap; /* +0x004c */ unsigned long e32_rsrctab; /* +0x0050 */ unsigned long e32_rsrccnt; /* +0x0054 */ unsigned long e32_restab; /* +0x0058 */ unsigned long e32_enttab; /* +0x005c */ unsigned long e32_dirtab; /* +0x0060 */ unsigned long e32_dircnt; /* +0x0064 */ unsigned long e32_fpagetab; /* +0x0068 */ unsigned long e32_frectab; /* +0x006c */ unsigned long e32_impmod; /* +0x0070 */ unsigned long e32_impmodcnt; /* +0x0074 */ unsigned long e32_impproc; /* +0x0078 */ unsigned long e32_pagesum; /* +0x007c */ unsigned long e32_datapage; /* +0x0080 */ unsigned long e32_preload; /* +0x0084 */ unsigned long e32_nrestab; /* +0x0088 */ unsigned long e32_cbnrestab; /* +0x008c */ unsigned long e32_nressum; /* +0x0090 */ unsigned long e32_autodata; /* +0x0094 */ unsigned long e32_debuginfo; /* +0x0098 */ unsigned long e32_debuglen; /* +0x009c */ unsigned long e32_instpreload; /* +0x00a0 */ unsigned long e32_instdemand; /* +0x00a4 */ unsigned long e32_heapsize; /* +0x00a8 */ unsigned char e32_res3[12]; /* +0x00ac 6e 15 00 00 */ unsigned long e32_winresoff; /* +0x00b8 */ unsigned long e32_winreslen; /* +0x00bc */ unsigned short e32_devid; /* +0x00c0 */ unsigned short e32_ddkver; /* +0x00c2 */ }; struct _CACHE_DESCRIPTOR { unsigned char Level; /* +0x0000 */ unsigned char Associativity; /* +0x0001 */ unsigned short LineSize; /* +0x0002 */ unsigned long Size; /* +0x0004 */ unsigned char Type[4]; /* +0x0008 6f 1f 00 00 */ }; struct _MIDL_STUB_DESC::<unnamed-type-IMPLICIT_HANDLE_INFO> { /* unsigned char pAutoHandle[0]; +0x0000 4f 13 00 00 */ /* unsigned char pPrimitiveHandle[0]; +0x0000 4f 13 00 00 */ unsigned char pGenericBindingInfo[4]; /* +0x0000 9b 22 00 00 */ }; struct _SHCREATEPROCESSINFOW { unsigned long cbSize; /* +0x0000 */ unsigned long fMask; /* +0x0004 */ unsigned char hwnd[4]; /* +0x0008 f1 12 00 00 */ unsigned char pszFile[4]; /* +0x000c c0 13 00 00 */ unsigned char pszParameters[4]; /* +0x0010 c0 13 00 00 */ unsigned char pszCurrentDirectory[4]; /* +0x0014 c0 13 00 00 */ void *hUserToken; /* +0x0018 */ unsigned char lpProcessAttributes[4]; /* +0x001c fb 14 00 00 */ unsigned char lpThreadAttributes[4]; /* +0x0020 fb 14 00 00 */ unsigned char bInheritHandles[4]; /* +0x0024 74 00 00 00 */ unsigned long dwCreationFlags; /* +0x0028 */ unsigned char lpStartupInfo[4]; /* +0x002c 70 17 00 00 */ unsigned char lpProcessInformation[4]; /* +0x0030 a6 22 00 00 */ }; struct _FILE_MAKE_COMPATIBLE_BUFFER { unsigned char CloseDisc; /* +0x0000 */ }; struct _TRANSACTIONMANAGER_BASIC_INFORMATION { unsigned char TmIdentity[16]; /* +0x0000 dc 14 00 00 */ unsigned char VirtualClock[8]; /* +0x0010 3d 13 00 00 */ }; struct _CERT_POLICY_CONSTRAINTS_INFO { unsigned char fRequireExplicitPolicy[4]; /* +0x0000 74 00 00 00 */ unsigned long dwRequireExplicitPolicySkipCerts; /* +0x0004 */ unsigned char fInhibitPolicyMapping[4]; /* +0x0008 74 00 00 00 */ unsigned long dwInhibitPolicyMappingSkipCerts; /* +0x000c */ }; struct _CM_MCA_POS_DATA { unsigned short AdapterId; /* +0x0000 */ unsigned char PosData1; /* +0x0002 */ unsigned char PosData2; /* +0x0003 */ unsigned char PosData3; /* +0x0004 */ unsigned char PosData4; /* +0x0005 */ }; struct _WIN32_FILE_ATTRIBUTE_DATA { unsigned long dwFileAttributes; /* +0x0000 */ unsigned char ftCreationTime[8]; /* +0x0004 31 13 00 00 */ unsigned char ftLastAccessTime[8]; /* +0x000c 31 13 00 00 */ unsigned char ftLastWriteTime[8]; /* +0x0014 31 13 00 00 */ unsigned long nFileSizeHigh; /* +0x001c */ unsigned long nFileSizeLow; /* +0x0020 */ }; struct _FILE_STORAGE_INFO { unsigned long LogicalBytesPerSector; /* +0x0000 */ unsigned long PhysicalBytesPerSectorForAtomicity; /* +0x0004 */ unsigned long PhysicalBytesPerSectorForPerformance; /* +0x0008 */ unsigned long FileSystemEffectivePhysicalBytesPerSectorForAtomicity; /* +0x000c */ unsigned long Flags; /* +0x0010 */ unsigned long ByteOffsetForSectorAlignment; /* +0x0014 */ unsigned long ByteOffsetForPartitionAlignment; /* +0x0018 */ }; struct _FILE_MAILSLOT_SET_INFORMATION { unsigned char ReadTimeout[4]; /* +0x0000 53 16 00 00 */ }; struct _RTL_DYNAMIC_HASH_TABLE { unsigned long Flags; /* +0x0000 */ unsigned long Shift; /* +0x0004 */ unsigned long TableSize; /* +0x0008 */ unsigned long Pivot; /* +0x000c */ unsigned long DivisorMask; /* +0x0010 */ unsigned long NumEntries; /* +0x0014 */ unsigned long NonEmptyBuckets; /* +0x0018 */ unsigned long NumEnumerators; /* +0x001c */ void *Directory; /* +0x0020 */ }; struct _DOCINFOW { unsigned char cbSize[4]; /* +0x0000 74 00 00 00 */ unsigned char lpszDocName[4]; /* +0x0004 c0 13 00 00 */ unsigned char lpszOutput[4]; /* +0x0008 c0 13 00 00 */ unsigned char lpszDatatype[4]; /* +0x000c c0 13 00 00 */ unsigned long fwType; /* +0x0010 */ }; struct _BCryptBufferDesc { unsigned long ulVersion; /* +0x0000 */ unsigned long cBuffers; /* +0x0004 */ unsigned char pBuffers[4]; /* +0x0008 d5 22 00 00 */ }; struct _CRYPT_PASSWORD_CREDENTIALSW { unsigned long cbSize; /* +0x0000 */ unsigned char pszUsername[4]; /* +0x0004 71 04 00 00 */ unsigned char pszPassword[4]; /* +0x0008 71 04 00 00 */ }; struct _SYSTEM_DEVICE_DATA_INFORMATION { unsigned char DeviceId[8]; /* +0x0000 dd 12 00 00 */ unsigned char DataName[8]; /* +0x0008 dd 12 00 00 */ unsigned long DataType; /* +0x0010 */ unsigned long DataBufferLength; /* +0x0014 */ void *DataBuffer; /* +0x0018 */ }; struct _RTL_BARRIER { unsigned char Barrier[4]; /* +0x0000 c3 17 00 00 */ long LeftBarrier; /* +0x0004 */ unsigned char WaitEvent[8]; /* +0x0008 e0 22 00 00 */ long TotalProcessors; /* +0x0010 */ unsigned long Spins; /* +0x0014 */ unsigned char DUMMYRESERVEDSTRUCTNAME[24]; /* +0x0000 e1 22 00 00 */ }; struct _RTL_BARRIER::<unnamed-tag>::<unnamed-type-DUMMYRESERVEDSTRUCTNAME> { unsigned long Reserved1; /* +0x0000 */ unsigned long Reserved2; /* +0x0004 */ unsigned char Reserved3[8]; /* +0x0008 69 15 00 00 */ unsigned long Reserved4; /* +0x0010 */ unsigned long Reserved5; /* +0x0014 */ }; struct _OSVERSIONINFOEXA { unsigned long dwOSVersionInfoSize; /* +0x0000 */ unsigned long dwMajorVersion; /* +0x0004 */ unsigned long dwMinorVersion; /* +0x0008 */ unsigned long dwBuildNumber; /* +0x000c */ unsigned long dwPlatformId; /* +0x0010 */ unsigned char szCSDVersion[128]; /* +0x0014 f7 16 00 00 */ unsigned short wServicePackMajor; /* +0x0094 */ unsigned short wServicePackMinor; /* +0x0096 */ unsigned short wSuiteMask; /* +0x0098 */ unsigned char wProductType; /* +0x009a */ unsigned char wReserved; /* +0x009b */ }; struct _IMAGE_COFF_SYMBOLS_HEADER { unsigned long NumberOfSymbols; /* +0x0000 */ unsigned long LvaToFirstSymbol; /* +0x0004 */ unsigned long NumberOfLinenumbers; /* +0x0008 */ unsigned long LvaToFirstLinenumber; /* +0x000c */ unsigned long RvaToFirstByteOfCode; /* +0x0010 */ unsigned long RvaToLastByteOfCode; /* +0x0014 */ unsigned long RvaToFirstByteOfData; /* +0x0018 */ unsigned long RvaToLastByteOfData; /* +0x001c */ }; struct tagOBJREFDATA { unsigned long nElms; /* +0x0000 */ unsigned char ppElmArray[4]; /* +0x0004 f7 22 00 00 */ }; struct _WAKE_TIMER_INFO { unsigned long OffsetToNext; /* +0x0000 */ unsigned char DueTime[8]; /* +0x0008 fd 22 00 00 */ unsigned long Period; /* +0x0010 */ unsigned char ReasonContext[28]; /* +0x0014 0c 18 00 00 */ }; struct tagEMRPOLYLINE16 { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned char rclBounds[16]; /* +0x0008 d5 12 00 00 */ unsigned long cpts; /* +0x0018 */ unsigned char apts[4]; /* +0x001c 05 23 00 00 */ }; struct _OCSP_RESPONSE_INFO { unsigned long dwStatus; /* +0x0000 */ char *pszObjId; /* +0x0004 */ unsigned char Value[8]; /* +0x0008 02 13 00 00 */ }; struct _LDR_IMPORT_CALLBACK_INFO { unsigned char ImportCallbackRoutine[4]; /* +0x0000 12 23 00 00 */ void *ImportCallbackParameter; /* +0x0004 */ }; struct _PS_ATTRIBUTE_LIST { unsigned long TotalLength; /* +0x0000 */ unsigned char Attributes[16]; /* +0x0004 16 23 00 00 */ }; struct tagEMRPOLYDRAW { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned char rclBounds[16]; /* +0x0008 d5 12 00 00 */ unsigned long cptl; /* +0x0018 */ unsigned char aptl[8]; /* +0x001c e9 15 00 00 */ unsigned char abTypes[4]; /* +0x0024 f9 12 00 00 */ }; struct tagMENUBARINFO { unsigned long cbSize; /* +0x0000 */ unsigned char rcBar[16]; /* +0x0004 63 14 00 00 */ unsigned char hMenu[4]; /* +0x0014 4c 15 00 00 */ unsigned char hwndMenu[4]; /* +0x0018 f1 12 00 00 */ /* unsigned char fBarFocused[0]; +0x001c 1f 23 00 00 */ unsigned char fFocused[4]; /* +0x001c 20 23 00 00 */ }; struct _BYTE_SIZEDARR { unsigned long clSize; /* +0x0000 */ unsigned char *pData; /* +0x0004 */ }; struct tagPOINTER_DEVICE_INFO { unsigned long displayOrientation; /* +0x0000 */ void *device; /* +0x0004 */ unsigned char pointerDeviceType[4]; /* +0x0008 29 23 00 00 */ unsigned char monitor[4]; /* +0x000c cd 17 00 00 */ unsigned long startingCursorId; /* +0x0010 */ unsigned short maxActiveContacts; /* +0x0014 */ unsigned char productString[1042]; /* +0x0016 2a 23 00 00 */ }; struct _STARTUPINFOA { unsigned long cb; /* +0x0000 */ char *lpReserved; /* +0x0004 */ char *lpDesktop; /* +0x0008 */ char *lpTitle; /* +0x000c */ unsigned long dwX; /* +0x0010 */ unsigned long dwY; /* +0x0014 */ unsigned long dwXSize; /* +0x0018 */ unsigned long dwYSize; /* +0x001c */ unsigned long dwXCountChars; /* +0x0020 */ unsigned long dwYCountChars; /* +0x0024 */ unsigned long dwFillAttribute; /* +0x0028 */ unsigned long dwFlags; /* +0x002c */ unsigned short wShowWindow; /* +0x0030 */ unsigned short cbReserved2; /* +0x0032 */ unsigned char *lpReserved2; /* +0x0034 */ void *hStdInput; /* +0x0038 */ void *hStdOutput; /* +0x003c */ void *hStdError; /* +0x0040 */ }; struct tagCOLORCORRECTPALETTE { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned long ihPalette; /* +0x0008 */ unsigned long nFirstEntry; /* +0x000c */ unsigned long nPalEntries; /* +0x0010 */ unsigned long nReserved; /* +0x0014 */ }; struct _CRYPT_CONTEXT_FUNCTION_CONFIG { unsigned long dwFlags; /* +0x0000 */ unsigned long dwReserved; /* +0x0004 */ }; struct _DISPLAY_DEVICEA { unsigned long cb; /* +0x0000 */ unsigned char DeviceName[32]; /* +0x0004 43 23 00 00 */ unsigned char DeviceString[128]; /* +0x0024 f7 16 00 00 */ unsigned long StateFlags; /* +0x00a4 */ unsigned char DeviceID[128]; /* +0x00a8 f7 16 00 00 */ unsigned char DeviceKey[128]; /* +0x0128 f7 16 00 00 */ }; struct _DRAGINFOA { unsigned char uSize[4]; /* +0x0000 75 00 00 00 */ unsigned char pt[8]; /* +0x0004 8a 14 00 00 */ unsigned char fNC[4]; /* +0x000c 74 00 00 00 */ char *lpFileList; /* +0x0010 */ unsigned long grfKeyState; /* +0x0014 */ }; struct _DMA_CONFIGURATION_BYTE0 { /* unsigned char Channel[0]; +0x0000 4a 23 00 00 */ /* unsigned char Reserved[0]; +0x0000 4b 23 00 00 */ /* unsigned char Shared[0]; +0x0000 74 1e 00 00 */ unsigned char MoreEntries[1]; /* +0x0000 75 1e 00 00 */ }; struct tagENHMETARECORD { unsigned long iType; /* +0x0000 */ unsigned long nSize; /* +0x0004 */ unsigned char dParm[4]; /* +0x0008 f6 12 00 00 */ }; struct _remoteMETAFILEPICT { long mm; /* +0x0000 */ long xExt; /* +0x0004 */ long yExt; /* +0x0008 */ unsigned char hMF[4]; /* +0x000c 53 23 00 00 */ }; struct _tagPROTOCOL_ARGUMENT { unsigned char szMethod[4]; /* +0x0000 c0 13 00 00 */ unsigned char szTargetUrl[4]; /* +0x0004 c0 13 00 00 */ }; struct _CRYPT_CONTENT_INFO_SEQUENCE_OF_ANY { char *pszObjId; /* +0x0000 */ unsigned long cValue; /* +0x0004 */ unsigned char rgValue[4]; /* +0x0008 47 13 00 00 */ }; struct _PROCESS_MITIGATION_POLICY_INFORMATION { unsigned char Policy[4]; /* +0x0000 5c 23 00 00 */ /* unsigned char ASLRPolicy[0]; +0x0004 5d 23 00 00 */ /* unsigned char StackCheckPolicy[0]; +0x0004 5e 23 00 00 */ /* unsigned char StrictHandleCheckPolicy[0]; +0x0004 5f 23 00 00 */ unsigned char SystemCallDisablePolicy[4]; /* +0x0004 60 23 00 00 */ }; struct _FILE_COMPRESSION_INFO { unsigned char CompressedFileSize[8]; /* +0x0000 3d 13 00 00 */ unsigned short CompressionFormat; /* +0x0008 */ unsigned char CompressionUnitShift; /* +0x000a */ unsigned char ChunkShift; /* +0x000b */ unsigned char ClusterShift; /* +0x000c */ unsigned char Reserved[3]; /* +0x000d 8d 13 00 00 */ }; struct tagEMRSCALEVIEWPORTEXTEX { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ long xNum; /* +0x0008 */ long xDenom; /* +0x000c */ long yNum; /* +0x0010 */ long yDenom; /* +0x0014 */ }; struct _RPC_BINDING_HANDLE_TEMPLATE_V1_W { unsigned long Version; /* +0x0000 */ unsigned long Flags; /* +0x0004 */ unsigned long ProtocolSequence; /* +0x0008 */ unsigned short *NetworkAddress; /* +0x000c */ unsigned short *StringEndpoint; /* +0x0010 */ }; struct _CRYPT_RSA_SSA_PSS_PARAMETERS { unsigned char HashAlgorithm[12]; /* +0x0000 55 14 00 00 */ unsigned char MaskGenAlgorithm[16]; /* +0x000c 71 23 00 00 */ unsigned long dwSaltLength; /* +0x001c */ unsigned long dwTrailerField; /* +0x0020 */ }; struct tagEMRELLIPSE { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned char rclBox[16]; /* +0x0008 d5 12 00 00 */ }; struct _CRL_FIND_ISSUED_FOR_PARA { unsigned char pSubjectCert[4]; /* +0x0000 b9 13 00 00 */ unsigned char pIssuerCert[4]; /* +0x0004 b9 13 00 00 */ }; struct _RATE_QUOTA_LIMIT { unsigned long RateData; /* +0x0000 */ /* unsigned char RatePercent[0]; +0x0000 7c 23 00 00 */ unsigned char Reserved0[4]; /* +0x0000 7d 23 00 00 */ }; struct _SYSTEM_LOGICAL_PROCESSOR_INFORMATION { unsigned long ProcessorMask; /* +0x0000 */ unsigned char Relationship[4]; /* +0x0004 af 1a 00 00 */ /* unsigned char ProcessorCore[0]; +0x0008 80 23 00 00 */ /* unsigned char NumaNode[0]; +0x0008 81 23 00 00 */ /* unsigned char Cache[0]; +0x0008 82 23 00 00 */ unsigned char Reserved[16]; /* +0x0008 83 23 00 00 */ }; struct _SYSTEM_LOGICAL_PROCESSOR_INFORMATION::<unnamed-tag>::<unnamed-type-NumaNode> { unsigned long NodeNumber; /* +0x0000 */ }; struct _SYSTEM_LOGICAL_PROCESSOR_INFORMATION::<unnamed-tag>::<unnamed-type-ProcessorCore> { unsigned char Flags; /* +0x0000 */ }; struct _SYSTEM_WATCHDOG_HANDLER_INFORMATION { unsigned char WdHandler[4]; /* +0x0000 8a 23 00 00 */ void *Context; /* +0x0004 */ }; struct tagENHMETAHEADER { unsigned long iType; /* +0x0000 */ unsigned long nSize; /* +0x0004 */ unsigned char rclBounds[16]; /* +0x0008 d5 12 00 00 */ unsigned char rclFrame[16]; /* +0x0018 d5 12 00 00 */ unsigned long dSignature; /* +0x0028 */ unsigned long nVersion; /* +0x002c */ unsigned long nBytes; /* +0x0030 */ unsigned long nRecords; /* +0x0034 */ unsigned short nHandles; /* +0x0038 */ unsigned short sReserved; /* +0x003a */ unsigned long nDescription; /* +0x003c */ unsigned long offDescription; /* +0x0040 */ unsigned long nPalEntries; /* +0x0044 */ unsigned char szlDevice[8]; /* +0x0048 aa 15 00 00 */ unsigned char szlMillimeters[8]; /* +0x0050 aa 15 00 00 */ unsigned long cbPixelFormat; /* +0x0058 */ unsigned long offPixelFormat; /* +0x005c */ unsigned long bOpenGL; /* +0x0060 */ unsigned char szlMicrometers[8]; /* +0x0064 aa 15 00 00 */ }; struct _SERVICE_TRIGGER { unsigned long dwTriggerType; /* +0x0000 */ unsigned long dwAction; /* +0x0004 */ unsigned char pTriggerSubtype[4]; /* +0x0008 44 16 00 00 */ unsigned long cDataItems; /* +0x000c */ unsigned char pDataItems[4]; /* +0x0010 94 23 00 00 */ }; struct _CMSG_CTRL_KEY_AGREE_DECRYPT_PARA { unsigned long cbSize; /* +0x0000 */ unsigned long hCryptProv; /* +0x0004 */ unsigned long hNCryptKey; /* +0x0004 */ unsigned long dwKeySpec; /* +0x0008 */ unsigned char pKeyAgree[4]; /* +0x000c 98 23 00 00 */ unsigned long dwRecipientIndex; /* +0x0010 */ unsigned long dwRecipientEncryptedKeyIndex; /* +0x0014 */ unsigned char OriginatorPublicKey[12]; /* +0x0018 03 13 00 00 */ }; struct _FILE_FS_LABEL_INFORMATION { unsigned long VolumeLabelLength; /* +0x0000 */ unsigned char VolumeLabel[4]; /* +0x0004 f7 13 00 00 */ }; struct _SD_GLOBAL_CHANGE_INPUT { unsigned long Flags; /* +0x0000 */ unsigned long ChangeType; /* +0x0004 */ /* unsigned char SdChange[0]; +0x0008 a1 23 00 00 */ /* unsigned char SdQueryStats[0]; +0x0008 a2 23 00 00 */ unsigned char SdEnumSds[16]; /* +0x0008 a3 23 00 00 */ }; struct _KLOCK_QUEUE_HANDLE { unsigned char LockQueue[8]; /* +0x0000 09 22 00 00 */ unsigned char OldIrql; /* +0x0008 */ }; struct tagRAWMOUSE { unsigned short usFlags; /* +0x0000 */ unsigned long ulButtons; /* +0x0004 */ unsigned short usButtonFlags; /* +0x0004 */ unsigned short usButtonData; /* +0x0006 */ unsigned long ulRawButtons; /* +0x0008 */ long lLastX; /* +0x000c */ long lLastY; /* +0x0010 */ unsigned long ulExtraInformation; /* +0x0014 */ }; struct tagGESTUREINFO { unsigned char cbSize[4]; /* +0x0000 75 00 00 00 */ unsigned long dwFlags; /* +0x0004 */ unsigned long dwID; /* +0x0008 */ unsigned char hwndTarget[4]; /* +0x000c f1 12 00 00 */ unsigned char ptsLocation[4]; /* +0x0010 04 23 00 00 */ unsigned long dwInstanceID; /* +0x0014 */ unsigned long dwSequenceID; /* +0x0018 */ unsigned long long ullArguments; /* +0x0020 */ unsigned char cbExtraArgs[8]; /* +0x0028 75 00 00 00 */ }; struct _M128A { unsigned long long Low; /* +0x0000 */ long long High; /* +0x0008 */ }; struct _SYSDBG_MSR { unsigned long Msr; /* +0x0000 */ unsigned long long Data; /* +0x0008 */ }; struct _JOURNAL_SET_DELETE_VALUE_INFORMATION { unsigned char Action[8]; /* +0x0000 38 15 00 00 */ unsigned long long RecordNumber; /* +0x0008 */ unsigned char TimeStamp[8]; /* +0x0010 3d 13 00 00 */ unsigned char KeyPathName[8]; /* +0x0018 dd 12 00 00 */ unsigned char ValueName[8]; /* +0x0020 dd 12 00 00 */ unsigned long OldValueType; /* +0x0028 */ unsigned long OldDataLength; /* +0x002c */ void *OldData; /* +0x0030 */ unsigned long NewValueType; /* +0x0034 */ unsigned long NewDataLength; /* +0x0038 */ void *NewData; /* +0x003c */ }; struct _IO_RESOURCE_LIST { unsigned short Version; /* +0x0000 */ unsigned short Revision; /* +0x0002 */ unsigned long Count; /* +0x0004 */ unsigned char Descriptors[32]; /* +0x0008 bd 23 00 00 */ }; struct _HEAP_RANGE_INFORMATION { unsigned long Address; /* +0x0000 */ unsigned long Size; /* +0x0004 */ unsigned long Type; /* +0x0008 */ unsigned long Protection; /* +0x000c */ unsigned long FirstBlockInformationOffset; /* +0x0010 */ unsigned long NextRangeInformationOffset; /* +0x0014 */ }; struct _CRYPT_DEFAULT_CONTEXT_MULTI_OID_PARA { unsigned long cOID; /* +0x0000 */ unsigned char rgpszOID[4]; /* +0x0004 c6 23 00 00 */ }; struct _SE_SECURITY_DESCRIPTOR { unsigned long Size; /* +0x0000 */ unsigned long Flags; /* +0x0004 */ void *SecurityDescriptor; /* +0x0008 */ }; struct _LDR_DATA_TABLE_ENTRY { unsigned char InLoadOrderLinks[8]; /* +0x0000 44 1f 00 00 */ unsigned char InMemoryOrderLinks[8]; /* +0x0008 44 1f 00 00 */ /* unsigned char InInitializationOrderLinks[0]; +0x0010 44 1f 00 00 */ unsigned char InProgressLinks[8]; /* +0x0010 44 1f 00 00 */ void *DllBase; /* +0x0018 */ void *EntryPoint; /* +0x001c */ unsigned long SizeOfImage; /* +0x0020 */ unsigned char FullDllName[8]; /* +0x0024 dd 12 00 00 */ unsigned char BaseDllName[8]; /* +0x002c dd 12 00 00 */ /* unsigned char FlagGroup[0]; +0x0034 b7 17 00 00 */ unsigned long Flags; /* +0x0034 */ /* unsigned char PackagedBinary[0]; +0x0034 17 13 00 00 */ /* unsigned char MarkedForRemoval[0]; +0x0034 7e 18 00 00 */ /* unsigned char ImageDll[0]; +0x0034 7f 18 00 00 */ /* unsigned char LoadNotificationsSent[0]; +0x0034 27 1e 00 00 */ /* unsigned char TelemetryEntryProcessed[0]; +0x0034 42 1e 00 00 */ /* unsigned char ProcessStaticImport[0]; +0x0034 ce 23 00 00 */ /* unsigned char InLegacyLists[0]; +0x0034 ff 1e 00 00 */ /* unsigned char InIndexes[0]; +0x0034 00 1f 00 00 */ /* unsigned char ShimDll[0]; +0x0034 c4 1d 00 00 */ /* unsigned char InExceptionTable[0]; +0x0034 01 1f 00 00 */ /* unsigned char ReservedFlags1[0]; +0x0034 cf 23 00 00 */ /* unsigned char LoadInProgress[0]; +0x0034 d0 23 00 00 */ /* unsigned char ReservedFlags2[0]; +0x0034 d1 23 00 00 */ /* unsigned char EntryProcessed[0]; +0x0034 05 1f 00 00 */ /* unsigned char ReservedFlags3[0]; +0x0034 d2 23 00 00 */ /* unsigned char DontCallForThreads[0]; +0x0034 d3 23 00 00 */ /* unsigned char ProcessAttachCalled[0]; +0x0034 d4 23 00 00 */ /* unsigned char ProcessAttachFailed[0]; +0x0034 88 13 00 00 */ /* unsigned char CorDeferredValidate[0]; +0x0034 89 13 00 00 */ /* unsigned char CorImage[0]; +0x0034 94 20 00 00 */ /* unsigned char DontRelocate[0]; +0x0034 95 20 00 00 */ /* unsigned char CorILOnly[0]; +0x0034 d5 23 00 00 */ /* unsigned char ReservedFlags5[0]; +0x0034 d6 23 00 00 */ /* unsigned char Redirected[0]; +0x0034 d7 23 00 00 */ /* unsigned char ReservedFlags6[0]; +0x0034 d8 23 00 00 */ unsigned char CompatDatabaseProcessed[4]; /* +0x0034 95 18 00 00 */ unsigned short ObsoleteLoadCount; /* +0x0038 */ unsigned short TlsIndex; /* +0x003a */ unsigned char HashLinks[8]; /* +0x003c 44 1f 00 00 */ unsigned long TimeDateStamp; /* +0x0044 */ unsigned char EntryPointActivationContext[4]; /* +0x0048 69 17 00 00 */ void *PatchInformation; /* +0x004c */ unsigned char DdagNode[4]; /* +0x0050 da 23 00 00 */ unsigned char NodeModuleLink[8]; /* +0x0054 44 1f 00 00 */ unsigned char SnapContext[4]; /* +0x005c dc 23 00 00 */ void *SwitchBackContext; /* +0x0060 */ unsigned char BaseAddressIndexNode[12]; /* +0x0064 0a 20 00 00 */ unsigned char MappingInfoIndexNode[12]; /* +0x0070 0a 20 00 00 */ unsigned long OriginalBase; /* +0x007c */ unsigned char LoadTime[8]; /* +0x0080 3d 13 00 00 */ unsigned long BaseNameHashValue; /* +0x0088 */ }; struct _FILE_GET_EA_INFORMATION { unsigned long NextEntryOffset; /* +0x0000 */ unsigned char EaNameLength; /* +0x0004 */ unsigned char EaName[3]; /* +0x0005 df 23 00 00 */ }; struct _QUERY_FILE_LAYOUT_OUTPUT { unsigned long FileEntryCount; /* +0x0000 */ unsigned long FirstFileOffset; /* +0x0004 */ unsigned long Flags; /* +0x0008 */ unsigned long Reserved; /* +0x000c */ }; struct _PROCESSOR_IDLE_STATES { unsigned long Size; /* +0x0000 */ unsigned long Revision; /* +0x0004 */ unsigned long Count; /* +0x0008 */ unsigned long Type; /* +0x000c */ unsigned long TargetProcessors; /* +0x0010 */ unsigned char State[24]; /* +0x0014 e5 23 00 00 */ }; struct _RPC_MESSAGE { void *Handle; /* +0x0000 */ unsigned long DataRepresentation; /* +0x0004 */ void *Buffer; /* +0x0008 */ unsigned char BufferLength[4]; /* +0x000c 75 00 00 00 */ unsigned char ProcNum[4]; /* +0x0010 75 00 00 00 */ unsigned char TransferSyntax[4]; /* +0x0014 ec 23 00 00 */ void *RpcInterfaceInformation; /* +0x0018 */ void *ReservedForRuntime; /* +0x001c */ void *ManagerEpv; /* +0x0020 */ void *ImportContext; /* +0x0024 */ unsigned long RpcFlags; /* +0x0028 */ }; struct NCRYPT_ALLOC_PARA { unsigned long cbSize; /* +0x0000 */ unsigned char pfnAlloc[4]; /* +0x0004 e4 16 00 00 */ unsigned char pfnFree[4]; /* +0x0008 c7 13 00 00 */ }; struct _CRYPT_BIT_BLOB { unsigned long cbData; /* +0x0000 */ unsigned char *pbData; /* +0x0004 */ unsigned long cUnusedBits; /* +0x0008 */ }; struct _RTL_PROCESS_BACKTRACE_INFORMATION { char *SymbolicBackTrace; /* +0x0000 */ unsigned long TraceCount; /* +0x0004 */ unsigned short Index; /* +0x0008 */ unsigned short Depth; /* +0x000a */ unsigned char BackTrace[128]; /* +0x000c f9 23 00 00 */ }; struct _PROCESS_KEEPALIVE_COUNT_INFORMATION { unsigned long Count; /* +0x0000 */ }; struct _SYSTEM_POWER_LOGGING_ENTRY { unsigned long Reason; /* +0x0000 */ unsigned long States; /* +0x0004 */ }; struct _SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION { unsigned long FlagsToEnable; /* +0x0000 */ unsigned long FlagsToDisable; /* +0x0004 */ }; struct tagMOUSEMOVEPOINT { unsigned char x[4]; /* +0x0000 74 00 00 00 */ unsigned char y[4]; /* +0x0004 74 00 00 00 */ unsigned long time; /* +0x0008 */ unsigned long dwExtraInfo; /* +0x000c */ }; struct _CERT_PUBLIC_KEY_INFO { unsigned char Algorithm[12]; /* +0x0000 55 14 00 00 */ unsigned char PublicKey[12]; /* +0x000c 03 13 00 00 */ }; struct _CERT_LOGOTYPE_AUDIO_INFO { unsigned long dwFileSize; /* +0x0000 */ unsigned long dwPlayTime; /* +0x0004 */ unsigned long dwChannels; /* +0x0008 */ unsigned long dwSampleRate; /* +0x000c */ unsigned char pwszLanguage[4]; /* +0x0010 71 04 00 00 */ }; struct _FILE_INTEGRITY_STREAM_INFORMATION { unsigned short ChecksumAlgorithm; /* +0x0000 */ unsigned char ChecksumChunkShift; /* +0x0002 */ unsigned char ClusterShift; /* +0x0003 */ unsigned long Flags; /* +0x0004 */ }; struct _DIAGNOSTIC_BUFFER { unsigned long Size; /* +0x0000 */ unsigned char CallerType[4]; /* +0x0004 14 24 00 00 */ unsigned long ProcessImageNameOffset; /* +0x0008 */ unsigned long ProcessId; /* +0x000c */ unsigned long ServiceTag; /* +0x0010 */ unsigned long DeviceDescriptionOffset; /* +0x0008 */ unsigned long DevicePathOffset; /* +0x000c */ unsigned long ReasonOffset; /* +0x0014 */ }; struct _SYSTEM_VERIFIER_INFORMATION { unsigned long NextEntryOffset; /* +0x0000 */ unsigned long Level; /* +0x0004 */ unsigned char DriverName[8]; /* +0x0008 dd 12 00 00 */ unsigned long RaiseIrqls; /* +0x0010 */ unsigned long AcquireSpinLocks; /* +0x0014 */ unsigned long SynchronizeExecutions; /* +0x0018 */ unsigned long AllocationsAttempted; /* +0x001c */ unsigned long AllocationsSucceeded; /* +0x0020 */ unsigned long AllocationsSucceededSpecialPool; /* +0x0024 */ unsigned long AllocationsWithNoTag; /* +0x0028 */ unsigned long TrimRequests; /* +0x002c */ unsigned long Trims; /* +0x0030 */ unsigned long AllocationsFailed; /* +0x0034 */ unsigned long AllocationsFailedDeliberately; /* +0x0038 */ unsigned long Loads; /* +0x003c */ unsigned long Unloads; /* +0x0040 */ unsigned long UnTrackedPool; /* +0x0044 */ unsigned long CurrentPagedPoolAllocations; /* +0x0048 */ unsigned long CurrentNonPagedPoolAllocations; /* +0x004c */ unsigned long PeakPagedPoolAllocations; /* +0x0050 */ unsigned long PeakNonPagedPoolAllocations; /* +0x0054 */ unsigned long PagedPoolUsageInBytes; /* +0x0058 */ unsigned long NonPagedPoolUsageInBytes; /* +0x005c */ unsigned long PeakPagedPoolUsageInBytes; /* +0x0060 */ unsigned long PeakNonPagedPoolUsageInBytes; /* +0x0064 */ }; struct tagHIGHCONTRASTW { unsigned char cbSize[4]; /* +0x0000 75 00 00 00 */ unsigned long dwFlags; /* +0x0004 */ unsigned char lpszDefaultScheme[4]; /* +0x0008 71 04 00 00 */ }; struct _CM_SERIAL_DEVICE_DATA { unsigned short Version; /* +0x0000 */ unsigned short Revision; /* +0x0002 */ unsigned long BaudClock; /* +0x0004 */ }; struct _cpinfoexA { unsigned char MaxCharSize[4]; /* +0x0000 75 00 00 00 */ unsigned char DefaultChar[2]; /* +0x0004 a7 17 00 00 */ unsigned char LeadByte[12]; /* +0x0006 6e 15 00 00 */ unsigned char UnicodeDefaultChar[2]; /* +0x0012 71 00 00 00 */ unsigned char CodePage[4]; /* +0x0014 75 00 00 00 */ unsigned char CodePageName[260]; /* +0x0018 27 24 00 00 */ }; struct _CERT_AUTHORITY_INFO_ACCESS { unsigned long cAccDescr; /* +0x0000 */ unsigned char rgAccDescr[4]; /* +0x0004 2b 24 00 00 */ }; struct _CERT_STRONG_SIGN_PARA { unsigned long cbSize; /* +0x0000 */ unsigned long dwInfoChoice; /* +0x0004 */ void *pvInfo; /* +0x0008 */ /* unsigned char pSerializedInfo[0]; +0x0008 2f 24 00 00 */ char *pszOID; /* +0x0008 */ }; struct _JIT_DEBUG_INFO { unsigned long dwSize; /* +0x0000 */ unsigned long dwProcessorArchitecture; /* +0x0004 */ unsigned long dwThreadID; /* +0x0008 */ unsigned long dwReserved0; /* +0x000c */ unsigned long long lpExceptionAddress; /* +0x0010 */ unsigned long long lpExceptionRecord; /* +0x0018 */ unsigned long long lpContextRecord; /* +0x0020 */ }; struct _FILE_IO_PRIORITY_HINT_INFO { unsigned char PriorityHint[4]; /* +0x0000 3d 24 00 00 */ }; struct _CRL_DIST_POINT_NAME { unsigned long dwDistPointNameChoice; /* +0x0000 */ unsigned char FullName[8]; /* +0x0004 44 24 00 00 */ }; struct _CMSG_RECIPIENT_ENCRYPTED_KEY_ENCODE_INFO { unsigned long cbSize; /* +0x0000 */ unsigned char RecipientPublicKey[12]; /* +0x0004 03 13 00 00 */ unsigned char RecipientId[20]; /* +0x0010 30 13 00 00 */ unsigned char Date[8]; /* +0x0024 31 13 00 00 */ unsigned char pOtherAttr[4]; /* +0x002c 33 13 00 00 */ }; struct _FILE_GET_QUOTA_INFORMATION { unsigned long NextEntryOffset; /* +0x0000 */ unsigned long SidLength; /* +0x0004 */ unsigned char Sid[12]; /* +0x0008 dc 1e 00 00 */ }; struct _FILE_PIPE_CLIENT_PROCESS_BUFFER { void *ClientSession; /* +0x0000 */ void *ClientProcess; /* +0x0004 */ }; struct tagEMRSETICMPROFILE { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned long dwFlags; /* +0x0008 */ unsigned long cbName; /* +0x000c */ unsigned long cbData; /* +0x0010 */ unsigned char Data[4]; /* +0x0014 f9 12 00 00 */ }; struct _CERT_GENERAL_SUBTREE { unsigned char Base[12]; /* +0x0000 ff 15 00 00 */ unsigned long dwMinimum; /* +0x000c */ unsigned char fMaximum[4]; /* +0x0010 74 00 00 00 */ unsigned long dwMaximum; /* +0x0014 */ }; struct _CERT_KEY_CONTEXT { unsigned long cbSize; /* +0x0000 */ unsigned long hCryptProv; /* +0x0004 */ unsigned long hNCryptKey; /* +0x0004 */ unsigned long dwKeySpec; /* +0x0008 */ }; struct _SYSTEM_SESSION_PROCESS_INFORMATION { unsigned long SessionId; /* +0x0000 */ unsigned long SizeOfBuf; /* +0x0004 */ void *Buffer; /* +0x0008 */ }; struct _SYSTEM_VA_LIST_INFORMATION { unsigned long VirtualSize; /* +0x0000 */ unsigned long VirtualPeak; /* +0x0004 */ unsigned long VirtualLimit; /* +0x0008 */ unsigned long AllocationFailures; /* +0x000c */ }; struct _ABC { unsigned char abcA[4]; /* +0x0000 74 00 00 00 */ unsigned char abcB[4]; /* +0x0004 75 00 00 00 */ unsigned char abcC[4]; /* +0x0008 74 00 00 00 */ }; struct _HTTPSPolicyCallbackData { unsigned long cbStruct; /* +0x0000 */ unsigned long cbSize; /* +0x0000 */ unsigned long dwAuthType; /* +0x0004 */ unsigned long fdwChecks; /* +0x0008 */ unsigned char pwszServerName[4]; /* +0x000c 71 04 00 00 */ }; struct tagOXID_INFO { unsigned long dwTid; /* +0x0000 */ unsigned long dwPid; /* +0x0004 */ unsigned long dwAuthnHint; /* +0x0008 */ unsigned char version[4]; /* +0x000c 66 1f 00 00 */ unsigned char ipidRemUnknown[16]; /* +0x0010 dc 14 00 00 */ unsigned long dwFlags; /* +0x0020 */ unsigned char psa[4]; /* +0x0024 65 1f 00 00 */ }; struct _ACTIVATION_CONTEXT_SECTION_KEYED_DATA_ASSEMBLY_METADATA { unsigned char Information[4]; /* +0x0000 93 24 00 00 */ void *SectionBase; /* +0x0004 */ unsigned long SectionLength; /* +0x0008 */ void *SectionGlobalDataBase; /* +0x000c */ unsigned long SectionGlobalDataLength; /* +0x0010 */ }; struct _BCryptBuffer { unsigned long cbBuffer; /* +0x0000 */ unsigned long BufferType; /* +0x0004 */ void *pvBuffer; /* +0x0008 */ }; struct _CRYPT_GET_TIME_VALID_OBJECT_EXTRA_INFO { unsigned long cbSize; /* +0x0000 */ unsigned char iDeltaCrlIndicator[4]; /* +0x0004 74 00 00 00 */ unsigned char pftCacheResync[4]; /* +0x0008 73 17 00 00 */ unsigned char pLastSyncTime[4]; /* +0x000c 73 17 00 00 */ unsigned char pMaxAgeTime[4]; /* +0x0010 73 17 00 00 */ unsigned char pChainPara[4]; /* +0x0014 9d 24 00 00 */ unsigned char pDeltaCrlIndicator[4]; /* +0x0018 47 13 00 00 */ }; struct tagORPC_EXTENT { unsigned char id[16]; /* +0x0000 dc 14 00 00 */ unsigned long size; /* +0x0010 */ unsigned char data[4]; /* +0x0014 f9 12 00 00 */ }; struct _LDR_DDAG_NODE { unsigned char Modules[8]; /* +0x0000 44 1f 00 00 */ unsigned char ServiceTagList[4]; /* +0x0008 df 1a 00 00 */ unsigned long LoadCount; /* +0x000c */ unsigned long ReferenceCount; /* +0x0010 */ unsigned long DependencyCount; /* +0x0014 */ /* unsigned char Dependencies[0]; +0x0018 1c 19 00 00 */ unsigned char RemovalLink[4]; /* +0x0018 ba 17 00 00 */ unsigned char IncomingDependencies[4]; /* +0x001c 1c 19 00 00 */ unsigned char State[4]; /* +0x0020 a2 24 00 00 */ unsigned char CondenseLink[4]; /* +0x0024 ba 17 00 00 */ unsigned long PreorderNumber; /* +0x0028 */ unsigned long LowestLink; /* +0x002c */ }; struct _LPC_CLIENT_DIED_MSG { unsigned char PortMsg[24]; /* +0x0000 01 20 00 00 */ unsigned char CreateTime[8]; /* +0x0018 3d 13 00 00 */ }; struct _wireSAFEARRAY_UNION { unsigned long sfType; /* +0x0000 */ }; struct _wireSAFEARRAY_UNION::__MIDL_IOleAutomationTypes_0001 { /* unsigned char BstrStr[0]; +0x0000 b3 24 00 00 */ /* unsigned char UnknownStr[0]; +0x0000 b4 24 00 00 */ /* unsigned char DispatchStr[0]; +0x0000 b5 24 00 00 */ /* unsigned char VariantStr[0]; +0x0000 b6 24 00 00 */ /* unsigned char RecordStr[0]; +0x0000 b7 24 00 00 */ /* unsigned char HaveIidStr[0]; +0x0000 b8 24 00 00 */ /* unsigned char ByteStr[0]; +0x0000 b9 24 00 00 */ /* unsigned char WordStr[0]; +0x0000 ba 24 00 00 */ /* unsigned char LongStr[0]; +0x0000 bb 24 00 00 */ unsigned char HyperStr[24]; /* +0x0000 bc 24 00 00 */ }; struct _TRANSACTION_NOTIFICATION_MARSHAL_ARGUMENT { unsigned long MarshalCookie; /* +0x0000 */ unsigned char UOW[16]; /* +0x0004 dc 14 00 00 */ }; struct _CSV_INTERNAL_CONTROL_PARAM { unsigned char Operation[8]; /* +0x0000 c4 24 00 00 */ long long Unused; /* +0x0008 */ }; struct _MCI_ADDR { unsigned long Address; /* +0x0000 */ unsigned long Reserved; /* +0x0004 */ unsigned long long QuadPart; /* +0x0000 */ }; struct DISPLAYCONFIG_TARGET_PREFERRED_MODE { unsigned char header[20]; /* +0x0000 ca 24 00 00 */ unsigned char width[4]; /* +0x0014 75 00 00 00 */ unsigned char height[8]; /* +0x0018 75 00 00 00 */ unsigned char targetMode[48]; /* +0x0020 cb 24 00 00 */ }; struct tagPOINTER_TOUCH_INFO { unsigned char pointerInfo[80]; /* +0x0000 ce 24 00 00 */ unsigned char touchFlags[4]; /* +0x0050 75 00 00 00 */ unsigned char touchMask[4]; /* +0x0054 75 00 00 00 */ unsigned char rcContact[16]; /* +0x0058 63 14 00 00 */ unsigned char rcContactRaw[16]; /* +0x0068 63 14 00 00 */ unsigned char orientation[4]; /* +0x0078 75 00 00 00 */ unsigned char pressure[4]; /* +0x007c 75 00 00 00 */ }; struct tagACCESSTIMEOUT { unsigned char cbSize[4]; /* +0x0000 75 00 00 00 */ unsigned long dwFlags; /* +0x0004 */ unsigned long iTimeOutMSec; /* +0x0008 */ }; struct __MIDL___MIDL_itf_wtypes_0000_0001_0001 { unsigned long tyspec; /* +0x0000 */ }; struct __MIDL___MIDL_itf_wtypes_0000_0001_0001::__MIDL___MIDL_itf_wtypes_0000_0001_0005 { /* unsigned char clsid[0]; +0x0000 dc 14 00 00 */ /* unsigned char pFileExt[0]; +0x0000 71 04 00 00 */ /* unsigned char pMimeType[0]; +0x0000 71 04 00 00 */ /* unsigned char pProgId[0]; +0x0000 71 04 00 00 */ unsigned char pFileName[32]; /* +0x0000 71 04 00 00 */ }; struct __MIDL___MIDL_itf_wtypes_0000_0001_0001::__MIDL___MIDL_itf_wtypes_0000_0001_0005::<unnamed-type-ByObjectId> { unsigned char ObjectId[16]; /* +0x0000 dc 14 00 00 */ unsigned char PolicyId[16]; /* +0x0010 dc 14 00 00 */ }; struct __MIDL___MIDL_itf_wtypes_0000_0001_0001::__MIDL___MIDL_itf_wtypes_0000_0001_0005::<unnamed-type-ByName> { unsigned char pPackageName[4]; /* +0x0000 71 04 00 00 */ unsigned char PolicyId[16]; /* +0x0004 dc 14 00 00 */ }; struct _CERT_POLICY_QUALIFIER_NOTICE_REFERENCE { char *pszOrganization; /* +0x0000 */ unsigned long cNoticeNumbers; /* +0x0004 */ unsigned char rgNoticeNumbers[4]; /* +0x0008 74 04 00 00 */ }; struct _CERT_REVOCATION_CRL_INFO { unsigned long cbSize; /* +0x0000 */ unsigned char pBaseCrlContext[4]; /* +0x0004 d8 1f 00 00 */ unsigned char pDeltaCrlContext[4]; /* +0x0008 d8 1f 00 00 */ unsigned char pCrlEntry[4]; /* +0x000c 20 16 00 00 */ unsigned char fDeltaCrlEntry[4]; /* +0x0010 74 00 00 00 */ }; struct _CERT_CHAIN_POLICY_PARA { unsigned long cbSize; /* +0x0000 */ unsigned long dwFlags; /* +0x0004 */ void *pvExtraPolicyPara; /* +0x0008 */ }; struct _FILE_MAILSLOT_PEEK_BUFFER { unsigned long ReadDataAvailable; /* +0x0000 */ unsigned long NumberOfMessages; /* +0x0004 */ unsigned long MessageLength; /* +0x0008 */ }; struct _userFLAG_STGMEDIUM { long ContextFlags; /* +0x0000 */ long fPassOwnership; /* +0x0004 */ unsigned char Stgmed[4]; /* +0x0008 08 23 00 00 */ }; struct _wireSAFEARRAY { unsigned short cDims; /* +0x0000 */ unsigned short fFeatures; /* +0x0002 */ unsigned long cbElements; /* +0x0004 */ unsigned long cLocks; /* +0x0008 */ unsigned char uArrayStructs[28]; /* +0x000c 02 25 00 00 */ unsigned char rgsabound[8]; /* +0x0028 04 25 00 00 */ }; struct _CMC_TAGGED_REQUEST { unsigned long dwTaggedRequestChoice; /* +0x0000 */ unsigned char pTaggedCertRequest[4]; /* +0x0004 0a 25 00 00 */ }; struct _CMS_KEY_INFO { unsigned long dwVersion; /* +0x0000 */ unsigned char Algid[4]; /* +0x0004 75 00 00 00 */ unsigned char *pbOID; /* +0x0008 */ unsigned long cbOID; /* +0x000c */ }; struct _CTL_VERIFY_USAGE_PARA { unsigned long cbSize; /* +0x0000 */ unsigned char ListIdentifier[8]; /* +0x0004 02 13 00 00 */ unsigned long cCtlStore; /* +0x000c */ unsigned char rghCtlStore[4]; /* +0x0010 4f 13 00 00 */ unsigned long cSignerStore; /* +0x0014 */ unsigned char rghSignerStore[4]; /* +0x0018 4f 13 00 00 */ }; struct _DRAGINFOW { unsigned char uSize[4]; /* +0x0000 75 00 00 00 */ unsigned char pt[8]; /* +0x0004 8a 14 00 00 */ unsigned char fNC[4]; /* +0x000c 74 00 00 00 */ unsigned char lpFileList[4]; /* +0x0010 71 04 00 00 */ unsigned long grfKeyState; /* +0x0014 */ }; struct threadlocaleinfostruct { unsigned char refcount[4]; /* +0x0000 74 00 00 00 */ unsigned char lc_codepage[4]; /* +0x0004 75 00 00 00 */ unsigned char lc_collate_cp[4]; /* +0x0008 75 00 00 00 */ unsigned char lc_handle[24]; /* +0x000c a8 1f 00 00 */ unsigned char lc_id[180]; /* +0x0024 18 25 00 00 */ }; struct _CMSG_KEY_TRANS_ENCRYPT_INFO { unsigned long cbSize; /* +0x0000 */ unsigned long dwRecipientIndex; /* +0x0004 */ unsigned char KeyEncryptionAlgorithm[12]; /* +0x0008 55 14 00 00 */ unsigned char EncryptedKey[8]; /* +0x0014 02 13 00 00 */ unsigned long dwFlags; /* +0x001c */ }; struct _MESSAGE_RESOURCE_ENTRY { unsigned short Length; /* +0x0000 */ unsigned short Flags; /* +0x0002 */ unsigned char Text[2]; /* +0x0004 f9 12 00 00 */ }; struct _WNF_PUBLISH_DESCRIPTOR { unsigned char StateName[8]; /* +0x0000 e5 13 00 00 */ unsigned char TypeId[4]; /* +0x0008 38 1f 00 00 */ unsigned char StateData[4]; /* +0x000c 3d 19 00 00 */ unsigned long StateDataLength; /* +0x0010 */ }; struct _CRYPT_RETRIEVE_AUX_INFO { unsigned long cbSize; /* +0x0000 */ unsigned char pLastSyncTime[4]; /* +0x0004 73 17 00 00 */ unsigned long dwMaxUrlRetrievalByteCount; /* +0x0008 */ unsigned char pPreFetchInfo[4]; /* +0x000c 2e 25 00 00 */ unsigned char pFlushInfo[4]; /* +0x0010 30 25 00 00 */ unsigned char ppResponseInfo[4]; /* +0x0014 33 25 00 00 */ unsigned char pwszCacheFileNamePrefix[4]; /* +0x0018 71 04 00 00 */ unsigned char pftCacheResync[4]; /* +0x001c 73 17 00 00 */ unsigned char fProxyCacheRetrieval[4]; /* +0x0020 74 00 00 00 */ unsigned long dwHttpStatusCode; /* +0x0024 */ }; struct _MEMORY_WORKING_SET_INFORMATION { unsigned long NumberOfEntries; /* +0x0000 */ unsigned char WorkingSetInfo[4]; /* +0x0004 38 25 00 00 */ }; struct tagPOLYTEXTW { unsigned char x[4]; /* +0x0000 74 00 00 00 */ unsigned char y[4]; /* +0x0004 74 00 00 00 */ unsigned char n[4]; /* +0x0008 75 00 00 00 */ unsigned char lpstr[4]; /* +0x000c c0 13 00 00 */ unsigned char uiFlags[4]; /* +0x0010 75 00 00 00 */ unsigned char rcl[16]; /* +0x0014 63 14 00 00 */ unsigned char pdx[4]; /* +0x0024 74 04 00 00 */ }; struct tagSOLE_AUTHENTICATION_INFO { unsigned long dwAuthnSvc; /* +0x0000 */ unsigned long dwAuthzSvc; /* +0x0004 */ void *pAuthInfo; /* +0x0008 */ }; struct _BCRYPT_PSS_PADDING_INFO { unsigned char pszAlgId[4]; /* +0x0000 c0 13 00 00 */ unsigned long cbSalt; /* +0x0004 */ }; struct _CRYPT_OID_INFO { unsigned long cbSize; /* +0x0000 */ unsigned char pszOID[4]; /* +0x0004 62 14 00 00 */ unsigned char pwszName[4]; /* +0x0008 c0 13 00 00 */ unsigned long dwGroupId; /* +0x000c */ unsigned long dwValue; /* +0x0010 */ /* unsigned char Algid[0]; +0x0010 75 00 00 00 */ unsigned long dwLength; /* +0x0010 */ unsigned char ExtraInfo[8]; /* +0x0014 02 13 00 00 */ }; struct _PLUGPLAY_CONTROL_DEVICE_CONTROL_DATA { unsigned char DeviceInstance[8]; /* +0x0000 dd 12 00 00 */ unsigned long Flags; /* +0x0008 */ }; struct _CRYPT_RSAES_OAEP_PARAMETERS { unsigned char HashAlgorithm[12]; /* +0x0000 55 14 00 00 */ unsigned char MaskGenAlgorithm[16]; /* +0x000c 71 23 00 00 */ unsigned char PSourceAlgorithm[12]; /* +0x001c 4e 25 00 00 */ }; struct _SYSTEM_CALL_TIME_INFORMATION { unsigned long Length; /* +0x0000 */ unsigned long TotalCalls; /* +0x0004 */ unsigned char TimeOfCalls[8]; /* +0x0008 55 25 00 00 */ }; struct _TRANSACTION_NOTIFICATION_SAVEPOINT_ARGUMENT { unsigned long SavepointId; /* +0x0000 */ }; struct tagGESTURENOTIFYSTRUCT { unsigned char cbSize[4]; /* +0x0000 75 00 00 00 */ unsigned long dwFlags; /* +0x0004 */ unsigned char hwndTarget[4]; /* +0x0008 f1 12 00 00 */ unsigned char ptsLocation[4]; /* +0x000c 04 23 00 00 */ unsigned long dwInstanceID; /* +0x0010 */ }; struct _RETRIEVAL_POINTER_BASE { unsigned char FileAreaOffset[8]; /* +0x0000 3d 13 00 00 */ }; struct _CERT_SELECT_CRITERIA { unsigned long dwType; /* +0x0000 */ unsigned long cPara; /* +0x0004 */ unsigned char ppPara[4]; /* +0x0008 4f 13 00 00 */ }; struct _FILE_PATH { unsigned long Version; /* +0x0000 */ unsigned long Length; /* +0x0004 */ unsigned long Type; /* +0x0008 */ unsigned char FilePath[4]; /* +0x000c f9 12 00 00 */ }; struct tagSTYLEBUFW { unsigned long dwStyle; /* +0x0000 */ unsigned char szDescription[64]; /* +0x0004 a5 15 00 00 */ }; struct _IMAGE_THUNK_DATA32::<unnamed-type-u1> { unsigned long ForwarderString; /* +0x0000 */ unsigned long Function; /* +0x0000 */ unsigned long Ordinal; /* +0x0000 */ unsigned long AddressOfData; /* +0x0000 */ }; struct _SYSTEM_HYPERVISOR_QUERY_INFORMATION { unsigned char HypervisorConnected; /* +0x0000 */ unsigned char Spare0[7]; /* +0x0001 91 25 00 00 */ unsigned long long EnabledAddressSpaceEnlightenments; /* +0x0008 */ }; struct _XMIT_ROUTINE_QUINTUPLE { unsigned char pfnTranslateToXmit[4]; /* +0x0000 94 25 00 00 */ unsigned char pfnTranslateFromXmit[4]; /* +0x0004 94 25 00 00 */ unsigned char pfnFreeXmit[4]; /* +0x0008 94 25 00 00 */ unsigned char pfnFreeInst[4]; /* +0x000c 94 25 00 00 */ }; struct _CERT_REVOCATION_INFO { unsigned long cbSize; /* +0x0000 */ unsigned long dwRevocationResult; /* +0x0004 */ unsigned char pszRevocationOid[4]; /* +0x0008 62 14 00 00 */ void *pvOidSpecificInfo; /* +0x000c */ unsigned char fHasFreshnessTime[4]; /* +0x0010 74 00 00 00 */ unsigned long dwFreshnessTime; /* +0x0014 */ unsigned char pCrlInfo[4]; /* +0x0018 98 25 00 00 */ }; struct KnownClsidAndScope { unsigned char clsid[16]; /* +0x0000 dc 14 00 00 */ unsigned long registrationScope; /* +0x0010 */ }; struct _nlsversioninfo { unsigned long dwNLSVersionInfoSize; /* +0x0000 */ unsigned long dwNLSVersion; /* +0x0004 */ unsigned long dwDefinedVersion; /* +0x0008 */ unsigned long dwEffectiveId; /* +0x000c */ unsigned char guidCustomVersion[16]; /* +0x0010 dc 14 00 00 */ }; struct _RPC_SECURITY_QOS_V5_A { unsigned long Version; /* +0x0000 */ unsigned long Capabilities; /* +0x0004 */ unsigned long IdentityTracking; /* +0x0008 */ unsigned long ImpersonationType; /* +0x000c */ unsigned long AdditionalSecurityInfoType; /* +0x0010 */ }; struct _CRYPT_PSOURCE_ALGORITHM { char *pszObjId; /* +0x0000 */ unsigned char EncodingParameters[8]; /* +0x0004 02 13 00 00 */ }; struct _TRANSACTION_PROPERTIES_INFORMATION { unsigned long IsolationLevel; /* +0x0000 */ unsigned long IsolationFlags; /* +0x0004 */ unsigned char Timeout[8]; /* +0x0008 3d 13 00 00 */ unsigned long Outcome; /* +0x0010 */ unsigned long DescriptionLength; /* +0x0014 */ unsigned char Description[8]; /* +0x0018 f7 13 00 00 */ }; struct _stat64 { unsigned char st_dev[4]; /* +0x0000 75 00 00 00 */ unsigned short st_ino; /* +0x0004 */ unsigned short st_mode; /* +0x0006 */ short st_nlink; /* +0x0008 */ short st_uid; /* +0x000a */ short st_gid; /* +0x000c */ unsigned char st_rdev[8]; /* +0x0010 75 00 00 00 */ long long st_size; /* +0x0018 */ long long st_atime; /* +0x0020 */ long long st_mtime; /* +0x0028 */ long long st_ctime; /* +0x0030 */ }; struct tagMETAFILEPICT { long mm; /* +0x0000 */ long xExt; /* +0x0004 */ long yExt; /* +0x0008 */ unsigned char hMF[4]; /* +0x000c bb 25 00 00 */ }; struct _CMSG_CNG_CONTENT_DECRYPT_INFO { unsigned long cbSize; /* +0x0000 */ unsigned char ContentEncryptionAlgorithm[12]; /* +0x0004 55 14 00 00 */ unsigned char pfnAlloc[4]; /* +0x0010 66 19 00 00 */ unsigned char pfnFree[4]; /* +0x0014 c7 13 00 00 */ unsigned long hNCryptKey; /* +0x0018 */ unsigned char *pbContentEncryptKey; /* +0x001c */ unsigned long cbContentEncryptKey; /* +0x0020 */ void *hCNGContentEncryptKey; /* +0x0024 */ unsigned char *pbCNGContentEncryptKeyObject; /* +0x0028 */ }; struct _EISA_IRQ_DESCRIPTOR { /* unsigned char Interrupt[0]; +0x0000 c8 25 00 00 */ /* unsigned char Reserved[0]; +0x0000 c9 25 00 00 */ /* unsigned char LevelTriggered[0]; +0x0000 73 1e 00 00 */ /* unsigned char Shared[0]; +0x0000 74 1e 00 00 */ unsigned char MoreEntries[1]; /* +0x0000 75 1e 00 00 */ }; struct _FOCUS_EVENT_RECORD { unsigned char bSetFocus[4]; /* +0x0000 74 00 00 00 */ }; struct _CRYPT_HASH_MESSAGE_PARA { unsigned long cbSize; /* +0x0000 */ unsigned long dwMsgEncodingType; /* +0x0004 */ unsigned long hCryptProv; /* +0x0008 */ unsigned char HashAlgorithm[12]; /* +0x000c 55 14 00 00 */ void *pvHashAuxInfo; /* +0x0018 */ }; struct _SHELLEXECUTEINFOA { unsigned long cbSize; /* +0x0000 */ unsigned long fMask; /* +0x0004 */ unsigned char hwnd[4]; /* +0x0008 f1 12 00 00 */ unsigned char lpVerb[4]; /* +0x000c 62 14 00 00 */ unsigned char lpFile[4]; /* +0x0010 62 14 00 00 */ unsigned char lpParameters[4]; /* +0x0014 62 14 00 00 */ unsigned char lpDirectory[4]; /* +0x0018 62 14 00 00 */ unsigned char nShow[4]; /* +0x001c 74 00 00 00 */ unsigned char hInstApp[4]; /* +0x0020 ba 14 00 00 */ void *lpIDList; /* +0x0024 */ unsigned char lpClass[4]; /* +0x0028 62 14 00 00 */ unsigned char hkeyClass[4]; /* +0x002c 72 19 00 00 */ unsigned long dwHotKey; /* +0x0030 */ void *hIcon; /* +0x0034 */ void *hMonitor; /* +0x0034 */ void *hProcess; /* +0x0038 */ }; struct _SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION { unsigned long ProcessorCount; /* +0x0000 */ unsigned char Offsets[4]; /* +0x0004 f6 12 00 00 */ }; struct _FILE_STANDARD_INFO { unsigned char AllocationSize[8]; /* +0x0000 3d 13 00 00 */ unsigned char EndOfFile[8]; /* +0x0008 3d 13 00 00 */ unsigned long NumberOfLinks; /* +0x0010 */ unsigned char DeletePending; /* +0x0014 */ unsigned char Directory; /* +0x0015 */ }; struct _wireSAFEARR_VARIANT { unsigned long Size; /* +0x0000 */ unsigned char aVariant[4]; /* +0x0004 de 25 00 00 */ }; struct _CERT_BASIC_CONSTRAINTS_INFO { unsigned char SubjectType[12]; /* +0x0000 03 13 00 00 */ unsigned char fPathLenConstraint[4]; /* +0x000c 74 00 00 00 */ unsigned long dwPathLenConstraint; /* +0x0010 */ unsigned long cSubtreesConstraint; /* +0x0014 */ unsigned char rgSubtreesConstraint[4]; /* +0x0018 47 13 00 00 */ }; struct _SECTION_IMAGE_INFORMATION { void *TransferAddress; /* +0x0000 */ unsigned long ZeroBits; /* +0x0004 */ unsigned long MaximumStackSize; /* +0x0008 */ unsigned long CommittedStackSize; /* +0x000c */ unsigned long SubSystemType; /* +0x0010 */ unsigned short SubSystemMinorVersion; /* +0x0014 */ unsigned short SubSystemMajorVersion; /* +0x0016 */ unsigned long SubSystemVersion; /* +0x0014 */ unsigned long GpValue; /* +0x0018 */ unsigned short ImageCharacteristics; /* +0x001c */ unsigned short DllCharacteristics; /* +0x001e */ unsigned short Machine; /* +0x0020 */ unsigned char ImageContainsCode; /* +0x0022 */ unsigned char ImageFlags; /* +0x0023 */ /* unsigned char ComPlusNativeReady[0]; +0x0023 6f 1e 00 00 */ /* unsigned char ComPlusILOnly[0]; +0x0023 70 1e 00 00 */ /* unsigned char ImageDynamicallyRelocated[0]; +0x0023 71 1e 00 00 */ /* unsigned char ImageMappedFlat[0]; +0x0023 e3 25 00 00 */ /* unsigned char BaseBelow4gb[0]; +0x0023 c9 25 00 00 */ unsigned char Reserved[1]; /* +0x0023 e4 25 00 00 */ unsigned long LoaderFlags; /* +0x0024 */ unsigned long ImageFileSize; /* +0x0028 */ unsigned long CheckSum; /* +0x002c */ }; struct tagHELPWININFOW { unsigned char wStructSize[4]; /* +0x0000 74 00 00 00 */ unsigned char x[4]; /* +0x0004 74 00 00 00 */ unsigned char y[4]; /* +0x0008 74 00 00 00 */ unsigned char dx[4]; /* +0x000c 74 00 00 00 */ unsigned char dy[4]; /* +0x0010 74 00 00 00 */ unsigned char wMax[4]; /* +0x0014 74 00 00 00 */ unsigned char rgchMember[4]; /* +0x0018 e7 25 00 00 */ }; struct _HYPER_SIZEDARR { unsigned long clSize; /* +0x0000 */ long long *pData; /* +0x0004 */ }; struct tagCANDIDATEFORM { unsigned long dwIndex; /* +0x0000 */ unsigned long dwStyle; /* +0x0004 */ unsigned char ptCurrentPos[8]; /* +0x0008 8a 14 00 00 */ unsigned char rcArea[16]; /* +0x0010 63 14 00 00 */ }; struct _BCRYPT_OAEP_PADDING_INFO { unsigned char pszAlgId[4]; /* +0x0000 c0 13 00 00 */ unsigned char *pbLabel; /* +0x0004 */ unsigned long cbLabel; /* +0x0008 */ }; struct _NTFS_STATISTICS { unsigned long LogFileFullExceptions; /* +0x0000 */ unsigned long OtherExceptions; /* +0x0004 */ unsigned long MftReads; /* +0x0008 */ unsigned long MftReadBytes; /* +0x000c */ unsigned long MftWrites; /* +0x0010 */ unsigned long MftWriteBytes; /* +0x0014 */ }; struct _SYSTEM_SESSION_POOLTAG_INFORMATION { unsigned long NextEntryOffset; /* +0x0000 */ unsigned long SessionId; /* +0x0004 */ unsigned long Count; /* +0x0008 */ unsigned char TagInfo[28]; /* +0x000c 16 15 00 00 */ }; struct _RTL_VERIFIER_THUNK_DESCRIPTOR { char *ThunkName; /* +0x0000 */ void *ThunkOldAddress; /* +0x0004 */ void *ThunkNewAddress; /* +0x0008 */ }; struct tagMULTIKEYHELPA { unsigned long mkSize; /* +0x0000 */ char mkKeylist; /* +0x0004 */ unsigned char szKeyphrase[3]; /* +0x0005 df 23 00 00 */ }; struct tagBinaryParam { void *Buffer; /* +0x0000 */ short Size; /* +0x0004 */ }; struct _OCSP_REQUEST_INFO { unsigned long dwVersion; /* +0x0000 */ unsigned char pRequestorName[4]; /* +0x0004 11 18 00 00 */ unsigned long cRequestEntry; /* +0x0008 */ unsigned char rgRequestEntry[4]; /* +0x000c 19 26 00 00 */ unsigned long cExtension; /* +0x0010 */ unsigned char rgExtension[4]; /* +0x0014 22 16 00 00 */ }; struct _PROCESS_CYCLE_TIME_INFORMATION { unsigned long long AccumulatedCycles; /* +0x0000 */ unsigned long long CurrentCycleCount; /* +0x0008 */ }; struct _TRANSACTIONMANAGER_RECOVERY_INFORMATION { unsigned long long LastRecoveredLsn; /* +0x0000 */ }; struct _HEAP_BLOCK_EXTRA_INFORMATION { unsigned char Next; /* +0x0000 */ unsigned long Type; /* +0x0004 */ unsigned long Size; /* +0x0008 */ }; struct tagAUDIODESCRIPTION { unsigned char cbSize[4]; /* +0x0000 75 00 00 00 */ unsigned char Enabled[4]; /* +0x0004 74 00 00 00 */ unsigned long Locale; /* +0x0008 */ }; struct tagRID_DEVICE_INFO { unsigned long cbSize; /* +0x0000 */ unsigned long dwType; /* +0x0004 */ /* unsigned char mouse[0]; +0x0008 41 26 00 00 */ /* unsigned char keyboard[0]; +0x0008 42 26 00 00 */ unsigned char hid[24]; /* +0x0008 43 26 00 00 */ }; struct _CMC_ADD_ATTRIBUTES_INFO { unsigned long dwCmcDataReference; /* +0x0000 */ unsigned long cCertReference; /* +0x0004 */ unsigned long *rgdwCertReference; /* +0x0008 */ unsigned long cAttribute; /* +0x000c */ unsigned char rgAttribute[4]; /* +0x0010 d8 13 00 00 */ }; struct _SHNAMEMAPPINGA { char *pszOldPath; /* +0x0000 */ char *pszNewPath; /* +0x0004 */ unsigned char cchOldPath[4]; /* +0x0008 74 00 00 00 */ unsigned char cchNewPath[4]; /* +0x000c 74 00 00 00 */ }; struct _ImageArchitectureEntry { unsigned long FixupInstRVA; /* +0x0000 */ unsigned long NewInst; /* +0x0004 */ }; struct IMPORT_OBJECT_HEADER { unsigned short Sig1; /* +0x0000 */ unsigned short Sig2; /* +0x0002 */ unsigned short Version; /* +0x0004 */ unsigned short Machine; /* +0x0006 */ unsigned long TimeDateStamp; /* +0x0008 */ unsigned long SizeOfData; /* +0x000c */ unsigned short Ordinal; /* +0x0010 */ unsigned short Hint; /* +0x0010 */ /* unsigned char Type[0]; +0x0012 63 26 00 00 */ /* unsigned char NameType[0]; +0x0012 64 26 00 00 */ unsigned char Reserved[2]; /* +0x0012 65 26 00 00 */ }; struct _CERT_CREATE_CONTEXT_PARA { unsigned long cbSize; /* +0x0000 */ unsigned char pfnFree[4]; /* +0x0004 c7 13 00 00 */ void *pvFree; /* +0x0008 */ unsigned char pfnSort[4]; /* +0x000c 8c 26 00 00 */ void *pvSort; /* +0x0010 */ }; struct tagInterfaceData { unsigned long ulCntData; /* +0x0000 */ unsigned char abData[1024]; /* +0x0004 8f 26 00 00 */ }; struct _XSAVE_VENDOR { unsigned char VendorId[16]; /* +0x0000 22 13 00 00 */ unsigned char SupportedCpu[40]; /* +0x0010 92 26 00 00 */ }; struct _CRYPT_TIME_STAMP_REQUEST_INFO { char *pszTimeStampAlgorithm; /* +0x0000 */ char *pszContentType; /* +0x0004 */ unsigned char Content[8]; /* +0x0008 02 13 00 00 */ unsigned long cAttribute; /* +0x0010 */ unsigned char rgAttribute[4]; /* +0x0014 d8 13 00 00 */ }; struct _FNSAVE_FORMAT { unsigned long ControlWord; /* +0x0000 */ unsigned long StatusWord; /* +0x0004 */ unsigned long TagWord; /* +0x0008 */ unsigned long ErrorOffset; /* +0x000c */ unsigned long ErrorSelector; /* +0x0010 */ unsigned long DataOffset; /* +0x0014 */ unsigned long DataSelector; /* +0x0018 */ unsigned char RegisterArea[80]; /* +0x001c 97 26 00 00 */ }; struct _RTL_CRITICAL_SECTION32 { unsigned long DebugInfo; /* +0x0000 */ long LockCount; /* +0x0004 */ long RecursionCount; /* +0x0008 */ unsigned long OwningThread; /* +0x000c */ unsigned long LockSemaphore; /* +0x0010 */ unsigned long SpinCount; /* +0x0014 */ }; struct _HEAP_REGION_INFORMATION { unsigned long Address; /* +0x0000 */ unsigned long ReserveSize; /* +0x0004 */ unsigned long CommitSize; /* +0x0008 */ unsigned long FirstRangeInformationOffset; /* +0x000c */ unsigned long NextRegionInformationOffset; /* +0x0010 */ }; struct _CERT_AUTHORITY_KEY_ID2_INFO { unsigned char KeyId[8]; /* +0x0000 02 13 00 00 */ unsigned char AuthorityCertIssuer[8]; /* +0x0008 44 24 00 00 */ unsigned char AuthorityCertSerialNumber[8]; /* +0x0010 02 13 00 00 */ }; struct _CERT_LOGOTYPE_INFO { unsigned long dwLogotypeInfoChoice; /* +0x0000 */ /* unsigned char pLogotypeDirectInfo[0]; +0x0004 a1 26 00 00 */ unsigned char pLogotypeIndirectInfo[4]; /* +0x0004 a3 26 00 00 */ }; struct _COUNTER_READING { unsigned char Type[4]; /* +0x0000 d0 19 00 00 */ unsigned long Index; /* +0x0004 */ unsigned long long Start; /* +0x0008 */ unsigned long long Total; /* +0x0010 */ }; struct _SEMAPHORE_BASIC_INFORMATION { long CurrentCount; /* +0x0000 */ long MaximumCount; /* +0x0004 */ }; struct _QUERY_PERFORMANCE_COUNTER_FLAGS { /* unsigned char KernelTransition[0]; +0x0000 17 13 00 00 */ /* unsigned char Reserved[0]; +0x0000 8e 13 00 00 */ unsigned long ul; /* +0x0000 */ }; struct tagLOGPALETTE { unsigned short palVersion; /* +0x0000 */ unsigned short palNumEntries; /* +0x0002 */ unsigned char palPalEntry[4]; /* +0x0004 ae 26 00 00 */ }; struct _ALPC_PORT_ATTRIBUTES { unsigned long Flags; /* +0x0000 */ unsigned char SecurityQos[12]; /* +0x0004 b8 26 00 00 */ unsigned long MaxMessageLength; /* +0x0010 */ unsigned long MemoryBandwidth; /* +0x0014 */ unsigned long MaxPoolUsage; /* +0x0018 */ unsigned long MaxSectionSize; /* +0x001c */ unsigned long MaxViewSize; /* +0x0020 */ unsigned long MaxTotalSectionSize; /* +0x0024 */ unsigned long DupObjectTypes; /* +0x0028 */ }; struct _SYSTEM_HANDLE_INFORMATION { unsigned long NumberOfHandles; /* +0x0000 */ unsigned char Handles[16]; /* +0x0004 bd 26 00 00 */ }; struct tagCBT_CREATEWNDW { unsigned char lpcs[4]; /* +0x0000 c3 26 00 00 */ unsigned char hwndInsertAfter[4]; /* +0x0004 f1 12 00 00 */ }; struct tagMOUSEINPUT { long dx; /* +0x0000 */ long dy; /* +0x0004 */ unsigned long mouseData; /* +0x0008 */ unsigned long dwFlags; /* +0x000c */ unsigned long time; /* +0x0010 */ unsigned long dwExtraInfo; /* +0x0014 */ }; struct tagSTGMEDIUM { unsigned long tymed; /* +0x0000 */ /* unsigned char hBitmap[0]; +0x0004 06 18 00 00 */ void *hMetaFilePict; /* +0x0004 */ /* unsigned char hEnhMetaFile[0]; +0x0004 da 26 00 00 */ void *hGlobal; /* +0x0004 */ /* unsigned char lpszFileName[0]; +0x0004 71 04 00 00 */ /* unsigned char pstm[0]; +0x0004 dc 26 00 00 */ unsigned char pstg[4]; /* +0x0004 fc 15 00 00 */ unsigned char pUnkForRelease[4]; /* +0x0008 7f 17 00 00 */ }; struct _FSCTL_OFFLOAD_WRITE_INPUT { unsigned long Size; /* +0x0000 */ unsigned long Flags; /* +0x0004 */ unsigned long long FileOffset; /* +0x0008 */ unsigned long long CopyLength; /* +0x0010 */ unsigned long long TransferOffset; /* +0x0018 */ unsigned char Token[512]; /* +0x0020 76 19 00 00 */ }; struct _stat { unsigned char st_dev[4]; /* +0x0000 75 00 00 00 */ unsigned short st_ino; /* +0x0004 */ unsigned short st_mode; /* +0x0006 */ short st_nlink; /* +0x0008 */ short st_uid; /* +0x000a */ short st_gid; /* +0x000c */ unsigned char st_rdev[4]; /* +0x0010 75 00 00 00 */ long st_size; /* +0x0014 */ long st_atime; /* +0x0018 */ long st_mtime; /* +0x001c */ long st_ctime; /* +0x0020 */ }; struct tagEMRSETWORLDTRANSFORM { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned char xform[24]; /* +0x0008 d6 12 00 00 */ }; struct _CRYPT_HASH_INFO { unsigned char HashAlgorithm[12]; /* +0x0000 55 14 00 00 */ unsigned char Hash[8]; /* +0x000c 02 13 00 00 */ }; struct _PROCESS_MEMORY_ALLOCATION_MODE { unsigned long Flags; /* +0x0000 */ /* unsigned char TopDown[0]; +0x0000 17 13 00 00 */ unsigned char Reserved[4]; /* +0x0000 8e 13 00 00 */ }; struct _FILE_FULL_EA_INFORMATION { unsigned long NextEntryOffset; /* +0x0000 */ unsigned char Flags; /* +0x0004 */ unsigned char EaNameLength; /* +0x0005 */ unsigned short EaValueLength; /* +0x0006 */ unsigned char EaName[4]; /* +0x0008 df 23 00 00 */ }; struct _TXFS_WRITE_BACKUP_INFORMATION { unsigned char Buffer[1]; /* +0x0000 f9 12 00 00 */ }; struct _PERFORMANCE_DATA { unsigned short Size; /* +0x0000 */ unsigned char Version; /* +0x0002 */ unsigned char HwCountersCount; /* +0x0003 */ unsigned long ContextSwitchCount; /* +0x0004 */ unsigned long long WaitReasonBitMap; /* +0x0008 */ unsigned long long CycleTime; /* +0x0010 */ unsigned long RetryCount; /* +0x0018 */ unsigned long Reserved; /* +0x001c */ unsigned char HwCounters[256]; /* +0x0020 0d 27 00 00 */ }; struct tagENUMUILANG { unsigned long NumOfEnumUILang; /* +0x0000 */ unsigned long SizeOfEnumUIBuffer; /* +0x0004 */ unsigned short *pEnumUIBuffer; /* +0x0008 */ }; struct _CRYPT_OBJID_TABLE { unsigned long dwAlgId; /* +0x0000 */ unsigned char pszObjId[4]; /* +0x0004 62 14 00 00 */ }; struct _BOOT_AREA_INFO { unsigned long BootSectorCount; /* +0x0000 */ }; struct _HARDERROR_MSG { unsigned char h[24]; /* +0x0000 01 20 00 00 */ long Status; /* +0x0018 */ unsigned char ErrorTime[8]; /* +0x0020 3d 13 00 00 */ unsigned long ValidResponseOptions; /* +0x0028 */ unsigned long Response; /* +0x002c */ unsigned long NumberOfParameters; /* +0x0030 */ unsigned long UnicodeStringParameterMask; /* +0x0034 */ unsigned char Parameters[24]; /* +0x0038 3b 17 00 00 */ }; struct _PLUGPLAY_CONTROL_CLASS_ASSOCIATION_DATA { unsigned char DeviceInstance[8]; /* +0x0000 dd 12 00 00 */ unsigned char InterfaceGuid[4]; /* +0x0008 44 16 00 00 */ unsigned char Reference[8]; /* +0x000c dd 12 00 00 */ unsigned char Register; /* +0x0014 */ unsigned char SymLink[4]; /* +0x0018 71 04 00 00 */ unsigned long SymLinkLength; /* +0x001c */ }; struct _RTL_BALANCED_NODE { /* unsigned char Children[0]; +0x0000 2c 27 00 00 */ unsigned char Left[4]; /* +0x0000 0b 20 00 00 */ unsigned char Right[4]; /* +0x0004 0b 20 00 00 */ /* unsigned char Red[0]; +0x0008 6f 1e 00 00 */ /* unsigned char Balance[0]; +0x0008 c4 1e 00 00 */ unsigned long ParentValue; /* +0x0008 */ }; struct tagICONMETRICSW { unsigned char cbSize[4]; /* +0x0000 75 00 00 00 */ unsigned char iHorzSpacing[4]; /* +0x0004 74 00 00 00 */ unsigned char iVertSpacing[4]; /* +0x0008 74 00 00 00 */ unsigned char iTitleWrap[4]; /* +0x000c 74 00 00 00 */ unsigned char lfFont[92]; /* +0x0010 a3 16 00 00 */ }; struct _ACTIVATION_CONTEXT_BASIC_INFORMATION { /* unsigned char ActivationContext[0]; +0x0000 69 17 00 00 */ void *hActCtx; /* +0x0000 */ unsigned long Flags; /* +0x0004 */ unsigned long dwFlags; /* +0x0004 */ }; struct _CERT_AUTHORITY_KEY_ID_INFO { unsigned char KeyId[8]; /* +0x0000 02 13 00 00 */ unsigned char CertIssuer[8]; /* +0x0008 02 13 00 00 */ unsigned char CertSerialNumber[8]; /* +0x0010 02 13 00 00 */ }; struct _CERT_PAIR { unsigned char Forward[8]; /* +0x0000 02 13 00 00 */ unsigned char Reverse[8]; /* +0x0008 02 13 00 00 */ }; struct _CONSOLE_SCREEN_BUFFER_INFOEX { unsigned long cbSize; /* +0x0000 */ unsigned char dwSize[4]; /* +0x0004 09 18 00 00 */ unsigned char dwCursorPosition[4]; /* +0x0008 09 18 00 00 */ unsigned short wAttributes; /* +0x000c */ unsigned char srWindow[8]; /* +0x000e 42 27 00 00 */ unsigned char dwMaximumWindowSize[4]; /* +0x0016 09 18 00 00 */ unsigned short wPopupAttributes; /* +0x001a */ unsigned char bFullscreenSupported[4]; /* +0x001c 74 00 00 00 */ unsigned char ColorTable[64]; /* +0x0020 43 27 00 00 */ }; struct _ENUM_SERVICE_STATUSW { unsigned char lpServiceName[4]; /* +0x0000 71 04 00 00 */ unsigned char lpDisplayName[4]; /* +0x0004 71 04 00 00 */ unsigned char ServiceStatus[28]; /* +0x0008 46 27 00 00 */ }; struct _FILE_IO_PRIORITY_HINT_INFORMATION { unsigned char PriorityHint[4]; /* +0x0000 5d 27 00 00 */ }; struct _SECTION_IMAGE_INFORMATION64 { unsigned long long TransferAddress; /* +0x0000 */ unsigned long ZeroBits; /* +0x0008 */ unsigned long long MaximumStackSize; /* +0x0010 */ unsigned long long CommittedStackSize; /* +0x0018 */ unsigned long SubSystemType; /* +0x0020 */ unsigned short SubSystemMinorVersion; /* +0x0024 */ unsigned short SubSystemMajorVersion; /* +0x0026 */ unsigned long SubSystemVersion; /* +0x0024 */ unsigned long GpValue; /* +0x0028 */ unsigned short ImageCharacteristics; /* +0x002c */ unsigned short DllCharacteristics; /* +0x002e */ unsigned short Machine; /* +0x0030 */ unsigned char ImageContainsCode; /* +0x0032 */ unsigned char ImageFlags; /* +0x0033 */ /* unsigned char ComPlus[0]; +0x0033 6f 1e 00 00 */ /* unsigned char ImageDynamicallyRelocated[0]; +0x0033 70 1e 00 00 */ unsigned char Reserved[1]; /* +0x0033 05 20 00 00 */ unsigned long LoaderFlags; /* +0x0034 */ unsigned long ImageFileSize; /* +0x0038 */ unsigned long CheckSum; /* +0x003c */ }; struct _LINK_TRACKING_INFORMATION { unsigned char Type[4]; /* +0x0000 68 27 00 00 */ unsigned char VolumeId[16]; /* +0x0004 09 1c 00 00 */ }; struct _STARTUPINFOEXA { unsigned char StartupInfo[68]; /* +0x0000 6d 27 00 00 */ unsigned char lpAttributeList[4]; /* +0x0044 47 1e 00 00 */ }; struct _devicemodeA { unsigned char dmDeviceName[32]; /* +0x0000 e5 17 00 00 */ unsigned short dmSpecVersion; /* +0x0020 */ unsigned short dmDriverVersion; /* +0x0022 */ unsigned short dmSize; /* +0x0024 */ unsigned short dmDriverExtra; /* +0x0026 */ unsigned long dmFields; /* +0x0028 */ short dmOrientation; /* +0x002c */ short dmPaperSize; /* +0x002e */ short dmPaperLength; /* +0x0030 */ short dmPaperWidth; /* +0x0032 */ short dmScale; /* +0x0034 */ short dmCopies; /* +0x0036 */ short dmDefaultSource; /* +0x0038 */ short dmPrintQuality; /* +0x003a */ unsigned char dmPosition[8]; /* +0x002c 9f 13 00 00 */ unsigned long dmDisplayOrientation; /* +0x0034 */ unsigned long dmDisplayFixedOutput; /* +0x0038 */ short dmColor; /* +0x003c */ short dmDuplex; /* +0x003e */ short dmYResolution; /* +0x0040 */ short dmTTOption; /* +0x0042 */ short dmCollate; /* +0x0044 */ unsigned char dmFormName[32]; /* +0x0046 e5 17 00 00 */ unsigned short dmLogPixels; /* +0x0066 */ unsigned long dmBitsPerPel; /* +0x0068 */ unsigned long dmPelsWidth; /* +0x006c */ unsigned long dmPelsHeight; /* +0x0070 */ unsigned long dmDisplayFlags; /* +0x0074 */ unsigned long dmNup; /* +0x0074 */ unsigned long dmDisplayFrequency; /* +0x0078 */ unsigned long dmICMMethod; /* +0x007c */ unsigned long dmICMIntent; /* +0x0080 */ unsigned long dmMediaType; /* +0x0084 */ unsigned long dmDitherType; /* +0x0088 */ unsigned long dmReserved1; /* +0x008c */ unsigned long dmReserved2; /* +0x0090 */ unsigned long dmPanningWidth; /* +0x0094 */ unsigned long dmPanningHeight; /* +0x0098 */ }; struct _CONSOLE_FONT_INFOEX { unsigned long cbSize; /* +0x0000 */ unsigned long nFont; /* +0x0004 */ unsigned char dwFontSize[4]; /* +0x0008 09 18 00 00 */ unsigned char FontFamily[4]; /* +0x000c 75 00 00 00 */ unsigned char FontWeight[4]; /* +0x0010 75 00 00 00 */ unsigned char FaceName[64]; /* +0x0014 a5 15 00 00 */ }; struct value_entW { unsigned char ve_valuename[4]; /* +0x0000 71 04 00 00 */ unsigned long ve_valuelen; /* +0x0004 */ unsigned long ve_valueptr; /* +0x0008 */ unsigned long ve_type; /* +0x000c */ }; struct _CRYPT_CONTEXT_FUNCTIONS { unsigned long cFunctions; /* +0x0000 */ unsigned char rgpszFunctions[4]; /* +0x0004 d0 13 00 00 */ }; struct _CROSS_CERT_DIST_POINTS_INFO { unsigned long dwSyncDeltaTime; /* +0x0000 */ unsigned long cDistPoint; /* +0x0004 */ unsigned char rgDistPoint[4]; /* +0x0008 78 27 00 00 */ }; struct _REPAIR_DEFERRED_EXTENTS_INPUT { unsigned long Flags; /* +0x0000 */ unsigned long ExtentCount; /* +0x0004 */ unsigned char Extents[16]; /* +0x0008 18 21 00 00 */ }; struct _COVERAGE_MODULES { unsigned long ListAndReset; /* +0x0000 */ unsigned long NumberOfModules; /* +0x0004 */ unsigned char ModuleRequestInfo[20]; /* +0x0008 7e 27 00 00 */ unsigned char Modules[24]; /* +0x001c 80 27 00 00 */ }; struct _PACKEDEVENTINFO { unsigned long ulSize; /* +0x0000 */ unsigned long ulNumEventsForLogFile; /* +0x0004 */ /* unsigned char ulOffsets[0]; +0x0008 83 27 00 00 */ }; struct _LOOKUP_STREAM_FROM_CLUSTER_ENTRY { unsigned long OffsetToNext; /* +0x0000 */ unsigned long Flags; /* +0x0004 */ unsigned char Reserved[8]; /* +0x0008 3d 13 00 00 */ unsigned char Cluster[8]; /* +0x0010 3d 13 00 00 */ unsigned char FileName[8]; /* +0x0018 f7 13 00 00 */ }; struct _POWER_SESSION_RIT_STATE { unsigned char Active; /* +0x0000 */ unsigned long LastInputTime; /* +0x0004 */ }; struct _KEY_VALUE_PARTIAL_INFORMATION { unsigned long TitleIndex; /* +0x0000 */ unsigned long Type; /* +0x0004 */ unsigned long DataLength; /* +0x0008 */ unsigned char Data[4]; /* +0x000c f9 12 00 00 */ }; struct _INVERTED_FUNCTION_TABLE { unsigned long CurrentSize; /* +0x0000 */ unsigned long MaximumSize; /* +0x0004 */ unsigned char Epoch[4]; /* +0x0008 bb 17 00 00 */ unsigned char Overflow; /* +0x000c */ unsigned char TableEntry[8192]; /* +0x0010 98 27 00 00 */ }; struct tagWNDCLASSEXW { unsigned char cbSize[4]; /* +0x0000 75 00 00 00 */ unsigned char style[4]; /* +0x0004 75 00 00 00 */ unsigned char lpfnWndProc[4]; /* +0x0008 b0 27 00 00 */ unsigned char cbClsExtra[4]; /* +0x000c 74 00 00 00 */ unsigned char cbWndExtra[4]; /* +0x0010 74 00 00 00 */ unsigned char hInstance[4]; /* +0x0014 ba 14 00 00 */ unsigned char hIcon[4]; /* +0x0018 07 21 00 00 */ unsigned char hCursor[4]; /* +0x001c 07 21 00 00 */ unsigned char hbrBackground[4]; /* +0x0020 4f 23 00 00 */ unsigned char lpszMenuName[4]; /* +0x0024 c0 13 00 00 */ unsigned char lpszClassName[4]; /* +0x0028 c0 13 00 00 */ unsigned char hIconSm[4]; /* +0x002c 07 21 00 00 */ }; struct tagMENUITEMINFOW { unsigned char cbSize[4]; /* +0x0000 75 00 00 00 */ unsigned char fMask[4]; /* +0x0004 75 00 00 00 */ unsigned char fType[4]; /* +0x0008 75 00 00 00 */ unsigned char fState[4]; /* +0x000c 75 00 00 00 */ unsigned char wID[4]; /* +0x0010 75 00 00 00 */ unsigned char hSubMenu[4]; /* +0x0014 4c 15 00 00 */ unsigned char hbmpChecked[4]; /* +0x0018 06 18 00 00 */ unsigned char hbmpUnchecked[4]; /* +0x001c 06 18 00 00 */ unsigned long dwItemData; /* +0x0020 */ unsigned char dwTypeData[4]; /* +0x0024 71 04 00 00 */ unsigned char cch[4]; /* +0x0028 75 00 00 00 */ unsigned char hbmpItem[4]; /* +0x002c 06 18 00 00 */ }; struct _s__RTTIClassHierarchyDescriptor { unsigned long signature; /* +0x0000 */ unsigned long attributes; /* +0x0004 */ unsigned long numBaseClasses; /* +0x0008 */ unsigned char pBaseClassArray[4]; /* +0x000c b9 27 00 00 */ }; struct _PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY { unsigned long Flags; /* +0x0000 */ /* unsigned char DisallowWin32kSystemCalls[0]; +0x0000 17 13 00 00 */ unsigned char ReservedFlags[4]; /* +0x0000 8e 13 00 00 */ }; struct _THREAD_PROFILING_INFORMATION { unsigned long long HardwareCounters; /* +0x0000 */ unsigned long Flags; /* +0x0008 */ unsigned long Enable; /* +0x000c */ unsigned char PerformanceData[8]; /* +0x0010 bf 27 00 00 */ }; struct _KEY_NAME_INFORMATION { unsigned long NameLength; /* +0x0000 */ unsigned char Name[4]; /* +0x0004 f7 13 00 00 */ }; struct _RTL_PROCESS_HEAPS { unsigned long NumberOfHeaps; /* +0x0000 */ unsigned char Heaps[64]; /* +0x0004 c7 27 00 00 */ }; struct tagGCP_RESULTSA { unsigned long lStructSize; /* +0x0000 */ char *lpOutString; /* +0x0004 */ unsigned char lpOrder[4]; /* +0x0008 75 04 00 00 */ unsigned char lpDx[4]; /* +0x000c 74 04 00 00 */ unsigned char lpCaretPos[4]; /* +0x0010 74 04 00 00 */ char *lpClass; /* +0x0014 */ unsigned char lpGlyphs[4]; /* +0x0018 71 04 00 00 */ unsigned char nGlyphs[4]; /* +0x001c 75 00 00 00 */ unsigned char nMaxFit[4]; /* +0x0020 74 00 00 00 */ }; struct _KEY_WOW64_FLAGS_INFORMATION { unsigned long UserFlags; /* +0x0000 */ }; struct _RTL_ANSI_STRING_BUFFER { unsigned char String[8]; /* +0x0000 d4 17 00 00 */ unsigned char ByteBuffer[24]; /* +0x0008 ef 27 00 00 */ unsigned char MinimumStaticBufferForTerminalNul[4]; /* +0x0020 f9 12 00 00 */ }; struct tagMETARECORD { unsigned long rdSize; /* +0x0000 */ unsigned short rdFunction; /* +0x0004 */ unsigned char rdParm[2]; /* +0x0006 ba 15 00 00 */ }; struct tagRPC_ERROR_ENUM_HANDLE { unsigned long Signature; /* +0x0000 */ void *CurrentPos; /* +0x0004 */ void *Head; /* +0x0008 */ }; struct _TRANSACTION_NOTIFICATION_PROPAGATE_ARGUMENT { unsigned long PropagationCookie; /* +0x0000 */ unsigned char UOW[16]; /* +0x0004 dc 14 00 00 */ unsigned char TmIdentity[16]; /* +0x0014 dc 14 00 00 */ unsigned long BufferLength; /* +0x0024 */ }; struct tagWNDCLASSEXA { unsigned char cbSize[4]; /* +0x0000 75 00 00 00 */ unsigned char style[4]; /* +0x0004 75 00 00 00 */ unsigned char lpfnWndProc[4]; /* +0x0008 b0 27 00 00 */ unsigned char cbClsExtra[4]; /* +0x000c 74 00 00 00 */ unsigned char cbWndExtra[4]; /* +0x0010 74 00 00 00 */ unsigned char hInstance[4]; /* +0x0014 ba 14 00 00 */ unsigned char hIcon[4]; /* +0x0018 07 21 00 00 */ unsigned char hCursor[4]; /* +0x001c 07 21 00 00 */ unsigned char hbrBackground[4]; /* +0x0020 4f 23 00 00 */ unsigned char lpszMenuName[4]; /* +0x0024 62 14 00 00 */ unsigned char lpszClassName[4]; /* +0x0028 62 14 00 00 */ unsigned char hIconSm[4]; /* +0x002c 07 21 00 00 */ }; struct _UUID_VECTOR { unsigned long Count; /* +0x0000 */ unsigned char Uuid[4]; /* +0x0004 fa 27 00 00 */ }; struct _CRYPT_DECRYPT_MESSAGE_PARA { unsigned long cbSize; /* +0x0000 */ unsigned long dwMsgAndCertEncodingType; /* +0x0004 */ unsigned long cCertStore; /* +0x0008 */ unsigned char rghCertStore[4]; /* +0x000c 4f 13 00 00 */ }; struct _devicemodeW { unsigned char dmDeviceName[64]; /* +0x0000 a5 15 00 00 */ unsigned short dmSpecVersion; /* +0x0040 */ unsigned short dmDriverVersion; /* +0x0042 */ unsigned short dmSize; /* +0x0044 */ unsigned short dmDriverExtra; /* +0x0046 */ unsigned long dmFields; /* +0x0048 */ short dmOrientation; /* +0x004c */ short dmPaperSize; /* +0x004e */ short dmPaperLength; /* +0x0050 */ short dmPaperWidth; /* +0x0052 */ short dmScale; /* +0x0054 */ short dmCopies; /* +0x0056 */ short dmDefaultSource; /* +0x0058 */ short dmPrintQuality; /* +0x005a */ unsigned char dmPosition[8]; /* +0x004c 9f 13 00 00 */ unsigned long dmDisplayOrientation; /* +0x0054 */ unsigned long dmDisplayFixedOutput; /* +0x0058 */ short dmColor; /* +0x005c */ short dmDuplex; /* +0x005e */ short dmYResolution; /* +0x0060 */ short dmTTOption; /* +0x0062 */ short dmCollate; /* +0x0064 */ unsigned char dmFormName[64]; /* +0x0066 a5 15 00 00 */ unsigned short dmLogPixels; /* +0x00a6 */ unsigned long dmBitsPerPel; /* +0x00a8 */ unsigned long dmPelsWidth; /* +0x00ac */ unsigned long dmPelsHeight; /* +0x00b0 */ unsigned long dmDisplayFlags; /* +0x00b4 */ unsigned long dmNup; /* +0x00b4 */ unsigned long dmDisplayFrequency; /* +0x00b8 */ unsigned long dmICMMethod; /* +0x00bc */ unsigned long dmICMIntent; /* +0x00c0 */ unsigned long dmMediaType; /* +0x00c4 */ unsigned long dmDitherType; /* +0x00c8 */ unsigned long dmReserved1; /* +0x00cc */ unsigned long dmReserved2; /* +0x00d0 */ unsigned long dmPanningWidth; /* +0x00d4 */ unsigned long dmPanningHeight; /* +0x00d8 */ }; enum tagSTREAM_SEEK { STREAM_SEEK_SET = 0, STREAM_SEEK_CUR = 1, STREAM_SEEK_END = 2 }; struct _REPAIR_DEFERRED_EXTENTS_OUTPUT { unsigned long Status; /* +0x0000 */ unsigned long ErrorExtentIndex; /* +0x0004 */ unsigned char ErrorExtent[16]; /* +0x0008 17 21 00 00 */ }; struct tagEMRTEXT { unsigned char ptlReference[8]; /* +0x0000 9f 13 00 00 */ unsigned long nChars; /* +0x0008 */ unsigned long offString; /* +0x000c */ unsigned long fOptions; /* +0x0010 */ unsigned char rcl[16]; /* +0x0014 d5 12 00 00 */ unsigned long offDx; /* +0x0024 */ }; struct tagHARDWAREINPUT { unsigned long uMsg; /* +0x0000 */ unsigned short wParamL; /* +0x0004 */ unsigned short wParamH; /* +0x0006 */ }; struct tagWINDOWINFO { unsigned long cbSize; /* +0x0000 */ unsigned char rcWindow[16]; /* +0x0004 63 14 00 00 */ unsigned char rcClient[16]; /* +0x0014 63 14 00 00 */ unsigned long dwStyle; /* +0x0024 */ unsigned long dwExStyle; /* +0x0028 */ unsigned long dwWindowStatus; /* +0x002c */ unsigned char cxWindowBorders[4]; /* +0x0030 75 00 00 00 */ unsigned char cyWindowBorders[4]; /* +0x0034 75 00 00 00 */ unsigned short atomWindowType; /* +0x0038 */ unsigned short wCreatorVersion; /* +0x003a */ }; struct _heapinfo { unsigned char _pentry[4]; /* +0x0000 74 04 00 00 */ unsigned char _size[4]; /* +0x0004 75 00 00 00 */ unsigned char _useflag[4]; /* +0x0008 74 00 00 00 */ }; struct tagDCOM_ENDPOINT { unsigned char wszProtSeq[4]; /* +0x0000 71 04 00 00 */ unsigned char wszPorts[4]; /* +0x0004 71 04 00 00 */ unsigned long dwFlags; /* +0x0008 */ }; struct _SCONTEXT_QUEUE { unsigned long NumberOfObjects; /* +0x0000 */ unsigned char ArrayOfObjects[4]; /* +0x0004 22 28 00 00 */ }; struct tagWINDOWPLACEMENT { unsigned char length[4]; /* +0x0000 75 00 00 00 */ unsigned char flags[4]; /* +0x0004 75 00 00 00 */ unsigned char showCmd[4]; /* +0x0008 75 00 00 00 */ unsigned char ptMinPosition[8]; /* +0x000c 8a 14 00 00 */ unsigned char ptMaxPosition[8]; /* +0x0014 8a 14 00 00 */ unsigned char rcNormalPosition[16]; /* +0x001c 63 14 00 00 */ }; struct _TEB_ACTIVE_FRAME_CONTEXT_EX { unsigned char BasicContext[8]; /* +0x0000 63 28 00 00 */ unsigned char SourceLocation[4]; /* +0x0008 62 14 00 00 */ }; struct _RPC_HTTP_TRANSPORT_CREDENTIALS_V3_A { void *TransportCredentials; /* +0x0000 */ unsigned long Flags; /* +0x0004 */ unsigned long AuthenticationTarget; /* +0x0008 */ unsigned long NumberOfAuthnSchemes; /* +0x000c */ unsigned long *AuthnSchemes; /* +0x0010 */ unsigned char *ServerCertificateSubject; /* +0x0014 */ void *ProxyCredentials; /* +0x0018 */ unsigned long NumberOfProxyAuthnSchemes; /* +0x001c */ unsigned long *ProxyAuthnSchemes; /* +0x0020 */ }; struct _SHNAMEMAPPINGW { unsigned char pszOldPath[4]; /* +0x0000 71 04 00 00 */ unsigned char pszNewPath[4]; /* +0x0004 71 04 00 00 */ unsigned char cchOldPath[4]; /* +0x0008 74 00 00 00 */ unsigned char cchNewPath[4]; /* +0x000c 74 00 00 00 */ }; struct _JOBOBJECT_BASIC_LIMIT_INFORMATION { unsigned char PerProcessUserTimeLimit[8]; /* +0x0000 3d 13 00 00 */ unsigned char PerJobUserTimeLimit[8]; /* +0x0008 3d 13 00 00 */ unsigned long LimitFlags; /* +0x0010 */ unsigned long MinimumWorkingSetSize; /* +0x0014 */ unsigned long MaximumWorkingSetSize; /* +0x0018 */ unsigned long ActiveProcessLimit; /* +0x001c */ unsigned long Affinity; /* +0x0020 */ unsigned long PriorityClass; /* +0x0024 */ unsigned long SchedulingClass; /* +0x0028 */ }; struct tagVS_FIXEDFILEINFO { unsigned long dwSignature; /* +0x0000 */ unsigned long dwStrucVersion; /* +0x0004 */ unsigned long dwFileVersionMS; /* +0x0008 */ unsigned long dwFileVersionLS; /* +0x000c */ unsigned long dwProductVersionMS; /* +0x0010 */ unsigned long dwProductVersionLS; /* +0x0014 */ unsigned long dwFileFlagsMask; /* +0x0018 */ unsigned long dwFileFlags; /* +0x001c */ unsigned long dwFileOS; /* +0x0020 */ unsigned long dwFileType; /* +0x0024 */ unsigned long dwFileSubtype; /* +0x0028 */ unsigned long dwFileDateMS; /* +0x002c */ unsigned long dwFileDateLS; /* +0x0030 */ }; struct _CRYPT_VERIFY_MESSAGE_PARA { unsigned long cbSize; /* +0x0000 */ unsigned long dwMsgAndCertEncodingType; /* +0x0004 */ unsigned long hCryptProv; /* +0x0008 */ unsigned char pfnGetSignerCertificate[4]; /* +0x000c 96 28 00 00 */ void *pvGetArg; /* +0x0010 */ }; struct _EXCEPTION_RECORD32 { long ExceptionCode; /* +0x0000 */ unsigned long ExceptionFlags; /* +0x0004 */ unsigned long ExceptionRecord; /* +0x0008 */ unsigned long ExceptionAddress; /* +0x000c */ unsigned long NumberParameters; /* +0x0010 */ unsigned char ExceptionInformation[60]; /* +0x0014 99 28 00 00 */ }; struct tagMENUITEMINFOA { unsigned char cbSize[4]; /* +0x0000 75 00 00 00 */ unsigned char fMask[4]; /* +0x0004 75 00 00 00 */ unsigned char fType[4]; /* +0x0008 75 00 00 00 */ unsigned char fState[4]; /* +0x000c 75 00 00 00 */ unsigned char wID[4]; /* +0x0010 75 00 00 00 */ unsigned char hSubMenu[4]; /* +0x0014 4c 15 00 00 */ unsigned char hbmpChecked[4]; /* +0x0018 06 18 00 00 */ unsigned char hbmpUnchecked[4]; /* +0x001c 06 18 00 00 */ unsigned long dwItemData; /* +0x0020 */ char *dwTypeData; /* +0x0024 */ unsigned char cch[4]; /* +0x0028 75 00 00 00 */ unsigned char hbmpItem[4]; /* +0x002c 06 18 00 00 */ }; struct _CMSG_SIGNED_ENCODE_INFO { unsigned long cbSize; /* +0x0000 */ unsigned long cSigners; /* +0x0004 */ unsigned char rgSigners[4]; /* +0x0008 a4 28 00 00 */ unsigned long cCertEncoded; /* +0x000c */ unsigned char rgCertEncoded[4]; /* +0x0010 47 13 00 00 */ unsigned long cCrlEncoded; /* +0x0014 */ unsigned char rgCrlEncoded[4]; /* +0x0018 47 13 00 00 */ }; struct tagEMREXTCREATEPEN { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned long ihPen; /* +0x0008 */ unsigned long offBmi; /* +0x000c */ unsigned long cbBmi; /* +0x0010 */ unsigned long offBits; /* +0x0014 */ unsigned long cbBits; /* +0x0018 */ unsigned char elp[28]; /* +0x001c ec 1e 00 00 */ }; struct _IMAGE_RELOCATION { unsigned long VirtualAddress; /* +0x0000 */ unsigned long RelocCount; /* +0x0000 */ unsigned long SymbolTableIndex; /* +0x0004 */ unsigned short Type; /* +0x0008 */ }; struct tagWTSSESSION_NOTIFICATION { unsigned long cbSize; /* +0x0000 */ unsigned long dwSessionId; /* +0x0004 */ }; struct _TXFS_LIST_TRANSACTION_LOCKED_FILES { unsigned char KtmTransaction[16]; /* +0x0000 dc 14 00 00 */ unsigned long long NumberOfFiles; /* +0x0010 */ unsigned long long BufferSizeRequired; /* +0x0018 */ unsigned long long Offset; /* +0x0020 */ }; struct _FILE_ATTRIBUTE_CACHE_VALUE { long Status; /* +0x0000 */ unsigned short Size; /* +0x0004 */ unsigned short RequiredSize; /* +0x0006 */ unsigned char Data[4]; /* +0x0008 f9 12 00 00 */ }; struct _LOAD_ASDATA_TABLE { void *Module; /* +0x0000 */ unsigned char FilePath[4]; /* +0x0004 71 04 00 00 */ unsigned long Size; /* +0x0008 */ void *Handle; /* +0x000c */ long RefCount; /* +0x0010 */ unsigned char EntryPointActivationContext[4]; /* +0x0014 69 17 00 00 */ }; struct _s__RTTIBaseClassDescriptor2 { unsigned char pTypeDescriptor[4]; /* +0x0000 52 17 00 00 */ unsigned long numContainedBases; /* +0x0004 */ unsigned char where[12]; /* +0x0008 d5 28 00 00 */ unsigned long attributes; /* +0x0014 */ unsigned char pClassDescriptor[4]; /* +0x0018 55 17 00 00 */ }; struct _PS_CPU_QUOTA_QUERY_INFORMATION { unsigned long SessionCount; /* +0x0000 */ unsigned char SessionInformation[8]; /* +0x0004 d9 28 00 00 */ }; struct _FILE_MOVE_CLUSTER_INFORMATION { unsigned long ClusterCount; /* +0x0000 */ void *RootDirectory; /* +0x0004 */ unsigned long FileNameLength; /* +0x0008 */ unsigned char FileName[4]; /* +0x000c f7 13 00 00 */ }; struct _QUERY_SERVICE_LOCK_STATUSW { unsigned long fIsLocked; /* +0x0000 */ unsigned char lpLockOwner[4]; /* +0x0004 71 04 00 00 */ unsigned long dwLockDuration; /* +0x0008 */ }; struct _CRYPT_KEY_PROV_PARAM { unsigned long dwParam; /* +0x0000 */ unsigned char *pbData; /* +0x0004 */ unsigned long cbData; /* +0x0008 */ unsigned long dwFlags; /* +0x000c */ }; struct _FILE_VALID_DATA_LENGTH_INFORMATION { unsigned char ValidDataLength[8]; /* +0x0000 3d 13 00 00 */ }; struct _MODEMDEVCAPS { unsigned long dwActualSize; /* +0x0000 */ unsigned long dwRequiredSize; /* +0x0004 */ unsigned long dwDevSpecificOffset; /* +0x0008 */ unsigned long dwDevSpecificSize; /* +0x000c */ unsigned long dwModemProviderVersion; /* +0x0010 */ unsigned long dwModemManufacturerOffset; /* +0x0014 */ unsigned long dwModemManufacturerSize; /* +0x0018 */ unsigned long dwModemModelOffset; /* +0x001c */ unsigned long dwModemModelSize; /* +0x0020 */ unsigned long dwModemVersionOffset; /* +0x0024 */ unsigned long dwModemVersionSize; /* +0x0028 */ unsigned long dwDialOptions; /* +0x002c */ unsigned long dwCallSetupFailTimer; /* +0x0030 */ unsigned long dwInactivityTimeout; /* +0x0034 */ unsigned long dwSpeakerVolume; /* +0x0038 */ unsigned long dwSpeakerMode; /* +0x003c */ unsigned long dwModemOptions; /* +0x0040 */ unsigned long dwMaxDTERate; /* +0x0044 */ unsigned long dwMaxDCERate; /* +0x0048 */ unsigned char abVariablePortion[4]; /* +0x004c f9 12 00 00 */ }; struct _RTL_STACK_TRACE_DATABASE_CREATE { void *CommitBase; /* +0x0000 */ unsigned long CommitSize; /* +0x0004 */ unsigned long ReserveSize; /* +0x0008 */ }; struct _MOUSE_EVENT_RECORD { unsigned char dwMousePosition[4]; /* +0x0000 09 18 00 00 */ unsigned long dwButtonState; /* +0x0004 */ unsigned long dwControlKeyState; /* +0x0008 */ unsigned long dwEventFlags; /* +0x000c */ }; struct _STRING32 { unsigned short Length; /* +0x0000 */ unsigned short MaximumLength; /* +0x0002 */ unsigned long Buffer; /* +0x0004 */ }; struct _KLDR_DATA_TABLE_ENTRY64 { unsigned char InLoadOrderLinks[16]; /* +0x0000 e7 1c 00 00 */ unsigned long long __Undefined1; /* +0x0010 */ unsigned long long __Undefined2; /* +0x0018 */ unsigned long long __Undefined3; /* +0x0020 */ unsigned long long NonPagedDebugInfo; /* +0x0028 */ unsigned long long DllBase; /* +0x0030 */ unsigned long long EntryPoint; /* +0x0038 */ unsigned long SizeOfImage; /* +0x0040 */ unsigned char FullDllName[16]; /* +0x0048 0d 29 00 00 */ unsigned char BaseDllName[16]; /* +0x0058 0d 29 00 00 */ unsigned long Flags; /* +0x0068 */ unsigned short LoadCount; /* +0x006c */ unsigned short __Undefined5; /* +0x006e */ unsigned long long __Undefined6; /* +0x0070 */ unsigned long CheckSum; /* +0x0078 */ unsigned long __padding1; /* +0x007c */ unsigned long TimeDateStamp; /* +0x0080 */ unsigned long __padding2; /* +0x0084 */ }; struct _FILE_BOTH_DIR_INFORMATION { unsigned long NextEntryOffset; /* +0x0000 */ unsigned long FileIndex; /* +0x0004 */ unsigned char CreationTime[8]; /* +0x0008 3d 13 00 00 */ unsigned char LastAccessTime[8]; /* +0x0010 3d 13 00 00 */ unsigned char LastWriteTime[8]; /* +0x0018 3d 13 00 00 */ unsigned char ChangeTime[8]; /* +0x0020 3d 13 00 00 */ unsigned char EndOfFile[8]; /* +0x0028 3d 13 00 00 */ unsigned char AllocationSize[8]; /* +0x0030 3d 13 00 00 */ unsigned long FileAttributes; /* +0x0038 */ unsigned long FileNameLength; /* +0x003c */ unsigned long EaSize; /* +0x0040 */ char ShortNameLength; /* +0x0044 */ unsigned char ShortName[24]; /* +0x0046 11 29 00 00 */ unsigned char FileName[2]; /* +0x005e f7 13 00 00 */ }; struct _SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT { unsigned long Hits; /* +0x0000 */ unsigned char PercentFrequency; /* +0x0004 */ }; struct _SYSTEM_VERIFIER_COUNTERS_INFORMATION { unsigned char Legacy[104]; /* +0x0000 16 29 00 00 */ unsigned long RaiseIrqls; /* +0x0068 */ unsigned long AcquireSpinLocks; /* +0x006c */ unsigned long SynchronizeExecutions; /* +0x0070 */ unsigned long AllocationsWithNoTag; /* +0x0074 */ unsigned long AllocationsFailed; /* +0x0078 */ unsigned long AllocationsFailedDeliberately; /* +0x007c */ unsigned long LockedBytes; /* +0x0080 */ unsigned long PeakLockedBytes; /* +0x0084 */ unsigned long MappedLockedBytes; /* +0x0088 */ unsigned long PeakMappedLockedBytes; /* +0x008c */ unsigned long MappedIoSpaceBytes; /* +0x0090 */ unsigned long PeakMappedIoSpaceBytes; /* +0x0094 */ unsigned long PagesForMdlBytes; /* +0x0098 */ unsigned long PeakPagesForMdlBytes; /* +0x009c */ unsigned long ContiguousMemoryBytes; /* +0x00a0 */ unsigned long PeakContiguousMemoryBytes; /* +0x00a4 */ }; struct _SYSTEM_EXTENDED_THREAD_INFORMATION { unsigned char ThreadInfo[64]; /* +0x0000 1b 29 00 00 */ void *StackBase; /* +0x0040 */ void *StackLimit; /* +0x0044 */ void *Win32StartAddress; /* +0x0048 */ void *TebBase; /* +0x004c */ unsigned long Reserved2; /* +0x0050 */ unsigned long Reserved3; /* +0x0054 */ unsigned long Reserved4; /* +0x0058 */ }; struct _RTL_RELATIVE_NAME_U { unsigned char RelativeName[8]; /* +0x0000 dd 12 00 00 */ void *ContainingDirectory; /* +0x0008 */ unsigned char CurDirRef[4]; /* +0x000c 21 29 00 00 */ }; struct _MIDL_STUB_MESSAGE { unsigned char RpcMsg[4]; /* +0x0000 2c 29 00 00 */ unsigned char *Buffer; /* +0x0004 */ unsigned char *BufferStart; /* +0x0008 */ unsigned char *BufferEnd; /* +0x000c */ unsigned char *BufferMark; /* +0x0010 */ unsigned long BufferLength; /* +0x0014 */ unsigned long MemorySize; /* +0x0018 */ unsigned char *Memory; /* +0x001c */ unsigned char IsClient; /* +0x0020 */ unsigned char Pad; /* +0x0021 */ unsigned short uFlags2; /* +0x0022 */ unsigned char ReuseBuffer[4]; /* +0x0024 74 00 00 00 */ unsigned char pAllocAllNodesContext[4]; /* +0x0028 2e 29 00 00 */ unsigned char pPointerQueueState[4]; /* +0x002c 30 29 00 00 */ unsigned char IgnoreEmbeddedPointers[4]; /* +0x0030 74 00 00 00 */ unsigned char *PointerBufferMark; /* +0x0034 */ unsigned char CorrDespIncrement; /* +0x0038 */ unsigned char uFlags; /* +0x0039 */ unsigned short UniquePtrCount; /* +0x003a */ unsigned long MaxCount; /* +0x003c */ unsigned long Offset; /* +0x0040 */ unsigned long ActualCount; /* +0x0044 */ unsigned char pfnAllocate[4]; /* +0x0048 66 19 00 00 */ unsigned char pfnFree[4]; /* +0x004c c7 13 00 00 */ unsigned char *StackTop; /* +0x0050 */ unsigned char *pPresentedType; /* +0x0054 */ unsigned char *pTransmitType; /* +0x0058 */ void *SavedHandle; /* +0x005c */ unsigned char StubDesc[4]; /* +0x0060 33 29 00 00 */ unsigned char FullPtrXlatTables[4]; /* +0x0064 35 29 00 00 */ unsigned long FullPtrRefId; /* +0x0068 */ unsigned long PointerLength; /* +0x006c */ /* unsigned char fInDontFree[0]; +0x0070 1f 23 00 00 */ /* unsigned char fDontCallFreeInst[0]; +0x0070 20 23 00 00 */ /* unsigned char fInOnlyParam[0]; +0x0070 36 29 00 00 */ /* unsigned char fHasReturn[0]; +0x0070 37 29 00 00 */ /* unsigned char fHasExtensions[0]; +0x0070 38 29 00 00 */ /* unsigned char fHasNewCorrDesc[0]; +0x0070 39 29 00 00 */ /* unsigned char fIsIn[0]; +0x0070 3a 29 00 00 */ /* unsigned char fIsOut[0]; +0x0070 3b 29 00 00 */ /* unsigned char fIsOicf[0]; +0x0070 3c 29 00 00 */ /* unsigned char fBufferValid[0]; +0x0070 3d 29 00 00 */ /* unsigned char fHasMemoryValidateCallback[0]; +0x0070 3e 29 00 00 */ /* unsigned char fInFree[0]; +0x0070 3f 29 00 00 */ /* unsigned char fNeedMCCP[0]; +0x0070 40 29 00 00 */ /* unsigned char fUnused[0]; +0x0070 41 29 00 00 */ unsigned char fUnused2[4]; /* +0x0070 42 29 00 00 */ unsigned long dwDestContext; /* +0x0074 */ void *pvDestContext; /* +0x0078 */ unsigned char SavedContextHandles[4]; /* +0x007c 22 28 00 00 */ long ParamNumber; /* +0x0080 */ unsigned char pRpcChannelBuffer[4]; /* +0x0084 68 19 00 00 */ unsigned char pArrayInfo[4]; /* +0x0088 44 29 00 00 */ unsigned long *SizePtrCountArray; /* +0x008c */ unsigned long *SizePtrOffsetArray; /* +0x0090 */ unsigned long *SizePtrLengthArray; /* +0x0094 */ void *pArgQueue; /* +0x0098 */ unsigned long dwStubPhase; /* +0x009c */ void *LowStackMark; /* +0x00a0 */ unsigned char pAsyncMsg[4]; /* +0x00a4 46 29 00 00 */ unsigned char pCorrInfo[4]; /* +0x00a8 52 15 00 00 */ unsigned char *pCorrMemory; /* +0x00ac */ void *pMemoryList; /* +0x00b0 */ unsigned char pCSInfo[4]; /* +0x00b4 74 00 00 00 */ unsigned char *ConformanceMark; /* +0x00b8 */ unsigned char *VarianceMark; /* +0x00bc */ unsigned char Unused[4]; /* +0x00c0 74 00 00 00 */ unsigned char pContext[4]; /* +0x00c4 48 29 00 00 */ void *ContextHandleHash; /* +0x00c8 */ void *pUserMarshalList; /* +0x00cc */ unsigned char Reserved51_3[4]; /* +0x00d0 74 00 00 00 */ unsigned char Reserved51_4[4]; /* +0x00d4 74 00 00 00 */ unsigned char Reserved51_5[4]; /* +0x00d8 74 00 00 00 */ }; struct _CONNECTDLGSTRUCTW { unsigned long cbStructure; /* +0x0000 */ unsigned char hwndOwner[4]; /* +0x0004 f1 12 00 00 */ unsigned char lpConnRes[4]; /* +0x0008 b0 28 00 00 */ unsigned long dwFlags; /* +0x000c */ unsigned long dwDevNum; /* +0x0010 */ }; struct _FILEOFFSET_INFORMATION { /* unsigned char DontUse[0]; +0x0000 7e 29 00 00 */ /* unsigned char Offset[0]; +0x0000 7f 29 00 00 */ unsigned char Reserved[8]; /* +0x0000 80 29 00 00 */ }; struct _CERT_LOGOTYPE_REFERENCE { unsigned long cHashedUrl; /* +0x0000 */ unsigned char rgHashedUrl[4]; /* +0x0004 8b 29 00 00 */ }; struct tagEMRINVERTRGN { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned char rclBounds[16]; /* +0x0008 d5 12 00 00 */ unsigned long cbRgnData; /* +0x0018 */ unsigned char RgnData[4]; /* +0x001c f9 12 00 00 */ }; struct tagSOLE_AUTHENTICATION_SERVICE { unsigned long dwAuthnSvc; /* +0x0000 */ unsigned long dwAuthzSvc; /* +0x0004 */ unsigned char pPrincipalName[4]; /* +0x0008 71 04 00 00 */ unsigned char hr[4]; /* +0x000c 08 00 00 00 */ }; struct _CERT_LOGOTYPE_IMAGE_INFO { unsigned long dwLogotypeImageInfoChoice; /* +0x0000 */ unsigned long dwFileSize; /* +0x0004 */ unsigned long dwXSize; /* +0x0008 */ unsigned long dwYSize; /* +0x000c */ unsigned long dwLogotypeImageResolutionChoice; /* +0x0010 */ unsigned long dwNumBits; /* +0x0014 */ unsigned long dwTableSize; /* +0x0014 */ unsigned char pwszLanguage[4]; /* +0x0018 71 04 00 00 */ }; struct _IMAGE_SEPARATE_DEBUG_HEADER { unsigned short Signature; /* +0x0000 */ unsigned short Flags; /* +0x0002 */ unsigned short Machine; /* +0x0004 */ unsigned short Characteristics; /* +0x0006 */ unsigned long TimeDateStamp; /* +0x0008 */ unsigned long CheckSum; /* +0x000c */ unsigned long ImageBase; /* +0x0010 */ unsigned long SizeOfImage; /* +0x0014 */ unsigned long NumberOfSections; /* +0x0018 */ unsigned long ExportedNamesSize; /* +0x001c */ unsigned long DebugDirectorySize; /* +0x0020 */ unsigned long SectionAlignment; /* +0x0024 */ unsigned char Reserved[8]; /* +0x0028 69 15 00 00 */ }; struct _BOOT_AREA_INFO::<unnamed-type-BootSectors> { unsigned char Offset[8]; /* +0x0000 3d 13 00 00 */ }; struct _MEMORY_SCRUB_INFORMATION { void *Handle; /* +0x0000 */ unsigned long PagesScrubbed; /* +0x0004 */ }; struct tagCOMPAREITEMSTRUCT { unsigned char CtlType[4]; /* +0x0000 75 00 00 00 */ unsigned char CtlID[4]; /* +0x0004 75 00 00 00 */ unsigned char hwndItem[4]; /* +0x0008 f1 12 00 00 */ unsigned char itemID1[4]; /* +0x000c 75 00 00 00 */ unsigned long itemData1; /* +0x0010 */ unsigned char itemID2[4]; /* +0x0014 75 00 00 00 */ unsigned long itemData2; /* +0x0018 */ unsigned long dwLocaleId; /* +0x001c */ }; struct tagPOINTER_DEVICE_PROPERTY { unsigned char logicalMin[4]; /* +0x0000 74 00 00 00 */ unsigned char logicalMax[4]; /* +0x0004 74 00 00 00 */ unsigned char physicalMin[4]; /* +0x0008 74 00 00 00 */ unsigned char physicalMax[4]; /* +0x000c 74 00 00 00 */ unsigned char unit[4]; /* +0x0010 75 00 00 00 */ unsigned char unitExponent[4]; /* +0x0014 75 00 00 00 */ unsigned short usagePageId; /* +0x0018 */ unsigned short usageId; /* +0x001a */ }; struct _CERT_CHAIN_PARA { unsigned long cbSize; /* +0x0000 */ unsigned char RequestedUsage[12]; /* +0x0004 c4 29 00 00 */ }; struct _CONTEXT_CHUNK { long Offset; /* +0x0000 */ unsigned long Length; /* +0x0004 */ }; struct _FILE_LINK_INFORMATION { unsigned char ReplaceIfExists; /* +0x0000 */ void *RootDirectory; /* +0x0004 */ unsigned long FileNameLength; /* +0x0008 */ unsigned char FileName[4]; /* +0x000c f7 13 00 00 */ }; struct _JOURNAL_SET_KEY_USER_FLAGS_INFORMATION { unsigned char Action[8]; /* +0x0000 38 15 00 00 */ unsigned long long RecordNumber; /* +0x0008 */ unsigned char TimeStamp[8]; /* +0x0010 3d 13 00 00 */ unsigned char KeyPathName[8]; /* +0x0018 dd 12 00 00 */ unsigned long OldFlags; /* +0x0020 */ unsigned long NewFlags; /* +0x0024 */ }; struct _ENUM_SERVICE_STATUSA { char *lpServiceName; /* +0x0000 */ char *lpDisplayName; /* +0x0004 */ unsigned char ServiceStatus[28]; /* +0x0008 46 27 00 00 */ }; struct ASSOCIATIONELEMENT { unsigned char ac[4]; /* +0x0000 f6 29 00 00 */ unsigned char hkClass[4]; /* +0x0004 72 19 00 00 */ unsigned char pszClass[4]; /* +0x0008 c0 13 00 00 */ }; struct _SYSTEM_HIBERFILE_INFORMATION { unsigned long NumberOfMcbPairs; /* +0x0000 */ unsigned char Mcb[8]; /* +0x0008 55 25 00 00 */ }; struct _OSVERSIONINFOA { unsigned long dwOSVersionInfoSize; /* +0x0000 */ unsigned long dwMajorVersion; /* +0x0004 */ unsigned long dwMinorVersion; /* +0x0008 */ unsigned long dwBuildNumber; /* +0x000c */ unsigned long dwPlatformId; /* +0x0010 */ unsigned char szCSDVersion[128]; /* +0x0014 f7 16 00 00 */ }; struct tagEMRRESTOREDC { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ long iRelative; /* +0x0008 */ }; struct tagGUITHREADINFO { unsigned long cbSize; /* +0x0000 */ unsigned long flags; /* +0x0004 */ unsigned char hwndActive[4]; /* +0x0008 f1 12 00 00 */ unsigned char hwndFocus[4]; /* +0x000c f1 12 00 00 */ unsigned char hwndCapture[4]; /* +0x0010 f1 12 00 00 */ unsigned char hwndMenuOwner[4]; /* +0x0014 f1 12 00 00 */ unsigned char hwndMoveSize[4]; /* +0x0018 f1 12 00 00 */ unsigned char hwndCaret[4]; /* +0x001c f1 12 00 00 */ unsigned char rcCaret[16]; /* +0x0020 63 14 00 00 */ }; struct _CLAIM_SECURITY_ATTRIBUTE_V1 { unsigned char Name[4]; /* +0x0000 71 04 00 00 */ unsigned short ValueType; /* +0x0004 */ unsigned short Reserved; /* +0x0006 */ unsigned long Flags; /* +0x0008 */ unsigned long ValueCount; /* +0x000c */ }; struct _CLAIM_SECURITY_ATTRIBUTE_V1::<unnamed-type-Values> { long long *pInt64; /* +0x0000 */ unsigned long long *pUint64; /* +0x0000 */ /* unsigned char ppString[0]; +0x0000 d0 13 00 00 */ /* unsigned char pFqbn[0]; +0x0000 28 1b 00 00 */ unsigned char pOctetString[4]; /* +0x0000 f8 18 00 00 */ }; struct _DISPLAY_DEVICEW { unsigned long cb; /* +0x0000 */ unsigned char DeviceName[64]; /* +0x0004 a5 15 00 00 */ unsigned char DeviceString[256]; /* +0x0044 a7 15 00 00 */ unsigned long StateFlags; /* +0x0144 */ unsigned char DeviceID[256]; /* +0x0148 a7 15 00 00 */ unsigned char DeviceKey[256]; /* +0x0248 a7 15 00 00 */ }; struct _UMS_CREATE_THREAD_ATTRIBUTES { unsigned long UmsVersion; /* +0x0000 */ /* unsigned char RtlUmsContext[0]; +0x0004 c8 17 00 00 */ void *UmsContext; /* +0x0004 */ /* unsigned char RtlUmsCompletionList[0]; +0x0008 dc 15 00 00 */ void *UmsCompletionList; /* +0x0008 */ }; struct _CSV_QUERY_REDIRECT_STATE { unsigned long MdsNodeId; /* +0x0000 */ unsigned long DsNodeId; /* +0x0004 */ unsigned char FileRedirected; /* +0x0008 */ }; struct _SERVICE_NOTIFY_1 { unsigned long dwVersion; /* +0x0000 */ unsigned char pfnNotifyCallback[4]; /* +0x0004 c7 13 00 00 */ void *pContext; /* +0x0008 */ unsigned long dwNotificationStatus; /* +0x000c */ unsigned char ServiceStatus[36]; /* +0x0010 c6 16 00 00 */ }; struct _FILE_ATTRIBUTE_TAG_INFORMATION { unsigned long FileAttributes; /* +0x0000 */ unsigned long ReparseTag; /* +0x0004 */ }; struct _RTL_HANDLE_TABLE { unsigned long MaximumNumberOfHandles; /* +0x0000 */ unsigned long SizeOfHandleTableEntry; /* +0x0004 */ unsigned long UseHeap; /* +0x0008 */ unsigned long TableSize; /* +0x000c */ unsigned char FreeHandles[4]; /* +0x0010 42 2a 00 00 */ unsigned char CommittedHandles[4]; /* +0x0014 42 2a 00 00 */ unsigned char UnCommittedHandles[4]; /* +0x0018 42 2a 00 00 */ unsigned char MaxReservedHandles[4]; /* +0x001c 42 2a 00 00 */ }; struct _SYSTEMTIME { unsigned short wYear; /* +0x0000 */ unsigned short wMonth; /* +0x0002 */ unsigned short wDayOfWeek; /* +0x0004 */ unsigned short wDay; /* +0x0006 */ unsigned short wHour; /* +0x0008 */ unsigned short wMinute; /* +0x000a */ unsigned short wSecond; /* +0x000c */ unsigned short wMilliseconds; /* +0x000e */ }; struct _FILE_ALLOCATION_INFORMATION { unsigned char AllocationSize[8]; /* +0x0000 3d 13 00 00 */ }; struct tagKEYBDINPUT { unsigned short wVk; /* +0x0000 */ unsigned short wScan; /* +0x0002 */ unsigned long dwFlags; /* +0x0004 */ unsigned long time; /* +0x0008 */ unsigned long dwExtraInfo; /* +0x000c */ }; struct _BOOT_ENTRY { unsigned long Version; /* +0x0000 */ unsigned long Length; /* +0x0004 */ unsigned long Id; /* +0x0008 */ unsigned long Attributes; /* +0x000c */ unsigned long FriendlyNameOffset; /* +0x0010 */ unsigned long BootFilePathOffset; /* +0x0014 */ unsigned long OsOptionsLength; /* +0x0018 */ unsigned char OsOptions[4]; /* +0x001c f9 12 00 00 */ }; struct _RTL_DEBUG_INFORMATION { void *SectionHandleClient; /* +0x0000 */ void *ViewBaseClient; /* +0x0004 */ void *ViewBaseTarget; /* +0x0008 */ unsigned long ViewBaseDelta; /* +0x000c */ void *EventPairClient; /* +0x0010 */ void *EventPairTarget; /* +0x0014 */ void *TargetProcessId; /* +0x0018 */ void *TargetThreadHandle; /* +0x001c */ unsigned long Flags; /* +0x0020 */ unsigned long OffsetFree; /* +0x0024 */ unsigned long CommitSize; /* +0x0028 */ unsigned long ViewSize; /* +0x002c */ /* unsigned char Modules[0]; +0x0030 2a 22 00 00 */ unsigned char ModulesEx[4]; /* +0x0030 7d 2a 00 00 */ unsigned char BackTraces[4]; /* +0x0034 ce 1c 00 00 */ unsigned char Heaps[4]; /* +0x0038 7f 2a 00 00 */ unsigned char Locks[4]; /* +0x003c 81 2a 00 00 */ void *SpecificHeap; /* +0x0040 */ void *TargetProcessHandle; /* +0x0044 */ unsigned char VerifierOptions[4]; /* +0x0048 83 2a 00 00 */ void *ProcessHeap; /* +0x004c */ void *CriticalSectionHandle; /* +0x0050 */ void *CriticalSectionOwnerThread; /* +0x0054 */ unsigned char Reserved[16]; /* +0x0058 84 2a 00 00 */ }; struct tagCURSORINFO { unsigned long cbSize; /* +0x0000 */ unsigned long flags; /* +0x0004 */ unsigned char hCursor[4]; /* +0x0008 07 21 00 00 */ unsigned char ptScreenPos[8]; /* +0x000c 8a 14 00 00 */ }; struct value_entA { char *ve_valuename; /* +0x0000 */ unsigned long ve_valuelen; /* +0x0004 */ unsigned long ve_valueptr; /* +0x0008 */ unsigned long ve_type; /* +0x000c */ }; struct _TRANSACTION_NOTIFICATION_RECOVERY_ARGUMENT { unsigned char EnlistmentId[16]; /* +0x0000 dc 14 00 00 */ unsigned char UOW[16]; /* +0x0010 dc 14 00 00 */ }; struct _RPC_CALL_LOCAL_ADDRESS_V1 { unsigned char Version[4]; /* +0x0000 75 00 00 00 */ void *Buffer; /* +0x0004 */ unsigned long BufferSize; /* +0x0008 */ unsigned char AddressFormat[4]; /* +0x000c 93 2a 00 00 */ }; struct _PS_SYSTEM_DLL_INIT_BLOCK { unsigned long Size; /* +0x0000 */ unsigned long SystemDllWowRelocation; /* +0x0004 */ unsigned long long SystemDllNativeRelocation; /* +0x0008 */ unsigned char Wow64SharedInformation[64]; /* +0x0010 43 27 00 00 */ unsigned long RngData; /* +0x0050 */ unsigned long long MitigationOptions; /* +0x0058 */ }; struct _RTL_RESOURCE { unsigned char CriticalSection[24]; /* +0x0000 60 1f 00 00 */ void *SharedSemaphore; /* +0x0018 */ unsigned char NumberOfWaitingShared[4]; /* +0x001c bb 17 00 00 */ void *ExclusiveSemaphore; /* +0x0020 */ unsigned char NumberOfWaitingExclusive[4]; /* +0x0024 bb 17 00 00 */ unsigned char NumberOfActive[4]; /* +0x0028 c3 17 00 00 */ void *ExclusiveOwnerThread; /* +0x002c */ unsigned long Flags; /* +0x0030 */ unsigned char DebugInfo[4]; /* +0x0034 6a 22 00 00 */ }; struct tagENUMLOGFONTEXDVW { unsigned char elfEnumLogfontEx[348]; /* +0x0000 9a 2a 00 00 */ unsigned char elfDesignVector[72]; /* +0x015c 01 21 00 00 */ }; struct _CRYPT_CREDENTIALS { unsigned long cbSize; /* +0x0000 */ unsigned char pszCredentialsOid[4]; /* +0x0004 62 14 00 00 */ void *pvCredentials; /* +0x0008 */ }; struct _JOBOBJECT_EXTENDED_LIMIT_INFORMATION { unsigned char BasicLimitInformation[48]; /* +0x0000 98 16 00 00 */ unsigned char IoInfo[48]; /* +0x0030 55 1c 00 00 */ unsigned long ProcessMemoryLimit; /* +0x0060 */ unsigned long JobMemoryLimit; /* +0x0064 */ unsigned long PeakProcessMemoryUsed; /* +0x0068 */ unsigned long PeakJobMemoryUsed; /* +0x006c */ }; struct _EXCEPTION_POINTERS { unsigned char ExceptionRecord[4]; /* +0x0000 cf 28 00 00 */ unsigned char ContextRecord[4]; /* +0x0004 58 13 00 00 */ }; struct _FILE_BASIC_INFO { unsigned char CreationTime[8]; /* +0x0000 3d 13 00 00 */ unsigned char LastAccessTime[8]; /* +0x0008 3d 13 00 00 */ unsigned char LastWriteTime[8]; /* +0x0010 3d 13 00 00 */ unsigned char ChangeTime[8]; /* +0x0018 3d 13 00 00 */ unsigned long FileAttributes; /* +0x0020 */ }; struct _TRANSACTION_NOTIFICATION_TM_ONLINE_ARGUMENT { unsigned char TmIdentity[16]; /* +0x0000 dc 14 00 00 */ unsigned long Flags; /* +0x0010 */ }; struct _PROCESS_AFFINITY_UPDATE_MODE { unsigned long Flags; /* +0x0000 */ /* unsigned char EnableAutoUpdate[0]; +0x0000 17 13 00 00 */ /* unsigned char Permanent[0]; +0x0000 7e 18 00 00 */ unsigned char Reserved[4]; /* +0x0000 b3 19 00 00 */ }; struct _SD_CHANGE_MACHINE_SID_OUTPUT { unsigned long long NumSDChangedSuccess; /* +0x0000 */ unsigned long long NumSDChangedFail; /* +0x0008 */ unsigned long long NumSDUnused; /* +0x0010 */ unsigned long long NumSDTotal; /* +0x0018 */ unsigned long long NumMftSDChangedSuccess; /* +0x0020 */ unsigned long long NumMftSDChangedFail; /* +0x0028 */ unsigned long long NumMftSDTotal; /* +0x0030 */ }; struct _COVERAGE_MODULE_REQUEST::<unnamed-type-SearchInfo> { /* unsigned char MD5Hash[0]; +0x0000 09 1c 00 00 */ unsigned char ModuleName[16]; /* +0x0000 dd 12 00 00 */ }; struct _SAFER_PATHNAME_IDENTIFICATION { unsigned char header[32]; /* +0x0000 44 19 00 00 */ unsigned char Description[512]; /* +0x0020 3c 17 00 00 */ unsigned char ImageName[4]; /* +0x0220 71 04 00 00 */ unsigned long dwSaferFlags; /* +0x0224 */ }; struct _OBJECT_TYPE_INFORMATION { unsigned char TypeName[8]; /* +0x0000 dd 12 00 00 */ unsigned long TotalNumberOfObjects; /* +0x0008 */ unsigned long TotalNumberOfHandles; /* +0x000c */ unsigned long TotalPagedPoolUsage; /* +0x0010 */ unsigned long TotalNonPagedPoolUsage; /* +0x0014 */ unsigned long TotalNamePoolUsage; /* +0x0018 */ unsigned long TotalHandleTableUsage; /* +0x001c */ unsigned long HighWaterNumberOfObjects; /* +0x0020 */ unsigned long HighWaterNumberOfHandles; /* +0x0024 */ unsigned long HighWaterPagedPoolUsage; /* +0x0028 */ unsigned long HighWaterNonPagedPoolUsage; /* +0x002c */ unsigned long HighWaterNamePoolUsage; /* +0x0030 */ unsigned long HighWaterHandleTableUsage; /* +0x0034 */ unsigned long InvalidAttributes; /* +0x0038 */ unsigned char GenericMapping[16]; /* +0x003c 41 16 00 00 */ unsigned long ValidAccessMask; /* +0x004c */ unsigned char SecurityRequired; /* +0x0050 */ unsigned char MaintainHandleCount; /* +0x0051 */ unsigned long PoolType; /* +0x0054 */ unsigned long DefaultPagedPoolCharge; /* +0x0058 */ unsigned long DefaultNonPagedPoolCharge; /* +0x005c */ }; struct _FSCTL_QUERY_FAT_BPB_BUFFER { unsigned char First0x24BytesOfBootSector[36]; /* +0x0000 1c 1c 00 00 */ }; struct tagTOUCHINPUT { long x; /* +0x0000 */ long y; /* +0x0004 */ void *hSource; /* +0x0008 */ unsigned long dwID; /* +0x000c */ unsigned long dwFlags; /* +0x0010 */ unsigned long dwMask; /* +0x0014 */ unsigned long dwTime; /* +0x0018 */ unsigned long dwExtraInfo; /* +0x001c */ unsigned long cxContact; /* +0x0020 */ unsigned long cyContact; /* +0x0024 */ }; struct _COORD { short X; /* +0x0000 */ short Y; /* +0x0002 */ }; struct _DEVICE_FLAGS { /* unsigned char Failed[0]; +0x0000 17 13 00 00 */ /* unsigned char ReadOnly[0]; +0x0000 7e 18 00 00 */ /* unsigned char Removable[0]; +0x0000 7f 18 00 00 */ /* unsigned char ConsoleIn[0]; +0x0000 27 1e 00 00 */ /* unsigned char ConsoleOut[0]; +0x0000 42 1e 00 00 */ /* unsigned char Input[0]; +0x0000 ce 23 00 00 */ unsigned char Output[4]; /* +0x0000 ff 1e 00 00 */ }; struct _tagBINDINFO { unsigned long cbSize; /* +0x0000 */ unsigned char szExtraInfo[4]; /* +0x0004 71 04 00 00 */ unsigned char stgmedData[12]; /* +0x0008 02 2b 00 00 */ unsigned long grfBindInfoF; /* +0x0014 */ unsigned long dwBindVerb; /* +0x0018 */ unsigned char szCustomVerb[4]; /* +0x001c 71 04 00 00 */ unsigned long cbstgmedData; /* +0x0020 */ unsigned long dwOptions; /* +0x0024 */ unsigned long dwOptionsFlags; /* +0x0028 */ unsigned long dwCodePage; /* +0x002c */ unsigned char securityAttributes[12]; /* +0x0030 fa 14 00 00 */ unsigned char iid[16]; /* +0x003c dc 14 00 00 */ unsigned char pUnk[4]; /* +0x004c 7f 17 00 00 */ unsigned long dwReserved; /* +0x0050 */ }; struct _CERT_INFO { unsigned long dwVersion; /* +0x0000 */ unsigned char SerialNumber[8]; /* +0x0004 02 13 00 00 */ unsigned char SignatureAlgorithm[12]; /* +0x000c 55 14 00 00 */ unsigned char Issuer[8]; /* +0x0018 02 13 00 00 */ unsigned char NotBefore[8]; /* +0x0020 31 13 00 00 */ unsigned char NotAfter[8]; /* +0x0028 31 13 00 00 */ unsigned char Subject[8]; /* +0x0030 02 13 00 00 */ unsigned char SubjectPublicKeyInfo[24]; /* +0x0038 36 20 00 00 */ unsigned char IssuerUniqueId[12]; /* +0x0050 03 13 00 00 */ unsigned char SubjectUniqueId[12]; /* +0x005c 03 13 00 00 */ unsigned long cExtension; /* +0x0068 */ unsigned char rgExtension[4]; /* +0x006c 22 16 00 00 */ }; struct _SAFER_IDENTIFICATION_HEADER { unsigned char dwIdentificationType[4]; /* +0x0000 07 2b 00 00 */ unsigned long cbStructSize; /* +0x0004 */ unsigned char IdentificationGuid[16]; /* +0x0008 dc 14 00 00 */ unsigned char lastModified[8]; /* +0x0018 31 13 00 00 */ }; struct _PROCESS_HANDLE_INFORMATION { unsigned long HandleCount; /* +0x0000 */ unsigned long HandleCountHighWatermark; /* +0x0004 */ }; struct _CM_INT13_DRIVE_PARAMETER { unsigned short DriveSelect; /* +0x0000 */ unsigned long MaxCylinders; /* +0x0002 */ unsigned short SectorsPerTrack; /* +0x0006 */ unsigned short MaxHeads; /* +0x0008 */ unsigned short NumberDrives; /* +0x000a */ }; struct _PLUGPLAY_CONTROL_LEGACY_DEVGEN_DATA { unsigned char ServiceName[8]; /* +0x0000 dd 12 00 00 */ unsigned char DeviceInstance[4]; /* +0x0008 71 04 00 00 */ unsigned long DeviceInstanceLength; /* +0x000c */ }; struct _WOW64_FLOATING_SAVE_AREA { unsigned long ControlWord; /* +0x0000 */ unsigned long StatusWord; /* +0x0004 */ unsigned long TagWord; /* +0x0008 */ unsigned long ErrorOffset; /* +0x000c */ unsigned long ErrorSelector; /* +0x0010 */ unsigned long DataOffset; /* +0x0014 */ unsigned long DataSelector; /* +0x0018 */ unsigned char RegisterArea[80]; /* +0x001c 97 26 00 00 */ unsigned long Cr0NpxState; /* +0x006c */ }; struct _RTL_VERIFIER_PROVIDER_HELPER_TABLE { unsigned long Length; /* +0x0000 */ unsigned char VerifierEngLogStackTrace[4]; /* +0x0004 e4 16 00 00 */ unsigned char VerifierEngReleaseStackTrace[4]; /* +0x0008 c7 13 00 00 */ unsigned char VerifierEngGetStackTraceAddressEx[112]; /* +0x000c ea 19 00 00 */ }; struct _RTL_VERIFIER_PROVIDER_HELPER_TABLE::_RTL_VERIFIER_PROVIDER_HELPER_TABLE_UNUSED_STRUCT { unsigned long UnusedLong; /* +0x0000 */ unsigned char UnusedPointer[100]; /* +0x0004 15 2b 00 00 */ }; struct _MEMORYSTATUS { unsigned long dwLength; /* +0x0000 */ unsigned long dwMemoryLoad; /* +0x0004 */ unsigned long dwTotalPhys; /* +0x0008 */ unsigned long dwAvailPhys; /* +0x000c */ unsigned long dwTotalPageFile; /* +0x0010 */ unsigned long dwAvailPageFile; /* +0x0014 */ unsigned long dwTotalVirtual; /* +0x0018 */ unsigned long dwAvailVirtual; /* +0x001c */ }; struct _SHELLEXECUTEINFOW { unsigned long cbSize; /* +0x0000 */ unsigned long fMask; /* +0x0004 */ unsigned char hwnd[4]; /* +0x0008 f1 12 00 00 */ unsigned char lpVerb[4]; /* +0x000c c0 13 00 00 */ unsigned char lpFile[4]; /* +0x0010 c0 13 00 00 */ unsigned char lpParameters[4]; /* +0x0014 c0 13 00 00 */ unsigned char lpDirectory[4]; /* +0x0018 c0 13 00 00 */ unsigned char nShow[4]; /* +0x001c 74 00 00 00 */ unsigned char hInstApp[4]; /* +0x0020 ba 14 00 00 */ void *lpIDList; /* +0x0024 */ unsigned char lpClass[4]; /* +0x0028 c0 13 00 00 */ unsigned char hkeyClass[4]; /* +0x002c 72 19 00 00 */ unsigned long dwHotKey; /* +0x0030 */ void *hIcon; /* +0x0034 */ void *hMonitor; /* +0x0034 */ void *hProcess; /* +0x0038 */ }; struct tagORPC_EXTENT_ARRAY { unsigned long size; /* +0x0000 */ unsigned long reserved; /* +0x0004 */ unsigned char extent[4]; /* +0x0008 22 2b 00 00 */ }; struct _FILE_NETWORK_PHYSICAL_NAME_INFORMATION { unsigned long FileNameLength; /* +0x0000 */ unsigned char FileName[4]; /* +0x0004 f7 13 00 00 */ }; struct tagTITLEBARINFOEX { unsigned long cbSize; /* +0x0000 */ unsigned char rcTitleBar[16]; /* +0x0004 63 14 00 00 */ unsigned char rgstate[24]; /* +0x0014 a8 1f 00 00 */ unsigned char rgrect[96]; /* +0x002c 29 2b 00 00 */ }; struct tagCLEANLOCALSTORAGE { unsigned char pInterface[4]; /* +0x0000 7f 17 00 00 */ void *pStorage; /* +0x0004 */ unsigned long flags; /* +0x0008 */ }; struct _TOKEN_APPCONTAINER_INFORMATION { void *TokenAppContainer; /* +0x0000 */ }; struct _LPC_UNREGISTER_PROCESS_MSG { unsigned char PortMsg[24]; /* +0x0000 01 20 00 00 */ void *UniqueProcessId; /* +0x0018 */ }; struct tagTTPOLYGONHEADER { unsigned long cb; /* +0x0000 */ unsigned long dwType; /* +0x0004 */ unsigned char pfxStart[8]; /* +0x0008 2c 21 00 00 */ }; struct tagMSGBOXPARAMSW { unsigned char cbSize[4]; /* +0x0000 75 00 00 00 */ unsigned char hwndOwner[4]; /* +0x0004 f1 12 00 00 */ unsigned char hInstance[4]; /* +0x0008 ba 14 00 00 */ unsigned char lpszText[4]; /* +0x000c c0 13 00 00 */ unsigned char lpszCaption[4]; /* +0x0010 c0 13 00 00 */ unsigned long dwStyle; /* +0x0014 */ unsigned char lpszIcon[4]; /* +0x0018 c0 13 00 00 */ unsigned long dwContextHelpId; /* +0x001c */ unsigned char lpfnMsgBoxCallback[4]; /* +0x0020 3e 2b 00 00 */ unsigned long dwLanguageId; /* +0x0024 */ }; struct _SERVICE_CONTROL_STATUS_REASON_PARAMSW { unsigned long dwReason; /* +0x0000 */ unsigned char pszComment[4]; /* +0x0004 71 04 00 00 */ unsigned char ServiceStatus[36]; /* +0x0008 c6 16 00 00 */ }; struct tagAXESLISTW { unsigned long axlReserved; /* +0x0000 */ unsigned long axlNumAxes; /* +0x0004 */ unsigned char axlAxisInfo[640]; /* +0x0008 59 2b 00 00 */ }; struct _CERT_BIOMETRIC_DATA { unsigned long dwTypeOfBiometricDataChoice; /* +0x0000 */ unsigned long dwPredefined; /* +0x0004 */ char *pszObjId; /* +0x0004 */ unsigned char HashedUrl[24]; /* +0x0008 8a 29 00 00 */ }; struct _SHFILEOPSTRUCTW { unsigned char hwnd[4]; /* +0x0000 f1 12 00 00 */ unsigned char wFunc[4]; /* +0x0004 75 00 00 00 */ unsigned char pFrom[4]; /* +0x0008 c0 13 00 00 */ unsigned char pTo[4]; /* +0x000c c0 13 00 00 */ unsigned short fFlags; /* +0x0010 */ unsigned char fAnyOperationsAborted[4]; /* +0x0012 74 00 00 00 */ void *hNameMappings; /* +0x0016 */ unsigned char lpszProgressTitle[4]; /* +0x001a c0 13 00 00 */ }; struct _IMAGE_ARCHIVE_MEMBER_HEADER { unsigned char Name[16]; /* +0x0000 09 1c 00 00 */ unsigned char Date[12]; /* +0x0010 6e 15 00 00 */ unsigned char UserID[6]; /* +0x001c 3c 22 00 00 */ unsigned char GroupID[6]; /* +0x0022 3c 22 00 00 */ unsigned char Mode[8]; /* +0x0028 7f 19 00 00 */ unsigned char Size[10]; /* +0x0030 66 2b 00 00 */ unsigned char EndHeader[2]; /* +0x003a a7 17 00 00 */ }; struct _PROCESS_EXCEPTION_PORT { void *ExceptionPortHandle; /* +0x0000 */ unsigned long StateFlags; /* +0x0004 */ }; struct _KEY_HANDLE_TAGS_INFORMATION { unsigned long HandleTags; /* +0x0000 */ }; struct _RTL_MODULE_BASIC_INFO { void *ImageBase; /* +0x0000 */ }; struct _BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO { unsigned long cbSize; /* +0x0000 */ unsigned long dwInfoVersion; /* +0x0004 */ unsigned char *pbNonce; /* +0x0008 */ unsigned long cbNonce; /* +0x000c */ unsigned char *pbAuthData; /* +0x0010 */ unsigned long cbAuthData; /* +0x0014 */ unsigned char *pbTag; /* +0x0018 */ unsigned long cbTag; /* +0x001c */ unsigned char *pbMacContext; /* +0x0020 */ unsigned long cbMacContext; /* +0x0024 */ unsigned long cbAAD; /* +0x0028 */ unsigned long long cbData; /* +0x0030 */ unsigned long dwFlags; /* +0x0038 */ }; struct _CERT_DSS_PARAMETERS { unsigned char p[8]; /* +0x0000 02 13 00 00 */ unsigned char q[8]; /* +0x0008 02 13 00 00 */ unsigned char g[8]; /* +0x0010 02 13 00 00 */ }; struct _OBJECT_NAME_INFORMATION { unsigned char Name[8]; /* +0x0000 dd 12 00 00 */ }; struct _SYSTEM_KERNEL_DEBUGGER_INFORMATION { unsigned char KernelDebuggerEnabled; /* +0x0000 */ unsigned char KernelDebuggerNotPresent; /* +0x0001 */ }; struct _REG_NOTIFY_INFORMATION { unsigned long NextEntryOffset; /* +0x0000 */ unsigned char Action[4]; /* +0x0004 c2 2b 00 00 */ unsigned long KeyLength; /* +0x0008 */ unsigned char Key[4]; /* +0x000c f7 13 00 00 */ }; struct _SERVICE_FAILURE_ACTIONSW { unsigned long dwResetPeriod; /* +0x0000 */ unsigned char lpRebootMsg[4]; /* +0x0004 71 04 00 00 */ unsigned char lpCommand[4]; /* +0x0008 71 04 00 00 */ unsigned long cActions; /* +0x000c */ unsigned char lpsaActions[4]; /* +0x0010 d6 2b 00 00 */ }; struct _PROCESS_PRIORITY_CLASS { unsigned char Foreground; /* +0x0000 */ unsigned char PriorityClass; /* +0x0001 */ }; struct _TXFS_TRANSACTION_ACTIVE_INFO { unsigned char TransactionsActiveAtSnapshot; /* +0x0000 */ }; struct _EVENT_BASIC_INFORMATION { unsigned char EventType[4]; /* +0x0000 e5 2b 00 00 */ long EventState; /* +0x0004 */ }; struct _DSSSEED { unsigned long counter; /* +0x0000 */ unsigned char seed[20]; /* +0x0004 7b 16 00 00 */ }; struct _SERVICE_PREFERRED_NODE_INFO { unsigned short usPreferredNode; /* +0x0000 */ unsigned char fDelete; /* +0x0002 */ }; struct _IMAGE_EXPORT_DIRECTORY { unsigned long Characteristics; /* +0x0000 */ unsigned long TimeDateStamp; /* +0x0004 */ unsigned short MajorVersion; /* +0x0008 */ unsigned short MinorVersion; /* +0x000a */ unsigned long Name; /* +0x000c */ unsigned long Base; /* +0x0010 */ unsigned long NumberOfFunctions; /* +0x0014 */ unsigned long NumberOfNames; /* +0x0018 */ unsigned long AddressOfFunctions; /* +0x001c */ unsigned long AddressOfNames; /* +0x0020 */ unsigned long AddressOfNameOrdinals; /* +0x0024 */ }; struct _PROCESSOR_PROFILE_CONTROL_AREA { unsigned char PebsDsSaveArea[96]; /* +0x0000 2d 1a 00 00 */ }; struct tagENUMTEXTMETRICW { unsigned char etmNewTextMetricEx[100]; /* +0x0000 fe 2b 00 00 */ unsigned char etmAxesList[648]; /* +0x0064 d7 24 00 00 */ }; struct _PAGE_PRIORITY_INFORMATION { unsigned long PagePriority; /* +0x0000 */ }; struct tagACTCTX_SECTION_KEYED_DATA { unsigned long cbSize; /* +0x0000 */ unsigned long ulDataFormatVersion; /* +0x0004 */ void *lpData; /* +0x0008 */ unsigned long ulLength; /* +0x000c */ void *lpSectionGlobalData; /* +0x0010 */ unsigned long ulSectionGlobalDataLength; /* +0x0014 */ void *lpSectionBase; /* +0x0018 */ unsigned long ulSectionTotalLength; /* +0x001c */ void *hActCtx; /* +0x0020 */ unsigned long ulAssemblyRosterIndex; /* +0x0024 */ unsigned long ulFlags; /* +0x0028 */ unsigned char AssemblyMetadata[20]; /* +0x002c 07 2c 00 00 */ }; struct _CRYPT_KEY_SIGN_MESSAGE_PARA { unsigned long cbSize; /* +0x0000 */ unsigned long dwMsgAndCertEncodingType; /* +0x0004 */ unsigned long hCryptProv; /* +0x0008 */ unsigned long hNCryptKey; /* +0x0008 */ unsigned long dwKeySpec; /* +0x000c */ unsigned char HashAlgorithm[12]; /* +0x0010 55 14 00 00 */ void *pvHashAuxInfo; /* +0x001c */ unsigned char PubKeyAlgorithm[12]; /* +0x0020 55 14 00 00 */ }; struct _POWER_STATE { /* unsigned char SystemState[0]; +0x0000 5a 16 00 00 */ unsigned char DeviceState[4]; /* +0x0000 58 16 00 00 */ }; struct tagICONMETRICSA { unsigned char cbSize[4]; /* +0x0000 75 00 00 00 */ unsigned char iHorzSpacing[4]; /* +0x0004 74 00 00 00 */ unsigned char iVertSpacing[4]; /* +0x0008 74 00 00 00 */ unsigned char iTitleWrap[4]; /* +0x000c 74 00 00 00 */ unsigned char lfFont[60]; /* +0x0010 c2 16 00 00 */ }; struct _PROCESSOR_GROUP_INFO { unsigned char MaximumProcessorCount; /* +0x0000 */ unsigned char ActiveProcessorCount; /* +0x0001 */ unsigned char Reserved[38]; /* +0x0002 1f 2c 00 00 */ unsigned long ActiveProcessorMask; /* +0x0028 */ }; struct tagEMREXTTEXTOUTA { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned char rclBounds[16]; /* +0x0008 d5 12 00 00 */ unsigned long iGraphicsMode; /* +0x0018 */ unsigned char exScale[4]; /* +0x001c 40 00 00 00 */ unsigned char eyScale[4]; /* +0x0020 40 00 00 00 */ unsigned char emrtext[40]; /* +0x0024 21 1c 00 00 */ }; struct tagEMRPLGBLT { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned char rclBounds[16]; /* +0x0008 d5 12 00 00 */ unsigned char aptlDest[24]; /* +0x0018 24 2c 00 00 */ long xSrc; /* +0x0030 */ long ySrc; /* +0x0034 */ long cxSrc; /* +0x0038 */ long cySrc; /* +0x003c */ unsigned char xformSrc[24]; /* +0x0040 d6 12 00 00 */ unsigned long crBkColorSrc; /* +0x0058 */ unsigned long iUsageSrc; /* +0x005c */ unsigned long offBmiSrc; /* +0x0060 */ unsigned long cbBmiSrc; /* +0x0064 */ unsigned long offBitsSrc; /* +0x0068 */ unsigned long cbBitsSrc; /* +0x006c */ long xMask; /* +0x0070 */ long yMask; /* +0x0074 */ unsigned long iUsageMask; /* +0x0078 */ unsigned long offBmiMask; /* +0x007c */ unsigned long cbBmiMask; /* +0x0080 */ unsigned long offBitsMask; /* +0x0084 */ unsigned long cbBitsMask; /* +0x0088 */ }; struct _CERT_POLICY_MAPPING { char *pszIssuerDomainPolicy; /* +0x0000 */ char *pszSubjectDomainPolicy; /* +0x0004 */ }; struct _LOAD_DLL_DEBUG_INFO { void *hFile; /* +0x0000 */ void *lpBaseOfDll; /* +0x0004 */ unsigned long dwDebugInfoFileOffset; /* +0x0008 */ unsigned long nDebugInfoSize; /* +0x000c */ void *lpImageName; /* +0x0010 */ unsigned short fUnicode; /* +0x0014 */ }; struct _ACL { unsigned char AclRevision; /* +0x0000 */ unsigned char Sbz1; /* +0x0001 */ unsigned short AclSize; /* +0x0002 */ unsigned short AceCount; /* +0x0004 */ unsigned short Sbz2; /* +0x0006 */ }; struct _IMAGE_RUNTIME_FUNCTION_ENTRY { unsigned long BeginAddress; /* +0x0000 */ unsigned long EndAddress; /* +0x0004 */ unsigned long UnwindInfoAddress; /* +0x0008 */ }; struct tagCIEXYZ { long ciexyzX; /* +0x0000 */ long ciexyzY; /* +0x0004 */ long ciexyzZ; /* +0x0008 */ }; struct _CMSG_HASHED_ENCODE_INFO { unsigned long cbSize; /* +0x0000 */ unsigned long hCryptProv; /* +0x0004 */ unsigned char HashAlgorithm[12]; /* +0x0008 55 14 00 00 */ void *pvHashAuxInfo; /* +0x0014 */ }; struct _PLUGPLAY_CONTROL_BLOCKED_DRIVER_DATA { unsigned long Flags; /* +0x0000 */ unsigned long BufferLength; /* +0x0004 */ void *Buffer; /* +0x0008 */ }; struct _CMSG_KEY_AGREE_RECIPIENT_INFO { unsigned long dwVersion; /* +0x0000 */ unsigned long dwOriginatorChoice; /* +0x0004 */ /* unsigned char OriginatorCertId[0]; +0x0008 30 13 00 00 */ unsigned char OriginatorPublicKeyInfo[24]; /* +0x0008 36 20 00 00 */ unsigned char UserKeyingMaterial[8]; /* +0x0020 02 13 00 00 */ unsigned char KeyEncryptionAlgorithm[12]; /* +0x0028 55 14 00 00 */ unsigned long cRecipientEncryptedKeys; /* +0x0034 */ unsigned char rgpRecipientEncryptedKeys[4]; /* +0x0038 47 2c 00 00 */ }; struct _PROCESS_DISK_COUNTERS { unsigned long long BytesRead; /* +0x0000 */ unsigned long long BytesWritten; /* +0x0008 */ unsigned long long ReadOperationCount; /* +0x0010 */ unsigned long long WriteOperationCount; /* +0x0018 */ unsigned long long FlushOperationCount; /* +0x0020 */ }; struct tagRGBQUAD { unsigned char rgbBlue; /* +0x0000 */ unsigned char rgbGreen; /* +0x0001 */ unsigned char rgbRed; /* +0x0002 */ unsigned char rgbReserved; /* +0x0003 */ }; struct tagRPC_EE_INFO_PARAM { unsigned char ParameterType[16]; /* +0x0000 87 2c 00 00 */ }; struct tagRPC_EE_INFO_PARAM::<unnamed-type-u> { char *AnsiString; /* +0x0000 */ /* unsigned char UnicodeString[0]; +0x0000 71 04 00 00 */ long LVal; /* +0x0000 */ short SVal; /* +0x0000 */ unsigned long long PVal; /* +0x0000 */ unsigned char BVal[8]; /* +0x0000 8b 2c 00 00 */ }; struct __MIDL___MIDL_itf_activate_0000_0011_0004 { unsigned long ulNumClasses; /* +0x0000 */ unsigned char pCLSIDs[4]; /* +0x0004 44 16 00 00 */ unsigned long pidProcess; /* +0x0008 */ void *hProcess; /* +0x000c */ void *hImpersonationToken; /* +0x0010 */ unsigned char pwszWinstaDesktop[4]; /* +0x0014 71 04 00 00 */ unsigned long dwState; /* +0x0018 */ unsigned char AppId[16]; /* +0x001c dc 14 00 00 */ unsigned char ServerType[4]; /* +0x002c 8e 2c 00 00 */ unsigned char ServerID[4]; /* +0x0030 8f 2c 00 00 */ unsigned char ftCreated[8]; /* +0x0034 31 13 00 00 */ }; struct _FILE_SEGMENT_ELEMENT { void *Buffer; /* +0x0000 */ unsigned long long Alignment; /* +0x0000 */ }; struct _SI_COPYFILE { unsigned long SourceFileNameLength; /* +0x0000 */ unsigned long DestinationFileNameLength; /* +0x0004 */ unsigned long Flags; /* +0x0008 */ unsigned char FileNameBuffer[4]; /* +0x000c f7 13 00 00 */ }; struct _SID_AND_ATTRIBUTES_HASH { unsigned long SidCount; /* +0x0000 */ unsigned char SidAttr[4]; /* +0x0004 be 1b 00 00 */ unsigned char Hash[128]; /* +0x0008 9b 2c 00 00 */ }; struct _div_t { unsigned char quot[4]; /* +0x0000 74 00 00 00 */ unsigned char rem[4]; /* +0x0004 74 00 00 00 */ }; struct tagStorageLayout { unsigned long LayoutType; /* +0x0000 */ unsigned char pwcsElementName[4]; /* +0x0004 71 04 00 00 */ unsigned char cOffset[8]; /* +0x0008 3d 13 00 00 */ unsigned char cBytes[8]; /* +0x0010 3d 13 00 00 */ }; struct _SERVICE_FAILURE_ACTIONS_FLAG { unsigned char fFailureActionsOnNonCrashFailures[4]; /* +0x0000 74 00 00 00 */ }; struct _RTL_ELEVATION_FLAGS { unsigned long Flags; /* +0x0000 */ /* unsigned char ElevationEnabled[0]; +0x0000 17 13 00 00 */ /* unsigned char VirtualizationEnabled[0]; +0x0000 7e 18 00 00 */ /* unsigned char InstallerDetectEnabled[0]; +0x0000 7f 18 00 00 */ unsigned char ReservedBits[4]; /* +0x0000 b0 2c 00 00 */ }; struct _AVRF_MEMORY_RANGE { void *BaseAddress; /* +0x0000 */ unsigned long Size; /* +0x0004 */ }; struct _LDT_ENTRY::<unnamed-type-HighWord>::<unnamed-type-Bits> { /* unsigned char BaseMid[0]; +0x0000 84 13 00 00 */ /* unsigned char Type[0]; +0x0000 bd 2c 00 00 */ /* unsigned char Dpl[0]; +0x0000 be 2c 00 00 */ /* unsigned char Pres[0]; +0x0000 92 20 00 00 */ /* unsigned char LimitHi[0]; +0x0000 87 13 00 00 */ /* unsigned char Sys[0]; +0x0000 88 13 00 00 */ /* unsigned char Reserved_0[0]; +0x0000 89 13 00 00 */ /* unsigned char Default_Big[0]; +0x0000 94 20 00 00 */ /* unsigned char Granularity[0]; +0x0000 95 20 00 00 */ unsigned char BaseHi[4]; /* +0x0000 bf 2c 00 00 */ }; struct _LDT_ENTRY::<unnamed-type-HighWord>::<unnamed-type-Bytes> { unsigned char BaseMid; /* +0x0000 */ unsigned char Flags1; /* +0x0001 */ unsigned char Flags2; /* +0x0002 */ unsigned char BaseHi; /* +0x0003 */ }; struct tagHIGHCONTRASTA { unsigned char cbSize[4]; /* +0x0000 75 00 00 00 */ unsigned long dwFlags; /* +0x0004 */ char *lpszDefaultScheme; /* +0x0008 */ }; struct _RPC_HTTP_TRANSPORT_CREDENTIALS_V2_A { unsigned char TransportCredentials[4]; /* +0x0000 cc 18 00 00 */ unsigned long Flags; /* +0x0004 */ unsigned long AuthenticationTarget; /* +0x0008 */ unsigned long NumberOfAuthnSchemes; /* +0x000c */ unsigned long *AuthnSchemes; /* +0x0010 */ unsigned char *ServerCertificateSubject; /* +0x0014 */ unsigned char ProxyCredentials[4]; /* +0x0018 cc 18 00 00 */ unsigned long NumberOfProxyAuthnSchemes; /* +0x001c */ unsigned long *ProxyAuthnSchemes; /* +0x0020 */ }; struct _CERT_CHAIN { unsigned long cCerts; /* +0x0000 */ unsigned char certs[4]; /* +0x0004 47 13 00 00 */ unsigned char keyLocatorInfo[28]; /* +0x0008 2e 2b 00 00 */ }; struct _JOB_SET_ARRAY { void *JobHandle; /* +0x0000 */ unsigned long MemberLevel; /* +0x0004 */ unsigned long Flags; /* +0x0008 */ }; struct tagDESIGNVECTOR { unsigned long dvReserved; /* +0x0000 */ unsigned long dvNumAxes; /* +0x0004 */ unsigned char dvValues[64]; /* +0x0008 f0 2c 00 00 */ }; struct _CMSG_ENVELOPED_ENCODE_INFO { unsigned long cbSize; /* +0x0000 */ unsigned long hCryptProv; /* +0x0004 */ unsigned char ContentEncryptionAlgorithm[12]; /* +0x0008 55 14 00 00 */ void *pvEncryptionAuxInfo; /* +0x0014 */ unsigned long cRecipients; /* +0x0018 */ unsigned char rgpRecipients[4]; /* +0x001c f4 2c 00 00 */ }; struct tagLOGPEN { unsigned char lopnStyle[4]; /* +0x0000 75 00 00 00 */ unsigned char lopnWidth[8]; /* +0x0004 8a 14 00 00 */ unsigned long lopnColor; /* +0x000c */ }; struct _FLAGGED_WORD_BLOB { unsigned long fFlags; /* +0x0000 */ unsigned long clSize; /* +0x0004 */ unsigned char asData[4]; /* +0x0008 ba 15 00 00 */ }; struct _SAFER_CODE_PROPERTIES_V1 { unsigned long cbSize; /* +0x0000 */ unsigned long dwCheckFlags; /* +0x0004 */ unsigned char ImagePath[4]; /* +0x0008 c0 13 00 00 */ void *hImageFileHandle; /* +0x000c */ unsigned long UrlZoneId; /* +0x0010 */ unsigned char ImageHash[64]; /* +0x0014 13 13 00 00 */ unsigned long dwImageHashSize; /* +0x0054 */ unsigned char ImageSize[8]; /* +0x0058 3d 13 00 00 */ unsigned char HashAlgorithm[4]; /* +0x0060 75 00 00 00 */ unsigned char *pByteBlock; /* +0x0064 */ unsigned char hWndParent[4]; /* +0x0068 f1 12 00 00 */ unsigned long dwWVTUIChoice; /* +0x006c */ }; struct _FILE_END_OF_FILE_INFORMATION { unsigned char EndOfFile[8]; /* +0x0000 3d 13 00 00 */ }; struct _MIDL_FORMAT_STRING { short Pad; /* +0x0000 */ /* unsigned char Format[0]; +0x0002 02 2d 00 00 */ }; struct _CRYPT_BLOB_ARRAY { unsigned long cBlob; /* +0x0000 */ unsigned char rgBlob[4]; /* +0x0004 47 13 00 00 */ }; struct _EXCEPTION_LOG { unsigned char ExceptionRecord[80]; /* +0x0000 4b 20 00 00 */ unsigned char ContextRecord[716]; /* +0x0050 57 13 00 00 */ unsigned char Type[4]; /* +0x031c 1b 2d 00 00 */ long Disposition; /* +0x0320 */ unsigned long Thread; /* +0x0324 */ unsigned long ControlPc; /* +0x0328 */ void *Handler; /* +0x032c */ }; struct _GLYPHMETRICS { unsigned char gmBlackBoxX[4]; /* +0x0000 75 00 00 00 */ unsigned char gmBlackBoxY[4]; /* +0x0004 75 00 00 00 */ unsigned char gmptGlyphOrigin[8]; /* +0x0008 8a 14 00 00 */ short gmCellIncX; /* +0x0010 */ short gmCellIncY; /* +0x0012 */ }; struct tagAXESLISTA { unsigned long axlReserved; /* +0x0000 */ unsigned long axlNumAxes; /* +0x0004 */ unsigned char axlAxisInfo[384]; /* +0x0008 21 2d 00 00 */ }; struct _JOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION { unsigned char BasicInfo[48]; /* +0x0000 54 1c 00 00 */ unsigned char IoInfo[48]; /* +0x0030 55 1c 00 00 */ }; struct _SYSTEM_MEMORY_CHANNEL_INFORMATION { unsigned long ChannelNumber; /* +0x0000 */ unsigned long ChannelHeatIndex; /* +0x0004 */ unsigned long long TotalPageCount; /* +0x0008 */ unsigned long long ZeroPageCount; /* +0x0010 */ unsigned long long FreePageCount; /* +0x0018 */ unsigned long long StandbyPageCount; /* +0x0020 */ }; struct tagRID_DEVICE_INFO_MOUSE { unsigned long dwId; /* +0x0000 */ unsigned long dwNumberOfButtons; /* +0x0004 */ unsigned long dwSampleRate; /* +0x0008 */ unsigned char fHasHorizontalWheel[4]; /* +0x000c 74 00 00 00 */ }; struct tagCHANGEFILTERSTRUCT { unsigned long cbSize; /* +0x0000 */ unsigned long ExtStatus; /* +0x0004 */ }; struct _OBJECT_BASIC_INFORMATION { unsigned long Attributes; /* +0x0000 */ unsigned long GrantedAccess; /* +0x0004 */ unsigned long HandleCount; /* +0x0008 */ unsigned long PointerCount; /* +0x000c */ unsigned long PagedPoolCharge; /* +0x0010 */ unsigned long NonPagedPoolCharge; /* +0x0014 */ unsigned char Reserved[12]; /* +0x0018 22 13 00 00 */ unsigned long NameInfoSize; /* +0x0024 */ unsigned long TypeInfoSize; /* +0x0028 */ unsigned long SecurityDescriptorSize; /* +0x002c */ unsigned char CreationTime[8]; /* +0x0030 3d 13 00 00 */ }; struct _COVERAGE_SECTION_HEADER { unsigned long Signature; /* +0x0000 */ unsigned long CoverageType; /* +0x0004 */ unsigned char MD5Hash[16]; /* +0x0008 09 1c 00 00 */ unsigned long CoverageSectionSize; /* +0x0018 */ unsigned long CoverageVectorSize; /* +0x001c */ unsigned long CoverageVectorOffset; /* +0x0020 */ unsigned long ExtraDataOffset; /* +0x0024 */ }; struct _PORT_DATA_ENTRY { void *Base; /* +0x0000 */ unsigned long Size; /* +0x0004 */ }; struct _RTL_DYNAMIC_HASH_TABLE_CONTEXT { unsigned char ChainHead[4]; /* +0x0000 5d 2d 00 00 */ unsigned char PrevLinkage[4]; /* +0x0004 5d 2d 00 00 */ unsigned long Signature; /* +0x0008 */ }; struct _CERT_RDN_ATTR { char *pszObjId; /* +0x0000 */ unsigned long dwValueType; /* +0x0004 */ unsigned char Value[8]; /* +0x0008 02 13 00 00 */ }; struct _OSVERSIONINFOEXW { unsigned long dwOSVersionInfoSize; /* +0x0000 */ unsigned long dwMajorVersion; /* +0x0004 */ unsigned long dwMinorVersion; /* +0x0008 */ unsigned long dwBuildNumber; /* +0x000c */ unsigned long dwPlatformId; /* +0x0010 */ unsigned char szCSDVersion[256]; /* +0x0014 a7 15 00 00 */ unsigned short wServicePackMajor; /* +0x0114 */ unsigned short wServicePackMinor; /* +0x0116 */ unsigned short wSuiteMask; /* +0x0118 */ unsigned char wProductType; /* +0x011a */ unsigned char wReserved; /* +0x011b */ }; struct _NOTIFYICONDATAA { unsigned long cbSize; /* +0x0000 */ unsigned char hWnd[4]; /* +0x0004 f1 12 00 00 */ unsigned char uID[4]; /* +0x0008 75 00 00 00 */ unsigned char uFlags[4]; /* +0x000c 75 00 00 00 */ unsigned char uCallbackMessage[4]; /* +0x0010 75 00 00 00 */ unsigned char hIcon[4]; /* +0x0014 07 21 00 00 */ unsigned char szTip[128]; /* +0x0018 f7 16 00 00 */ unsigned long dwState; /* +0x0098 */ unsigned long dwStateMask; /* +0x009c */ unsigned char szInfo[256]; /* +0x00a0 8e 2d 00 00 */ /* unsigned char uTimeout[0]; +0x01a0 75 00 00 00 */ unsigned char uVersion[4]; /* +0x01a0 75 00 00 00 */ unsigned char szInfoTitle[64]; /* +0x01a4 8f 2d 00 00 */ unsigned long dwInfoFlags; /* +0x01e4 */ unsigned char guidItem[16]; /* +0x01e8 dc 14 00 00 */ unsigned char hBalloonIcon[4]; /* +0x01f8 07 21 00 00 */ }; struct _PROCESS_HANDLE_TABLE_ENTRY_INFO { void *HandleValue; /* +0x0000 */ unsigned long HandleCount; /* +0x0004 */ unsigned long PointerCount; /* +0x0008 */ unsigned long GrantedAccess; /* +0x000c */ unsigned long ObjectTypeIndex; /* +0x0010 */ unsigned long HandleAttributes; /* +0x0014 */ unsigned long Reserved; /* +0x0018 */ }; struct _CM_COMPONENT_INFORMATION { unsigned char Flags[4]; /* +0x0000 ad 2d 00 00 */ unsigned long Version; /* +0x0004 */ unsigned long Key; /* +0x0008 */ unsigned long AffinityMask; /* +0x000c */ }; struct _MUIREGISTRYINFO { unsigned char Owned[4]; /* +0x0000 75 00 00 00 */ unsigned char InstallLanguageFallback[8]; /* +0x0004 b0 2d 00 00 */ unsigned long Generation; /* +0x000c */ unsigned long ProcessGeneration; /* +0x0010 */ unsigned char Installed[4]; /* +0x0014 b2 2d 00 00 */ unsigned char Strings[4]; /* +0x0018 73 1f 00 00 */ unsigned char MachineConfig[4]; /* +0x001c b4 2d 00 00 */ unsigned char UserConfig[4]; /* +0x0020 b4 2d 00 00 */ unsigned char MachinePreferred[4]; /* +0x0024 b6 2d 00 00 */ unsigned char UserPreferred[4]; /* +0x0028 b6 2d 00 00 */ unsigned char ProcessPreferred[4]; /* +0x002c b6 2d 00 00 */ unsigned char MergedUser[4]; /* +0x0030 b6 2d 00 00 */ unsigned char MergedMachine[4]; /* +0x0034 b6 2d 00 00 */ unsigned char MergedFallback[4]; /* +0x0038 b6 2d 00 00 */ unsigned char PrevRegInfo[4]; /* +0x003c 62 17 00 00 */ unsigned long MUI_Locked; /* +0x0040 */ unsigned long MUI_SE; /* +0x0044 */ unsigned long MUI_NumberAllowed; /* +0x0048 */ unsigned char MUI_AllowedLanguage[4]; /* +0x004c 71 04 00 00 */ unsigned char MUI_InstalledSKU[4]; /* +0x0050 71 04 00 00 */ unsigned long cbInstalledSKU; /* +0x0054 */ unsigned long cbAllowedLanguage; /* +0x0058 */ unsigned char MUI_DisallowedLanguage[4]; /* +0x005c 71 04 00 00 */ unsigned long cbDisallowedLanguage; /* +0x0060 */ }; struct _RTL_PROCESS_BACKTRACES { unsigned long CommittedMemory; /* +0x0000 */ unsigned long ReservedMemory; /* +0x0004 */ unsigned long NumberOfBackTraceLookups; /* +0x0008 */ unsigned long NumberOfBackTraces; /* +0x000c */ unsigned char BackTraces[140]; /* +0x0010 ba 2d 00 00 */ }; struct _DEBUG_EVENT { unsigned long dwDebugEventCode; /* +0x0000 */ unsigned long dwProcessId; /* +0x0004 */ unsigned long dwThreadId; /* +0x0008 */ }; struct _CRYPTNET_URL_CACHE_PRE_FETCH_INFO { unsigned long cbSize; /* +0x0000 */ unsigned long dwObjectType; /* +0x0004 */ unsigned long dwError; /* +0x0008 */ unsigned long dwReserved; /* +0x000c */ unsigned char ThisUpdateTime[8]; /* +0x0010 31 13 00 00 */ unsigned char NextUpdateTime[8]; /* +0x0018 31 13 00 00 */ unsigned char PublishTime[8]; /* +0x0020 31 13 00 00 */ }; struct _SECURITY_DESCRIPTOR_RELATIVE { unsigned char Revision; /* +0x0000 */ unsigned char Sbz1; /* +0x0001 */ unsigned short Control; /* +0x0002 */ unsigned long Owner; /* +0x0004 */ unsigned long Group; /* +0x0008 */ unsigned long Sacl; /* +0x000c */ unsigned long Dacl; /* +0x0010 */ }; struct _FILE_NAMES_INFORMATION { unsigned long NextEntryOffset; /* +0x0000 */ unsigned long FileIndex; /* +0x0004 */ unsigned long FileNameLength; /* +0x0008 */ unsigned char FileName[4]; /* +0x000c f7 13 00 00 */ }; struct _RPC_BINDING_HANDLE_TEMPLATE_V1_W::<unnamed-type-u1> { unsigned short *Reserved; /* +0x0000 */ }; struct _CRYPT_3DES_KEY_STATE { unsigned char Key[24]; /* +0x0000 e2 2d 00 00 */ unsigned char IV[8]; /* +0x0018 7f 19 00 00 */ unsigned char Feedback[8]; /* +0x0020 7f 19 00 00 */ }; struct _NDR_EXPR_DESC { unsigned char pOffset[4]; /* +0x0000 3b 19 00 00 */ unsigned char pFormatExpr[4]; /* +0x0004 39 19 00 00 */ }; struct _CERT_REVOCATION_STATUS { unsigned long cbSize; /* +0x0000 */ unsigned long dwIndex; /* +0x0004 */ unsigned long dwError; /* +0x0008 */ unsigned long dwReason; /* +0x000c */ unsigned char fHasFreshnessTime[4]; /* +0x0010 74 00 00 00 */ unsigned long dwFreshnessTime; /* +0x0014 */ }; struct _FILE_STREAM_INFO { unsigned long NextEntryOffset; /* +0x0000 */ unsigned long StreamNameLength; /* +0x0004 */ unsigned char StreamSize[8]; /* +0x0008 3d 13 00 00 */ unsigned char StreamAllocationSize[8]; /* +0x0010 3d 13 00 00 */ unsigned char StreamName[8]; /* +0x0018 f7 13 00 00 */ }; struct _TOKEN_STATISTICS { unsigned char TokenId[8]; /* +0x0000 21 15 00 00 */ unsigned char AuthenticationId[8]; /* +0x0008 21 15 00 00 */ unsigned char ExpirationTime[8]; /* +0x0010 3d 13 00 00 */ unsigned char TokenType[4]; /* +0x0018 04 2e 00 00 */ unsigned char ImpersonationLevel[4]; /* +0x001c 05 2e 00 00 */ unsigned long DynamicCharged; /* +0x0020 */ unsigned long DynamicAvailable; /* +0x0024 */ unsigned long GroupCount; /* +0x0028 */ unsigned long PrivilegeCount; /* +0x002c */ unsigned char ModifiedId[8]; /* +0x0030 21 15 00 00 */ }; struct _FILE_EA_INFORMATION { unsigned long EaSize; /* +0x0000 */ }; struct _KEY_VALUE_PARTIAL_INFORMATION_ALIGN64 { unsigned long Type; /* +0x0000 */ unsigned long DataLength; /* +0x0004 */ unsigned char Data[4]; /* +0x0008 f9 12 00 00 */ }; struct _PLUGPLAY_CONTROL_INSTALL_DATA { unsigned long BufferLength; /* +0x0000 */ unsigned char Buffer[4]; /* +0x0004 71 04 00 00 */ }; struct tagTOUCH_HIT_TESTING_PROXIMITY_EVALUATION { unsigned short score; /* +0x0000 */ unsigned char adjustedPoint[8]; /* +0x0004 8a 14 00 00 */ }; struct _RPC_BINDING_HANDLE_SECURITY_V1_A { unsigned long Version; /* +0x0000 */ unsigned char *ServerPrincName; /* +0x0004 */ unsigned long AuthnLevel; /* +0x0008 */ unsigned long AuthnSvc; /* +0x000c */ unsigned char AuthIdentity[4]; /* +0x0010 cc 18 00 00 */ unsigned char SecurityQos[4]; /* +0x0014 03 1d 00 00 */ }; struct tagQUERYCONTEXT { unsigned long dwContext; /* +0x0000 */ unsigned char Platform[16]; /* +0x0004 36 2e 00 00 */ unsigned long Locale; /* +0x0014 */ unsigned long dwVersionHi; /* +0x0018 */ unsigned long dwVersionLo; /* +0x001c */ }; struct _SYSTEM_PROCESSOR_POLICY_INFORMATION { unsigned long Length; /* +0x0000 */ unsigned long PolicyId; /* +0x0004 */ unsigned char Policy[48]; /* +0x0008 3f 2e 00 00 */ }; struct _CERT_LOGOTYPE_IMAGE { unsigned char LogotypeDetails[12]; /* +0x0000 a5 18 00 00 */ unsigned char pLogotypeImageInfo[4]; /* +0x000c 46 2e 00 00 */ }; struct _PRIVILEGE_SET { unsigned long PrivilegeCount; /* +0x0000 */ unsigned long Control; /* +0x0004 */ unsigned char Privilege[12]; /* +0x0008 4e 2e 00 00 */ }; struct _CERT_X942_DH_VALIDATION_PARAMS { unsigned char seed[12]; /* +0x0000 03 13 00 00 */ unsigned long pgenCounter; /* +0x000c */ }; struct _CERT_CHAIN_POLICY_STATUS { unsigned long cbSize; /* +0x0000 */ unsigned long dwError; /* +0x0004 */ long lChainIndex; /* +0x0008 */ long lElementIndex; /* +0x000c */ void *pvExtraPolicyStatus; /* +0x0010 */ }; struct _TEB { unsigned char NtTib[28]; /* +0x0000 3e 27 00 00 */ void *EnvironmentPointer; /* +0x001c */ unsigned char ClientId[8]; /* +0x0020 3e 13 00 00 */ void *ActiveRpcHandle; /* +0x0028 */ void *ThreadLocalStoragePointer; /* +0x002c */ unsigned char ProcessEnvironmentBlock[4]; /* +0x0030 5d 2e 00 00 */ unsigned long LastErrorValue; /* +0x0034 */ unsigned long CountOfOwnedCriticalSections; /* +0x0038 */ void *CsrClientThread; /* +0x003c */ void *Win32ThreadInfo; /* +0x0040 */ unsigned char User32Reserved[104]; /* +0x0044 5e 2e 00 00 */ unsigned char UserReserved[20]; /* +0x00ac 3b 17 00 00 */ void *WOW32Reserved; /* +0x00c0 */ unsigned long CurrentLocale; /* +0x00c4 */ unsigned long FpSoftwareStatusRegister; /* +0x00c8 */ unsigned char SystemReserved1[216]; /* +0x00cc 5f 2e 00 00 */ long ExceptionCode; /* +0x01a4 */ unsigned char ActivationContextStackPointer[4]; /* +0x01a8 19 1e 00 00 */ unsigned char SpareBytes[36]; /* +0x01ac 1c 1c 00 00 */ unsigned long TxFsContext; /* +0x01d0 */ unsigned char GdiTebBatch[1248]; /* +0x01d4 60 2e 00 00 */ unsigned char RealClientId[8]; /* +0x06b4 3e 13 00 00 */ void *GdiCachedProcessHandle; /* +0x06bc */ unsigned long GdiClientPID; /* +0x06c0 */ unsigned long GdiClientTID; /* +0x06c4 */ void *GdiThreadLocalInfo; /* +0x06c8 */ unsigned char Win32ClientInfo[248]; /* +0x06cc 61 2e 00 00 */ unsigned char glDispatchTable[932]; /* +0x07c4 62 2e 00 00 */ unsigned char glReserved1[116]; /* +0x0b68 63 2e 00 00 */ void *glReserved2; /* +0x0bdc */ void *glSectionInfo; /* +0x0be0 */ void *glSection; /* +0x0be4 */ void *glTable; /* +0x0be8 */ void *glCurrentRC; /* +0x0bec */ void *glContext; /* +0x0bf0 */ unsigned long LastStatusValue; /* +0x0bf4 */ unsigned char StaticUnicodeString[8]; /* +0x0bf8 dd 12 00 00 */ unsigned char StaticUnicodeBuffer[524]; /* +0x0c00 64 2e 00 00 */ void *DeallocationStack; /* +0x0e0c */ unsigned char TlsSlots[256]; /* +0x0e10 65 2e 00 00 */ unsigned char TlsLinks[8]; /* +0x0f10 44 1f 00 00 */ void *Vdm; /* +0x0f18 */ void *ReservedForNtRpc; /* +0x0f1c */ unsigned char DbgSsReserved[8]; /* +0x0f20 e0 22 00 00 */ unsigned long HardErrorMode; /* +0x0f28 */ unsigned char Instrumentation[36]; /* +0x0f2c 66 2e 00 00 */ unsigned char ActivityId[16]; /* +0x0f50 dc 14 00 00 */ void *SubProcessTag; /* +0x0f60 */ void *EtwLocalData; /* +0x0f64 */ void *EtwTraceData; /* +0x0f68 */ void *WinSockData; /* +0x0f6c */ unsigned long GdiBatchCount; /* +0x0f70 */ /* unsigned char CurrentIdealProcessor[0]; +0x0f74 7e 20 00 00 */ unsigned long IdealProcessorValue; /* +0x0f74 */ unsigned char ReservedPad0; /* +0x0f74 */ unsigned char ReservedPad1; /* +0x0f75 */ unsigned char ReservedPad2; /* +0x0f76 */ unsigned char IdealProcessor; /* +0x0f77 */ unsigned long GuaranteedStackBytes; /* +0x0f78 */ void *ReservedForPerf; /* +0x0f7c */ void *ReservedForOle; /* +0x0f80 */ unsigned long WaitingOnLoaderLock; /* +0x0f84 */ void *SavedPriorityState; /* +0x0f88 */ unsigned long ReservedForCodeCoverage; /* +0x0f8c */ void *ThreadPoolData; /* +0x0f90 */ unsigned char TlsExpansionSlots[4]; /* +0x0f94 4f 13 00 00 */ unsigned long MuiGeneration; /* +0x0f98 */ unsigned long IsImpersonating; /* +0x0f9c */ void *NlsCache; /* +0x0fa0 */ void *pShimData; /* +0x0fa4 */ unsigned short HeapVirtualAffinity; /* +0x0fa8 */ unsigned short LowFragHeapDataSlot; /* +0x0faa */ void *CurrentTransactionHandle; /* +0x0fac */ unsigned char ActiveFrame[4]; /* +0x0fb0 67 2e 00 00 */ void *FlsData; /* +0x0fb4 */ void *PreferredLanguages; /* +0x0fb8 */ void *UserPrefLanguages; /* +0x0fbc */ void *MergedPrefLanguages; /* +0x0fc0 */ unsigned long MuiImpersonation; /* +0x0fc4 */ /* unsigned char CrossTebFlags[0]; +0x0fc8 68 2e 00 00 */ unsigned char SpareCrossTebBits[2]; /* +0x0fc8 69 2e 00 00 */ unsigned short SameTebFlags; /* +0x0fca */ /* unsigned char SafeThunkCall[0]; +0x0fca 6a 2e 00 00 */ /* unsigned char InDebugPrint[0]; +0x0fca 6b 2e 00 00 */ /* unsigned char HasFiberData[0]; +0x0fca 6c 2e 00 00 */ /* unsigned char SkipThreadAttach[0]; +0x0fca 6d 2e 00 00 */ /* unsigned char WerInShipAssertCode[0]; +0x0fca 6e 2e 00 00 */ /* unsigned char RanProcessInit[0]; +0x0fca 6f 2e 00 00 */ /* unsigned char ClonedThread[0]; +0x0fca 70 2e 00 00 */ /* unsigned char SuppressDebugMsg[0]; +0x0fca 71 2e 00 00 */ /* unsigned char DisableUserStackWalk[0]; +0x0fca 72 2e 00 00 */ /* unsigned char RtlExceptionAttached[0]; +0x0fca 73 2e 00 00 */ /* unsigned char InitialThread[0]; +0x0fca 74 2e 00 00 */ /* unsigned char SessionAware[0]; +0x0fca 75 2e 00 00 */ /* unsigned char DisabledStackCheck[0]; +0x0fca 76 2e 00 00 */ unsigned char SpareSameTebBits[2]; /* +0x0fca 77 2e 00 00 */ void *TxnScopeEnterCallback; /* +0x0fcc */ void *TxnScopeExitCallback; /* +0x0fd0 */ void *TxnScopeContext; /* +0x0fd4 */ unsigned long LockCount; /* +0x0fd8 */ unsigned long SpareUlong0; /* +0x0fdc */ void *ResourceRetValue; /* +0x0fe0 */ void *ReservedForWdf; /* +0x0fe4 */ }; struct _SYSTEM_PAGEFILE_INFORMATION { unsigned long NextEntryOffset; /* +0x0000 */ unsigned long TotalSize; /* +0x0004 */ unsigned long TotalInUse; /* +0x0008 */ unsigned long PeakUsage; /* +0x000c */ unsigned char PageFileName[8]; /* +0x0010 dd 12 00 00 */ }; struct _WNF_TYPE_ID { unsigned char TypeId[16]; /* +0x0000 dc 14 00 00 */ }; struct _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_GET_ROOT { void *ResolutionContext; /* +0x0000 */ unsigned long RootIndex; /* +0x0004 */ unsigned char CancelResolution; /* +0x0008 */ unsigned char NoMoreEntries; /* +0x0009 */ unsigned char Root[8]; /* +0x000c dd 12 00 00 */ }; struct _REPAIR_COPIES_OUTPUT { unsigned char FileOffsetRestart[8]; /* +0x0000 3d 13 00 00 */ unsigned long Status; /* +0x0008 */ unsigned long ExtentCount; /* +0x000c */ unsigned char Extents[16]; /* +0x0010 18 21 00 00 */ }; struct _RTL_LFG_RNG_STATE { unsigned char SeedArray[224]; /* +0x0000 82 2e 00 00 */ long Next; /* +0x00e0 */ long NextP; /* +0x00e4 */ }; struct tagEMREOF { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned long nPalEntries; /* +0x0008 */ unsigned long offPalEntries; /* +0x000c */ unsigned long nSizeLast; /* +0x0010 */ }; struct _FILE_LAYOUT_ENTRY { unsigned long Version; /* +0x0000 */ unsigned long NextFileOffset; /* +0x0004 */ unsigned long Flags; /* +0x0008 */ unsigned long FileAttributes; /* +0x000c */ unsigned long long FileReferenceNumber; /* +0x0010 */ unsigned long FirstNameOffset; /* +0x0018 */ unsigned long FirstStreamOffset; /* +0x001c */ unsigned long ExtraInfoOffset; /* +0x0020 */ unsigned long Reserved; /* +0x0024 */ }; struct _stat32i64 { unsigned char st_dev[4]; /* +0x0000 75 00 00 00 */ unsigned short st_ino; /* +0x0004 */ unsigned short st_mode; /* +0x0006 */ short st_nlink; /* +0x0008 */ short st_uid; /* +0x000a */ short st_gid; /* +0x000c */ unsigned char st_rdev[8]; /* +0x0010 75 00 00 00 */ long long st_size; /* +0x0018 */ long st_atime; /* +0x0020 */ long st_mtime; /* +0x0024 */ long st_ctime; /* +0x0028 */ }; struct _CSV_IS_OWNED_BY_CSVFS { unsigned char OwnedByCSVFS; /* +0x0000 */ }; struct _wfinddata64_t { unsigned char attrib[8]; /* +0x0000 75 00 00 00 */ long long time_create; /* +0x0008 */ long long time_access; /* +0x0010 */ long long time_write; /* +0x0018 */ long long size; /* +0x0020 */ unsigned char name[520]; /* +0x0028 e4 15 00 00 */ }; struct _CTL_INFO { unsigned long dwVersion; /* +0x0000 */ unsigned char SubjectUsage[8]; /* +0x0004 bd 13 00 00 */ unsigned char ListIdentifier[8]; /* +0x000c 02 13 00 00 */ unsigned char SequenceNumber[8]; /* +0x0014 02 13 00 00 */ unsigned char ThisUpdate[8]; /* +0x001c 31 13 00 00 */ unsigned char NextUpdate[8]; /* +0x0024 31 13 00 00 */ unsigned char SubjectAlgorithm[12]; /* +0x002c 55 14 00 00 */ unsigned long cCTLEntry; /* +0x0038 */ unsigned char rgCTLEntry[4]; /* +0x003c 57 2e 00 00 */ unsigned long cExtension; /* +0x0040 */ unsigned char rgExtension[4]; /* +0x0044 22 16 00 00 */ }; struct _TIME_FIELDS { short Year; /* +0x0000 */ short Month; /* +0x0002 */ short Day; /* +0x0004 */ short Hour; /* +0x0006 */ short Minute; /* +0x0008 */ short Second; /* +0x000a */ short Milliseconds; /* +0x000c */ short Weekday; /* +0x000e */ }; struct tagPALETTEENTRY { unsigned char peRed; /* +0x0000 */ unsigned char peGreen; /* +0x0001 */ unsigned char peBlue; /* +0x0002 */ unsigned char peFlags; /* +0x0003 */ }; struct tagRPC_CALL_ATTRIBUTES_V1_W { unsigned char Version[4]; /* +0x0000 75 00 00 00 */ unsigned long Flags; /* +0x0004 */ unsigned long ServerPrincipalNameBufferLength; /* +0x0008 */ unsigned short *ServerPrincipalName; /* +0x000c */ unsigned long ClientPrincipalNameBufferLength; /* +0x0010 */ unsigned short *ClientPrincipalName; /* +0x0014 */ unsigned long AuthenticationLevel; /* +0x0018 */ unsigned long AuthenticationService; /* +0x001c */ unsigned char NullSession[4]; /* +0x0020 74 00 00 00 */ }; struct _s__CatchableType { unsigned char properties[4]; /* +0x0000 75 00 00 00 */ unsigned char pType[4]; /* +0x0004 52 17 00 00 */ unsigned char thisDisplacement[12]; /* +0x0008 d5 28 00 00 */ unsigned char sizeOrOffset[4]; /* +0x0014 74 00 00 00 */ unsigned char copyFunction[4]; /* +0x0018 c7 13 00 00 */ }; struct _Wx86ThreadState { unsigned long *CallBx86Eip; /* +0x0000 */ void *DeallocationCpu; /* +0x0004 */ unsigned char UseKnownWx86Dll; /* +0x0008 */ char OleStubInvoked; /* +0x0009 */ }; struct tagLOGCOLORSPACEW { unsigned long lcsSignature; /* +0x0000 */ unsigned long lcsVersion; /* +0x0004 */ unsigned long lcsSize; /* +0x0008 */ long lcsCSType; /* +0x000c */ long lcsIntent; /* +0x0010 */ unsigned char lcsEndpoints[36]; /* +0x0014 c4 2c 00 00 */ unsigned long lcsGammaRed; /* +0x0038 */ unsigned long lcsGammaGreen; /* +0x003c */ unsigned long lcsGammaBlue; /* +0x0040 */ unsigned char lcsFilename[520]; /* +0x0044 e4 15 00 00 */ }; struct tagPOINTER_PEN_INFO { unsigned char pointerInfo[80]; /* +0x0000 ce 24 00 00 */ unsigned char penFlags[4]; /* +0x0050 75 00 00 00 */ unsigned char penMask[4]; /* +0x0054 75 00 00 00 */ unsigned char pressure[4]; /* +0x0058 75 00 00 00 */ unsigned char rotation[4]; /* +0x005c 75 00 00 00 */ unsigned char tiltX[4]; /* +0x0060 74 00 00 00 */ unsigned char tiltY[4]; /* +0x0064 74 00 00 00 */ }; struct _RSAPUBKEY { unsigned long magic; /* +0x0000 */ unsigned long bitlen; /* +0x0004 */ unsigned long pubexp; /* +0x0008 */ }; struct _CRYPT_IMAGE_REF { unsigned char pszImage[4]; /* +0x0000 71 04 00 00 */ unsigned long dwFlags; /* +0x0004 */ }; struct _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_SUCCESSFUL { void *ResolutionContext; /* +0x0000 */ unsigned long RootIndexUsed; /* +0x0004 */ }; struct _GRADIENT_RECT { unsigned long UpperLeft; /* +0x0000 */ unsigned long LowerRight; /* +0x0004 */ }; struct _ADMINISTRATOR_POWER_POLICY { unsigned char MinSleep[4]; /* +0x0000 5a 16 00 00 */ unsigned char MaxSleep[4]; /* +0x0004 5a 16 00 00 */ unsigned long MinVideoTimeout; /* +0x0008 */ unsigned long MaxVideoTimeout; /* +0x000c */ unsigned long MinSpindownTimeout; /* +0x0010 */ unsigned long MaxSpindownTimeout; /* +0x0014 */ }; struct _RTL_BACKOFF { unsigned long Delay; /* +0x0000 */ }; struct _IMAGE_RESOURCE_DATA_ENTRY { unsigned long OffsetToData; /* +0x0000 */ unsigned long Size; /* +0x0004 */ unsigned long CodePage; /* +0x0008 */ unsigned long Reserved; /* +0x000c */ }; struct _DEDUP_CHUNK_INFORMATION_HASH32 { unsigned long ChunkFlags; /* +0x0000 */ long long ChunkOffsetInFile; /* +0x0008 */ long long ChunkSize; /* +0x0010 */ unsigned char HashVal[32]; /* +0x0018 e5 17 00 00 */ }; struct _KEY_CACHED_INFORMATION { unsigned char LastWriteTime[8]; /* +0x0000 3d 13 00 00 */ unsigned long TitleIndex; /* +0x0008 */ unsigned long SubKeys; /* +0x000c */ unsigned long MaxNameLen; /* +0x0010 */ unsigned long Values; /* +0x0014 */ unsigned long MaxValueNameLen; /* +0x0018 */ unsigned long MaxValueDataLen; /* +0x001c */ unsigned long NameLength; /* +0x0020 */ }; struct _RemotableHandle { long fContext; /* +0x0000 */ }; struct _PROCESS_HANDLE_TRACING_ENABLE_EX { unsigned long Flags; /* +0x0000 */ unsigned long TotalSlots; /* +0x0004 */ }; struct _EISA_PORT_DESCRIPTOR { /* unsigned char NumberPorts[0]; +0x0000 3e 2f 00 00 */ /* unsigned char Reserved[0]; +0x0000 73 1e 00 00 */ /* unsigned char Shared[0]; +0x0000 74 1e 00 00 */ unsigned char MoreEntries[1]; /* +0x0000 75 1e 00 00 */ }; struct _CMSG_SP3_COMPATIBLE_AUX_INFO { unsigned long cbSize; /* +0x0000 */ unsigned long dwFlags; /* +0x0004 */ }; struct tagEMRPOLYPOLYLINE16 { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned char rclBounds[16]; /* +0x0008 d5 12 00 00 */ unsigned long nPolys; /* +0x0018 */ unsigned long cpts; /* +0x001c */ unsigned char aPolyCounts[4]; /* +0x0020 f6 12 00 00 */ unsigned char apts[4]; /* +0x0024 05 23 00 00 */ }; struct _FLAG_STGMEDIUM { long ContextFlags; /* +0x0000 */ long fPassOwnership; /* +0x0004 */ unsigned char Stgmed[12]; /* +0x0008 02 2b 00 00 */ }; struct tagCUSTDATA { unsigned long cCustData; /* +0x0000 */ unsigned char prgCustData[4]; /* +0x0004 b7 15 00 00 */ }; struct _SERVICE_REQUIRED_PRIVILEGES_INFOA { char *pmszRequiredPrivileges; /* +0x0000 */ }; struct _JOBOBJECT_BASIC_ACCOUNTING_INFORMATION { unsigned char TotalUserTime[8]; /* +0x0000 3d 13 00 00 */ unsigned char TotalKernelTime[8]; /* +0x0008 3d 13 00 00 */ unsigned char ThisPeriodTotalUserTime[8]; /* +0x0010 3d 13 00 00 */ unsigned char ThisPeriodTotalKernelTime[8]; /* +0x0018 3d 13 00 00 */ unsigned long TotalPageFaultCount; /* +0x0020 */ unsigned long TotalProcesses; /* +0x0024 */ unsigned long ActiveProcesses; /* +0x0028 */ unsigned long TotalTerminatedProcesses; /* +0x002c */ }; struct _SYSTEM_PERFORMANCE_INFORMATION { unsigned char IdleProcessTime[8]; /* +0x0000 3d 13 00 00 */ unsigned char IoReadTransferCount[8]; /* +0x0008 3d 13 00 00 */ unsigned char IoWriteTransferCount[8]; /* +0x0010 3d 13 00 00 */ unsigned char IoOtherTransferCount[8]; /* +0x0018 3d 13 00 00 */ unsigned long IoReadOperationCount; /* +0x0020 */ unsigned long IoWriteOperationCount; /* +0x0024 */ unsigned long IoOtherOperationCount; /* +0x0028 */ unsigned long AvailablePages; /* +0x002c */ unsigned long CommittedPages; /* +0x0030 */ unsigned long CommitLimit; /* +0x0034 */ unsigned long PeakCommitment; /* +0x0038 */ unsigned long PageFaultCount; /* +0x003c */ unsigned long CopyOnWriteCount; /* +0x0040 */ unsigned long TransitionCount; /* +0x0044 */ unsigned long CacheTransitionCount; /* +0x0048 */ unsigned long DemandZeroCount; /* +0x004c */ unsigned long PageReadCount; /* +0x0050 */ unsigned long PageReadIoCount; /* +0x0054 */ unsigned long CacheReadCount; /* +0x0058 */ unsigned long CacheIoCount; /* +0x005c */ unsigned long DirtyPagesWriteCount; /* +0x0060 */ unsigned long DirtyWriteIoCount; /* +0x0064 */ unsigned long MappedPagesWriteCount; /* +0x0068 */ unsigned long MappedWriteIoCount; /* +0x006c */ unsigned long PagedPoolPages; /* +0x0070 */ unsigned long NonPagedPoolPages; /* +0x0074 */ unsigned long PagedPoolAllocs; /* +0x0078 */ unsigned long PagedPoolFrees; /* +0x007c */ unsigned long NonPagedPoolAllocs; /* +0x0080 */ unsigned long NonPagedPoolFrees; /* +0x0084 */ unsigned long FreeSystemPtes; /* +0x0088 */ unsigned long ResidentSystemCodePage; /* +0x008c */ unsigned long TotalSystemDriverPages; /* +0x0090 */ unsigned long TotalSystemCodePages; /* +0x0094 */ unsigned long NonPagedPoolLookasideHits; /* +0x0098 */ unsigned long PagedPoolLookasideHits; /* +0x009c */ unsigned long AvailablePagedPoolPages; /* +0x00a0 */ unsigned long ResidentSystemCachePage; /* +0x00a4 */ unsigned long ResidentPagedPoolPage; /* +0x00a8 */ unsigned long ResidentSystemDriverPage; /* +0x00ac */ unsigned long CcFastReadNoWait; /* +0x00b0 */ unsigned long CcFastReadWait; /* +0x00b4 */ unsigned long CcFastReadResourceMiss; /* +0x00b8 */ unsigned long CcFastReadNotPossible; /* +0x00bc */ unsigned long CcFastMdlReadNoWait; /* +0x00c0 */ unsigned long CcFastMdlReadWait; /* +0x00c4 */ unsigned long CcFastMdlReadResourceMiss; /* +0x00c8 */ unsigned long CcFastMdlReadNotPossible; /* +0x00cc */ unsigned long CcMapDataNoWait; /* +0x00d0 */ unsigned long CcMapDataWait; /* +0x00d4 */ unsigned long CcMapDataNoWaitMiss; /* +0x00d8 */ unsigned long CcMapDataWaitMiss; /* +0x00dc */ unsigned long CcPinMappedDataCount; /* +0x00e0 */ unsigned long CcPinReadNoWait; /* +0x00e4 */ unsigned long CcPinReadWait; /* +0x00e8 */ unsigned long CcPinReadNoWaitMiss; /* +0x00ec */ unsigned long CcPinReadWaitMiss; /* +0x00f0 */ unsigned long CcCopyReadNoWait; /* +0x00f4 */ unsigned long CcCopyReadWait; /* +0x00f8 */ unsigned long CcCopyReadNoWaitMiss; /* +0x00fc */ unsigned long CcCopyReadWaitMiss; /* +0x0100 */ unsigned long CcMdlReadNoWait; /* +0x0104 */ unsigned long CcMdlReadWait; /* +0x0108 */ unsigned long CcMdlReadNoWaitMiss; /* +0x010c */ unsigned long CcMdlReadWaitMiss; /* +0x0110 */ unsigned long CcReadAheadIos; /* +0x0114 */ unsigned long CcLazyWriteIos; /* +0x0118 */ unsigned long CcLazyWritePages; /* +0x011c */ unsigned long CcDataFlushes; /* +0x0120 */ unsigned long CcDataPages; /* +0x0124 */ unsigned long ContextSwitches; /* +0x0128 */ unsigned long FirstLevelTbFills; /* +0x012c */ unsigned long SecondLevelTbFills; /* +0x0130 */ unsigned long SystemCalls; /* +0x0134 */ unsigned long long CcTotalDirtyPages; /* +0x0138 */ unsigned long long CcDirtyPageThreshold; /* +0x0140 */ long long ResidentAvailablePages; /* +0x0148 */ }; struct tagWIN16RECT { unsigned short left; /* +0x0000 */ unsigned short top; /* +0x0002 */ unsigned short right; /* +0x0004 */ unsigned short bottom; /* +0x0006 */ }; struct _RTL_MODULE_EXTENDED_INFO { unsigned char BasicInfo[4]; /* +0x0000 68 2f 00 00 */ unsigned long ImageSize; /* +0x0004 */ unsigned short FileNameOffset; /* +0x0008 */ unsigned char FullPathName[258]; /* +0x000a 74 16 00 00 */ }; struct _COMSTAT { /* unsigned char fCtsHold[0]; +0x0000 17 13 00 00 */ /* unsigned char fDsrHold[0]; +0x0000 7e 18 00 00 */ /* unsigned char fRlsdHold[0]; +0x0000 7f 18 00 00 */ /* unsigned char fXoffHold[0]; +0x0000 27 1e 00 00 */ /* unsigned char fXoffSent[0]; +0x0000 42 1e 00 00 */ /* unsigned char fEof[0]; +0x0000 ce 23 00 00 */ /* unsigned char fTxim[0]; +0x0000 ff 1e 00 00 */ unsigned char fReserved[4]; /* +0x0000 7d 23 00 00 */ unsigned long cbInQue; /* +0x0004 */ unsigned long cbOutQue; /* +0x0008 */ }; struct tagPOINTER_INFO { unsigned long pointerType; /* +0x0000 */ unsigned char pointerId[4]; /* +0x0004 75 00 00 00 */ unsigned char frameId[4]; /* +0x0008 75 00 00 00 */ unsigned char pointerFlags[4]; /* +0x000c 75 00 00 00 */ void *sourceDevice; /* +0x0010 */ unsigned char hwndTarget[4]; /* +0x0014 f1 12 00 00 */ unsigned char ptPixelLocation[8]; /* +0x0018 8a 14 00 00 */ unsigned char ptHimetricLocation[8]; /* +0x0020 8a 14 00 00 */ unsigned char ptPixelLocationRaw[8]; /* +0x0028 8a 14 00 00 */ unsigned char ptHimetricLocationRaw[8]; /* +0x0030 8a 14 00 00 */ unsigned long dwTime; /* +0x0038 */ unsigned char historyCount[4]; /* +0x003c 75 00 00 00 */ unsigned char InputData[4]; /* +0x0040 74 00 00 00 */ unsigned long dwKeyStates; /* +0x0044 */ unsigned long long PerformanceCount; /* +0x0048 */ }; struct _PROCESS_WS_WATCH_INFORMATION_EX { unsigned char BasicInfo[8]; /* +0x0000 48 23 00 00 */ unsigned long FaultingThreadId; /* +0x0008 */ unsigned long Flags; /* +0x000c */ }; struct _TRANSACTIONMANAGER_LOG_INFORMATION { unsigned char LogIdentity[16]; /* +0x0000 dc 14 00 00 */ }; struct _FP_80 { unsigned char W[12]; /* +0x0000 22 13 00 00 */ }; struct _ALPC_TOKEN_ATTR { unsigned char TokenId[8]; /* +0x0000 21 15 00 00 */ unsigned char AuthenticationId[8]; /* +0x0008 21 15 00 00 */ unsigned char ModifiedId[8]; /* +0x0010 21 15 00 00 */ }; struct _FILE_PREFETCH { unsigned long Type; /* +0x0000 */ unsigned long Count; /* +0x0004 */ unsigned char Prefetch[8]; /* +0x0008 98 2f 00 00 */ }; struct _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA { /* unsigned char ResolutionBeginning[0]; +0x0000 9d 2f 00 00 */ /* unsigned char GetRoot[0]; +0x0000 9e 2f 00 00 */ /* unsigned char ResolutionSuccessful[0]; +0x0000 9f 2f 00 00 */ unsigned char ResolutionEnding[32]; /* +0x0000 a0 2f 00 00 */ }; struct tagHW_PROFILE_INFOW { unsigned long dwDockInfo; /* +0x0000 */ unsigned char szHwProfileGuid[78]; /* +0x0004 a3 2f 00 00 */ unsigned char szHwProfileName[162]; /* +0x0052 08 21 00 00 */ }; struct _SYSTEM_EXCEPTION_INFORMATION { unsigned long AlignmentFixupCount; /* +0x0000 */ unsigned long ExceptionDispatchCount; /* +0x0004 */ unsigned long FloatingEmulationCount; /* +0x0008 */ unsigned long ByteWordEmulationCount; /* +0x000c */ }; struct _CM_FLOPPY_DEVICE_DATA { unsigned short Version; /* +0x0000 */ unsigned short Revision; /* +0x0002 */ unsigned char Size[8]; /* +0x0004 0c 1d 00 00 */ unsigned long MaxDensity; /* +0x000c */ unsigned long MountDensity; /* +0x0010 */ unsigned char StepRateHeadUnloadTime; /* +0x0014 */ unsigned char HeadLoadTime; /* +0x0015 */ unsigned char MotorOffTime; /* +0x0016 */ unsigned char SectorLengthCode; /* +0x0017 */ unsigned char SectorPerTrack; /* +0x0018 */ unsigned char ReadWriteGapLength; /* +0x0019 */ unsigned char DataTransferLength; /* +0x001a */ unsigned char FormatGapLength; /* +0x001b */ unsigned char FormatFillCharacter; /* +0x001c */ unsigned char HeadSettleTime; /* +0x001d */ unsigned char MotorSettleTime; /* +0x001e */ unsigned char MaximumTrackValue; /* +0x001f */ unsigned char DataTransferRate; /* +0x0020 */ }; struct tagPANOSE { unsigned char bFamilyType; /* +0x0000 */ unsigned char bSerifStyle; /* +0x0001 */ unsigned char bWeight; /* +0x0002 */ unsigned char bProportion; /* +0x0003 */ unsigned char bContrast; /* +0x0004 */ unsigned char bStrokeVariation; /* +0x0005 */ unsigned char bArmStyle; /* +0x0006 */ unsigned char bLetterform; /* +0x0007 */ unsigned char bMidline; /* +0x0008 */ unsigned char bXHeight; /* +0x0009 */ }; struct _ENUM_SERVICE_STATUS_PROCESSW { unsigned char lpServiceName[4]; /* +0x0000 71 04 00 00 */ unsigned char lpDisplayName[4]; /* +0x0004 71 04 00 00 */ unsigned char ServiceStatusProcess[36]; /* +0x0008 c6 16 00 00 */ }; struct _SAFER_CODE_PROPERTIES_V2 { unsigned long cbSize; /* +0x0000 */ unsigned long dwCheckFlags; /* +0x0004 */ unsigned char ImagePath[4]; /* +0x0008 c0 13 00 00 */ void *hImageFileHandle; /* +0x000c */ unsigned long UrlZoneId; /* +0x0010 */ unsigned char ImageHash[64]; /* +0x0014 13 13 00 00 */ unsigned long dwImageHashSize; /* +0x0054 */ unsigned char ImageSize[8]; /* +0x0058 3d 13 00 00 */ unsigned char HashAlgorithm[4]; /* +0x0060 75 00 00 00 */ unsigned char *pByteBlock; /* +0x0064 */ unsigned char hWndParent[4]; /* +0x0068 f1 12 00 00 */ unsigned long dwWVTUIChoice; /* +0x006c */ unsigned char PackageMoniker[4]; /* +0x0070 c0 13 00 00 */ unsigned char PackagePublisher[4]; /* +0x0074 c0 13 00 00 */ unsigned char PackageName[8]; /* +0x0078 c0 13 00 00 */ unsigned long long PackageVersion; /* +0x0080 */ }; struct _SYSTEM_PROCESSOR_POWER_INFORMATION { unsigned char CurrentFrequency; /* +0x0000 */ unsigned char ThermalLimitFrequency; /* +0x0001 */ unsigned char ConstantThrottleFrequency; /* +0x0002 */ unsigned char DegradedThrottleFrequency; /* +0x0003 */ unsigned char LastBusyFrequency; /* +0x0004 */ unsigned char LastC3Frequency; /* +0x0005 */ unsigned char LastAdjustedBusyFrequency; /* +0x0006 */ unsigned char ProcessorMinThrottle; /* +0x0007 */ unsigned char ProcessorMaxThrottle; /* +0x0008 */ unsigned long NumberOfFrequencies; /* +0x000c */ unsigned long PromotionCount; /* +0x0010 */ unsigned long DemotionCount; /* +0x0014 */ unsigned long ErrorCount; /* +0x0018 */ unsigned long RetryCount; /* +0x001c */ unsigned long long CurrentFrequencyTime; /* +0x0020 */ unsigned long long CurrentProcessorTime; /* +0x0028 */ unsigned long long CurrentProcessorIdleTime; /* +0x0030 */ unsigned long long LastProcessorTime; /* +0x0038 */ unsigned long long LastProcessorIdleTime; /* +0x0040 */ }; struct _RTL_RXACT_LOG { unsigned long OperationCount; /* +0x0000 */ unsigned long LogSize; /* +0x0004 */ unsigned long LogSizeInUse; /* +0x0008 */ }; struct _LDR_RESLOADER_RET { void *Module; /* +0x0000 */ void *DataEntry; /* +0x0004 */ void *TargetModule; /* +0x0008 */ }; struct tagIMEMENUITEMINFOA { unsigned char cbSize[4]; /* +0x0000 75 00 00 00 */ unsigned char fType[4]; /* +0x0004 75 00 00 00 */ unsigned char fState[4]; /* +0x0008 75 00 00 00 */ unsigned char wID[4]; /* +0x000c 75 00 00 00 */ unsigned char hbmpChecked[4]; /* +0x0010 06 18 00 00 */ unsigned char hbmpUnchecked[4]; /* +0x0014 06 18 00 00 */ unsigned long dwItemData; /* +0x0018 */ unsigned char szString[80]; /* +0x001c c8 2f 00 00 */ unsigned char hbmpItem[4]; /* +0x006c 06 18 00 00 */ }; struct _SYSTEM_GDI_DRIVER_INFORMATION { unsigned char DriverName[8]; /* +0x0000 dd 12 00 00 */ void *ImageAddress; /* +0x0008 */ void *SectionPointer; /* +0x000c */ void *EntryPoint; /* +0x0010 */ unsigned char ExportSectionPointer[4]; /* +0x0014 ce 2f 00 00 */ unsigned long ImageLength; /* +0x0018 */ }; struct tagKERNINGPAIR { unsigned short wFirst; /* +0x0000 */ unsigned short wSecond; /* +0x0002 */ unsigned char iKernAmount[4]; /* +0x0004 74 00 00 00 */ }; struct tagCOLORMATCHTOTARGET { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned long dwAction; /* +0x0008 */ unsigned long dwFlags; /* +0x000c */ unsigned long cbName; /* +0x0010 */ unsigned long cbData; /* +0x0014 */ unsigned char Data[4]; /* +0x0018 f9 12 00 00 */ }; struct _wireSAFEARR_UNKNOWN { unsigned long Size; /* +0x0000 */ unsigned char apUnknown[4]; /* +0x0004 13 22 00 00 */ }; struct _CRYPT_PROVIDERS { unsigned long cProviders; /* +0x0000 */ unsigned char rgpszProviders[4]; /* +0x0004 d0 13 00 00 */ }; struct _LEARNING_MODE_OBJECT_INFORMATION { unsigned char ListEntry[4]; /* +0x0000 ba 17 00 00 */ unsigned char LogLevel[4]; /* +0x0004 e0 2f 00 00 */ unsigned char ObjectType[4]; /* +0x0008 a2 17 00 00 */ unsigned char ObjectName[4]; /* +0x000c a2 17 00 00 */ void *RootDirectory; /* +0x0010 */ unsigned char FullObjectName[8]; /* +0x0014 dd 12 00 00 */ }; struct _SYSTEM_VHD_BOOT_INFORMATION { unsigned char OsDiskIsVhd; /* +0x0000 */ unsigned long OsVhdFilePathOffset; /* +0x0004 */ unsigned char OsVhdParentVolume[4]; /* +0x0008 f7 13 00 00 */ }; struct _CMSG_SIGNER_ENCODE_INFO { unsigned long cbSize; /* +0x0000 */ unsigned char pCertInfo[4]; /* +0x0004 39 1a 00 00 */ unsigned long hCryptProv; /* +0x0008 */ unsigned long hNCryptKey; /* +0x0008 */ unsigned long dwKeySpec; /* +0x000c */ unsigned char HashAlgorithm[12]; /* +0x0010 55 14 00 00 */ void *pvHashAuxInfo; /* +0x001c */ unsigned long cAuthAttr; /* +0x0020 */ unsigned char rgAuthAttr[4]; /* +0x0024 d8 13 00 00 */ unsigned long cUnauthAttr; /* +0x0028 */ unsigned char rgUnauthAttr[4]; /* +0x002c d8 13 00 00 */ }; struct tagEMRCREATEPEN { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned long ihPen; /* +0x0008 */ unsigned char lopn[16]; /* +0x000c b9 18 00 00 */ }; struct _MIDL_STUBLESS_PROXY_INFO { unsigned char pStubDesc[4]; /* +0x0000 33 29 00 00 */ unsigned char ProcFormatString[4]; /* +0x0004 39 19 00 00 */ unsigned char FormatStringOffset[4]; /* +0x0008 3b 19 00 00 */ unsigned char pTransferSyntax[4]; /* +0x000c ec 23 00 00 */ unsigned long nCount; /* +0x0010 */ unsigned char pSyntaxInfo[4]; /* +0x0014 aa 20 00 00 */ }; struct _CERT_DH_PARAMETERS { unsigned char p[8]; /* +0x0000 02 13 00 00 */ unsigned char g[8]; /* +0x0008 02 13 00 00 */ }; struct tagORPCTHIS { unsigned char version[4]; /* +0x0000 66 1f 00 00 */ unsigned long flags; /* +0x0004 */ unsigned long reserved1; /* +0x0008 */ unsigned char cid[16]; /* +0x000c dc 14 00 00 */ unsigned char extensions[4]; /* +0x001c 0f 30 00 00 */ }; struct _PROCESS_MITIGATION_DEP_POLICY { unsigned long Flags; /* +0x0000 */ /* unsigned char Enable[0]; +0x0000 17 13 00 00 */ /* unsigned char DisableAtlThunkEmulation[0]; +0x0000 7e 18 00 00 */ unsigned char ReservedFlags[4]; /* +0x0000 b3 19 00 00 */ unsigned char Permanent; /* +0x0004 */ }; struct _KEY_EVENT_RECORD { unsigned char bKeyDown[4]; /* +0x0000 74 00 00 00 */ unsigned short wRepeatCount; /* +0x0004 */ unsigned short wVirtualKeyCode; /* +0x0006 */ unsigned short wVirtualScanCode; /* +0x0008 */ }; struct _KEY_EVENT_RECORD::<unnamed-type-uChar> { /* unsigned char UnicodeChar[0]; +0x0000 71 00 00 00 */ char AsciiChar; /* +0x0000 */ }; struct _RTL_PROCESS_MODULES { unsigned long NumberOfModules; /* +0x0000 */ unsigned char Modules[284]; /* +0x0004 24 30 00 00 */ }; struct _PEB { unsigned char InheritedAddressSpace; /* +0x0000 */ unsigned char ReadImageFileExecOptions; /* +0x0001 */ unsigned char BeingDebugged; /* +0x0002 */ unsigned char BitField; /* +0x0003 */ /* unsigned char ImageUsesLargePages[0]; +0x0003 6f 1e 00 00 */ /* unsigned char IsProtectedProcess[0]; +0x0003 70 1e 00 00 */ /* unsigned char IsLegacyProcess[0]; +0x0003 71 1e 00 00 */ /* unsigned char IsImageDynamicallyRelocated[0]; +0x0003 e3 25 00 00 */ /* unsigned char SkipPatchingUser32Forwarders[0]; +0x0003 c9 25 00 00 */ unsigned char SpareBits[1]; /* +0x0003 e4 25 00 00 */ void *Mutant; /* +0x0004 */ void *ImageBaseAddress; /* +0x0008 */ unsigned char Ldr[4]; /* +0x000c 28 30 00 00 */ unsigned char ProcessParameters[4]; /* +0x0010 b5 23 00 00 */ void *SubSystemData; /* +0x0014 */ void *ProcessHeap; /* +0x0018 */ unsigned char FastPebLock[4]; /* +0x001c 61 1f 00 00 */ void *AtlThunkSListPtr; /* +0x0020 */ void *IFEOKey; /* +0x0024 */ unsigned long CrossProcessFlags; /* +0x0028 */ /* unsigned char ProcessInJob[0]; +0x0028 17 13 00 00 */ /* unsigned char ProcessInitializing[0]; +0x0028 7e 18 00 00 */ /* unsigned char ProcessUsingVEH[0]; +0x0028 7f 18 00 00 */ /* unsigned char ProcessUsingVCH[0]; +0x0028 27 1e 00 00 */ /* unsigned char ProcessUsingFTH[0]; +0x0028 42 1e 00 00 */ unsigned char ReservedBits0[4]; /* +0x0028 43 1e 00 00 */ void *KernelCallbackTable; /* +0x002c */ void *UserSharedInfoPtr; /* +0x002c */ unsigned char SystemReserved[4]; /* +0x0030 f6 12 00 00 */ unsigned long AtlThunkSListPtr32; /* +0x0034 */ void *ApiSetMap; /* +0x0038 */ unsigned long TlsExpansionCounter; /* +0x003c */ void *TlsBitmap; /* +0x0040 */ unsigned char TlsBitmapBits[8]; /* +0x0044 69 15 00 00 */ void *ReadOnlySharedMemoryBase; /* +0x004c */ void *HotpatchInformation; /* +0x0050 */ unsigned char ReadOnlyStaticServerData[4]; /* +0x0054 4f 13 00 00 */ void *AnsiCodePageData; /* +0x0058 */ void *OemCodePageData; /* +0x005c */ void *UnicodeCaseTableData; /* +0x0060 */ unsigned long NumberOfProcessors; /* +0x0064 */ unsigned long NtGlobalFlag; /* +0x0068 */ unsigned char CriticalSectionTimeout[8]; /* +0x0070 3d 13 00 00 */ unsigned long HeapSegmentReserve; /* +0x0078 */ unsigned long HeapSegmentCommit; /* +0x007c */ unsigned long HeapDeCommitTotalFreeThreshold; /* +0x0080 */ unsigned long HeapDeCommitFreeBlockThreshold; /* +0x0084 */ unsigned long NumberOfHeaps; /* +0x0088 */ unsigned long MaximumNumberOfHeaps; /* +0x008c */ unsigned char ProcessHeaps[4]; /* +0x0090 4f 13 00 00 */ void *GdiSharedHandleTable; /* +0x0094 */ void *ProcessStarterHelper; /* +0x0098 */ unsigned long GdiDCAttributeList; /* +0x009c */ unsigned char LoaderLock[4]; /* +0x00a0 61 1f 00 00 */ unsigned long OSMajorVersion; /* +0x00a4 */ unsigned long OSMinorVersion; /* +0x00a8 */ unsigned short OSBuildNumber; /* +0x00ac */ unsigned short OSCSDVersion; /* +0x00ae */ unsigned long OSPlatformId; /* +0x00b0 */ unsigned long ImageSubsystem; /* +0x00b4 */ unsigned long ImageSubsystemMajorVersion; /* +0x00b8 */ unsigned long ImageSubsystemMinorVersion; /* +0x00bc */ unsigned long ActiveProcessAffinityMask; /* +0x00c0 */ unsigned char GdiHandleBuffer[136]; /* +0x00c4 29 30 00 00 */ unsigned char PostProcessInitRoutine[4]; /* +0x014c 26 1b 00 00 */ void *TlsExpansionBitmap; /* +0x0150 */ unsigned char TlsExpansionBitmapBits[128]; /* +0x0154 9b 2c 00 00 */ unsigned long SessionId; /* +0x01d4 */ unsigned char AppCompatFlags[8]; /* +0x01d8 fd 22 00 00 */ unsigned char AppCompatFlagsUser[8]; /* +0x01e0 fd 22 00 00 */ void *pShimData; /* +0x01e8 */ void *AppCompatInfo; /* +0x01ec */ unsigned char CSDVersion[8]; /* +0x01f0 dd 12 00 00 */ unsigned char ActivationContextData[4]; /* +0x01f8 2c 30 00 00 */ unsigned char ProcessAssemblyStorageMap[4]; /* +0x01fc 2e 30 00 00 */ unsigned char SystemDefaultActivationContextData[4]; /* +0x0200 2c 30 00 00 */ unsigned char SystemAssemblyStorageMap[4]; /* +0x0204 2e 30 00 00 */ unsigned long MinimumStackCommit; /* +0x0208 */ unsigned char FlsCallback[4]; /* +0x020c 30 30 00 00 */ unsigned char FlsListHead[8]; /* +0x0210 44 1f 00 00 */ void *FlsBitmap; /* +0x0218 */ unsigned char FlsBitmapBits[16]; /* +0x021c 4f 1a 00 00 */ unsigned long FlsHighIndex; /* +0x022c */ void *WerRegistrationData; /* +0x0230 */ void *WerShipAssertPtr; /* +0x0234 */ void *pUnused; /* +0x0238 */ void *pImageHeaderHash; /* +0x023c */ unsigned long TracingFlags; /* +0x0240 */ /* unsigned char HeapTracingEnabled[0]; +0x0240 17 13 00 00 */ /* unsigned char CritSecTracingEnabled[0]; +0x0240 7e 18 00 00 */ /* unsigned char LibLoaderTracingEnabled[0]; +0x0240 7f 18 00 00 */ unsigned char SpareTracingBits[8]; /* +0x0240 b0 2c 00 00 */ unsigned long long CsrServerReadOnlySharedMemoryBase; /* +0x0248 */ }; struct _CALL_FRAME { void *ReturnAddress; /* +0x0000 */ void *Param1; /* +0x0004 */ void *Param2; /* +0x0008 */ void *CompatibilityArea; /* +0x000c */ }; struct _RPC_SECURITY_QOS { unsigned long Version; /* +0x0000 */ unsigned long Capabilities; /* +0x0004 */ unsigned long IdentityTracking; /* +0x0008 */ unsigned long ImpersonationType; /* +0x000c */ }; struct _LDT_SIZE { unsigned long Length; /* +0x0000 */ }; struct _SYSTEM_CODEINTEGRITY_INFORMATION { unsigned long Length; /* +0x0000 */ unsigned long CodeIntegrityOptions; /* +0x0004 */ }; struct _SEC_WINNT_AUTH_IDENTITY_A { unsigned char *User; /* +0x0000 */ unsigned long UserLength; /* +0x0004 */ unsigned char *Domain; /* +0x0008 */ unsigned long DomainLength; /* +0x000c */ unsigned char *Password; /* +0x0010 */ unsigned long PasswordLength; /* +0x0014 */ unsigned long Flags; /* +0x0018 */ }; struct _PROCESS_ACCESS_TOKEN { void *Token; /* +0x0000 */ void *Thread; /* +0x0004 */ }; struct _STORAGE_QUERY_DEPENDENT_VOLUME_RESPONSE { unsigned long ResponseLevel; /* +0x0000 */ unsigned long NumberEntries; /* +0x0004 */ /* unsigned char Lev1Depends[0]; +0x0008 6d 30 00 00 */ unsigned char Lev2Depends[68]; /* +0x0008 6f 30 00 00 */ }; struct tagCLIENTCREATESTRUCT { void *hWindowMenu; /* +0x0000 */ unsigned char idFirstChild[4]; /* +0x0004 75 00 00 00 */ }; struct _CONSOLE_HISTORY_INFO { unsigned char cbSize[4]; /* +0x0000 75 00 00 00 */ unsigned char HistoryBufferSize[4]; /* +0x0004 75 00 00 00 */ unsigned char NumberOfHistoryBuffers[4]; /* +0x0008 75 00 00 00 */ unsigned long dwFlags; /* +0x000c */ }; struct _CERT_OR_CRL_BUNDLE { unsigned long cItem; /* +0x0000 */ unsigned char rgItem[4]; /* +0x0004 7b 30 00 00 */ }; struct _OBJECTID { unsigned char Lineage[16]; /* +0x0000 dc 14 00 00 */ unsigned long Uniquifier; /* +0x0010 */ }; struct tagEMRSETPIXELV { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned char ptlPixel[8]; /* +0x0008 9f 13 00 00 */ unsigned long crColor; /* +0x0010 */ }; struct _RPC_SERVER_INTERFACE { unsigned char Length[4]; /* +0x0000 75 00 00 00 */ unsigned char InterfaceId[20]; /* +0x0004 eb 16 00 00 */ unsigned char TransferSyntax[20]; /* +0x0018 eb 16 00 00 */ unsigned char DispatchTable[4]; /* +0x002c 37 19 00 00 */ unsigned char RpcProtseqEndpointCount[4]; /* +0x0030 75 00 00 00 */ unsigned char RpcProtseqEndpoint[4]; /* +0x0034 67 1e 00 00 */ void *DefaultManagerEpv; /* +0x0038 */ unsigned char InterpreterInfo[4]; /* +0x003c 3d 19 00 00 */ unsigned char Flags[4]; /* +0x0040 75 00 00 00 */ }; struct _CRYPT_OBJECT_LOCATOR_PROVIDER_TABLE { unsigned long cbSize; /* +0x0000 */ unsigned char pfnGet[4]; /* +0x0004 8e 30 00 00 */ unsigned char pfnRelease[4]; /* +0x0008 8e 2a 00 00 */ unsigned char pfnFreePassword[4]; /* +0x000c 3c 1e 00 00 */ unsigned char pfnFree[4]; /* +0x0010 d5 1a 00 00 */ unsigned char pfnFreeIdentifier[4]; /* +0x0014 7d 2c 00 00 */ }; struct _NT_TIB64 { unsigned long long ExceptionList; /* +0x0000 */ unsigned long long StackBase; /* +0x0008 */ unsigned long long StackLimit; /* +0x0010 */ unsigned long long SubSystemTib; /* +0x0018 */ unsigned long long FiberData; /* +0x0020 */ unsigned long Version; /* +0x0020 */ unsigned long long ArbitraryUserPointer; /* +0x0028 */ unsigned long long Self; /* +0x0030 */ }; struct _LOOKUP_STREAM_FROM_CLUSTER_INPUT { unsigned long Flags; /* +0x0000 */ unsigned long NumberOfClusters; /* +0x0004 */ unsigned char Cluster[8]; /* +0x0008 55 25 00 00 */ }; struct _SYSTEM_INTERRUPT_INFORMATION { unsigned long ContextSwitches; /* +0x0000 */ unsigned long DpcCount; /* +0x0004 */ unsigned long DpcRate; /* +0x0008 */ unsigned long TimeIncrement; /* +0x000c */ unsigned long DpcBypassCount; /* +0x0010 */ unsigned long ApcBypassCount; /* +0x0014 */ }; struct _UMS_SCHEDULER_STARTUP_INFO { unsigned long UmsVersion; /* +0x0000 */ void *CompletionList; /* +0x0004 */ unsigned char SchedulerProc[4]; /* +0x0008 e0 15 00 00 */ void *SchedulerParam; /* +0x000c */ }; struct _ABCFLOAT { unsigned char abcfA[4]; /* +0x0000 40 00 00 00 */ unsigned char abcfB[4]; /* +0x0004 40 00 00 00 */ unsigned char abcfC[4]; /* +0x0008 40 00 00 00 */ }; struct tagEMRCREATECOLORSPACE { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned long ihCS; /* +0x0008 */ unsigned char lcs[328]; /* +0x000c 9b 30 00 00 */ }; struct _numberfmtW { unsigned char NumDigits[4]; /* +0x0000 75 00 00 00 */ unsigned char LeadingZero[4]; /* +0x0004 75 00 00 00 */ unsigned char Grouping[4]; /* +0x0008 75 00 00 00 */ unsigned char lpDecimalSep[4]; /* +0x000c 71 04 00 00 */ unsigned char lpThousandSep[4]; /* +0x0010 71 04 00 00 */ unsigned char NegativeOrder[4]; /* +0x0014 75 00 00 00 */ }; struct _CRYPT_PKCS8_EXPORT_PARAMS { unsigned long hCryptProv; /* +0x0000 */ unsigned long dwKeySpec; /* +0x0004 */ char *pszPrivateKeyObjId; /* +0x0008 */ unsigned char pEncryptPrivateKeyFunc[4]; /* +0x000c a2 30 00 00 */ void *pVoidEncryptFunc; /* +0x0010 */ }; struct _TXFS_START_RM_INFORMATION { unsigned long Flags; /* +0x0000 */ unsigned long long LogContainerSize; /* +0x0008 */ unsigned long LogContainerCountMin; /* +0x0010 */ unsigned long LogContainerCountMax; /* +0x0014 */ unsigned long LogGrowthIncrement; /* +0x0018 */ unsigned long LogAutoShrinkPercentage; /* +0x001c */ unsigned long TmLogPathOffset; /* +0x0020 */ unsigned short TmLogPathLength; /* +0x0024 */ unsigned short LoggingMode; /* +0x0026 */ unsigned short LogPathLength; /* +0x0028 */ unsigned short Reserved; /* +0x002a */ unsigned char LogPath[4]; /* +0x002c f7 13 00 00 */ }; struct _STREAM_LAYOUT_ENTRY { unsigned long Version; /* +0x0000 */ unsigned long NextStreamOffset; /* +0x0004 */ unsigned long Flags; /* +0x0008 */ unsigned long ExtentInformationOffset; /* +0x000c */ unsigned char AllocationSize[8]; /* +0x0010 3d 13 00 00 */ unsigned char EndOfFile[8]; /* +0x0018 3d 13 00 00 */ unsigned long StreamIdentifierLength; /* +0x0020 */ unsigned long Reserved; /* +0x0024 */ unsigned char StreamIdentifier[8]; /* +0x0028 f7 13 00 00 */ }; struct _PARSE_MESSAGE_CONTEXT { unsigned long fFlags; /* +0x0000 */ unsigned long cwSavColumn; /* +0x0004 */ unsigned long iwSrc; /* +0x0008 */ unsigned long iwDst; /* +0x000c */ unsigned long iwDstSpace; /* +0x0010 */ char *lpvArgStart; /* +0x0014 */ }; struct _IMAGE_ALPHA64_RUNTIME_FUNCTION_ENTRY { unsigned long long BeginAddress; /* +0x0000 */ unsigned long long EndAddress; /* +0x0008 */ unsigned long long ExceptionHandler; /* +0x0010 */ unsigned long long HandlerData; /* +0x0018 */ unsigned long long PrologEndAddress; /* +0x0020 */ }; struct _QUERY_FILE_LAYOUT_INPUT { unsigned long NumberOfPairs; /* +0x0000 */ unsigned long Flags; /* +0x0004 */ unsigned char FilterType[4]; /* +0x0008 b0 30 00 00 */ unsigned long Reserved; /* +0x000c */ }; struct _QUERY_FILE_LAYOUT_INPUT::<unnamed-type-Filter> { /* unsigned char ClusterRanges[0]; +0x0000 b4 30 00 00 */ unsigned char FileReferenceRanges[16]; /* +0x0000 b5 30 00 00 */ }; struct _CERT_NAME_VALUE { unsigned long dwValueType; /* +0x0000 */ unsigned char Value[8]; /* +0x0004 02 13 00 00 */ }; struct _FILE_VOLUME_NAME_INFORMATION { unsigned long DeviceNameLength; /* +0x0000 */ unsigned char DeviceName[4]; /* +0x0004 f7 13 00 00 */ }; struct _POWER_SESSION_TIMEOUTS { unsigned long InputTimeout; /* +0x0000 */ unsigned long DisplayTimeout; /* +0x0004 */ }; struct _KAFFINITY_ENUMERATION_CONTEXT { unsigned char Affinity[4]; /* +0x0000 66 23 00 00 */ unsigned long CurrentMask; /* +0x0004 */ unsigned short CurrentIndex; /* +0x0008 */ }; struct _wfinddatai64_t { unsigned char attrib[4]; /* +0x0000 75 00 00 00 */ long time_create; /* +0x0004 */ long time_access; /* +0x0008 */ long time_write; /* +0x000c */ long long size; /* +0x0010 */ unsigned char name[520]; /* +0x0018 e4 15 00 00 */ }; struct _PROV_ENUMALGS { unsigned char aiAlgid[4]; /* +0x0000 75 00 00 00 */ unsigned long dwBitLen; /* +0x0004 */ unsigned long dwNameLen; /* +0x0008 */ unsigned char szName[20]; /* +0x000c b6 1e 00 00 */ }; struct _TOKEN_ELEVATION { unsigned long TokenIsElevated; /* +0x0000 */ }; struct _SYSTEM_HOTPATCH_CODE_INFORMATION { unsigned long Flags; /* +0x0000 */ unsigned long InfoSize; /* +0x0004 */ /* unsigned char CodeInfo[0]; +0x0008 f2 30 00 00 */ /* unsigned char KernelInfo[0]; +0x0008 f3 30 00 00 */ /* unsigned char UserModeInfo[0]; +0x0008 f4 30 00 00 */ /* unsigned char InjectionInfo[0]; +0x0008 f5 30 00 00 */ unsigned char AtomicSwap[48]; /* +0x0008 f6 30 00 00 */ }; struct _SYSTEM_HOTPATCH_CODE_INFORMATION::<unnamed-tag>::<unnamed-type-AtomicSwap> { unsigned long long ParentDirectory; /* +0x0000 */ unsigned long long ObjectHandle1; /* +0x0008 */ unsigned long long ObjectHandle2; /* +0x0010 */ }; struct _SYSTEM_HOTPATCH_CODE_INFORMATION::<unnamed-tag>::<unnamed-type-InjectionInfo> { unsigned short NameOffset; /* +0x0000 */ unsigned short NameLength; /* +0x0002 */ unsigned short TargetNameOffset; /* +0x0004 */ unsigned short TargetNameLength; /* +0x0006 */ unsigned short ColdpatchImagePathOffset; /* +0x0008 */ unsigned short ColdpatchImagePathLength; /* +0x000a */ unsigned long long TargetProcess; /* +0x0010 */ }; struct _SYSTEM_HOTPATCH_CODE_INFORMATION::<unnamed-tag>::<unnamed-type-UserModeInfo> { unsigned short NameOffset; /* +0x0000 */ unsigned short NameLength; /* +0x0002 */ unsigned short TargetNameOffset; /* +0x0004 */ unsigned short TargetNameLength; /* +0x0006 */ unsigned short ColdpatchImagePathOffset; /* +0x0008 */ unsigned short ColdpatchImagePathLength; /* +0x000a */ unsigned char PatchingFinished; /* +0x000c */ }; struct _SYSTEM_HOTPATCH_CODE_INFORMATION::<unnamed-tag>::<unnamed-type-KernelInfo> { unsigned short NameOffset; /* +0x0000 */ unsigned short NameLength; /* +0x0002 */ }; struct _SYSTEM_HOTPATCH_CODE_INFORMATION::<unnamed-tag>::<unnamed-type-CodeInfo> { unsigned long DescriptorsCount; /* +0x0000 */ unsigned char CodeDescriptors[40]; /* +0x0008 01 31 00 00 */ }; struct _MEMORY_PRIORITY_INFORMATION { unsigned long MemoryPriority; /* +0x0000 */ }; struct _CRL_ISSUING_DIST_POINT { unsigned char DistPointName[12]; /* +0x0000 d8 22 00 00 */ unsigned char fOnlyContainsUserCerts[4]; /* +0x000c 74 00 00 00 */ unsigned char fOnlyContainsCACerts[4]; /* +0x0010 74 00 00 00 */ unsigned char OnlySomeReasonFlags[12]; /* +0x0014 03 13 00 00 */ unsigned char fIndirectCRL[4]; /* +0x0020 74 00 00 00 */ }; struct _SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION { unsigned long Version; /* +0x0000 */ unsigned char Flags[4]; /* +0x0004 0a 31 00 00 */ unsigned char ValidFlags[4]; /* +0x0008 0a 31 00 00 */ }; struct _RTL_UNICODE_STRING_BUFFER { unsigned char String[8]; /* +0x0000 dd 12 00 00 */ unsigned char ByteBuffer[24]; /* +0x0008 ef 27 00 00 */ unsigned char MinimumStaticBufferForTerminalNul[4]; /* +0x0020 a7 17 00 00 */ }; struct _userSTGMEDIUM::_STGMEDIUM_UNION { unsigned long tymed; /* +0x0000 */ }; struct _userSTGMEDIUM::_STGMEDIUM_UNION::__MIDL_IAdviseSink_0003 { /* unsigned char hMetaFilePict[0]; +0x0000 15 31 00 00 */ /* unsigned char hHEnhMetaFile[0]; +0x0000 17 31 00 00 */ /* unsigned char hGdiHandle[0]; +0x0000 19 31 00 00 */ /* unsigned char hGlobal[0]; +0x0000 cd 13 00 00 */ /* unsigned char lpszFileName[0]; +0x0000 71 04 00 00 */ /* unsigned char pstm[0]; +0x0000 0e 16 00 00 */ unsigned char pstg[4]; /* +0x0000 0e 16 00 00 */ }; struct _FILE_ID_GLOBAL_TX_DIR_INFORMATION { unsigned long NextEntryOffset; /* +0x0000 */ unsigned long FileIndex; /* +0x0004 */ unsigned char CreationTime[8]; /* +0x0008 3d 13 00 00 */ unsigned char LastAccessTime[8]; /* +0x0010 3d 13 00 00 */ unsigned char LastWriteTime[8]; /* +0x0018 3d 13 00 00 */ unsigned char ChangeTime[8]; /* +0x0020 3d 13 00 00 */ unsigned char EndOfFile[8]; /* +0x0028 3d 13 00 00 */ unsigned char AllocationSize[8]; /* +0x0030 3d 13 00 00 */ unsigned long FileAttributes; /* +0x0038 */ unsigned long FileNameLength; /* +0x003c */ unsigned char FileId[8]; /* +0x0040 3d 13 00 00 */ unsigned char LockingTransactionId[16]; /* +0x0048 dc 14 00 00 */ unsigned long TxInfoFlags; /* +0x0058 */ unsigned char FileName[4]; /* +0x005c f7 13 00 00 */ }; struct _IMAGE_BOUND_FORWARDER_REF { unsigned long TimeDateStamp; /* +0x0000 */ unsigned short OffsetModuleName; /* +0x0004 */ unsigned short Reserved; /* +0x0006 */ }; struct _LDR_FAILURE_DATA { long Status; /* +0x0000 */ unsigned char ImageName[64]; /* +0x0004 a5 15 00 00 */ unsigned char AdditionalInfo[64]; /* +0x0044 a5 15 00 00 */ }; struct _SYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION { unsigned long NumberOfLogicalProcessors; /* +0x0000 */ unsigned long NumberOfCores; /* +0x0004 */ }; struct tagRAWINPUTDEVICELIST { void *hDevice; /* +0x0000 */ unsigned long dwType; /* +0x0004 */ }; struct _X86_CALL_FRAME { unsigned long ReturnAddress; /* +0x0000 */ unsigned long Param1; /* +0x0004 */ unsigned long Param2; /* +0x0008 */ unsigned long CompatibilityArea; /* +0x000c */ }; struct _CRYPT_ENROLLMENT_NAME_VALUE_PAIR { unsigned char pwszName[4]; /* +0x0000 71 04 00 00 */ unsigned char pwszValue[4]; /* +0x0004 71 04 00 00 */ }; struct _TRANSACTION_ENLISTMENT_PAIR { unsigned char EnlistmentId[16]; /* +0x0000 dc 14 00 00 */ unsigned char ResourceManagerId[16]; /* +0x0010 dc 14 00 00 */ }; struct tagDIBSECTION { unsigned char dsBm[24]; /* +0x0000 43 31 00 00 */ unsigned char dsBmih[40]; /* +0x0018 44 31 00 00 */ unsigned char dsBitfields[12]; /* +0x0040 22 13 00 00 */ void *dshSection; /* +0x004c */ unsigned long dsOffset; /* +0x0050 */ }; struct _SHFILEOPSTRUCTA { unsigned char hwnd[4]; /* +0x0000 f1 12 00 00 */ unsigned char wFunc[4]; /* +0x0004 75 00 00 00 */ unsigned char pFrom[4]; /* +0x0008 62 14 00 00 */ unsigned char pTo[4]; /* +0x000c 62 14 00 00 */ unsigned short fFlags; /* +0x0010 */ unsigned char fAnyOperationsAborted[4]; /* +0x0012 74 00 00 00 */ void *hNameMappings; /* +0x0016 */ unsigned char lpszProgressTitle[4]; /* +0x001a 62 14 00 00 */ }; struct tagDATAELEMENT { unsigned char dataID[16]; /* +0x0000 dc 14 00 00 */ unsigned long cbSize; /* +0x0010 */ unsigned long cbRounded; /* +0x0014 */ unsigned char Data[4]; /* +0x0018 f9 12 00 00 */ }; struct _WOW64_LDT_ENTRY { unsigned short LimitLow; /* +0x0000 */ unsigned short BaseLow; /* +0x0002 */ }; struct _WIN32_STREAM_ID { unsigned long dwStreamId; /* +0x0000 */ unsigned long dwStreamAttributes; /* +0x0004 */ unsigned char Size[8]; /* +0x0008 3d 13 00 00 */ unsigned long dwStreamNameSize; /* +0x0010 */ unsigned char cStreamName[4]; /* +0x0014 f7 13 00 00 */ }; struct tagENUMLOGFONTEXW { unsigned char elfLogFont[92]; /* +0x0000 a3 16 00 00 */ unsigned char elfFullName[128]; /* +0x005c 98 1e 00 00 */ unsigned char elfStyle[64]; /* +0x00dc a5 15 00 00 */ unsigned char elfScript[64]; /* +0x011c a5 15 00 00 */ }; struct _CTL_USAGE { unsigned long cUsageIdentifier; /* +0x0000 */ unsigned char rgpszUsageIdentifier[4]; /* +0x0004 c6 23 00 00 */ }; struct _CMSG_RC2_AUX_INFO { unsigned long cbSize; /* +0x0000 */ unsigned long dwBitLen; /* +0x0004 */ }; struct _TOKEN_OWNER { void *Owner; /* +0x0000 */ }; struct _tagRemBINDINFO { unsigned long cbSize; /* +0x0000 */ unsigned char szExtraInfo[4]; /* +0x0004 71 04 00 00 */ unsigned long grfBindInfoF; /* +0x0008 */ unsigned long dwBindVerb; /* +0x000c */ unsigned char szCustomVerb[4]; /* +0x0010 71 04 00 00 */ unsigned long cbstgmedData; /* +0x0014 */ unsigned long dwOptions; /* +0x0018 */ unsigned long dwOptionsFlags; /* +0x001c */ unsigned long dwCodePage; /* +0x0020 */ unsigned char securityAttributes[12]; /* +0x0024 8d 16 00 00 */ unsigned char iid[16]; /* +0x0030 dc 14 00 00 */ unsigned char pUnk[4]; /* +0x0040 7f 17 00 00 */ unsigned long dwReserved; /* +0x0044 */ }; struct _EVENTSFORLOGFILE { unsigned long ulSize; /* +0x0000 */ unsigned char szLogicalLogFile[512]; /* +0x0004 3c 17 00 00 */ unsigned long ulNumRecords; /* +0x0204 */ /* unsigned char pEventLogRecords[0]; +0x0208 6d 31 00 00 */ }; struct _COAUTHINFO { unsigned long dwAuthnSvc; /* +0x0000 */ unsigned long dwAuthzSvc; /* +0x0004 */ unsigned char pwszServerPrincName[4]; /* +0x0008 71 04 00 00 */ unsigned long dwAuthnLevel; /* +0x000c */ unsigned long dwImpersonationLevel; /* +0x0010 */ unsigned char pAuthIdentityData[4]; /* +0x0014 91 31 00 00 */ unsigned long dwCapabilities; /* +0x0018 */ }; struct _UNIQUE_PROCESS_INFORMATION { /* unsigned char DontUse[0]; +0x0000 7e 29 00 00 */ /* unsigned char UniqueProcessKey[0]; +0x0000 7f 29 00 00 */ unsigned char Reserved[8]; /* +0x0000 80 29 00 00 */ }; struct _SUPPORTED_OS_INFO { unsigned short OsCount; /* +0x0000 */ unsigned short MitigationExist; /* +0x0002 */ unsigned char OsList[8]; /* +0x0004 b0 2d 00 00 */ }; struct _RPC_ASYNC_STATE { unsigned char Size[4]; /* +0x0000 75 00 00 00 */ unsigned long Signature; /* +0x0004 */ long Lock; /* +0x0008 */ unsigned long Flags; /* +0x000c */ void *StubInfo; /* +0x0010 */ void *UserInfo; /* +0x0014 */ void *RuntimeInfo; /* +0x0018 */ unsigned char Event[4]; /* +0x001c a4 13 00 00 */ unsigned char NotificationType[4]; /* +0x0020 9c 31 00 00 */ unsigned char u[16]; /* +0x0024 9d 31 00 00 */ unsigned char Reserved[16]; /* +0x0034 9e 31 00 00 */ }; struct _SERVICE_START_REASON { unsigned long dwReason; /* +0x0000 */ }; struct _CERT_KEY_USAGE_RESTRICTION_INFO { unsigned long cCertPolicyId; /* +0x0000 */ unsigned char rgCertPolicyId[4]; /* +0x0004 aa 31 00 00 */ unsigned char RestrictedKeyUsage[12]; /* +0x0008 03 13 00 00 */ }; struct _APPCATEGORYINFO { unsigned long Locale; /* +0x0000 */ unsigned char pszDescription[4]; /* +0x0004 71 04 00 00 */ unsigned char AppCategoryId[16]; /* +0x0008 dc 14 00 00 */ }; struct _TOKEN_ORIGIN { unsigned char OriginatingLogonSession[8]; /* +0x0000 21 15 00 00 */ }; struct _RTL_QUERY_DEBUG_INFORMATION_INFO { unsigned long UniqueProcessId; /* +0x0000 */ unsigned long Flags; /* +0x0004 */ unsigned long long Buffer; /* +0x0008 */ }; struct _SERVICE_CONTROL_STATUS_REASON_PARAMSA { unsigned long dwReason; /* +0x0000 */ char *pszComment; /* +0x0004 */ unsigned char ServiceStatus[36]; /* +0x0008 c6 16 00 00 */ }; struct _OCSP_BASIC_SIGNED_RESPONSE_INFO { unsigned char ToBeSigned[8]; /* +0x0000 02 13 00 00 */ unsigned char SignatureInfo[32]; /* +0x0008 b9 31 00 00 */ }; struct tagLAYERPLANEDESCRIPTOR { unsigned short nSize; /* +0x0000 */ unsigned short nVersion; /* +0x0002 */ unsigned long dwFlags; /* +0x0004 */ unsigned char iPixelType; /* +0x0008 */ unsigned char cColorBits; /* +0x0009 */ unsigned char cRedBits; /* +0x000a */ unsigned char cRedShift; /* +0x000b */ unsigned char cGreenBits; /* +0x000c */ unsigned char cGreenShift; /* +0x000d */ unsigned char cBlueBits; /* +0x000e */ unsigned char cBlueShift; /* +0x000f */ unsigned char cAlphaBits; /* +0x0010 */ unsigned char cAlphaShift; /* +0x0011 */ unsigned char cAccumBits; /* +0x0012 */ unsigned char cAccumRedBits; /* +0x0013 */ unsigned char cAccumGreenBits; /* +0x0014 */ unsigned char cAccumBlueBits; /* +0x0015 */ unsigned char cAccumAlphaBits; /* +0x0016 */ unsigned char cDepthBits; /* +0x0017 */ unsigned char cStencilBits; /* +0x0018 */ unsigned char cAuxBuffers; /* +0x0019 */ unsigned char iLayerPlane; /* +0x001a */ unsigned char bReserved; /* +0x001b */ unsigned long crTransparent; /* +0x001c */ }; struct tagPOINTER_DEVICE_CURSOR_INFO { unsigned char cursorId[4]; /* +0x0000 75 00 00 00 */ unsigned char cursor[4]; /* +0x0004 be 31 00 00 */ }; struct _CONSOLE_CURSOR_INFO { unsigned long dwSize; /* +0x0000 */ unsigned char bVisible[4]; /* +0x0004 74 00 00 00 */ }; struct _XSAVE_VENDORS { unsigned long NumberOfVendors; /* +0x0000 */ unsigned char Vendor[56]; /* +0x0008 c7 31 00 00 */ }; struct _FILE_ALL_INFORMATION { unsigned char BasicInformation[40]; /* +0x0000 ca 31 00 00 */ unsigned char StandardInformation[24]; /* +0x0028 cb 31 00 00 */ unsigned char InternalInformation[8]; /* +0x0040 cc 31 00 00 */ unsigned char EaInformation[4]; /* +0x0048 07 1c 00 00 */ unsigned char AccessInformation[4]; /* +0x004c 6d 25 00 00 */ unsigned char PositionInformation[8]; /* +0x0050 cd 31 00 00 */ unsigned char ModeInformation[4]; /* +0x0058 37 17 00 00 */ unsigned char AlignmentInformation[4]; /* +0x005c c1 1b 00 00 */ unsigned char NameInformation[8]; /* +0x0060 ce 31 00 00 */ }; struct _STARTUPINFOW { unsigned long cb; /* +0x0000 */ unsigned char lpReserved[4]; /* +0x0004 71 04 00 00 */ unsigned char lpDesktop[4]; /* +0x0008 71 04 00 00 */ unsigned char lpTitle[4]; /* +0x000c 71 04 00 00 */ unsigned long dwX; /* +0x0010 */ unsigned long dwY; /* +0x0014 */ unsigned long dwXSize; /* +0x0018 */ unsigned long dwYSize; /* +0x001c */ unsigned long dwXCountChars; /* +0x0020 */ unsigned long dwYCountChars; /* +0x0024 */ unsigned long dwFillAttribute; /* +0x0028 */ unsigned long dwFlags; /* +0x002c */ unsigned short wShowWindow; /* +0x0030 */ unsigned short cbReserved2; /* +0x0032 */ unsigned char *lpReserved2; /* +0x0034 */ void *hStdInput; /* +0x0038 */ void *hStdOutput; /* +0x003c */ void *hStdError; /* +0x0040 */ }; struct _CRYPT_CSP_PROVIDER { unsigned long dwKeySpec; /* +0x0000 */ unsigned char pwszProviderName[4]; /* +0x0004 71 04 00 00 */ unsigned char Signature[12]; /* +0x0008 03 13 00 00 */ }; struct _CMSG_CTRL_ADD_SIGNER_UNAUTH_ATTR_PARA { unsigned long cbSize; /* +0x0000 */ unsigned long dwSignerIndex; /* +0x0004 */ unsigned char blob[8]; /* +0x0008 02 13 00 00 */ }; struct _IMAGE_DOS_HEADER { unsigned short e_magic; /* +0x0000 */ unsigned short e_cblp; /* +0x0002 */ unsigned short e_cp; /* +0x0004 */ unsigned short e_crlc; /* +0x0006 */ unsigned short e_cparhdr; /* +0x0008 */ unsigned short e_minalloc; /* +0x000a */ unsigned short e_maxalloc; /* +0x000c */ unsigned short e_ss; /* +0x000e */ unsigned short e_sp; /* +0x0010 */ unsigned short e_csum; /* +0x0012 */ unsigned short e_ip; /* +0x0014 */ unsigned short e_cs; /* +0x0016 */ unsigned short e_lfarlc; /* +0x0018 */ unsigned short e_ovno; /* +0x001a */ unsigned char e_res[8]; /* +0x001c b0 2d 00 00 */ unsigned short e_oemid; /* +0x0024 */ unsigned short e_oeminfo; /* +0x0026 */ unsigned char e_res2[20]; /* +0x0028 d9 31 00 00 */ long e_lfanew; /* +0x003c */ }; struct _TP_TASK { unsigned char Callbacks[4]; /* +0x0000 dd 31 00 00 */ unsigned long NumaNode; /* +0x0004 */ unsigned char IdealProcessor; /* +0x0008 */ unsigned char ListEntry[8]; /* +0x000c 44 1f 00 00 */ }; struct _FILE_DISPOSITION_INFO { unsigned char DeleteFileW; /* +0x0000 */ }; struct _CTL_ANY_SUBJECT_INFO { unsigned char SubjectAlgorithm[12]; /* +0x0000 55 14 00 00 */ unsigned char SubjectIdentifier[8]; /* +0x000c 02 13 00 00 */ }; struct _FP_IEEE_RECORD { unsigned char Operand1[24]; /* +0x0000 e4 31 00 00 */ unsigned char Operand2[24]; /* +0x0018 e4 31 00 00 */ unsigned char Result[24]; /* +0x0030 e4 31 00 00 */ }; struct tagBITMAPCOREHEADER { unsigned long bcSize; /* +0x0000 */ unsigned short bcWidth; /* +0x0004 */ unsigned short bcHeight; /* +0x0006 */ unsigned short bcPlanes; /* +0x0008 */ unsigned short bcBitCount; /* +0x000a */ }; struct DISPLAYCONFIG_SET_TARGET_PERSISTENCE { unsigned char header[20]; /* +0x0000 ca 24 00 00 */ /* unsigned char bootPersistenceOn[0]; +0x0014 cf 1c 00 00 */ /* unsigned char reserved[0]; +0x0014 eb 31 00 00 */ unsigned char value[4]; /* +0x0014 75 00 00 00 */ }; struct _SERVICE_STATUS { unsigned long dwServiceType; /* +0x0000 */ unsigned long dwCurrentState; /* +0x0004 */ unsigned long dwControlsAccepted; /* +0x0008 */ unsigned long dwWin32ExitCode; /* +0x000c */ unsigned long dwServiceSpecificExitCode; /* +0x0010 */ unsigned long dwCheckPoint; /* +0x0014 */ unsigned long dwWaitHint; /* +0x0018 */ }; struct _PRIVKEYVER3 { unsigned long magic; /* +0x0000 */ unsigned long bitlenP; /* +0x0004 */ unsigned long bitlenQ; /* +0x0008 */ unsigned long bitlenJ; /* +0x000c */ unsigned long bitlenX; /* +0x0010 */ unsigned char DSSSeed[24]; /* +0x0014 6e 19 00 00 */ }; struct _CRL_DIST_POINTS_INFO { unsigned long cDistPoint; /* +0x0000 */ unsigned char rgDistPoint[4]; /* +0x0004 f3 31 00 00 */ }; struct _CM_ROM_BLOCK { unsigned long Address; /* +0x0000 */ unsigned long Size; /* +0x0004 */ }; struct _CERT_STRONG_SIGN_SERIALIZED_INFO { unsigned long dwFlags; /* +0x0000 */ unsigned char pwszCNGSignHashAlgids[4]; /* +0x0004 71 04 00 00 */ unsigned char pwszCNGPubKeyMinBitLengths[4]; /* +0x0008 71 04 00 00 */ }; struct _FILE_ATTRIBUTE_CACHE_VALUES { unsigned long Flags; /* +0x0000 */ unsigned long NumberOfValues; /* +0x0004 */ unsigned char Attributes[212]; /* +0x0008 04 32 00 00 */ }; struct _LUNICODE_STRING { unsigned long Length; /* +0x0000 */ unsigned long MaximumLength; /* +0x0004 */ unsigned char Buffer[4]; /* +0x0008 71 04 00 00 */ }; struct _WINDOWS_OS_OPTIONS { unsigned char Signature[8]; /* +0x0000 7f 19 00 00 */ unsigned long Version; /* +0x0008 */ unsigned long Length; /* +0x000c */ unsigned long OsLoadPathOffset; /* +0x0010 */ unsigned char OsLoadOptions[4]; /* +0x0014 f7 13 00 00 */ }; struct _JOURNAL_ABSOLUTE_INFORMATION { unsigned char StartTimeStamp[8]; /* +0x0000 3d 13 00 00 */ unsigned char EndTimeStamp[8]; /* +0x0008 3d 13 00 00 */ unsigned long long NumberOfRecords; /* +0x0010 */ unsigned long FillLevel; /* +0x0018 */ }; struct _SHORT_SIZEDARR { unsigned long clSize; /* +0x0000 */ unsigned short *pData; /* +0x0004 */ }; struct _FILE_ID_BOTH_DIR_INFORMATION { unsigned long NextEntryOffset; /* +0x0000 */ unsigned long FileIndex; /* +0x0004 */ unsigned char CreationTime[8]; /* +0x0008 3d 13 00 00 */ unsigned char LastAccessTime[8]; /* +0x0010 3d 13 00 00 */ unsigned char LastWriteTime[8]; /* +0x0018 3d 13 00 00 */ unsigned char ChangeTime[8]; /* +0x0020 3d 13 00 00 */ unsigned char EndOfFile[8]; /* +0x0028 3d 13 00 00 */ unsigned char AllocationSize[8]; /* +0x0030 3d 13 00 00 */ unsigned long FileAttributes; /* +0x0038 */ unsigned long FileNameLength; /* +0x003c */ unsigned long EaSize; /* +0x0040 */ char ShortNameLength; /* +0x0044 */ unsigned char ShortName[26]; /* +0x0046 11 29 00 00 */ unsigned char FileId[8]; /* +0x0060 3d 13 00 00 */ unsigned char FileName[8]; /* +0x0068 f7 13 00 00 */ }; struct tagEMRSELECTOBJECT { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned long ihObject; /* +0x0008 */ }; struct _userHGLOBAL { long fContext; /* +0x0000 */ }; struct _userHGLOBAL::__MIDL_IWinTypes_0003 { long hInproc; /* +0x0000 */ /* unsigned char hRemote[0]; +0x0000 f4 2b 00 00 */ long long hInproc64; /* +0x0000 */ }; struct _FILE_LINKS_INFORMATION { unsigned long BytesNeeded; /* +0x0000 */ unsigned long EntriesReturned; /* +0x0004 */ unsigned char Entry[24]; /* +0x0008 4a 32 00 00 */ }; struct _SYSTEM_POWER_INFORMATION { unsigned long MaxIdlenessAllowed; /* +0x0000 */ unsigned long Idleness; /* +0x0004 */ unsigned long TimeRemaining; /* +0x0008 */ unsigned char CoolingMode; /* +0x000c */ }; struct _RTL_HEAP_PARAMETERS { unsigned long Length; /* +0x0000 */ unsigned long SegmentReserve; /* +0x0004 */ unsigned long SegmentCommit; /* +0x0008 */ unsigned long DeCommitFreeBlockThreshold; /* +0x000c */ unsigned long DeCommitTotalFreeThreshold; /* +0x0010 */ unsigned long MaximumAllocationSize; /* +0x0014 */ unsigned long VirtualMemoryThreshold; /* +0x0018 */ unsigned long InitialCommit; /* +0x001c */ unsigned long InitialReserve; /* +0x0020 */ unsigned char CommitRoutine[4]; /* +0x0024 4f 32 00 00 */ unsigned char Reserved[8]; /* +0x0028 69 15 00 00 */ }; struct _ACTIVATION_CONTEXT_DETAILED_INFORMATION { unsigned long dwFlags; /* +0x0000 */ unsigned long ulFormatVersion; /* +0x0004 */ unsigned long ulAssemblyCount; /* +0x0008 */ unsigned long ulRootManifestPathType; /* +0x000c */ unsigned long ulRootManifestPathChars; /* +0x0010 */ unsigned long ulRootConfigurationPathType; /* +0x0014 */ unsigned long ulRootConfigurationPathChars; /* +0x0018 */ unsigned long ulAppDirPathType; /* +0x001c */ unsigned long ulAppDirPathChars; /* +0x0020 */ unsigned char lpRootManifestPath[4]; /* +0x0024 c0 13 00 00 */ unsigned char lpRootConfigurationPath[4]; /* +0x0028 c0 13 00 00 */ unsigned char lpAppDirPath[4]; /* +0x002c c0 13 00 00 */ }; struct tagLASTINPUTINFO { unsigned char cbSize[4]; /* +0x0000 75 00 00 00 */ unsigned long dwTime; /* +0x0004 */ }; struct tagHELPINFO { unsigned char cbSize[4]; /* +0x0000 75 00 00 00 */ unsigned char iContextType[4]; /* +0x0004 74 00 00 00 */ unsigned char iCtrlId[4]; /* +0x0008 74 00 00 00 */ void *hItemHandle; /* +0x000c */ unsigned long dwContextId; /* +0x0010 */ unsigned char MousePos[8]; /* +0x0014 8a 14 00 00 */ }; struct tagACTCTX_SECTION_KEYED_DATA_2600 { unsigned long cbSize; /* +0x0000 */ unsigned long ulDataFormatVersion; /* +0x0004 */ void *lpData; /* +0x0008 */ unsigned long ulLength; /* +0x000c */ void *lpSectionGlobalData; /* +0x0010 */ unsigned long ulSectionGlobalDataLength; /* +0x0014 */ void *lpSectionBase; /* +0x0018 */ unsigned long ulSectionTotalLength; /* +0x001c */ void *hActCtx; /* +0x0020 */ unsigned long ulAssemblyRosterIndex; /* +0x0024 */ }; struct _FILE_MODE_INFORMATION { unsigned long Mode; /* +0x0000 */ }; struct _LAST_EXCEPTION_LOG { unsigned char ExceptionRecord[80]; /* +0x0000 4b 20 00 00 */ unsigned char ContextRecord[716]; /* +0x0050 57 13 00 00 */ unsigned long ControlPc; /* +0x031c */ unsigned char Disposition[4]; /* +0x0320 76 32 00 00 */ unsigned char HandlerData[20]; /* +0x0324 3b 17 00 00 */ }; struct _RTL_RXACT_CONTEXT { void *RootRegistryKey; /* +0x0000 */ void *RXactKey; /* +0x0004 */ unsigned char HandlesValid; /* +0x0008 */ unsigned char RXactLog[4]; /* +0x000c 7a 32 00 00 */ }; struct tagUPDATELAYEREDWINDOWINFO { unsigned long cbSize; /* +0x0000 */ unsigned char hdcDst[4]; /* +0x0004 f1 1e 00 00 */ unsigned char pptDst[4]; /* +0x0008 82 32 00 00 */ unsigned char psize[4]; /* +0x000c 84 32 00 00 */ unsigned char hdcSrc[4]; /* +0x0010 f1 1e 00 00 */ unsigned char pptSrc[4]; /* +0x0014 82 32 00 00 */ unsigned long crKey; /* +0x0018 */ unsigned char pblend[4]; /* +0x001c 87 32 00 00 */ unsigned long dwFlags; /* +0x0020 */ unsigned char prcDirty[4]; /* +0x0024 a6 1e 00 00 */ }; struct _CERT_ALT_NAME_ENTRY { unsigned long dwAltNameChoice; /* +0x0000 */ /* unsigned char pOtherName[0]; +0x0004 8b 32 00 00 */ /* unsigned char pwszRfc822Name[0]; +0x0004 71 04 00 00 */ /* unsigned char pwszDNSName[0]; +0x0004 71 04 00 00 */ /* unsigned char DirectoryName[0]; +0x0004 02 13 00 00 */ /* unsigned char pwszURL[0]; +0x0004 71 04 00 00 */ /* unsigned char IPAddress[0]; +0x0004 02 13 00 00 */ char *pszRegisteredID; /* +0x0004 */ }; struct _IMAGE_DEBUG_MISC { unsigned long DataType; /* +0x0000 */ unsigned long Length; /* +0x0004 */ unsigned char Unicode; /* +0x0008 */ unsigned char Reserved[3]; /* +0x0009 8d 13 00 00 */ unsigned char Data[4]; /* +0x000c f9 12 00 00 */ }; struct tagEMRSETCOLORADJUSTMENT { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned char ColorAdjustment[24]; /* +0x0008 be 32 00 00 */ }; struct _CERT_NAME_INFO { unsigned long cRDN; /* +0x0000 */ unsigned char rgRDN[4]; /* +0x0004 a7 1a 00 00 */ }; struct _FPO_DATA { unsigned long ulOffStart; /* +0x0000 */ unsigned long cbProcSize; /* +0x0004 */ unsigned long cdwLocals; /* +0x0008 */ unsigned short cdwParams; /* +0x000c */ /* unsigned char cbProlog[0]; +0x000e c3 32 00 00 */ /* unsigned char cbRegs[0]; +0x000e c4 32 00 00 */ /* unsigned char fHasSEH[0]; +0x000e 75 2e 00 00 */ /* unsigned char fUseBP[0]; +0x000e 76 2e 00 00 */ /* unsigned char reserved[0]; +0x000e c5 32 00 00 */ unsigned char cbFrame[2]; /* +0x000e c6 32 00 00 */ }; struct _SYSTEM_BIGPOOL_INFORMATION { unsigned long Count; /* +0x0000 */ unsigned char AllocatedInfo[12]; /* +0x0004 5e 13 00 00 */ }; struct tagNONCLIENTMETRICSW { unsigned char cbSize[4]; /* +0x0000 75 00 00 00 */ unsigned char iBorderWidth[4]; /* +0x0004 74 00 00 00 */ unsigned char iScrollWidth[4]; /* +0x0008 74 00 00 00 */ unsigned char iScrollHeight[4]; /* +0x000c 74 00 00 00 */ unsigned char iCaptionWidth[4]; /* +0x0010 74 00 00 00 */ unsigned char iCaptionHeight[4]; /* +0x0014 74 00 00 00 */ unsigned char lfCaptionFont[92]; /* +0x0018 a3 16 00 00 */ unsigned char iSmCaptionWidth[4]; /* +0x0074 74 00 00 00 */ unsigned char iSmCaptionHeight[4]; /* +0x0078 74 00 00 00 */ unsigned char lfSmCaptionFont[92]; /* +0x007c a3 16 00 00 */ unsigned char iMenuWidth[4]; /* +0x00d8 74 00 00 00 */ unsigned char iMenuHeight[4]; /* +0x00dc 74 00 00 00 */ unsigned char lfMenuFont[92]; /* +0x00e0 a3 16 00 00 */ unsigned char lfStatusFont[92]; /* +0x013c a3 16 00 00 */ unsigned char lfMessageFont[92]; /* +0x0198 a3 16 00 00 */ unsigned char iPaddedBorderWidth[4]; /* +0x01f4 74 00 00 00 */ }; struct _CONSOLE_SCREEN_BUFFER_INFO { unsigned char dwSize[4]; /* +0x0000 09 18 00 00 */ unsigned char dwCursorPosition[4]; /* +0x0004 09 18 00 00 */ unsigned short wAttributes; /* +0x0008 */ unsigned char srWindow[8]; /* +0x000a 42 27 00 00 */ unsigned char dwMaximumWindowSize[4]; /* +0x0012 09 18 00 00 */ }; struct tagCSPLATFORM { unsigned long dwPlatformId; /* +0x0000 */ unsigned long dwVersionHi; /* +0x0004 */ unsigned long dwVersionLo; /* +0x0008 */ unsigned long dwProcessorArch; /* +0x000c */ }; struct _PROCESS_EXTENDED_BASIC_INFORMATION { unsigned long Size; /* +0x0000 */ unsigned char BasicInfo[24]; /* +0x0004 ec 32 00 00 */ unsigned long Flags; /* +0x001c */ /* unsigned char IsProtectedProcess[0]; +0x001c 17 13 00 00 */ /* unsigned char IsWow64Process[0]; +0x001c 7e 18 00 00 */ /* unsigned char IsProcessDeleting[0]; +0x001c 7f 18 00 00 */ /* unsigned char IsCrossSessionCreate[0]; +0x001c 27 1e 00 00 */ /* unsigned char IsFrozen[0]; +0x001c 42 1e 00 00 */ /* unsigned char IsIdleAware[0]; +0x001c ce 23 00 00 */ unsigned char SpareBits[4]; /* +0x001c ed 32 00 00 */ }; struct _SERVICE_DESCRIPTIONA { char *lpDescription; /* +0x0000 */ }; struct _BCRYPT_DSA_KEY_BLOB { unsigned long dwMagic; /* +0x0000 */ unsigned long cbKey; /* +0x0004 */ unsigned char Count[4]; /* +0x0008 b7 17 00 00 */ unsigned char Seed[20]; /* +0x000c 7b 16 00 00 */ unsigned char q[20]; /* +0x0020 7b 16 00 00 */ }; struct _SYSTEM_SYSTEM_DISK_INFORMATION { unsigned char SystemDisk[8]; /* +0x0000 dd 12 00 00 */ }; struct tagEMRPOLYDRAW16 { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned char rclBounds[16]; /* +0x0008 d5 12 00 00 */ unsigned long cpts; /* +0x0018 */ unsigned char apts[4]; /* +0x001c 05 23 00 00 */ unsigned char abTypes[4]; /* +0x0020 f9 12 00 00 */ }; struct _LONG_SIZEDARR { unsigned long clSize; /* +0x0000 */ unsigned long *pData; /* +0x0004 */ }; struct _JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION { unsigned long long IoReadBytesLimit; /* +0x0000 */ unsigned long long IoWriteBytesLimit; /* +0x0008 */ unsigned char PerJobUserTimeLimit[8]; /* +0x0010 3d 13 00 00 */ unsigned long long JobMemoryLimit; /* +0x0018 */ unsigned char RateControlTolerance[4]; /* +0x0020 79 19 00 00 */ unsigned char RateControlToleranceInterval[4]; /* +0x0024 7a 19 00 00 */ unsigned long LimitFlags; /* +0x0028 */ }; struct _SEC_WINNT_AUTH_IDENTITY_W { unsigned short *User; /* +0x0000 */ unsigned long UserLength; /* +0x0004 */ unsigned short *Domain; /* +0x0008 */ unsigned long DomainLength; /* +0x000c */ unsigned short *Password; /* +0x0010 */ unsigned long PasswordLength; /* +0x0014 */ unsigned long Flags; /* +0x0018 */ }; struct _NDR_USER_MARSHAL_INFO { unsigned long InformationLevel; /* +0x0000 */ unsigned char Level1[40]; /* +0x0004 18 33 00 00 */ }; struct tagEMRSETVIEWPORTORGEX { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned char ptlOrigin[8]; /* +0x0008 9f 13 00 00 */ }; struct _WOW64_DESCRIPTOR_TABLE_ENTRY { unsigned long Selector; /* +0x0000 */ unsigned char Descriptor[8]; /* +0x0004 2f 33 00 00 */ }; struct _SERVICE_TABLE_ENTRYA { char *lpServiceName; /* +0x0000 */ unsigned char lpServiceProc[4]; /* +0x0004 3b 2d 00 00 */ }; struct _OPEN_PRINTER_PROPS_INFOW { unsigned long dwSize; /* +0x0000 */ unsigned char pszSheetName[4]; /* +0x0004 71 04 00 00 */ unsigned char uSheetIndex[4]; /* +0x0008 75 00 00 00 */ unsigned long dwFlags; /* +0x000c */ unsigned char bModal[4]; /* +0x0010 74 00 00 00 */ }; struct tagENUMLOGFONTEXA { unsigned char elfLogFont[60]; /* +0x0000 c2 16 00 00 */ unsigned char elfFullName[64]; /* +0x003c 13 13 00 00 */ unsigned char elfStyle[32]; /* +0x007c e5 17 00 00 */ unsigned char elfScript[32]; /* +0x009c e5 17 00 00 */ }; struct _RPC_PROTSEQ_VECTORA { unsigned char Count[4]; /* +0x0000 75 00 00 00 */ unsigned char Protseq[4]; /* +0x0004 3c 33 00 00 */ }; struct _PLEX_READ_DATA_REQUEST { unsigned char ByteOffset[8]; /* +0x0000 3d 13 00 00 */ unsigned long ByteLength; /* +0x0008 */ unsigned long PlexNumber; /* +0x000c */ }; struct _SYSTEM_CALL_COUNT_INFORMATION { unsigned long Length; /* +0x0000 */ unsigned long NumberOfTables; /* +0x0004 */ }; struct _MEMORY_WORKING_SET_EX_BLOCK::<unnamed-tag>::<unnamed-type-Invalid> { /* unsigned char Valid[0]; +0x0000 17 13 00 00 */ /* unsigned char Reserved0[0]; +0x0000 4a 33 00 00 */ /* unsigned char Shared[0]; +0x0000 92 20 00 00 */ /* unsigned char Reserved1[0]; +0x0000 4b 33 00 00 */ /* unsigned char PageTable[0]; +0x0000 89 13 00 00 */ /* unsigned char Location[0]; +0x0000 4c 33 00 00 */ /* unsigned char Reserved2[0]; +0x0000 4d 33 00 00 */ unsigned char Bad[4]; /* +0x0000 95 18 00 00 */ }; struct _TRANSACTIONMANAGER_OLDEST_INFORMATION { unsigned char OldestTransactionGuid[16]; /* +0x0000 dc 14 00 00 */ }; struct _API_SET_NAMESPACE_ARRAY { unsigned long Version; /* +0x0000 */ unsigned long Count; /* +0x0004 */ unsigned char Array[12]; /* +0x0008 58 33 00 00 */ }; struct _SYSTEM_QUERY_TIME_ADJUST_INFORMATION { unsigned long TimeAdjustment; /* +0x0000 */ unsigned long TimeIncrement; /* +0x0004 */ unsigned char Enable; /* +0x0008 */ }; struct tagMETAHEADER { unsigned short mtType; /* +0x0000 */ unsigned short mtHeaderSize; /* +0x0002 */ unsigned short mtVersion; /* +0x0004 */ unsigned long mtSize; /* +0x0006 */ unsigned short mtNoObjects; /* +0x000a */ unsigned long mtMaxRecord; /* +0x000c */ unsigned short mtNoParameters; /* +0x0010 */ }; struct _REMOTE_NAME_INFOW { unsigned char lpUniversalName[4]; /* +0x0000 71 04 00 00 */ unsigned char lpConnectionName[4]; /* +0x0004 71 04 00 00 */ unsigned char lpRemainingPath[4]; /* +0x0008 71 04 00 00 */ }; struct _CMSG_STREAM_INFO { unsigned long cbContent; /* +0x0000 */ unsigned char pfnStreamOutput[4]; /* +0x0004 6c 33 00 00 */ void *pvArg; /* +0x0008 */ }; struct _FILE_TRACKING_INFORMATION { void *DestinationFile; /* +0x0000 */ unsigned long ObjectInformationLength; /* +0x0004 */ unsigned char ObjectInformation[4]; /* +0x0008 df 23 00 00 */ }; struct tagFILTERKEYS { unsigned char cbSize[4]; /* +0x0000 75 00 00 00 */ unsigned long dwFlags; /* +0x0004 */ unsigned long iWaitMSec; /* +0x0008 */ unsigned long iDelayMSec; /* +0x000c */ unsigned long iRepeatMSec; /* +0x0010 */ unsigned long iBounceMSec; /* +0x0014 */ }; struct _SE_LEARNING_MODE_USER_OBJECT_DATA { unsigned long Cookie; /* +0x0000 */ unsigned char ObjectType[4]; /* +0x0004 a2 17 00 00 */ unsigned char ObjectName[4]; /* +0x0008 a2 17 00 00 */ }; struct tagEMRSETTEXTCOLOR { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned long crColor; /* +0x0008 */ }; struct tagSTATPROPSTG { unsigned char lpwstrName[4]; /* +0x0000 71 04 00 00 */ unsigned long propid; /* +0x0004 */ unsigned short vt; /* +0x0008 */ }; struct _CERT_KEY_ATTRIBUTES_INFO { unsigned char KeyId[8]; /* +0x0000 02 13 00 00 */ unsigned char IntendedKeyUsage[12]; /* +0x0008 03 13 00 00 */ unsigned char pPrivateKeyUsagePeriod[4]; /* +0x0014 b4 33 00 00 */ }; struct _REPARSE_DATA_BUFFER { unsigned long ReparseTag; /* +0x0000 */ unsigned short ReparseDataLength; /* +0x0004 */ unsigned short Reserved; /* +0x0006 */ /* unsigned char SymbolicLinkReparseBuffer[0]; +0x0008 b7 33 00 00 */ /* unsigned char MountPointReparseBuffer[0]; +0x0008 b8 33 00 00 */ unsigned char GenericReparseBuffer[16]; /* +0x0008 b9 33 00 00 */ }; struct _REPARSE_DATA_BUFFER::<unnamed-tag>::<unnamed-type-GenericReparseBuffer> { unsigned char DataBuffer[1]; /* +0x0000 f9 12 00 00 */ }; struct _REPARSE_DATA_BUFFER::<unnamed-tag>::<unnamed-type-MountPointReparseBuffer> { unsigned short SubstituteNameOffset; /* +0x0000 */ unsigned short SubstituteNameLength; /* +0x0002 */ unsigned short PrintNameOffset; /* +0x0004 */ unsigned short PrintNameLength; /* +0x0006 */ unsigned char PathBuffer[2]; /* +0x0008 f7 13 00 00 */ }; struct _REPARSE_DATA_BUFFER::<unnamed-tag>::<unnamed-type-SymbolicLinkReparseBuffer> { unsigned short SubstituteNameOffset; /* +0x0000 */ unsigned short SubstituteNameLength; /* +0x0002 */ unsigned short PrintNameOffset; /* +0x0004 */ unsigned short PrintNameLength; /* +0x0006 */ unsigned long Flags; /* +0x0008 */ unsigned char PathBuffer[4]; /* +0x000c f7 13 00 00 */ }; struct _HOTPATCH_HOOK_DESCRIPTOR { unsigned long long TargetAddress; /* +0x0000 */ unsigned long long MappedAddress; /* +0x0008 */ unsigned long CodeOffset; /* +0x0010 */ unsigned long CodeSize; /* +0x0014 */ unsigned long OrigCodeOffset; /* +0x0018 */ unsigned long ValidationOffset; /* +0x001c */ unsigned long ValidationSize; /* +0x0020 */ }; struct _RTL_HEAP_INFORMATION { void *BaseAddress; /* +0x0000 */ unsigned long Flags; /* +0x0004 */ unsigned short EntryOverhead; /* +0x0008 */ unsigned short CreatorBackTraceIndex; /* +0x000a */ unsigned long BytesAllocated; /* +0x000c */ unsigned long BytesCommitted; /* +0x0010 */ unsigned long NumberOfTags; /* +0x0014 */ unsigned long NumberOfEntries; /* +0x0018 */ unsigned long NumberOfPseudoTags; /* +0x001c */ unsigned long PseudoTagGranularity; /* +0x0020 */ unsigned char Reserved[20]; /* +0x0024 3b 17 00 00 */ unsigned char Tags[4]; /* +0x0038 ad 23 00 00 */ unsigned char Entries[4]; /* +0x003c c5 33 00 00 */ }; struct _CERT_STORE_PROV_FIND_INFO { unsigned long cbSize; /* +0x0000 */ unsigned long dwMsgAndCertEncodingType; /* +0x0004 */ unsigned long dwFindFlags; /* +0x0008 */ unsigned long dwFindType; /* +0x000c */ unsigned char pvFindPara[4]; /* +0x0010 3d 19 00 00 */ }; struct _RTL_HEAP_WALK_ENTRY { void *DataAddress; /* +0x0000 */ unsigned long DataSize; /* +0x0004 */ unsigned char OverheadBytes; /* +0x0008 */ unsigned char SegmentIndex; /* +0x0009 */ unsigned short Flags; /* +0x000a */ /* unsigned char Block[0]; +0x000c d0 33 00 00 */ unsigned char Segment[16]; /* +0x000c d1 33 00 00 */ }; struct _RTL_HEAP_WALK_ENTRY::<unnamed-tag>::<unnamed-type-Segment> { unsigned long CommittedSize; /* +0x0000 */ unsigned long UnCommittedSize; /* +0x0004 */ void *FirstEntry; /* +0x0008 */ void *LastEntry; /* +0x000c */ }; struct _RTL_HEAP_WALK_ENTRY::<unnamed-tag>::<unnamed-type-Block> { unsigned long Settable; /* +0x0000 */ unsigned short TagIndex; /* +0x0004 */ unsigned short AllocatorBackTraceIndex; /* +0x0006 */ unsigned char Reserved[8]; /* +0x0008 69 15 00 00 */ }; struct tagWNDCLASSA { unsigned char style[4]; /* +0x0000 75 00 00 00 */ unsigned char lpfnWndProc[4]; /* +0x0004 b0 27 00 00 */ unsigned char cbClsExtra[4]; /* +0x0008 74 00 00 00 */ unsigned char cbWndExtra[4]; /* +0x000c 74 00 00 00 */ unsigned char hInstance[4]; /* +0x0010 ba 14 00 00 */ unsigned char hIcon[4]; /* +0x0014 07 21 00 00 */ unsigned char hCursor[4]; /* +0x0018 07 21 00 00 */ unsigned char hbrBackground[4]; /* +0x001c 4f 23 00 00 */ unsigned char lpszMenuName[4]; /* +0x0020 62 14 00 00 */ unsigned char lpszClassName[4]; /* +0x0024 62 14 00 00 */ }; struct _VM_COUNTERS_EX { unsigned long PeakVirtualSize; /* +0x0000 */ unsigned long VirtualSize; /* +0x0004 */ unsigned long PageFaultCount; /* +0x0008 */ unsigned long PeakWorkingSetSize; /* +0x000c */ unsigned long WorkingSetSize; /* +0x0010 */ unsigned long QuotaPeakPagedPoolUsage; /* +0x0014 */ unsigned long QuotaPagedPoolUsage; /* +0x0018 */ unsigned long QuotaPeakNonPagedPoolUsage; /* +0x001c */ unsigned long QuotaNonPagedPoolUsage; /* +0x0020 */ unsigned long PagefileUsage; /* +0x0024 */ unsigned long PeakPagefileUsage; /* +0x0028 */ unsigned long PrivateUsage; /* +0x002c */ }; struct _QUAD { long long UseThisFieldToCopy; /* +0x0000 */ unsigned char DoNotUseThisField[8]; /* +0x0000 41 00 00 00 */ }; struct _XSTATE_CONTEXT { unsigned long long Mask; /* +0x0000 */ unsigned long Length; /* +0x0008 */ unsigned long Reserved1; /* +0x000c */ unsigned char Area[4]; /* +0x0010 fa 33 00 00 */ unsigned long Reserved2; /* +0x0014 */ void *Buffer; /* +0x0018 */ unsigned long Reserved3; /* +0x001c */ }; struct _VARIABLE_NAME_AND_VALUE { unsigned long NextEntryOffset; /* +0x0000 */ unsigned long ValueOffset; /* +0x0004 */ unsigned long ValueLength; /* +0x0008 */ unsigned long Attributes; /* +0x000c */ unsigned char VendorGuid[16]; /* +0x0010 dc 14 00 00 */ unsigned char Name[4]; /* +0x0020 f7 13 00 00 */ }; struct _SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS { void *KeyHandle; /* +0x0000 */ unsigned char ValueNamePointer[4]; /* +0x0004 a2 17 00 00 */ unsigned long *RequiredLengthPointer; /* +0x0008 */ unsigned char *Buffer; /* +0x000c */ unsigned long BufferLength; /* +0x0010 */ unsigned long Type; /* +0x0014 */ unsigned char *AppendBuffer; /* +0x0018 */ unsigned long AppendBufferLength; /* +0x001c */ unsigned char CreateIfDoesntExist; /* +0x0020 */ unsigned char TruncateExistingValue; /* +0x0021 */ }; struct tagDELETEITEMSTRUCT { unsigned char CtlType[4]; /* +0x0000 75 00 00 00 */ unsigned char CtlID[4]; /* +0x0004 75 00 00 00 */ unsigned char itemID[4]; /* +0x0008 75 00 00 00 */ unsigned char hwndItem[4]; /* +0x000c f1 12 00 00 */ unsigned long itemData; /* +0x0010 */ }; struct _RPC_C_OPT_COOKIE_AUTH_DESCRIPTOR { unsigned long BufferSize; /* +0x0000 */ char *Buffer; /* +0x0004 */ }; struct _PROCESS_STACK_ALLOCATION_INFORMATION_EX { unsigned long PreferredNode; /* +0x0000 */ unsigned long Reserved0; /* +0x0004 */ unsigned long Reserved1; /* +0x0008 */ unsigned long Reserved2; /* +0x000c */ unsigned char AllocInfo[12]; /* +0x0010 0b 34 00 00 */ }; struct _STREAM_EXTENT_ENTRY { unsigned long Flags; /* +0x0000 */ }; struct _CMSG_KEY_AGREE_KEY_ENCRYPT_INFO { unsigned long cbSize; /* +0x0000 */ unsigned char EncryptedKey[8]; /* +0x0004 02 13 00 00 */ }; struct tagIMECHARPOSITION { unsigned long dwSize; /* +0x0000 */ unsigned long dwCharPos; /* +0x0004 */ unsigned char pt[8]; /* +0x0008 8a 14 00 00 */ unsigned char cLineHeight[4]; /* +0x0010 75 00 00 00 */ unsigned char rcDocument[16]; /* +0x0014 63 14 00 00 */ }; struct _CRL_REVOCATION_INFO { unsigned char pCrlEntry[4]; /* +0x0000 20 16 00 00 */ unsigned char pCrlContext[4]; /* +0x0004 d8 1f 00 00 */ unsigned char pCrlIssuerChain[4]; /* +0x0008 90 15 00 00 */ }; struct _s__ThrowInfo { unsigned char attributes[4]; /* +0x0000 75 00 00 00 */ unsigned char pmfnUnwind[4]; /* +0x0004 c7 13 00 00 */ unsigned char pForwardCompat[4]; /* +0x0008 da 17 00 00 */ unsigned char pCatchableTypeArray[4]; /* +0x000c 29 34 00 00 */ }; struct _TRANSACTIONMANAGER_LOGPATH_INFORMATION { unsigned long LogPathLength; /* +0x0000 */ unsigned char LogPath[4]; /* +0x0004 f7 13 00 00 */ }; struct _OCSP_SIGNATURE_INFO { unsigned char SignatureAlgorithm[12]; /* +0x0000 55 14 00 00 */ unsigned char Signature[12]; /* +0x000c 03 13 00 00 */ unsigned long cCertEncoded; /* +0x0018 */ unsigned char rgCertEncoded[4]; /* +0x001c 47 13 00 00 */ }; struct _THREAD_TEB_INFORMATION { void *TebInformation; /* +0x0000 */ unsigned long TebOffset; /* +0x0004 */ unsigned long BytesToRead; /* +0x0008 */ }; struct _JOBOBJECT_WAKE_FILTER { unsigned long HighEdgeFilter; /* +0x0000 */ unsigned long LowEdgeFilter; /* +0x0004 */ }; struct _TRANSACTION_BASIC_INFORMATION { unsigned char TransactionId[16]; /* +0x0000 dc 14 00 00 */ unsigned long State; /* +0x0010 */ unsigned long Outcome; /* +0x0014 */ }; struct tagMENUGETOBJECTINFO { unsigned long dwFlags; /* +0x0000 */ unsigned char uPos[4]; /* +0x0004 75 00 00 00 */ unsigned char hmenu[4]; /* +0x0008 4c 15 00 00 */ void *riid; /* +0x000c */ void *pvObj; /* +0x0010 */ }; struct _CERT_RDN { unsigned long cRDNAttr; /* +0x0000 */ unsigned char rgRDNAttr[4]; /* +0x0004 9a 1f 00 00 */ }; struct tagWNDCLASSW { unsigned char style[4]; /* +0x0000 75 00 00 00 */ unsigned char lpfnWndProc[4]; /* +0x0004 b0 27 00 00 */ unsigned char cbClsExtra[4]; /* +0x0008 74 00 00 00 */ unsigned char cbWndExtra[4]; /* +0x000c 74 00 00 00 */ unsigned char hInstance[4]; /* +0x0010 ba 14 00 00 */ unsigned char hIcon[4]; /* +0x0014 07 21 00 00 */ unsigned char hCursor[4]; /* +0x0018 07 21 00 00 */ unsigned char hbrBackground[4]; /* +0x001c 4f 23 00 00 */ unsigned char lpszMenuName[4]; /* +0x0020 c0 13 00 00 */ unsigned char lpszClassName[4]; /* +0x0024 c0 13 00 00 */ }; struct tagRPC_EXTENDED_ERROR_INFO { unsigned long Version; /* +0x0000 */ unsigned char ComputerName[4]; /* +0x0004 71 04 00 00 */ unsigned long ProcessID; /* +0x0008 */ }; struct _FILE_LAYOUT_NAME_ENTRY { unsigned long NextNameOffset; /* +0x0000 */ unsigned long Flags; /* +0x0004 */ unsigned long long ParentFileReferenceNumber; /* +0x0008 */ unsigned long FileNameLength; /* +0x0010 */ unsigned long Reserved; /* +0x0014 */ unsigned char FileName[8]; /* +0x0018 f7 13 00 00 */ }; struct _MCA_EXCEPTION::<unnamed-type-u>::<unnamed-type-Mce> { unsigned long long Address; /* +0x0000 */ unsigned long long Type; /* +0x0008 */ }; struct _MCA_EXCEPTION::<unnamed-type-u>::<unnamed-type-Mca> { unsigned char BankNumber; /* +0x0000 */ unsigned char Reserved2[7]; /* +0x0001 91 25 00 00 */ unsigned char Status[8]; /* +0x0008 95 2f 00 00 */ unsigned char Address[8]; /* +0x0010 81 34 00 00 */ unsigned long long Misc; /* +0x0018 */ }; struct tagNEWTEXTMETRICW { long tmHeight; /* +0x0000 */ long tmAscent; /* +0x0004 */ long tmDescent; /* +0x0008 */ long tmInternalLeading; /* +0x000c */ long tmExternalLeading; /* +0x0010 */ long tmAveCharWidth; /* +0x0014 */ long tmMaxCharWidth; /* +0x0018 */ long tmWeight; /* +0x001c */ long tmOverhang; /* +0x0020 */ long tmDigitizedAspectX; /* +0x0024 */ long tmDigitizedAspectY; /* +0x0028 */ unsigned char tmFirstChar[2]; /* +0x002c 71 00 00 00 */ unsigned char tmLastChar[2]; /* +0x002e 71 00 00 00 */ unsigned char tmDefaultChar[2]; /* +0x0030 71 00 00 00 */ unsigned char tmBreakChar[2]; /* +0x0032 71 00 00 00 */ unsigned char tmItalic; /* +0x0034 */ unsigned char tmUnderlined; /* +0x0035 */ unsigned char tmStruckOut; /* +0x0036 */ unsigned char tmPitchAndFamily; /* +0x0037 */ unsigned char tmCharSet; /* +0x0038 */ unsigned long ntmFlags; /* +0x003c */ unsigned char ntmSizeEM[4]; /* +0x0040 75 00 00 00 */ unsigned char ntmCellHeight[4]; /* +0x0044 75 00 00 00 */ unsigned char ntmAvgWidth[4]; /* +0x0048 75 00 00 00 */ }; struct DISPLAYCONFIG_2DREGION { unsigned char cx[4]; /* +0x0000 75 00 00 00 */ unsigned char cy[4]; /* +0x0004 75 00 00 00 */ }; struct _CMC_TAGGED_CERT_REQUEST { unsigned long dwBodyPartID; /* +0x0000 */ unsigned char SignedCertRequest[8]; /* +0x0004 02 13 00 00 */ }; struct tagEMRMASKBLT { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned char rclBounds[16]; /* +0x0008 d5 12 00 00 */ long xDest; /* +0x0018 */ long yDest; /* +0x001c */ long cxDest; /* +0x0020 */ long cyDest; /* +0x0024 */ unsigned long dwRop; /* +0x0028 */ long xSrc; /* +0x002c */ long ySrc; /* +0x0030 */ unsigned char xformSrc[24]; /* +0x0034 d6 12 00 00 */ unsigned long crBkColorSrc; /* +0x004c */ unsigned long iUsageSrc; /* +0x0050 */ unsigned long offBmiSrc; /* +0x0054 */ unsigned long cbBmiSrc; /* +0x0058 */ unsigned long offBitsSrc; /* +0x005c */ unsigned long cbBitsSrc; /* +0x0060 */ long xMask; /* +0x0064 */ long yMask; /* +0x0068 */ unsigned long iUsageMask; /* +0x006c */ unsigned long offBmiMask; /* +0x0070 */ unsigned long cbBmiMask; /* +0x0074 */ unsigned long offBitsMask; /* +0x0078 */ unsigned long cbBitsMask; /* +0x007c */ }; struct _CRYPT_RC4_KEY_STATE { unsigned char Key[16]; /* +0x0000 09 1c 00 00 */ unsigned char SBox[256]; /* +0x0010 74 16 00 00 */ unsigned char i; /* +0x0110 */ unsigned char j; /* +0x0111 */ }; struct _PLUGPLAY_EVENT_BLOCK { unsigned char EventGuid[16]; /* +0x0000 dc 14 00 00 */ unsigned char EventCategory[4]; /* +0x0010 99 34 00 00 */ unsigned long *Result; /* +0x0014 */ unsigned long Flags; /* +0x0018 */ unsigned long TotalSize; /* +0x001c */ void *DeviceObject; /* +0x0020 */ }; struct _PLUGPLAY_EVENT_BLOCK::<unnamed-type-u>::<unnamed-type-DeviceInstanceNotification> { unsigned char DeviceId[2]; /* +0x0000 f7 13 00 00 */ }; struct _PLUGPLAY_EVENT_BLOCK::<unnamed-type-u>::<unnamed-type-PowerSettingNotification> { unsigned char PowerSettingGuid[16]; /* +0x0000 dc 14 00 00 */ unsigned long Flags; /* +0x0010 */ unsigned long SessionId; /* +0x0014 */ unsigned long DataLength; /* +0x0018 */ unsigned char Data[4]; /* +0x001c f9 12 00 00 */ }; struct _PLUGPLAY_EVENT_BLOCK::<unnamed-type-u>::<unnamed-type-InvalidIDNotification> { unsigned char ParentId[2]; /* +0x0000 f7 13 00 00 */ }; struct _PLUGPLAY_EVENT_BLOCK::<unnamed-type-u>::<unnamed-type-BlockedDriverNotification> { unsigned char BlockedDriverGuid[16]; /* +0x0000 dc 14 00 00 */ }; struct _PLUGPLAY_EVENT_BLOCK::<unnamed-type-u>::<unnamed-type-VetoNotification> { unsigned char VetoType[4]; /* +0x0000 31 19 00 00 */ unsigned char DeviceIdVetoNameBuffer[4]; /* +0x0004 f7 13 00 00 */ }; struct _PLUGPLAY_EVENT_BLOCK::<unnamed-type-u>::<unnamed-type-PowerNotification> { unsigned long NotificationCode; /* +0x0000 */ unsigned long NotificationData; /* +0x0004 */ }; struct _PLUGPLAY_EVENT_BLOCK::<unnamed-type-u>::<unnamed-type-ProfileNotification> { void *Notification; /* +0x0000 */ }; struct _PLUGPLAY_EVENT_BLOCK::<unnamed-type-u>::<unnamed-type-CustomNotification> { void *NotificationStructure; /* +0x0000 */ unsigned char DeviceId[4]; /* +0x0004 f7 13 00 00 */ }; struct _PLUGPLAY_EVENT_BLOCK::<unnamed-type-u>::<unnamed-type-DeviceClass> { unsigned char ClassGuid[16]; /* +0x0000 dc 14 00 00 */ unsigned char SymbolicLinkName[4]; /* +0x0010 f7 13 00 00 */ }; struct _RTL_AVL_TREE { unsigned char Root[4]; /* +0x0000 0b 20 00 00 */ }; struct _IMAGE_AUX_SYMBOL_EX::<unnamed-type-CRC> { unsigned long crc; /* +0x0000 */ unsigned char rgbReserved[16]; /* +0x0004 09 1c 00 00 */ }; struct _IMAGE_AUX_SYMBOL_EX::<unnamed-type-Section> { unsigned long Length; /* +0x0000 */ unsigned short NumberOfRelocations; /* +0x0004 */ unsigned short NumberOfLinenumbers; /* +0x0006 */ unsigned long CheckSum; /* +0x0008 */ short Number; /* +0x000c */ unsigned char Selection; /* +0x000e */ unsigned char bReserved; /* +0x000f */ short HighNumber; /* +0x0010 */ unsigned char rgbReserved[2]; /* +0x0012 a7 17 00 00 */ }; struct _IMAGE_AUX_SYMBOL_EX::<unnamed-type-File> { unsigned char Name[20]; /* +0x0000 7b 16 00 00 */ }; struct _IMAGE_AUX_SYMBOL_EX::<unnamed-type-Sym> { unsigned long WeakDefaultSymIndex; /* +0x0000 */ unsigned long WeakSearchType; /* +0x0004 */ unsigned char rgbReserved[12]; /* +0x0008 6e 15 00 00 */ }; struct _FILE_ID_FULL_DIR_INFORMATION { unsigned long NextEntryOffset; /* +0x0000 */ unsigned long FileIndex; /* +0x0004 */ unsigned char CreationTime[8]; /* +0x0008 3d 13 00 00 */ unsigned char LastAccessTime[8]; /* +0x0010 3d 13 00 00 */ unsigned char LastWriteTime[8]; /* +0x0018 3d 13 00 00 */ unsigned char ChangeTime[8]; /* +0x0020 3d 13 00 00 */ unsigned char EndOfFile[8]; /* +0x0028 3d 13 00 00 */ unsigned char AllocationSize[8]; /* +0x0030 3d 13 00 00 */ unsigned long FileAttributes; /* +0x0038 */ unsigned long FileNameLength; /* +0x003c */ unsigned long EaSize; /* +0x0040 */ unsigned char FileId[8]; /* +0x0048 3d 13 00 00 */ unsigned char FileName[8]; /* +0x0050 f7 13 00 00 */ }; struct _CRYPT_SMART_CARD_ROOT_INFO { unsigned char rgbCardID[16]; /* +0x0000 09 1c 00 00 */ unsigned char luid[8]; /* +0x0010 68 29 00 00 */ }; struct _POOLED_USAGE_AND_LIMITS { unsigned long PeakPagedPoolUsage; /* +0x0000 */ unsigned long PagedPoolUsage; /* +0x0004 */ unsigned long PagedPoolLimit; /* +0x0008 */ unsigned long PeakNonPagedPoolUsage; /* +0x000c */ unsigned long NonPagedPoolUsage; /* +0x0010 */ unsigned long NonPagedPoolLimit; /* +0x0014 */ unsigned long PeakPagefileUsage; /* +0x0018 */ unsigned long PagefileUsage; /* +0x001c */ unsigned long PagefileLimit; /* +0x0020 */ }; struct _CLUSTER_RANGE { unsigned char StartingCluster[8]; /* +0x0000 3d 13 00 00 */ unsigned char ClusterCount[8]; /* +0x0008 3d 13 00 00 */ }; struct _CM_SCSI_DEVICE_DATA { unsigned short Version; /* +0x0000 */ unsigned short Revision; /* +0x0002 */ unsigned char HostIdentifier; /* +0x0004 */ }; struct _SERVICE_SID_INFO { unsigned long dwServiceSidType; /* +0x0000 */ }; struct _REPARSE_INDEX_KEY { unsigned long FileReparseTag; /* +0x0000 */ unsigned char FileId[8]; /* +0x0004 3d 13 00 00 */ }; struct _REMOTE_LINK_TRACKING_INFORMATION_ { void *TargetFileObject; /* +0x0000 */ unsigned long TargetLinkTrackingInformationLength; /* +0x0004 */ unsigned char TargetLinkTrackingInformationBuffer[4]; /* +0x0008 f9 12 00 00 */ }; struct _RTL_RUN_ONCE { void *Ptr; /* +0x0000 */ unsigned long Value; /* +0x0000 */ unsigned char State[4]; /* +0x0000 09 35 00 00 */ }; struct tagEMRPIXELFORMAT { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned char pfd[40]; /* +0x0008 e8 23 00 00 */ }; struct _TXFS_LIST_TRANSACTIONS { unsigned long long NumberOfTransactions; /* +0x0000 */ unsigned long long BufferSizeRequired; /* +0x0008 */ }; struct _SYSDBG_BUS_DATA { unsigned long Address; /* +0x0000 */ void *Buffer; /* +0x0004 */ unsigned long Request; /* +0x0008 */ unsigned char BusDataType[4]; /* +0x000c 26 35 00 00 */ unsigned long BusNumber; /* +0x0010 */ unsigned long SlotNumber; /* +0x0014 */ }; struct _REASON_CONTEXT { unsigned long Version; /* +0x0000 */ unsigned long Flags; /* +0x0004 */ }; struct _REASON_CONTEXT::<unnamed-type-Reason>::<unnamed-type-Detailed> { unsigned char LocalizedReasonModule[4]; /* +0x0000 ba 14 00 00 */ unsigned long LocalizedReasonId; /* +0x0004 */ unsigned long ReasonStringCount; /* +0x0008 */ unsigned char ReasonStrings[4]; /* +0x000c d0 13 00 00 */ }; struct tagCREATESTRUCTA { void *lpCreateParams; /* +0x0000 */ unsigned char hInstance[4]; /* +0x0004 ba 14 00 00 */ unsigned char hMenu[4]; /* +0x0008 4c 15 00 00 */ unsigned char hwndParent[4]; /* +0x000c f1 12 00 00 */ unsigned char cy[4]; /* +0x0010 74 00 00 00 */ unsigned char cx[4]; /* +0x0014 74 00 00 00 */ unsigned char y[4]; /* +0x0018 74 00 00 00 */ unsigned char x[4]; /* +0x001c 74 00 00 00 */ long style; /* +0x0020 */ unsigned char lpszName[4]; /* +0x0024 62 14 00 00 */ unsigned char lpszClass[4]; /* +0x0028 62 14 00 00 */ unsigned long dwExStyle; /* +0x002c */ }; struct _OCSP_REQUEST_ENTRY { unsigned char CertId[36]; /* +0x0000 ad 31 00 00 */ unsigned long cExtension; /* +0x0024 */ unsigned char rgExtension[4]; /* +0x0028 22 16 00 00 */ }; struct _DESCRIPTOR_TABLE_ENTRY { unsigned long Selector; /* +0x0000 */ unsigned char Descriptor[8]; /* +0x0004 50 2f 00 00 */ }; struct _RTL_VERIFIER_FAULT_INJECTIONS_INFORMATION { unsigned long Size; /* +0x0000 */ unsigned char Initialized; /* +0x0004 */ unsigned char FaultProbability[64]; /* +0x0008 43 27 00 00 */ unsigned char FaultBreak[64]; /* +0x0048 43 27 00 00 */ unsigned long TargetMaximumIndex; /* +0x0088 */ unsigned char FaultTargetStart[512]; /* +0x008c 84 35 00 00 */ unsigned char FaultTargetEnd[512]; /* +0x028c 84 35 00 00 */ unsigned long ExclusionMaximumIndex; /* +0x048c */ unsigned char FaultExclusionStart[512]; /* +0x0490 84 35 00 00 */ unsigned char FaultExclusionEnd[512]; /* +0x0690 84 35 00 00 */ }; struct tagSOUNDSENTRYA { unsigned char cbSize[4]; /* +0x0000 75 00 00 00 */ unsigned long dwFlags; /* +0x0004 */ unsigned long iFSTextEffect; /* +0x0008 */ unsigned long iFSTextEffectMSec; /* +0x000c */ unsigned long iFSTextEffectColorBits; /* +0x0010 */ unsigned long iFSGrafEffect; /* +0x0014 */ unsigned long iFSGrafEffectMSec; /* +0x0018 */ unsigned long iFSGrafEffectColor; /* +0x001c */ unsigned long iWindowsEffect; /* +0x0020 */ unsigned long iWindowsEffectMSec; /* +0x0024 */ char *lpszWindowsEffectDLL; /* +0x0028 */ unsigned long iWindowsEffectOrdinal; /* +0x002c */ }; struct _numberfmtA { unsigned char NumDigits[4]; /* +0x0000 75 00 00 00 */ unsigned char LeadingZero[4]; /* +0x0004 75 00 00 00 */ unsigned char Grouping[4]; /* +0x0008 75 00 00 00 */ char *lpDecimalSep; /* +0x000c */ char *lpThousandSep; /* +0x0010 */ unsigned char NegativeOrder[4]; /* +0x0014 75 00 00 00 */ }; struct _PREFIX_TABLE { short NodeTypeCode; /* +0x0000 */ short NameLength; /* +0x0002 */ unsigned char NextPrefixTree[4]; /* +0x0004 17 30 00 00 */ }; struct _REQUEST_RAW_ENCRYPTED_DATA { long long FileOffset; /* +0x0000 */ unsigned long Length; /* +0x0008 */ }; struct _SYSTEM_PROCESSOR_PERFORMANCE_STATE_DISTRIBUTION { unsigned long ProcessorNumber; /* +0x0000 */ unsigned long StateCount; /* +0x0004 */ unsigned char States[8]; /* +0x0008 ab 35 00 00 */ }; struct tagINTERFACEDATA { unsigned char pmethdata[4]; /* +0x0000 54 15 00 00 */ unsigned char cMembers[4]; /* +0x0004 75 00 00 00 */ }; struct _SERVICE_TIMECHANGE_INFO { unsigned char liNewTime[8]; /* +0x0000 3d 13 00 00 */ unsigned char liOldTime[8]; /* +0x0008 3d 13 00 00 */ }; struct _ICONINFO { unsigned char fIcon[4]; /* +0x0000 74 00 00 00 */ unsigned long xHotspot; /* +0x0004 */ unsigned long yHotspot; /* +0x0008 */ unsigned char hbmMask[4]; /* +0x000c 06 18 00 00 */ unsigned char hbmColor[4]; /* +0x0010 06 18 00 00 */ }; struct _SE_ACCESS_REQUEST { unsigned long Size; /* +0x0000 */ unsigned char SeSecurityDescriptor[4]; /* +0x0004 d9 35 00 00 */ unsigned long DesiredAccess; /* +0x0008 */ unsigned long PreviouslyGrantedAccess; /* +0x000c */ void *PrincipalSelfSid; /* +0x0010 */ unsigned char GenericMapping[4]; /* +0x0014 ff 27 00 00 */ unsigned long ObjectTypeListCount; /* +0x0018 */ unsigned char ObjectTypeList[4]; /* +0x001c db 35 00 00 */ }; struct _INITIAL_TEB::<unnamed-type-OldInitialTeb> { void *OldStackBase; /* +0x0000 */ void *OldStackLimit; /* +0x0004 */ }; struct _RTL_PROCESS_LOCKS { unsigned long NumberOfLocks; /* +0x0000 */ unsigned char Locks[36]; /* +0x0004 e1 35 00 00 */ }; struct _RTL_TIME_ZONE_INFORMATION { long Bias; /* +0x0000 */ unsigned char StandardName[64]; /* +0x0004 a5 15 00 00 */ unsigned char StandardStart[16]; /* +0x0044 34 30 00 00 */ long StandardBias; /* +0x0054 */ unsigned char DaylightName[64]; /* +0x0058 a5 15 00 00 */ unsigned char DaylightStart[16]; /* +0x0098 34 30 00 00 */ long DaylightBias; /* +0x00a8 */ }; struct tagRPC_EXTENDED_ERROR_INFO::<unnamed-type-u> { /* unsigned char SystemTime[0]; +0x0000 a6 15 00 00 */ unsigned char FileTime[16]; /* +0x0000 31 13 00 00 */ }; struct _CRYPTPROTECT_PROMPTSTRUCT { unsigned long cbSize; /* +0x0000 */ unsigned long dwPromptFlags; /* +0x0004 */ unsigned char hwndApp[4]; /* +0x0008 f1 12 00 00 */ unsigned char szPrompt[4]; /* +0x000c c0 13 00 00 */ }; struct _ALPC_PORT_CALLBACK_INFORMATION { void *CallbackObject; /* +0x0000 */ void *Context; /* +0x0004 */ }; struct _RTL_VERIFIER_PROVIDER_DESCRIPTOR { unsigned long Length; /* +0x0000 */ unsigned char ProviderDlls[4]; /* +0x0004 ce 28 00 00 */ unsigned char ProviderDllLoadCallback[4]; /* +0x0008 0f 28 00 00 */ unsigned char ProviderDllUnloadCallback[4]; /* +0x000c 0f 28 00 00 */ unsigned char VerifierImage[4]; /* +0x0010 71 04 00 00 */ unsigned long VerifierFlags; /* +0x0014 */ unsigned long VerifierDebug; /* +0x0018 */ void *RtlpGetStackTraceAddress; /* +0x001c */ void *RtlpDebugPageHeapCreate; /* +0x0020 */ void *RtlpDebugPageHeapDestroy; /* +0x0024 */ unsigned char ProviderNtdllHeapFreeCallback[4]; /* +0x0028 d8 19 00 00 */ }; struct _PROCESS_INFORMATION { void *hProcess; /* +0x0000 */ void *hThread; /* +0x0004 */ unsigned long dwProcessId; /* +0x0008 */ unsigned long dwThreadId; /* +0x000c */ }; struct _FP_32 { unsigned char W[4]; /* +0x0000 f6 12 00 00 */ }; struct _SYSTEM_OBJECT_INFORMATION { unsigned long NextEntryOffset; /* +0x0000 */ void *Object; /* +0x0004 */ void *CreatorUniqueProcess; /* +0x0008 */ unsigned short CreatorBackTraceIndex; /* +0x000c */ unsigned short Flags; /* +0x000e */ long PointerCount; /* +0x0010 */ long HandleCount; /* +0x0014 */ unsigned long PagedPoolCharge; /* +0x0018 */ unsigned long NonPagedPoolCharge; /* +0x001c */ void *ExclusiveProcessId; /* +0x0020 */ void *SecurityDescriptor; /* +0x0024 */ unsigned char NameInfo[8]; /* +0x0028 24 36 00 00 */ }; struct tagWINDOWPOS { unsigned char hwnd[4]; /* +0x0000 f1 12 00 00 */ unsigned char hwndInsertAfter[4]; /* +0x0004 f1 12 00 00 */ unsigned char x[4]; /* +0x0008 74 00 00 00 */ unsigned char y[4]; /* +0x000c 74 00 00 00 */ unsigned char cx[4]; /* +0x0010 74 00 00 00 */ unsigned char cy[4]; /* +0x0014 74 00 00 00 */ unsigned char flags[4]; /* +0x0018 75 00 00 00 */ }; struct tagNONCLIENTMETRICSA { unsigned char cbSize[4]; /* +0x0000 75 00 00 00 */ unsigned char iBorderWidth[4]; /* +0x0004 74 00 00 00 */ unsigned char iScrollWidth[4]; /* +0x0008 74 00 00 00 */ unsigned char iScrollHeight[4]; /* +0x000c 74 00 00 00 */ unsigned char iCaptionWidth[4]; /* +0x0010 74 00 00 00 */ unsigned char iCaptionHeight[4]; /* +0x0014 74 00 00 00 */ unsigned char lfCaptionFont[60]; /* +0x0018 c2 16 00 00 */ unsigned char iSmCaptionWidth[4]; /* +0x0054 74 00 00 00 */ unsigned char iSmCaptionHeight[4]; /* +0x0058 74 00 00 00 */ unsigned char lfSmCaptionFont[60]; /* +0x005c c2 16 00 00 */ unsigned char iMenuWidth[4]; /* +0x0098 74 00 00 00 */ unsigned char iMenuHeight[4]; /* +0x009c 74 00 00 00 */ unsigned char lfMenuFont[60]; /* +0x00a0 c2 16 00 00 */ unsigned char lfStatusFont[60]; /* +0x00dc c2 16 00 00 */ unsigned char lfMessageFont[60]; /* +0x0118 c2 16 00 00 */ unsigned char iPaddedBorderWidth[4]; /* +0x0154 74 00 00 00 */ }; struct tagGLYPHSET { unsigned long cbThis; /* +0x0000 */ unsigned long flAccel; /* +0x0004 */ unsigned long cGlyphsSupported; /* +0x0008 */ unsigned long cRanges; /* +0x000c */ unsigned char ranges[4]; /* +0x0010 33 36 00 00 */ }; struct tagMDICREATESTRUCTW { unsigned char szClass[4]; /* +0x0000 c0 13 00 00 */ unsigned char szTitle[4]; /* +0x0004 c0 13 00 00 */ void *hOwner; /* +0x0008 */ unsigned char x[4]; /* +0x000c 74 00 00 00 */ unsigned char y[4]; /* +0x0010 74 00 00 00 */ unsigned char cx[4]; /* +0x0014 74 00 00 00 */ unsigned char cy[4]; /* +0x0018 74 00 00 00 */ unsigned long style; /* +0x001c */ long lParam; /* +0x0020 */ }; struct _FILE_FS_SIZE_INFORMATION { unsigned char TotalAllocationUnits[8]; /* +0x0000 3d 13 00 00 */ unsigned char AvailableAllocationUnits[8]; /* +0x0008 3d 13 00 00 */ unsigned long SectorsPerAllocationUnit; /* +0x0010 */ unsigned long BytesPerSector; /* +0x0014 */ }; struct _PO_WAKE_SOURCE_DEVICE { unsigned char Header[8]; /* +0x0000 0b 18 00 00 */ unsigned char InstancePath[4]; /* +0x0008 f7 13 00 00 */ }; struct _KEY_CONTROL_FLAGS_INFORMATION { unsigned long ControlFlags; /* +0x0000 */ }; struct _KCRM_TRANSACTION_BLOB { unsigned char UOW[16]; /* +0x0000 dc 14 00 00 */ unsigned char TmIdentity[16]; /* +0x0010 dc 14 00 00 */ unsigned long IsolationLevel; /* +0x0020 */ unsigned long IsolationFlags; /* +0x0024 */ unsigned long Timeout; /* +0x0028 */ unsigned char Description[128]; /* +0x002c 98 1e 00 00 */ }; struct _MUILANGLISTNODE { unsigned short LanguageType; /* +0x0000 */ unsigned short Reserved; /* +0x0002 */ short LanguageSpec; /* +0x0004 */ }; struct _cpinfo { unsigned char MaxCharSize[4]; /* +0x0000 75 00 00 00 */ unsigned char DefaultChar[2]; /* +0x0004 a7 17 00 00 */ unsigned char LeadByte[14]; /* +0x0006 6e 15 00 00 */ }; struct _POWER_SESSION_CONNECT { unsigned char Connected; /* +0x0000 */ unsigned char Console; /* +0x0001 */ }; struct tagRPC_CALL_ATTRIBUTES_V2_A { unsigned char Version[4]; /* +0x0000 75 00 00 00 */ unsigned long Flags; /* +0x0004 */ unsigned long ServerPrincipalNameBufferLength; /* +0x0008 */ unsigned char *ServerPrincipalName; /* +0x000c */ unsigned long ClientPrincipalNameBufferLength; /* +0x0010 */ unsigned char *ClientPrincipalName; /* +0x0014 */ unsigned long AuthenticationLevel; /* +0x0018 */ unsigned long AuthenticationService; /* +0x001c */ unsigned char NullSession[4]; /* +0x0020 74 00 00 00 */ unsigned char KernelModeCaller[4]; /* +0x0024 74 00 00 00 */ unsigned long ProtocolSequence; /* +0x0028 */ unsigned long IsClientLocal; /* +0x002c */ void *ClientPID; /* +0x0030 */ unsigned long CallStatus; /* +0x0034 */ unsigned char CallType[4]; /* +0x0038 a0 18 00 00 */ unsigned char CallLocalAddress[4]; /* +0x003c a2 18 00 00 */ unsigned short OpNum; /* +0x0040 */ unsigned char InterfaceUuid[16]; /* +0x0044 dc 14 00 00 */ }; struct _FILE_PIPE_CLIENT_PROCESS_BUFFER_EX { void *ClientSession; /* +0x0000 */ void *ClientProcess; /* +0x0004 */ unsigned short ClientComputerNameLength; /* +0x0008 */ unsigned char ClientComputerBuffer[34]; /* +0x000a 8c 21 00 00 */ }; struct tagIMEMENUITEMINFOW { unsigned char cbSize[4]; /* +0x0000 75 00 00 00 */ unsigned char fType[4]; /* +0x0004 75 00 00 00 */ unsigned char fState[4]; /* +0x0008 75 00 00 00 */ unsigned char wID[4]; /* +0x000c 75 00 00 00 */ unsigned char hbmpChecked[4]; /* +0x0010 06 18 00 00 */ unsigned char hbmpUnchecked[4]; /* +0x0014 06 18 00 00 */ unsigned long dwItemData; /* +0x0018 */ unsigned char szString[160]; /* +0x001c 08 21 00 00 */ unsigned char hbmpItem[4]; /* +0x00bc 06 18 00 00 */ }; struct _RTL_CRITICAL_SECTION_DEBUG32 { unsigned short Type; /* +0x0000 */ unsigned short CreatorBackTraceIndex; /* +0x0002 */ unsigned long CriticalSection; /* +0x0004 */ unsigned char ProcessLocksList[8]; /* +0x0008 d9 1e 00 00 */ unsigned long EntryCount; /* +0x0010 */ unsigned long ContentionCount; /* +0x0014 */ unsigned char Spare[8]; /* +0x0018 69 15 00 00 */ }; struct _OPERATION_START_PARAMETERS { unsigned long Version; /* +0x0000 */ unsigned long OperationId; /* +0x0004 */ unsigned long Flags; /* +0x0008 */ }; struct _CRL_DIST_POINT { unsigned char DistPointName[12]; /* +0x0000 d8 22 00 00 */ unsigned char ReasonFlags[12]; /* +0x000c 03 13 00 00 */ unsigned char CRLIssuer[8]; /* +0x0018 44 24 00 00 */ }; struct _CRYPT_MASK_GEN_ALGORITHM { char *pszObjId; /* +0x0000 */ unsigned char HashAlgorithm[12]; /* +0x0004 55 14 00 00 */ }; struct _FILE_REFERENCE_RANGE { unsigned long long StartingFileReferenceNumber; /* +0x0000 */ unsigned long long EndingFileReferenceNumber; /* +0x0008 */ }; struct _wfinddata_t { unsigned char attrib[4]; /* +0x0000 75 00 00 00 */ long time_create; /* +0x0004 */ long time_access; /* +0x0008 */ long time_write; /* +0x000c */ unsigned long size; /* +0x0010 */ unsigned char name[520]; /* +0x0014 e4 15 00 00 */ }; struct tagEMRSETMITERLIMIT { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned char eMiterLimit[4]; /* +0x0008 40 00 00 00 */ }; struct _CERT_LOGOTYPE_DETAILS { unsigned char pwszMimeType[4]; /* +0x0000 71 04 00 00 */ unsigned long cHashedUrl; /* +0x0004 */ unsigned char rgHashedUrl[4]; /* +0x0008 8b 29 00 00 */ }; struct _SLIST_HEADER { unsigned long long Alignment; /* +0x0000 */ unsigned char Next[4]; /* +0x0000 ba 17 00 00 */ unsigned short Depth; /* +0x0004 */ unsigned short Sequence; /* +0x0006 */ }; struct tagLOGBRUSH32 { unsigned char lbStyle[4]; /* +0x0000 75 00 00 00 */ unsigned long lbColor; /* +0x0004 */ unsigned long lbHatch; /* +0x0008 */ }; struct _CRYPT_PKCS8_IMPORT_PARAMS { unsigned char PrivateKey[8]; /* +0x0000 02 13 00 00 */ unsigned char pResolvehCryptProvFunc[4]; /* +0x0008 09 37 00 00 */ void *pVoidResolveFunc; /* +0x000c */ unsigned char pDecryptPrivateKeyFunc[4]; /* +0x0010 0c 37 00 00 */ void *pVoidDecryptFunc; /* +0x0014 */ }; struct _TOKEN_SECURITY_ATTRIBUTES_INFORMATION { unsigned short Version; /* +0x0000 */ unsigned short Reserved; /* +0x0002 */ unsigned long AttributeCount; /* +0x0004 */ }; struct _TOKEN_SECURITY_ATTRIBUTES_INFORMATION::<unnamed-type-Attribute> { unsigned char pAttributeV1[4]; /* +0x0000 13 37 00 00 */ }; struct _RTL_VERIFIER_PAGEHEAPS_INFORMATION { unsigned long TotalSize; /* +0x0000 */ unsigned long NumberPageHeaps; /* +0x0004 */ unsigned char PageHeapInformation[20]; /* +0x0008 19 37 00 00 */ }; enum __vc_attributes::pointer_defaultAttribute::type_e { ptr = 0, ref = 1, unique = 2 }; enum __vc_attributes::threadingAttribute::threading_e { apartment = 1, single = 2, free = 3, neutral = 4, both = 5 }; enum __vc_attributes::event_receiverAttribute::type_e { native = 0, com = 1, managed = 2 }; enum __vc_attributes::aggregatableAttribute::type_e { never = 0, allowed = 1, always = 2 }; enum __vc_attributes::event_sourceAttribute::optimize_e { speed = 0, size = 1 }; enum __vc_attributes::moduleAttribute::type_e { dll = 1, exe = 2, service = 3, unspecified = 4, EXE = 2, SERVICE = 3 }; enum __vc_attributes::helper_attributes::usageAttribute::usage_e { eAnyUsage = 0, eCoClassUsage = 1, eCOMInterfaceUsage = 2, eInterfaceUsage = 6, eMemberUsage = 8, eMethodUsage = 16, eInterfaceMethodUsage = 32, eInterfaceMemberUsage = 64, eCoClassMemberUsage = 128, eCoClassMethodUsage = 256, eGlobalMethodUsage = 768, eGlobalDataUsage = 1024, eClassUsage = 2048, eInterfaceParameterUsage = 4096, eMethodParameterUsage = 12288, eIDLModuleUsage = 16384, = 32770 }; enum __vc_attributes::helper_attributes::v1_alttypeAttribute::type_e { eBoolean = 0, eInteger = 1, eFloat = 2, eDouble = 3 }; struct _FILE_PIPE_REMOTE_INFORMATION { unsigned char CollectDataTime[8]; /* +0x0000 3d 13 00 00 */ unsigned long MaximumCollectionCount; /* +0x0008 */ }; struct tagEMRGDICOMMENT { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned long cbData; /* +0x0008 */ unsigned char Data[4]; /* +0x000c f9 12 00 00 */ }; struct _BCRYPT_ALGORITHM_IDENTIFIER { unsigned char pszName[4]; /* +0x0000 71 04 00 00 */ unsigned long dwClass; /* +0x0004 */ unsigned long dwFlags; /* +0x0008 */ }; struct tagMENUINFO { unsigned long cbSize; /* +0x0000 */ unsigned long fMask; /* +0x0004 */ unsigned long dwStyle; /* +0x0008 */ unsigned char cyMax[4]; /* +0x000c 75 00 00 00 */ unsigned char hbrBack[4]; /* +0x0010 4f 23 00 00 */ unsigned long dwContextHelpID; /* +0x0014 */ unsigned long dwMenuData; /* +0x0018 */ }; struct _CRYPT_ENCRYPT_MESSAGE_PARA { unsigned long cbSize; /* +0x0000 */ unsigned long dwMsgEncodingType; /* +0x0004 */ unsigned long hCryptProv; /* +0x0008 */ unsigned char ContentEncryptionAlgorithm[12]; /* +0x000c 55 14 00 00 */ void *pvEncryptionAuxInfo; /* +0x0018 */ unsigned long dwFlags; /* +0x001c */ unsigned long dwInnerContentType; /* +0x0020 */ }; struct _ALPC_BASIC_INFORMATION { unsigned long Flags; /* +0x0000 */ unsigned long SequenceNo; /* +0x0004 */ void *PortContext; /* +0x0008 */ }; struct _FILE_LEVEL_TRIM { unsigned long Key; /* +0x0000 */ unsigned long NumRanges; /* +0x0004 */ unsigned char Ranges[16]; /* +0x0008 70 3a 00 00 */ }; struct tagRECONVERTSTRING { unsigned long dwSize; /* +0x0000 */ unsigned long dwVersion; /* +0x0004 */ unsigned long dwStrLen; /* +0x0008 */ unsigned long dwStrOffset; /* +0x000c */ unsigned long dwCompStrLen; /* +0x0010 */ unsigned long dwCompStrOffset; /* +0x0014 */ unsigned long dwTargetStrLen; /* +0x0018 */ unsigned long dwTargetStrOffset; /* +0x001c */ }; struct _CERT_QC_STATEMENTS_EXT_INFO { unsigned long cStatement; /* +0x0000 */ unsigned char rgStatement[4]; /* +0x0004 ee 24 00 00 */ }; struct _SYSTEM_REGISTRY_QUOTA_INFORMATION { unsigned long RegistryQuotaAllowed; /* +0x0000 */ unsigned long RegistryQuotaUsed; /* +0x0004 */ unsigned long PagedPoolSize; /* +0x0008 */ }; struct _NETCONNECTINFOSTRUCT { unsigned long cbStructure; /* +0x0000 */ unsigned long dwFlags; /* +0x0004 */ unsigned long dwSpeed; /* +0x0008 */ unsigned long dwDelay; /* +0x000c */ unsigned long dwOptDataSize; /* +0x0010 */ }; struct tagALTTABINFO { unsigned long cbSize; /* +0x0000 */ unsigned char cItems[4]; /* +0x0004 74 00 00 00 */ unsigned char cColumns[4]; /* +0x0008 74 00 00 00 */ unsigned char cRows[4]; /* +0x000c 74 00 00 00 */ unsigned char iColFocus[4]; /* +0x0010 74 00 00 00 */ unsigned char iRowFocus[4]; /* +0x0014 74 00 00 00 */ unsigned char cxItem[4]; /* +0x0018 74 00 00 00 */ unsigned char cyItem[4]; /* +0x001c 74 00 00 00 */ unsigned char ptStart[8]; /* +0x0020 8a 14 00 00 */ }; struct _CERT_SYSTEM_STORE_INFO { unsigned long cbSize; /* +0x0000 */ }; struct _FILE_IS_REMOTE_DEVICE_INFORMATION { unsigned char IsRemote; /* +0x0000 */ }; struct _userHBITMAP { long fContext; /* +0x0000 */ }; struct _userHBITMAP::__MIDL_IWinTypes_0007 { long hInproc; /* +0x0000 */ /* unsigned char hRemote[0]; +0x0000 a9 3a 00 00 */ long long hInproc64; /* +0x0000 */ }; struct _AUTHENTICODE_EXTRA_CERT_CHAIN_POLICY_PARA { unsigned long cbSize; /* +0x0000 */ unsigned long dwRegPolicySettings; /* +0x0004 */ unsigned char pSignerInfo[4]; /* +0x0008 af 3a 00 00 */ }; struct _CMSG_CTRL_VERIFY_SIGNATURE_EX_PARA { unsigned long cbSize; /* +0x0000 */ unsigned long hCryptProv; /* +0x0004 */ unsigned long dwSignerIndex; /* +0x0008 */ unsigned long dwSignerType; /* +0x000c */ void *pvSigner; /* +0x0010 */ }; struct _PROCESSOR_POWER_INFORMATION { unsigned long Number; /* +0x0000 */ unsigned long MaxMhz; /* +0x0004 */ unsigned long CurrentMhz; /* +0x0008 */ unsigned long MhzLimit; /* +0x000c */ unsigned long MaxIdleState; /* +0x0010 */ unsigned long CurrentIdleState; /* +0x0014 */ }; struct _LDR_SECTION_INFO { void *SectionHandle; /* +0x0000 */ unsigned long DesiredAccess; /* +0x0004 */ unsigned char ObjA[4]; /* +0x0008 dd 3a 00 00 */ unsigned long SectionPageProtection; /* +0x000c */ unsigned long AllocationAttributes; /* +0x0010 */ }; struct tagEMRSETCOLORSPACE { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned long ihCS; /* +0x0008 */ }; struct _MMPFN_IDENTITY::<unnamed-type-u2>::<unnamed-type-e2> { unsigned char CombinedPage[4]; /* +0x0000 17 13 00 00 */ }; struct _MMPFN_IDENTITY::<unnamed-type-u2>::<unnamed-type-e1> { /* unsigned char Image[0]; +0x0000 17 13 00 00 */ unsigned char Mismatch[4]; /* +0x0000 7e 18 00 00 */ }; struct _MMPFN_IDENTITY::<unnamed-type-u1> { /* unsigned char e1[0]; +0x0000 f6 3a 00 00 */ /* unsigned char e2[0]; +0x0000 f7 3a 00 00 */ /* unsigned char e3[0]; +0x0000 f8 3a 00 00 */ unsigned char e4[8]; /* +0x0000 f9 3a 00 00 */ }; struct _FILE_ALLOCATED_RANGE_BUFFER { unsigned char FileOffset[8]; /* +0x0000 3d 13 00 00 */ unsigned char Length[8]; /* +0x0008 3d 13 00 00 */ }; struct _RTL_UNLOAD_EVENT_TRACE32 { unsigned long BaseAddress; /* +0x0000 */ unsigned long SizeOfImage; /* +0x0004 */ unsigned long Sequence; /* +0x0008 */ unsigned long TimeDateStamp; /* +0x000c */ unsigned long CheckSum; /* +0x0010 */ unsigned char ImageName[64]; /* +0x0014 a5 15 00 00 */ unsigned char Version[8]; /* +0x0054 69 15 00 00 */ }; struct _SYSTEM_POWER_POLICY { unsigned long Revision; /* +0x0000 */ unsigned char PowerButton[12]; /* +0x0004 6d 1f 00 00 */ unsigned char SleepButton[12]; /* +0x0010 6d 1f 00 00 */ unsigned char LidClose[12]; /* +0x001c 6d 1f 00 00 */ unsigned char LidOpenWake[4]; /* +0x0028 5a 16 00 00 */ unsigned long Reserved; /* +0x002c */ unsigned char Idle[12]; /* +0x0030 6d 1f 00 00 */ unsigned long IdleTimeout; /* +0x003c */ unsigned char IdleSensitivity; /* +0x0040 */ unsigned char DynamicThrottle; /* +0x0041 */ unsigned char Spare2[2]; /* +0x0042 a7 17 00 00 */ unsigned char MinSleep[4]; /* +0x0044 5a 16 00 00 */ unsigned char MaxSleep[4]; /* +0x0048 5a 16 00 00 */ unsigned char ReducedLatencySleep[4]; /* +0x004c 5a 16 00 00 */ unsigned long WinLogonFlags; /* +0x0050 */ unsigned long Spare3; /* +0x0054 */ unsigned long DozeS4Timeout; /* +0x0058 */ unsigned long BroadcastCapacityResolution; /* +0x005c */ unsigned char DischargePolicy[96]; /* +0x0060 29 3b 00 00 */ unsigned long VideoTimeout; /* +0x00c0 */ unsigned char VideoDimDisplay; /* +0x00c4 */ unsigned char VideoReserved[12]; /* +0x00c8 22 13 00 00 */ unsigned long SpindownTimeout; /* +0x00d4 */ unsigned char OptimizeForPower; /* +0x00d8 */ unsigned char FanThrottleTolerance; /* +0x00d9 */ unsigned char ForcedThrottle; /* +0x00da */ unsigned char MinThrottle; /* +0x00db */ unsigned char OverThrottled[12]; /* +0x00dc 6d 1f 00 00 */ }; struct _TRANSACTION_LIST_INFORMATION { unsigned long NumberOfTransactions; /* +0x0000 */ unsigned char TransactionInformation[16]; /* +0x0004 2c 3b 00 00 */ }; struct _wireSAFEARR_BSTR { unsigned long Size; /* +0x0000 */ unsigned char aBstr[4]; /* +0x0004 34 3b 00 00 */ }; struct _FILE_DIRECTORY_INFORMATION { unsigned long NextEntryOffset; /* +0x0000 */ unsigned long FileIndex; /* +0x0004 */ unsigned char CreationTime[8]; /* +0x0008 3d 13 00 00 */ unsigned char LastAccessTime[8]; /* +0x0010 3d 13 00 00 */ unsigned char LastWriteTime[8]; /* +0x0018 3d 13 00 00 */ unsigned char ChangeTime[8]; /* +0x0020 3d 13 00 00 */ unsigned char EndOfFile[8]; /* +0x0028 3d 13 00 00 */ unsigned char AllocationSize[8]; /* +0x0030 3d 13 00 00 */ unsigned long FileAttributes; /* +0x0038 */ unsigned long FileNameLength; /* +0x003c */ unsigned char FileName[8]; /* +0x0040 f7 13 00 00 */ }; struct _CERT_EXTENSION { char *pszObjId; /* +0x0000 */ unsigned char fCritical[4]; /* +0x0004 74 00 00 00 */ unsigned char Value[8]; /* +0x0008 02 13 00 00 */ }; struct _PROCESS_MITIGATION_STACKCHECK_POLICY { unsigned long Flags; /* +0x0000 */ /* unsigned char Permanent[0]; +0x0000 17 13 00 00 */ unsigned char ReservedFlags[4]; /* +0x0000 8e 13 00 00 */ }; struct tagSOUNDSENTRYW { unsigned char cbSize[4]; /* +0x0000 75 00 00 00 */ unsigned long dwFlags; /* +0x0004 */ unsigned long iFSTextEffect; /* +0x0008 */ unsigned long iFSTextEffectMSec; /* +0x000c */ unsigned long iFSTextEffectColorBits; /* +0x0010 */ unsigned long iFSGrafEffect; /* +0x0014 */ unsigned long iFSGrafEffectMSec; /* +0x0018 */ unsigned long iFSGrafEffectColor; /* +0x001c */ unsigned long iWindowsEffect; /* +0x0020 */ unsigned long iWindowsEffectMSec; /* +0x0024 */ unsigned char lpszWindowsEffectDLL[4]; /* +0x0028 71 04 00 00 */ unsigned long iWindowsEffectOrdinal; /* +0x002c */ }; struct _OLESTREAM { unsigned char lpstbl[4]; /* +0x0000 4f 3b 00 00 */ }; struct _NCRYPT_CIPHER_PADDING_INFO { unsigned long cbSize; /* +0x0000 */ unsigned long dwFlags; /* +0x0004 */ unsigned char *pbIV; /* +0x0008 */ unsigned long cbIV; /* +0x000c */ unsigned char *pbOtherInfo; /* +0x0010 */ unsigned long cbOtherInfo; /* +0x0014 */ }; struct _CRL_ENTRY { unsigned char SerialNumber[8]; /* +0x0000 02 13 00 00 */ unsigned char RevocationDate[8]; /* +0x0008 31 13 00 00 */ unsigned long cExtension; /* +0x0010 */ unsigned char rgExtension[4]; /* +0x0014 22 16 00 00 */ }; struct _FSCTL_OFFLOAD_READ_INPUT { unsigned long Size; /* +0x0000 */ unsigned long Flags; /* +0x0004 */ unsigned long TokenTimeToLive; /* +0x0008 */ unsigned long Reserved; /* +0x000c */ unsigned long long FileOffset; /* +0x0010 */ unsigned long long CopyLength; /* +0x0018 */ }; struct _SYSTEM_BOOT_LOGO_INFORMATION { unsigned char Bitmap[1]; /* +0x0000 f9 12 00 00 */ }; struct _IMAGE_FUNCTION_ENTRY { unsigned long StartingAddress; /* +0x0000 */ unsigned long EndingAddress; /* +0x0004 */ unsigned long EndOfPrologue; /* +0x0008 */ }; struct tagMEASUREITEMSTRUCT { unsigned char CtlType[4]; /* +0x0000 75 00 00 00 */ unsigned char CtlID[4]; /* +0x0004 75 00 00 00 */ unsigned char itemID[4]; /* +0x0008 75 00 00 00 */ unsigned char itemWidth[4]; /* +0x000c 75 00 00 00 */ unsigned char itemHeight[4]; /* +0x0010 75 00 00 00 */ unsigned long itemData; /* +0x0014 */ }; struct _RPC_PROTSEQ_ENDPOINT { unsigned char *RpcProtocolSequence; /* +0x0000 */ unsigned char *Endpoint; /* +0x0004 */ }; struct _PROCESS_BASIC_INFORMATION { long ExitStatus; /* +0x0000 */ unsigned char PebBaseAddress[4]; /* +0x0004 5d 2e 00 00 */ unsigned long AffinityMask; /* +0x0008 */ long BasePriority; /* +0x000c */ unsigned long UniqueProcessId; /* +0x0010 */ unsigned long InheritedFromUniqueProcessId; /* +0x0014 */ }; struct _CRYPT_TIMESTAMP_PARA { unsigned char pszTSAPolicyId[4]; /* +0x0000 62 14 00 00 */ unsigned char fRequestCerts[4]; /* +0x0004 74 00 00 00 */ unsigned char Nonce[8]; /* +0x0008 02 13 00 00 */ unsigned long cExtension; /* +0x0010 */ unsigned char rgExtension[4]; /* +0x0014 22 16 00 00 */ }; struct tagENUMLOGFONTW { unsigned char elfLogFont[92]; /* +0x0000 a3 16 00 00 */ unsigned char elfFullName[128]; /* +0x005c 98 1e 00 00 */ unsigned char elfStyle[64]; /* +0x00dc a5 15 00 00 */ }; struct _CRYPT_ALGORITHM_IDENTIFIER { char *pszObjId; /* +0x0000 */ unsigned char Parameters[8]; /* +0x0004 02 13 00 00 */ }; struct _LDR_DLL_NOTIFICATION_DATA { /* unsigned char Loaded[0]; +0x0000 77 2a 00 00 */ unsigned char Unloaded[20]; /* +0x0000 a7 3b 00 00 */ }; struct _CMSG_KEY_AGREE_RECIPIENT_ENCODE_INFO { unsigned long cbSize; /* +0x0000 */ unsigned char KeyEncryptionAlgorithm[12]; /* +0x0004 55 14 00 00 */ void *pvKeyEncryptionAuxInfo; /* +0x0010 */ unsigned char KeyWrapAlgorithm[12]; /* +0x0014 55 14 00 00 */ void *pvKeyWrapAuxInfo; /* +0x0020 */ unsigned long hCryptProv; /* +0x0024 */ unsigned long dwKeySpec; /* +0x0028 */ unsigned long dwKeyChoice; /* +0x002c */ /* unsigned char pEphemeralAlgorithm[0]; +0x0030 51 1d 00 00 */ unsigned char pSenderId[4]; /* +0x0030 bf 3b 00 00 */ unsigned char UserKeyingMaterial[8]; /* +0x0034 02 13 00 00 */ unsigned long cRecipientEncryptedKeys; /* +0x003c */ unsigned char rgpRecipientEncryptedKeys[4]; /* +0x0040 c2 3b 00 00 */ }; struct _SYSTEM_NUMA_PROXIMITY_MAP { unsigned long NodeProximityId; /* +0x0000 */ unsigned short NodeNumber; /* +0x0004 */ }; struct _JOURNAL_SET_KEY_LAST_WRITE_TIME_INFORMATION { unsigned char Action[8]; /* +0x0000 38 15 00 00 */ unsigned long long RecordNumber; /* +0x0008 */ unsigned char TimeStamp[8]; /* +0x0010 3d 13 00 00 */ unsigned char KeyPathName[8]; /* +0x0018 dd 12 00 00 */ unsigned char OldLastWriteTime[8]; /* +0x0020 3d 13 00 00 */ unsigned char NewLastWriteTime[8]; /* +0x0028 3d 13 00 00 */ }; struct _CREATE_THREAD_DEBUG_INFO { void *hThread; /* +0x0000 */ void *lpThreadLocalBase; /* +0x0004 */ unsigned char lpStartAddress[4]; /* +0x0008 c4 15 00 00 */ }; struct tagMSGBOXPARAMSA { unsigned char cbSize[4]; /* +0x0000 75 00 00 00 */ unsigned char hwndOwner[4]; /* +0x0004 f1 12 00 00 */ unsigned char hInstance[4]; /* +0x0008 ba 14 00 00 */ unsigned char lpszText[4]; /* +0x000c 62 14 00 00 */ unsigned char lpszCaption[4]; /* +0x0010 62 14 00 00 */ unsigned long dwStyle; /* +0x0014 */ unsigned char lpszIcon[4]; /* +0x0018 62 14 00 00 */ unsigned long dwContextHelpId; /* +0x001c */ unsigned char lpfnMsgBoxCallback[4]; /* +0x0020 3e 2b 00 00 */ unsigned long dwLanguageId; /* +0x0024 */ }; struct _CM_PCCARD_DEVICE_DATA { unsigned char Flags; /* +0x0000 */ unsigned char ErrorCode; /* +0x0001 */ unsigned short Reserved; /* +0x0002 */ unsigned long BusData; /* +0x0004 */ unsigned long DeviceId; /* +0x0008 */ unsigned long LegacyBaseAddress; /* +0x000c */ unsigned char IRQMap[16]; /* +0x0010 09 1c 00 00 */ }; struct _RTL_BALANCED_LINKS { unsigned char Parent[4]; /* +0x0000 5e 21 00 00 */ unsigned char LeftChild[4]; /* +0x0004 5e 21 00 00 */ unsigned char RightChild[4]; /* +0x0008 5e 21 00 00 */ char Balance; /* +0x000c */ unsigned char Reserved[3]; /* +0x000d 8d 13 00 00 */ }; struct DISPLAYCONFIG_VIDEO_SIGNAL_INFO { unsigned long long pixelRate; /* +0x0000 */ unsigned char hSyncFreq[8]; /* +0x0008 e7 3b 00 00 */ unsigned char vSyncFreq[8]; /* +0x0010 e7 3b 00 00 */ unsigned char activeSize[8]; /* +0x0018 e8 3b 00 00 */ unsigned char totalSize[8]; /* +0x0020 e8 3b 00 00 */ unsigned char videoStandard[4]; /* +0x0028 75 00 00 00 */ unsigned char scanLineOrdering[4]; /* +0x002c e9 3b 00 00 */ }; struct _COUNTED_REASON_CONTEXT { unsigned long Version; /* +0x0000 */ unsigned long Flags; /* +0x0004 */ unsigned char ResourceFileName[8]; /* +0x0008 dd 12 00 00 */ unsigned short ResourceReasonId; /* +0x0010 */ unsigned long StringCount; /* +0x0014 */ /* unsigned char ReasonStrings[-16]; +0x0018 a2 17 00 00 */ unsigned char SimpleString[20]; /* +0x0008 dd 12 00 00 */ }; struct _INVERTED_FUNCTION_TABLE_ENTRY { void *FunctionTable; /* +0x0000 */ void *ImageBase; /* +0x0004 */ unsigned long SizeOfImage; /* +0x0008 */ unsigned long SizeOfTable; /* +0x000c */ }; struct _IMAGE_SECTION_HEADER { unsigned char Name[40]; /* +0x0000 7f 19 00 00 */ }; struct _IMAGE_SECTION_HEADER::<unnamed-type-Misc> { unsigned long PhysicalAddress; /* +0x0000 */ unsigned long VirtualSize; /* +0x0000 */ }; struct _PROCESS_REVOKE_FILE_HANDLES_INFORMATION { unsigned char TargetDevicePath[8]; /* +0x0000 dd 12 00 00 */ }; struct _SHSTOCKICONINFO { unsigned long cbSize; /* +0x0000 */ unsigned char hIcon[4]; /* +0x0004 07 21 00 00 */ unsigned char iSysImageIndex[4]; /* +0x0008 74 00 00 00 */ unsigned char iIcon[4]; /* +0x000c 74 00 00 00 */ unsigned char szPath[520]; /* +0x0010 e4 15 00 00 */ }; struct tagBITMAP { long bmType; /* +0x0000 */ long bmWidth; /* +0x0004 */ long bmHeight; /* +0x0008 */ long bmWidthBytes; /* +0x000c */ unsigned short bmPlanes; /* +0x0010 */ unsigned short bmBitsPixel; /* +0x0012 */ void *bmBits; /* +0x0014 */ }; struct _CONSOLE_FONT_INFO { unsigned long nFont; /* +0x0000 */ unsigned char dwFontSize[4]; /* +0x0004 09 18 00 00 */ }; struct tagSTGOPTIONS { unsigned short usVersion; /* +0x0000 */ unsigned short reserved; /* +0x0002 */ unsigned long ulSectorSize; /* +0x0004 */ unsigned char pwcsTemplateFile[4]; /* +0x0008 c0 13 00 00 */ }; struct _CRYPT_X942_OTHER_INFO { char *pszContentEncryptionObjId; /* +0x0000 */ unsigned char rgbCounter[4]; /* +0x0004 b7 17 00 00 */ unsigned char rgbKeyLength[4]; /* +0x0008 b7 17 00 00 */ unsigned char PubInfo[8]; /* +0x000c 02 13 00 00 */ }; struct _SD_QUERY_STATS_OUTPUT { unsigned long long SdsStreamSize; /* +0x0000 */ unsigned long long SdsAllocationSize; /* +0x0008 */ unsigned long long SiiStreamSize; /* +0x0010 */ unsigned long long SiiAllocationSize; /* +0x0018 */ unsigned long long SdhStreamSize; /* +0x0020 */ unsigned long long SdhAllocationSize; /* +0x0028 */ unsigned long long NumSDTotal; /* +0x0030 */ unsigned long long NumSDUnused; /* +0x0038 */ }; struct _DISCDLGSTRUCTW { unsigned long cbStructure; /* +0x0000 */ unsigned char hwndOwner[4]; /* +0x0004 f1 12 00 00 */ unsigned char lpLocalName[4]; /* +0x0008 71 04 00 00 */ unsigned char lpRemoteName[4]; /* +0x000c 71 04 00 00 */ unsigned long dwFlags; /* +0x0010 */ }; struct _OPEN_PRINTER_PROPS_INFOA { unsigned long dwSize; /* +0x0000 */ char *pszSheetName; /* +0x0004 */ unsigned char uSheetIndex[4]; /* +0x0008 75 00 00 00 */ unsigned long dwFlags; /* +0x000c */ unsigned char bModal[4]; /* +0x0010 74 00 00 00 */ }; struct tagACTCTXW { unsigned long cbSize; /* +0x0000 */ unsigned long dwFlags; /* +0x0004 */ unsigned char lpSource[4]; /* +0x0008 c0 13 00 00 */ unsigned short wProcessorArchitecture; /* +0x000c */ unsigned short wLangId; /* +0x000e */ unsigned char lpAssemblyDirectory[4]; /* +0x0010 c0 13 00 00 */ unsigned char lpResourceName[4]; /* +0x0014 c0 13 00 00 */ unsigned char lpApplicationName[4]; /* +0x0018 c0 13 00 00 */ unsigned char hModule[4]; /* +0x001c ba 14 00 00 */ }; struct tagLOCALESIGNATURE { unsigned char lsUsb[16]; /* +0x0000 4f 1a 00 00 */ unsigned char lsCsbDefault[8]; /* +0x0010 69 15 00 00 */ unsigned char lsCsbSupported[8]; /* +0x0018 69 15 00 00 */ }; struct tagVersionedStream { unsigned char guidVersion[16]; /* +0x0000 dc 14 00 00 */ unsigned char pStream[4]; /* +0x0010 dc 26 00 00 */ }; struct _JOBOBJECT_BASIC_PROCESS_ID_LIST { unsigned long NumberOfAssignedProcesses; /* +0x0000 */ unsigned long NumberOfProcessIdsInList; /* +0x0004 */ unsigned char ProcessIdList[4]; /* +0x0008 f6 12 00 00 */ }; struct _REMSECURITY_ATTRIBUTES { unsigned long nLength; /* +0x0000 */ unsigned long lpSecurityDescriptor; /* +0x0004 */ unsigned char bInheritHandle[4]; /* +0x0008 74 00 00 00 */ }; struct _CLAIM_SECURITY_ATTRIBUTE_FQBN_VALUE { unsigned long long Version; /* +0x0000 */ unsigned char Name[8]; /* +0x0008 71 04 00 00 */ }; struct _RTL_UNLOAD_EVENT_TRACE { void *BaseAddress; /* +0x0000 */ unsigned long SizeOfImage; /* +0x0004 */ unsigned long Sequence; /* +0x0008 */ unsigned long TimeDateStamp; /* +0x000c */ unsigned long CheckSum; /* +0x0010 */ unsigned char ImageName[64]; /* +0x0014 a5 15 00 00 */ unsigned char Version[8]; /* +0x0054 69 15 00 00 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR { unsigned char Type; /* +0x0000 */ unsigned char ShareDisposition; /* +0x0001 */ unsigned short Flags; /* +0x0002 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR::<unnamed-type-u>::<unnamed-type-Connection> { unsigned char Class; /* +0x0000 */ unsigned char Type; /* +0x0001 */ unsigned char Reserved1; /* +0x0002 */ unsigned char Reserved2; /* +0x0003 */ unsigned long IdLowPart; /* +0x0004 */ unsigned long IdHighPart; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR::<unnamed-type-u>::<unnamed-type-Memory64> { unsigned char Start[8]; /* +0x0000 3d 13 00 00 */ unsigned long Length64; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR::<unnamed-type-u>::<unnamed-type-Memory48> { unsigned char Start[8]; /* +0x0000 3d 13 00 00 */ unsigned long Length48; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR::<unnamed-type-u>::<unnamed-type-Memory40> { unsigned char Start[8]; /* +0x0000 3d 13 00 00 */ unsigned long Length40; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR::<unnamed-type-u>::<unnamed-type-DeviceSpecificData> { unsigned long DataSize; /* +0x0000 */ unsigned long Reserved1; /* +0x0004 */ unsigned long Reserved2; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR::<unnamed-type-u>::<unnamed-type-BusNumber> { unsigned long Start; /* +0x0000 */ unsigned long Length; /* +0x0004 */ unsigned long Reserved; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR::<unnamed-type-u>::<unnamed-type-DevicePrivate> { unsigned char Data[12]; /* +0x0000 22 13 00 00 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR::<unnamed-type-u>::<unnamed-type-DmaV3> { unsigned long Channel; /* +0x0000 */ unsigned long RequestLine; /* +0x0004 */ unsigned long Reserved1; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR::<unnamed-type-u>::<unnamed-type-Dma> { unsigned long Channel; /* +0x0000 */ unsigned long Port; /* +0x0004 */ unsigned long Reserved1; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR::<unnamed-type-u>::<unnamed-type-Memory> { unsigned char Start[8]; /* +0x0000 3d 13 00 00 */ unsigned long Length; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR::<unnamed-type-u>::<unnamed-type-MessageInterrupt> { /* unsigned char Raw[0]; +0x0000 99 3c 00 00 */ unsigned char Translated[12]; /* +0x0000 9a 3c 00 00 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR::<unnamed-type-u>::<unnamed-type-MessageInterrupt>::<unnamed-tag>::<unnamed-type-Translated> { unsigned long Level; /* +0x0000 */ unsigned long Vector; /* +0x0004 */ unsigned long Affinity; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR::<unnamed-type-u>::<unnamed-type-MessageInterrupt>::<unnamed-tag>::<unnamed-type-Raw> { unsigned short Reserved; /* +0x0000 */ unsigned short MessageCount; /* +0x0002 */ unsigned long Vector; /* +0x0004 */ unsigned long Affinity; /* +0x0008 */ }; struct tagNEWTEXTMETRICA { long tmHeight; /* +0x0000 */ long tmAscent; /* +0x0004 */ long tmDescent; /* +0x0008 */ long tmInternalLeading; /* +0x000c */ long tmExternalLeading; /* +0x0010 */ long tmAveCharWidth; /* +0x0014 */ long tmMaxCharWidth; /* +0x0018 */ long tmWeight; /* +0x001c */ long tmOverhang; /* +0x0020 */ long tmDigitizedAspectX; /* +0x0024 */ long tmDigitizedAspectY; /* +0x0028 */ unsigned char tmFirstChar; /* +0x002c */ unsigned char tmLastChar; /* +0x002d */ unsigned char tmDefaultChar; /* +0x002e */ unsigned char tmBreakChar; /* +0x002f */ unsigned char tmItalic; /* +0x0030 */ unsigned char tmUnderlined; /* +0x0031 */ unsigned char tmStruckOut; /* +0x0032 */ unsigned char tmPitchAndFamily; /* +0x0033 */ unsigned char tmCharSet; /* +0x0034 */ unsigned long ntmFlags; /* +0x0038 */ unsigned char ntmSizeEM[4]; /* +0x003c 75 00 00 00 */ unsigned char ntmCellHeight[4]; /* +0x0040 75 00 00 00 */ unsigned char ntmAvgWidth[4]; /* +0x0044 75 00 00 00 */ }; struct _IMAGE_ARM_RUNTIME_FUNCTION_ENTRY { unsigned long BeginAddress; /* +0x0000 */ unsigned long UnwindData; /* +0x0004 */ /* unsigned char Flag[0]; +0x0004 09 35 00 00 */ /* unsigned char FunctionLength[0]; +0x0004 b8 3c 00 00 */ /* unsigned char Ret[0]; +0x0004 be 2c 00 00 */ /* unsigned char H[0]; +0x0004 92 20 00 00 */ /* unsigned char Reg[0]; +0x0004 b9 3c 00 00 */ /* unsigned char R[0]; +0x0004 d4 23 00 00 */ /* unsigned char L[0]; +0x0004 88 13 00 00 */ /* unsigned char C[0]; +0x0004 89 13 00 00 */ unsigned char StackAdjust[4]; /* +0x0004 8a 13 00 00 */ }; struct _ATOM_TABLE_INFORMATION { unsigned long NumberOfAtoms; /* +0x0000 */ unsigned char Atoms[4]; /* +0x0004 ba 15 00 00 */ }; struct _BOOT_ENTROPY_NT_RESULT { unsigned long maxEntropySources; /* +0x0000 */ unsigned char EntropySourceResult[728]; /* +0x0008 de 3c 00 00 */ unsigned char SeedBytesForCng[48]; /* +0x02e0 0a 1c 00 00 */ }; struct _EISA_MEMORY_CONFIGURATION { unsigned char ConfigurationByte[1]; /* +0x0000 e1 3c 00 00 */ unsigned char DataSize; /* +0x0001 */ unsigned short AddressLowWord; /* +0x0002 */ unsigned char AddressHighByte; /* +0x0004 */ unsigned short MemorySize; /* +0x0005 */ }; struct _PROCESS_BASIC_INFORMATION64 { long ExitStatus; /* +0x0000 */ unsigned char Pad1[4]; /* +0x0004 75 00 00 00 */ unsigned long long PebBaseAddress; /* +0x0008 */ unsigned long long AffinityMask; /* +0x0010 */ long BasePriority; /* +0x0018 */ unsigned char Pad2[4]; /* +0x001c 75 00 00 00 */ unsigned long long UniqueProcessId; /* +0x0020 */ unsigned long long InheritedFromUniqueProcessId; /* +0x0028 */ }; struct _FILE_REMOTE_PROTOCOL_INFORMATION { unsigned short StructureVersion; /* +0x0000 */ unsigned short StructureSize; /* +0x0002 */ unsigned long Protocol; /* +0x0004 */ unsigned short ProtocolMajorVersion; /* +0x0008 */ unsigned short ProtocolMinorVersion; /* +0x000a */ unsigned short ProtocolRevision; /* +0x000c */ unsigned short Reserved; /* +0x000e */ unsigned long Flags; /* +0x0010 */ }; struct tagSIZE { long cx; /* +0x0000 */ long cy; /* +0x0004 */ }; struct _OCSP_SIGNED_REQUEST_INFO { unsigned char ToBeSigned[8]; /* +0x0000 02 13 00 00 */ unsigned char pOptionalSignatureInfo[4]; /* +0x0008 f3 3c 00 00 */ }; struct _FILE_SET_DEFECT_MGMT_BUFFER { unsigned char Disable; /* +0x0000 */ }; struct _TIMER_SET_COALESCABLE_TIMER_INFO { unsigned char DueTime[8]; /* +0x0000 3d 13 00 00 */ unsigned char TimerApcRoutine[4]; /* +0x0008 a2 25 00 00 */ void *TimerContext; /* +0x000c */ unsigned char WakeContext[4]; /* +0x0010 fb 3c 00 00 */ unsigned long Period; /* +0x0014 */ unsigned long TolerableDelay; /* +0x0018 */ unsigned char *PreviousState; /* +0x001c */ }; struct _FILE_SYSTEM_RECOGNITION_INFORMATION { unsigned char FileSystem[9]; /* +0x0000 18 3d 00 00 */ }; struct _UNICODE_PREFIX_TABLE { short NodeTypeCode; /* +0x0000 */ short NameLength; /* +0x0002 */ unsigned char NextPrefixTree[4]; /* +0x0004 a0 17 00 00 */ unsigned char LastNextEntry[4]; /* +0x0008 a0 17 00 00 */ }; struct tagTOUCH_HIT_TESTING_INPUT { unsigned char pointerId[4]; /* +0x0000 75 00 00 00 */ unsigned char point[8]; /* +0x0004 8a 14 00 00 */ unsigned char boundingBox[16]; /* +0x000c 63 14 00 00 */ unsigned char nonOccludedBoundingBox[16]; /* +0x001c 63 14 00 00 */ unsigned char orientation[4]; /* +0x002c 75 00 00 00 */ }; struct _CMSG_KEY_TRANS_RECIPIENT_INFO { unsigned long dwVersion; /* +0x0000 */ unsigned char RecipientId[20]; /* +0x0004 30 13 00 00 */ unsigned char KeyEncryptionAlgorithm[12]; /* +0x0018 55 14 00 00 */ unsigned char EncryptedKey[8]; /* +0x0024 02 13 00 00 */ }; struct _PROCESS_SESSION_INFORMATION { unsigned long SessionId; /* +0x0000 */ }; struct _CRYPT_PRIVATE_KEY_INFO { unsigned long Version; /* +0x0000 */ unsigned char Algorithm[12]; /* +0x0004 55 14 00 00 */ unsigned char PrivateKey[8]; /* +0x0010 02 13 00 00 */ unsigned char pAttributes[4]; /* +0x0018 f3 2c 00 00 */ }; struct _SYSTEM_CONTEXT_SWITCH_INFORMATION { unsigned long ContextSwitches; /* +0x0000 */ unsigned long FindAny; /* +0x0004 */ unsigned long FindLast; /* +0x0008 */ unsigned long FindIdeal; /* +0x000c */ unsigned long IdleAny; /* +0x0010 */ unsigned long IdleCurrent; /* +0x0014 */ unsigned long IdleLast; /* +0x0018 */ unsigned long IdleIdeal; /* +0x001c */ unsigned long PreemptAny; /* +0x0020 */ unsigned long PreemptCurrent; /* +0x0024 */ unsigned long PreemptLast; /* +0x0028 */ unsigned long SwitchToIdle; /* +0x002c */ }; struct _CONTEXT_EX { unsigned char All[8]; /* +0x0000 ec 36 00 00 */ unsigned char Legacy[8]; /* +0x0008 ec 36 00 00 */ unsigned char XState[8]; /* +0x0010 ec 36 00 00 */ }; struct _SYSTEM_DEVICE_INFORMATION { unsigned long NumberOfDisks; /* +0x0000 */ unsigned long NumberOfFloppies; /* +0x0004 */ unsigned long NumberOfCdRoms; /* +0x0008 */ unsigned long NumberOfTapes; /* +0x000c */ unsigned long NumberOfSerialPorts; /* +0x0010 */ unsigned long NumberOfParallelPorts; /* +0x0014 */ }; struct _FLS_DATA { unsigned char Entry[8]; /* +0x0000 44 1f 00 00 */ unsigned char Slots[512]; /* +0x0008 6c 3d 00 00 */ }; struct _CRYPT_PROVIDER_REFS { unsigned long cProviders; /* +0x0000 */ unsigned char rgpProviders[4]; /* +0x0004 6f 3d 00 00 */ }; struct _tagPROTOCOLFILTERDATA { unsigned long cbSize; /* +0x0000 */ unsigned char pProtocolSink[4]; /* +0x0004 72 25 00 00 */ unsigned char pProtocol[4]; /* +0x0008 af 1b 00 00 */ unsigned char pUnk[4]; /* +0x000c 7f 17 00 00 */ unsigned long dwFilterFlags; /* +0x0010 */ }; struct tagBITMAPFILEHEADER { unsigned short bfType; /* +0x0000 */ unsigned long bfSize; /* +0x0002 */ unsigned short bfReserved1; /* +0x0006 */ unsigned short bfReserved2; /* +0x0008 */ unsigned long bfOffBits; /* +0x000a */ }; struct _SERVICE_DESCRIPTIONW { unsigned char lpDescription[4]; /* +0x0000 71 04 00 00 */ }; struct _BCRYPT_DH_PARAMETER_HEADER { unsigned long cbLength; /* +0x0000 */ unsigned long dwMagic; /* +0x0004 */ unsigned long cbKeyLength; /* +0x0008 */ }; struct _IMAGE_NT_HEADERS64 { unsigned long Signature; /* +0x0000 */ unsigned char FileHeader[20]; /* +0x0004 aa 18 00 00 */ unsigned char OptionalHeader[240]; /* +0x0018 c9 29 00 00 */ }; struct _WGLSWAP { unsigned char hdc[4]; /* +0x0000 f1 1e 00 00 */ unsigned char uiFlags[4]; /* +0x0004 75 00 00 00 */ }; struct _PO_WAKE_SOURCE_HEADER { unsigned char Type[4]; /* +0x0000 ad 3d 00 00 */ unsigned long Size; /* +0x0004 */ }; struct _FIXED { unsigned short fract; /* +0x0000 */ short value; /* +0x0002 */ }; struct _CMC_DATA_INFO { unsigned long cTaggedAttribute; /* +0x0000 */ unsigned char rgTaggedAttribute[4]; /* +0x0004 07 1d 00 00 */ unsigned long cTaggedRequest; /* +0x0008 */ unsigned char rgTaggedRequest[4]; /* +0x000c 32 26 00 00 */ unsigned long cTaggedContentInfo; /* +0x0010 */ unsigned char rgTaggedContentInfo[4]; /* +0x0014 f6 3d 00 00 */ unsigned long cTaggedOtherMsg; /* +0x0018 */ unsigned char rgTaggedOtherMsg[4]; /* +0x001c f8 3d 00 00 */ }; struct _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_BEGINNING { unsigned char Data[4]; /* +0x0000 3d 19 00 00 */ unsigned long AssemblyRosterIndex; /* +0x0004 */ void *ResolutionContext; /* +0x0008 */ unsigned char Root[8]; /* +0x000c dd 12 00 00 */ unsigned char KnownRoot; /* +0x0014 */ unsigned long RootCount; /* +0x0018 */ unsigned char CancelResolution; /* +0x001c */ }; struct _MEMORY_COMBINE_INFORMATION { void *Handle; /* +0x0000 */ unsigned long PagesCombined; /* +0x0004 */ }; struct _PSINJECTDATA { unsigned long DataBytes; /* +0x0000 */ unsigned short InjectionPoint; /* +0x0004 */ unsigned short PageNumber; /* +0x0006 */ }; struct _RGNDATA { unsigned char rdh[32]; /* +0x0000 22 3e 00 00 */ unsigned char Buffer[4]; /* +0x0020 df 23 00 00 */ }; struct _tagHIT_LOGGING_INFO { unsigned long dwStructSize; /* +0x0000 */ char *lpszLoggedUrlName; /* +0x0004 */ unsigned char StartTime[16]; /* +0x0008 a6 15 00 00 */ unsigned char EndTime[16]; /* +0x0018 a6 15 00 00 */ char *lpszExtendedInfo; /* +0x0028 */ }; struct _RTL_HEAP_ENTRY::<unnamed-type-u>::<unnamed-type-s2> { unsigned long CommittedSize; /* +0x0000 */ void *FirstBlock; /* +0x0004 */ }; struct _RTL_HEAP_ENTRY::<unnamed-type-u>::<unnamed-type-s1> { unsigned long Settable; /* +0x0000 */ unsigned long Tag; /* +0x0004 */ }; struct DISPLAYCONFIG_DEVICE_INFO_HEADER { unsigned char type[4]; /* +0x0000 52 3e 00 00 */ unsigned char size[4]; /* +0x0004 75 00 00 00 */ unsigned char adapterId[8]; /* +0x0008 21 15 00 00 */ unsigned char id[4]; /* +0x0010 75 00 00 00 */ }; struct tagEMREXTFLOODFILL { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned char ptlStart[8]; /* +0x0008 9f 13 00 00 */ unsigned long crColor; /* +0x0010 */ unsigned long iMode; /* +0x0014 */ }; struct _ACTIVATION_CONTEXT_STACK { unsigned char ActiveFrame[4]; /* +0x0000 66 3e 00 00 */ unsigned char FrameListCache[8]; /* +0x0004 44 1f 00 00 */ unsigned long Flags; /* +0x000c */ unsigned long NextCookieSequenceNumber; /* +0x0010 */ unsigned long StackId; /* +0x0014 */ }; struct _EVENTLOG_FULL_INFORMATION { unsigned long dwFull; /* +0x0000 */ }; struct _CMSG_SIGNED_AND_ENVELOPED_ENCODE_INFO { unsigned long cbSize; /* +0x0000 */ unsigned char SignedInfo[28]; /* +0x0004 6b 3e 00 00 */ unsigned char EnvelopedInfo[32]; /* +0x0020 fc 12 00 00 */ }; struct _SYSTEM_THREAD_CID_PRIORITY_INFORMATION { unsigned char ClientId[8]; /* +0x0000 3e 13 00 00 */ long Priority; /* +0x0008 */ }; struct _JOURNAL_CREATE_DELETE_KEY_INFORMATION { unsigned char Action[8]; /* +0x0000 38 15 00 00 */ unsigned long long RecordNumber; /* +0x0008 */ unsigned char TimeStamp[8]; /* +0x0010 3d 13 00 00 */ unsigned char KeyPathName[8]; /* +0x0018 dd 12 00 00 */ unsigned long SecurityDescriptorLength; /* +0x0020 */ void *SecurityDescriptor; /* +0x0024 */ unsigned short ClassLength; /* +0x0028 */ void *ClassData; /* +0x002c */ unsigned char SymbolicLink; /* +0x0030 */ }; struct _XSAVE_AREA { unsigned char LegacyState[512]; /* +0x0000 a9 22 00 00 */ unsigned char Header[64]; /* +0x0200 88 3d 00 00 */ }; struct tagRAWINPUTDEVICE { unsigned short usUsagePage; /* +0x0000 */ unsigned short usUsage; /* +0x0002 */ unsigned long dwFlags; /* +0x0004 */ unsigned char hwndTarget[4]; /* +0x0008 f1 12 00 00 */ }; struct _CRYPT_VERIFY_CERT_SIGN_STRONG_PROPERTIES_INFO { unsigned char CertSignHashCNGAlgPropData[8]; /* +0x0000 02 13 00 00 */ unsigned char CertIssuerPubKeyBitLengthPropData[8]; /* +0x0008 02 13 00 00 */ }; struct _FILE_IOSTATUSBLOCK_RANGE_INFORMATION { unsigned char *IoStatusBlockRange; /* +0x0000 */ unsigned long Length; /* +0x0004 */ }; struct _KEY_WRITE_TIME_INFORMATION { unsigned char LastWriteTime[8]; /* +0x0000 3d 13 00 00 */ }; struct _FILE_OBJECTID_INFORMATION { long long FileReference; /* +0x0000 */ unsigned char ObjectId[16]; /* +0x0008 09 1c 00 00 */ unsigned char BirthVolumeId[16]; /* +0x0018 09 1c 00 00 */ unsigned char BirthObjectId[16]; /* +0x0028 09 1c 00 00 */ /* unsigned char DomainId[-32]; +0x0038 09 1c 00 00 */ unsigned char ExtendedInfo[48]; /* +0x0018 0a 1c 00 00 */ }; struct _RTL_VERIFIER_RUNTIME_FLAGS_INFORMATION { unsigned long Size; /* +0x0000 */ unsigned long ProviderFlags; /* +0x0004 */ unsigned long DebugFlags; /* +0x0008 */ unsigned long Spare; /* +0x000c */ }; struct _AUTHENTICODE_EXTRA_CERT_CHAIN_POLICY_STATUS { unsigned long cbSize; /* +0x0000 */ unsigned char fCommercial[4]; /* +0x0004 74 00 00 00 */ }; struct _RTL_USER_PROCESS_INFORMATION64 { unsigned long Length; /* +0x0000 */ long long Process; /* +0x0008 */ long long Thread; /* +0x0010 */ unsigned char ClientId[16]; /* +0x0018 20 2e 00 00 */ unsigned char ImageInformation[64]; /* +0x0028 f1 2b 00 00 */ }; struct _PROCESS_HANDLE_TRACING_QUERY { void *Handle; /* +0x0000 */ unsigned long TotalTraces; /* +0x0004 */ unsigned char HandleTrace[80]; /* +0x0008 d8 3e 00 00 */ }; struct _CPS_URLS { unsigned char pszURL[4]; /* +0x0000 71 04 00 00 */ unsigned char pAlgorithm[4]; /* +0x0004 51 1d 00 00 */ unsigned char pDigest[4]; /* +0x0008 47 13 00 00 */ }; struct _CRYPT_SEQUENCE_OF_ANY { unsigned long cValue; /* +0x0000 */ unsigned char rgValue[4]; /* +0x0004 47 13 00 00 */ }; struct _CRYPT_TIMESTAMP_REQUEST { unsigned long dwVersion; /* +0x0000 */ unsigned char HashAlgorithm[12]; /* +0x0004 55 14 00 00 */ unsigned char HashedMessage[8]; /* +0x0010 02 13 00 00 */ char *pszTSAPolicyId; /* +0x0018 */ unsigned char Nonce[8]; /* +0x001c 02 13 00 00 */ unsigned char fCertReq[4]; /* +0x0024 74 00 00 00 */ unsigned long cExtension; /* +0x0028 */ unsigned char rgExtension[4]; /* +0x002c 22 16 00 00 */ }; struct _SECURITY_DESCRIPTOR { unsigned char Revision; /* +0x0000 */ unsigned char Sbz1; /* +0x0001 */ unsigned short Control; /* +0x0002 */ void *Owner; /* +0x0004 */ void *Group; /* +0x0008 */ unsigned char Sacl[4]; /* +0x000c 43 1a 00 00 */ unsigned char Dacl[4]; /* +0x0010 43 1a 00 00 */ }; struct _SYSTEM_PROCESSOR_PROFILE_CONTROL_AREA { unsigned char ProcessorProfileControlArea[4]; /* +0x0000 e7 3e 00 00 */ unsigned char Allocate; /* +0x0004 */ }; struct _WIN32_FIND_STREAM_DATA { unsigned char StreamSize[8]; /* +0x0000 3d 13 00 00 */ unsigned char cStreamName[592]; /* +0x0008 ea 3e 00 00 */ }; struct tagPARAMDATA { unsigned char szName[4]; /* +0x0000 71 04 00 00 */ unsigned short vt; /* +0x0004 */ }; struct _JOBOBJECT_WAKE_INFORMATION { unsigned long long NotificationChannel; /* +0x0000 */ unsigned char WakeCounters[32]; /* +0x0008 0f 3f 00 00 */ }; struct _KEY_OPEN_SUBKEYS_INFORMATION { unsigned long Count; /* +0x0000 */ unsigned char KeyArray[12]; /* +0x0004 13 3f 00 00 */ }; struct _CRYPT_ENCRYPTED_PRIVATE_KEY_INFO { unsigned char EncryptionAlgorithm[12]; /* +0x0000 55 14 00 00 */ unsigned char EncryptedPrivateKey[8]; /* +0x000c 02 13 00 00 */ }; struct _EV_EXTRA_CERT_CHAIN_POLICY_PARA { unsigned long cbSize; /* +0x0000 */ unsigned long dwRootProgramQualifierFlags; /* +0x0004 */ }; struct _IMAGE_RESOURCE_DIR_STRING_U { unsigned short Length; /* +0x0000 */ unsigned char NameString[2]; /* +0x0002 f7 13 00 00 */ }; struct _POWER_PLATFORM_INFORMATION { unsigned char Role[4]; /* +0x0000 05 33 00 00 */ unsigned char AoAc; /* +0x0004 */ }; struct _USER_MARSHAL_CB { unsigned long Flags; /* +0x0000 */ unsigned char pStubMsg[4]; /* +0x0004 05 1a 00 00 */ unsigned char pReserve[4]; /* +0x0008 39 19 00 00 */ unsigned long Signature; /* +0x000c */ unsigned char CBType[4]; /* +0x0010 2a 3f 00 00 */ unsigned char pFormat[4]; /* +0x0014 39 19 00 00 */ unsigned char pTypeFormat[4]; /* +0x0018 39 19 00 00 */ }; struct _CERT_REGISTRY_STORE_CLIENT_GPT_PARA { unsigned char hKeyBase[4]; /* +0x0000 72 19 00 00 */ unsigned char pwszRegPath[4]; /* +0x0004 71 04 00 00 */ }; struct _EXTENDED_ENCRYPTED_DATA_INFO { unsigned long ExtendedCode; /* +0x0000 */ unsigned long Length; /* +0x0004 */ unsigned long Flags; /* +0x0008 */ unsigned long Reserved; /* +0x000c */ }; struct _PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY { unsigned long Flags; /* +0x0000 */ /* unsigned char RaiseExceptionOnInvalidHandleReference[0]; +0x0000 17 13 00 00 */ /* unsigned char HandleExceptionsPermanentlyEnabled[0]; +0x0000 7e 18 00 00 */ unsigned char ReservedFlags[4]; /* +0x0000 b3 19 00 00 */ }; struct tagTTPOLYCURVE { unsigned short wType; /* +0x0000 */ unsigned short cpfx; /* +0x0002 */ unsigned char apfx[8]; /* +0x0004 49 3f 00 00 */ }; struct _CRYPT_PKCS12_PBE_PARAMS { unsigned char iIterations[4]; /* +0x0000 74 00 00 00 */ unsigned long cbSalt; /* +0x0004 */ }; struct _MEMORY_WORKING_SET_EX_INFORMATION { void *VirtualAddress; /* +0x0000 */ }; struct _MEMORY_WORKING_SET_EX_INFORMATION::<unnamed-type-u1> { /* unsigned char VirtualAttributes[0]; +0x0000 56 3f 00 00 */ unsigned long Long; /* +0x0000 */ }; struct _TP_POOL_STACK_INFORMATION { unsigned long StackReserve; /* +0x0000 */ unsigned long StackCommit; /* +0x0004 */ }; struct __NCRYPT_UI_POLICY { unsigned long dwVersion; /* +0x0000 */ unsigned long dwFlags; /* +0x0004 */ unsigned char pszCreationTitle[4]; /* +0x0008 c0 13 00 00 */ unsigned char pszFriendlyName[4]; /* +0x000c c0 13 00 00 */ unsigned char pszDescription[4]; /* +0x0010 c0 13 00 00 */ }; struct _LDRP_CSLIST { unsigned char Tail[4]; /* +0x0000 5a 1a 00 00 */ }; struct _RPC_SECURITY_QOS_V4_W { unsigned long Version; /* +0x0000 */ unsigned long Capabilities; /* +0x0004 */ unsigned long IdentityTracking; /* +0x0008 */ unsigned long ImpersonationType; /* +0x000c */ unsigned long AdditionalSecurityInfoType; /* +0x0010 */ }; struct _NT_TIB32 { unsigned long ExceptionList; /* +0x0000 */ unsigned long StackBase; /* +0x0004 */ unsigned long StackLimit; /* +0x0008 */ unsigned long SubSystemTib; /* +0x000c */ unsigned long FiberData; /* +0x0010 */ unsigned long Version; /* +0x0010 */ unsigned long ArbitraryUserPointer; /* +0x0014 */ unsigned long Self; /* +0x0018 */ }; struct _CRYPTNET_URL_CACHE_RESPONSE_INFO { unsigned long cbSize; /* +0x0000 */ unsigned short wResponseType; /* +0x0004 */ unsigned short wResponseFlags; /* +0x0006 */ unsigned char LastModifiedTime[8]; /* +0x0008 31 13 00 00 */ unsigned long dwMaxAge; /* +0x0010 */ unsigned char pwszETag[4]; /* +0x0014 c0 13 00 00 */ unsigned long dwProxyId; /* +0x0018 */ }; struct _RESOURCEMANAGER_COMPLETION_INFORMATION { void *IoCompletionPortHandle; /* +0x0000 */ unsigned long CompletionKey; /* +0x0004 */ }; struct _TXFS_MODIFY_RM { unsigned long Flags; /* +0x0000 */ unsigned long LogContainerCountMax; /* +0x0004 */ unsigned long LogContainerCountMin; /* +0x0008 */ unsigned long LogContainerCount; /* +0x000c */ unsigned long LogGrowthIncrement; /* +0x0010 */ unsigned long LogAutoShrinkPercentage; /* +0x0014 */ unsigned long long Reserved; /* +0x0018 */ unsigned short LoggingMode; /* +0x0020 */ }; struct _ALPC_SECURITY_ATTR { unsigned long Flags; /* +0x0000 */ unsigned char QoS[4]; /* +0x0004 a7 3f 00 00 */ void *ContextHandle; /* +0x0008 */ }; struct _SYSTEM_VERIFIER_FAULTS_INFORMATION { unsigned long Probability; /* +0x0000 */ unsigned long MaxProbability; /* +0x0004 */ unsigned char PoolTags[8]; /* +0x0008 dd 12 00 00 */ unsigned char Applications[8]; /* +0x0010 dd 12 00 00 */ }; struct _ACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION { unsigned long ElementCount; /* +0x0000 */ /* unsigned char Elements[0]; +0x0004 bf 3f 00 00 */ }; struct tagXFORM { unsigned char eM11[4]; /* +0x0000 40 00 00 00 */ unsigned char eM12[4]; /* +0x0004 40 00 00 00 */ unsigned char eM21[4]; /* +0x0008 40 00 00 00 */ unsigned char eM22[4]; /* +0x000c 40 00 00 00 */ unsigned char eDx[4]; /* +0x0010 40 00 00 00 */ unsigned char eDy[4]; /* +0x0014 40 00 00 00 */ }; struct _NCRYPT_KEY_BLOB_HEADER { unsigned long cbSize; /* +0x0000 */ unsigned long dwMagic; /* +0x0004 */ unsigned long cbAlgName; /* +0x0008 */ unsigned long cbKeyData; /* +0x000c */ unsigned long cbKeyName; /* +0x0010 */ }; struct _ALPC_DATA_VIEW_ATTR { unsigned long Flags; /* +0x0000 */ void *SectionHandle; /* +0x0004 */ void *ViewBase; /* +0x0008 */ unsigned long ViewSize; /* +0x000c */ }; struct _CM_PNP_BIOS_DEVICE_NODE { unsigned short Size; /* +0x0000 */ unsigned char Node; /* +0x0002 */ unsigned long ProductId; /* +0x0003 */ unsigned char DeviceType[3]; /* +0x0007 8d 13 00 00 */ unsigned short DeviceAttributes; /* +0x000a */ }; struct _PLUGPLAY_CONTROL_TARGET_RELATION_DATA { void *UserFileHandle; /* +0x0000 */ long Status; /* +0x0004 */ unsigned long DeviceInstanceLen; /* +0x0008 */ unsigned char DeviceInstance[4]; /* +0x000c 71 04 00 00 */ }; struct _FILE_POSITION_INFORMATION { unsigned char CurrentByteOffset[8]; /* +0x0000 3d 13 00 00 */ }; struct DISPLAYCONFIG_SOURCE_DEVICE_NAME { unsigned char header[20]; /* +0x0000 ca 24 00 00 */ unsigned char viewGdiDeviceName[64]; /* +0x0014 a5 15 00 00 */ }; struct _PLUGPLAY_CONTROL_DEVICE_RELATIONS_DATA { unsigned char DeviceInstance[8]; /* +0x0000 dd 12 00 00 */ unsigned char Operation[4]; /* +0x0008 8c 34 00 00 */ unsigned long BufferLength; /* +0x000c */ unsigned char Buffer[4]; /* +0x0010 71 04 00 00 */ }; struct _MANAGEDAPPLICATION { unsigned char pszPackageName[4]; /* +0x0000 71 04 00 00 */ unsigned char pszPublisher[4]; /* +0x0004 71 04 00 00 */ unsigned long dwVersionHi; /* +0x0008 */ unsigned long dwVersionLo; /* +0x000c */ unsigned long dwRevision; /* +0x0010 */ unsigned char GpoId[16]; /* +0x0014 dc 14 00 00 */ unsigned char pszPolicyName[4]; /* +0x0024 71 04 00 00 */ unsigned char ProductId[16]; /* +0x0028 dc 14 00 00 */ unsigned short Language; /* +0x0038 */ unsigned char pszOwner[4]; /* +0x003c 71 04 00 00 */ unsigned char pszCompany[4]; /* +0x0040 71 04 00 00 */ unsigned char pszComments[4]; /* +0x0044 71 04 00 00 */ unsigned char pszContact[4]; /* +0x0048 71 04 00 00 */ unsigned char pszSupportUrl[4]; /* +0x004c 71 04 00 00 */ unsigned long dwPathType; /* +0x0050 */ unsigned char bInstalled[4]; /* +0x0054 74 00 00 00 */ }; struct tagEMRCREATEPALETTE { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned long ihPal; /* +0x0008 */ unsigned char lgpl[8]; /* +0x000c 41 35 00 00 */ }; struct tagEMRCREATEBRUSHINDIRECT { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned long ihBrush; /* +0x0008 */ unsigned char lb[12]; /* +0x000c ef 18 00 00 */ }; struct _JOBOBJECT_BASIC_UI_RESTRICTIONS { unsigned long UIRestrictionsClass; /* +0x0000 */ }; struct tagSTYLEBUFA { unsigned long dwStyle; /* +0x0000 */ unsigned char szDescription[32]; /* +0x0004 43 23 00 00 */ }; struct _CERT_SIMPLE_CHAIN { unsigned long cbSize; /* +0x0000 */ unsigned char TrustStatus[8]; /* +0x0004 ba 13 00 00 */ unsigned long cElement; /* +0x000c */ unsigned char rgpElement[4]; /* +0x0010 22 40 00 00 */ unsigned char pTrustListInfo[4]; /* +0x0014 6b 31 00 00 */ unsigned char fHasRevocationFreshnessTime[4]; /* +0x0018 74 00 00 00 */ unsigned long dwRevocationFreshnessTime; /* +0x001c */ }; struct _FILE_NUMA_NODE_INFORMATION { unsigned short NodeNumber; /* +0x0000 */ }; struct pvalueA { char *pv_valuename; /* +0x0000 */ unsigned char pv_valuelen[4]; /* +0x0004 74 00 00 00 */ void *pv_value_context; /* +0x0008 */ unsigned long pv_type; /* +0x000c */ }; struct _RTL_DYNAMIC_HASH_TABLE_ENUMERATOR { unsigned char HashEntry[12]; /* +0x0000 cf 36 00 00 */ unsigned char ChainHead[4]; /* +0x000c 5d 2d 00 00 */ unsigned long BucketIndex; /* +0x0010 */ }; struct tagCY { unsigned long Lo; /* +0x0000 */ long Hi; /* +0x0004 */ long long int64; /* +0x0000 */ }; struct _CSTRING { unsigned short Length; /* +0x0000 */ unsigned short MaximumLength; /* +0x0002 */ unsigned char Buffer[4]; /* +0x0004 62 14 00 00 */ }; struct _SECURITY_CAPABILITIES { void *AppContainerSid; /* +0x0000 */ unsigned char Capabilities[4]; /* +0x0004 be 1b 00 00 */ unsigned long CapabilityCount; /* +0x0008 */ unsigned long Reserved; /* +0x000c */ }; struct _PROCESS_DEVICEMAP_INFORMATION { /* unsigned char Set[0]; +0x0000 35 40 00 00 */ unsigned char Query[36]; /* +0x0000 36 40 00 00 */ }; struct _PROCESS_WINDOW_INFORMATION { unsigned long WindowFlags; /* +0x0000 */ unsigned short WindowTitleLength; /* +0x0004 */ unsigned char WindowTitle[2]; /* +0x0006 f7 13 00 00 */ }; struct _TRANSACTION_NOTIFICATION { void *TransactionKey; /* +0x0000 */ unsigned long TransactionNotification; /* +0x0004 */ unsigned char TmVirtualClock[8]; /* +0x0008 3d 13 00 00 */ unsigned long ArgumentLength; /* +0x0010 */ }; struct tagBITMAPINFO { unsigned char bmiHeader[40]; /* +0x0000 44 31 00 00 */ unsigned char bmiColors[4]; /* +0x0028 41 40 00 00 */ }; struct _CERT_NAME_CONSTRAINTS_INFO { unsigned long cPermittedSubtree; /* +0x0000 */ unsigned char rgPermittedSubtree[4]; /* +0x0004 48 40 00 00 */ unsigned long cExcludedSubtree; /* +0x0008 */ unsigned char rgExcludedSubtree[4]; /* +0x000c 48 40 00 00 */ }; struct _CRYPT_PASSWORD_CREDENTIALSA { unsigned long cbSize; /* +0x0000 */ char *pszUsername; /* +0x0004 */ char *pszPassword; /* +0x0008 */ }; struct _TXFS_QUERY_RM_INFORMATION { unsigned long BytesRequired; /* +0x0000 */ unsigned long long TailLsn; /* +0x0008 */ unsigned long long CurrentLsn; /* +0x0010 */ unsigned long long ArchiveTailLsn; /* +0x0018 */ unsigned long long LogContainerSize; /* +0x0020 */ unsigned char HighestVirtualClock[8]; /* +0x0028 3d 13 00 00 */ unsigned long LogContainerCount; /* +0x0030 */ unsigned long LogContainerCountMax; /* +0x0034 */ unsigned long LogContainerCountMin; /* +0x0038 */ unsigned long LogGrowthIncrement; /* +0x003c */ unsigned long LogAutoShrinkPercentage; /* +0x0040 */ unsigned long Flags; /* +0x0044 */ unsigned short LoggingMode; /* +0x0048 */ unsigned short Reserved; /* +0x004a */ unsigned long RmState; /* +0x004c */ unsigned long long LogCapacity; /* +0x0050 */ unsigned long long LogFree; /* +0x0058 */ unsigned long long TopsSize; /* +0x0060 */ unsigned long long TopsUsed; /* +0x0068 */ unsigned long long TransactionCount; /* +0x0070 */ unsigned long long OnePCCount; /* +0x0078 */ unsigned long long TwoPCCount; /* +0x0080 */ unsigned long long NumberLogFileFull; /* +0x0088 */ unsigned long long OldestTransactionAge; /* +0x0090 */ unsigned char RMName[16]; /* +0x0098 dc 14 00 00 */ unsigned long TmLogPathOffset; /* +0x00a8 */ }; struct _COMMTIMEOUTS { unsigned long ReadIntervalTimeout; /* +0x0000 */ unsigned long ReadTotalTimeoutMultiplier; /* +0x0004 */ unsigned long ReadTotalTimeoutConstant; /* +0x0008 */ unsigned long WriteTotalTimeoutMultiplier; /* +0x000c */ unsigned long WriteTotalTimeoutConstant; /* +0x0010 */ }; struct _CMSG_CMS_SIGNER_INFO { unsigned long dwVersion; /* +0x0000 */ unsigned char SignerId[20]; /* +0x0004 30 13 00 00 */ unsigned char HashAlgorithm[12]; /* +0x0018 55 14 00 00 */ unsigned char HashEncryptionAlgorithm[12]; /* +0x0024 55 14 00 00 */ unsigned char EncryptedHash[8]; /* +0x0030 02 13 00 00 */ unsigned char AuthAttrs[8]; /* +0x0038 ea 18 00 00 */ unsigned char UnauthAttrs[8]; /* +0x0040 ea 18 00 00 */ }; struct IMAGE_AUX_SYMBOL_TOKEN_DEF { unsigned char bAuxType; /* +0x0000 */ unsigned char bReserved; /* +0x0001 */ unsigned long SymbolTableIndex; /* +0x0002 */ unsigned char rgbReserved[12]; /* +0x0006 6e 15 00 00 */ }; struct _REPARSE_GUID_DATA_BUFFER { unsigned long ReparseTag; /* +0x0000 */ unsigned short ReparseDataLength; /* +0x0004 */ unsigned short Reserved; /* +0x0006 */ unsigned char ReparseGuid[20]; /* +0x0008 dc 14 00 00 */ }; struct _RTL_PROCESS_BACKTRACES_CONTROL { unsigned long ControlCode; /* +0x0000 */ unsigned long ControlSize; /* +0x0004 */ /* unsigned char ControlData[0]; +0x0008 f9 12 00 00 */ unsigned char DatabaseCreate[12]; /* +0x0008 98 40 00 00 */ }; struct tagLOGCOLORSPACEA { unsigned long lcsSignature; /* +0x0000 */ unsigned long lcsVersion; /* +0x0004 */ unsigned long lcsSize; /* +0x0008 */ long lcsCSType; /* +0x000c */ long lcsIntent; /* +0x0010 */ unsigned char lcsEndpoints[36]; /* +0x0014 c4 2c 00 00 */ unsigned long lcsGammaRed; /* +0x0038 */ unsigned long lcsGammaGreen; /* +0x003c */ unsigned long lcsGammaBlue; /* +0x0040 */ unsigned char lcsFilename[260]; /* +0x0044 27 24 00 00 */ }; struct _TOKEN_PRIMARY_GROUP { void *PrimaryGroup; /* +0x0000 */ }; struct _wireSAFEARR_DISPATCH { unsigned long Size; /* +0x0000 */ unsigned char apDispatch[4]; /* +0x0004 80 31 00 00 */ }; struct _SECURITY_QUALITY_OF_SERVICE { unsigned long Length; /* +0x0000 */ unsigned char ImpersonationLevel[4]; /* +0x0004 05 2e 00 00 */ unsigned char ContextTrackingMode; /* +0x0008 */ unsigned char EffectiveOnly; /* +0x0009 */ }; struct tagPELARRAY { long paXCount; /* +0x0000 */ long paYCount; /* +0x0004 */ long paXExt; /* +0x0008 */ long paYExt; /* +0x000c */ unsigned char paRGBs; /* +0x0010 */ }; struct _IMAGE_AUX_SYMBOL::<unnamed-type-CRC> { unsigned long crc; /* +0x0000 */ unsigned char rgbReserved[14]; /* +0x0004 03 41 00 00 */ }; struct _IMAGE_AUX_SYMBOL::<unnamed-type-Section> { unsigned long Length; /* +0x0000 */ unsigned short NumberOfRelocations; /* +0x0004 */ unsigned short NumberOfLinenumbers; /* +0x0006 */ unsigned long CheckSum; /* +0x0008 */ short Number; /* +0x000c */ unsigned char Selection; /* +0x000e */ unsigned char bReserved; /* +0x000f */ short HighNumber; /* +0x0010 */ }; struct _IMAGE_AUX_SYMBOL::<unnamed-type-File> { unsigned char Name[18]; /* +0x0000 08 41 00 00 */ }; struct _IMAGE_AUX_SYMBOL::<unnamed-type-Sym> { unsigned long TagIndex; /* +0x0000 */ }; struct _IMAGE_AUX_SYMBOL::<unnamed-type-Sym>::<unnamed-type-FcnAry>::<unnamed-type-Array> { unsigned char Dimension[8]; /* +0x0000 b0 2d 00 00 */ }; struct _IMAGE_AUX_SYMBOL::<unnamed-type-Sym>::<unnamed-type-FcnAry>::<unnamed-type-Function> { unsigned long PointerToLinenumber; /* +0x0000 */ unsigned long PointerToNextFunction; /* +0x0004 */ }; struct _IMAGE_AUX_SYMBOL::<unnamed-type-Sym>::<unnamed-type-Misc>::<unnamed-type-LnSz> { unsigned short Linenumber; /* +0x0000 */ unsigned short Size; /* +0x0002 */ }; struct _PROCESS_DEVICEMAP_INFORMATION_EX { /* unsigned char Set[0]; +0x0000 1e 41 00 00 */ unsigned char Query[36]; /* +0x0000 1f 41 00 00 */ unsigned long Flags; /* +0x0024 */ }; struct _FILE_LINK_ENTRY_INFORMATION { unsigned long NextEntryOffset; /* +0x0000 */ long long ParentFileId; /* +0x0008 */ unsigned long FileNameLength; /* +0x0010 */ unsigned char FileName[4]; /* +0x0014 f7 13 00 00 */ }; struct _FP_IEEE_VALUE::<unnamed-type-Control> { /* unsigned char RoundingMode[0]; +0x0000 09 35 00 00 */ /* unsigned char Inexact[0]; +0x0000 7f 18 00 00 */ /* unsigned char Underflow[0]; +0x0000 27 1e 00 00 */ /* unsigned char Overflow[0]; +0x0000 42 1e 00 00 */ /* unsigned char ZeroDivide[0]; +0x0000 ce 23 00 00 */ /* unsigned char InvalidOperation[0]; +0x0000 ff 1e 00 00 */ /* unsigned char OperandValid[0]; +0x0000 00 1f 00 00 */ /* unsigned char Format[0]; +0x0000 85 13 00 00 */ /* unsigned char Precision[0]; +0x0000 86 13 00 00 */ /* unsigned char Operation[0]; +0x0000 24 41 00 00 */ /* unsigned char Spare[0]; +0x0000 25 41 00 00 */ unsigned char HardwareException[4]; /* +0x0000 95 18 00 00 */ }; struct _FP_IEEE_VALUE::<unnamed-type-Value> { short I16Value; /* +0x0000 */ unsigned short U16Value; /* +0x0000 */ long I32Value; /* +0x0000 */ unsigned long U32Value; /* +0x0000 */ void *StringValue; /* +0x0000 */ unsigned long CompareValue; /* +0x0000 */ /* unsigned char Fp32Value[0]; +0x0000 28 41 00 00 */ /* unsigned char I64Value[0]; +0x0000 3d 13 00 00 */ /* unsigned char U64Value[0]; +0x0000 fd 22 00 00 */ /* unsigned char Fp64Value[0]; +0x0000 29 41 00 00 */ /* unsigned char Fp80Value[0]; +0x0000 83 1e 00 00 */ unsigned char Fp128Value[16]; /* +0x0000 18 1c 00 00 */ }; struct tagCURSORSHAPE { unsigned char xHotSpot[4]; /* +0x0000 74 00 00 00 */ unsigned char yHotSpot[4]; /* +0x0004 74 00 00 00 */ unsigned char cx[4]; /* +0x0008 74 00 00 00 */ unsigned char cy[4]; /* +0x000c 74 00 00 00 */ unsigned char cbWidth[4]; /* +0x0010 74 00 00 00 */ unsigned char Planes; /* +0x0014 */ unsigned char BitsPixel; /* +0x0015 */ }; struct tagI_RpcProxyCallbackInterface { unsigned char IsValidMachineFn[4]; /* +0x0000 db 2f 00 00 */ unsigned char GetClientAddressFn[4]; /* +0x0004 ca 3b 00 00 */ unsigned char GetConnectionTimeoutFn[4]; /* +0x0008 1e 21 00 00 */ unsigned char PerformCalloutFn[4]; /* +0x000c be 22 00 00 */ unsigned char FreeCalloutStateFn[4]; /* +0x0010 44 2d 00 00 */ unsigned char GetClientSessionAndResourceUUIDFn[4]; /* +0x0014 32 41 00 00 */ unsigned char ProxyFilterIfFn[4]; /* +0x0018 35 41 00 00 */ unsigned char RpcProxyUpdatePerfCounterFn[4]; /* +0x001c a9 2c 00 00 */ unsigned char RpcProxyUpdatePerfCounterBackendServerFn[4]; /* +0x0020 c2 2e 00 00 */ }; struct _tagStartParam { unsigned char iid[16]; /* +0x0000 dc 14 00 00 */ unsigned char pIBindCtx[4]; /* +0x0010 44 1d 00 00 */ unsigned char pItf[4]; /* +0x0014 7f 17 00 00 */ }; struct _QUERY_SERVICE_CONFIGA { unsigned long dwServiceType; /* +0x0000 */ unsigned long dwStartType; /* +0x0004 */ unsigned long dwErrorControl; /* +0x0008 */ char *lpBinaryPathName; /* +0x000c */ char *lpLoadOrderGroup; /* +0x0010 */ unsigned long dwTagId; /* +0x0014 */ char *lpDependencies; /* +0x0018 */ char *lpServiceStartName; /* +0x001c */ char *lpDisplayName; /* +0x0020 */ }; struct _XSAVE_FEATURE { unsigned long FeatureId; /* +0x0000 */ /* unsigned char Vendors[0]; +0x0008 6a 41 00 00 */ unsigned long long Unused; /* +0x0008 */ }; struct _ALPC_MESSAGE_ATTRIBUTES { unsigned long AllocatedAttributes; /* +0x0000 */ unsigned long ValidAttributes; /* +0x0004 */ }; struct _FILE_PROCESS_IDS_USING_FILE_INFORMATION { unsigned long NumberOfProcessIdsInList; /* +0x0000 */ unsigned char ProcessIdList[4]; /* +0x0004 f6 12 00 00 */ }; struct _CM_MONITOR_DEVICE_DATA { unsigned short Version; /* +0x0000 */ unsigned short Revision; /* +0x0002 */ unsigned short HorizontalScreenSize; /* +0x0004 */ unsigned short VerticalScreenSize; /* +0x0006 */ unsigned short HorizontalResolution; /* +0x0008 */ unsigned short VerticalResolution; /* +0x000a */ unsigned short HorizontalDisplayTimeLow; /* +0x000c */ unsigned short HorizontalDisplayTime; /* +0x000e */ unsigned short HorizontalDisplayTimeHigh; /* +0x0010 */ unsigned short HorizontalBackPorchLow; /* +0x0012 */ unsigned short HorizontalBackPorch; /* +0x0014 */ unsigned short HorizontalBackPorchHigh; /* +0x0016 */ unsigned short HorizontalFrontPorchLow; /* +0x0018 */ unsigned short HorizontalFrontPorch; /* +0x001a */ unsigned short HorizontalFrontPorchHigh; /* +0x001c */ unsigned short HorizontalSyncLow; /* +0x001e */ unsigned short HorizontalSync; /* +0x0020 */ unsigned short HorizontalSyncHigh; /* +0x0022 */ unsigned short VerticalBackPorchLow; /* +0x0024 */ unsigned short VerticalBackPorch; /* +0x0026 */ unsigned short VerticalBackPorchHigh; /* +0x0028 */ unsigned short VerticalFrontPorchLow; /* +0x002a */ unsigned short VerticalFrontPorch; /* +0x002c */ unsigned short VerticalFrontPorchHigh; /* +0x002e */ unsigned short VerticalSyncLow; /* +0x0030 */ unsigned short VerticalSync; /* +0x0032 */ unsigned short VerticalSyncHigh; /* +0x0034 */ }; struct _IMAGE_RESOURCE_DIRECTORY_STRING { unsigned short Length; /* +0x0000 */ unsigned char NameString[2]; /* +0x0002 df 23 00 00 */ }; struct _PORT_DATA_INFORMATION { unsigned long CountDataEntries; /* +0x0000 */ unsigned char DataEntries[8]; /* +0x0004 8f 41 00 00 */ }; struct _ALPC_HANDLE_ATTR { unsigned long Flags; /* +0x0000 */ void *Handle; /* +0x0004 */ unsigned long ObjectType; /* +0x0008 */ unsigned long DesiredAccess; /* +0x000c */ }; struct _ACTIVATION_CONTEXT_SECTION_KEYED_DATA_2600 { unsigned long Size; /* +0x0000 */ unsigned long DataFormatVersion; /* +0x0004 */ void *Data; /* +0x0008 */ unsigned long Length; /* +0x000c */ void *SectionGlobalData; /* +0x0010 */ unsigned long SectionGlobalDataLength; /* +0x0014 */ void *SectionBase; /* +0x0018 */ unsigned long SectionTotalLength; /* +0x001c */ unsigned char ActivationContext[4]; /* +0x0020 69 17 00 00 */ unsigned long AssemblyRosterIndex; /* +0x0024 */ unsigned long Flags; /* +0x0028 */ }; struct _SERVICE_TRIGGER_INFO { unsigned long cTriggers; /* +0x0000 */ unsigned char pTriggers[4]; /* +0x0004 87 1b 00 00 */ unsigned char *pReserved; /* +0x0008 */ }; struct _PROCESS_WS_WATCH_INFORMATION { void *FaultingPc; /* +0x0000 */ void *FaultingVa; /* +0x0004 */ }; struct _COVERAGE_UNLOADED_MODULE_ENTRY { unsigned char NextEntry[8]; /* +0x0000 44 1f 00 00 */ unsigned char BaseDllName[8]; /* +0x0008 dd 12 00 00 */ unsigned char FullDllName[8]; /* +0x0010 dd 12 00 00 */ unsigned long CoverageSectionSize; /* +0x0018 */ void *CoverageSection; /* +0x001c */ }; struct _tagCODEBASEHOLD { unsigned long cbSize; /* +0x0000 */ unsigned char szDistUnit[4]; /* +0x0004 71 04 00 00 */ unsigned char szCodeBase[4]; /* +0x0008 71 04 00 00 */ unsigned long dwVersionMS; /* +0x000c */ unsigned long dwVersionLS; /* +0x0010 */ unsigned long dwStyle; /* +0x0014 */ }; struct tagOBJREF { unsigned long signature; /* +0x0000 */ unsigned long flags; /* +0x0004 */ unsigned char iid[80]; /* +0x0008 dc 14 00 00 */ }; struct tagPARAMDESCEX { unsigned long cBytes; /* +0x0000 */ unsigned char varDefaultValue[16]; /* +0x0008 3b 18 00 00 */ }; enum tagMSHCTX { MSHCTX_LOCAL = 0, MSHCTX_NOSHAREDMEM = 1, MSHCTX_DIFFERENTMACHINE = 2, MSHCTX_INPROC = 3, MSHCTX_CROSSCTX = 4 }; struct _LOCALMANAGEDAPPLICATION { unsigned char pszDeploymentName[4]; /* +0x0000 71 04 00 00 */ unsigned char pszPolicyName[4]; /* +0x0004 71 04 00 00 */ unsigned char pszProductId[4]; /* +0x0008 71 04 00 00 */ unsigned long dwState; /* +0x000c */ }; struct _RTLP_PROCESS_REFLECTION_CONTEXT { unsigned long ReflectionContextSize; /* +0x0000 */ unsigned long ReflectionFlags; /* +0x0004 */ unsigned char ReflectionRoutine[4]; /* +0x0008 cc 19 00 00 */ void *ReflectionParameter; /* +0x000c */ void *ReflectedProcessCreatedEvent; /* +0x0010 */ void *ReflectedProcessHandlesDuplicatedEvent; /* +0x0014 */ void *ReflectionStartEvent; /* +0x0018 */ unsigned char ReflectionInformation[16]; /* +0x001c cc 1e 00 00 */ }; struct _CRYPT_URL_INFO { unsigned long cbSize; /* +0x0000 */ unsigned long dwSyncDeltaTime; /* +0x0004 */ unsigned long cGroup; /* +0x0008 */ unsigned long *rgcGroupEntry; /* +0x000c */ }; struct pvalueW { unsigned char pv_valuename[4]; /* +0x0000 71 04 00 00 */ unsigned char pv_valuelen[4]; /* +0x0004 74 00 00 00 */ void *pv_value_context; /* +0x0008 */ unsigned long pv_type; /* +0x000c */ }; struct _RPC_SYNTAX_IDENTIFIER { unsigned char SyntaxGUID[16]; /* +0x0000 dc 14 00 00 */ unsigned char SyntaxVersion[4]; /* +0x0010 b6 29 00 00 */ }; struct _CRYPT_IMAGE_REG { unsigned char pszImage[4]; /* +0x0000 71 04 00 00 */ unsigned long cInterfaces; /* +0x0004 */ unsigned char rgpInterfaces[4]; /* +0x0008 21 42 00 00 */ }; struct _PRIV_SCM_INFO { long lThreadID; /* +0x0000 */ unsigned char pwszWinstaDesktop[4]; /* +0x0004 71 04 00 00 */ unsigned long long ProcessSignature; /* +0x0008 */ unsigned char pEnvBlock[4]; /* +0x0010 71 04 00 00 */ unsigned long EnvBlockLength; /* +0x0014 */ }; struct _NETRESOURCEA { unsigned long dwScope; /* +0x0000 */ unsigned long dwType; /* +0x0004 */ unsigned long dwDisplayType; /* +0x0008 */ unsigned long dwUsage; /* +0x000c */ char *lpLocalName; /* +0x0010 */ char *lpRemoteName; /* +0x0014 */ char *lpComment; /* +0x0018 */ char *lpProvider; /* +0x001c */ }; struct tagRAWINPUTHEADER { unsigned long dwType; /* +0x0000 */ unsigned long dwSize; /* +0x0004 */ void *hDevice; /* +0x0008 */ unsigned char wParam[4]; /* +0x000c 75 00 00 00 */ }; struct _KEY_FULL_INFORMATION { unsigned char LastWriteTime[8]; /* +0x0000 3d 13 00 00 */ unsigned long TitleIndex; /* +0x0008 */ unsigned long ClassOffset; /* +0x000c */ unsigned long ClassLength; /* +0x0010 */ unsigned long SubKeys; /* +0x0014 */ unsigned long MaxNameLen; /* +0x0018 */ unsigned long MaxClassLen; /* +0x001c */ unsigned long Values; /* +0x0020 */ unsigned long MaxValueNameLen; /* +0x0024 */ unsigned long MaxValueDataLen; /* +0x0028 */ unsigned char Class[4]; /* +0x002c f7 13 00 00 */ }; struct _SYSTEM_BASIC_INFORMATION { unsigned long Reserved; /* +0x0000 */ unsigned long TimerResolution; /* +0x0004 */ unsigned long PageSize; /* +0x0008 */ unsigned long NumberOfPhysicalPages; /* +0x000c */ unsigned long LowestPhysicalPageNumber; /* +0x0010 */ unsigned long HighestPhysicalPageNumber; /* +0x0014 */ unsigned long AllocationGranularity; /* +0x0018 */ unsigned long MinimumUserModeAddress; /* +0x001c */ unsigned long MaximumUserModeAddress; /* +0x0020 */ unsigned long ActiveProcessorsAffinityMask; /* +0x0024 */ char NumberOfProcessors; /* +0x0028 */ }; struct _FILE_SFIO_VOLUME_INFORMATION { unsigned long MaximumRequestsPerPeriod; /* +0x0000 */ unsigned long MinimumPeriod; /* +0x0004 */ unsigned long MinimumTransferSize; /* +0x0008 */ }; struct _HEAP_BLOCK_SETTABLE_INFORMATION { unsigned long Settable; /* +0x0000 */ unsigned short TagIndex; /* +0x0004 */ unsigned short AllocatorBackTraceIndex; /* +0x0006 */ }; struct _CERT_POLICY_ID { unsigned long cCertPolicyElementId; /* +0x0000 */ unsigned char rgpszCertPolicyElementId[4]; /* +0x0004 c6 23 00 00 */ }; struct _KLDR_DATA_TABLE_ENTRY32 { unsigned char InLoadOrderLinks[8]; /* +0x0000 d9 1e 00 00 */ unsigned long __Undefined1; /* +0x0008 */ unsigned long __Undefined2; /* +0x000c */ unsigned long __Undefined3; /* +0x0010 */ unsigned long NonPagedDebugInfo; /* +0x0014 */ unsigned long DllBase; /* +0x0018 */ unsigned long EntryPoint; /* +0x001c */ unsigned long SizeOfImage; /* +0x0020 */ unsigned char FullDllName[8]; /* +0x0024 8b 17 00 00 */ unsigned char BaseDllName[8]; /* +0x002c 8b 17 00 00 */ unsigned long Flags; /* +0x0034 */ unsigned short LoadCount; /* +0x0038 */ unsigned short __Undefined5; /* +0x003a */ unsigned long __Undefined6; /* +0x003c */ unsigned long CheckSum; /* +0x0040 */ unsigned long TimeDateStamp; /* +0x0044 */ }; struct _TXFS_LIST_TRANSACTIONS_ENTRY { unsigned char TransactionId[16]; /* +0x0000 dc 14 00 00 */ unsigned long TransactionState; /* +0x0010 */ unsigned long Reserved1; /* +0x0014 */ unsigned long Reserved2; /* +0x0018 */ long long Reserved3; /* +0x0020 */ }; struct _FILE_PIPE_PEEK_BUFFER { unsigned long NamedPipeState; /* +0x0000 */ unsigned long ReadDataAvailable; /* +0x0004 */ unsigned long NumberOfMessages; /* +0x0008 */ unsigned long MessageLength; /* +0x000c */ unsigned char Data[4]; /* +0x0010 df 23 00 00 */ }; struct ANON_OBJECT_HEADER_V2 { unsigned short Sig1; /* +0x0000 */ unsigned short Sig2; /* +0x0002 */ unsigned short Version; /* +0x0004 */ unsigned short Machine; /* +0x0006 */ unsigned long TimeDateStamp; /* +0x0008 */ unsigned char ClassID[16]; /* +0x000c dc 14 00 00 */ unsigned long SizeOfData; /* +0x001c */ unsigned long Flags; /* +0x0020 */ unsigned long MetaDataSize; /* +0x0024 */ unsigned long MetaDataOffset; /* +0x0028 */ }; struct _PLUGPLAY_CONTROL_CONFLICT_STRINGS { unsigned long NullDeviceInstance; /* +0x0000 */ unsigned char DeviceInstanceStrings[4]; /* +0x0004 f7 13 00 00 */ }; struct _CMC_RESPONSE_INFO { unsigned long cTaggedAttribute; /* +0x0000 */ unsigned char rgTaggedAttribute[4]; /* +0x0004 07 1d 00 00 */ unsigned long cTaggedContentInfo; /* +0x0008 */ unsigned char rgTaggedContentInfo[4]; /* +0x000c f6 3d 00 00 */ unsigned long cTaggedOtherMsg; /* +0x0010 */ unsigned char rgTaggedOtherMsg[4]; /* +0x0014 f8 3d 00 00 */ }; struct _IMAGE_OPTIONAL_HEADER { unsigned short Magic; /* +0x0000 */ unsigned char MajorLinkerVersion; /* +0x0002 */ unsigned char MinorLinkerVersion; /* +0x0003 */ unsigned long SizeOfCode; /* +0x0004 */ unsigned long SizeOfInitializedData; /* +0x0008 */ unsigned long SizeOfUninitializedData; /* +0x000c */ unsigned long AddressOfEntryPoint; /* +0x0010 */ unsigned long BaseOfCode; /* +0x0014 */ unsigned long BaseOfData; /* +0x0018 */ unsigned long ImageBase; /* +0x001c */ unsigned long SectionAlignment; /* +0x0020 */ unsigned long FileAlignment; /* +0x0024 */ unsigned short MajorOperatingSystemVersion; /* +0x0028 */ unsigned short MinorOperatingSystemVersion; /* +0x002a */ unsigned short MajorImageVersion; /* +0x002c */ unsigned short MinorImageVersion; /* +0x002e */ unsigned short MajorSubsystemVersion; /* +0x0030 */ unsigned short MinorSubsystemVersion; /* +0x0032 */ unsigned long Win32VersionValue; /* +0x0034 */ unsigned long SizeOfImage; /* +0x0038 */ unsigned long SizeOfHeaders; /* +0x003c */ unsigned long CheckSum; /* +0x0040 */ unsigned short Subsystem; /* +0x0044 */ unsigned short DllCharacteristics; /* +0x0046 */ unsigned long SizeOfStackReserve; /* +0x0048 */ unsigned long SizeOfStackCommit; /* +0x004c */ unsigned long SizeOfHeapReserve; /* +0x0050 */ unsigned long SizeOfHeapCommit; /* +0x0054 */ unsigned long LoaderFlags; /* +0x0058 */ unsigned long NumberOfRvaAndSizes; /* +0x005c */ unsigned char DataDirectory[128]; /* +0x0060 34 17 00 00 */ }; struct _MUTANT_OWNER_INFORMATION { unsigned char ClientId[8]; /* +0x0000 3e 13 00 00 */ }; struct _COSERVERINFO { unsigned long dwReserved1; /* +0x0000 */ unsigned char pwszName[4]; /* +0x0004 71 04 00 00 */ unsigned char pAuthInfo[4]; /* +0x0008 8c 42 00 00 */ unsigned long dwReserved2; /* +0x000c */ }; struct _RPC_CLIENT_INTERFACE { unsigned char Length[4]; /* +0x0000 75 00 00 00 */ unsigned char InterfaceId[20]; /* +0x0004 eb 16 00 00 */ unsigned char TransferSyntax[20]; /* +0x0018 eb 16 00 00 */ unsigned char DispatchTable[4]; /* +0x002c 37 19 00 00 */ unsigned char RpcProtseqEndpointCount[4]; /* +0x0030 75 00 00 00 */ unsigned char RpcProtseqEndpoint[4]; /* +0x0034 67 1e 00 00 */ unsigned long Reserved; /* +0x0038 */ unsigned char InterpreterInfo[4]; /* +0x003c 3d 19 00 00 */ unsigned char Flags[4]; /* +0x0040 75 00 00 00 */ }; struct _CERT_LOGOTYPE_DATA { unsigned long cLogotypeImage; /* +0x0000 */ unsigned char rgLogotypeImage[4]; /* +0x0004 b5 1b 00 00 */ unsigned long cLogotypeAudio; /* +0x0008 */ unsigned char rgLogotypeAudio[4]; /* +0x000c ad 42 00 00 */ }; struct _AppBarData { unsigned long cbSize; /* +0x0000 */ unsigned char hWnd[4]; /* +0x0004 f1 12 00 00 */ unsigned char uCallbackMessage[4]; /* +0x0008 75 00 00 00 */ unsigned char uEdge[4]; /* +0x000c 75 00 00 00 */ unsigned char rc[16]; /* +0x0010 63 14 00 00 */ long lParam; /* +0x0020 */ }; struct _GENERIC_MAPPING { unsigned long GenericRead; /* +0x0000 */ unsigned long GenericWrite; /* +0x0004 */ unsigned long GenericExecute; /* +0x0008 */ unsigned long GenericAll; /* +0x000c */ }; struct _CTL_USAGE_MATCH { unsigned long dwType; /* +0x0000 */ unsigned char Usage[8]; /* +0x0004 bd 13 00 00 */ }; struct COPYFILE2_EXTENDED_PARAMETERS { unsigned long dwSize; /* +0x0000 */ unsigned long dwCopyFlags; /* +0x0004 */ unsigned char pfCancel[4]; /* +0x0008 74 04 00 00 */ unsigned char pProgressRoutine[4]; /* +0x000c 2a 29 00 00 */ void *pvCallbackContext; /* +0x0010 */ }; struct _FILE_PREFETCH_EX { unsigned long Type; /* +0x0000 */ unsigned long Count; /* +0x0004 */ void *Context; /* +0x0008 */ unsigned char Prefetch[8]; /* +0x0010 98 2f 00 00 */ }; struct _CRYPTNET_URL_CACHE_FLUSH_INFO { unsigned long cbSize; /* +0x0000 */ unsigned long dwExemptSeconds; /* +0x0004 */ unsigned char ExpireTime[8]; /* +0x0008 31 13 00 00 */ }; struct _CM_FULL_RESOURCE_DESCRIPTOR { unsigned char InterfaceType[4]; /* +0x0000 10 21 00 00 */ unsigned long BusNumber; /* +0x0004 */ unsigned char PartialResourceList[24]; /* +0x0008 d1 42 00 00 */ }; struct _TOKEN_PRIVILEGES { unsigned long PrivilegeCount; /* +0x0000 */ unsigned char Privileges[12]; /* +0x0004 4e 2e 00 00 */ }; struct tagRPCOLEMESSAGE { void *reserved1; /* +0x0000 */ unsigned long dataRepresentation; /* +0x0004 */ void *Buffer; /* +0x0008 */ unsigned long cbBuffer; /* +0x000c */ unsigned long iMethod; /* +0x0010 */ unsigned char reserved2[20]; /* +0x0014 d6 42 00 00 */ unsigned long rpcFlags; /* +0x0028 */ }; struct _AUTHENTICODE_TS_EXTRA_CERT_CHAIN_POLICY_PARA { unsigned long cbSize; /* +0x0000 */ unsigned long dwRegPolicySettings; /* +0x0004 */ unsigned char fCommercial[4]; /* +0x0008 74 00 00 00 */ }; struct _PORT_MESSAGE::<unnamed-type-u2>::<unnamed-type-s2> { short Type; /* +0x0000 */ short DataInfoOffset; /* +0x0002 */ }; struct _PORT_MESSAGE::<unnamed-type-u1>::<unnamed-type-s1> { short DataLength; /* +0x0000 */ short TotalLength; /* +0x0002 */ }; struct _FILE_FS_ATTRIBUTE_INFORMATION { unsigned long FileSystemAttributes; /* +0x0000 */ long MaximumComponentNameLength; /* +0x0004 */ unsigned long FileSystemNameLength; /* +0x0008 */ unsigned char FileSystemName[4]; /* +0x000c f7 13 00 00 */ }; struct _MUICCHEADER { unsigned char ulMaxStringsSize[4]; /* +0x0000 75 00 00 00 */ unsigned char ulSizeStrings[4]; /* +0x0004 75 00 00 00 */ unsigned char ulMaxNumInstalledCultures[4]; /* +0x0008 75 00 00 00 */ unsigned char ulNumInstalledCultures[4]; /* +0x000c 75 00 00 00 */ unsigned char ulMaxNumUnverifiedCultures[4]; /* +0x0010 75 00 00 00 */ unsigned char ulNumUnverifiedCultures[4]; /* +0x0014 75 00 00 00 */ }; struct _SYSTEM_VDM_INSTEMUL_INFO { unsigned long SegmentNotPresent; /* +0x0000 */ unsigned long VdmOpcode0F; /* +0x0004 */ unsigned long OpcodeESPrefix; /* +0x0008 */ unsigned long OpcodeCSPrefix; /* +0x000c */ unsigned long OpcodeSSPrefix; /* +0x0010 */ unsigned long OpcodeDSPrefix; /* +0x0014 */ unsigned long OpcodeFSPrefix; /* +0x0018 */ unsigned long OpcodeGSPrefix; /* +0x001c */ unsigned long OpcodeOPER32Prefix; /* +0x0020 */ unsigned long OpcodeADDR32Prefix; /* +0x0024 */ unsigned long OpcodeINSB; /* +0x0028 */ unsigned long OpcodeINSW; /* +0x002c */ unsigned long OpcodeOUTSB; /* +0x0030 */ unsigned long OpcodeOUTSW; /* +0x0034 */ unsigned long OpcodePUSHF; /* +0x0038 */ unsigned long OpcodePOPF; /* +0x003c */ unsigned long OpcodeINTnn; /* +0x0040 */ unsigned long OpcodeINTO; /* +0x0044 */ unsigned long OpcodeIRET; /* +0x0048 */ unsigned long OpcodeINBimm; /* +0x004c */ unsigned long OpcodeINWimm; /* +0x0050 */ unsigned long OpcodeOUTBimm; /* +0x0054 */ unsigned long OpcodeOUTWimm; /* +0x0058 */ unsigned long OpcodeINB; /* +0x005c */ unsigned long OpcodeINW; /* +0x0060 */ unsigned long OpcodeOUTB; /* +0x0064 */ unsigned long OpcodeOUTW; /* +0x0068 */ unsigned long OpcodeLOCKPrefix; /* +0x006c */ unsigned long OpcodeREPNEPrefix; /* +0x0070 */ unsigned long OpcodeREPPrefix; /* +0x0074 */ unsigned long OpcodeHLT; /* +0x0078 */ unsigned long OpcodeCLI; /* +0x007c */ unsigned long OpcodeSTI; /* +0x0080 */ unsigned long BopCount; /* +0x0084 */ }; struct _CERT_HASHED_URL { unsigned char HashAlgorithm[12]; /* +0x0000 55 14 00 00 */ unsigned char Hash[8]; /* +0x000c 02 13 00 00 */ unsigned char pwszUrl[4]; /* +0x0014 71 04 00 00 */ }; struct provider_info { unsigned char pi_R0_1val[4]; /* +0x0000 b4 13 00 00 */ unsigned char pi_R0_allvals[4]; /* +0x0004 b4 13 00 00 */ unsigned char pi_R3_1val[4]; /* +0x0008 b4 13 00 00 */ unsigned char pi_R3_allvals[4]; /* +0x000c b4 13 00 00 */ unsigned long pi_flags; /* +0x0010 */ void *pi_key_context; /* +0x0014 */ }; struct _CRYPT_SIGN_MESSAGE_PARA { unsigned long cbSize; /* +0x0000 */ unsigned long dwMsgEncodingType; /* +0x0004 */ unsigned char pSigningCert[4]; /* +0x0008 b9 13 00 00 */ unsigned char HashAlgorithm[12]; /* +0x000c 55 14 00 00 */ void *pvHashAuxInfo; /* +0x0018 */ unsigned long cMsgCert; /* +0x001c */ unsigned char rgpMsgCert[4]; /* +0x0020 86 15 00 00 */ unsigned long cMsgCrl; /* +0x0024 */ unsigned char rgpMsgCrl[4]; /* +0x0028 36 3d 00 00 */ unsigned long cAuthAttr; /* +0x002c */ unsigned char rgAuthAttr[4]; /* +0x0030 d8 13 00 00 */ unsigned long cUnauthAttr; /* +0x0034 */ unsigned char rgUnauthAttr[4]; /* +0x0038 d8 13 00 00 */ unsigned long dwFlags; /* +0x003c */ unsigned long dwInnerContentType; /* +0x0040 */ }; struct _RPC_SECURITY_QOS_V4_A { unsigned long Version; /* +0x0000 */ unsigned long Capabilities; /* +0x0004 */ unsigned long IdentityTracking; /* +0x0008 */ unsigned long ImpersonationType; /* +0x000c */ unsigned long AdditionalSecurityInfoType; /* +0x0010 */ }; struct _NCryptAlgorithmName { unsigned char pszName[4]; /* +0x0000 71 04 00 00 */ unsigned long dwClass; /* +0x0004 */ unsigned long dwAlgOperations; /* +0x0008 */ unsigned long dwFlags; /* +0x000c */ }; struct _PATHNAME_BUFFER { unsigned long PathNameLength; /* +0x0000 */ unsigned char Name[4]; /* +0x0004 f7 13 00 00 */ }; struct _CERT_ID { unsigned long dwIdChoice; /* +0x0000 */ /* unsigned char IssuerSerialNumber[0]; +0x0004 f5 18 00 00 */ /* unsigned char KeyId[0]; +0x0004 02 13 00 00 */ unsigned char HashId[16]; /* +0x0004 02 13 00 00 */ }; struct _GROUP_AFFINITY { unsigned long Mask; /* +0x0000 */ unsigned short Group; /* +0x0004 */ unsigned char Reserved[6]; /* +0x0006 5c 43 00 00 */ }; struct _ALPC_SERVER_INFORMATION { /* unsigned char In[0]; +0x0000 5f 43 00 00 */ unsigned char Out[16]; /* +0x0000 60 43 00 00 */ }; struct _ALPC_SERVER_INFORMATION::<unnamed-tag>::<unnamed-type-Out> { unsigned char ThreadBlocked; /* +0x0000 */ void *ConnectedProcessId; /* +0x0004 */ unsigned char ConnectionPortName[8]; /* +0x0008 dd 12 00 00 */ }; struct _ALPC_SERVER_INFORMATION::<unnamed-tag>::<unnamed-type-In> { void *ThreadHandle; /* +0x0000 */ }; struct DISPLAYCONFIG_PATH_INFO { unsigned char sourceInfo[20]; /* +0x0000 69 43 00 00 */ unsigned char targetInfo[48]; /* +0x0014 6a 43 00 00 */ unsigned char flags[4]; /* +0x0044 75 00 00 00 */ }; struct _SYSTEM_DPC_BEHAVIOR_INFORMATION { unsigned long Spare; /* +0x0000 */ unsigned long DpcQueueDepth; /* +0x0004 */ unsigned long MinimumDpcRate; /* +0x0008 */ unsigned long AdjustDpcThreshold; /* +0x000c */ unsigned long IdealDpcRate; /* +0x0010 */ }; struct _CONSOLE_SELECTION_INFO { unsigned long dwFlags; /* +0x0000 */ unsigned char dwSelectionAnchor[4]; /* +0x0004 09 18 00 00 */ unsigned char srSelection[8]; /* +0x0008 42 27 00 00 */ }; struct _CMSG_KEY_TRANS_RECIPIENT_ENCODE_INFO { unsigned long cbSize; /* +0x0000 */ unsigned char KeyEncryptionAlgorithm[12]; /* +0x0004 55 14 00 00 */ void *pvKeyEncryptionAuxInfo; /* +0x0010 */ unsigned long hCryptProv; /* +0x0014 */ unsigned char RecipientPublicKey[12]; /* +0x0018 03 13 00 00 */ unsigned char RecipientId[20]; /* +0x0024 30 13 00 00 */ }; struct _EISA_DMA_CONFIGURATION { unsigned char ConfigurationByte0[1]; /* +0x0000 82 43 00 00 */ unsigned char ConfigurationByte1[1]; /* +0x0001 83 43 00 00 */ }; struct _MEMORYSTATUSEX { unsigned long dwLength; /* +0x0000 */ unsigned long dwMemoryLoad; /* +0x0004 */ unsigned long long ullTotalPhys; /* +0x0008 */ unsigned long long ullAvailPhys; /* +0x0010 */ unsigned long long ullTotalPageFile; /* +0x0018 */ unsigned long long ullAvailPageFile; /* +0x0020 */ unsigned long long ullTotalVirtual; /* +0x0028 */ unsigned long long ullAvailVirtual; /* +0x0030 */ unsigned long long ullAvailExtendedVirtual; /* +0x0038 */ }; struct _RTL_GENERIC_TABLE { unsigned char TableRoot[4]; /* +0x0000 91 43 00 00 */ unsigned char InsertOrderList[8]; /* +0x0004 44 1f 00 00 */ unsigned char OrderedPointer[4]; /* +0x000c 5d 2d 00 00 */ unsigned long WhichOrderedElement; /* +0x0010 */ unsigned long NumberGenericTableElements; /* +0x0014 */ unsigned char CompareRoutine[4]; /* +0x0018 94 43 00 00 */ unsigned char AllocateRoutine[4]; /* +0x001c 95 43 00 00 */ unsigned char FreeRoutine[4]; /* +0x0020 c9 42 00 00 */ void *TableContext; /* +0x0024 */ }; struct tagCHARSETINFO { unsigned char ciCharset[4]; /* +0x0000 75 00 00 00 */ unsigned char ciACP[4]; /* +0x0004 75 00 00 00 */ unsigned char fs[24]; /* +0x0008 57 20 00 00 */ }; struct tagPROPSPEC { unsigned long ulKind; /* +0x0000 */ unsigned long propid; /* +0x0004 */ unsigned char lpwstr[4]; /* +0x0004 71 04 00 00 */ }; struct _ICONINFOEXA { unsigned long cbSize; /* +0x0000 */ unsigned char fIcon[4]; /* +0x0004 74 00 00 00 */ unsigned long xHotspot; /* +0x0008 */ unsigned long yHotspot; /* +0x000c */ unsigned char hbmMask[4]; /* +0x0010 06 18 00 00 */ unsigned char hbmColor[4]; /* +0x0014 06 18 00 00 */ unsigned short wResID; /* +0x0018 */ unsigned char szModName[260]; /* +0x001a 27 24 00 00 */ unsigned char szResName[262]; /* +0x011e 27 24 00 00 */ }; struct _IO_ERROR_LOG_PACKET { unsigned char MajorFunctionCode; /* +0x0000 */ unsigned char RetryCount; /* +0x0001 */ unsigned short DumpDataSize; /* +0x0002 */ unsigned short NumberOfStrings; /* +0x0004 */ unsigned short StringOffset; /* +0x0006 */ unsigned short EventCategory; /* +0x0008 */ long ErrorCode; /* +0x000c */ unsigned long UniqueErrorValue; /* +0x0010 */ long FinalStatus; /* +0x0014 */ unsigned long SequenceNumber; /* +0x0018 */ unsigned long IoControlCode; /* +0x001c */ unsigned char DeviceOffset[8]; /* +0x0020 3d 13 00 00 */ unsigned char DumpData[8]; /* +0x0028 f6 12 00 00 */ }; struct _WIN32_FIND_DATAA { unsigned long dwFileAttributes; /* +0x0000 */ unsigned char ftCreationTime[8]; /* +0x0004 31 13 00 00 */ unsigned char ftLastAccessTime[8]; /* +0x000c 31 13 00 00 */ unsigned char ftLastWriteTime[8]; /* +0x0014 31 13 00 00 */ unsigned long nFileSizeHigh; /* +0x001c */ unsigned long nFileSizeLow; /* +0x0020 */ unsigned long dwReserved0; /* +0x0024 */ unsigned long dwReserved1; /* +0x0028 */ unsigned char cFileName[260]; /* +0x002c 27 24 00 00 */ unsigned char cAlternateFileName[16]; /* +0x0130 d9 43 00 00 */ }; struct tagContextProperty { unsigned char policyId[16]; /* +0x0000 dc 14 00 00 */ unsigned long flags; /* +0x0010 */ unsigned char pUnk[4]; /* +0x0014 7f 17 00 00 */ }; struct _DEDUP_QUERY_FILE_HASHES_INPUT_BUFFER { unsigned long Version; /* +0x0000 */ unsigned long QueryFlags; /* +0x0004 */ unsigned long HashAlgorithm; /* +0x0008 */ unsigned char RangeOffsetInFile[8]; /* +0x0010 3d 13 00 00 */ unsigned char RangeLength[8]; /* +0x0018 3d 13 00 00 */ }; struct _SYSTEM_LOOKASIDE_INFORMATION { unsigned short CurrentDepth; /* +0x0000 */ unsigned short MaximumDepth; /* +0x0002 */ unsigned long TotalAllocates; /* +0x0004 */ unsigned long AllocateMisses; /* +0x0008 */ unsigned long TotalFrees; /* +0x000c */ unsigned long FreeMisses; /* +0x0010 */ unsigned long Type; /* +0x0014 */ unsigned long Tag; /* +0x0018 */ unsigned long Size; /* +0x001c */ }; struct _NOTIFYICONDATAW { unsigned long cbSize; /* +0x0000 */ unsigned char hWnd[4]; /* +0x0004 f1 12 00 00 */ unsigned char uID[4]; /* +0x0008 75 00 00 00 */ unsigned char uFlags[4]; /* +0x000c 75 00 00 00 */ unsigned char uCallbackMessage[4]; /* +0x0010 75 00 00 00 */ unsigned char hIcon[4]; /* +0x0014 07 21 00 00 */ unsigned char szTip[256]; /* +0x0018 a7 15 00 00 */ unsigned long dwState; /* +0x0118 */ unsigned long dwStateMask; /* +0x011c */ unsigned char szInfo[512]; /* +0x0120 3c 17 00 00 */ /* unsigned char uTimeout[0]; +0x0320 75 00 00 00 */ unsigned char uVersion[4]; /* +0x0320 75 00 00 00 */ unsigned char szInfoTitle[128]; /* +0x0324 98 1e 00 00 */ unsigned long dwInfoFlags; /* +0x03a4 */ unsigned char guidItem[16]; /* +0x03a8 dc 14 00 00 */ unsigned char hBalloonIcon[4]; /* +0x03b8 07 21 00 00 */ }; struct _MUTANT_BASIC_INFORMATION { long CurrentCount; /* +0x0000 */ unsigned char OwnedByCaller; /* +0x0004 */ unsigned char AbandonedState; /* +0x0005 */ }; struct _SYSTEM_FILECACHE_INFORMATION { unsigned long CurrentSize; /* +0x0000 */ unsigned long PeakSize; /* +0x0004 */ unsigned long PageFaultCount; /* +0x0008 */ unsigned long MinimumWorkingSet; /* +0x000c */ unsigned long MaximumWorkingSet; /* +0x0010 */ unsigned long CurrentSizeIncludingTransitionInPages; /* +0x0014 */ unsigned long PeakSizeIncludingTransitionInPages; /* +0x0018 */ unsigned long TransitionRePurposeCount; /* +0x001c */ unsigned long Flags; /* +0x0020 */ }; struct _MEMORY_FRAME_INFORMATION { /* unsigned char UseDescription[0]; +0x0000 0c 44 00 00 */ /* unsigned char ListDescription[0]; +0x0000 0d 44 00 00 */ /* unsigned char Reserved0[0]; +0x0000 0e 44 00 00 */ /* unsigned char Pinned[0]; +0x0000 0f 44 00 00 */ /* unsigned char DontUse[0]; +0x0000 7f 29 00 00 */ /* unsigned char Priority[0]; +0x0000 10 44 00 00 */ unsigned char Reserved[8]; /* +0x0000 11 44 00 00 */ }; struct tagEMRGLSBOUNDEDRECORD { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned char rclBounds[16]; /* +0x0008 d5 12 00 00 */ unsigned long cbData; /* +0x0018 */ unsigned char Data[4]; /* +0x001c f9 12 00 00 */ }; struct _IMAGE_OS2_HEADER { unsigned short ne_magic; /* +0x0000 */ char ne_ver; /* +0x0002 */ char ne_rev; /* +0x0003 */ unsigned short ne_enttab; /* +0x0004 */ unsigned short ne_cbenttab; /* +0x0006 */ long ne_crc; /* +0x0008 */ unsigned short ne_flags; /* +0x000c */ unsigned short ne_autodata; /* +0x000e */ unsigned short ne_heap; /* +0x0010 */ unsigned short ne_stack; /* +0x0012 */ long ne_csip; /* +0x0014 */ long ne_sssp; /* +0x0018 */ unsigned short ne_cseg; /* +0x001c */ unsigned short ne_cmod; /* +0x001e */ unsigned short ne_cbnrestab; /* +0x0020 */ unsigned short ne_segtab; /* +0x0022 */ unsigned short ne_rsrctab; /* +0x0024 */ unsigned short ne_restab; /* +0x0026 */ unsigned short ne_modtab; /* +0x0028 */ unsigned short ne_imptab; /* +0x002a */ long ne_nrestab; /* +0x002c */ unsigned short ne_cmovent; /* +0x0030 */ unsigned short ne_align; /* +0x0032 */ unsigned short ne_cres; /* +0x0034 */ unsigned char ne_exetyp; /* +0x0036 */ unsigned char ne_flagsothers; /* +0x0037 */ unsigned short ne_pretthunks; /* +0x0038 */ unsigned short ne_psegrefbytes; /* +0x003a */ unsigned short ne_swaparea; /* +0x003c */ unsigned short ne_expver; /* +0x003e */ }; struct _CRYPT_AES_256_KEY_STATE { unsigned char Key[32]; /* +0x0000 e5 17 00 00 */ unsigned char IV[16]; /* +0x0020 09 1c 00 00 */ unsigned char EncryptionState[240]; /* +0x0030 1c 44 00 00 */ unsigned char DecryptionState[240]; /* +0x0120 1c 44 00 00 */ unsigned char Feedback[16]; /* +0x0210 09 1c 00 00 */ }; struct _KEY_SET_VIRTUALIZATION_INFORMATION { /* unsigned char VirtualTarget[0]; +0x0000 17 13 00 00 */ /* unsigned char VirtualStore[0]; +0x0000 7e 18 00 00 */ /* unsigned char VirtualSource[0]; +0x0000 7f 18 00 00 */ unsigned char Reserved[4]; /* +0x0000 b0 2c 00 00 */ }; struct _ACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION { unsigned long ulFlags; /* +0x0000 */ unsigned char RunLevel[4]; /* +0x0004 21 44 00 00 */ unsigned long UiAccess; /* +0x0008 */ }; struct DISPLAYCONFIG_PATH_TARGET_INFO { unsigned char adapterId[8]; /* +0x0000 21 15 00 00 */ unsigned char id[4]; /* +0x0008 75 00 00 00 */ unsigned char modeInfoIdx[4]; /* +0x000c 75 00 00 00 */ unsigned char outputTechnology[4]; /* +0x0010 24 44 00 00 */ unsigned char rotation[4]; /* +0x0014 25 44 00 00 */ unsigned char scaling[4]; /* +0x0018 26 44 00 00 */ unsigned char refreshRate[8]; /* +0x001c e7 3b 00 00 */ unsigned char scanLineOrdering[4]; /* +0x0024 e9 3b 00 00 */ unsigned char targetAvailable[4]; /* +0x0028 74 00 00 00 */ unsigned char statusFlags[4]; /* +0x002c 75 00 00 00 */ }; struct tagACTCTX_SECTION_KEYED_DATA_ASSEMBLY_METADATA { void *lpInformation; /* +0x0000 */ void *lpSectionBase; /* +0x0004 */ unsigned long ulSectionLength; /* +0x0008 */ void *lpSectionGlobalDataBase; /* +0x000c */ unsigned long ulSectionGlobalDataLength; /* +0x0010 */ }; struct tagHANDLETABLE { unsigned char objectHandle[4]; /* +0x0000 31 44 00 00 */ }; struct _FILE_FS_DEVICE_INFORMATION { unsigned long DeviceType; /* +0x0000 */ unsigned long Characteristics; /* +0x0004 */ }; struct _CRYPT_INTERFACE_REG { unsigned long dwInterface; /* +0x0000 */ unsigned long dwFlags; /* +0x0004 */ unsigned long cFunctions; /* +0x0008 */ unsigned char rgpszFunctions[4]; /* +0x000c d0 13 00 00 */ }; struct _IMAGE_TLS_DIRECTORY32 { unsigned long StartAddressOfRawData; /* +0x0000 */ unsigned long EndAddressOfRawData; /* +0x0004 */ unsigned long AddressOfIndex; /* +0x0008 */ unsigned long AddressOfCallBacks; /* +0x000c */ unsigned long SizeOfZeroFill; /* +0x0010 */ unsigned long Characteristics; /* +0x0014 */ }; struct _SYSTEM_POOL_ENTRY { unsigned char Allocated; /* +0x0000 */ unsigned char Spare0; /* +0x0001 */ unsigned short AllocatorBackTraceIndex; /* +0x0002 */ unsigned long Size; /* +0x0004 */ /* unsigned char Tag[0]; +0x0008 b7 17 00 00 */ unsigned long TagUlong; /* +0x0008 */ void *ProcessChargedQuota; /* +0x0008 */ }; struct _PS_CREATE_INFO { unsigned long Size; /* +0x0000 */ unsigned char State[4]; /* +0x0004 4a 44 00 00 */ /* unsigned char InitState[0]; +0x0008 4b 44 00 00 */ /* unsigned char FailSection[0]; +0x0008 4c 44 00 00 */ /* unsigned char ExeFormat[0]; +0x0008 4d 44 00 00 */ /* unsigned char ExeName[0]; +0x0008 4e 44 00 00 */ unsigned char SuccessState[64]; /* +0x0008 4f 44 00 00 */ }; struct _ALPC_CONTEXT_ATTR { void *PortContext; /* +0x0000 */ void *MessageContext; /* +0x0004 */ unsigned long Sequence; /* +0x0008 */ unsigned long MessageId; /* +0x000c */ unsigned long CallbackId; /* +0x0010 */ }; struct _DRAWPATRECT { unsigned char ptPosition[8]; /* +0x0000 8a 14 00 00 */ unsigned char ptSize[8]; /* +0x0008 8a 14 00 00 */ unsigned short wStyle; /* +0x0010 */ unsigned short wPattern; /* +0x0012 */ }; struct DISPLAYCONFIG_MODE_INFO { unsigned char infoType[4]; /* +0x0000 6e 44 00 00 */ unsigned char id[4]; /* +0x0004 75 00 00 00 */ unsigned char adapterId[8]; /* +0x0008 21 15 00 00 */ /* unsigned char targetMode[0]; +0x0010 cb 24 00 00 */ unsigned char sourceMode[48]; /* +0x0010 6f 44 00 00 */ }; struct _POINTFLOAT { unsigned char x[4]; /* +0x0000 40 00 00 00 */ unsigned char y[4]; /* +0x0004 40 00 00 00 */ }; struct _BCRYPT_DSA_PARAMETER_HEADER_V2 { unsigned long cbLength; /* +0x0000 */ unsigned long dwMagic; /* +0x0004 */ unsigned long cbKeyLength; /* +0x0008 */ unsigned char hashAlgorithm[4]; /* +0x000c 88 44 00 00 */ unsigned char standardVersion[4]; /* +0x0010 89 44 00 00 */ unsigned long cbSeedLength; /* +0x0014 */ unsigned long cbGroupSize; /* +0x0018 */ unsigned char Count[4]; /* +0x001c b7 17 00 00 */ }; struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX { void *Object; /* +0x0000 */ unsigned long UniqueProcessId; /* +0x0004 */ unsigned long HandleValue; /* +0x0008 */ unsigned long GrantedAccess; /* +0x000c */ unsigned short CreatorBackTraceIndex; /* +0x0010 */ unsigned short ObjectTypeIndex; /* +0x0012 */ unsigned long HandleAttributes; /* +0x0014 */ unsigned long Reserved; /* +0x0018 */ }; struct tagEMRBITBLT { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned char rclBounds[16]; /* +0x0008 d5 12 00 00 */ long xDest; /* +0x0018 */ long yDest; /* +0x001c */ long cxDest; /* +0x0020 */ long cyDest; /* +0x0024 */ unsigned long dwRop; /* +0x0028 */ long xSrc; /* +0x002c */ long ySrc; /* +0x0030 */ unsigned char xformSrc[24]; /* +0x0034 d6 12 00 00 */ unsigned long crBkColorSrc; /* +0x004c */ unsigned long iUsageSrc; /* +0x0050 */ unsigned long offBmiSrc; /* +0x0054 */ unsigned long cbBmiSrc; /* +0x0058 */ unsigned long offBitsSrc; /* +0x005c */ unsigned long cbBitsSrc; /* +0x0060 */ }; struct tagOleMenuGroupWidths { unsigned char width[24]; /* +0x0000 92 44 00 00 */ }; struct _MUILANGCFGNODE { short LangSpec; /* +0x0000 */ unsigned short FallbackTypes; /* +0x0002 */ unsigned short Reserved; /* +0x0004 */ unsigned char FallbackSpecs[6]; /* +0x0006 96 44 00 00 */ }; struct tagMDINEXTMENU { unsigned char hmenuIn[4]; /* +0x0000 4c 15 00 00 */ unsigned char hmenuNext[4]; /* +0x0004 4c 15 00 00 */ unsigned char hwndNext[4]; /* +0x0008 f1 12 00 00 */ }; struct _SYSTEM_VERIFIER_CANCELLATION_INFORMATION { unsigned long CancelProbability; /* +0x0000 */ unsigned long CancelThreshold; /* +0x0004 */ unsigned long CompletionThreshold; /* +0x0008 */ unsigned long CancellationVerifierDisabled; /* +0x000c */ unsigned long AvailableIssues; /* +0x0010 */ unsigned char Issues[2048]; /* +0x0014 a1 44 00 00 */ }; struct _NTFS_STATISTICS::<unnamed-type-Allocate> { unsigned long Calls; /* +0x0000 */ unsigned long Clusters; /* +0x0004 */ unsigned long Hints; /* +0x0008 */ unsigned long RunsReturned; /* +0x000c */ unsigned long HintsHonored; /* +0x0010 */ unsigned long HintsClusters; /* +0x0014 */ unsigned long Cache; /* +0x0018 */ unsigned long CacheClusters; /* +0x001c */ unsigned long CacheMiss; /* +0x0020 */ unsigned long CacheMissClusters; /* +0x0024 */ }; struct _NTFS_STATISTICS::<unnamed-type-MftBitmapWritesUserLevel> { unsigned short Write; /* +0x0000 */ unsigned short Create; /* +0x0002 */ unsigned short SetInfo; /* +0x0004 */ unsigned short Flush; /* +0x0006 */ }; struct _NTFS_STATISTICS::<unnamed-type-BitmapWritesUserLevel> { unsigned short Write; /* +0x0000 */ unsigned short Create; /* +0x0002 */ unsigned short SetInfo; /* +0x0004 */ }; struct _EXCEPTION_RECORD { long ExceptionCode; /* +0x0000 */ unsigned long ExceptionFlags; /* +0x0004 */ unsigned char ExceptionRecord[4]; /* +0x0008 cf 28 00 00 */ void *ExceptionAddress; /* +0x000c */ unsigned long NumberParameters; /* +0x0010 */ unsigned char ExceptionInformation[60]; /* +0x0014 99 28 00 00 */ }; struct _APPLICATIONLAUNCH_SETTING_VALUE { unsigned char ActivationTime[8]; /* +0x0000 3d 13 00 00 */ unsigned long Flags; /* +0x0008 */ unsigned long ButtonInstanceID; /* +0x000c */ }; struct _userCLIPFORMAT::__MIDL_IWinTypes_0001 { unsigned long dwValue; /* +0x0000 */ unsigned char pwszName[4]; /* +0x0000 71 04 00 00 */ }; struct tagSTDOBJREF { unsigned long flags; /* +0x0000 */ unsigned long cPublicRefs; /* +0x0004 */ unsigned long long oxid; /* +0x0008 */ unsigned long long oid; /* +0x0010 */ unsigned char ipid[16]; /* +0x0018 dc 14 00 00 */ }; struct _MEMORY_REGION_INFORMATION { void *AllocationBase; /* +0x0000 */ unsigned long AllocationProtect; /* +0x0004 */ unsigned long RegionType; /* +0x0008 */ unsigned long RegionSize; /* +0x000c */ unsigned long CommitSize; /* +0x0010 */ }; struct _userHMETAFILEPICT { long fContext; /* +0x0000 */ }; struct _userHMETAFILEPICT::__MIDL_IWinTypes_0005 { long hInproc; /* +0x0000 */ /* unsigned char hRemote[0]; +0x0000 e4 44 00 00 */ long long hInproc64; /* +0x0000 */ }; struct _RPC_SECURITY_QOS_V5_W { unsigned long Version; /* +0x0000 */ unsigned long Capabilities; /* +0x0004 */ unsigned long IdentityTracking; /* +0x0008 */ unsigned long ImpersonationType; /* +0x000c */ unsigned long AdditionalSecurityInfoType; /* +0x0010 */ }; struct _SYSTEM_NUMA_INFORMATION { unsigned long HighestNodeNumber; /* +0x0000 */ unsigned long Reserved; /* +0x0004 */ /* unsigned char ActiveProcessorsGroupAffinity[0]; +0x0008 fb 44 00 00 */ /* unsigned char AvailableMemory[0]; +0x0008 fc 44 00 00 */ unsigned char Pad[256]; /* +0x0008 fd 44 00 00 */ }; struct _RTL_UNLOAD_EVENT_TRACE64 { unsigned long long BaseAddress; /* +0x0000 */ unsigned long long SizeOfImage; /* +0x0008 */ unsigned long Sequence; /* +0x0010 */ unsigned long TimeDateStamp; /* +0x0014 */ unsigned long CheckSum; /* +0x0018 */ unsigned char ImageName[64]; /* +0x001c a5 15 00 00 */ unsigned char Version[12]; /* +0x005c 69 15 00 00 */ }; struct _KEY_NODE_INFORMATION { unsigned char LastWriteTime[8]; /* +0x0000 3d 13 00 00 */ unsigned long TitleIndex; /* +0x0008 */ unsigned long ClassOffset; /* +0x000c */ unsigned long ClassLength; /* +0x0010 */ unsigned long NameLength; /* +0x0014 */ unsigned char Name[8]; /* +0x0018 f7 13 00 00 */ }; struct _CM_PARTIAL_RESOURCE_LIST { unsigned short Version; /* +0x0000 */ unsigned short Revision; /* +0x0002 */ unsigned long Count; /* +0x0004 */ unsigned char PartialDescriptors[16]; /* +0x0008 08 45 00 00 */ }; struct tagSTRINGBINDING { unsigned short wTowerId; /* +0x0000 */ unsigned short aNetworkAddr; /* +0x0002 */ }; struct _MALLOC_FREE_STRUCT { unsigned char pfnAllocate[4]; /* +0x0000 66 19 00 00 */ unsigned char pfnFree[4]; /* +0x0004 c7 13 00 00 */ }; struct _tagDATAINFO { unsigned long ulTotalSize; /* +0x0000 */ unsigned long ulavrPacketSize; /* +0x0004 */ unsigned long ulConnectSpeed; /* +0x0008 */ unsigned long ulProcessorSpeed; /* +0x000c */ }; struct _PLUGPLAY_CONTROL_QUERY_AND_REMOVE_DATA { unsigned char DeviceInstance[8]; /* +0x0000 dd 12 00 00 */ unsigned long Flags; /* +0x0008 */ unsigned char VetoType[4]; /* +0x000c 31 19 00 00 */ unsigned char VetoName[4]; /* +0x0010 71 04 00 00 */ unsigned long VetoNameLength; /* +0x0014 */ }; struct _RTL_HEAP_TAG_INFO { unsigned long NumberOfAllocations; /* +0x0000 */ unsigned long NumberOfFrees; /* +0x0004 */ unsigned long BytesAllocated; /* +0x0008 */ }; struct _RPC_HTTP_TRANSPORT_CREDENTIALS_V2_W { unsigned char TransportCredentials[4]; /* +0x0000 01 1d 00 00 */ unsigned long Flags; /* +0x0004 */ unsigned long AuthenticationTarget; /* +0x0008 */ unsigned long NumberOfAuthnSchemes; /* +0x000c */ unsigned long *AuthnSchemes; /* +0x0010 */ unsigned short *ServerCertificateSubject; /* +0x0014 */ unsigned char ProxyCredentials[4]; /* +0x0018 01 1d 00 00 */ unsigned long NumberOfProxyAuthnSchemes; /* +0x001c */ unsigned long *ProxyAuthnSchemes; /* +0x0020 */ }; struct CONFIRMSAFETY { unsigned char clsid[16]; /* +0x0000 dc 14 00 00 */ unsigned char pUnk[4]; /* +0x0010 7f 17 00 00 */ unsigned long dwFlags; /* +0x0014 */ }; struct _FILE_NOTIFY_INFORMATION { unsigned long NextEntryOffset; /* +0x0000 */ unsigned long Action; /* +0x0004 */ unsigned long FileNameLength; /* +0x0008 */ unsigned char FileName[4]; /* +0x000c f7 13 00 00 */ }; struct _ENLISTMENT_CRM_INFORMATION { unsigned char CrmTransactionManagerId[16]; /* +0x0000 dc 14 00 00 */ unsigned char CrmResourceManagerId[16]; /* +0x0010 dc 14 00 00 */ unsigned char CrmEnlistmentId[16]; /* +0x0020 dc 14 00 00 */ }; struct _EXCEPTION_RECORD64 { long ExceptionCode; /* +0x0000 */ unsigned long ExceptionFlags; /* +0x0004 */ unsigned long long ExceptionRecord; /* +0x0008 */ unsigned long long ExceptionAddress; /* +0x0010 */ unsigned long NumberParameters; /* +0x0018 */ unsigned long __unusedAlignment; /* +0x001c */ unsigned char ExceptionInformation[120]; /* +0x0020 58 45 00 00 */ }; struct _WNF_UPDATE_DESCRIPTOR { unsigned char StateName[4]; /* +0x0000 e7 13 00 00 */ unsigned char TypeId[4]; /* +0x0004 68 30 00 00 */ unsigned char StateData[4]; /* +0x0008 3d 19 00 00 */ unsigned long Length; /* +0x000c */ void *ExplicitScope; /* +0x0010 */ }; struct _SD_QUERY_STATS_INPUT { unsigned long Reserved; /* +0x0000 */ }; struct tagEMRRESIZEPALETTE { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned long ihPal; /* +0x0008 */ unsigned long cEntries; /* +0x000c */ }; struct _FP_128 { unsigned char W[16]; /* +0x0000 4f 1a 00 00 */ }; struct _LUID_AND_ATTRIBUTES { unsigned char Luid[8]; /* +0x0000 21 15 00 00 */ unsigned long Attributes; /* +0x0008 */ }; struct _SID { unsigned char Revision; /* +0x0000 */ unsigned char SubAuthorityCount; /* +0x0001 */ unsigned char IdentifierAuthority[6]; /* +0x0002 15 14 00 00 */ unsigned char SubAuthority[4]; /* +0x0008 f6 12 00 00 */ }; struct _OBJECT_TYPE_LIST { unsigned short Level; /* +0x0000 */ unsigned short Sbz; /* +0x0002 */ unsigned char ObjectType[4]; /* +0x0004 44 16 00 00 */ }; enum RO_INIT_TYPE { RO_INIT_SINGLETHREADED = 0, RO_INIT_MULTITHREADED = 1 }; struct _TOKEN_SECURITY_ATTRIBUTES_AND_OPERATION_INFORMATION { unsigned char Attributes[4]; /* +0x0000 4d 3f 00 00 */ unsigned char Operations[4]; /* +0x0004 09 27 00 00 */ }; struct _FILE_FS_OBJECTID_INFORMATION { unsigned char ObjectId[16]; /* +0x0000 09 1c 00 00 */ unsigned char ExtendedInfo[48]; /* +0x0010 0a 1c 00 00 */ }; struct _TIME_ZONE_INFORMATION { long Bias; /* +0x0000 */ unsigned char StandardName[64]; /* +0x0004 a5 15 00 00 */ unsigned char StandardDate[16]; /* +0x0044 a6 15 00 00 */ long StandardBias; /* +0x0054 */ unsigned char DaylightName[64]; /* +0x0058 a5 15 00 00 */ unsigned char DaylightDate[16]; /* +0x0098 a6 15 00 00 */ long DaylightBias; /* +0x00a8 */ }; struct _CERT_POLICY95_QUALIFIER1 { unsigned char pszPracticesReference[4]; /* +0x0000 71 04 00 00 */ char *pszNoticeIdentifier; /* +0x0004 */ char *pszNSINoticeIdentifier; /* +0x0008 */ unsigned long cCPSURLs; /* +0x000c */ unsigned char rgCPSURLs[4]; /* +0x0010 c2 30 00 00 */ }; struct _POWER_MONITOR_INVOCATION { unsigned char On; /* +0x0000 */ unsigned char Console; /* +0x0001 */ }; struct _SYSTEM_FIRMWARE_TABLE_HANDLER { unsigned long ProviderSignature; /* +0x0000 */ unsigned char Register; /* +0x0004 */ unsigned char FirmwareTableHandler[4]; /* +0x0008 9e 16 00 00 */ void *DriverObject; /* +0x000c */ }; struct tagNCCALCSIZE_PARAMS { unsigned char rgrc[48]; /* +0x0000 d3 45 00 00 */ unsigned char lppos[4]; /* +0x0030 eb 2b 00 00 */ }; struct _IMAGE_DELAYLOAD_DESCRIPTOR::<unnamed-type-Attributes> { unsigned long AllAttributes; /* +0x0000 */ /* unsigned char RvaBased[0]; +0x0000 17 13 00 00 */ unsigned char ReservedAttributes[4]; /* +0x0000 8e 13 00 00 */ }; struct _PROCESS_MITIGATION_ASLR_POLICY { unsigned long Flags; /* +0x0000 */ /* unsigned char EnableStackRandomization[0]; +0x0000 17 13 00 00 */ /* unsigned char EnableForceRelocateImages[0]; +0x0000 7e 18 00 00 */ /* unsigned char EnableHighEntropy[0]; +0x0000 7f 18 00 00 */ /* unsigned char DisallowStrippedImages[0]; +0x0000 27 1e 00 00 */ unsigned char ReservedFlags[4]; /* +0x0000 28 1e 00 00 */ }; struct _QUERY_SERVICE_LOCK_STATUSA { unsigned long fIsLocked; /* +0x0000 */ char *lpLockOwner; /* +0x0004 */ unsigned long dwLockDuration; /* +0x0008 */ }; struct _RTL_PROCESS_MODULE_INFORMATION { void *Section; /* +0x0000 */ void *MappedBase; /* +0x0004 */ void *ImageBase; /* +0x0008 */ unsigned long ImageSize; /* +0x000c */ unsigned long Flags; /* +0x0010 */ unsigned short LoadOrderIndex; /* +0x0014 */ unsigned short InitOrderIndex; /* +0x0016 */ unsigned short LoadCount; /* +0x0018 */ unsigned short OffsetToFileName; /* +0x001a */ unsigned char FullPathName[256]; /* +0x001c 74 16 00 00 */ }; struct tagEMRGRADIENTFILL { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned char rclBounds[16]; /* +0x0008 d5 12 00 00 */ unsigned long nVer; /* +0x0018 */ unsigned long nTri; /* +0x001c */ unsigned long ulMode; /* +0x0020 */ unsigned char Ver[16]; /* +0x0024 f1 45 00 00 */ }; struct _LDR_DLL_UNLOADED_NOTIFICATION_DATA { unsigned long Flags; /* +0x0000 */ unsigned char FullDllName[4]; /* +0x0004 da 19 00 00 */ unsigned char BaseDllName[4]; /* +0x0008 da 19 00 00 */ void *DllBase; /* +0x000c */ unsigned long SizeOfImage; /* +0x0010 */ }; struct tagTPMPARAMS { unsigned char cbSize[4]; /* +0x0000 75 00 00 00 */ unsigned char rcExclude[16]; /* +0x0004 63 14 00 00 */ }; struct _TXFS_READ_BACKUP_INFORMATION_OUT { unsigned long BufferLength; /* +0x0000 */ unsigned char Buffer[4]; /* +0x0000 f9 12 00 00 */ }; struct _HEAP_BLOCK_INFORMATION { unsigned long Address; /* +0x0000 */ unsigned long Flags; /* +0x0004 */ unsigned long DataSize; /* +0x0008 */ unsigned long OverheadSize; /* +0x000c */ unsigned long NextBlockInformationOffset; /* +0x0010 */ }; struct _TP_DEBUG_FREE_INFO { unsigned long FreeListSize; /* +0x0000 */ }; struct _CMC_STATUS_INFO { unsigned long dwStatus; /* +0x0000 */ unsigned long cBodyList; /* +0x0004 */ unsigned long *rgdwBodyList; /* +0x0008 */ unsigned char pwszStatusString[4]; /* +0x000c 71 04 00 00 */ unsigned long dwOtherInfoChoice; /* +0x0010 */ unsigned long dwFailInfo; /* +0x0014 */ unsigned char pPendInfo[4]; /* +0x0014 f6 33 00 00 */ }; struct _SYSDBG_PHYSICAL { unsigned char Address[8]; /* +0x0000 3d 13 00 00 */ void *Buffer; /* +0x0008 */ unsigned long Request; /* +0x000c */ }; struct _PREFIX_TABLE_ENTRY { short NodeTypeCode; /* +0x0000 */ short NameLength; /* +0x0002 */ unsigned char NextPrefixTree[4]; /* +0x0004 17 30 00 00 */ unsigned char Links[12]; /* +0x0008 a1 17 00 00 */ unsigned char Prefix[4]; /* +0x0014 d5 17 00 00 */ }; struct _PAGEDIR_INFORMATION { /* unsigned char DontUse[0]; +0x0000 7e 29 00 00 */ /* unsigned char PageDirectoryBase[0]; +0x0000 7f 29 00 00 */ unsigned char Reserved[8]; /* +0x0000 80 29 00 00 */ }; struct _ENLISTMENT_BASIC_INFORMATION { unsigned char EnlistmentId[16]; /* +0x0000 dc 14 00 00 */ unsigned char TransactionId[16]; /* +0x0010 dc 14 00 00 */ unsigned char ResourceManagerId[16]; /* +0x0020 dc 14 00 00 */ }; struct _TOKEN_SECURITY_ATTRIBUTE_RELATIVE_V1::<unnamed-type-Values> { /* unsigned char pInt64[0]; +0x0000 f6 12 00 00 */ /* unsigned char pUint64[0]; +0x0000 f6 12 00 00 */ /* unsigned char ppString[0]; +0x0000 f6 12 00 00 */ /* unsigned char pFqbn[0]; +0x0000 f6 12 00 00 */ unsigned char pOctetString[4]; /* +0x0000 f6 12 00 00 */ }; struct _IMAGE_ROM_OPTIONAL_HEADER { unsigned short Magic; /* +0x0000 */ unsigned char MajorLinkerVersion; /* +0x0002 */ unsigned char MinorLinkerVersion; /* +0x0003 */ unsigned long SizeOfCode; /* +0x0004 */ unsigned long SizeOfInitializedData; /* +0x0008 */ unsigned long SizeOfUninitializedData; /* +0x000c */ unsigned long AddressOfEntryPoint; /* +0x0010 */ unsigned long BaseOfCode; /* +0x0014 */ unsigned long BaseOfData; /* +0x0018 */ unsigned long BaseOfBss; /* +0x001c */ unsigned long GprMask; /* +0x0020 */ unsigned char CprMask[16]; /* +0x0024 4f 1a 00 00 */ unsigned long GpValue; /* +0x0034 */ }; struct COPYFILE2_MESSAGE { unsigned char Type[4]; /* +0x0000 5a 46 00 00 */ unsigned long dwPadding; /* +0x0004 */ }; struct COPYFILE2_MESSAGE::<unnamed-type-Info>::<unnamed-type-Error> { unsigned char CopyPhase[4]; /* +0x0000 66 46 00 00 */ unsigned long dwStreamNumber; /* +0x0004 */ unsigned char hrFailure[4]; /* +0x0008 08 00 00 00 */ unsigned long dwReserved; /* +0x000c */ unsigned char uliChunkNumber[8]; /* +0x0010 fd 22 00 00 */ unsigned char uliStreamSize[8]; /* +0x0018 fd 22 00 00 */ unsigned char uliStreamBytesTransferred[8]; /* +0x0020 fd 22 00 00 */ unsigned char uliTotalFileSize[8]; /* +0x0028 fd 22 00 00 */ unsigned char uliTotalBytesTransferred[8]; /* +0x0030 fd 22 00 00 */ }; struct COPYFILE2_MESSAGE::<unnamed-type-Info>::<unnamed-type-PollContinue> { unsigned long dwReserved; /* +0x0000 */ }; struct COPYFILE2_MESSAGE::<unnamed-type-Info>::<unnamed-type-StreamFinished> { unsigned long dwStreamNumber; /* +0x0000 */ unsigned long dwReserved; /* +0x0004 */ void *hSourceFile; /* +0x0008 */ void *hDestinationFile; /* +0x000c */ unsigned char uliStreamSize[8]; /* +0x0010 fd 22 00 00 */ unsigned char uliStreamBytesTransferred[8]; /* +0x0018 fd 22 00 00 */ unsigned char uliTotalFileSize[8]; /* +0x0020 fd 22 00 00 */ unsigned char uliTotalBytesTransferred[8]; /* +0x0028 fd 22 00 00 */ }; struct COPYFILE2_MESSAGE::<unnamed-type-Info>::<unnamed-type-StreamStarted> { unsigned long dwStreamNumber; /* +0x0000 */ unsigned long dwReserved; /* +0x0004 */ void *hSourceFile; /* +0x0008 */ void *hDestinationFile; /* +0x000c */ unsigned char uliStreamSize[8]; /* +0x0010 fd 22 00 00 */ unsigned char uliTotalFileSize[8]; /* +0x0018 fd 22 00 00 */ }; struct COPYFILE2_MESSAGE::<unnamed-type-Info>::<unnamed-type-ChunkFinished> { unsigned long dwStreamNumber; /* +0x0000 */ unsigned long dwReserved; /* +0x0004 */ void *hSourceFile; /* +0x0008 */ void *hDestinationFile; /* +0x000c */ unsigned char uliChunkNumber[8]; /* +0x0010 fd 22 00 00 */ unsigned char uliChunkSize[8]; /* +0x0018 fd 22 00 00 */ unsigned char uliStreamSize[8]; /* +0x0020 fd 22 00 00 */ unsigned char uliStreamBytesTransferred[8]; /* +0x0028 fd 22 00 00 */ unsigned char uliTotalFileSize[8]; /* +0x0030 fd 22 00 00 */ unsigned char uliTotalBytesTransferred[8]; /* +0x0038 fd 22 00 00 */ }; struct COPYFILE2_MESSAGE::<unnamed-type-Info>::<unnamed-type-ChunkStarted> { unsigned long dwStreamNumber; /* +0x0000 */ unsigned long dwReserved; /* +0x0004 */ void *hSourceFile; /* +0x0008 */ void *hDestinationFile; /* +0x000c */ unsigned char uliChunkNumber[8]; /* +0x0010 fd 22 00 00 */ unsigned char uliChunkSize[8]; /* +0x0018 fd 22 00 00 */ unsigned char uliStreamSize[8]; /* +0x0020 fd 22 00 00 */ unsigned char uliTotalFileSize[8]; /* +0x0028 fd 22 00 00 */ }; struct _SYSTEM_MEMORY_LIST_INFORMATION { unsigned long ZeroPageCount; /* +0x0000 */ unsigned long FreePageCount; /* +0x0004 */ unsigned long ModifiedPageCount; /* +0x0008 */ unsigned long ModifiedNoWritePageCount; /* +0x000c */ unsigned long BadPageCount; /* +0x0010 */ unsigned char PageCountByPriority[32]; /* +0x0014 75 46 00 00 */ unsigned char RepurposedPagesByPriority[32]; /* +0x0034 75 46 00 00 */ unsigned long ModifiedPageCountPageFile; /* +0x0054 */ }; struct _INPUT_RECORD { unsigned short EventType; /* +0x0000 */ }; struct _TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY { unsigned long long Offset; /* +0x0000 */ unsigned long NameFlags; /* +0x0008 */ long long FileId; /* +0x0010 */ unsigned long Reserved1; /* +0x0018 */ unsigned long Reserved2; /* +0x001c */ long long Reserved3; /* +0x0020 */ unsigned char FileName[8]; /* +0x0028 f7 13 00 00 */ }; struct _RPC_HTTP_TRANSPORT_CREDENTIALS_W { unsigned char TransportCredentials[4]; /* +0x0000 01 1d 00 00 */ unsigned long Flags; /* +0x0004 */ unsigned long AuthenticationTarget; /* +0x0008 */ unsigned long NumberOfAuthnSchemes; /* +0x000c */ unsigned long *AuthnSchemes; /* +0x0010 */ unsigned short *ServerCertificateSubject; /* +0x0014 */ }; struct _ACL_SIZE_INFORMATION { unsigned long AceCount; /* +0x0000 */ unsigned long AclBytesInUse; /* +0x0004 */ unsigned long AclBytesFree; /* +0x0008 */ }; struct _TIMER_BASIC_INFORMATION { unsigned char RemainingTime[8]; /* +0x0000 3d 13 00 00 */ unsigned char TimerState; /* +0x0008 */ }; struct _CERT_CRL_CONTEXT_PAIR { unsigned char pCertContext[4]; /* +0x0000 b9 13 00 00 */ unsigned char pCrlContext[4]; /* +0x0004 d8 1f 00 00 */ }; struct _REASON_BUFFER { unsigned long Flags; /* +0x0000 */ unsigned long ResourceFileNameOffset; /* +0x0004 */ unsigned short ResourceReasonId; /* +0x0008 */ unsigned long StringCount; /* +0x000c */ unsigned long SubstitutionStringsOffset; /* +0x0010 */ unsigned long SimpleStringOffset; /* +0x0004 */ }; struct _SHQUERYRBINFO { unsigned long cbSize; /* +0x0000 */ long long i64Size; /* +0x0004 */ long long i64NumItems; /* +0x000c */ }; struct _WORKER_FACTORY_BASIC_INFORMATION { unsigned char Timeout[8]; /* +0x0000 3d 13 00 00 */ unsigned char RetryTimeout[8]; /* +0x0008 3d 13 00 00 */ unsigned char IdleTimeout[8]; /* +0x0010 3d 13 00 00 */ unsigned char Paused; /* +0x0018 */ unsigned char TimerSet; /* +0x0019 */ unsigned char QueuedToExWorker; /* +0x001a */ unsigned char MayCreate; /* +0x001b */ unsigned char CreateInProgress; /* +0x001c */ unsigned char InsertedIntoQueue; /* +0x001d */ unsigned char Shutdown; /* +0x001e */ unsigned long BindingCount; /* +0x0020 */ unsigned long ThreadMinimum; /* +0x0024 */ unsigned long ThreadMaximum; /* +0x0028 */ unsigned long PendingWorkerCount; /* +0x002c */ unsigned long WaitingWorkerCount; /* +0x0030 */ unsigned long TotalWorkerCount; /* +0x0034 */ unsigned long ReleaseCount; /* +0x0038 */ long long InfiniteWaitGoal; /* +0x0040 */ unsigned char StartRoutine[4]; /* +0x0048 cc 19 00 00 */ void *StartParameter; /* +0x004c */ void *ProcessId; /* +0x0050 */ unsigned long StackReserve; /* +0x0054 */ unsigned long StackCommit; /* +0x0058 */ long LastThreadCreationStatus; /* +0x005c */ }; struct _IMAGE_BOUND_IMPORT_DESCRIPTOR { unsigned long TimeDateStamp; /* +0x0000 */ unsigned short OffsetModuleName; /* +0x0004 */ unsigned short NumberOfModuleForwarderRefs; /* +0x0006 */ }; struct _TOKEN_DEVICE_CLAIMS { void *DeviceClaims; /* +0x0000 */ }; struct _LDT_INFORMATION { unsigned long Start; /* +0x0000 */ unsigned long Length; /* +0x0004 */ unsigned char LdtEntries[8]; /* +0x0008 e9 46 00 00 */ }; struct tagMInterfacePointer { unsigned long ulCntData; /* +0x0000 */ unsigned char abData[4]; /* +0x0004 f9 12 00 00 */ }; struct _TEB_ACTIVE_FRAME { unsigned long Flags; /* +0x0000 */ unsigned char Previous[4]; /* +0x0004 67 2e 00 00 */ unsigned char Context[4]; /* +0x0008 f7 46 00 00 */ }; struct _ACCESS_REASONS { unsigned char Data[128]; /* +0x0000 9b 2c 00 00 */ }; struct _OCSP_BASIC_RESPONSE_INFO { unsigned long dwVersion; /* +0x0000 */ unsigned long dwResponderIdChoice; /* +0x0004 */ /* unsigned char ByNameResponderId[0]; +0x0008 02 13 00 00 */ unsigned char ByKeyResponderId[8]; /* +0x0008 02 13 00 00 */ unsigned char ProducedAt[8]; /* +0x0010 31 13 00 00 */ unsigned long cResponseEntry; /* +0x0018 */ unsigned char rgResponseEntry[4]; /* +0x001c 44 2f 00 00 */ unsigned long cExtension; /* +0x0020 */ unsigned char rgExtension[4]; /* +0x0024 22 16 00 00 */ }; struct _CMC_TAGGED_OTHER_MSG { unsigned long dwBodyPartID; /* +0x0000 */ char *pszObjId; /* +0x0004 */ unsigned char Value[8]; /* +0x0008 02 13 00 00 */ }; struct _IO_RESOURCE_DESCRIPTOR::<unnamed-type-u>::<unnamed-type-Memory64> { unsigned long Length64; /* +0x0000 */ unsigned long Alignment64; /* +0x0004 */ unsigned char MinimumAddress[8]; /* +0x0008 3d 13 00 00 */ unsigned char MaximumAddress[8]; /* +0x0010 3d 13 00 00 */ }; struct _IO_RESOURCE_DESCRIPTOR::<unnamed-type-u>::<unnamed-type-Memory48> { unsigned long Length48; /* +0x0000 */ unsigned long Alignment48; /* +0x0004 */ unsigned char MinimumAddress[8]; /* +0x0008 3d 13 00 00 */ unsigned char MaximumAddress[8]; /* +0x0010 3d 13 00 00 */ }; struct _IO_RESOURCE_DESCRIPTOR::<unnamed-type-u>::<unnamed-type-Memory40> { unsigned long Length40; /* +0x0000 */ unsigned long Alignment40; /* +0x0004 */ unsigned char MinimumAddress[8]; /* +0x0008 3d 13 00 00 */ unsigned char MaximumAddress[8]; /* +0x0010 3d 13 00 00 */ }; struct _IO_RESOURCE_DESCRIPTOR::<unnamed-type-u>::<unnamed-type-ConfigData> { unsigned long Priority; /* +0x0000 */ unsigned long Reserved1; /* +0x0004 */ unsigned long Reserved2; /* +0x0008 */ }; struct _IO_RESOURCE_DESCRIPTOR::<unnamed-type-u>::<unnamed-type-BusNumber> { unsigned long Length; /* +0x0000 */ unsigned long MinBusNumber; /* +0x0004 */ unsigned long MaxBusNumber; /* +0x0008 */ unsigned long Reserved; /* +0x000c */ }; struct _IO_RESOURCE_DESCRIPTOR::<unnamed-type-u>::<unnamed-type-Generic> { unsigned long Length; /* +0x0000 */ unsigned long Alignment; /* +0x0004 */ unsigned char MinimumAddress[8]; /* +0x0008 3d 13 00 00 */ unsigned char MaximumAddress[8]; /* +0x0010 3d 13 00 00 */ }; struct _IO_RESOURCE_DESCRIPTOR::<unnamed-type-u>::<unnamed-type-DmaV3> { unsigned long RequestLine; /* +0x0000 */ unsigned long Reserved; /* +0x0004 */ unsigned long Channel; /* +0x0008 */ unsigned long TransferWidth; /* +0x000c */ }; struct _IO_RESOURCE_DESCRIPTOR::<unnamed-type-u>::<unnamed-type-Dma> { unsigned long MinimumChannel; /* +0x0000 */ unsigned long MaximumChannel; /* +0x0004 */ }; struct _IO_RESOURCE_DESCRIPTOR::<unnamed-type-u>::<unnamed-type-Interrupt> { unsigned long MinimumVector; /* +0x0000 */ unsigned long MaximumVector; /* +0x0004 */ unsigned char AffinityPolicy[4]; /* +0x0008 54 42 00 00 */ unsigned char PriorityPolicy[4]; /* +0x000c 6b 2f 00 00 */ unsigned long TargetedProcessors; /* +0x0010 */ }; struct _XSAVE_SUPPORTED_CPU { unsigned char CpuInfo[32]; /* +0x0000 d1 15 00 00 */ /* unsigned char CpuErrata[0]; +0x0020 4e 1c 00 00 */ unsigned long long Unused; /* +0x0020 */ }; struct _PLUGPLAY_CONTROL_PROPERTY_DATA { unsigned char DeviceInstance[8]; /* +0x0000 dd 12 00 00 */ unsigned long PropertyType; /* +0x0008 */ void *Buffer; /* +0x000c */ unsigned long BufferSize; /* +0x0010 */ }; struct tm { unsigned char tm_sec[4]; /* +0x0000 74 00 00 00 */ unsigned char tm_min[4]; /* +0x0004 74 00 00 00 */ unsigned char tm_hour[4]; /* +0x0008 74 00 00 00 */ unsigned char tm_mday[4]; /* +0x000c 74 00 00 00 */ unsigned char tm_mon[4]; /* +0x0010 74 00 00 00 */ unsigned char tm_year[4]; /* +0x0014 74 00 00 00 */ unsigned char tm_wday[4]; /* +0x0018 74 00 00 00 */ unsigned char tm_yday[4]; /* +0x001c 74 00 00 00 */ unsigned char tm_isdst[4]; /* +0x0020 74 00 00 00 */ }; struct _HARDWARE_COUNTER { unsigned char Type[4]; /* +0x0000 d0 19 00 00 */ unsigned long Reserved; /* +0x0004 */ unsigned long long Index; /* +0x0008 */ }; struct _INPUT_RECORD::<unnamed-type-Event> { /* unsigned char KeyEvent[0]; +0x0000 b5 47 00 00 */ /* unsigned char MouseEvent[0]; +0x0000 10 2f 00 00 */ /* unsigned char WindowBufferSizeEvent[0]; +0x0000 b6 47 00 00 */ /* unsigned char MenuEvent[0]; +0x0000 60 33 00 00 */ unsigned char FocusEvent[16]; /* +0x0000 1a 45 00 00 */ }; struct _IMAGE_LINENUMBER::<unnamed-type-Type> { unsigned long SymbolTableIndex; /* +0x0000 */ unsigned long VirtualAddress; /* +0x0000 */ }; struct _REMOTE_PORT_VIEW { unsigned long Length; /* +0x0000 */ unsigned long ViewSize; /* +0x0004 */ void *ViewBase; /* +0x0008 */ }; struct _FSCTL_INTEGRITY_INFORMATION_BUFFER { unsigned short ChecksumAlgorithm; /* +0x0000 */ unsigned short Reserved; /* +0x0002 */ unsigned long Flags; /* +0x0004 */ }; struct _PSFEATURE_CUSTPAPER { long lOrientation; /* +0x0000 */ long lWidth; /* +0x0004 */ long lHeight; /* +0x0008 */ long lWidthOffset; /* +0x000c */ long lHeightOffset; /* +0x0010 */ }; struct tagNEWTEXTMETRICEXW { unsigned char ntmTm[76]; /* +0x0000 c0 3a 00 00 */ unsigned char ntmFontSig[24]; /* +0x004c 57 20 00 00 */ }; struct tagCUSTDATAITEM { unsigned char guid[16]; /* +0x0000 dc 14 00 00 */ unsigned char varValue[16]; /* +0x0010 3b 18 00 00 */ }; struct _RGNDATAHEADER { unsigned long dwSize; /* +0x0000 */ unsigned long iType; /* +0x0004 */ unsigned long nCount; /* +0x0008 */ unsigned long nRgnSize; /* +0x000c */ unsigned char rcBound[16]; /* +0x0010 63 14 00 00 */ }; struct _SECURITY_SEED_AND_LENGTH { unsigned char Length; /* +0x0000 */ unsigned char Seed; /* +0x0001 */ }; struct tagEMRFORMAT { unsigned long dSignature; /* +0x0000 */ unsigned long nVersion; /* +0x0004 */ unsigned long cbData; /* +0x0008 */ unsigned long offData; /* +0x000c */ }; struct _PS_CREATE_INFO::<unnamed-tag>::<unnamed-type-SuccessState> { unsigned long OutputFlags; /* +0x0000 */ /* unsigned char ProtectedProcess[0]; +0x0000 6f 1e 00 00 */ /* unsigned char AddressSpaceOverride[0]; +0x0000 70 1e 00 00 */ /* unsigned char DevOverrideEnabled[0]; +0x0000 71 1e 00 00 */ /* unsigned char ManifestDetected[0]; +0x0000 e3 25 00 00 */ unsigned char SpareBits1[1]; /* +0x0000 fd 47 00 00 */ unsigned char SpareBits2[1]; /* +0x0001 fe 47 00 00 */ unsigned char SpareBits3[2]; /* +0x0002 69 2e 00 00 */ void *FileHandle; /* +0x0004 */ void *SectionHandle; /* +0x0008 */ unsigned long long UserProcessParametersNative; /* +0x0010 */ unsigned long UserProcessParametersWow64; /* +0x0018 */ unsigned long CurrentParameterFlags; /* +0x001c */ unsigned long long PebAddressNative; /* +0x0020 */ unsigned long PebAddressWow64; /* +0x0028 */ unsigned long long ManifestAddress; /* +0x0030 */ unsigned long ManifestSize; /* +0x0038 */ }; struct _PS_CREATE_INFO::<unnamed-tag>::<unnamed-type-ExeName> { void *IFEOKey; /* +0x0000 */ }; struct _PS_CREATE_INFO::<unnamed-tag>::<unnamed-type-ExeFormat> { unsigned short DllCharacteristics; /* +0x0000 */ }; struct _PS_CREATE_INFO::<unnamed-tag>::<unnamed-type-FailSection> { void *FileHandle; /* +0x0000 */ }; struct _PS_CREATE_INFO::<unnamed-tag>::<unnamed-type-InitState> { unsigned long InitFlags; /* +0x0000 */ /* unsigned char WriteOutputOnExit[0]; +0x0000 6f 1e 00 00 */ /* unsigned char DetectManifest[0]; +0x0000 70 1e 00 00 */ /* unsigned char IFEOSkipDebugger[0]; +0x0000 71 1e 00 00 */ /* unsigned char IFEODoNotPropagateKeyState[0]; +0x0000 e3 25 00 00 */ unsigned char SpareBits1[1]; /* +0x0000 fd 47 00 00 */ unsigned char SpareBits2[1]; /* +0x0001 fe 47 00 00 */ unsigned char ProhibitedImageCharacteristics[2]; /* +0x0002 69 2e 00 00 */ unsigned long AdditionalFileAccess; /* +0x0004 */ }; struct _RTL_HEAP_TAG { unsigned long NumberOfAllocations; /* +0x0000 */ unsigned long NumberOfFrees; /* +0x0004 */ unsigned long BytesAllocated; /* +0x0008 */ unsigned short TagIndex; /* +0x000c */ unsigned short CreatorBackTraceIndex; /* +0x000e */ unsigned char TagName[48]; /* +0x0010 0d 48 00 00 */ }; struct _SYSTEM_FIRMWARE_TABLE_INFORMATION { unsigned long ProviderSignature; /* +0x0000 */ unsigned char Action[4]; /* +0x0004 14 48 00 00 */ unsigned long TableID; /* +0x0008 */ unsigned long TableBufferLength; /* +0x000c */ unsigned char TableBuffer[4]; /* +0x0010 f9 12 00 00 */ }; struct _SD_GLOBAL_CHANGE_OUTPUT { unsigned long Flags; /* +0x0000 */ unsigned long ChangeType; /* +0x0004 */ /* unsigned char SdChange[0]; +0x0008 46 21 00 00 */ /* unsigned char SdQueryStats[0]; +0x0008 95 36 00 00 */ unsigned char SdEnumSds[64]; /* +0x0008 54 44 00 00 */ }; struct _BCRYPT_KEY_DATA_BLOB_HEADER { unsigned long dwMagic; /* +0x0000 */ unsigned long dwVersion; /* +0x0004 */ unsigned long cbKeyData; /* +0x0008 */ }; struct _IO_STATUS_BLOCK { long Status; /* +0x0000 */ void *Pointer; /* +0x0000 */ unsigned long Information; /* +0x0004 */ }; struct _xml_error { unsigned char _nLine[4]; /* +0x0000 75 00 00 00 */ unsigned char _pchBuf[4]; /* +0x0004 71 04 00 00 */ unsigned char _cchBuf[4]; /* +0x0008 75 00 00 00 */ unsigned char _ich[4]; /* +0x000c 75 00 00 00 */ unsigned char _pszFound[4]; /* +0x0010 71 04 00 00 */ unsigned char _pszExpected[4]; /* +0x0014 71 04 00 00 */ unsigned long _reserved1; /* +0x0018 */ unsigned long _reserved2; /* +0x001c */ }; struct _RemotableHandle::__MIDL_IWinTypes_0009 { long hInproc; /* +0x0000 */ long hRemote; /* +0x0000 */ }; struct _PROCESS_EXTENDED_BASIC_INFORMATION64 { unsigned long long Size; /* +0x0000 */ unsigned char BasicInfo[48]; /* +0x0008 64 48 00 00 */ /* unsigned char Flags[0]; +0x0038 75 00 00 00 */ /* unsigned char IsProtectedProcess[0]; +0x0038 cf 1c 00 00 */ /* unsigned char IsWow64Process[0]; +0x0038 d0 1c 00 00 */ /* unsigned char IsProcessDeleting[0]; +0x0038 d1 1c 00 00 */ /* unsigned char IsCrossSessionCreate[0]; +0x0038 65 48 00 00 */ unsigned char SpareBits[8]; /* +0x0038 66 48 00 00 */ }; struct _OVERLAPPED { unsigned long Internal; /* +0x0000 */ unsigned long InternalHigh; /* +0x0004 */ unsigned long Offset; /* +0x0008 */ unsigned long OffsetHigh; /* +0x000c */ void *Pointer; /* +0x0008 */ void *hEvent; /* +0x0010 */ }; struct tagRID_DEVICE_INFO_HID { unsigned long dwVendorId; /* +0x0000 */ unsigned long dwProductId; /* +0x0004 */ unsigned long dwVersionNumber; /* +0x0008 */ unsigned short usUsagePage; /* +0x000c */ unsigned short usUsage; /* +0x000e */ }; struct tagOIFI { unsigned char cb[4]; /* +0x0000 75 00 00 00 */ unsigned char fMDIApp[4]; /* +0x0004 74 00 00 00 */ unsigned char hwndFrame[4]; /* +0x0008 f1 12 00 00 */ unsigned char haccel[4]; /* +0x000c c6 21 00 00 */ unsigned char cAccelEntries[4]; /* +0x0010 75 00 00 00 */ }; struct _BCRYPT_OID { unsigned long cbOID; /* +0x0000 */ unsigned char *pbOID; /* +0x0004 */ }; struct IMAGE_LOAD_CONFIG_DIRECTORY32 { unsigned long Size; /* +0x0000 */ unsigned long TimeDateStamp; /* +0x0004 */ unsigned short MajorVersion; /* +0x0008 */ unsigned short MinorVersion; /* +0x000a */ unsigned long GlobalFlagsClear; /* +0x000c */ unsigned long GlobalFlagsSet; /* +0x0010 */ unsigned long CriticalSectionDefaultTimeout; /* +0x0014 */ unsigned long DeCommitFreeBlockThreshold; /* +0x0018 */ unsigned long DeCommitTotalFreeThreshold; /* +0x001c */ unsigned long LockPrefixTable; /* +0x0020 */ unsigned long MaximumAllocationSize; /* +0x0024 */ unsigned long VirtualMemoryThreshold; /* +0x0028 */ unsigned long ProcessHeapFlags; /* +0x002c */ unsigned long ProcessAffinityMask; /* +0x0030 */ unsigned short CSDVersion; /* +0x0034 */ unsigned short Reserved1; /* +0x0036 */ unsigned long EditList; /* +0x0038 */ unsigned long SecurityCookie; /* +0x003c */ unsigned long SEHandlerTable; /* +0x0040 */ unsigned long SEHandlerCount; /* +0x0044 */ }; struct _RTL_DYNAMIC_TIME_ZONE_INFORMATION { unsigned char tzi[172]; /* +0x0000 1e 3b 00 00 */ unsigned char TimeZoneKeyName[256]; /* +0x00ac a7 15 00 00 */ unsigned char DynamicDaylightTimeDisabled; /* +0x01ac */ }; struct _THREAD_UMS_INFORMATION { unsigned char Command[4]; /* +0x0000 80 48 00 00 */ unsigned char CompletionList[4]; /* +0x0004 dc 15 00 00 */ unsigned char UmsContext[4]; /* +0x0008 c8 17 00 00 */ }; struct tagORPCTHAT { unsigned long flags; /* +0x0000 */ unsigned char extensions[4]; /* +0x0004 0f 30 00 00 */ }; struct _PS_STD_HANDLE_INFO { unsigned long Flags; /* +0x0000 */ /* unsigned char StdHandleState[0]; +0x0000 09 35 00 00 */ unsigned char PseudoHandleMask[4]; /* +0x0000 85 48 00 00 */ unsigned long StdHandleSubsystemType; /* +0x0004 */ }; struct _TP_CALLBACK_ENVIRON_V3 { unsigned long Version; /* +0x0000 */ unsigned char Pool[4]; /* +0x0004 8a 48 00 00 */ unsigned char CleanupGroup[4]; /* +0x0008 8b 48 00 00 */ unsigned char CleanupGroupCancelCallback[4]; /* +0x000c 8d 48 00 00 */ void *RaceDll; /* +0x0010 */ unsigned char ActivationContext[4]; /* +0x0014 69 17 00 00 */ unsigned char FinalizationCallback[16]; /* +0x0018 90 48 00 00 */ }; struct _UNIVERSAL_NAME_INFOA { char *lpUniversalName; /* +0x0000 */ }; struct _FILE_INTERNAL_INFORMATION { unsigned char IndexNumber[8]; /* +0x0000 3d 13 00 00 */ }; struct _CMSG_CTRL_MAIL_LIST_DECRYPT_PARA { unsigned long cbSize; /* +0x0000 */ unsigned long hCryptProv; /* +0x0004 */ unsigned char pMailList[4]; /* +0x0008 b6 48 00 00 */ unsigned long dwRecipientIndex; /* +0x000c */ unsigned long dwKeyChoice; /* +0x0010 */ unsigned long hKeyEncryptionKey; /* +0x0014 */ void *pvKeyEncryptionKey; /* +0x0014 */ }; struct tagEMRSETMAPPERFLAGS { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned long dwFlags; /* +0x0008 */ }; struct _SYSTEM_POWER_STATUS { unsigned char ACLineStatus; /* +0x0000 */ unsigned char BatteryFlag; /* +0x0001 */ unsigned char BatteryLifePercent; /* +0x0002 */ unsigned char Reserved1; /* +0x0003 */ unsigned long BatteryLifeTime; /* +0x0004 */ unsigned long BatteryFullLifeTime; /* +0x0008 */ }; struct _PLUGPLAY_CONTROL_RETRIEVE_DOCK_DATA { unsigned long DeviceInstanceLength; /* +0x0000 */ unsigned char DeviceInstance[4]; /* +0x0004 71 04 00 00 */ }; struct DISPLAYCONFIG_TARGET_MODE { unsigned char targetVideoSignalInfo[48]; /* +0x0000 ce 48 00 00 */ }; struct tagCBT_CREATEWNDA { unsigned char lpcs[4]; /* +0x0000 67 33 00 00 */ unsigned char hwndInsertAfter[4]; /* +0x0004 f1 12 00 00 */ }; struct _FILEMUIINFO { unsigned long dwSize; /* +0x0000 */ unsigned long dwVersion; /* +0x0004 */ unsigned long dwFileType; /* +0x0008 */ unsigned char pChecksum[16]; /* +0x000c 09 1c 00 00 */ unsigned char pServiceChecksum[16]; /* +0x001c 09 1c 00 00 */ unsigned long dwLanguageNameOffset; /* +0x002c */ unsigned long dwTypeIDMainSize; /* +0x0030 */ unsigned long dwTypeIDMainOffset; /* +0x0034 */ unsigned long dwTypeNameMainOffset; /* +0x0038 */ unsigned long dwTypeIDMUISize; /* +0x003c */ unsigned long dwTypeIDMUIOffset; /* +0x0040 */ unsigned long dwTypeNameMUIOffset; /* +0x0044 */ unsigned char abBuffer[8]; /* +0x0048 7f 19 00 00 */ }; struct _IO_COUNTERS { unsigned long long ReadOperationCount; /* +0x0000 */ unsigned long long WriteOperationCount; /* +0x0008 */ unsigned long long OtherOperationCount; /* +0x0010 */ unsigned long long ReadTransferCount; /* +0x0018 */ unsigned long long WriteTransferCount; /* +0x0020 */ unsigned long long OtherTransferCount; /* +0x0028 */ }; struct _PUBLICKEYSTRUC { unsigned char bType; /* +0x0000 */ unsigned char bVersion; /* +0x0001 */ unsigned short reserved; /* +0x0002 */ unsigned char aiKeyAlg[4]; /* +0x0004 75 00 00 00 */ }; struct _CTL_FIND_USAGE_PARA { unsigned long cbSize; /* +0x0000 */ unsigned char SubjectUsage[8]; /* +0x0004 bd 13 00 00 */ unsigned char ListIdentifier[8]; /* +0x000c 02 13 00 00 */ unsigned char pSigner[4]; /* +0x0014 39 1a 00 00 */ }; struct tagOBJREF::<unnamed-type-u_objref>::<unnamed-type-u_extended> { unsigned char std[40]; /* +0x0000 10 49 00 00 */ unsigned char pORData[4]; /* +0x0028 12 49 00 00 */ unsigned char saResAddr[12]; /* +0x002c 64 1f 00 00 */ }; struct tagOBJREF::<unnamed-type-u_objref>::<unnamed-type-u_custom> { unsigned char clsid[16]; /* +0x0000 dc 14 00 00 */ unsigned long cbExtension; /* +0x0010 */ unsigned long size; /* +0x0014 */ unsigned char *pData; /* +0x0018 */ }; struct tagOBJREF::<unnamed-type-u_objref>::<unnamed-type-u_handler> { unsigned char std[40]; /* +0x0000 10 49 00 00 */ unsigned char clsid[16]; /* +0x0028 dc 14 00 00 */ unsigned char saResAddr[8]; /* +0x0038 64 1f 00 00 */ }; struct tagOBJREF::<unnamed-type-u_objref>::<unnamed-type-u_standard> { unsigned char std[40]; /* +0x0000 10 49 00 00 */ unsigned char saResAddr[8]; /* +0x0028 64 1f 00 00 */ }; struct _SD_ENUM_SDS_ENTRY { unsigned long Hash; /* +0x0000 */ unsigned long SecurityId; /* +0x0004 */ unsigned long long Offset; /* +0x0008 */ unsigned long Length; /* +0x0010 */ unsigned char Descriptor[4]; /* +0x0014 f9 12 00 00 */ }; struct tagRID_DEVICE_INFO_KEYBOARD { unsigned long dwType; /* +0x0000 */ unsigned long dwSubType; /* +0x0004 */ unsigned long dwKeyboardMode; /* +0x0008 */ unsigned long dwNumberOfFunctionKeys; /* +0x000c */ unsigned long dwNumberOfIndicators; /* +0x0010 */ unsigned long dwNumberOfKeysTotal; /* +0x0014 */ }; struct _CRYPT_TIMESTAMP_RESPONSE { unsigned long dwStatus; /* +0x0000 */ unsigned long cFreeText; /* +0x0004 */ unsigned char rgFreeText[4]; /* +0x0008 d0 13 00 00 */ unsigned char FailureInfo[12]; /* +0x000c 03 13 00 00 */ unsigned char ContentInfo[8]; /* +0x0018 02 13 00 00 */ }; struct _userHPALETTE { long fContext; /* +0x0000 */ }; struct _userHPALETTE::__MIDL_IWinTypes_0008 { long hInproc; /* +0x0000 */ /* unsigned char hRemote[0]; +0x0000 42 35 00 00 */ long long hInproc64; /* +0x0000 */ }; struct _userBITMAP { long bmType; /* +0x0000 */ long bmWidth; /* +0x0004 */ long bmHeight; /* +0x0008 */ long bmWidthBytes; /* +0x000c */ unsigned short bmPlanes; /* +0x0010 */ unsigned short bmBitsPixel; /* +0x0012 */ unsigned long cbSize; /* +0x0014 */ unsigned char pBuffer[4]; /* +0x0018 f9 12 00 00 */ }; struct ANON_OBJECT_HEADER_BIGOBJ { unsigned short Sig1; /* +0x0000 */ unsigned short Sig2; /* +0x0002 */ unsigned short Version; /* +0x0004 */ unsigned short Machine; /* +0x0006 */ unsigned long TimeDateStamp; /* +0x0008 */ unsigned char ClassID[16]; /* +0x000c dc 14 00 00 */ unsigned long SizeOfData; /* +0x001c */ unsigned long Flags; /* +0x0020 */ unsigned long MetaDataSize; /* +0x0024 */ unsigned long MetaDataOffset; /* +0x0028 */ unsigned long NumberOfSections; /* +0x002c */ unsigned long PointerToSymbolTable; /* +0x0030 */ unsigned long NumberOfSymbols; /* +0x0034 */ }; struct _FILE_DISPOSITION_INFORMATION { unsigned char DeleteFile; /* +0x0000 */ }; struct _FILE_PIPE_WAIT_FOR_BUFFER { unsigned char Timeout[8]; /* +0x0000 3d 13 00 00 */ unsigned long NameLength; /* +0x0008 */ unsigned char TimeoutSpecified; /* +0x000c */ unsigned char Name[2]; /* +0x000e f7 13 00 00 */ }; struct _CRYPT_CONTENT_INFO { char *pszObjId; /* +0x0000 */ unsigned char Content[8]; /* +0x0004 02 13 00 00 */ }; struct HSTRING_HEADER::<unnamed-type-Reserved> { void *Reserved1; /* +0x0000 */ unsigned char Reserved2[20]; /* +0x0000 b6 1e 00 00 */ }; struct _PROCESS_HANDLE_TRACING_ENTRY { void *Handle; /* +0x0000 */ unsigned char ClientId[8]; /* +0x0004 3e 13 00 00 */ unsigned long Type; /* +0x000c */ unsigned char Stacks[64]; /* +0x0010 6e 49 00 00 */ }; struct _REQUEST_OPLOCK_OUTPUT_BUFFER { unsigned short StructureVersion; /* +0x0000 */ unsigned short StructureLength; /* +0x0002 */ unsigned long OriginalOplockLevel; /* +0x0004 */ unsigned long NewOplockLevel; /* +0x0008 */ unsigned long Flags; /* +0x000c */ unsigned long AccessMode; /* +0x0010 */ unsigned short ShareMode; /* +0x0014 */ }; struct _SE_IMPERSONATION_STATE { void *Token; /* +0x0000 */ unsigned char CopyOnOpen; /* +0x0004 */ unsigned char EffectiveOnly; /* +0x0005 */ unsigned char Level[4]; /* +0x0008 05 2e 00 00 */ }; struct _currencyfmtA { unsigned char NumDigits[4]; /* +0x0000 75 00 00 00 */ unsigned char LeadingZero[4]; /* +0x0004 75 00 00 00 */ unsigned char Grouping[4]; /* +0x0008 75 00 00 00 */ char *lpDecimalSep; /* +0x000c */ char *lpThousandSep; /* +0x0010 */ unsigned char NegativeOrder[4]; /* +0x0014 75 00 00 00 */ unsigned char PositiveOrder[4]; /* +0x0018 75 00 00 00 */ char *lpCurrencySymbol; /* +0x001c */ }; struct tagDRAWITEMSTRUCT { unsigned char CtlType[4]; /* +0x0000 75 00 00 00 */ unsigned char CtlID[4]; /* +0x0004 75 00 00 00 */ unsigned char itemID[4]; /* +0x0008 75 00 00 00 */ unsigned char itemAction[4]; /* +0x000c 75 00 00 00 */ unsigned char itemState[4]; /* +0x0010 75 00 00 00 */ unsigned char hwndItem[4]; /* +0x0014 f1 12 00 00 */ unsigned char hDC[4]; /* +0x0018 f1 1e 00 00 */ unsigned char rcItem[16]; /* +0x001c 63 14 00 00 */ unsigned long itemData; /* +0x002c */ }; struct _TypeDescriptor { unsigned char pVFTable[4]; /* +0x0000 3d 19 00 00 */ void *spare; /* +0x0004 */ /* unsigned char name[0]; +0x0008 a0 49 00 00 */ }; struct tagSOLE_AUTHENTICATION_LIST { unsigned long cAuthInfo; /* +0x0000 */ unsigned char aAuthInfo[4]; /* +0x0004 2a 25 00 00 */ }; struct tagGCP_RESULTSW { unsigned long lStructSize; /* +0x0000 */ unsigned char lpOutString[4]; /* +0x0004 71 04 00 00 */ unsigned char lpOrder[4]; /* +0x0008 75 04 00 00 */ unsigned char lpDx[4]; /* +0x000c 74 04 00 00 */ unsigned char lpCaretPos[4]; /* +0x0010 74 04 00 00 */ char *lpClass; /* +0x0014 */ unsigned char lpGlyphs[4]; /* +0x0018 71 04 00 00 */ unsigned char nGlyphs[4]; /* +0x001c 75 00 00 00 */ unsigned char nMaxFit[4]; /* +0x0020 74 00 00 00 */ }; struct _RPC_ASYNC_NOTIFICATION_INFO::<unnamed-type-HWND> { unsigned char hWnd[4]; /* +0x0000 f1 12 00 00 */ unsigned char Msg[4]; /* +0x0004 75 00 00 00 */ }; struct _RPC_ASYNC_NOTIFICATION_INFO::<unnamed-type-IOC> { void *hIOPort; /* +0x0000 */ unsigned long dwNumberOfBytesTransferred; /* +0x0004 */ unsigned long dwCompletionKey; /* +0x0008 */ unsigned char lpOverlapped[4]; /* +0x000c 5a 19 00 00 */ }; struct _RPC_ASYNC_NOTIFICATION_INFO::<unnamed-type-APC> { unsigned char NotificationRoutine[4]; /* +0x0000 a7 13 00 00 */ void *hThread; /* +0x0004 */ }; struct _BCRYPT_DSA_KEY_BLOB_V2 { unsigned long dwMagic; /* +0x0000 */ unsigned long cbKey; /* +0x0004 */ unsigned char hashAlgorithm[4]; /* +0x0008 88 44 00 00 */ unsigned char standardVersion[4]; /* +0x000c 89 44 00 00 */ unsigned long cbSeedLength; /* +0x0010 */ unsigned long cbGroupSize; /* +0x0014 */ unsigned char Count[4]; /* +0x0018 b7 17 00 00 */ }; struct _CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 { unsigned long Name; /* +0x0000 */ unsigned short ValueType; /* +0x0004 */ unsigned short Reserved; /* +0x0006 */ unsigned long Flags; /* +0x0008 */ unsigned long ValueCount; /* +0x000c */ }; struct tagLOGFONTA { long lfHeight; /* +0x0000 */ long lfWidth; /* +0x0004 */ long lfEscapement; /* +0x0008 */ long lfOrientation; /* +0x000c */ long lfWeight; /* +0x0010 */ unsigned char lfItalic; /* +0x0014 */ unsigned char lfUnderline; /* +0x0015 */ unsigned char lfStrikeOut; /* +0x0016 */ unsigned char lfCharSet; /* +0x0017 */ unsigned char lfOutPrecision; /* +0x0018 */ unsigned char lfClipPrecision; /* +0x0019 */ unsigned char lfQuality; /* +0x001a */ unsigned char lfPitchAndFamily; /* +0x001b */ unsigned char lfFaceName[32]; /* +0x001c 43 23 00 00 */ }; struct _SYSTEM_CRASH_DUMP_STATE_INFORMATION { unsigned char CrashDumpConfigurationClass[4]; /* +0x0000 f9 49 00 00 */ }; struct DISPLAYCONFIG_ADAPTER_NAME { unsigned char header[20]; /* +0x0000 ca 24 00 00 */ unsigned char adapterDevicePath[256]; /* +0x0014 a7 15 00 00 */ }; struct _FILE_PIPE_INFORMATION { unsigned long ReadMode; /* +0x0000 */ unsigned long CompletionMode; /* +0x0004 */ }; struct _POWER_IDLE_RESILIENCY { unsigned long CoalescingTimeout; /* +0x0000 */ unsigned long IdleResiliencyPeriod; /* +0x0004 */ }; struct _IMAGE_IMPORT_BY_NAME { unsigned short Hint; /* +0x0000 */ unsigned char Name[2]; /* +0x0002 df 23 00 00 */ }; struct _QUOTA_LIMITS_EX { unsigned long PagedPoolLimit; /* +0x0000 */ unsigned long NonPagedPoolLimit; /* +0x0004 */ unsigned long MinimumWorkingSetSize; /* +0x0008 */ unsigned long MaximumWorkingSetSize; /* +0x000c */ unsigned long PagefileLimit; /* +0x0010 */ unsigned char TimeLimit[8]; /* +0x0018 3d 13 00 00 */ unsigned long WorkingSetLimit; /* +0x0020 */ unsigned long Reserved2; /* +0x0024 */ unsigned long Reserved3; /* +0x0028 */ unsigned long Reserved4; /* +0x002c */ unsigned long Flags; /* +0x0030 */ unsigned char CpuRateLimit[4]; /* +0x0034 d5 3c 00 00 */ }; struct tagEMREXTSELECTCLIPRGN { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned long cbRgnData; /* +0x0008 */ unsigned long iMode; /* +0x000c */ unsigned char RgnData[4]; /* +0x0010 f9 12 00 00 */ }; struct _CM_KEYBOARD_DEVICE_DATA { unsigned short Version; /* +0x0000 */ unsigned short Revision; /* +0x0002 */ unsigned char Type; /* +0x0004 */ unsigned char Subtype; /* +0x0005 */ unsigned short KeyboardFlags; /* +0x0006 */ }; struct _IMAGE_BASE_RELOCATION { unsigned long VirtualAddress; /* +0x0000 */ unsigned long SizeOfBlock; /* +0x0004 */ }; struct _SYSTEM_ERROR_PORT_TIMEOUTS { unsigned long StartTimeout; /* +0x0000 */ unsigned long CommTimeout; /* +0x0004 */ }; struct tagSERIALIZEDPROPERTYVALUE { unsigned long dwType; /* +0x0000 */ unsigned char rgb[4]; /* +0x0004 f9 12 00 00 */ }; struct tagHW_PROFILE_INFOA { unsigned long dwDockInfo; /* +0x0000 */ unsigned char szHwProfileGuid[39]; /* +0x0004 73 4a 00 00 */ unsigned char szHwProfileName[81]; /* +0x002b c8 2f 00 00 */ }; struct tagEMRSETPALETTEENTRIES { unsigned char emr[8]; /* +0x0000 d4 12 00 00 */ unsigned long ihPal; /* +0x0008 */ unsigned long iStart; /* +0x000c */ unsigned long cEntries; /* +0x0010 */ unsigned char aPalEntries[4]; /* +0x0014 ae 26 00 00 */ }; struct _PROCESS_DEVICEMAP_INFORMATION::<unnamed-tag>::<unnamed-type-Query> { unsigned long DriveMap; /* +0x0000 */ unsigned char DriveType[32]; /* +0x0004 e5 17 00 00 */ }; struct _PROCESS_DEVICEMAP_INFORMATION::<unnamed-tag>::<unnamed-type-Set> { void *DirectoryHandle; /* +0x0000 */ }; struct _CMSG_CMS_RECIPIENT_INFO { unsigned long dwRecipientChoice; /* +0x0000 */ /* unsigned char pKeyTrans[0]; +0x0004 53 20 00 00 */ /* unsigned char pKeyAgree[0]; +0x0004 98 23 00 00 */ unsigned char pMailList[4]; /* +0x0004 b6 48 00 00 */ }; struct _JOURNAL_TRANSACTION_BOUNDARY_INFORMATION { unsigned char Action[8]; /* +0x0000 38 15 00 00 */ unsigned long long RecordNumber; /* +0x0008 */ unsigned char TimeStamp[8]; /* +0x0010 3d 13 00 00 */ unsigned char TransactionID[16]; /* +0x0018 dc 14 00 00 */ }; struct _EX_ATTRIBUTE_INFORMATION_REGISTRATION { unsigned char QueryRoutine[4]; /* +0x0000 fa 1d 00 00 */ unsigned char SetRoutine[4]; /* +0x0004 fa 1d 00 00 */ }; struct _JOBOBJECT_FREEZE_INFORMATION { unsigned long Flags; /* +0x0000 */ /* unsigned char FreezeOperation[0]; +0x0000 17 13 00 00 */ /* unsigned char FilterOperation[0]; +0x0000 7e 18 00 00 */ unsigned char Reserved[4]; /* +0x0000 b3 19 00 00 */ unsigned char Freeze; /* +0x0004 */ unsigned char Reserved0[3]; /* +0x0005 8d 13 00 00 */ unsigned char WakeFilter[8]; /* +0x0008 41 34 00 00 */ }; struct _IMAGE_SYMBOL::<unnamed-type-N> { unsigned char ShortName[8]; /* +0x0000 7f 19 00 00 */ }; struct _IMAGE_SYMBOL::<unnamed-type-N>::<unnamed-type-Name> { unsigned long Short; /* +0x0000 */ unsigned long Long; /* +0x0004 */ }; struct _CERT_TRUST_LIST_INFO { unsigned long cbSize; /* +0x0000 */ unsigned char pCtlEntry[4]; /* +0x0004 57 2e 00 00 */ unsigned char pCtlContext[4]; /* +0x0008 84 15 00 00 */ }; struct _CM_SONIC_DEVICE_DATA { unsigned short Version; /* +0x0000 */ unsigned short Revision; /* +0x0002 */ unsigned short DataConfigurationRegister; /* +0x0004 */ unsigned char EthernetAddress[8]; /* +0x0006 7f 19 00 00 */ }; struct _SD_ENUM_SDS_INPUT { unsigned long long StartingOffset; /* +0x0000 */ unsigned long long MaxSDEntriesToReturn; /* +0x0008 */ }; struct _PROCESS_HANDLE_SNAPSHOT_INFORMATION { unsigned long NumberOfHandles; /* +0x0000 */ unsigned long Reserved; /* +0x0004 */ unsigned char Handles[28]; /* +0x0008 14 4b 00 00 */ }; struct _WINDOW_BUFFER_SIZE_RECORD { unsigned char dwSize[4]; /* +0x0000 09 18 00 00 */ }; struct IMAGE_LOAD_CONFIG_DIRECTORY64 { unsigned long Size; /* +0x0000 */ unsigned long TimeDateStamp; /* +0x0004 */ unsigned short MajorVersion; /* +0x0008 */ unsigned short MinorVersion; /* +0x000a */ unsigned long GlobalFlagsClear; /* +0x000c */ unsigned long GlobalFlagsSet; /* +0x0010 */ unsigned long CriticalSectionDefaultTimeout; /* +0x0014 */ unsigned long long DeCommitFreeBlockThreshold; /* +0x0018 */ unsigned long long DeCommitTotalFreeThreshold; /* +0x0020 */ unsigned long long LockPrefixTable; /* +0x0028 */ unsigned long long MaximumAllocationSize; /* +0x0030 */ unsigned long long VirtualMemoryThreshold; /* +0x0038 */ unsigned long long ProcessAffinityMask; /* +0x0040 */ unsigned long ProcessHeapFlags; /* +0x0048 */ unsigned short CSDVersion; /* +0x004c */ unsigned short Reserved1; /* +0x004e */ unsigned long long EditList; /* +0x0050 */ unsigned long long SecurityCookie; /* +0x0058 */ unsigned long long SEHandlerTable; /* +0x0060 */ unsigned long long SEHandlerCount; /* +0x0068 */ }; struct NTFS_EXTENDED_VOLUME_DATA { unsigned long ByteCount; /* +0x0000 */ unsigned short MajorVersion; /* +0x0004 */ unsigned short MinorVersion; /* +0x0006 */ unsigned long BytesPerPhysicalSector; /* +0x0008 */ }; struct STARTING_LCN_INPUT_BUFFER { unsigned char StartingLcn[8]; /* +0x0000 3d 13 00 00 */ }; struct VOLUME_BITMAP_BUFFER { unsigned char StartingLcn[8]; /* +0x0000 3d 13 00 00 */ unsigned char BitmapSize[8]; /* +0x0008 3d 13 00 00 */ unsigned char Buffer[8]; /* +0x0010 f9 12 00 00 */ }; struct STARTING_VCN_INPUT_BUFFER { unsigned char StartingVcn[8]; /* +0x0000 3d 13 00 00 */ }; struct NTFS_FILE_RECORD_OUTPUT_BUFFER { unsigned char FileReferenceNumber[8]; /* +0x0000 3d 13 00 00 */ unsigned long FileRecordLength; /* +0x0008 */ unsigned char FileRecordBuffer[4]; /* +0x000c f9 12 00 00 */ }; struct FIND_BY_SID_DATA { unsigned long Restart; /* +0x0000 */ unsigned char Sid[12]; /* +0x0004 dc 1e 00 00 */ }; struct CREATE_USN_JOURNAL_DATA { unsigned long long MaximumSize; /* +0x0000 */ unsigned long long AllocationDelta; /* +0x0008 */ }; struct READ_USN_JOURNAL_DATA { long long StartUsn; /* +0x0000 */ unsigned long ReasonMask; /* +0x0008 */ unsigned long ReturnOnlyOnClose; /* +0x000c */ unsigned long long Timeout; /* +0x0010 */ unsigned long long BytesToWaitFor; /* +0x0018 */ unsigned long long UsnJournalID; /* +0x0020 */ }; struct USN_RECORD { unsigned long RecordLength; /* +0x0000 */ unsigned short MajorVersion; /* +0x0004 */ unsigned short MinorVersion; /* +0x0006 */ unsigned long long FileReferenceNumber; /* +0x0008 */ unsigned long long ParentFileReferenceNumber; /* +0x0010 */ long long Usn; /* +0x0018 */ unsigned char TimeStamp[8]; /* +0x0020 3d 13 00 00 */ unsigned long Reason; /* +0x0028 */ unsigned long SourceInfo; /* +0x002c */ unsigned long SecurityId; /* +0x0030 */ unsigned long FileAttributes; /* +0x0034 */ unsigned short FileNameLength; /* +0x0038 */ unsigned short FileNameOffset; /* +0x003a */ unsigned char FileName[4]; /* +0x003c f7 13 00 00 */ }; struct USN_JOURNAL_DATA { unsigned long long UsnJournalID; /* +0x0000 */ long long FirstUsn; /* +0x0008 */ long long NextUsn; /* +0x0010 */ long long LowestValidUsn; /* +0x0018 */ long long MaxUsn; /* +0x0020 */ unsigned long long MaximumSize; /* +0x0028 */ unsigned long long AllocationDelta; /* +0x0030 */ }; struct DELETE_USN_JOURNAL_DATA { unsigned long long UsnJournalID; /* +0x0000 */ unsigned long DeleteFlags; /* +0x0008 */ }; struct MARK_HANDLE_INFO { unsigned long UsnSourceInfo; /* +0x0000 */ unsigned long CopyNumber; /* +0x0000 */ void *VolumeHandle; /* +0x0004 */ unsigned long HandleInfo; /* +0x0008 */ }; struct BULK_SECURITY_TEST_DATA { unsigned long DesiredAccess; /* +0x0000 */ unsigned char SecurityIds[4]; /* +0x0004 f6 12 00 00 */ }; struct SET_POWER_SETTING_VALUE { unsigned long Version; /* +0x0000 */ unsigned char Guid[16]; /* +0x0004 dc 14 00 00 */ unsigned char PowerCondition[4]; /* +0x0014 40 4b 00 00 */ unsigned long DataLength; /* +0x0018 */ unsigned char Data[4]; /* +0x001c f9 12 00 00 */ }; struct BATTERY_REPORTING_SCALE { unsigned long Granularity; /* +0x0000 */ unsigned long Capacity; /* +0x0004 */ }; struct POWER_STATE_NOTIFY_HANDLER { unsigned char Handler[4]; /* +0x0000 47 4b 00 00 */ void *Context; /* +0x0004 */ }; struct PROCESSOR_IDLE_TIMES { unsigned long long StartTime; /* +0x0000 */ unsigned long long EndTime; /* +0x0008 */ unsigned char Reserved[16]; /* +0x0010 4f 1a 00 00 */ }; struct PPM_WMI_LEGACY_PERFSTATE { unsigned long Frequency; /* +0x0000 */ unsigned long Flags; /* +0x0004 */ unsigned long PercentFrequency; /* +0x0008 */ }; struct PPM_WMI_PERF_STATE { unsigned long Frequency; /* +0x0000 */ unsigned long Power; /* +0x0004 */ unsigned char PercentFrequency; /* +0x0008 */ unsigned char IncreaseLevel; /* +0x0009 */ unsigned char DecreaseLevel; /* +0x000a */ unsigned char Type; /* +0x000b */ unsigned long IncreaseTime; /* +0x000c */ unsigned long DecreaseTime; /* +0x0010 */ unsigned long long Control; /* +0x0018 */ unsigned long long Status; /* +0x0020 */ unsigned long HitCount; /* +0x0028 */ unsigned long Reserved1; /* +0x002c */ unsigned long long Reserved2; /* +0x0030 */ unsigned long long Reserved3; /* +0x0038 */ }; struct PPM_WMI_PERF_STATES { unsigned long Count; /* +0x0000 */ unsigned long MaxFrequency; /* +0x0004 */ unsigned long CurrentState; /* +0x0008 */ unsigned long MaxPerfState; /* +0x000c */ unsigned long MinPerfState; /* +0x0010 */ unsigned long LowestPerfState; /* +0x0014 */ unsigned long ThermalConstraint; /* +0x0018 */ unsigned char BusyAdjThreshold; /* +0x001c */ unsigned char PolicyType; /* +0x001d */ unsigned char Type; /* +0x001e */ unsigned char Reserved; /* +0x001f */ unsigned long TimerInterval; /* +0x0020 */ unsigned long long TargetProcessors; /* +0x0028 */ unsigned long PStateHandler; /* +0x0030 */ unsigned long PStateContext; /* +0x0034 */ unsigned long TStateHandler; /* +0x0038 */ unsigned long TStateContext; /* +0x003c */ unsigned long FeedbackHandler; /* +0x0040 */ unsigned long Reserved1; /* +0x0044 */ unsigned long long Reserved2; /* +0x0048 */ unsigned char State[64]; /* +0x0050 50 4b 00 00 */ }; struct PPM_WMI_PERF_STATES_EX { unsigned long Count; /* +0x0000 */ unsigned long MaxFrequency; /* +0x0004 */ unsigned long CurrentState; /* +0x0008 */ unsigned long MaxPerfState; /* +0x000c */ unsigned long MinPerfState; /* +0x0010 */ unsigned long LowestPerfState; /* +0x0014 */ unsigned long ThermalConstraint; /* +0x0018 */ unsigned char BusyAdjThreshold; /* +0x001c */ unsigned char PolicyType; /* +0x001d */ unsigned char Type; /* +0x001e */ unsigned char Reserved; /* +0x001f */ unsigned long TimerInterval; /* +0x0020 */ void *TargetProcessors; /* +0x0024 */ unsigned long PStateHandler; /* +0x0028 */ unsigned long PStateContext; /* +0x002c */ unsigned long TStateHandler; /* +0x0030 */ unsigned long TStateContext; /* +0x0034 */ unsigned long FeedbackHandler; /* +0x0038 */ unsigned long Reserved1; /* +0x003c */ unsigned long long Reserved2; /* +0x0040 */ unsigned char State[64]; /* +0x0048 50 4b 00 00 */ }; struct PPM_IDLE_STATE_ACCOUNTING { unsigned long IdleTransitions; /* +0x0000 */ unsigned long FailedTransitions; /* +0x0004 */ unsigned long InvalidBucketIndex; /* +0x0008 */ unsigned long long TotalTime; /* +0x0010 */ unsigned char IdleTimeBuckets[24]; /* +0x0018 a8 1f 00 00 */ }; struct PPM_IDLE_ACCOUNTING { unsigned long StateCount; /* +0x0000 */ unsigned long TotalTransitions; /* +0x0004 */ unsigned long ResetCount; /* +0x0008 */ unsigned long long StartTime; /* +0x0010 */ unsigned char State[48]; /* +0x0018 57 4b 00 00 */ }; struct PPM_IDLE_STATE_ACCOUNTING_EX { unsigned long long TotalTime; /* +0x0000 */ unsigned long IdleTransitions; /* +0x0008 */ unsigned long FailedTransitions; /* +0x000c */ unsigned long InvalidBucketIndex; /* +0x0010 */ unsigned long MinTimeUs; /* +0x0014 */ unsigned long MaxTimeUs; /* +0x0018 */ unsigned char IdleTimeBuckets[384]; /* +0x0020 5a 4b 00 00 */ }; struct PPM_IDLE_ACCOUNTING_EX { unsigned long StateCount; /* +0x0000 */ unsigned long TotalTransitions; /* +0x0004 */ unsigned long ResetCount; /* +0x0008 */ unsigned long long StartTime; /* +0x0010 */ unsigned char State[416]; /* +0x0018 5d 4b 00 00 */ }; struct PPM_PERFSTATE_EVENT { unsigned long State; /* +0x0000 */ unsigned long Status; /* +0x0004 */ unsigned long Latency; /* +0x0008 */ unsigned long Speed; /* +0x000c */ unsigned long Processor; /* +0x0010 */ }; struct PPM_PERFSTATE_DOMAIN_EVENT { unsigned long State; /* +0x0000 */ unsigned long Latency; /* +0x0004 */ unsigned long Speed; /* +0x0008 */ unsigned long long Processors; /* +0x0010 */ }; struct PPM_IDLESTATE_EVENT { unsigned long NewState; /* +0x0000 */ unsigned long OldState; /* +0x0004 */ unsigned long long Processors; /* +0x0008 */ }; struct PPM_THERMALCHANGE_EVENT { unsigned long ThermalConstraint; /* +0x0000 */ unsigned long long Processors; /* +0x0008 */ }; struct SYSTEM_POWER_LEVEL { unsigned char Enable; /* +0x0000 */ unsigned char Spare[3]; /* +0x0001 8d 13 00 00 */ unsigned long BatteryLevel; /* +0x0004 */ unsigned char PowerPolicy[12]; /* +0x0008 6d 1f 00 00 */ unsigned char MinSystemState[4]; /* +0x0014 5a 16 00 00 */ }; struct PROCESSOR_IDLESTATE_INFO { unsigned long TimeCheck; /* +0x0000 */ unsigned char DemotePercent; /* +0x0004 */ unsigned char PromotePercent; /* +0x0005 */ unsigned char Spare[2]; /* +0x0006 a7 17 00 00 */ }; struct PROCESSOR_IDLESTATE_POLICY { unsigned short Revision; /* +0x0000 */ }; struct PROCESSOR_IDLESTATE_POLICY::<unnamed-type-Flags> { unsigned short AsUSHORT; /* +0x0000 */ /* unsigned char AllowScaling[0]; +0x0000 6a 2e 00 00 */ /* unsigned char Disabled[0]; +0x0000 6b 2e 00 00 */ unsigned char Reserved[2]; /* +0x0000 70 4b 00 00 */ }; struct PROCESSOR_PERFSTATE_POLICY { unsigned long Revision; /* +0x0000 */ unsigned char MaxThrottle; /* +0x0004 */ unsigned char MinThrottle; /* +0x0005 */ unsigned char BusyAdjThreshold; /* +0x0006 */ unsigned char Spare; /* +0x0007 */ unsigned char Flags[1]; /* +0x0007 73 4b 00 00 */ unsigned long TimeCheck; /* +0x0008 */ unsigned long IncreaseTime; /* +0x000c */ unsigned long DecreaseTime; /* +0x0010 */ unsigned long IncreasePercent; /* +0x0014 */ unsigned long DecreasePercent; /* +0x0018 */ }; struct PROCESSOR_PERFSTATE_POLICY::<unnamed-tag>::<unnamed-type-Flags> { unsigned char AsUCHAR; /* +0x0000 */ /* unsigned char NoDomainAccounting[0]; +0x0000 6f 1e 00 00 */ /* unsigned char IncreasePolicy[0]; +0x0000 76 4b 00 00 */ /* unsigned char DecreasePolicy[0]; +0x0000 72 1e 00 00 */ unsigned char Reserved[1]; /* +0x0000 e4 25 00 00 */ }; struct SYSTEM_BATTERY_STATE { unsigned char AcOnLine; /* +0x0000 */ unsigned char BatteryPresent; /* +0x0001 */ unsigned char Charging; /* +0x0002 */ unsigned char Discharging; /* +0x0003 */ unsigned char Spare1[4]; /* +0x0004 b7 17 00 00 */ unsigned long MaxCapacity; /* +0x0008 */ unsigned long RemainingCapacity; /* +0x000c */ unsigned long Rate; /* +0x0010 */ unsigned long EstimatedTime; /* +0x0014 */ unsigned long DefaultAlert1; /* +0x0018 */ unsigned long DefaultAlert2; /* +0x001c */ }; struct RTL_ACE_DATA { unsigned char AceType; /* +0x0000 */ unsigned char InheritFlags; /* +0x0001 */ unsigned char AceFlags; /* +0x0002 */ unsigned long Mask; /* +0x0004 */ unsigned char Sid[4]; /* +0x0008 4f 13 00 00 */ }; struct _LDOUBLE { unsigned char ld[10]; /* +0x0000 66 2b 00 00 */ }; struct _CRT_DOUBLE { unsigned char x[8]; /* +0x0000 41 00 00 00 */ }; struct _CRT_FLOAT { unsigned char f[4]; /* +0x0000 40 00 00 00 */ }; struct SHELLHOOKINFO { unsigned char hwnd[4]; /* +0x0000 f1 12 00 00 */ unsigned char rc[16]; /* +0x0004 63 14 00 00 */ }; struct POWERBROADCAST_SETTING { unsigned char PowerSetting[16]; /* +0x0000 dc 14 00 00 */ unsigned long DataLength; /* +0x0010 */ unsigned char Data[4]; /* +0x0014 f9 12 00 00 */ }; struct BSMINFO { unsigned char cbSize[4]; /* +0x0000 75 00 00 00 */ unsigned char hdesk[4]; /* +0x0004 8e 4b 00 00 */ unsigned char hwnd[4]; /* +0x0008 f1 12 00 00 */ unsigned char luid[8]; /* +0x000c 21 15 00 00 */ }; struct FLASHWINFO { unsigned char cbSize[4]; /* +0x0000 75 00 00 00 */ unsigned char hwnd[4]; /* +0x0004 f1 12 00 00 */ unsigned long dwFlags; /* +0x0008 */ unsigned char uCount[4]; /* +0x000c 75 00 00 00 */ unsigned long dwTimeout; /* +0x0010 */ }; struct DLGTEMPLATE { unsigned long style; /* +0x0000 */ unsigned long dwExtendedStyle; /* +0x0004 */ unsigned short cdit; /* +0x0008 */ short x; /* +0x000a */ short y; /* +0x000c */ short cx; /* +0x000e */ short cy; /* +0x0010 */ }; struct DLGITEMTEMPLATE { unsigned long style; /* +0x0000 */ unsigned long dwExtendedStyle; /* +0x0004 */ short x; /* +0x0008 */ short y; /* +0x000a */ short cx; /* +0x000c */ short cy; /* +0x000e */ unsigned short id; /* +0x0010 */ }; struct MENUITEMTEMPLATEHEADER { unsigned short versionNumber; /* +0x0000 */ unsigned short offset; /* +0x0002 */ }; struct RPC_STATS_VECTOR { unsigned char Count[4]; /* +0x0000 75 00 00 00 */ unsigned char Stats[4]; /* +0x0004 f6 12 00 00 */ }; struct RPC_IF_ID_VECTOR { unsigned long Count; /* +0x0000 */ unsigned char IfId[4]; /* +0x0004 9d 4b 00 00 */ }; struct RPC_CLIENT_INFORMATION1 { unsigned char *UserName; /* +0x0000 */ unsigned char *ComputerName; /* +0x0004 */ unsigned short Privilege; /* +0x0008 */ unsigned long AuthFlags; /* +0x000c */ }; struct RPC_DISPATCH_TABLE { unsigned char DispatchTableCount[4]; /* +0x0000 75 00 00 00 */ unsigned char DispatchTable[4]; /* +0x0004 a2 4b 00 00 */ long Reserved; /* +0x0008 */ }; struct <unnamed-type-NDR_SCONTEXT> { unsigned char pad[8]; /* +0x0000 e0 22 00 00 */ void *userContext; /* +0x0008 */ }; struct ARRAY_INFO { long Dimension; /* +0x0000 */ unsigned long *BufferConformanceMark; /* +0x0004 */ unsigned long *BufferVarianceMark; /* +0x0008 */ unsigned long *MaxCountArray; /* +0x000c */ unsigned long *OffsetArray; /* +0x0010 */ unsigned long *ActualCountArray; /* +0x0014 */ }; struct NUMPARSE { unsigned char cDig[4]; /* +0x0000 74 00 00 00 */ unsigned long dwInFlags; /* +0x0004 */ unsigned long dwOutFlags; /* +0x0008 */ unsigned char cchUsed[4]; /* +0x000c 74 00 00 00 */ unsigned char nBaseShift[4]; /* +0x0010 74 00 00 00 */ unsigned char nPwr10[4]; /* +0x0014 74 00 00 00 */ }; struct UDATE { unsigned char st[16]; /* +0x0000 a6 15 00 00 */ unsigned short wDayOfYear; /* +0x0010 */ }; struct _SC_ACTION { unsigned char Type[4]; /* +0x0000 d0 4b 00 00 */ unsigned long Delay; /* +0x0004 */ }; struct _TOKEN_MANDATORY_POLICY { unsigned long Policy; /* +0x0000 */ }; struct _wireBRECORD { unsigned long fFlags; /* +0x0000 */ unsigned long clSize; /* +0x0004 */ unsigned char pRecInfo[4]; /* +0x0008 50 3c 00 00 */ unsigned char *pRecord; /* +0x000c */ }; struct _CRYPT_CONTEXTS { unsigned long cContexts; /* +0x0000 */ unsigned char rgpszContexts[4]; /* +0x0004 d0 13 00 00 */ }; struct tagWCRANGE { unsigned char wcLow[2]; /* +0x0000 71 00 00 00 */ unsigned short cGlyphs; /* +0x0002 */ }; struct _LDR_VERIFY_IMAGE_INFO { unsigned long Size; /* +0x0000 */ unsigned long Flags; /* +0x0004 */ unsigned char CallbackInfo[8]; /* +0x0008 c0 2a 00 00 */ unsigned char SectionInfo[20]; /* +0x0010 07 4c 00 00 */ unsigned short ImageCharacteristics; /* +0x0024 */ }; struct tagSTATPROPSETSTG { unsigned char fmtid[16]; /* +0x0000 dc 14 00 00 */ unsigned char clsid[16]; /* +0x0010 dc 14 00 00 */ unsigned long grfFlags; /* +0x0020 */ unsigned char mtime[8]; /* +0x0024 31 13 00 00 */ unsigned char ctime[8]; /* +0x002c 31 13 00 00 */ unsigned char atime[8]; /* +0x0034 31 13 00 00 */ unsigned long dwOSVersion; /* +0x003c */ }; struct _VIRTUAL_STORAGE_TYPE { unsigned long DeviceId; /* +0x0000 */ unsigned char VendorId[16]; /* +0x0004 dc 14 00 00 */ }; struct _IO_RESOURCE_REQUIREMENTS_LIST { unsigned long ListSize; /* +0x0000 */ unsigned char InterfaceType[4]; /* +0x0004 10 21 00 00 */ unsigned long BusNumber; /* +0x0008 */ unsigned long SlotNumber; /* +0x000c */ unsigned char Reserved[12]; /* +0x0010 22 13 00 00 */ unsigned long AlternativeLists; /* +0x001c */ unsigned char List[40]; /* +0x0020 33 4c 00 00 */ }; struct _OBJECT_ATTRIBUTES64 { unsigned long Length; /* +0x0000 */ unsigned long long RootDirectory; /* +0x0008 */ unsigned long long ObjectName; /* +0x0010 */ unsigned long Attributes; /* +0x0018 */ unsigned long long SecurityDescriptor; /* +0x0020 */ unsigned long long SecurityQualityOfService; /* +0x0028 */ }; struct _RTL_PROCESS_MODULE_INFORMATION_EX { unsigned short NextOffset; /* +0x0000 */ unsigned char BaseInfo[284]; /* +0x0004 ee 2b 00 00 */ unsigned long ImageChecksum; /* +0x0120 */ unsigned long TimeDateStamp; /* +0x0124 */ void *DefaultBase; /* +0x0128 */ }; struct _ALPC_PORT_COMPLETION_LIST_INFORMATION { void *Buffer; /* +0x0000 */ unsigned long Size; /* +0x0004 */ unsigned long ConcurrencyCount; /* +0x0008 */ unsigned long AttributeFlags; /* +0x000c */ }; struct _ZONEATTRIBUTES { unsigned long cbSize; /* +0x0000 */ unsigned char szDisplayName[520]; /* +0x0004 e4 15 00 00 */ unsigned char szDescription[400]; /* +0x020c 58 4c 00 00 */ unsigned char szIconPath[520]; /* +0x039c e4 15 00 00 */ unsigned long dwTemplateMinLevel; /* +0x05a4 */ unsigned long dwTemplateRecommended; /* +0x05a8 */ unsigned long dwTemplateCurrentLevel; /* +0x05ac */ unsigned long dwFlags; /* +0x05b0 */ }; struct _SYSTEM_LOW_PRIORITY_IO_INFORMATION { unsigned long LowPriReadOperations; /* +0x0000 */ unsigned long LowPriWriteOperations; /* +0x0004 */ unsigned long KernelBumpedToNormalOperations; /* +0x0008 */ unsigned long LowPriPagingReadOperations; /* +0x000c */ unsigned long KernelPagingReadsBumpedToNormal; /* +0x0010 */ unsigned long LowPriPagingWriteOperations; /* +0x0014 */ unsigned long KernelPagingWritesBumpedToNormal; /* +0x0018 */ unsigned long BoostedIrpCount; /* +0x001c */ unsigned long BoostedPagingIrpCount; /* +0x0020 */ unsigned long BlanketBoostCount; /* +0x0024 */ }; struct _FILE_TYPE_NOTIFICATION_INPUT { unsigned long Flags; /* +0x0000 */ unsigned long NumFileTypeIDs; /* +0x0004 */ unsigned char FileTypeID[16]; /* +0x0008 57 1e 00 00 */ }; struct _LDBL12 { unsigned char ld12[12]; /* +0x0000 6e 15 00 00 */ }; struct _CERT_REVOCATION_CHAIN_PARA { unsigned long cbSize; /* +0x0000 */ void *hChainEngine; /* +0x0004 */ void *hAdditionalStore; /* +0x0008 */ unsigned long dwChainFlags; /* +0x000c */ unsigned long dwUrlRetrievalTimeout; /* +0x0010 */ unsigned char pftCurrentTime[4]; /* +0x0014 73 17 00 00 */ unsigned char pftCacheResync[4]; /* +0x0018 73 17 00 00 */ unsigned long cbMaxUrlRetrievalByteCount; /* +0x001c */ }; struct POWER_ACTION_POLICY { unsigned char Action[4]; /* +0x0000 cb 32 00 00 */ unsigned long Flags; /* +0x0004 */ unsigned long EventCode; /* +0x0008 */ }; struct MENUITEMTEMPLATE { unsigned short mtOption; /* +0x0000 */ unsigned short mtID; /* +0x0002 */ unsigned char mtString[2]; /* +0x0004 f7 13 00 00 */ }; struct _MCI_STATS::<unnamed-type-MciStats> { unsigned short McaCod; /* +0x0000 */ unsigned short MsCod; /* +0x0002 */ /* unsigned char OtherInfo[0]; +0x0004 ae 4c 00 00 */ /* unsigned char Damage[0]; +0x0004 af 4c 00 00 */ /* unsigned char AddressValid[0]; +0x0004 b0 4c 00 00 */ /* unsigned char MiscValid[0]; +0x0004 b1 4c 00 00 */ /* unsigned char Enabled[0]; +0x0004 d7 23 00 00 */ /* unsigned char UnCorrected[0]; +0x0004 b2 4c 00 00 */ /* unsigned char OverFlow[0]; +0x0004 e9 21 00 00 */ unsigned char Valid[4]; /* +0x0004 95 18 00 00 */ }; struct _BCRYPT_PKCS1_PADDING_INFO { unsigned char pszAlgId[4]; /* +0x0000 c0 13 00 00 */ }; struct _TEB_ACTIVE_FRAME_EX { unsigned char BasicFrame[12]; /* +0x0000 0d 25 00 00 */ void *ExtensionIdentifier; /* +0x000c */ }; struct _TOKEN_SECURITY_ATTRIBUTE_V1 { unsigned char Name[8]; /* +0x0000 dd 12 00 00 */ unsigned short ValueType; /* +0x0008 */ unsigned short Reserved; /* +0x000a */ unsigned long Flags; /* +0x000c */ unsigned long ValueCount; /* +0x0010 */ }; struct _AVRF_PROCESS_HANDLE_TRACING_ENTRY_WOW64 { unsigned long long Handle; /* +0x0000 */ unsigned char ClientId[16]; /* +0x0008 c2 4c 00 00 */ unsigned long Type; /* +0x0018 */ unsigned char Stacks[128]; /* +0x0020 fc 44 00 00 */ }; struct MOVE_FILE_RECORD_DATA { void *FileHandle; /* +0x0000 */ unsigned char SourceFileRecord[8]; /* +0x0008 3d 13 00 00 */ unsigned char TargetFileRecord[8]; /* +0x0010 3d 13 00 00 */ }; struct _PS_CPU_QUOTA_SET_INFORMATION { long long SessionHandle; /* +0x0000 */ unsigned long Weight; /* +0x0008 */ }; struct NTFS_VOLUME_DATA_BUFFER { unsigned char VolumeSerialNumber[8]; /* +0x0000 3d 13 00 00 */ unsigned char NumberSectors[8]; /* +0x0008 3d 13 00 00 */ unsigned char TotalClusters[8]; /* +0x0010 3d 13 00 00 */ unsigned char FreeClusters[8]; /* +0x0018 3d 13 00 00 */ unsigned char TotalReserved[8]; /* +0x0020 3d 13 00 00 */ unsigned long BytesPerSector; /* +0x0028 */ unsigned long BytesPerCluster; /* +0x002c */ unsigned long BytesPerFileRecordSegment; /* +0x0030 */ unsigned long ClustersPerFileRecordSegment; /* +0x0034 */ unsigned char MftValidDataLength[8]; /* +0x0038 3d 13 00 00 */ unsigned char MftStartLcn[8]; /* +0x0040 3d 13 00 00 */ unsigned char Mft2StartLcn[8]; /* +0x0048 3d 13 00 00 */ unsigned char MftZoneStart[8]; /* +0x0050 3d 13 00 00 */ unsigned char MftZoneEnd[8]; /* +0x0058 3d 13 00 00 */ }; struct _SYSTEM_MEMORY_INFORMATION { unsigned long PagedPoolCommitPageCount; /* +0x0000 */ unsigned long NonPagedPoolPageCount; /* +0x0004 */ unsigned long MdlPageCount; /* +0x0008 */ unsigned long CommitPageCount; /* +0x000c */ }; struct _MESSAGE_RESOURCE_DATA { unsigned long NumberOfBlocks; /* +0x0000 */ unsigned char Blocks[12]; /* +0x0004 f1 4c 00 00 */ }; struct _TOKEN_GROUPS { unsigned long GroupCount; /* +0x0000 */ unsigned char Groups[8]; /* +0x0004 24 21 00 00 */ }; struct _CERT_EXTENSIONS { unsigned long cExtension; /* +0x0000 */ unsigned char rgExtension[4]; /* +0x0004 22 16 00 00 */ }; struct _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_ENDING { void *ResolutionContext; /* +0x0000 */ }; struct _CMSG_MAIL_LIST_RECIPIENT_INFO { unsigned long dwVersion; /* +0x0000 */ unsigned char KeyId[8]; /* +0x0004 02 13 00 00 */ unsigned char KeyEncryptionAlgorithm[12]; /* +0x000c 55 14 00 00 */ unsigned char EncryptedKey[8]; /* +0x0018 02 13 00 00 */ unsigned char Date[8]; /* +0x0020 31 13 00 00 */ unsigned char pOtherAttr[4]; /* +0x0028 33 13 00 00 */ }; struct _CERT_SYSTEM_STORE_RELOCATE_PARA { /* unsigned char hKeyBase[0]; +0x0000 72 19 00 00 */ void *pvBase; /* +0x0000 */ void *pvSystemStore; /* +0x0004 */ /* unsigned char pszSystemStore[0]; +0x0004 62 14 00 00 */ unsigned char pwszSystemStore[4]; /* +0x0004 c0 13 00 00 */ }; struct _CERT_POLICY_INFO { char *pszPolicyIdentifier; /* +0x0000 */ unsigned long cPolicyQualifier; /* +0x0004 */ unsigned char rgPolicyQualifier[4]; /* +0x0008 b2 21 00 00 */ }; struct _CRYPT_KEY_VERIFY_MESSAGE_PARA { unsigned long cbSize; /* +0x0000 */ unsigned long dwMsgEncodingType; /* +0x0004 */ unsigned long hCryptProv; /* +0x0008 */ }; struct _CRYPT_TIMESTAMP_INFO { unsigned long dwVersion; /* +0x0000 */ char *pszTSAPolicyId; /* +0x0004 */ unsigned char HashAlgorithm[12]; /* +0x0008 55 14 00 00 */ unsigned char HashedMessage[8]; /* +0x0014 02 13 00 00 */ unsigned char SerialNumber[8]; /* +0x001c 02 13 00 00 */ unsigned char ftTime[8]; /* +0x0024 31 13 00 00 */ unsigned char pvAccuracy[4]; /* +0x002c 00 35 00 00 */ unsigned char fOrdering[4]; /* +0x0030 74 00 00 00 */ unsigned char Nonce[8]; /* +0x0034 02 13 00 00 */ unsigned char Tsa[8]; /* +0x003c 02 13 00 00 */ unsigned long cExtension; /* +0x0044 */ unsigned char rgExtension[4]; /* +0x0048 22 16 00 00 */ }; struct _STREAM_EXTENT_ENTRY::<unnamed-type-ExtentInformation> { unsigned char RetrievalPointers[32]; /* +0x0000 25 23 00 00 */ }; struct _TOKEN_AUDIT_POLICY { unsigned char PerUserPolicy[29]; /* +0x0000 4e 4d 00 00 */ }; struct tagRemSNB { unsigned long ulCntStr; /* +0x0000 */ unsigned long ulCntChar; /* +0x0004 */ unsigned char rgString[4]; /* +0x0008 f7 13 00 00 */ }; struct _PROCESS_STACK_ALLOCATION_INFORMATION { unsigned long ReserveSize; /* +0x0000 */ unsigned long ZeroBits; /* +0x0004 */ void *StackBase; /* +0x0008 */ }; struct FILE_ID_DESCRIPTOR { unsigned long dwSize; /* +0x0000 */ unsigned char Type[4]; /* +0x0004 d2 32 00 00 */ /* unsigned char FileId[0]; +0x0008 3d 13 00 00 */ unsigned char ObjectId[16]; /* +0x0008 dc 14 00 00 */ }; struct tagNC_ADDRESS { unsigned char pAddrInfo[4]; /* +0x0000 74 4d 00 00 */ unsigned short PortNumber; /* +0x0004 */ unsigned char PrefixLength; /* +0x0006 */ }; struct _KSPIN_LOCK_QUEUE { unsigned char Next[4]; /* +0x0000 8a 4d 00 00 */ unsigned char Lock[4]; /* +0x0004 8b 4d 00 00 */ }; struct _BCRYPT_PROVIDER_NAME { unsigned char pszProviderName[4]; /* +0x0000 71 04 00 00 */ }; struct tagCOLORADJUSTMENT { unsigned short caSize; /* +0x0000 */ unsigned short caFlags; /* +0x0002 */ unsigned short caIlluminantIndex; /* +0x0004 */ unsigned short caRedGamma; /* +0x0006 */ unsigned short caGreenGamma; /* +0x0008 */ unsigned short caBlueGamma; /* +0x000a */ unsigned short caReferenceBlack; /* +0x000c */ unsigned short caReferenceWhite; /* +0x000e */ short caContrast; /* +0x0010 */ short caBrightness; /* +0x0012 */ short caColorfulness; /* +0x0014 */ short caRedGreenTint; /* +0x0016 */ }; struct MFT_ENUM_DATA { unsigned long long StartFileReferenceNumber; /* +0x0000 */ long long LowUsn; /* +0x0008 */ long long HighUsn; /* +0x0010 */ }; struct _OBJECT_TYPES_INFORMATION { unsigned long NumberOfTypes; /* +0x0000 */ }; struct _MENU_EVENT_RECORD { unsigned char dwCommandId[4]; /* +0x0000 75 00 00 00 */ }; struct _DEBUG_EVENT::<unnamed-type-u> { /* unsigned char Exception[0]; +0x0000 bc 2f 00 00 */ /* unsigned char CreateThread[0]; +0x0000 3b 4c 00 00 */ /* unsigned char CreateProcessInfo[0]; +0x0000 29 43 00 00 */ /* unsigned char ExitThread[0]; +0x0000 0f 22 00 00 */ /* unsigned char ExitProcess[0]; +0x0000 84 42 00 00 */ /* unsigned char LoadDll[0]; +0x0000 ac 3b 00 00 */ /* unsigned char UnloadDll[0]; +0x0000 cb 4d 00 00 */ /* unsigned char DebugString[0]; +0x0000 55 3d 00 00 */ unsigned char RipInfo[84]; /* +0x0000 1a 46 00 00 */ }; struct _FILE_REMOTE_PROTOCOL_INFO { unsigned short StructureVersion; /* +0x0000 */ unsigned short StructureSize; /* +0x0002 */ unsigned long Protocol; /* +0x0004 */ unsigned short ProtocolMajorVersion; /* +0x0008 */ unsigned short ProtocolMinorVersion; /* +0x000a */ unsigned short ProtocolRevision; /* +0x000c */ unsigned short Reserved; /* +0x000e */ unsigned long Flags; /* +0x0010 */ }; struct _IMAGE_THUNK_DATA64::<unnamed-type-u1> { unsigned long long ForwarderString; /* +0x0000 */ unsigned long long Function; /* +0x0000 */ unsigned long long Ordinal; /* +0x0000 */ unsigned long long AddressOfData; /* +0x0000 */ }; struct _CERT_CHAIN_ENGINE_CONFIG { unsigned long cbSize; /* +0x0000 */ void *hRestrictedRoot; /* +0x0004 */ void *hRestrictedTrust; /* +0x0008 */ void *hRestrictedOther; /* +0x000c */ unsigned long cAdditionalStore; /* +0x0010 */ unsigned char rghAdditionalStore[4]; /* +0x0014 4f 13 00 00 */ unsigned long dwFlags; /* +0x0018 */ unsigned long dwUrlRetrievalTimeout; /* +0x001c */ unsigned long MaximumCachedCertificates; /* +0x0020 */ unsigned long CycleDetectionModulus; /* +0x0024 */ void *hExclusiveRoot; /* +0x0028 */ void *hExclusiveTrustedPeople; /* +0x002c */ unsigned long dwExclusiveFlags; /* +0x0030 */ }; struct _TOKEN_USER_CLAIMS { void *UserClaims; /* +0x0000 */ }; struct _SYSTEM_REF_TRACE_INFORMATION { unsigned char TraceEnable; /* +0x0000 */ unsigned char TracePermanent; /* +0x0001 */ unsigned char TraceProcessName[8]; /* +0x0004 dd 12 00 00 */ unsigned char TracePoolTags[8]; /* +0x000c dd 12 00 00 */ }; struct _HEAP_INFORMATION_ITEM { unsigned long Level; /* +0x0000 */ unsigned long Size; /* +0x0004 */ /* unsigned char ProcessHeapInformation[0]; +0x0008 27 14 00 00 */ /* unsigned char HeapInformation[0]; +0x0008 45 13 00 00 */ /* unsigned char HeapRegionInformation[0]; +0x0008 d0 12 00 00 */ /* unsigned char HeapRangeInformation[0]; +0x0008 c8 33 00 00 */ /* unsigned char HeapBlockInformation[0]; +0x0008 c3 42 00 00 */ /* unsigned char HeapPerfInformation[0]; +0x0008 1a 13 00 00 */ unsigned long DynamicStart; /* +0x0008 */ }; struct _API_SET_NAMESPACE_ENTRY { unsigned long NameOffset; /* +0x0000 */ unsigned long NameLength; /* +0x0004 */ unsigned long DataOffset; /* +0x0008 */ }; struct _RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_BASIC { unsigned long Size; /* +0x0000 */ unsigned long Format; /* +0x0004 */ unsigned char Frame[12]; /* +0x0008 33 1c 00 00 */ }; struct NTFS_FILE_RECORD_INPUT_BUFFER { unsigned char FileReferenceNumber[8]; /* +0x0000 3d 13 00 00 */ }; struct _IMAGE_SYMBOL_EX::<unnamed-type-N> { unsigned char ShortName[8]; /* +0x0000 7f 19 00 00 */ }; struct _FILE_REMOTE_PROTOCOL_INFORMATION::<unnamed-type-ProtocolSpecificReserved> { unsigned char Reserved[64]; /* +0x0000 43 27 00 00 */ }; struct _FILE_REMOTE_PROTOCOL_INFORMATION::<unnamed-type-GenericReserved> { unsigned char Reserved[32]; /* +0x0000 75 46 00 00 */ }; struct _IMAGE_RESOURCE_DIRECTORY { unsigned long Characteristics; /* +0x0000 */ unsigned long TimeDateStamp; /* +0x0004 */ unsigned short MajorVersion; /* +0x0008 */ unsigned short MinorVersion; /* +0x000a */ unsigned short NumberOfNamedEntries; /* +0x000c */ unsigned short NumberOfIdEntries; /* +0x000e */ }; struct _s__RTTIBaseClassArray { unsigned char arrayOfBaseClassDescriptors[1]; /* +0x0000 6e 4e 00 00 */ }; struct localeinfo_struct { unsigned char locinfo[4]; /* +0x0000 77 4e 00 00 */ unsigned char mbcinfo[4]; /* +0x0004 79 4e 00 00 */ }; struct _SYSDBG_TRIAGE_DUMP { unsigned long Flags; /* +0x0000 */ unsigned long BugCheckCode; /* +0x0004 */ unsigned long BugCheckParam1; /* +0x0008 */ unsigned long BugCheckParam2; /* +0x000c */ unsigned long BugCheckParam3; /* +0x0010 */ unsigned long BugCheckParam4; /* +0x0014 */ unsigned long ProcessHandles; /* +0x0018 */ unsigned long ThreadHandles; /* +0x001c */ unsigned char Handles[4]; /* +0x0020 4f 13 00 00 */ }; struct NCryptKeyName { unsigned char pszName[4]; /* +0x0000 71 04 00 00 */ unsigned char pszAlgid[4]; /* +0x0004 71 04 00 00 */ unsigned long dwLegacyKeySpec; /* +0x0008 */ unsigned long dwFlags; /* +0x000c */ }; struct _SYSTEM_PLATFORM_BINARY_INFORMATION { void *HandoffBuffer; /* +0x0000 */ void *CommandLineBuffer; /* +0x0004 */ unsigned long HandoffBufferSize; /* +0x0008 */ unsigned long CommandLineBufferSize; /* +0x000c */ }; struct _GDI_NONREMOTE { long fContext; /* +0x0000 */ }; struct _GDI_NONREMOTE::__MIDL_IWinTypes_0002 { long hInproc; /* +0x0000 */ unsigned char hRemote[4]; /* +0x0000 c6 4e 00 00 */ }; struct tagCWPSTRUCT { long lParam; /* +0x0000 */ unsigned char wParam[4]; /* +0x0004 75 00 00 00 */ unsigned char message[4]; /* +0x0008 75 00 00 00 */ unsigned char hwnd[4]; /* +0x000c f1 12 00 00 */ }; struct _SD_ENUM_SDS_OUTPUT { unsigned long long NextOffset; /* +0x0000 */ unsigned long long NumSDEntriesReturned; /* +0x0008 */ unsigned long long NumSDBytesReturned; /* +0x0010 */ unsigned char SDEntry[24]; /* +0x0018 e6 4e 00 00 */ }; struct PPM_WMI_IDLE_STATE { unsigned long Latency; /* +0x0000 */ unsigned long Power; /* +0x0004 */ unsigned long TimeCheck; /* +0x0008 */ unsigned char PromotePercent; /* +0x000c */ unsigned char DemotePercent; /* +0x000d */ unsigned char StateType; /* +0x000e */ unsigned char Reserved; /* +0x000f */ unsigned long StateFlags; /* +0x0010 */ unsigned long Context; /* +0x0014 */ unsigned long IdleHandler; /* +0x0018 */ unsigned long Reserved1; /* +0x001c */ }; struct _CERT_POLICY_QUALIFIER_INFO { char *pszPolicyQualifierId; /* +0x0000 */ unsigned char Qualifier[8]; /* +0x0004 02 13 00 00 */ }; struct _TXFS_GET_TRANSACTED_VERSION { unsigned long ThisBaseVersion; /* +0x0000 */ unsigned long LatestVersion; /* +0x0004 */ unsigned short ThisMiniVersion; /* +0x0008 */ unsigned short FirstMiniVersion; /* +0x000a */ unsigned short LatestMiniVersion; /* +0x000c */ }; struct _EXCEPTION_REGISTRATION_RECORD { unsigned char Next[4]; /* +0x0000 56 13 00 00 */ unsigned char Handler[4]; /* +0x0004 07 4f 00 00 */ }; struct PPM_WMI_IDLE_STATES_EX { unsigned long Type; /* +0x0000 */ unsigned long Count; /* +0x0004 */ unsigned long TargetState; /* +0x0008 */ unsigned long OldState; /* +0x000c */ void *TargetProcessors; /* +0x0010 */ unsigned char State[32]; /* +0x0014 0c 4f 00 00 */ }; struct _REMOTE_NAME_INFOA { char *lpUniversalName; /* +0x0000 */ char *lpConnectionName; /* +0x0004 */ char *lpRemainingPath; /* +0x0008 */ }; struct XSAVE_CPU_ERRATA { unsigned long NumberOfErrata; /* +0x0000 */ unsigned char Errata[32]; /* +0x0008 27 4f 00 00 */ }; struct tagOLEVERB { long lVerb; /* +0x0000 */ unsigned char lpszVerbName[4]; /* +0x0004 71 04 00 00 */ unsigned long fuFlags; /* +0x0008 */ unsigned long grfAttribs; /* +0x000c */ }; struct _ImageArchitectureHeader { /* unsigned char AmaskValue[0]; +0x0000 cf 1c 00 00 */ unsigned char AmaskShift[4]; /* +0x0000 5a 4f 00 00 */ unsigned long FirstEntryRVA; /* +0x0004 */ }; struct _FILE_QUERY_ON_DISK_VOL_INFO_BUFFER { unsigned char DirectoryCount[8]; /* +0x0000 3d 13 00 00 */ unsigned char FileCount[8]; /* +0x0008 3d 13 00 00 */ unsigned short FsFormatMajVersion; /* +0x0010 */ unsigned short FsFormatMinVersion; /* +0x0012 */ unsigned char FsFormatName[28]; /* +0x0014 11 29 00 00 */ unsigned char FormatTime[8]; /* +0x0030 3d 13 00 00 */ unsigned char LastUpdateTime[8]; /* +0x0038 3d 13 00 00 */ unsigned char CopyrightInfo[68]; /* +0x0040 aa 4f 00 00 */ unsigned char AbstractInfo[68]; /* +0x0084 aa 4f 00 00 */ unsigned char FormattingImplementationInfo[68]; /* +0x00c8 aa 4f 00 00 */ unsigned char LastModifyingImplementationInfo[68]; /* +0x010c aa 4f 00 00 */ }; struct _RTL_HANDLE_TABLE_ENTRY { unsigned long Flags; /* +0x0000 */ unsigned char NextFree[4]; /* +0x0000 42 2a 00 00 */ }; struct _NOTIFYICONIDENTIFIER { unsigned long cbSize; /* +0x0000 */ unsigned char hWnd[4]; /* +0x0004 f1 12 00 00 */ unsigned char uID[4]; /* +0x0008 75 00 00 00 */ unsigned char guidItem[16]; /* +0x000c dc 14 00 00 */ }; struct _IMAGE_TLS_DIRECTORY64 { unsigned long long StartAddressOfRawData; /* +0x0000 */ unsigned long long EndAddressOfRawData; /* +0x0008 */ unsigned long long AddressOfIndex; /* +0x0010 */ unsigned long long AddressOfCallBacks; /* +0x0018 */ unsigned long SizeOfZeroFill; /* +0x0020 */ unsigned long Characteristics; /* +0x0024 */ }; struct NOTIFY_USER_POWER_SETTING { unsigned char Guid[16]; /* +0x0000 dc 14 00 00 */ }; struct _CMSG_KEY_AGREE_ENCRYPT_INFO { unsigned long cbSize; /* +0x0000 */ unsigned long dwRecipientIndex; /* +0x0004 */ unsigned char KeyEncryptionAlgorithm[12]; /* +0x0008 55 14 00 00 */ unsigned char UserKeyingMaterial[8]; /* +0x0014 02 13 00 00 */ unsigned long dwOriginatorChoice; /* +0x001c */ /* unsigned char OriginatorCertId[0]; +0x0020 30 13 00 00 */ unsigned char OriginatorPublicKeyInfo[24]; /* +0x0020 36 20 00 00 */ unsigned long cKeyAgreeKeyEncryptInfo; /* +0x0038 */ unsigned char rgpKeyAgreeKeyEncryptInfo[4]; /* +0x003c e1 4f 00 00 */ unsigned long dwFlags; /* +0x0040 */ }; struct _FILE_STANDARD_LINK_INFORMATION { unsigned long NumberOfAccessibleLinks; /* +0x0000 */ unsigned long TotalNumberOfLinks; /* +0x0004 */ unsigned char DeletePending; /* +0x0008 */ unsigned char Directory; /* +0x0009 */ }; struct _CTL_CONTEXT { unsigned long dwMsgAndCertEncodingType; /* +0x0000 */ unsigned char *pbCtlEncoded; /* +0x0004 */ unsigned long cbCtlEncoded; /* +0x0008 */ unsigned char pCtlInfo[4]; /* +0x000c b6 32 00 00 */ void *hCertStore; /* +0x0010 */ void *hCryptMsg; /* +0x0014 */ unsigned char *pbCtlContent; /* +0x0018 */ unsigned long cbCtlContent; /* +0x001c */ }; struct _RPC_BINDING_VECTOR { unsigned long Count; /* +0x0000 */ unsigned char BindingH[4]; /* +0x0004 31 44 00 00 */ }; struct tagINTERFACEINFO { unsigned char pUnk[4]; /* +0x0000 7f 17 00 00 */ unsigned char iid[16]; /* +0x0004 dc 14 00 00 */ unsigned short wMethod; /* +0x0014 */ }; struct _BOOT_OPTIONS { unsigned long Version; /* +0x0000 */ unsigned long Length; /* +0x0004 */ unsigned long Timeout; /* +0x0008 */ unsigned long CurrentBootEntryId; /* +0x000c */ unsigned long NextBootEntryId; /* +0x0010 */ unsigned char HeadlessRedirection[4]; /* +0x0014 f7 13 00 00 */ }; struct _OCSP_BASIC_RESPONSE_ENTRY { unsigned char CertId[36]; /* +0x0000 ad 31 00 00 */ unsigned long dwCertStatus; /* +0x0024 */ unsigned char pRevokedInfo[4]; /* +0x0028 05 44 00 00 */ unsigned char ThisUpdate[8]; /* +0x002c 31 13 00 00 */ unsigned char NextUpdate[8]; /* +0x0034 31 13 00 00 */ unsigned long cExtension; /* +0x003c */ unsigned char rgExtension[4]; /* +0x0040 22 16 00 00 */ }; struct MOVE_FILE_DATA { void *FileHandle; /* +0x0000 */ unsigned char StartingVcn[8]; /* +0x0008 3d 13 00 00 */ unsigned char StartingLcn[8]; /* +0x0010 3d 13 00 00 */ unsigned long ClusterCount; /* +0x0018 */ }; struct IMAGE_COR20_HEADER { unsigned long cb; /* +0x0000 */ unsigned short MajorRuntimeVersion; /* +0x0004 */ unsigned short MinorRuntimeVersion; /* +0x0006 */ unsigned char MetaData[8]; /* +0x0008 33 17 00 00 */ unsigned long Flags; /* +0x0010 */ unsigned long EntryPointToken; /* +0x0014 */ unsigned long EntryPointRVA; /* +0x0014 */ unsigned char Resources[8]; /* +0x0018 33 17 00 00 */ unsigned char StrongNameSignature[8]; /* +0x0020 33 17 00 00 */ unsigned char CodeManagerTable[8]; /* +0x0028 33 17 00 00 */ unsigned char VTableFixups[8]; /* +0x0030 33 17 00 00 */ unsigned char ExportAddressTableJumps[8]; /* +0x0038 33 17 00 00 */ unsigned char ManagedNativeHeader[8]; /* +0x0040 33 17 00 00 */ }; struct _TOKEN_ACCESS_INFORMATION { unsigned char SidHash[4]; /* +0x0000 6b 3d 00 00 */ unsigned char RestrictedSidHash[4]; /* +0x0004 6b 3d 00 00 */ unsigned char Privileges[4]; /* +0x0008 da 21 00 00 */ unsigned char AuthenticationId[8]; /* +0x000c 21 15 00 00 */ unsigned char TokenType[4]; /* +0x0014 04 2e 00 00 */ unsigned char ImpersonationLevel[4]; /* +0x0018 05 2e 00 00 */ unsigned char MandatoryPolicy[4]; /* +0x001c 1c 35 00 00 */ unsigned long Flags; /* +0x0020 */ unsigned long AppContainerNumber; /* +0x0024 */ void *PackageSid; /* +0x0028 */ unsigned char CapabilitiesHash[4]; /* +0x002c 6b 3d 00 00 */ }; struct _API_SET_VALUE_ARRAY { unsigned long Count; /* +0x0000 */ unsigned char Array[16]; /* +0x0004 26 50 00 00 */ }; struct _SERVICE_FAILURE_ACTIONSA { unsigned long dwResetPeriod; /* +0x0000 */ char *lpRebootMsg; /* +0x0004 */ char *lpCommand; /* +0x0008 */ unsigned long cActions; /* +0x000c */ unsigned char lpsaActions[4]; /* +0x0010 d6 2b 00 00 */ }; struct _COMPRESSED_DATA_INFO { unsigned short CompressionFormatAndEngine; /* +0x0000 */ unsigned char CompressionUnitShift; /* +0x0002 */ unsigned char ChunkShift; /* +0x0003 */ unsigned char ClusterShift; /* +0x0004 */ unsigned char Reserved; /* +0x0005 */ unsigned short NumberOfChunks; /* +0x0006 */ unsigned char CompressedChunkSizes[4]; /* +0x0008 f6 12 00 00 */ }; struct _SYSTEM_TIMEOFDAY_INFORMATION { unsigned char BootTime[8]; /* +0x0000 3d 13 00 00 */ unsigned char CurrentTime[8]; /* +0x0008 3d 13 00 00 */ unsigned char TimeZoneBias[8]; /* +0x0010 3d 13 00 00 */ unsigned long TimeZoneId; /* +0x0018 */ unsigned long Reserved; /* +0x001c */ unsigned long long BootTimeBias; /* +0x0020 */ unsigned long long SleepTimeBias; /* +0x0028 */ }; struct _CM_EISA_FUNCTION_INFORMATION { unsigned long CompressedId; /* +0x0000 */ unsigned char IdSlotFlags1; /* +0x0004 */ unsigned char IdSlotFlags2; /* +0x0005 */ unsigned char MinorRevision; /* +0x0006 */ unsigned char MajorRevision; /* +0x0007 */ unsigned char Selections[26]; /* +0x0008 3a 50 00 00 */ unsigned char FunctionFlags; /* +0x0022 */ unsigned char TypeString[80]; /* +0x0023 97 26 00 00 */ unsigned char EisaMemory[63]; /* +0x0073 3b 50 00 00 */ unsigned char EisaIrq[14]; /* +0x00b2 3c 50 00 00 */ unsigned char EisaDma[8]; /* +0x00c0 3d 50 00 00 */ unsigned char EisaPort[60]; /* +0x00c8 3e 50 00 00 */ unsigned char InitializationData[60]; /* +0x0104 3f 50 00 00 */ }; struct _BCRYPT_RSAKEY_BLOB { unsigned long Magic; /* +0x0000 */ unsigned long BitLength; /* +0x0004 */ unsigned long cbPublicExp; /* +0x0008 */ unsigned long cbModulus; /* +0x000c */ unsigned long cbPrime1; /* +0x0010 */ unsigned long cbPrime2; /* +0x0014 */ }; struct PPM_WMI_IDLE_STATES { unsigned long Type; /* +0x0000 */ unsigned long Count; /* +0x0004 */ unsigned long TargetState; /* +0x0008 */ unsigned long OldState; /* +0x000c */ unsigned long long TargetProcessors; /* +0x0010 */ unsigned char State[32]; /* +0x0018 0c 4f 00 00 */ }; struct _SYSTEM_HOTPATCH_MODULE_QUERY_PARAMETERS { unsigned long QueryFlags; /* +0x0000 */ void *ProcessHandle; /* +0x0004 */ }; struct _SL_HWID_DEVICE_INFO { unsigned long SizeBytes; /* +0x0000 */ unsigned char Type; /* +0x0004 */ unsigned char DeviceRemovalPolicy; /* +0x0005 */ unsigned char AuthenticationStatus; /* +0x0006 */ unsigned char Disposition; /* +0x0007 */ unsigned long DeviceNodeLevel; /* +0x0008 */ unsigned char Guid[16]; /* +0x000c dc 14 00 00 */ unsigned char Data[4]; /* +0x001c f9 12 00 00 */ }; struct tagMSG { unsigned char hwnd[4]; /* +0x0000 f1 12 00 00 */ unsigned char message[4]; /* +0x0004 75 00 00 00 */ unsigned char wParam[4]; /* +0x0008 75 00 00 00 */ long lParam; /* +0x000c */ unsigned long time; /* +0x0010 */ unsigned char pt[8]; /* +0x0014 8a 14 00 00 */ }; struct tagCANDIDATELIST { unsigned long dwSize; /* +0x0000 */ unsigned long dwStyle; /* +0x0004 */ unsigned long dwCount; /* +0x0008 */ unsigned long dwSelection; /* +0x000c */ unsigned long dwPageStart; /* +0x0010 */ unsigned long dwPageSize; /* +0x0014 */ unsigned char dwOffset[4]; /* +0x0018 f6 12 00 00 */ }; struct _ACL_REVISION_INFORMATION { unsigned long AclRevision; /* +0x0000 */ }; struct _ROOT_INFO_LUID { unsigned long LowPart; /* +0x0000 */ long HighPart; /* +0x0004 */ }; struct PPM_IDLE_STATE_BUCKET_EX { unsigned long long TotalTimeUs; /* +0x0000 */ unsigned long MinTimeUs; /* +0x0008 */ unsigned long MaxTimeUs; /* +0x000c */ unsigned long Count; /* +0x0010 */ }; struct _IMAGE_IMPORT_DESCRIPTOR { unsigned long Characteristics; /* +0x0000 */ unsigned long OriginalFirstThunk; /* +0x0000 */ unsigned long TimeDateStamp; /* +0x0004 */ unsigned long ForwarderChain; /* +0x0008 */ unsigned long Name; /* +0x000c */ unsigned long FirstThunk; /* +0x0010 */ }; struct _PMD { unsigned char mdisp[4]; /* +0x0000 74 00 00 00 */ unsigned char pdisp[4]; /* +0x0004 74 00 00 00 */ unsigned char vdisp[4]; /* +0x0008 74 00 00 00 */ }; struct _RTL_BUFFER { unsigned char *Buffer; /* +0x0000 */ unsigned char *StaticBuffer; /* +0x0004 */ unsigned long Size; /* +0x0008 */ unsigned long StaticSize; /* +0x000c */ unsigned long ReservedForAllocatedSize; /* +0x0010 */ void *ReservedForIMalloc; /* +0x0014 */ }; struct _RPC_HTTP_TRANSPORT_CREDENTIALS_V3_W { void *TransportCredentials; /* +0x0000 */ unsigned long Flags; /* +0x0004 */ unsigned long AuthenticationTarget; /* +0x0008 */ unsigned long NumberOfAuthnSchemes; /* +0x000c */ unsigned long *AuthnSchemes; /* +0x0010 */ unsigned short *ServerCertificateSubject; /* +0x0014 */ void *ProxyCredentials; /* +0x0018 */ unsigned long NumberOfProxyAuthnSchemes; /* +0x001c */ unsigned long *ProxyAuthnSchemes; /* +0x0020 */ }; struct _CMC_PEND_INFO { unsigned char PendToken[8]; /* +0x0000 02 13 00 00 */ unsigned char PendTime[8]; /* +0x0008 31 13 00 00 */ }; struct tagHARDWAREHOOKSTRUCT { unsigned char hwnd[4]; /* +0x0000 f1 12 00 00 */ unsigned char message[4]; /* +0x0004 75 00 00 00 */ unsigned char wParam[4]; /* +0x0008 75 00 00 00 */ long lParam; /* +0x000c */ }; struct _PSFEATURE_OUTPUT { unsigned char bPageIndependent[4]; /* +0x0000 74 00 00 00 */ unsigned char bSetPageDevice[4]; /* +0x0004 74 00 00 00 */ }; struct KEY_PID_ARRAY { void *PID; /* +0x0000 */ unsigned char KeyName[8]; /* +0x0004 dd 12 00 00 */ }; struct _RTL_STACK_CONTEXT { unsigned long NumberOfEntries; /* +0x0000 */ unsigned char Entry[8]; /* +0x0004 f9 50 00 00 */ }; struct PPM_THERMAL_POLICY_EVENT { unsigned char Mode; /* +0x0000 */ unsigned long long Processors; /* +0x0008 */ }; struct SYSTEM_POWER_CAPABILITIES { unsigned char PowerButtonPresent; /* +0x0000 */ unsigned char SleepButtonPresent; /* +0x0001 */ unsigned char LidPresent; /* +0x0002 */ unsigned char SystemS1; /* +0x0003 */ unsigned char SystemS2; /* +0x0004 */ unsigned char SystemS3; /* +0x0005 */ unsigned char SystemS4; /* +0x0006 */ unsigned char SystemS5; /* +0x0007 */ unsigned char HiberFilePresent; /* +0x0008 */ unsigned char FullWake; /* +0x0009 */ unsigned char VideoDimPresent; /* +0x000a */ unsigned char ApmPresent; /* +0x000b */ unsigned char UpsPresent; /* +0x000c */ unsigned char ThermalControl; /* +0x000d */ unsigned char ProcessorThrottle; /* +0x000e */ unsigned char ProcessorMinThrottle; /* +0x000f */ unsigned char ProcessorMaxThrottle; /* +0x0010 */ unsigned char FastSystemS4; /* +0x0011 */ unsigned char Hiberboot; /* +0x0012 */ unsigned char WakeAlarmPresent; /* +0x0013 */ unsigned char AoAc; /* +0x0014 */ unsigned char DiskSpinDown; /* +0x0015 */ unsigned char spare3[8]; /* +0x0016 7f 19 00 00 */ unsigned char SystemBatteriesPresent; /* +0x001e */ unsigned char BatteriesAreShortTerm; /* +0x001f */ unsigned char BatteryScale[24]; /* +0x0020 b5 51 00 00 */ unsigned char AcOnLineWake[4]; /* +0x0038 5a 16 00 00 */ unsigned char SoftLidWake[4]; /* +0x003c 5a 16 00 00 */ unsigned char RtcWake[4]; /* +0x0040 5a 16 00 00 */ unsigned char MinDeviceWakeState[4]; /* +0x0044 5a 16 00 00 */ unsigned char DefaultLowLatencyWake[4]; /* +0x0048 5a 16 00 00 */ }; struct _EISA_PORT_CONFIGURATION { unsigned char Configuration[1]; /* +0x0000 90 46 00 00 */ unsigned short PortAddress; /* +0x0001 */ }; struct POWER_STATE_HANDLER { unsigned char Type[4]; /* +0x0000 fe 12 00 00 */ unsigned char RtcWake; /* +0x0004 */ unsigned char Spare[3]; /* +0x0005 8d 13 00 00 */ unsigned char Handler[4]; /* +0x0008 ef 48 00 00 */ void *Context; /* +0x000c */ }; struct DISPLAYCONFIG_TARGET_DEVICE_NAME { unsigned char header[20]; /* +0x0000 ca 24 00 00 */ unsigned char flags[4]; /* +0x0014 de 51 00 00 */ unsigned char outputTechnology[4]; /* +0x0018 24 44 00 00 */ unsigned short edidManufactureId; /* +0x001c */ unsigned short edidProductCodeId; /* +0x001e */ unsigned char connectorInstance[4]; /* +0x0020 75 00 00 00 */ unsigned char monitorFriendlyDeviceName[128]; /* +0x0024 98 1e 00 00 */ unsigned char monitorDevicePath[256]; /* +0x00a4 a7 15 00 00 */ }; struct _CLAIM_SECURITY_ATTRIBUTES_INFORMATION::<unnamed-type-Attribute> { unsigned char pAttributeV1[4]; /* +0x0000 ed 1f 00 00 */ }; struct _KEY_FLAGS_INFORMATION { unsigned long Wow64Flags; /* +0x0000 */ unsigned long KeyFlags; /* +0x0004 */ unsigned long ControlFlags; /* +0x0008 */ }; struct _CM_VIDEO_DEVICE_DATA { unsigned short Version; /* +0x0000 */ unsigned short Revision; /* +0x0002 */ unsigned long VideoClock; /* +0x0004 */ }; struct _wireVARIANT { unsigned long clSize; /* +0x0000 */ unsigned long rpcReserved; /* +0x0004 */ unsigned short vt; /* +0x0008 */ unsigned short wReserved1; /* +0x000a */ unsigned short wReserved2; /* +0x000c */ unsigned short wReserved3; /* +0x000e */ long long llVal; /* +0x0010 */ long lVal; /* +0x0010 */ unsigned char bVal; /* +0x0010 */ short iVal; /* +0x0010 */ /* unsigned char fltVal[0]; +0x0010 40 00 00 00 */ /* unsigned char dblVal[0]; +0x0010 41 00 00 00 */ short boolVal; /* +0x0010 */ long scode; /* +0x0010 */ /* unsigned char cyVal[0]; +0x0010 64 3d 00 00 */ /* unsigned char date[0]; +0x0010 41 00 00 00 */ /* unsigned char bstrVal[0]; +0x0010 40 1d 00 00 */ /* unsigned char punkVal[0]; +0x0010 7f 17 00 00 */ /* unsigned char pdispVal[0]; +0x0010 7f 31 00 00 */ /* unsigned char parray[0]; +0x0010 c8 50 00 00 */ /* unsigned char brecVal[0]; +0x0010 b2 15 00 00 */ unsigned char *pbVal; /* +0x0010 */ short *piVal; /* +0x0010 */ long *plVal; /* +0x0010 */ long long *pllVal; /* +0x0010 */ /* unsigned char pfltVal[0]; +0x0010 40 04 00 00 */ /* unsigned char pdblVal[0]; +0x0010 41 04 00 00 */ short *pboolVal; /* +0x0010 */ long *pscode; /* +0x0010 */ /* unsigned char pcyVal[0]; +0x0010 65 3d 00 00 */ /* unsigned char pdate[0]; +0x0010 41 04 00 00 */ /* unsigned char pbstrVal[0]; +0x0010 34 3b 00 00 */ /* unsigned char ppunkVal[0]; +0x0010 13 22 00 00 */ /* unsigned char ppdispVal[0]; +0x0010 80 31 00 00 */ /* unsigned char pparray[0]; +0x0010 14 52 00 00 */ /* unsigned char pvarVal[0]; +0x0010 de 25 00 00 */ char cVal; /* +0x0010 */ unsigned short uiVal; /* +0x0010 */ unsigned long ulVal; /* +0x0010 */ unsigned long long ullVal; /* +0x0010 */ /* unsigned char intVal[0]; +0x0010 74 00 00 00 */ /* unsigned char uintVal[0]; +0x0010 75 00 00 00 */ /* unsigned char decVal[0]; +0x0010 d2 1e 00 00 */ /* unsigned char pdecVal[0]; +0x0010 d3 1e 00 00 */ char *pcVal; /* +0x0010 */ unsigned short *puiVal; /* +0x0010 */ unsigned long *pulVal; /* +0x0010 */ unsigned long long *pullVal; /* +0x0010 */ /* unsigned char pintVal[0]; +0x0010 74 04 00 00 */ unsigned char puintVal[16]; /* +0x0010 75 04 00 00 */ }; struct _SHFILEINFOA { unsigned char hIcon[4]; /* +0x0000 07 21 00 00 */ unsigned char iIcon[4]; /* +0x0004 74 00 00 00 */ unsigned long dwAttributes; /* +0x0008 */ unsigned char szDisplayName[260]; /* +0x000c 27 24 00 00 */ unsigned char szTypeName[80]; /* +0x0110 c8 2f 00 00 */ }; struct _INSTALLSPEC::<unnamed-type-COMClass> { unsigned char Clsid[16]; /* +0x0000 dc 14 00 00 */ unsigned long ClsCtx; /* +0x0010 */ }; struct _INSTALLSPEC::<unnamed-type-AppName> { unsigned char Name[4]; /* +0x0000 71 04 00 00 */ unsigned char GPOId[16]; /* +0x0004 dc 14 00 00 */ }; struct _TOKEN_SECURITY_ATTRIBUTE_V1::<unnamed-type-Values> { long long *pInt64; /* +0x0000 */ unsigned long long *pUint64; /* +0x0000 */ /* unsigned char pString[0]; +0x0000 a2 17 00 00 */ /* unsigned char pFqbn[0]; +0x0000 fa 29 00 00 */ unsigned char pOctetString[4]; /* +0x0000 ac 2d 00 00 */ }; struct tagARRAYDESC { unsigned char tdescElem[8]; /* +0x0000 cf 40 00 00 */ unsigned short cDims; /* +0x0008 */ unsigned char rgbounds[8]; /* +0x000c 04 25 00 00 */ }; struct _RTL_ACTIVATION_CONTEXT_STACK_FRAME { unsigned char Previous[4]; /* +0x0000 66 3e 00 00 */ unsigned char ActivationContext[4]; /* +0x0004 69 17 00 00 */ unsigned long Flags; /* +0x0008 */ }; struct RPC_IMPORT_CONTEXT_P { void *LookupContext; /* +0x0000 */ void *ProposedHandle; /* +0x0004 */ unsigned char Bindings[4]; /* +0x0008 4f 52 00 00 */ }; struct _GDI_OBJECT::__MIDL_IAdviseSink_0002 { /* unsigned char hBitmap[0]; +0x0000 72 2b 00 00 */ /* unsigned char hPalette[0]; +0x0000 f4 21 00 00 */ unsigned char hGeneric[4]; /* +0x0000 cd 13 00 00 */ }; struct _OBJECT_HANDLE_FLAG_INFORMATION { unsigned char Inherit; /* +0x0000 */ unsigned char ProtectFromClose; /* +0x0001 */ }; struct tagMONITORINFO { unsigned long cbSize; /* +0x0000 */ unsigned char rcMonitor[16]; /* +0x0004 63 14 00 00 */ unsigned char rcWork[16]; /* +0x0014 63 14 00 00 */ unsigned long dwFlags; /* +0x0024 */ }; struct tagCOMPOSITIONFORM { unsigned long dwStyle; /* +0x0000 */ unsigned char ptCurrentPos[8]; /* +0x0004 8a 14 00 00 */ unsigned char rcArea[16]; /* +0x000c 63 14 00 00 */ }; struct _LDR_DATA_TABLE_ENTRY64 { unsigned char InLoadOrderLinks[16]; /* +0x0000 e7 1c 00 00 */ unsigned char InMemoryOrderLinks[16]; /* +0x0010 e7 1c 00 00 */ unsigned char InInitializationOrderLinks[16]; /* +0x0020 e7 1c 00 00 */ unsigned long long DllBase; /* +0x0030 */ unsigned long long EntryPoint; /* +0x0038 */ unsigned long SizeOfImage; /* +0x0040 */ unsigned char FullDllName[16]; /* +0x0048 0d 29 00 00 */ unsigned char BaseDllName[16]; /* +0x0058 0d 29 00 00 */ unsigned long Flags; /* +0x0068 */ unsigned short LoadCount; /* +0x006c */ unsigned short TlsIndex; /* +0x006e */ /* unsigned char HashLinks[0]; +0x0070 e7 1c 00 00 */ unsigned long long SectionPointer; /* +0x0070 */ unsigned long CheckSum; /* +0x0078 */ unsigned long TimeDateStamp; /* +0x0080 */ unsigned long long LoadedImports; /* +0x0080 */ }; struct _stat64i32 { unsigned char st_dev[4]; /* +0x0000 75 00 00 00 */ unsigned short st_ino; /* +0x0004 */ unsigned short st_mode; /* +0x0006 */ short st_nlink; /* +0x0008 */ short st_uid; /* +0x000a */ short st_gid; /* +0x000c */ unsigned char st_rdev[4]; /* +0x0010 75 00 00 00 */ long st_size; /* +0x0014 */ long long st_atime; /* +0x0018 */ long long st_mtime; /* +0x0020 */ long long st_ctime; /* +0x0028 */ }; struct tagRAWINPUT::<unnamed-type-data> { /* unsigned char mouse[0]; +0x0000 e6 28 00 00 */ /* unsigned char keyboard[0]; +0x0000 5c 20 00 00 */ unsigned char hid[24]; /* +0x0000 c2 43 00 00 */ }; struct BITMAPV5HEADER { unsigned long bV5Size; /* +0x0000 */ long bV5Width; /* +0x0004 */ long bV5Height; /* +0x0008 */ unsigned short bV5Planes; /* +0x000c */ unsigned short bV5BitCount; /* +0x000e */ unsigned long bV5Compression; /* +0x0010 */ unsigned long bV5SizeImage; /* +0x0014 */ long bV5XPelsPerMeter; /* +0x0018 */ long bV5YPelsPerMeter; /* +0x001c */ unsigned long bV5ClrUsed; /* +0x0020 */ unsigned long bV5ClrImportant; /* +0x0024 */ unsigned long bV5RedMask; /* +0x0028 */ unsigned long bV5GreenMask; /* +0x002c */ unsigned long bV5BlueMask; /* +0x0030 */ unsigned long bV5AlphaMask; /* +0x0034 */ unsigned long bV5CSType; /* +0x0038 */ unsigned char bV5Endpoints[36]; /* +0x003c c4 2c 00 00 */ unsigned long bV5GammaRed; /* +0x0060 */ unsigned long bV5GammaGreen; /* +0x0064 */ unsigned long bV5GammaBlue; /* +0x0068 */ unsigned long bV5Intent; /* +0x006c */ unsigned long bV5ProfileData; /* +0x0070 */ unsigned long bV5ProfileSize; /* +0x0074 */ unsigned long bV5Reserved; /* +0x0078 */ }; struct _MIDL_SERVER_INFO_ { unsigned char pStubDesc[4]; /* +0x0000 33 29 00 00 */ unsigned char DispatchTable[4]; /* +0x0004 56 53 00 00 */ unsigned char ProcString[4]; /* +0x0008 39 19 00 00 */ unsigned char FmtStringOffset[4]; /* +0x000c 3b 19 00 00 */ unsigned char ThunkTable[4]; /* +0x0010 09 1a 00 00 */ unsigned char pTransferSyntax[4]; /* +0x0014 ec 23 00 00 */ unsigned long nCount; /* +0x0018 */ unsigned char pSyntaxInfo[4]; /* +0x001c aa 20 00 00 */ }; struct RETRIEVAL_POINTERS_BUFFER { unsigned long ExtentCount; /* +0x0000 */ unsigned char StartingVcn[24]; /* +0x0008 3d 13 00 00 */ }; struct RETRIEVAL_POINTERS_BUFFER::<unnamed-type-Extents> { unsigned char NextVcn[8]; /* +0x0000 3d 13 00 00 */ unsigned char Lcn[8]; /* +0x0008 3d 13 00 00 */ }; struct BITMAPV4HEADER { unsigned long bV4Size; /* +0x0000 */ long bV4Width; /* +0x0004 */ long bV4Height; /* +0x0008 */ unsigned short bV4Planes; /* +0x000c */ unsigned short bV4BitCount; /* +0x000e */ unsigned long bV4V4Compression; /* +0x0010 */ unsigned long bV4SizeImage; /* +0x0014 */ long bV4XPelsPerMeter; /* +0x0018 */ long bV4YPelsPerMeter; /* +0x001c */ unsigned long bV4ClrUsed; /* +0x0020 */ unsigned long bV4ClrImportant; /* +0x0024 */ unsigned long bV4RedMask; /* +0x0028 */ unsigned long bV4GreenMask; /* +0x002c */ unsigned long bV4BlueMask; /* +0x0030 */ unsigned long bV4AlphaMask; /* +0x0034 */ unsigned long bV4CSType; /* +0x0038 */ unsigned char bV4Endpoints[36]; /* +0x003c c4 2c 00 00 */ unsigned long bV4GammaRed; /* +0x0060 */ unsigned long bV4GammaGreen; /* +0x0064 */ unsigned long bV4GammaBlue; /* +0x0068 */ }; struct DVTDINFO { unsigned char cbConvertSize[4]; /* +0x0000 75 00 00 00 */ unsigned char cchDrvName[4]; /* +0x0004 75 00 00 00 */ unsigned char cchDevName[4]; /* +0x0008 75 00 00 00 */ unsigned char cchPortName[4]; /* +0x000c 75 00 00 00 */ }; enum _TAPE_DRIVE_PROBLEM_TYPE { TapeDriveProblemNone = 0, TapeDriveReadWriteWarning = 1, TapeDriveReadWriteError = 2, TapeDriveReadWarning = 3, TapeDriveWriteWarning = 4, TapeDriveReadError = 5, TapeDriveWriteError = 6, TapeDriveHardwareError = 7, TapeDriveUnsupportedMedia = 8, TapeDriveScsiConnectionError = 9, TapeDriveTimetoClean = 10, TapeDriveCleanDriveNow = 11, TapeDriveMediaLifeExpired = 12, TapeDriveSnappedTape = 13 }; enum std::float_round_style { round_indeterminate = -1, round_toward_zero = 0, round_to_nearest = 1, round_toward_infinity = 2, round_toward_neg_infinity = 3 }; enum std::float_denorm_style { denorm_indeterminate = -1, denorm_absent = 0, denorm_present = 1 }; enum std::_Uninitialized { _Noinit = 0 }; enum std::pointer_safety::pointer_safety { relaxed = 0, preferred = 1, strict = 2 }; struct _TAPE_SET_DRIVE_PARAMETERS { unsigned char ECC; /* +0x0000 */ unsigned char Compression; /* +0x0001 */ unsigned char DataPadding; /* +0x0002 */ unsigned char ReportSetmarks; /* +0x0003 */ unsigned long EOTWarningZoneSize; /* +0x0004 */ }; struct std::_Bool_struct { unsigned char _Member[4]; /* +0x0000 74 00 00 00 */ }; struct std::tr1::_Get_align<short> { short _Elt0; /* +0x0000 */ char _Elt1; /* +0x0002 */ short _Elt2; /* +0x0004 */ }; struct std::tr1::_Get_align<char> { char _Elt0; /* +0x0000 */ char _Elt1; /* +0x0001 */ char _Elt2; /* +0x0002 */ }; struct std::tr1::_Get_align<long> { long _Elt0; /* +0x0000 */ char _Elt1; /* +0x0004 */ long _Elt2; /* +0x0008 */ }; struct std::tr1::_Get_align<int> { unsigned char _Elt0[4]; /* +0x0000 74 00 00 00 */ char _Elt1; /* +0x0004 */ unsigned char _Elt2[4]; /* +0x0008 74 00 00 00 */ }; struct _TAPE_SET_POSITION { unsigned long Method; /* +0x0000 */ unsigned long Partition; /* +0x0004 */ unsigned char Offset[8]; /* +0x0008 3d 13 00 00 */ unsigned char Immediate; /* +0x0010 */ }; struct _TAPE_WMI_OPERATIONS { unsigned long Method; /* +0x0000 */ unsigned long DataBufferSize; /* +0x0004 */ void *DataBuffer; /* +0x0008 */ }; struct $_TypeDescriptor$_extraBytes_15 { unsigned char pVFTable[4]; /* +0x0000 3d 19 00 00 */ void *spare; /* +0x0004 */ unsigned char name[15]; /* +0x0008 5f 56 00 00 */ }; struct __m128 { /* unsigned char m128_f32[0]; +0x0000 67 56 00 00 */ /* unsigned char m128_u64[0]; +0x0000 83 23 00 00 */ /* unsigned char m128_i8[0]; +0x0000 68 56 00 00 */ /* unsigned char m128_i16[0]; +0x0000 69 56 00 00 */ /* unsigned char m128_i32[0]; +0x0000 c2 21 00 00 */ /* unsigned char m128_i64[0]; +0x0000 6a 56 00 00 */ /* unsigned char m128_u8[0]; +0x0000 09 1c 00 00 */ /* unsigned char m128_u16[0]; +0x0000 6b 56 00 00 */ unsigned char m128_u32[16]; /* +0x0000 6c 56 00 00 */ }; struct _TAPE_GET_POSITION { unsigned long Type; /* +0x0000 */ unsigned long Partition; /* +0x0004 */ unsigned char Offset[8]; /* +0x0008 3d 13 00 00 */ }; struct _TAPE_ERASE { unsigned long Type; /* +0x0000 */ unsigned char Immediate; /* +0x0004 */ }; struct _TAPE_GET_MEDIA_PARAMETERS { unsigned char Capacity[8]; /* +0x0000 3d 13 00 00 */ unsigned char Remaining[8]; /* +0x0008 3d 13 00 00 */ unsigned long BlockSize; /* +0x0010 */ unsigned long PartitionCount; /* +0x0014 */ unsigned char WriteProtected; /* +0x0018 */ }; struct _complex { unsigned char x[8]; /* +0x0000 41 00 00 00 */ unsigned char y[8]; /* +0x0008 41 00 00 00 */ }; struct _exception { unsigned char type[4]; /* +0x0000 74 00 00 00 */ char *name; /* +0x0004 */ unsigned char arg1[8]; /* +0x0008 41 00 00 00 */ unsigned char arg2[8]; /* +0x0010 41 00 00 00 */ unsigned char retval[8]; /* +0x0018 41 00 00 00 */ }; struct _TAPE_CREATE_PARTITION { unsigned long Method; /* +0x0000 */ unsigned long Count; /* +0x0004 */ unsigned long Size; /* +0x0008 */ }; struct _TAPE_PREPARE { unsigned long Operation; /* +0x0000 */ unsigned char Immediate; /* +0x0004 */ }; struct __m128i { /* unsigned char m128i_i8[0]; +0x0000 68 56 00 00 */ /* unsigned char m128i_i16[0]; +0x0000 69 56 00 00 */ /* unsigned char m128i_i32[0]; +0x0000 c2 21 00 00 */ /* unsigned char m128i_i64[0]; +0x0000 6a 56 00 00 */ /* unsigned char m128i_u8[0]; +0x0000 09 1c 00 00 */ /* unsigned char m128i_u16[0]; +0x0000 6b 56 00 00 */ /* unsigned char m128i_u32[0]; +0x0000 6c 56 00 00 */ unsigned char m128i_u64[16]; /* +0x0000 83 23 00 00 */ }; struct _TAPE_GET_DRIVE_PARAMETERS { unsigned char ECC; /* +0x0000 */ unsigned char Compression; /* +0x0001 */ unsigned char DataPadding; /* +0x0002 */ unsigned char ReportSetmarks; /* +0x0003 */ unsigned long DefaultBlockSize; /* +0x0004 */ unsigned long MaximumBlockSize; /* +0x0008 */ unsigned long MinimumBlockSize; /* +0x000c */ unsigned long MaximumPartitionCount; /* +0x0010 */ unsigned long FeaturesLow; /* +0x0014 */ unsigned long FeaturesHigh; /* +0x0018 */ unsigned long EOTWarningZoneSize; /* +0x001c */ }; struct _CrtMemState { unsigned char pBlockHeader[4]; /* +0x0000 a0 56 00 00 */ unsigned char lCounts[20]; /* +0x0004 a1 56 00 00 */ unsigned char lSizes[20]; /* +0x0018 a1 56 00 00 */ unsigned char lHighWaterCount[4]; /* +0x002c 75 00 00 00 */ unsigned char lTotalCount[4]; /* +0x0030 75 00 00 00 */ }; struct __JUMP_BUFFER { unsigned long Ebp; /* +0x0000 */ unsigned long Ebx; /* +0x0004 */ unsigned long Edi; /* +0x0008 */ unsigned long Esi; /* +0x000c */ unsigned long Esp; /* +0x0010 */ unsigned long Eip; /* +0x0014 */ unsigned long Registration; /* +0x0018 */ unsigned long TryLevel; /* +0x001c */ unsigned long Cookie; /* +0x0020 */ unsigned long UnwindFunc; /* +0x0024 */ unsigned char UnwindData[24]; /* +0x0028 a8 1f 00 00 */ }; struct __m256i { /* unsigned char m256i_i8[0]; +0x0000 43 23 00 00 */ /* unsigned char m256i_i16[0]; +0x0000 a8 56 00 00 */ /* unsigned char m256i_i32[0]; +0x0000 a9 56 00 00 */ /* unsigned char m256i_i64[0]; +0x0000 aa 56 00 00 */ /* unsigned char m256i_u8[0]; +0x0000 e5 17 00 00 */ /* unsigned char m256i_u16[0]; +0x0000 ab 56 00 00 */ /* unsigned char m256i_u32[0]; +0x0000 ac 56 00 00 */ unsigned char m256i_u64[32]; /* +0x0000 0f 3f 00 00 */ }; struct _TAPE_WRITE_MARKS { unsigned long Type; /* +0x0000 */ unsigned long Count; /* +0x0004 */ unsigned char Immediate; /* +0x0008 */ }; struct __type_info_node { void *_MemPtr; /* +0x0000 */ unsigned char _Next[4]; /* +0x0004 4a 56 00 00 */ }; struct _Dconst { /* unsigned char _Word[0]; +0x0000 6b 56 00 00 */ /* unsigned char _Float[0]; +0x0000 40 00 00 00 */ /* unsigned char _Double[0]; +0x0000 41 00 00 00 */ unsigned char _Long_double[16]; /* +0x0000 41 00 00 00 */ }; struct __m256d { unsigned char m256d_f64[32]; /* +0x0000 de 56 00 00 */ }; struct _TAPE_SET_MEDIA_PARAMETERS { unsigned long BlockSize; /* +0x0000 */ }; struct __m128d { unsigned char m128d_f64[16]; /* +0x0000 e9 56 00 00 */ }; struct __m64 { unsigned long long m64_u64; /* +0x0000 */ /* unsigned char m64_f32[0]; +0x0000 01 57 00 00 */ /* unsigned char m64_i8[0]; +0x0000 0c 1d 00 00 */ /* unsigned char m64_i16[0]; +0x0000 f7 14 00 00 */ /* unsigned char m64_i32[0]; +0x0000 02 57 00 00 */ long long m64_i64; /* +0x0000 */ /* unsigned char m64_u8[0]; +0x0000 7f 19 00 00 */ /* unsigned char m64_u16[0]; +0x0000 b0 2d 00 00 */ unsigned char m64_u32[8]; /* +0x0000 03 57 00 00 */ }; struct __m256 { unsigned char m256_f32[32]; /* +0x0000 07 57 00 00 */ }; enum <unnamed-type-s_astaStatus> { AstaStatusUndetermined = 0, AstaEnabled = 1, AstaDisabled = 2 }; struct tagSTATDATA { unsigned char formatetc[20]; /* +0x0000 20 18 00 00 */ unsigned long advf; /* +0x0014 */ unsigned char pAdvSink[4]; /* +0x0018 23 18 00 00 */ unsigned long dwConnection; /* +0x001c */ }; struct tagPARAMDESC { unsigned char pparamdescex[4]; /* +0x0000 20 57 00 00 */ unsigned short wParamFlags; /* +0x0004 */ }; struct tagBINDPTR { /* unsigned char lpfuncdesc[0]; +0x0000 c1 40 00 00 */ /* unsigned char lpvardesc[0]; +0x0000 83 36 00 00 */ unsigned char lptcomp[4]; /* +0x0000 3a 2e 00 00 */ }; struct _RTL_CONDITION_VARIABLE { /* unsigned char WakeCount[0]; +0x0000 4d 57 00 00 */ /* unsigned char Waking[0]; +0x0000 27 1e 00 00 */ unsigned long Value; /* +0x0000 */ void *Ptr; /* +0x0000 */ }; struct tagTLIBATTR { unsigned char guid[16]; /* +0x0000 dc 14 00 00 */ unsigned long lcid; /* +0x0010 */ unsigned char syskind[4]; /* +0x0014 60 57 00 00 */ unsigned short wMajorVerNum; /* +0x0018 */ unsigned short wMinorVerNum; /* +0x001a */ unsigned short wLibFlags; /* +0x001c */ }; struct tagELEMDESC { unsigned char tdesc[8]; /* +0x0000 cf 40 00 00 */ /* unsigned char idldesc[0]; +0x0008 d5 40 00 00 */ unsigned char paramdesc[8]; /* +0x0008 ba 52 00 00 */ }; struct _IMAGE_DATA_DIRECTORY { unsigned long VirtualAddress; /* +0x0000 */ unsigned long Size; /* +0x0004 */ }; struct tagVARIANT { unsigned short vt; /* +0x0000 */ unsigned short wReserved1; /* +0x0002 */ unsigned short wReserved2; /* +0x0004 */ unsigned short wReserved3; /* +0x0006 */ long long llVal; /* +0x0008 */ long lVal; /* +0x0008 */ unsigned char bVal; /* +0x0008 */ short iVal; /* +0x0008 */ /* unsigned char fltVal[0]; +0x0008 40 00 00 00 */ /* unsigned char dblVal[0]; +0x0008 41 00 00 00 */ short boolVal; /* +0x0008 */ long scode; /* +0x0008 */ /* unsigned char cyVal[0]; +0x0008 64 3d 00 00 */ /* unsigned char date[0]; +0x0008 41 00 00 00 */ /* unsigned char bstrVal[0]; +0x0008 71 04 00 00 */ /* unsigned char punkVal[0]; +0x0008 7f 17 00 00 */ /* unsigned char pdispVal[0]; +0x0008 7f 31 00 00 */ /* unsigned char parray[0]; +0x0008 7b 57 00 00 */ unsigned char *pbVal; /* +0x0008 */ short *piVal; /* +0x0008 */ long *plVal; /* +0x0008 */ long long *pllVal; /* +0x0008 */ /* unsigned char pfltVal[0]; +0x0008 40 04 00 00 */ /* unsigned char pdblVal[0]; +0x0008 41 04 00 00 */ short *pboolVal; /* +0x0008 */ long *pscode; /* +0x0008 */ /* unsigned char pcyVal[0]; +0x0008 65 3d 00 00 */ /* unsigned char pdate[0]; +0x0008 41 04 00 00 */ /* unsigned char pbstrVal[0]; +0x0008 d0 13 00 00 */ /* unsigned char ppunkVal[0]; +0x0008 13 22 00 00 */ /* unsigned char ppdispVal[0]; +0x0008 80 31 00 00 */ /* unsigned char pparray[0]; +0x0008 7c 57 00 00 */ /* unsigned char pvarVal[0]; +0x0008 3c 18 00 00 */ void *byref; /* +0x0008 */ char cVal; /* +0x0008 */ unsigned short uiVal; /* +0x0008 */ unsigned long ulVal; /* +0x0008 */ unsigned long long ullVal; /* +0x0008 */ /* unsigned char intVal[0]; +0x0008 74 00 00 00 */ /* unsigned char uintVal[0]; +0x0008 75 00 00 00 */ /* unsigned char pdecVal[0]; +0x0008 d3 1e 00 00 */ char *pcVal; /* +0x0008 */ unsigned short *puiVal; /* +0x0008 */ unsigned long *pulVal; /* +0x0008 */ unsigned long long *pullVal; /* +0x0008 */ /* unsigned char pintVal[0]; +0x0008 74 04 00 00 */ /* unsigned char puintVal[0]; +0x0008 75 04 00 00 */ void *pvRecord; /* +0x0008 */ /* unsigned char pRecInfo[-12]; +0x000c 50 3c 00 00 */ unsigned char decVal[16]; /* +0x0000 d2 1e 00 00 */ }; struct tagMULTI_QI { unsigned char pIID[4]; /* +0x0000 4a 16 00 00 */ unsigned char pItf[4]; /* +0x0004 7f 17 00 00 */ unsigned char hr[4]; /* +0x0008 08 00 00 00 */ }; struct tagSAFEARRAYBOUND { unsigned long cElements; /* +0x0000 */ long lLbound; /* +0x0004 */ }; struct tagTYPEDESC { /* unsigned char lptdesc[0]; +0x0000 d0 40 00 00 */ /* unsigned char lpadesc[0]; +0x0000 b2 57 00 00 */ unsigned long hreftype; /* +0x0000 */ unsigned short vt; /* +0x0004 */ }; struct tagEXCEPINFO { unsigned short wCode; /* +0x0000 */ unsigned short wReserved; /* +0x0002 */ unsigned char bstrSource[4]; /* +0x0004 71 04 00 00 */ unsigned char bstrDescription[4]; /* +0x0008 71 04 00 00 */ unsigned char bstrHelpFile[4]; /* +0x000c 71 04 00 00 */ unsigned long dwHelpContext; /* +0x0010 */ void *pvReserved; /* +0x0014 */ unsigned char pfnDeferredFillIn[4]; /* +0x0018 b7 57 00 00 */ long scode; /* +0x001c */ }; struct tagSTATSTG { unsigned char pwcsName[4]; /* +0x0000 71 04 00 00 */ unsigned long type; /* +0x0004 */ unsigned char cbSize[8]; /* +0x0008 fd 22 00 00 */ unsigned char mtime[8]; /* +0x0010 31 13 00 00 */ unsigned char ctime[8]; /* +0x0018 31 13 00 00 */ unsigned char atime[8]; /* +0x0020 31 13 00 00 */ unsigned long grfMode; /* +0x0028 */ unsigned long grfLocksSupported; /* +0x002c */ unsigned char clsid[16]; /* +0x0030 dc 14 00 00 */ unsigned long grfStateBits; /* +0x0040 */ unsigned long reserved; /* +0x0044 */ }; struct tagFUNCDESC { long memid; /* +0x0000 */ long *lprgscode; /* +0x0004 */ unsigned char lprgelemdescParam[4]; /* +0x0008 e0 1f 00 00 */ unsigned char funckind[4]; /* +0x000c eb 57 00 00 */ unsigned char invkind[4]; /* +0x0010 5f 35 00 00 */ unsigned char callconv[4]; /* +0x0014 2b 13 00 00 */ short cParams; /* +0x0018 */ short cParamsOpt; /* +0x001a */ short oVft; /* +0x001c */ short cScodes; /* +0x001e */ unsigned char elemdescFunc[16]; /* +0x0020 df 1f 00 00 */ unsigned short wFuncFlags; /* +0x0030 */ }; struct tagBIND_OPTS { unsigned long cbStruct; /* +0x0000 */ unsigned long grfFlags; /* +0x0004 */ unsigned long grfMode; /* +0x0008 */ unsigned long dwTickCountDeadline; /* +0x000c */ }; struct tagIDLDESC { unsigned long dwReserved; /* +0x0000 */ unsigned short wIDLFlags; /* +0x0004 */ }; struct _UNICODE_STRING { unsigned short Length; /* +0x0000 */ unsigned short MaximumLength; /* +0x0002 */ unsigned char Buffer[4]; /* +0x0004 71 04 00 00 */ }; struct _RTL_SPLAY_LINKS { unsigned char Parent[4]; /* +0x0000 91 43 00 00 */ unsigned char LeftChild[4]; /* +0x0004 91 43 00 00 */ unsigned char RightChild[4]; /* +0x0008 91 43 00 00 */ }; struct _RTL_DYNAMIC_HASH_TABLE_ENTRY { unsigned char Linkage[8]; /* +0x0000 44 1f 00 00 */ unsigned long Signature; /* +0x0008 */ }; struct tagCABSTR { unsigned long cElems; /* +0x0000 */ unsigned char pElems[4]; /* +0x0004 d0 13 00 00 */ }; struct tagCACLSID { unsigned long cElems; /* +0x0000 */ unsigned char pElems[4]; /* +0x0004 44 16 00 00 */ }; struct tagCADBL { unsigned long cElems; /* +0x0000 */ unsigned char pElems[4]; /* +0x0004 41 04 00 00 */ }; struct tagCAUB { unsigned long cElems; /* +0x0000 */ unsigned char *pElems; /* +0x0004 */ }; struct tagCACY { unsigned long cElems; /* +0x0000 */ unsigned char pElems[4]; /* +0x0004 65 3d 00 00 */ }; struct LIST_ENTRY32 { unsigned long Flink; /* +0x0000 */ unsigned long Blink; /* +0x0004 */ }; struct tagIncomingCallData { unsigned long dwClientPID; /* +0x0000 */ }; struct _FILETIME { unsigned long dwLowDateTime; /* +0x0000 */ unsigned long dwHighDateTime; /* +0x0004 */ }; struct tagVARDESC { long memid; /* +0x0000 */ unsigned char lpstrSchema[4]; /* +0x0004 71 04 00 00 */ unsigned long oInst; /* +0x0008 */ unsigned char lpvarValue[4]; /* +0x0008 3c 18 00 00 */ unsigned char elemdescVar[16]; /* +0x000c df 1f 00 00 */ unsigned short wVarFlags; /* +0x001c */ unsigned char varkind[4]; /* +0x0020 43 58 00 00 */ }; struct CAtom { unsigned short m_atom; /* +0x0000 */ }; struct tagOutgoingCallData { unsigned long dwServerPID; /* +0x0000 */ unsigned long dwServerTID; /* +0x0004 */ }; struct tagDEC { unsigned short wReserved; /* +0x0000 */ unsigned char scale; /* +0x0002 */ unsigned char sign; /* +0x0003 */ unsigned short signscale; /* +0x0002 */ unsigned long Hi32; /* +0x0004 */ unsigned long Lo32; /* +0x0008 */ unsigned long Mid32; /* +0x000c */ unsigned long long Lo64; /* +0x0008 */ }; struct tagOutgoingActivationData { unsigned char guidServer[16]; /* +0x0000 dc 14 00 00 */ }; struct _CLIENT_ID { void *UniqueProcess; /* +0x0000 */ void *UniqueThread; /* +0x0004 */ }; struct _OBJECT_ATTRIBUTES { unsigned long Length; /* +0x0000 */ void *RootDirectory; /* +0x0004 */ unsigned char ObjectName[4]; /* +0x0008 a2 17 00 00 */ unsigned long Attributes; /* +0x000c */ void *SecurityDescriptor; /* +0x0010 */ void *SecurityQualityOfService; /* +0x0014 */ }; struct tagCAUL { unsigned long cElems; /* +0x0000 */ unsigned long *pElems; /* +0x0004 */ }; struct tagBSTRBLOB { unsigned long cbSize; /* +0x0000 */ unsigned char *pData; /* +0x0004 */ }; struct tagDVTARGETDEVICE { unsigned long tdSize; /* +0x0000 */ unsigned short tdDriverNameOffset; /* +0x0004 */ unsigned short tdDeviceNameOffset; /* +0x0006 */ unsigned short tdPortNameOffset; /* +0x0008 */ unsigned short tdExtDevmodeOffset; /* +0x000a */ unsigned char tdData[4]; /* +0x000c f9 12 00 00 */ }; struct tagCAH { unsigned long cElems; /* +0x0000 */ unsigned char pElems[4]; /* +0x0004 53 16 00 00 */ }; struct _KEY_VALUE_FULL_INFORMATION { unsigned long TitleIndex; /* +0x0000 */ unsigned long Type; /* +0x0004 */ unsigned long DataOffset; /* +0x0008 */ unsigned long DataLength; /* +0x000c */ unsigned long NameLength; /* +0x0010 */ unsigned char Name[4]; /* +0x0014 f7 13 00 00 */ }; struct _PROCESSOR_NUMBER { unsigned short Group; /* +0x0000 */ unsigned char Number; /* +0x0002 */ unsigned char Reserved; /* +0x0003 */ }; struct tagCAUI { unsigned long cElems; /* +0x0000 */ unsigned short *pElems; /* +0x0004 */ }; struct tagCAFILETIME { unsigned long cElems; /* +0x0000 */ unsigned char pElems[4]; /* +0x0004 73 17 00 00 */ }; struct _IMAGE_FILE_HEADER { unsigned short Machine; /* +0x0000 */ unsigned short NumberOfSections; /* +0x0002 */ unsigned long TimeDateStamp; /* +0x0004 */ unsigned long PointerToSymbolTable; /* +0x0008 */ unsigned long NumberOfSymbols; /* +0x000c */ unsigned short SizeOfOptionalHeader; /* +0x0010 */ unsigned short Characteristics; /* +0x0012 */ }; struct _XSTATE_FEATURE { unsigned long Offset; /* +0x0000 */ unsigned long Size; /* +0x0004 */ }; struct tagDISPPARAMS { unsigned char rgvarg[4]; /* +0x0000 3c 18 00 00 */ long *rgdispidNamedArgs; /* +0x0004 */ unsigned char cArgs[4]; /* +0x0008 75 00 00 00 */ unsigned char cNamedArgs[4]; /* +0x000c 75 00 00 00 */ }; struct tagSAFEARRAY { unsigned short cDims; /* +0x0000 */ unsigned short fFeatures; /* +0x0002 */ unsigned long cbElements; /* +0x0004 */ unsigned long cLocks; /* +0x0008 */ void *pvData; /* +0x000c */ unsigned char rgsabound[8]; /* +0x0010 04 25 00 00 */ }; struct _KSYSTEM_TIME { unsigned long LowPart; /* +0x0000 */ long High1Time; /* +0x0004 */ long High2Time; /* +0x0008 */ }; struct tagPROPVARIANT { unsigned short vt; /* +0x0000 */ unsigned short wReserved1; /* +0x0002 */ unsigned short wReserved2; /* +0x0004 */ unsigned short wReserved3; /* +0x0006 */ char cVal; /* +0x0008 */ unsigned char bVal; /* +0x0008 */ short iVal; /* +0x0008 */ unsigned short uiVal; /* +0x0008 */ long lVal; /* +0x0008 */ unsigned long ulVal; /* +0x0008 */ /* unsigned char intVal[0]; +0x0008 74 00 00 00 */ /* unsigned char uintVal[0]; +0x0008 75 00 00 00 */ /* unsigned char hVal[0]; +0x0008 3d 13 00 00 */ /* unsigned char uhVal[0]; +0x0008 fd 22 00 00 */ /* unsigned char fltVal[0]; +0x0008 40 00 00 00 */ /* unsigned char dblVal[0]; +0x0008 41 00 00 00 */ short boolVal; /* +0x0008 */ long scode; /* +0x0008 */ /* unsigned char cyVal[0]; +0x0008 64 3d 00 00 */ /* unsigned char date[0]; +0x0008 41 00 00 00 */ /* unsigned char filetime[0]; +0x0008 31 13 00 00 */ /* unsigned char puuid[0]; +0x0008 44 16 00 00 */ /* unsigned char pclipdata[0]; +0x0008 b7 58 00 00 */ /* unsigned char bstrVal[0]; +0x0008 71 04 00 00 */ /* unsigned char bstrblobVal[0]; +0x0008 b7 35 00 00 */ /* unsigned char blob[0]; +0x0008 23 32 00 00 */ char *pszVal; /* +0x0008 */ /* unsigned char pwszVal[0]; +0x0008 71 04 00 00 */ /* unsigned char punkVal[0]; +0x0008 7f 17 00 00 */ /* unsigned char pdispVal[0]; +0x0008 7f 31 00 00 */ /* unsigned char pStream[0]; +0x0008 dc 26 00 00 */ /* unsigned char pStorage[0]; +0x0008 fc 15 00 00 */ /* unsigned char pVersionedStream[0]; +0x0008 b9 58 00 00 */ /* unsigned char parray[0]; +0x0008 7b 57 00 00 */ /* unsigned char cac[0]; +0x0008 ba 58 00 00 */ /* unsigned char caub[0]; +0x0008 bb 58 00 00 */ /* unsigned char cai[0]; +0x0008 bc 58 00 00 */ /* unsigned char caui[0]; +0x0008 bd 58 00 00 */ /* unsigned char cal[0]; +0x0008 be 58 00 00 */ /* unsigned char caul[0]; +0x0008 bf 58 00 00 */ /* unsigned char cah[0]; +0x0008 c0 58 00 00 */ /* unsigned char cauh[0]; +0x0008 c1 58 00 00 */ /* unsigned char caflt[0]; +0x0008 c2 58 00 00 */ /* unsigned char cadbl[0]; +0x0008 c3 58 00 00 */ /* unsigned char cabool[0]; +0x0008 c4 58 00 00 */ /* unsigned char cascode[0]; +0x0008 c5 58 00 00 */ /* unsigned char cacy[0]; +0x0008 c6 58 00 00 */ /* unsigned char cadate[0]; +0x0008 c7 58 00 00 */ /* unsigned char cafiletime[0]; +0x0008 c8 58 00 00 */ /* unsigned char cauuid[0]; +0x0008 c9 58 00 00 */ /* unsigned char caclipdata[0]; +0x0008 ca 58 00 00 */ /* unsigned char cabstr[0]; +0x0008 cb 58 00 00 */ /* unsigned char cabstrblob[0]; +0x0008 cc 58 00 00 */ /* unsigned char calpstr[0]; +0x0008 cd 58 00 00 */ /* unsigned char calpwstr[0]; +0x0008 ce 58 00 00 */ /* unsigned char capropvar[0]; +0x0008 cf 58 00 00 */ char *pcVal; /* +0x0008 */ unsigned char *pbVal; /* +0x0008 */ short *piVal; /* +0x0008 */ unsigned short *puiVal; /* +0x0008 */ long *plVal; /* +0x0008 */ unsigned long *pulVal; /* +0x0008 */ /* unsigned char pintVal[0]; +0x0008 74 04 00 00 */ /* unsigned char puintVal[0]; +0x0008 75 04 00 00 */ /* unsigned char pfltVal[0]; +0x0008 40 04 00 00 */ /* unsigned char pdblVal[0]; +0x0008 41 04 00 00 */ short *pboolVal; /* +0x0008 */ /* unsigned char pdecVal[0]; +0x0008 d3 1e 00 00 */ long *pscode; /* +0x0008 */ /* unsigned char pcyVal[0]; +0x0008 65 3d 00 00 */ /* unsigned char pdate[0]; +0x0008 41 04 00 00 */ /* unsigned char pbstrVal[0]; +0x0008 d0 13 00 00 */ /* unsigned char ppunkVal[0]; +0x0008 13 22 00 00 */ /* unsigned char ppdispVal[0]; +0x0008 80 31 00 00 */ /* unsigned char pparray[0]; +0x0008 7c 57 00 00 */ /* unsigned char pvarVal[-8]; +0x0008 7d 1c 00 00 */ unsigned char decVal[16]; /* +0x0000 d2 1e 00 00 */ }; struct _LIST_ENTRY { unsigned char Flink[4]; /* +0x0000 5d 2d 00 00 */ unsigned char Blink[4]; /* +0x0004 5d 2d 00 00 */ }; struct _GDI_TEB_BATCH { unsigned long Offset; /* +0x0000 */ unsigned long HDC; /* +0x0004 */ unsigned char Buffer[1240]; /* +0x0008 d6 58 00 00 */ }; struct tagCAPROPVARIANT { unsigned long cElems; /* +0x0000 */ unsigned char pElems[4]; /* +0x0004 7d 1c 00 00 */ }; struct tagCLIPDATA { unsigned long cbSize; /* +0x0000 */ long ulClipFmt; /* +0x0004 */ unsigned char *pClipData; /* +0x0008 */ }; struct _RTL_DRIVE_LETTER_CURDIR { unsigned short Flags; /* +0x0000 */ unsigned short Length; /* +0x0002 */ unsigned long TimeStamp; /* +0x0004 */ unsigned char DosPath[8]; /* +0x0008 d4 17 00 00 */ }; struct tagCAC { unsigned long cElems; /* +0x0000 */ char *pElems; /* +0x0004 */ }; struct tagTYPEATTR { unsigned char guid[16]; /* +0x0000 dc 14 00 00 */ unsigned long lcid; /* +0x0010 */ unsigned long dwReserved; /* +0x0014 */ long memidConstructor; /* +0x0018 */ long memidDestructor; /* +0x001c */ unsigned char lpstrSchema[4]; /* +0x0020 71 04 00 00 */ unsigned long cbSizeInstance; /* +0x0024 */ unsigned char typekind[4]; /* +0x0028 5a 35 00 00 */ unsigned short cFuncs; /* +0x002c */ unsigned short cVars; /* +0x002e */ unsigned short cImplTypes; /* +0x0030 */ unsigned short cbSizeVft; /* +0x0032 */ unsigned short cbAlignment; /* +0x0034 */ unsigned short wTypeFlags; /* +0x0036 */ unsigned short wMajorVerNum; /* +0x0038 */ unsigned short wMinorVerNum; /* +0x003a */ unsigned char tdescAlias[8]; /* +0x003c cf 40 00 00 */ unsigned char idldescType[8]; /* +0x0044 d5 40 00 00 */ }; struct tagSOleTlsData { void *pvThreadBase; /* +0x0000 */ unsigned char pSmAllocator[4]; /* +0x0004 f7 58 00 00 */ unsigned long dwApartmentID; /* +0x0008 */ unsigned long dwFlags; /* +0x000c */ long TlsMapIndex; /* +0x0010 */ unsigned char ppTlsSlot[4]; /* +0x0014 4f 13 00 00 */ unsigned long cComInits; /* +0x0018 */ unsigned long cOleInits; /* +0x001c */ unsigned long cCalls; /* +0x0020 */ unsigned char pCallInfo[4]; /* +0x0024 fc 53 00 00 */ unsigned char pFreeAsyncCall[4]; /* +0x0028 fe 53 00 00 */ unsigned char pFreeClientCall[4]; /* +0x002c 00 54 00 00 */ unsigned char pObjServer[4]; /* +0x0030 02 54 00 00 */ unsigned long dwTIDCaller; /* +0x0034 */ unsigned char pCurrentCtx[4]; /* +0x0038 04 54 00 00 */ unsigned char pEmptyCtx[4]; /* +0x003c 04 54 00 00 */ unsigned long long ContextId; /* +0x0040 */ unsigned char pNativeApt[4]; /* +0x0048 06 54 00 00 */ unsigned char pCallContext[4]; /* +0x004c 7f 17 00 00 */ unsigned char pCtxCall[4]; /* +0x0050 08 54 00 00 */ unsigned char pPS[4]; /* +0x0054 0a 54 00 00 */ void *pvPendingCallsFront; /* +0x0058 */ void *pvPendingCallsBack; /* +0x005c */ unsigned char pCallCtrl[4]; /* +0x0060 0c 54 00 00 */ unsigned char pTopSCS[4]; /* +0x0064 0e 54 00 00 */ unsigned char pMsgFilter[4]; /* +0x0068 be 30 00 00 */ unsigned char hwndSTA[4]; /* +0x006c f1 12 00 00 */ long cORPCNestingLevel; /* +0x0070 */ unsigned long cDebugData; /* +0x0074 */ unsigned char LogicalThreadId[16]; /* +0x0078 dc 14 00 00 */ void *hThread; /* +0x0088 */ void *hRevert; /* +0x008c */ unsigned char pAsyncRelease[4]; /* +0x0090 7f 17 00 00 */ unsigned char hwndDdeServer[4]; /* +0x0094 f1 12 00 00 */ unsigned char hwndDdeClient[4]; /* +0x0098 f1 12 00 00 */ unsigned long cServeDdeObjects; /* +0x009c */ void *pSTALSvrsFront; /* +0x00a0 */ unsigned char hwndClip[4]; /* +0x00a4 f1 12 00 00 */ unsigned char pDataObjClip[4]; /* +0x00a8 c5 14 00 00 */ unsigned long dwClipSeqNum; /* +0x00ac */ unsigned long fIsClipWrapper; /* +0x00b0 */ unsigned char punkState[4]; /* +0x00b4 7f 17 00 00 */ unsigned long cCallCancellation; /* +0x00b8 */ unsigned long cAsyncSends; /* +0x00bc */ unsigned char pAsyncCallList[4]; /* +0x00c0 fe 53 00 00 */ unsigned char pSurrogateList[4]; /* +0x00c4 f9 58 00 00 */ void *pRWLockTlsEntry; /* +0x00c8 */ unsigned char CallEntry[8]; /* +0x00cc fa 58 00 00 */ unsigned char pContextStack[4]; /* +0x00d4 fc 58 00 00 */ unsigned char pFirstSpyReg[4]; /* +0x00d8 fe 58 00 00 */ unsigned char pFirstFreeSpyReg[4]; /* +0x00dc fe 58 00 00 */ unsigned char pVerifierData[4]; /* +0x00e0 00 59 00 00 */ unsigned long dwMaxSpy; /* +0x00e4 */ unsigned char cCustomMarshallerRecursion; /* +0x00e8 */ void *pDragCursors; /* +0x00ec */ unsigned char punkError[4]; /* +0x00f0 7f 17 00 00 */ unsigned long cbErrorData; /* +0x00f4 */ unsigned char outgoingCallData[8]; /* +0x00f8 01 59 00 00 */ unsigned char incomingCallData[4]; /* +0x0100 02 59 00 00 */ unsigned char outgoingActivationData[16]; /* +0x0104 03 59 00 00 */ unsigned long cReentrancyFromUserAPC; /* +0x0114 */ unsigned char pASTAWaitContext[4]; /* +0x0118 05 59 00 00 */ unsigned char dwCrossThreadFlags[4]; /* +0x011c bb 17 00 00 */ }; struct _KEY_VALUE_BASIC_INFORMATION { unsigned long TitleIndex; /* +0x0000 */ unsigned long Type; /* +0x0004 */ unsigned long NameLength; /* +0x0008 */ unsigned char Name[4]; /* +0x000c f7 13 00 00 */ }; struct tagBLOB { unsigned long cbSize; /* +0x0000 */ unsigned char *pBlobData; /* +0x0004 */ }; struct _KUSER_SHARED_DATA { unsigned long TickCountLowDeprecated; /* +0x0000 */ unsigned long TickCountMultiplier; /* +0x0004 */ unsigned char InterruptTime[12]; /* +0x0008 0e 59 00 00 */ unsigned char SystemTime[12]; /* +0x0014 0e 59 00 00 */ unsigned char TimeZoneBias[12]; /* +0x0020 0e 59 00 00 */ unsigned short ImageNumberLow; /* +0x002c */ unsigned short ImageNumberHigh; /* +0x002e */ unsigned char NtSystemRoot[520]; /* +0x0030 e4 15 00 00 */ unsigned long MaxStackTraceDepth; /* +0x0238 */ unsigned long CryptoExponent; /* +0x023c */ unsigned long TimeZoneId; /* +0x0240 */ unsigned long LargePageMinimum; /* +0x0244 */ unsigned long AitSamplingValue; /* +0x0248 */ unsigned long AppCompatFlag; /* +0x024c */ unsigned long long RNGSeedVersion; /* +0x0250 */ unsigned long GlobalValidationRunlevel; /* +0x0258 */ unsigned char Reserved2[8]; /* +0x025c 69 15 00 00 */ unsigned char NtProductType[4]; /* +0x0264 30 51 00 00 */ unsigned char ProductTypeIsValid; /* +0x0268 */ unsigned char Reserved0[1]; /* +0x0269 f9 12 00 00 */ unsigned short NativeProcessorArchitecture; /* +0x026a */ unsigned long NtMajorVersion; /* +0x026c */ unsigned long NtMinorVersion; /* +0x0270 */ unsigned char ProcessorFeatures[64]; /* +0x0274 13 13 00 00 */ unsigned long Reserved1; /* +0x02b4 */ unsigned long Reserved3; /* +0x02b8 */ unsigned char TimeSlip[4]; /* +0x02bc bb 17 00 00 */ unsigned char AlternativeArchitecture[4]; /* +0x02c0 0f 59 00 00 */ unsigned char AltArchitecturePad[4]; /* +0x02c4 f6 12 00 00 */ unsigned char SystemExpirationDate[8]; /* +0x02c8 3d 13 00 00 */ unsigned long SuiteMask; /* +0x02d0 */ unsigned char KdDebuggerEnabled; /* +0x02d4 */ unsigned char MitigationPolicies; /* +0x02d5 */ /* unsigned char NXSupportPolicy[0]; +0x02d5 c4 1e 00 00 */ /* unsigned char SEHValidationPolicy[0]; +0x02d5 c5 1e 00 00 */ /* unsigned char CurDirDevicesSkippedForDlls[0]; +0x02d5 c6 1e 00 00 */ unsigned char Reserved[1]; /* +0x02d5 c7 1e 00 00 */ unsigned char Reserved6[2]; /* +0x02d6 a7 17 00 00 */ unsigned char ActiveConsoleId[4]; /* +0x02d8 bb 17 00 00 */ unsigned char DismountCount[4]; /* +0x02dc bb 17 00 00 */ unsigned long ComPlusPackage; /* +0x02e0 */ unsigned long LastSystemRITEventTickCount; /* +0x02e4 */ unsigned long NumberOfPhysicalPages; /* +0x02e8 */ unsigned char SafeBootMode; /* +0x02ec */ unsigned char Reserved12[3]; /* +0x02ed 8d 13 00 00 */ unsigned long SharedDataFlags; /* +0x02f0 */ /* unsigned char DbgErrorPortPresent[0]; +0x02f0 17 13 00 00 */ /* unsigned char DbgElevationEnabled[0]; +0x02f0 7e 18 00 00 */ /* unsigned char DbgVirtEnabled[0]; +0x02f0 7f 18 00 00 */ /* unsigned char DbgInstallerDetectEnabled[0]; +0x02f0 27 1e 00 00 */ /* unsigned char DbgLkgEnabled[0]; +0x02f0 42 1e 00 00 */ /* unsigned char DbgDynProcessorEnabled[0]; +0x02f0 ce 23 00 00 */ /* unsigned char DbgConsoleBrokerEnabled[0]; +0x02f0 ff 1e 00 00 */ unsigned char SpareBits[4]; /* +0x02f0 7d 23 00 00 */ unsigned char DataFlagsPad[4]; /* +0x02f4 f6 12 00 00 */ unsigned long long TestRetInstruction; /* +0x02f8 */ unsigned long Reserved9; /* +0x0300 */ unsigned long Reserved10; /* +0x0304 */ unsigned char SystemCallPad[24]; /* +0x0308 10 59 00 00 */ /* unsigned char TickCount[0]; +0x0320 0e 59 00 00 */ /* unsigned char TickCountQuad[0]; +0x0320 c4 17 00 00 */ unsigned char ReservedTickCountOverlay[12]; /* +0x0320 22 13 00 00 */ unsigned char TickCountPad[4]; /* +0x032c f6 12 00 00 */ unsigned long Cookie; /* +0x0330 */ unsigned char CookiePad[4]; /* +0x0334 f6 12 00 00 */ long long ConsoleSessionForegroundProcessId; /* +0x0338 */ unsigned char TimeUpdateSequence[8]; /* +0x0340 c4 17 00 00 */ unsigned long long LastTimeUpdateQpcValue; /* +0x0348 */ unsigned long long LastInterruptTimeUpdateQpcValue; /* +0x0350 */ unsigned long long QpcTimeIncrement; /* +0x0358 */ unsigned long QpcTimeIncrement32; /* +0x0360 */ unsigned char Reserved8[28]; /* +0x0364 11 59 00 00 */ unsigned char UserModeGlobalLogger[32]; /* +0x0380 ab 56 00 00 */ unsigned long ImageFileExecutionOptions; /* +0x03a0 */ unsigned long LangGenerationCount; /* +0x03a4 */ unsigned char InterruptTimeBias[8]; /* +0x03a8 c4 17 00 00 */ unsigned char TscQpcBias[8]; /* +0x03b0 c4 17 00 00 */ unsigned char ActiveProcessorCount[4]; /* +0x03b8 bb 17 00 00 */ unsigned char ActiveGroupCount[1]; /* +0x03bc 12 59 00 00 */ unsigned char QpcTimeIncrementShift; /* +0x03bd */ unsigned short TscQpcData; /* +0x03be */ unsigned char TscQpcEnabled[1]; /* +0x03be 12 59 00 00 */ unsigned char TscQpcShift; /* +0x03bf */ unsigned char XState[528]; /* +0x03c0 35 31 00 00 */ }; struct _ULARGE_INTEGER { unsigned long LowPart; /* +0x0000 */ unsigned long HighPart; /* +0x0004 */ }; struct _ULARGE_INTEGER::<unnamed-type-u> { unsigned long LowPart; /* +0x0000 */ unsigned long HighPart; /* +0x0004 */ }; struct CMapKeyToValue::CAssoc { unsigned char pNext[4]; /* +0x0000 54 59 00 00 */ unsigned char nHashValue[4]; /* +0x0004 75 00 00 00 */ unsigned char key[8]; /* +0x0008 51 59 00 00 */ }; struct CMapKeyToValue::CKeyWrap { /* unsigned char rgbKey[0]; +0x0000 7f 19 00 00 */ void *pKey; /* +0x0000 */ unsigned char cbKey[4]; /* +0x0004 75 00 00 00 */ }; struct tagLC_ID { unsigned short wLanguage; /* +0x0000 */ unsigned short wCountry; /* +0x0002 */ unsigned short wCodePage; /* +0x0004 */ }; struct tagCAI { unsigned long cElems; /* +0x0000 */ short *pElems; /* +0x0004 */ }; struct _RTL_USER_PROCESS_PARAMETERS { unsigned long MaximumLength; /* +0x0000 */ unsigned long Length; /* +0x0004 */ unsigned long Flags; /* +0x0008 */ unsigned long DebugFlags; /* +0x000c */ void *ConsoleHandle; /* +0x0010 */ unsigned long ConsoleFlags; /* +0x0014 */ void *StandardInput; /* +0x0018 */ void *StandardOutput; /* +0x001c */ void *StandardError; /* +0x0020 */ unsigned char CurrentDirectory[12]; /* +0x0024 24 4c 00 00 */ unsigned char DllPath[8]; /* +0x0030 dd 12 00 00 */ unsigned char ImagePathName[8]; /* +0x0038 dd 12 00 00 */ unsigned char CommandLine[8]; /* +0x0040 dd 12 00 00 */ void *Environment; /* +0x0048 */ unsigned long StartingX; /* +0x004c */ unsigned long StartingY; /* +0x0050 */ unsigned long CountX; /* +0x0054 */ unsigned long CountY; /* +0x0058 */ unsigned long CountCharsX; /* +0x005c */ unsigned long CountCharsY; /* +0x0060 */ unsigned long FillAttribute; /* +0x0064 */ unsigned long WindowFlags; /* +0x0068 */ unsigned long ShowWindowFlags; /* +0x006c */ unsigned char WindowTitle[8]; /* +0x0070 dd 12 00 00 */ unsigned char DesktopInfo[8]; /* +0x0078 dd 12 00 00 */ unsigned char ShellInfo[8]; /* +0x0080 dd 12 00 00 */ unsigned char RuntimeData[8]; /* +0x0088 dd 12 00 00 */ unsigned char CurrentDirectores[512]; /* +0x0090 88 59 00 00 */ unsigned char EnvironmentSize[4]; /* +0x0290 bb 17 00 00 */ unsigned char EnvironmentVersion[4]; /* +0x0294 bb 17 00 00 */ unsigned char PackageMoniker[8]; /* +0x0298 dd 12 00 00 */ void *PackageDependencyData; /* +0x02a0 */ unsigned long ProcessGroupId; /* +0x02a4 */ }; struct _TP_TASK_CALLBACKS { unsigned char ExecuteCallback[4]; /* +0x0000 8d 59 00 00 */ unsigned char Unposted[4]; /* +0x0004 75 58 00 00 */ }; struct _RTL_CRITICAL_SECTION { unsigned char DebugInfo[4]; /* +0x0000 6a 22 00 00 */ long LockCount; /* +0x0004 */ long RecursionCount; /* +0x0008 */ void *OwningThread; /* +0x000c */ void *LockSemaphore; /* +0x0010 */ unsigned long SpinCount; /* +0x0014 */ }; struct CBool { unsigned char value[4]; /* +0x0000 74 00 00 00 */ }; struct _XSTATE_CONFIGURATION { unsigned long long EnabledFeatures; /* +0x0000 */ unsigned long Size; /* +0x0008 */ unsigned char OptimizedSave[4]; /* +0x000c 17 13 00 00 */ unsigned char Features[512]; /* +0x0010 6b 5a 00 00 */ }; struct threadlocaleinfostruct::<unnamed-type-lc_category> { char *locale; /* +0x0000 */ unsigned char wlocale[4]; /* +0x0004 71 04 00 00 */ unsigned char refcount[4]; /* +0x0008 74 04 00 00 */ unsigned char wrefcount[4]; /* +0x000c 74 04 00 00 */ }; struct tagInitializeSpyNode { unsigned char pNext[4]; /* +0x0000 fe 58 00 00 */ unsigned char pPrev[4]; /* +0x0004 fe 58 00 00 */ unsigned long dwRefs; /* +0x0008 */ unsigned long dwCookie; /* +0x000c */ unsigned char pInitSpy[4]; /* +0x0010 05 4a 00 00 */ }; struct tagCAL { unsigned long cElems; /* +0x0000 */ long *pElems; /* +0x0004 */ }; struct tagCAUH { unsigned long cElems; /* +0x0000 */ unsigned char pElems[4]; /* +0x0004 ab 46 00 00 */ }; struct _ldiv_t { long quot; /* +0x0000 */ long rem; /* +0x0004 */ }; struct _iobuf { char *_ptr; /* +0x0000 */ unsigned char _cnt[4]; /* +0x0004 74 00 00 00 */ char *_base; /* +0x0008 */ unsigned char _flag[4]; /* +0x000c 74 00 00 00 */ unsigned char _file[4]; /* +0x0010 74 00 00 00 */ unsigned char _charbuf[4]; /* +0x0014 74 00 00 00 */ unsigned char _bufsiz[4]; /* +0x0018 74 00 00 00 */ char *_tmpfname; /* +0x001c */ }; struct tagCallEntry { void *pNext; /* +0x0000 */ void *pvObject; /* +0x0004 */ }; struct _CURDIR { unsigned char DosPath[8]; /* +0x0000 dd 12 00 00 */ void *Handle; /* +0x0008 */ }; struct tagContextStackNode { unsigned char pNext[4]; /* +0x0000 fc 58 00 00 */ unsigned char pSavedContext[4]; /* +0x0004 04 54 00 00 */ unsigned char pServerContext[4]; /* +0x0008 04 54 00 00 */ unsigned char pClientCall[4]; /* +0x000c 08 54 00 00 */ unsigned char pServerCall[4]; /* +0x0010 08 54 00 00 */ unsigned char pPS[4]; /* +0x0014 0a 54 00 00 */ }; struct _NT_TIB { unsigned char ExceptionList[4]; /* +0x0000 56 13 00 00 */ void *StackBase; /* +0x0004 */ void *StackLimit; /* +0x0008 */ void *SubSystemTib; /* +0x000c */ void *FiberData; /* +0x0010 */ unsigned long Version; /* +0x0010 */ void *ArbitraryUserPointer; /* +0x0014 */ unsigned char Self[4]; /* +0x0018 3f 27 00 00 */ }; struct tagCAFLT { unsigned long cElems; /* +0x0000 */ unsigned char pElems[4]; /* +0x0004 40 04 00 00 */ }; struct tagCALPSTR { unsigned long cElems; /* +0x0000 */ unsigned char pElems[4]; /* +0x0004 c6 23 00 00 */ }; struct tagFORMATETC { unsigned short cfFormat; /* +0x0000 */ unsigned char ptd[4]; /* +0x0004 3c 35 00 00 */ unsigned long dwAspect; /* +0x0008 */ long lindex; /* +0x000c */ unsigned long tymed; /* +0x0010 */ }; struct _TEB_ACTIVE_FRAME_CONTEXT { unsigned long Flags; /* +0x0000 */ unsigned char FrameName[4]; /* +0x0004 62 14 00 00 */ }; struct _TP_CALLBACK_ENVIRON_V3::<unnamed-type-u> { unsigned long Flags; /* +0x0000 */ }; struct _TP_CALLBACK_ENVIRON_V3::<unnamed-type-u>::<unnamed-type-s> { /* unsigned char LongFunction[0]; +0x0000 17 13 00 00 */ /* unsigned char Persistent[0]; +0x0000 7e 18 00 00 */ unsigned char Private[4]; /* +0x0000 b3 19 00 00 */ }; struct LockCookie { unsigned long dwFlags; /* +0x0000 */ unsigned long dwWriterSeqNum; /* +0x0004 */ unsigned short wReaderLevel; /* +0x0008 */ unsigned short wWriterLevel; /* +0x000a */ unsigned long dwThreadID; /* +0x000c */ }; struct tagCABSTRBLOB { unsigned long cElems; /* +0x0000 */ unsigned char pElems[4]; /* +0x0004 b8 35 00 00 */ }; struct tagCACLIPDATA { unsigned long cElems; /* +0x0000 */ unsigned char pElems[4]; /* +0x0004 b7 58 00 00 */ }; struct CHwnd { unsigned char m_hwnd[4]; /* +0x0000 f1 12 00 00 */ }; struct LIST_ENTRY64 { unsigned long long Flink; /* +0x0000 */ unsigned long long Blink; /* +0x0008 */ }; enum ACTIVATION_PROPERTIES::eFlags { fFOR_SCM = 1, fSURROGATE = 4, fDO_NOT_LOAD = 8, fRELOAD_DARWIN = 16, fLSVR_ONLY = 32 }; struct CRWLock::LockState { /* unsigned char _numReaders[0]; +0x0000 2c 5c 00 00 */ /* unsigned char _writerPresent[0]; +0x0000 2d 5c 00 00 */ /* unsigned char _writerSignaled[0]; +0x0000 2e 5c 00 00 */ /* unsigned char _readerSignaled[0]; +0x0000 2f 5c 00 00 */ /* unsigned char _resetInProgress[0]; +0x0000 30 5c 00 00 */ /* unsigned char _waitingReaders[0]; +0x0000 31 5c 00 00 */ unsigned char _waitingWriters[4]; /* +0x0000 32 5c 00 00 */ }; struct CRWLock::EventState { /* unsigned char _entryIsEventMask[0]; +0x0000 bc 17 00 00 */ /* unsigned char _entryIsMarkedForPooling[0]; +0x0000 bd 17 00 00 */ /* unsigned char _entryIsBeingPooled[0]; +0x0000 be 17 00 00 */ /* unsigned char _readerEventBeingSignaled[0]; +0x0000 bf 17 00 00 */ /* unsigned char _readerEventBeingReset[0]; +0x0000 c0 17 00 00 */ /* unsigned char _readerCountIsSignalCount[0]; +0x0000 c1 17 00 00 */ /* unsigned char _readerCount[0]; +0x0000 35 5c 00 00 */ unsigned char _writerEventSignaled[4]; /* +0x0000 e8 20 00 00 */ }; enum _WPP_FLAG_LEN_ENUM { WPP_FLAG_LEN = 1 }; enum WPP_DEFINE_BIT_NAMES { WPP_BLOCK_START_OLE32 = 0, WPP_BIT_ERRORS = 1, WPP_BIT_WARNING = 2, WPP_BIT_INFO = 3, WPP_BIT_VERBOSE = 4, WPP_BIT_CHATTY = 5, WPP_BIT_GARRULOUS = 6, WPP_BIT_LOQUACIOUS = 7, WPP_BLOCK_END_OLE32 = 8 }; enum WPP_CTL_NAMES { WPP_CTL_OLE32 = 0, WPP_LAST_CTL = 1 }; enum tagORFLAG { ORF_CONNECTED = 1, ORF_STRINGSREGISTERED = 2, ORF_INBULKUPDATECALL = 4 }; enum __MIDL_IActivatorCustomMarshal_0001 { SPD_FLAG_USE_CONSOLE_SESSION = 1, SPD_FLAG_USE_DEFAULT_AUTHN_LVL = 2, SPD_FLAG_USE_SERVER_PID = 4, SPD_FLAG_USE_LUA_LEVEL_ADMIN = 8, SPD_FLAG_COAUTH_USER_IS_NULL = 16, SPD_FLAG_COAUTH_DOMAIN_IS_NULL = 32, SPD_FLAG_COAUTH_PWD_IS_NULL = 64, SPD_FLAG_USE_LUA_LEVEL_HIGHEST = 128 }; enum _RUNLEVEL { RUNLEVEL_LUA = 0, RUNLEVEL_HIGHEST = 1, RUNLEVEL_ADMIN = 2, RUNLEVEL_MAX_NON_UIA = 3, RUNLEVEL_LUA_UIA = 16, RUNLEVEL_HIGHEST_UIA = 17, RUNLEVEL_ADMIN_UIA = 18, RUNLEVEL_MAX = 19 }; enum __MIDL___MIDL_itf_immact_0000_0002_0002 { INVALID_LUA_RUNLEVEL = -1 }; enum BlockingReason { NotBlocking = 0, LifetimeLoop = 1, OutgoingCall = 2, CoWait = 3, ProcessEvents = 4 }; enum Serializer::<unnamed-tag> { DIRECTION_READ = 1, DIRECTION_WRITE = 2 }; enum tagOXIDFLAGS { OXIDF_REGISTERED = 1, OXIDF_MACHINE_LOCAL = 2, OXIDF_STOPPED = 4, OXIDF_PENDINGRELEASE = 8, OXIDF_REGISTERINGOIDS = 32, OXIDF_MTASERVER = 64, OXIDF_NTASERVER = 128, OXIDF_STASERVER = 256, OXIDF_REMOTEINITIALIZED = 512, OXIDF_APPCONTAINER = 1024, OXIDF_APPLICATION_STA = 2048, OXIDF_MTASTOPPED = 68, OXIDF_NTASTOPPED = 132, OXIDF_APARTMENT_TYPE_FLAGS = 2496 }; struct tagREMQIRESULT { unsigned char hResult[8]; /* +0x0000 08 00 00 00 */ unsigned char std[40]; /* +0x0008 10 49 00 00 */ }; struct tagREMINTERFACEREF { unsigned char ipid[16]; /* +0x0000 dc 14 00 00 */ unsigned long cPublicRefs; /* +0x0010 */ unsigned long cPrivateRefs; /* +0x0014 */ }; struct tagXAptCallback { long long pfnCallback; /* +0x0000 */ long long pParam; /* +0x0008 */ long long pServerCtx; /* +0x0010 */ long long pUnk; /* +0x0018 */ unsigned char iid[16]; /* +0x0020 dc 14 00 00 */ unsigned char iMethod[4]; /* +0x0030 74 00 00 00 */ unsigned char guidProcessSecret[20]; /* +0x0034 dc 14 00 00 */ }; struct _SCMREGKEY { unsigned long long dwEntryLoc; /* +0x0000 */ unsigned long dwHash; /* +0x0008 */ unsigned long dwScmId; /* +0x000c */ }; struct _MnkEqBuf { unsigned long cdwSize; /* +0x0000 */ unsigned char abEqData[4]; /* +0x0004 f9 12 00 00 */ }; struct _MkInterfaceList { unsigned long dwSize; /* +0x0000 */ unsigned char apIFDList[4]; /* +0x0004 7f 5c 00 00 */ }; struct tagIPIDEntry { unsigned char pNextIPID[4]; /* +0x0000 83 5c 00 00 */ unsigned long dwFlags; /* +0x0004 */ unsigned long cStrongRefs; /* +0x0008 */ unsigned long cWeakRefs; /* +0x000c */ unsigned long cPrivateRefs; /* +0x0010 */ void *pv; /* +0x0014 */ unsigned char pStub[4]; /* +0x0018 7f 17 00 00 */ unsigned char pOXIDEntry[4]; /* +0x001c 85 5c 00 00 */ unsigned char ipid[16]; /* +0x0020 dc 14 00 00 */ unsigned char iid[16]; /* +0x0030 dc 14 00 00 */ unsigned char pChnl[4]; /* +0x0040 87 5c 00 00 */ unsigned char pIRCEntry[4]; /* +0x0044 89 5c 00 00 */ unsigned char pOIDFLink[4]; /* +0x0048 83 5c 00 00 */ unsigned char pOIDBLink[4]; /* +0x004c 83 5c 00 00 */ }; struct tagPageEntry { unsigned char pNext[4]; /* +0x0000 8d 5c 00 00 */ unsigned long dwFlag; /* +0x0004 */ }; struct __MIDL_ILocalObjectExporter_0002 { unsigned long long mid; /* +0x0000 */ unsigned long long oxid; /* +0x0008 */ unsigned long refs; /* +0x0010 */ }; struct __MIDL_ILocalObjectExporter_0003 { unsigned long long mid; /* +0x0000 */ unsigned long long oid; /* +0x0008 */ }; struct __MIDL_ILocalObjectExporter_0004 { unsigned long long mid; /* +0x0000 */ unsigned long long oxid; /* +0x0008 */ unsigned long long oid; /* +0x0010 */ }; struct SHashChain { unsigned char pNext[4]; /* +0x0000 ad 5c 00 00 */ unsigned char pPrev[4]; /* +0x0004 ad 5c 00 00 */ }; struct SDWORDHashNode { unsigned char chain[8]; /* +0x0000 ac 5c 00 00 */ unsigned long key; /* +0x0008 */ }; struct SPointerHashNode { unsigned char chain[8]; /* +0x0000 ac 5c 00 00 */ void *key; /* +0x0008 */ }; struct SUUIDHashNode { unsigned char chain[8]; /* +0x0000 ac 5c 00 00 */ unsigned char key[16]; /* +0x0008 dc 14 00 00 */ }; struct SMultiGUIDKey { unsigned char cGUID[4]; /* +0x0000 74 00 00 00 */ unsigned char aGUID[4]; /* +0x0004 44 16 00 00 */ }; struct SMultiGUIDHashNode { unsigned char chain[8]; /* +0x0000 ac 5c 00 00 */ unsigned char key[8]; /* +0x0008 2e 5d 00 00 */ }; struct SStringHashNode { unsigned char chain[8]; /* +0x0000 ac 5c 00 00 */ unsigned long dwHash; /* +0x0008 */ unsigned char psaKey[4]; /* +0x000c 65 1f 00 00 */ }; struct SExtHashNode { unsigned char chain[8]; /* +0x0000 ac 5c 00 00 */ unsigned char pwszExt[4]; /* +0x0008 c0 13 00 00 */ }; struct SActivatableClassIdHashNode { unsigned char chain[8]; /* +0x0000 ac 5c 00 00 */ unsigned char activatableClassId[4]; /* +0x0008 c0 13 00 00 */ }; struct MIPID { unsigned long long mid; /* +0x0000 */ unsigned char ipid[16]; /* +0x0008 dc 14 00 00 */ unsigned long dwApt; /* +0x0018 */ }; struct SMIPIDHashNode { unsigned char chain[8]; /* +0x0000 ac 5c 00 00 */ unsigned char mipid[32]; /* +0x0008 a9 5c 00 00 */ }; enum tagFOCOXID { FOCOXID_REF = 1, FOCOXID_NOREF = 2 }; struct _RegOutput { unsigned long dwSize; /* +0x0000 */ unsigned char RegKeys[4]; /* +0x0004 f6 12 00 00 */ }; struct _RegInputEntry { unsigned char clsid[16]; /* +0x0000 dc 14 00 00 */ unsigned long long oxid; /* +0x0010 */ unsigned char ipid[16]; /* +0x0018 dc 14 00 00 */ unsigned long dwFlags; /* +0x0028 */ }; struct _RegInput { unsigned long dwSize; /* +0x0000 */ unsigned char rginent[48]; /* +0x0008 4d 5e 00 00 */ }; struct _ProcessActivatorToken { unsigned char ProcessGUID[16]; /* +0x0000 dc 14 00 00 */ unsigned char ActivatorIPID[16]; /* +0x0010 dc 14 00 00 */ unsigned long dwFlags; /* +0x0020 */ }; struct tagInstantiationInfoData { unsigned char classId[16]; /* +0x0000 dc 14 00 00 */ unsigned long classCtx; /* +0x0010 */ unsigned long actvflags; /* +0x0014 */ unsigned char fIsSurrogate[4]; /* +0x0018 74 00 00 00 */ unsigned long cIID; /* +0x001c */ unsigned long instFlag; /* +0x0020 */ unsigned char pIID[4]; /* +0x0024 44 16 00 00 */ unsigned long thisSize; /* +0x0028 */ unsigned char clientCOMVersion[4]; /* +0x002c 66 1f 00 00 */ }; struct tagLocationInfoData { unsigned char machineName[4]; /* +0x0000 71 04 00 00 */ unsigned long processId; /* +0x0004 */ unsigned long apartmentId; /* +0x0008 */ unsigned long contextId; /* +0x000c */ }; struct tagActivationContextInfoData { unsigned char clientOK[4]; /* +0x0000 74 00 00 00 */ unsigned char bReserved1[4]; /* +0x0004 74 00 00 00 */ unsigned long dwReserved1; /* +0x0008 */ unsigned long dwReserved2; /* +0x000c */ unsigned char pIFDClientCtx[4]; /* +0x0010 17 43 00 00 */ unsigned char pIFDPrototypeCtx[4]; /* +0x0014 17 43 00 00 */ }; struct tagCustomHeader { unsigned long totalSize; /* +0x0000 */ unsigned long headerSize; /* +0x0004 */ unsigned long cOpaqueData; /* +0x0008 */ unsigned long destCtx; /* +0x000c */ unsigned long cIfs; /* +0x0010 */ unsigned char classInfoClsid[16]; /* +0x0014 dc 14 00 00 */ unsigned char pclsid[4]; /* +0x0024 44 16 00 00 */ unsigned long *pSizes; /* +0x0028 */ unsigned char opaqueData[4]; /* +0x002c 5c 5e 00 00 */ }; struct tagPropsOutInfo { unsigned long cIfs; /* +0x0000 */ unsigned char piid[4]; /* +0x0004 44 16 00 00 */ unsigned char phresults[4]; /* +0x0008 08 04 00 00 */ unsigned char ppIntfData[4]; /* +0x000c 1a 43 00 00 */ }; struct tagSecurityInfoData { unsigned long dwAuthnFlags; /* +0x0000 */ unsigned char pServerInfo[4]; /* +0x0004 76 21 00 00 */ unsigned char pAuthIdentityInfo[4]; /* +0x0008 91 31 00 00 */ }; struct tagCustomPrivScmInfo { long Apartment; /* +0x0000 */ unsigned char pwszWinstaDesktop[4]; /* +0x0004 71 04 00 00 */ unsigned long long ProcessSignature; /* +0x0008 */ unsigned char pEnvBlock[4]; /* +0x0010 71 04 00 00 */ unsigned long EnvBlockLength; /* +0x0014 */ }; struct tagScmRequestInfoData { unsigned char pScmInfo[4]; /* +0x0000 67 5e 00 00 */ unsigned char remoteRequest[4]; /* +0x0004 69 5e 00 00 */ }; struct tagScmReplyInfoData { unsigned char pResolverInfo[4]; /* +0x0000 6d 5e 00 00 */ unsigned char remoteReply[4]; /* +0x0004 6f 5e 00 00 */ }; struct tagInstanceInfoData { unsigned char fileName[4]; /* +0x0000 71 04 00 00 */ unsigned long mode; /* +0x0004 */ unsigned char ifdROT[4]; /* +0x0008 17 43 00 00 */ unsigned char ifdStg[4]; /* +0x000c 17 43 00 00 */ }; struct tagSpecialPropertiesData { unsigned long dwSessionId; /* +0x0000 */ unsigned char fRemoteThisSessionId[4]; /* +0x0004 74 00 00 00 */ unsigned char fClientImpersonating[4]; /* +0x0008 74 00 00 00 */ unsigned char fPartitionIDPresent[4]; /* +0x000c 74 00 00 00 */ unsigned long dwDefaultAuthnLvl; /* +0x0010 */ unsigned char guidPartition[16]; /* +0x0014 dc 14 00 00 */ unsigned long dwPRTFlags; /* +0x0024 */ unsigned long dwOrigClsctx; /* +0x0028 */ unsigned long dwFlags; /* +0x002c */ unsigned long dwPid; /* +0x0030 */ unsigned long long hwnd; /* +0x0038 */ unsigned char dwReserved[24]; /* +0x0040 3b 17 00 00 */ }; struct _SSerializationHeader { unsigned long dwSize; /* +0x0000 */ void *pvMarshalPtr; /* +0x0004 */ }; struct tagComCallData { unsigned long dwDispid; /* +0x0000 */ unsigned long dwReserved; /* +0x0004 */ void *pUserDefined; /* +0x0008 */ }; struct tagSPSChain { unsigned char pNext[4]; /* +0x0000 e7 5e 00 00 */ unsigned char pPrev[4]; /* +0x0004 e7 5e 00 00 */ }; struct tagSPSCache { unsigned char clientPSChain[8]; /* +0x0000 e6 5e 00 00 */ unsigned char serverPSChain[8]; /* +0x0008 e6 5e 00 00 */ }; struct Microsoft::WRL::Details::BoolStruct { unsigned char Member[4]; /* +0x0000 74 00 00 00 */ }; enum tagRUNDOWN_RESULT { RUNDWN_UNKNOWN = 1, RUNDWN_KEEP = 2, RUNDWN_RUNDOWN = 4 }; enum tagCallType { CALLTYPE_NONE = 0, CALLTYPE_SYNCCALL = 1, CALLTYPE_SYNCENTER = 2, CALLTYPE_SYNCLEAVE = 3, CALLTYPE_SYNCRETURN = 4, CALLTYPE_BEGINCALL = 5, CALLTYPE_BEGINRETURN = 6, CALLTYPE_BEGINENTER = 7, CALLTYPE_BEGINLEAVE = 8, CALLTYPE_FINISHENTER = 9, CALLTYPE_FINISHLEAVE = 10, CALLTYPE_FINISHCALL = 11, CALLTYPE_FINISHRETURN = 12 }; struct tagPolicyEntry { unsigned char pNext[4]; /* +0x0000 51 62 00 00 */ unsigned char pPrev[4]; /* +0x0004 51 62 00 00 */ unsigned long ctxEvent; /* +0x0008 */ unsigned char pPolicy[4]; /* +0x000c b6 4f 00 00 */ unsigned char policyID[16]; /* +0x0010 dc 14 00 00 */ }; struct tagContexts { unsigned char pClientCtx[4]; /* +0x0000 04 54 00 00 */ unsigned char pServerCtx[4]; /* +0x0004 04 54 00 00 */ }; struct _tagSCtxListIndex { unsigned char idx[4]; /* +0x0000 74 00 00 00 */ unsigned char next[4]; /* +0x0004 74 00 00 00 */ unsigned char prev[4]; /* +0x0008 74 00 00 00 */ }; struct tagCTXVERSION { short ThisVersion; /* +0x0000 */ short MinVersion; /* +0x0002 */ }; struct tagCTXCOMMONHDR { unsigned char ContextId[16]; /* +0x0000 dc 14 00 00 */ unsigned long Flags; /* +0x0010 */ unsigned long Reserved; /* +0x0014 */ unsigned long dwNumExtents; /* +0x0018 */ unsigned long cbExtents; /* +0x001c */ unsigned long MshlFlags; /* +0x0020 */ }; struct tagBYVALHDR { unsigned long Count; /* +0x0000 */ unsigned char Frozen[4]; /* +0x0004 74 00 00 00 */ }; struct tagBYREFHDR { unsigned long Reserved; /* +0x0000 */ unsigned long ProcessId; /* +0x0004 */ }; struct tagCONTEXTHEADER { unsigned char Version[4]; /* +0x0000 0c 63 00 00 */ unsigned char CmnHdr[36]; /* +0x0004 0d 63 00 00 */ /* unsigned char ByValHdr[0]; +0x0028 0e 63 00 00 */ unsigned char ByRefHdr[8]; /* +0x0028 0f 63 00 00 */ }; enum ActivationProperties::<unnamed-type-_marshalState> { NOT_MARSHALLED = 1, SIZED = 2, MARSHALLED = 3, UNMARSHALLED = 4 }; struct CMachineNamesHelper::_UNIQUEADDRS { unsigned long dwcTotalUniqueAddrs; /* +0x0000 */ unsigned long dwStringSpaceNeeded; /* +0x0004 */ unsigned long dwCurrentAddr; /* +0x0008 */ unsigned char pszNextAddrToUse[4]; /* +0x000c 71 04 00 00 */ unsigned char ppszAddrs[4]; /* +0x0010 d0 13 00 00 */ unsigned char cchLeft[4]; /* +0x0014 75 00 00 00 */ }; struct CMachineNamesHelper::_SBTOTAL { unsigned long dwcTotalAddrs; /* +0x0000 */ unsigned char ppszAddresses[4]; /* +0x0004 d0 13 00 00 */ }; struct CFastBH { void *m_hRpc; /* +0x0000 */ void *m_ifHandle; /* +0x0004 */ }; struct _WPP_TRACE_CONTROL_BLOCK { unsigned char Next[8]; /* +0x0000 bd 66 00 00 */ unsigned long long UmRegistrationHandle; /* +0x0008 */ unsigned long long Logger; /* +0x0010 */ /* unsigned char Win2kCb[0]; +0x0010 bb 66 00 00 */ void *Ptr; /* +0x0010 */ unsigned char Cb[8]; /* +0x0010 bd 66 00 00 */ unsigned char FlagsLen; /* +0x0018 */ unsigned char Level; /* +0x0019 */ unsigned short Options; /* +0x001a */ unsigned char Flags[4]; /* +0x001c f6 12 00 00 */ unsigned char ControlGuid[8]; /* +0x0020 4a 16 00 00 */ }; struct WPP_PROJECT_CONTROL_BLOCK { /* unsigned char Control[0]; +0x0000 bc 66 00 00 */ unsigned char ReserveSpace[40]; /* +0x0000 c0 66 00 00 */ }; struct _WPP_WIN2K_CONTROL_BLOCK { unsigned long long Logger; /* +0x0000 */ unsigned long Flags; /* +0x0008 */ unsigned long Level; /* +0x000c */ unsigned char ControlGuid[8]; /* +0x0010 4a 16 00 00 */ }; enum Windows::Foundation::AsyncStatus { Created = 0, Started = 1, Completed = 2, Canceled = 3, Error = 4 }; enum ActivationAction { NormalActivation = 0, BrokeredActivation = 1, DisallowActivation = 2 }; enum Windows::Foundation::PropertyType { PropertyType_Empty = 0, PropertyType_UInt8 = 1, PropertyType_Int16 = 2, PropertyType_UInt16 = 3, PropertyType_Int32 = 4, PropertyType_UInt32 = 5, PropertyType_Int64 = 6, PropertyType_UInt64 = 7, PropertyType_Single = 8, PropertyType_Double = 9, PropertyType_Char16 = 10, PropertyType_Boolean = 11, PropertyType_String = 12, PropertyType_Inspectable = 13, PropertyType_DateTime = 14, PropertyType_TimeSpan = 15, PropertyType_Guid = 16, PropertyType_Point = 17, PropertyType_Size = 18, PropertyType_Rect = 19, PropertyType_OtherType = 20, PropertyType_UInt8Array = 1025, PropertyType_Int16Array = 1026, PropertyType_UInt16Array = 1027, PropertyType_Int32Array = 1028, PropertyType_UInt32Array = 1029, PropertyType_Int64Array = 1030, PropertyType_UInt64Array = 1031, PropertyType_SingleArray = 1032, PropertyType_DoubleArray = 1033, PropertyType_Char16Array = 1034, PropertyType_BooleanArray = 1035, PropertyType_StringArray = 1036, PropertyType_InspectableArray = 1037, PropertyType_DateTimeArray = 1038, PropertyType_TimeSpanArray = 1039, PropertyType_GuidArray = 1040, PropertyType_PointArray = 1041, PropertyType_SizeArray = 1042, PropertyType_RectArray = 1043, PropertyType_OtherTypeArray = 1044 }; enum Windows::Foundation::ActivationType { ActivationType_InProcess = 0, ActivationType_OutOfProcess = 1 }; enum Windows::Foundation::IdentityType { IdentityType_ActivateAsActivator = 0, IdentityType_RunAs = 1, IdentityType_ActivateAsPackage = 2 }; enum Windows::Foundation::RegistrationScope { RegistrationScope_PerMachine = 0, RegistrationScope_PerUser = 1, RegistrationScope_InboxApp = 2 }; enum Windows::Foundation::InstancingType { InstancingType_SingleInstance = 0, InstancingType_MultipleInstances = 1 }; struct _EVENT_DESCRIPTOR { unsigned short Id; /* +0x0000 */ unsigned char Version; /* +0x0002 */ unsigned char Channel; /* +0x0003 */ unsigned char Level; /* +0x0004 */ unsigned char Opcode; /* +0x0005 */ unsigned short Task; /* +0x0006 */ unsigned long long Keyword; /* +0x0008 */ }; struct _MCGEN_TRACE_CONTEXT { unsigned long long RegistrationHandle; /* +0x0000 */ unsigned long long Logger; /* +0x0008 */ unsigned long long MatchAnyKeyword; /* +0x0010 */ unsigned long long MatchAllKeyword; /* +0x0018 */ unsigned long Flags; /* +0x0020 */ unsigned long IsEnabled; /* +0x0024 */ unsigned char Level; /* +0x0028 */ unsigned char Reserve; /* +0x0029 */ unsigned short EnableBitsCount; /* +0x002a */ unsigned long *EnableBitMask; /* +0x002c */ unsigned char EnableKeyWords[4]; /* +0x0030 5c 67 00 00 */ unsigned char EnableLevel[4]; /* +0x0034 39 19 00 00 */ }; struct _EVENT_DATA_DESCRIPTOR { unsigned long long Ptr; /* +0x0000 */ unsigned long Size; /* +0x0008 */ unsigned long Reserved; /* +0x000c */ }; struct EventRegistrationToken { long long value; /* +0x0000 */ }; enum ProcessToken::DesignModeState { DesignModeNotDetermined = 0, InDesignMode = 1, NotInDesignMode = 2 }; enum ProcessToken::AppContainerState { NotDetermined = 0, AppContainer = 1, NotAppContainer = 2 }; enum ProcessToken::UserHiveOkState { UserHiveOkStateNotDetermined = 0, UserHiveIsOk = 1, UserHiveIsNotOk = 2 }; enum Windows::Foundation::ThreadingType { ThreadingType_BOTH = 0, ThreadingType_STA = 1, ThreadingType_MTA = 2 }; struct Windows::Foundation::Point { unsigned char X[4]; /* +0x0000 40 00 00 00 */ unsigned char Y[4]; /* +0x0004 40 00 00 00 */ }; struct Windows::Foundation::TimeSpan { long long Duration; /* +0x0000 */ }; struct Windows::Foundation::Size { unsigned char Width[4]; /* +0x0000 40 00 00 00 */ unsigned char Height[4]; /* +0x0004 40 00 00 00 */ }; struct Windows::Foundation::DateTime { long long UniversalTime; /* +0x0000 */ }; struct Windows::Foundation::Rect { unsigned char X[4]; /* +0x0000 40 00 00 00 */ unsigned char Y[4]; /* +0x0004 40 00 00 00 */ unsigned char Width[4]; /* +0x0008 40 00 00 00 */ unsigned char Height[4]; /* +0x000c 40 00 00 00 */ }; struct RoVariant::OutRef { unsigned char _pOwner[4]; /* +0x0000 4f 6f 00 00 */ unsigned char _pI[4]; /* +0x0004 1c 26 00 00 */ }; struct RoVariant::Accessor { unsigned char _pI[4]; /* +0x0000 1c 26 00 00 */ unsigned char _hrState[4]; /* +0x0004 08 00 00 00 */ }; enum RoVariant::States { StateIsNull = 0, StateIsObjNoRef = 1, StateIsObj = 3, StateIsPV = 7 }; struct _EVENT_FILTER_DESCRIPTOR { unsigned long long Ptr; /* +0x0000 */ unsigned long Size; /* +0x0008 */ unsigned long Type; /* +0x000c */ }; enum <unnamed-type-s_processTrust> { ProcessTrustUndetermined = 0, ProcessIsFullTrust = 1, ProcessIsNotFullTrust = 2 }; /* enum <unnamed-tag> { WPP_TRACE_OPTIONS = 43 }; */ struct CSplit_QI { unsigned char SomePMItfPtrs[8]; /* +0x0000 58 70 00 00 */ unsigned char SomeHRs[8]; /* +0x0008 59 70 00 00 */ unsigned char SomeIIDs[32]; /* +0x0010 5a 70 00 00 */ unsigned long _dwCount; /* +0x0030 */ char *_pAllocBlock; /* +0x0034 */ unsigned char _pItfArray[4]; /* +0x0038 1a 43 00 00 */ unsigned char _pHrArray[4]; /* +0x003c 08 04 00 00 */ unsigned char _pIIDArray[4]; /* +0x0040 44 16 00 00 */ }; struct tagTLSMapEntry { unsigned long dwThreadId; /* +0x0000 */ unsigned char ptls[4]; /* +0x0004 f5 53 00 00 */ }; enum MapEnumToSQMData<enum Ole32SQMFlags>::<unnamed-tag> { DataID = 2343 }; enum Ole32SQMFlags { SixteenbitOLEUsage = 1, OLEDDEUsage = 2 }; enum _MTA_INCREMENTOR_STATE { MTAStateNew = 0, MTAStateIncStarted = 1, MTAStateIncInited = 2, MTAStateIncWon = 3, MTAStateIncLost = 4, MTAStateIncFailed = 5, MTAStateIncKill = 6, MTAStateWorkStarted = 7, MTAStateWorkInited = 8, MTAStateWorkDone = 9, MTAStateWorkFailed = 10, MTAStateFailed = 11, MTAStateMax = 12 }; struct _MTA_USAGE_GLOBALS { unsigned long dwStackCapture; /* +0x0000 */ unsigned long *p_cMTAInits; /* +0x0004 */ unsigned long *p_cMTAWorkerInits; /* +0x0008 */ unsigned long *p_cMTAIncInits; /* +0x000c */ unsigned long *p_cMTAWaiters; /* +0x0010 */ unsigned char p_cMTABurnAThreads[4]; /* +0x0014 6a 1e 00 00 */ unsigned char ppMTAUsageIncrementorHead[4]; /* +0x0018 9d 70 00 00 */ unsigned long *p_cMTAIncrementorSize; /* +0x001c */ unsigned char p_posMTAIncrementorCompleted[4]; /* +0x0020 9e 70 00 00 */ unsigned char ppMTAUsageCompletedIncrementorHead[4]; /* +0x0024 9d 70 00 00 */ }; enum _SQM_TYPE { SQM_TYPE_NONE = 0, SQM_TYPE_DWORD = 1, SQM_TYPE_STRING = 2, SQM_TYPE_DWORD64 = 3 }; enum CClassCache::CDllPathEntry::eFlags { fSIXTEEN_BIT = 1, fWX86 = 2, fIS_OLE32 = 4, fDELAYED_UNLOAD = 16 }; enum CClassCache::CClassEntry::eFlags { fTREAT_AS = 1, fINCOMPLETE = 2, fDO_NOT_HASH = 4, fCOMPLUS = 8, fSIDE_BY_SIDE = 16, fSIDE_BY_SIDE_WITH_NO_HASHING = 32 }; enum DLL_INSTANTIATION_PROPERTIES::eFlags { fSIXTEEN_BIT = 1, fIS_OLE32 = 8, fIS_COMSVCS_CLSID = 16 }; enum CClassCache::CClassEntry::eGUIDIndex { iCLSID = 0, iPartition = 1, iTotal = 2 }; enum EChannelState { client_cs = 1, proxy_cs = 2, server_cs = 4, freethreaded_cs = 8, process_local_cs = 32, locked_cs = 64, neutral_cs = 256, fake_async_cs = 512, app_security_cs = 1024, cross_apartment_no_wait_cs = 2048 }; enum CRpcChannelBuffer::CServerCallMgr::<unnamed-tag> { STATE_WAITINGFORSIGNAL = 0, STATE_SIGNALED = 1, STATE_ERROR = 2 }; enum EHandleState { allow_hs = 1, deny_hs = 2, static_cloaking_hs = 4, dynamic_cloaking_hs = 8, any_cloaking_hs = 12, process_local_hs = 16, machine_local_hs = 32, app_security_hs = 64 }; enum MessageParamKind { CMessageCall = 0, CChannelObject = 1, CDllHost = 2, CGIPMessageParam = 3, POSTRELRIFREF = 4 }; enum tagSTDID_FLAGS { STDID_SERVER = 0, STDID_CLIENT = 1, STDID_FREETHREADED = 2, STDID_HAVEID = 4, STDID_IGNOREID = 8, STDID_AGGREGATED = 16, STDID_INDESTRUCTOR = 256, STDID_LOCKEDINMEM = 512, STDID_DEFHANDLER = 1024, STDID_AGGID = 2048, STDID_STCMRSHL = 4096, STDID_REMOVEDFROMIDOBJ = 8192, STDID_SYSTEM = 16384, = 32770 }; enum tagSMFLAGS { SMFLAGS_CLIENT_SIDE = 1, SMFLAGS_PENDINGDISCONNECT = 2, SMFLAGS_REGISTEREDOID = 4, SMFLAGS_DISCONNECTED = 8, SMFLAGS_FIRSTMARSHAL = 16, SMFLAGS_HANDLER = 32, SMFLAGS_WEAKCLIENT = 64, SMFLAGS_IGNORERUNDOWN = 128, SMFLAGS_CLIENTMARSHALED = 256, SMFLAGS_NOPING = 512, SMFLAGS_TRIEDTOCONNECT = 1024, SMFLAGS_CSTATICMARSHAL = 2048, SMFLAGS_USEAGGSTDMARSHAL = 4096, SMFLAGS_SYSTEM = 8192, SMFLAGS_DEACTIVATED = 16384, = 32770 }; enum tagIPIDFLAGS { IPIDF_CONNECTING = 1, IPIDF_DISCONNECTED = 2, IPIDF_SERVERENTRY = 4, IPIDF_NOPING = 8, IPIDF_COPY = 16, IPIDF_VACANT = 128, IPIDF_NONNDRSTUB = 256, IPIDF_NONNDRPROXY = 512, IPIDF_NOTIFYACT = 1024, IPIDF_TRIED_ASYNC = 2048, IPIDF_ASYNC_SERVER = 4096, IPIDF_DEACTIVATED = 8192, IPIDF_WEAKREFCACHE = 16384, = 32770 }; enum tagDISCTYPE { DISCTYPE_NORMAL = 1, DISCTYPE_RELEASE = 2, DISCTYPE_APPLICATION = 4, DISCTYPE_UNINIT = 8, DISCTYPE_RUNDOWN = 16, DISCTYPE_SYSTEM = 32 }; struct IRCEntry { unsigned char pNext[4]; /* +0x0000 89 5c 00 00 */ unsigned char pRefCache[4]; /* +0x0004 cd 70 00 00 */ unsigned long cStrongUsage; /* +0x0008 */ unsigned long cWeakUsage; /* +0x000c */ unsigned long cStrongRefs; /* +0x0010 */ unsigned long cPrivateRefs; /* +0x0014 */ unsigned long cWeakRefs; /* +0x0018 */ unsigned char ipid[16]; /* +0x001c dc 14 00 00 */ }; struct tagGIPEntry { unsigned char pPrev[4]; /* +0x0000 e4 70 00 00 */ unsigned char pNext[4]; /* +0x0004 e4 70 00 00 */ unsigned long dwType; /* +0x0008 */ unsigned long dwSeqNo; /* +0x000c */ unsigned char cUsage[4]; /* +0x0010 c3 17 00 00 */ unsigned long dwAptId; /* +0x0014 */ unsigned char pContext[4]; /* +0x0018 04 54 00 00 */ unsigned char pUnk[4]; /* +0x001c 7f 17 00 00 */ void *pVtable; /* +0x0020 */ unsigned char pUnkProxy[4]; /* +0x0024 7f 17 00 00 */ unsigned char mp[24]; /* +0x0028 e5 70 00 00 */ }; struct MarshalParams { unsigned char iid[16]; /* +0x0000 dc 14 00 00 */ unsigned long mshlflags; /* +0x0010 */ }; struct tagGIPEntry::<unnamed-type-u> { /* unsigned char pIFD[0]; +0x0000 5e 4c 00 00 */ unsigned char pobjref[4]; /* +0x0000 dd 66 00 00 */ }; enum CRIFTable::<unnamed-tag> { RIFFLG_HASCOUNTERPART = 1, RIFFLG_HASCLSID = 2, RIFFLG_PACKAGE_SCOPED_CLSID = 4 }; enum CRIFTable::RegistrationState { NOT_REGISTERED = 0, PENDING_REGISTRATION = 1, FULLY_REGISTERED = 2 }; struct CRIFTable::tagRIFEntry { unsigned char HashNode[24]; /* +0x0000 19 5d 00 00 */ unsigned char iidCounterpart[16]; /* +0x0018 dc 14 00 00 */ unsigned char psclsid[16]; /* +0x0028 dc 14 00 00 */ unsigned long dwFlags; /* +0x0038 */ unsigned char pBase[4]; /* +0x003c 20 71 00 00 */ unsigned long cSrvRefs; /* +0x0040 */ unsigned char srvRegistrationState[4]; /* +0x0044 3a 71 00 00 */ unsigned char ConditionSrvInterface[4]; /* +0x0048 14 58 00 00 */ unsigned char pSrvInterface[4]; /* +0x004c ec 26 00 00 */ unsigned long cCliRefs; /* +0x0050 */ unsigned char pCliInterface[4]; /* +0x0054 c9 4f 00 00 */ }; struct _SCHANNEL_CRED { unsigned long dwVersion; /* +0x0000 */ unsigned long cCreds; /* +0x0004 */ unsigned char paCred[4]; /* +0x0008 86 15 00 00 */ void *hRootStore; /* +0x000c */ unsigned long cMappers; /* +0x0010 */ unsigned char aphMappers[4]; /* +0x0014 41 71 00 00 */ unsigned long cSupportedAlgs; /* +0x0018 */ unsigned char palgSupportedAlgs[4]; /* +0x001c 75 04 00 00 */ unsigned long grbitEnabledProtocols; /* +0x0020 */ unsigned long dwMinimumCipherStrength; /* +0x0024 */ unsigned long dwMaximumCipherStrength; /* +0x0028 */ unsigned long dwSessionLifespan; /* +0x002c */ unsigned long dwFlags; /* +0x0030 */ unsigned long dwCredFormat; /* +0x0034 */ }; struct __MIDL_ICallFrame_0001 { unsigned long iMethod; /* +0x0000 */ unsigned char fHasInValues[4]; /* +0x0004 74 00 00 00 */ unsigned char fHasInOutValues[4]; /* +0x0008 74 00 00 00 */ unsigned char fHasOutValues[4]; /* +0x000c 74 00 00 00 */ unsigned char fDerivesFromIDispatch[4]; /* +0x0010 74 00 00 00 */ long cInInterfacesMax; /* +0x0014 */ long cInOutInterfacesMax; /* +0x0018 */ long cOutInterfacesMax; /* +0x001c */ long cTopLevelInInterfaces; /* +0x0020 */ unsigned char iid[16]; /* +0x0024 dc 14 00 00 */ unsigned long cMethod; /* +0x0034 */ unsigned long cParams; /* +0x0038 */ }; struct __MIDL_ICallFrame_0002 { unsigned char fIn; /* +0x0000 */ unsigned char fOut; /* +0x0001 */ unsigned long stackOffset; /* +0x0004 */ unsigned long cbParam; /* +0x0008 */ }; enum __MIDL_ICallFrame_0003 { CALLFRAME_COPY_NESTED = 1, CALLFRAME_COPY_INDEPENDENT = 2 }; struct __MIDL_ICallFrame_0004 { unsigned char fIn; /* +0x0000 */ unsigned long dwDestContext; /* +0x0004 */ void *pvDestContext; /* +0x0008 */ unsigned char punkReserved[4]; /* +0x000c 7f 17 00 00 */ unsigned char guidTransferSyntax[16]; /* +0x0010 dc 14 00 00 */ }; struct tagPIDData { unsigned char pServer[4]; /* +0x0000 7f 17 00 00 */ unsigned char pServerCtx[4]; /* +0x0004 04 54 00 00 */ }; struct tagOIDData { unsigned char pmoid[4]; /* +0x0000 4a 16 00 00 */ unsigned long aptID; /* +0x0004 */ }; struct SOIDRegistration { unsigned char Node[24]; /* +0x0000 19 5d 00 00 */ unsigned short cRefs; /* +0x0018 */ unsigned short flags; /* +0x001a */ unsigned long long mid; /* +0x0020 */ unsigned long long oxid; /* +0x0028 */ unsigned char pPrevList[4]; /* +0x0030 0c 72 00 00 */ unsigned char pNextList[4]; /* +0x0034 0c 72 00 00 */ unsigned char pRefCache[8]; /* +0x0038 cd 70 00 00 */ }; struct tagSQIResult { void *pv; /* +0x0000 */ unsigned char hr[4]; /* +0x0004 08 00 00 00 */ }; struct tagQICONTEXT { unsigned long dwFlags; /* +0x0000 */ unsigned char pARU[4]; /* +0x0004 3f 72 00 00 */ unsigned short cIIDs; /* +0x0008 */ unsigned char pIIDs[4]; /* +0x000c 44 16 00 00 */ unsigned char hr[4]; /* +0x0010 08 00 00 00 */ unsigned char pRemQiRes[4]; /* +0x0014 78 5c 00 00 */ unsigned char pIPIDEntry[4]; /* +0x0018 83 5c 00 00 */ unsigned char pIM[4]; /* +0x001c 36 42 00 00 */ unsigned char phr[4]; /* +0x0020 08 04 00 00 */ unsigned char ppMIFs[4]; /* +0x0024 1a 43 00 00 */ unsigned char data[4]; /* +0x0028 f9 12 00 00 */ }; struct CStdMarshal::DiscSinkNode { unsigned char pNext[4]; /* +0x0000 ea 72 00 00 */ unsigned char pPrev[4]; /* +0x0004 ea 72 00 00 */ unsigned char pSink[4]; /* +0x0008 d6 66 00 00 */ void *pvCookie; /* +0x000c */ }; enum ESignalState { none_ss = 0, pending_ss = 1, signaled_ss = 2, failed_ss = 3 }; struct pUnkListElement { unsigned char _pUnk[4]; /* +0x0000 7f 17 00 00 */ unsigned char _next[4]; /* +0x0004 45 74 00 00 */ }; struct ApartmentEntry { unsigned char node[12]; /* +0x0000 ef 5c 00 00 */ unsigned long hCOMActivator; /* +0x000c */ unsigned long hWinRTActivator; /* +0x0010 */ }; enum CClassCache::eFlags { fINITIALIZED = 1, fSHUTTINGDOWN = 2 }; enum CClassCache::CLSvrClassEntry::eFlags { fAT_STORAGE = 1, fREVOKE_PENDING = 2, fBEEN_USED = 16 }; struct CClassCache::CWinRTLocalSvrClassEntry { unsigned char _hashNode[12]; /* +0x0000 77 5d 00 00 */ unsigned char _pNextLSvr[4]; /* +0x000c e1 75 00 00 */ unsigned char _pPrevLSvr[4]; /* +0x0010 e1 75 00 00 */ unsigned char _pRegChain[4]; /* +0x0014 e1 75 00 00 */ unsigned char _pActivationFactoryCallback[60]; /* +0x0018 87 59 00 00 */ }; enum CClassCache::CWinRTLocalSvrClassEntry::eFlags { fREVOKE_PENDING = 2 }; struct CClassCache::CServiceRefEntry { unsigned long _ulServiceId; /* +0x0000 */ unsigned long _cRefsServiceProcess; /* +0x0004 */ void *_hSuspended; /* +0x0008 */ unsigned long _dwDelayMilliseconds; /* +0x000c */ unsigned char _ShutdownDelayTimer[4]; /* +0x0010 f9 31 00 00 */ unsigned char _bCanceledTimer[4]; /* +0x0014 74 00 00 00 */ unsigned char _pNextServiceRefEntry[4]; /* +0x0018 1c 76 00 00 */ unsigned char _pPrevServiceRefEntry[4]; /* +0x001c 1c 76 00 00 */ }; struct CClassCache::SDPEHashKey { unsigned char _pstr[4]; /* +0x0000 71 04 00 00 */ unsigned long _dwDIPFlags; /* +0x0004 */ }; struct _SQM_STREAM_ENTRY { unsigned long dwType; /* +0x0000 */ }; struct _SQM_STREAM_ENTRY_EX { unsigned long cbStruct; /* +0x0000 */ unsigned long dwType; /* +0x0004 */ }; struct _SQM_STREAM_ENTRY::<unnamed-type-val> { /* unsigned char pwszVal[0]; +0x0000 c0 13 00 00 */ unsigned long dwVal; /* +0x0000 */ }; struct _SQM_STREAM_ENTRY_EX::<unnamed-type-val> { /* unsigned char pwszVal[0]; +0x0000 c0 13 00 00 */ unsigned long dwVal; /* +0x0000 */ unsigned long long qwVal; /* +0x0000 */ }; enum MapEnumToSQMData<enum RpcssSQMFlags>::<unnamed-tag> { DataID = 2342 }; struct _MTA_USAGE_INCREMENTOR { unsigned char pNext[4]; /* +0x0000 9c 70 00 00 */ unsigned long ulTime; /* +0x0004 */ unsigned long dwThreadId; /* +0x0008 */ void *hMatureEvent; /* +0x000c */ unsigned char hr[4]; /* +0x0010 08 00 00 00 */ unsigned char State[4]; /* +0x0014 c8 77 00 00 */ unsigned char fForWrapper[4]; /* +0x0018 74 00 00 00 */ unsigned char Function[4]; /* +0x001c c4 15 00 00 */ void *Context; /* +0x0020 */ void *hMatureResultEvent; /* +0x0024 */ void *hBurnAThreadEvent; /* +0x0028 */ }; struct ErrorObjectData { unsigned long dwVersion; /* +0x0000 */ unsigned long dwHelpContext; /* +0x0004 */ unsigned char iid[16]; /* +0x0008 dc 14 00 00 */ }; struct NdrStringHeader { unsigned long dwMax; /* +0x0000 */ unsigned long dwOffset; /* +0x0004 */ unsigned long dwActual; /* +0x0008 */ }; struct NdrStringPtrHeader { unsigned long dwUnique; /* +0x0000 */ unsigned long dwMax; /* +0x0004 */ unsigned long dwOffset; /* +0x0008 */ unsigned long dwActual; /* +0x000c */ }; struct IMallocVtbl { unsigned char QueryInterface[4]; /* +0x0000 5b 78 00 00 */ unsigned char AddRef[4]; /* +0x0004 5e 78 00 00 */ unsigned char Release[4]; /* +0x0008 5e 78 00 00 */ unsigned char Alloc[4]; /* +0x000c 61 78 00 00 */ unsigned char Realloc[4]; /* +0x0010 64 78 00 00 */ unsigned char Free[4]; /* +0x0014 67 78 00 00 */ unsigned char GetSize[4]; /* +0x0018 69 78 00 00 */ unsigned char DidAlloc[4]; /* +0x001c 6b 78 00 00 */ unsigned char HeapMinimize[4]; /* +0x0020 6d 78 00 00 */ }; struct CMalloc { unsigned char lpVtbl[4]; /* +0x0000 71 78 00 00 */ }; struct AENTRY { unsigned long dwCollision; /* +0x0000 */ void *pAllocation; /* +0x0004 */ }; enum tagCCF_FLAGS { CCF_NONE = 0, CCF_AGGREGATABLE = 1 }; struct tagCFEntry { unsigned char pclsid[4]; /* +0x0000 4a 16 00 00 */ unsigned char pfnCI[4]; /* +0x0004 bd 78 00 00 */ unsigned long dwFlags; /* +0x0008 */ }; struct tagSWindowData { unsigned char hWnd[4]; /* +0x0000 f1 12 00 00 */ unsigned char wFirstMsg[4]; /* +0x0004 75 00 00 00 */ unsigned char wLastMsg[4]; /* +0x0008 75 00 00 00 */ }; struct ENTRY { unsigned char sz[4]; /* +0x0000 c0 13 00 00 */ unsigned char pclsid[4]; /* +0x0004 4a 16 00 00 */ }; struct tagSCMSA { unsigned short wNumEntries; /* +0x0000 */ unsigned short wSecurityOffset; /* +0x0002 */ unsigned char awszStringArray[124]; /* +0x0004 5c 79 00 00 */ }; struct __MIDL_ILocalObjectExporter_0001 { unsigned char pName[4]; /* +0x0000 71 04 00 00 */ unsigned short wId; /* +0x0004 */ }; struct _RevokeEntry { unsigned char clsid[16]; /* +0x0000 dc 14 00 00 */ unsigned long dwReg; /* +0x0010 */ }; struct _RevokeClasses { unsigned long dwSize; /* +0x0000 */ unsigned char revent[20]; /* +0x0004 64 79 00 00 */ }; enum ASTAWaitSatisfiedReason { ObjectSignaled = 0, MutexAbandoned = 1, ApcDispatched = 2, Timeout = 3, Failed = 4, LifetimeLoopExiting = 5 }; enum CAsyncStateMachine::<unnamed-type-eflags> { STATE_WAITINGFORBEGIN = 1, STATE_WAITINGFORFINISH = 2, STATE_BEGINABORTED = 3, STATE_EXECUTINGFINISH = 4, STATE_INITIALIZINGOBJECT = 5 }; enum CChannelObject::eState { STATE_ERROR = 1, STATE_READYFORGETBUFFER = 2, STATE_READYFORSEND = 3, STATE_SENDING = 4, STATE_READYFORSIGNAL = 5, STATE_RECEIVING = 6, STATE_READYFORRECEIVE = 7, STATE_READYFORFREEBUFFER = 8, STATE_AMBIGUOUS = 9 }; struct SPendingCall { unsigned char pNext[4]; /* +0x0000 3f 7a 00 00 */ unsigned char pPrev[4]; /* +0x0004 3f 7a 00 00 */ unsigned char pChnlObj[4]; /* +0x0008 ce 61 00 00 */ }; struct WireThis { /* unsigned char c[0]; +0x0000 aa 7a 00 00 */ unsigned char d[80]; /* +0x0000 ab 7a 00 00 */ }; struct WireThisPart1 { unsigned char version[4]; /* +0x0000 66 1f 00 00 */ unsigned long flags; /* +0x0004 */ unsigned long reserved1; /* +0x0008 */ unsigned char cid[16]; /* +0x000c dc 14 00 00 */ unsigned long unique; /* +0x001c */ }; struct WireExtentArray { unsigned long size; /* +0x0000 */ unsigned long reserved; /* +0x0004 */ unsigned long unique; /* +0x0008 */ unsigned long rounded_size; /* +0x000c */ unsigned char unique_flag[8]; /* +0x0010 69 15 00 00 */ }; struct WireExtent { unsigned long rounded_size; /* +0x0000 */ unsigned char id[16]; /* +0x0004 dc 14 00 00 */ unsigned long size; /* +0x0014 */ }; struct WireThisPart2 { unsigned char part1[32]; /* +0x0000 aa 7a 00 00 */ unsigned char ea[24]; /* +0x0020 b4 7a 00 00 */ unsigned char e[24]; /* +0x0038 b5 7a 00 00 */ }; struct ASTAWaitContext::ProcessEventsMsgWaitParams { unsigned long dwWakeMask; /* +0x0000 */ unsigned long dwFlags; /* +0x0004 */ }; struct CO_PROCESS_EVENTS_CONTEXT { unsigned char Internal[48]; /* +0x0000 62 7b 00 00 */ }; struct SendMessageToClassicSTAParams { unsigned char hWnd[4]; /* +0x0000 f1 12 00 00 */ unsigned char Msg[4]; /* +0x0004 75 00 00 00 */ unsigned char wParam[4]; /* +0x0008 75 00 00 00 */ long lParam; /* +0x000c */ void *hEventSendMessageDone; /* +0x0010 */ unsigned char hrSendMessage[4]; /* +0x0014 08 00 00 00 */ }; enum CComApartment::ASTAPostCall::__l5::<unnamed-type-whichList> { PriorityCalls = 0, DispatchableCalls = 1, QueuedCalls = 2 }; enum ASTAWaitContext::Wait::__l42::<unnamed-type-timeoutReason> { OuterWaitTimeout = 0, QueuedCallTimeout = 1, ZeroTimeoutForDispatchableCalls = 2 }; enum CallObjectOccurrenceOrStateVariable { CalledI_RpcFreeBuffer = 0, CalledI_RpcNegotiateTransferSyntax = 1, CalledI_RpcGetBufferWithObject = 2, CalledI_RpcGetBuffer = 3, CalledI_RpcAsyncSetHandle = 4, CalledI_RpcSend = 5, CalledI_RpcReceive = 6, CalledI_RpcAsyncAbortCall = 7, CalledI_RpcSendReceive = 8, ReturningFromThreadSendReceive = 9, OccurrenceLast = 10, CMessageCall_iFlags = 11, CAsyncCall_lFlags = 12, CAsyncCall_eSignalState = 13, CClientCall_m_dwFlags = 14 }; struct ThreadTypeSpecificRoutines { unsigned char WaitForHandles[4]; /* +0x0000 20 7c 00 00 */ unsigned char SignalMTAClient[4]; /* +0x0004 22 7c 00 00 */ unsigned char SignalNAClient[4]; /* +0x0008 22 7c 00 00 */ unsigned char CheckAndAdjustRpcFlagsInClientGetBuffer[4]; /* +0x000c 25 7c 00 00 */ unsigned char CanMakeOutCall[4]; /* +0x0010 26 7c 00 00 */ unsigned char CanMakeOutRemReleaseCall[4]; /* +0x0014 27 7c 00 00 */ unsigned char SendReceive[4]; /* +0x0018 29 7c 00 00 */ unsigned char Send[4]; /* +0x001c 29 7c 00 00 */ unsigned char Receive[4]; /* +0x0020 2b 7c 00 00 */ unsigned char BlockForAsyncCancel[4]; /* +0x0024 60 1b 00 00 */ unsigned char DispatchCrossApartmentCall[4]; /* +0x0028 2e 7c 00 00 */ unsigned char WaitForCall[4]; /* +0x002c 30 7c 00 00 */ unsigned char SendMessageToClassicSTA[4]; /* +0x0030 31 7c 00 00 */ }; enum EServerSecurity { SS_PROCESS_LOCAL = 1, SS_CALL_DONE = 2, SS_WAS_IMPERSONATING = 4 }; enum _TRUSTEE_TYPE { TRUSTEE_IS_UNKNOWN = 0, TRUSTEE_IS_USER = 1, TRUSTEE_IS_GROUP = 2, TRUSTEE_IS_DOMAIN = 3, TRUSTEE_IS_ALIAS = 4, TRUSTEE_IS_WELL_KNOWN_GROUP = 5, TRUSTEE_IS_DELETED = 6, TRUSTEE_IS_INVALID = 7, TRUSTEE_IS_COMPUTER = 8 }; enum _TRUSTEE_FORM { TRUSTEE_IS_SID = 0, TRUSTEE_IS_NAME = 1, TRUSTEE_BAD_FORM = 2, TRUSTEE_IS_OBJECTS_AND_SID = 3, TRUSTEE_IS_OBJECTS_AND_NAME = 4 }; enum _MULTIPLE_TRUSTEE_OPERATION { NO_MULTIPLE_TRUSTEE = 0, TRUSTEE_IS_IMPERSONATE = 1 }; enum LSA_FOREST_TRUST_RECORD_TYPE { ForestTrustTopLevelName = 0, ForestTrustTopLevelNameEx = 1, ForestTrustDomainInfo = 2, ForestTrustRecordTypeLast = 2 }; struct _TRUSTEE_W { unsigned char pMultipleTrustee[4]; /* +0x0000 af 7c 00 00 */ unsigned char MultipleTrusteeOperation[4]; /* +0x0004 b0 7c 00 00 */ unsigned char TrusteeForm[4]; /* +0x0008 b1 7c 00 00 */ unsigned char TrusteeType[4]; /* +0x000c b2 7c 00 00 */ unsigned char ptstrName[4]; /* +0x0010 71 04 00 00 */ }; struct _ACTRL_ACCESS_ENTRYW { unsigned char Trustee[20]; /* +0x0000 ae 7c 00 00 */ unsigned long fAccessFlags; /* +0x0014 */ unsigned long Access; /* +0x0018 */ unsigned long ProvSpecificAccess; /* +0x001c */ unsigned long Inheritance; /* +0x0020 */ unsigned char lpInheritProperty[4]; /* +0x0024 71 04 00 00 */ }; struct SAccessCache { unsigned char fAccess[4]; /* +0x0000 74 00 00 00 */ unsigned char lClient[8]; /* +0x0004 21 15 00 00 */ }; struct SBlanket { unsigned char _pPrincipal[4]; /* +0x0000 71 04 00 00 */ unsigned long _lAuthnLevel; /* +0x0004 */ unsigned long _lAuthnSvc; /* +0x0008 */ void *_pAuthId; /* +0x000c */ unsigned long _lAuthzSvc; /* +0x0010 */ unsigned char _sQos[36]; /* +0x0014 e9 17 00 00 */ unsigned long _lCapabilities; /* +0x0038 */ unsigned char _sCred[56]; /* +0x003c c8 70 00 00 */ unsigned char _pCert[4]; /* +0x0074 b9 13 00 00 */ }; struct _ACTRL_ACCESS_ENTRY_LISTW { unsigned long cEntries; /* +0x0000 */ unsigned char pAccessList[4]; /* +0x0004 f4 7c 00 00 */ }; struct _ACTRL_PROPERTY_ENTRYW { unsigned char lpProperty[4]; /* +0x0000 71 04 00 00 */ unsigned char pAccessEntryList[4]; /* +0x0004 b8 7c 00 00 */ unsigned long fListFlags; /* +0x0008 */ }; struct _ACTRL_ALISTW { unsigned long cEntries; /* +0x0000 */ unsigned char pPropertyAccessList[4]; /* +0x0004 ba 7c 00 00 */ }; struct SPermissionHeader { unsigned short wVersion; /* +0x0000 */ unsigned short wPad; /* +0x0002 */ unsigned char gClass[16]; /* +0x0004 dc 14 00 00 */ }; enum CALLFRAME_FREE { CALLFRAME_FREE_NONE = 0, CALLFRAME_FREE_IN = 1, CALLFRAME_FREE_INOUT = 2, CALLFRAME_FREE_OUT = 4, CALLFRAME_FREE_TOP_INOUT = 8, CALLFRAME_FREE_TOP_OUT = 16, CALLFRAME_FREE_ALL = 31 }; enum CALLFRAME_NULL { CALLFRAME_NULL_NONE = 0, CALLFRAME_NULL_INOUT = 2, CALLFRAME_NULL_OUT = 4, CALLFRAME_NULL_ALL = 6 }; enum CALLFRAME_WALK { CALLFRAME_WALK_IN = 1, CALLFRAME_WALK_INOUT = 2, CALLFRAME_WALK_OUT = 4 }; enum tagIDLFLAGS { IDLF_CREATE = 1, IDLF_STRONG = 2, IDLF_NOPING = 4, IDLF_NOIEC = 8, IDLF_FTM = 16 }; struct tagXCtxMarshalData { unsigned long dwSignature; /* +0x0000 */ unsigned char iid[16]; /* +0x0004 dc 14 00 00 */ unsigned char moxid[16]; /* +0x0014 dc 14 00 00 */ unsigned char pWrapper[4]; /* +0x0024 9f 71 00 00 */ unsigned char pEntry[4]; /* +0x0028 61 74 00 00 */ unsigned char pServer[4]; /* +0x002c 7f 17 00 00 */ unsigned char pServerCtx[4]; /* +0x0030 04 54 00 00 */ unsigned long dwMarshalFlags; /* +0x0034 */ }; struct tagXCtxWrapperData { unsigned char pIID[4]; /* +0x0000 4a 16 00 00 */ unsigned char pServer[4]; /* +0x0004 7f 17 00 00 */ unsigned long dwState; /* +0x0008 */ unsigned char pServerCtx[4]; /* +0x000c 04 54 00 00 */ unsigned char pClientCtx[4]; /* +0x0010 04 54 00 00 */ void *pv; /* +0x0014 */ }; struct tagXCtxQIData { unsigned char pIID[4]; /* +0x0000 4a 16 00 00 */ unsigned char pStdWrapper[4]; /* +0x0004 9f 71 00 00 */ unsigned char pEntry[4]; /* +0x0008 61 74 00 00 */ }; struct tagStdMarshalData { unsigned char pID[4]; /* +0x0000 b9 71 00 00 */ unsigned char pServer[4]; /* +0x0004 7f 17 00 00 */ unsigned char pIID[4]; /* +0x0008 4a 16 00 00 */ unsigned long dwDestCtx; /* +0x000c */ void *pvDestCtx; /* +0x0010 */ unsigned long mshlflags; /* +0x0014 */ unsigned char pobjref[4]; /* +0x0018 dd 66 00 00 */ }; struct tagIFaceSvrRefs { unsigned char pRpcStub[4]; /* +0x0000 68 1d 00 00 */ unsigned char pRpcProxy[4]; /* +0x0004 63 1d 00 00 */ void *pServer; /* +0x0008 */ unsigned char pCtxChnl[4]; /* +0x000c 63 74 00 00 */ }; struct tagXCtxDisconnectData { unsigned char pServer[4]; /* +0x0000 7f 17 00 00 */ unsigned char pID[4]; /* +0x0004 b9 71 00 00 */ unsigned long cIFaces; /* +0x0008 */ unsigned char pIFaceSvrRefs[4]; /* +0x000c 01 7e 00 00 */ }; struct CStdWrapper::Deactivate::__l3::tagServerRefs { unsigned char pRpcStub[4]; /* +0x0000 68 1d 00 00 */ void *pServer; /* +0x0004 */ }; struct CStdWrapper::Reactivate::__l3::tagServerRefs { unsigned char pRpcStub[4]; /* +0x0000 68 1d 00 00 */ unsigned char ppServer[4]; /* +0x0004 4f 13 00 00 */ unsigned char pIID[4]; /* +0x0008 44 16 00 00 */ }; struct tagPROPMARSHALHEADER { unsigned char clsid[16]; /* +0x0000 dc 14 00 00 */ unsigned char policyId[16]; /* +0x0010 dc 14 00 00 */ unsigned long flags; /* +0x0020 */ unsigned long cb; /* +0x0024 */ }; struct tagENVOYDATA { unsigned char contextId[16]; /* +0x0000 dc 14 00 00 */ unsigned long ulJunk1; /* +0x0010 */ unsigned long ulJunk2; /* +0x0014 */ }; struct tagMainHeader { unsigned long Signature; /* +0x0000 */ unsigned long Version; /* +0x0004 */ unsigned long cPolicies; /* +0x0008 */ unsigned long cbBuffer; /* +0x000c */ unsigned long cbSize; /* +0x0010 */ long hr; /* +0x0014 */ long hrServer; /* +0x0018 */ long reserved; /* +0x001c */ }; struct tagEntryHeader { unsigned long Signature; /* +0x0000 */ unsigned long cbBuffer; /* +0x0004 */ unsigned long cbSize; /* +0x0008 */ long reserved; /* +0x000c */ unsigned char policyID[16]; /* +0x0010 dc 14 00 00 */ }; enum Windows::Foundation::Collections::supports_cleanup<Windows::Foundation::Collections::IKeyValuePair<HSTRING__ *,unsigned char> *>::<unnamed-tag> { value = 1 }; struct _ASSEMBLY_VERSION { unsigned short Build; /* +0x0000 */ unsigned short Revision; /* +0x0002 */ unsigned short Minor; /* +0x0004 */ unsigned short Major; /* +0x0006 */ unsigned long long QuadPart; /* +0x0000 */ }; struct tagKnownSystemIIDs { unsigned char pIID[4]; /* +0x0000 4a 16 00 00 */ unsigned long dwRpcIfFlags; /* +0x0004 */ }; struct _ACTIVATION_CONTEXT_DATA_COM_INTERFACE_REDIRECTION { unsigned long Size; /* +0x0000 */ unsigned long Flags; /* +0x0004 */ unsigned char ProxyStubClsid32[16]; /* +0x0008 dc 14 00 00 */ unsigned long NumMethods; /* +0x0018 */ unsigned char TypeLibraryId[16]; /* +0x001c dc 14 00 00 */ unsigned char BaseInterface[16]; /* +0x002c dc 14 00 00 */ unsigned long NameLength; /* +0x003c */ unsigned long NameOffset; /* +0x0040 */ }; struct SHookList { unsigned char pNext[4]; /* +0x0000 de 7e 00 00 */ unsigned char pHook[4]; /* +0x0004 df 7e 00 00 */ unsigned char uExtension[16]; /* +0x0008 dc 14 00 00 */ }; struct WireThat { /* unsigned char c[0]; +0x0000 e6 7e 00 00 */ unsigned char d[56]; /* +0x0000 e7 7e 00 00 */ }; struct WireThatPart1 { unsigned long flags; /* +0x0000 */ unsigned long unique; /* +0x0004 */ }; struct WireThatPart2 { unsigned char part1[8]; /* +0x0000 e6 7e 00 00 */ unsigned char ea[24]; /* +0x0008 b4 7a 00 00 */ unsigned char e[24]; /* +0x0020 b5 7a 00 00 */ }; struct ORPC_INIT_ARGS { unsigned char lpIntfOrpcDebug[4]; /* +0x0000 03 7f 00 00 */ void *pvPSN; /* +0x0004 */ unsigned long dwReserved1; /* +0x0008 */ unsigned long dwReserved2; /* +0x000c */ }; struct ORPC_DBG_ALL { unsigned char *pSignature; /* +0x0000 */ unsigned char pMessage[4]; /* +0x0004 db 1d 00 00 */ unsigned char refiid[4]; /* +0x0008 4a 16 00 00 */ unsigned char pChannel[4]; /* +0x000c 68 19 00 00 */ unsigned char pUnkProxyMgr[4]; /* +0x0010 7f 17 00 00 */ void *pInterface; /* +0x0014 */ unsigned char pUnkObject[4]; /* +0x0018 7f 17 00 00 */ unsigned char hresult[4]; /* +0x001c 08 00 00 00 */ void *pvBuffer; /* +0x0020 */ unsigned long cbBuffer; /* +0x0024 */ unsigned long *lpcbBuffer; /* +0x0028 */ void *reserved; /* +0x002c */ }; enum tagCMLFLAGS { CMLF_QUITRECEIVED = 1, CMLF_CLEAREDQUEUE = 2, CMLF_CHECKEDTOKEN = 4, CMLF_DROPPEDINPUT = 8, CMLF_NEWINPUT = 16 }; enum tagCOMETWDELAYFLAGS { COMETWDELAY_UIMSGSINCML = 1, COMETWDELAY_DROPPEDINPUT = 2, COMETWDELAY_NEWINPUTINCML = 4 }; enum CSurrogateProcessActivator::<unnamed-type-m_timeoutState> { TIMEOUT_INACTIVE = 0, TIMEOUT_PENDING = 1, TIMEOUT_SUSPENDED = 2, TIMEOUT_HAPPENING = 3, TIMEOUT_FORCED_SHUTDOWN = 4 }; struct LocalThis { unsigned long flags; /* +0x0000 */ unsigned long client_thread; /* +0x0004 */ }; enum __MIDL___MIDL_itf_odeth_0000_0001_0001 { ORS_DONTRUNDOWN = 0, ORS_OK_TO_RUNDOWN = 1, ORS_OID_PINNED = 2 }; /* enum <unnamed-tag> { QIC_STATICMARSHAL = 1, QIC_DISCONNECTED = 2, QIC_ASYNC = 4, QIC_WEAKCLIENT = 8, QIC_BEGINCALLED = 16 }; */ struct tagIPIDTmp { unsigned long dwFlags; /* +0x0000 */ unsigned long cStrongRefs; /* +0x0004 */ unsigned long cWeakRefs; /* +0x0008 */ unsigned long cPrivateRefs; /* +0x000c */ void *pv; /* +0x0010 */ unsigned char pStub[4]; /* +0x0014 7f 17 00 00 */ unsigned char pOXIDEntry[4]; /* +0x0018 85 5c 00 00 */ }; struct tagStdUnmarshalData { unsigned char pStdID[4]; /* +0x0000 48 62 00 00 */ unsigned char pobjref[4]; /* +0x0004 dd 66 00 00 */ unsigned char pClientCtx[4]; /* +0x0008 04 54 00 00 */ unsigned char fCreateWrapper[4]; /* +0x000c 74 00 00 00 */ unsigned char ppv[4]; /* +0x0010 4f 13 00 00 */ unsigned char fLightNA[4]; /* +0x0014 74 00 00 00 */ }; struct tagStdReleaseData { unsigned char pStdMshl[4]; /* +0x0000 42 72 00 00 */ unsigned char pObjRef[4]; /* +0x0004 dd 66 00 00 */ }; struct tagStdDiscData { unsigned char pStdMshl[4]; /* +0x0000 42 72 00 00 */ unsigned long dwType; /* +0x0004 */ unsigned char fRelease[4]; /* +0x0008 74 00 00 00 */ }; struct CStdMarshal::DisconnectCliIPIDs::__l6::_IPIDReleaseSet { unsigned short cRifRef; /* +0x0000 */ unsigned char pRifRef[4]; /* +0x0004 ef 5d 00 00 */ }; struct ReportedExceptions { unsigned long dwExceptionCode; /* +0x0000 */ unsigned long dwReportCount; /* +0x0004 */ unsigned long dwMaxCount; /* +0x0008 */ }; enum _SecurityOptionsDisposition { ACCESS_DENIED_FOR_ACTIVATION_VIA_RESTRICTION = 1, ACCESS_DENIED_FOR_LAUNCH_VIA_RESTRICTION = 2, ACCESS_DENIED_FOR_ACTIVATION_VIA_PERMISSION = 4, ACCESS_DENIED_FOR_LAUNCH_VIA_PERMISSION = 8, ACCESS_DENIED_FOR_CALL_VIA_RESTRICTION = 16, ACCESS_DENIED_FOR_CALL_VIA_PERMISSION = 32, ACCESS_DENIED_VIA_DEFAULTPERMISSION = 64 }; enum _SecurityOptionsBitness { CurrentBitness = 0, Wow6432Bitness = 1, Wow6464Bitness = 2 }; enum tagORT { ORT_UNUSED = 0, ORT_OBJREF = 1, ORT_LAZY_OBJREF = 2, ORT_AGILE = 4, ORT_LAZY_AGILE = 8, ORT_STREAM = 22, ORT_FREETM = 50 }; enum tagPGALLOCATORFLAGS { PGALLOC_ZEROBRANDNEWPAGES = 1 }; struct STwoBits { void *_hEvent; /* +0x0000 */ unsigned long _dwCookie; /* +0x0004 */ }; struct tagRegIf { void *hServerIf; /* +0x0000 */ unsigned long dwRegFlags; /* +0x0004 */ unsigned char pfnSecurityCB[4]; /* +0x0008 b4 18 00 00 */ }; enum VSAParameterType { = 32771 }; enum eVSAEventFlags { cVSAEventStandard = 0, cVSAEventDefaultSource = 1, cVSAEventDefaultTarget = 2, cVSAEventCanBreak = 4 }; enum VSAStandardParameter { cVSAStandardParameterSourceMachine = 0, cVSAStandardParameterSourceProcess = 1, cVSAStandardParameterSourceThread = 2, cVSAStandardParameterSourceComponent = 3, cVSAStandardParameterSourceSession = 4, cVSAStandardParameterTargetMachine = 5, cVSAStandardParameterTargetProcess = 6, cVSAStandardParameterTargetThread = 7, cVSAStandardParameterTargetComponent = 8, cVSAStandardParameterTargetSession = 9, cVSAStandardParameterSecurityIdentity = 10, cVSAStandardParameterCausalityID = 11, cVSAStandardParameterNoDefault = 16384, cVSAStandardParameterSourceHandle = 16384, cVSAStandardParameterTargetHandle = 16385, cVSAStandardParameterArguments = 16386, cVSAStandardParameterReturnValue = 16387, cVSAStandardParameterException = 16388, cVSAStandardParameterCorrelationID = 16389 }; /* enum <unnamed-tag> { AUMGR_ALLLOCAL = 1, AUMGR_IUNKNOWN = 2, AUMGR_IMULTIQI = 3 }; */ struct <unnamed-type-MTAPendingCallList> { void *pv1; /* +0x0000 */ void *pv2; /* +0x0004 */ }; struct IUnknownVtbl { unsigned char QueryInterface[4]; /* +0x0000 e8 82 00 00 */ unsigned char AddRef[4]; /* +0x0004 ea 82 00 00 */ unsigned char Release[4]; /* +0x0008 ea 82 00 00 */ }; struct IRpcChannelBufferVtbl { unsigned char QueryInterface[4]; /* +0x0000 f2 82 00 00 */ unsigned char AddRef[4]; /* +0x0004 f4 82 00 00 */ unsigned char Release[4]; /* +0x0008 f4 82 00 00 */ unsigned char GetBuffer[4]; /* +0x000c f7 82 00 00 */ unsigned char SendReceive[4]; /* +0x0010 fa 82 00 00 */ unsigned char FreeBuffer[4]; /* +0x0014 fd 82 00 00 */ unsigned char GetDestCtx[4]; /* +0x0018 00 83 00 00 */ unsigned char IsConnected[4]; /* +0x001c 02 83 00 00 */ }; struct IOrpcDebugNotifyVtbl { unsigned char QueryInterface[4]; /* +0x0000 07 83 00 00 */ unsigned char AddRef[4]; /* +0x0004 0a 83 00 00 */ unsigned char Release[4]; /* +0x0008 0a 83 00 00 */ unsigned char ClientGetBufferSize[4]; /* +0x000c 0d 83 00 00 */ unsigned char ClientFillBuffer[4]; /* +0x0010 0d 83 00 00 */ unsigned char ClientNotify[4]; /* +0x0014 0d 83 00 00 */ unsigned char ServerNotify[4]; /* +0x0018 0d 83 00 00 */ unsigned char ServerGetBufferSize[4]; /* +0x001c 0d 83 00 00 */ unsigned char ServerFillBuffer[4]; /* +0x0020 0d 83 00 00 */ }; enum tagROIDFLAG { ROIDF_REGISTER = 1, ROIDF_PING = 2, ROIDF_DEREGISTER = 4, ROIDF_DELETEME = 8 }; struct tagXAptQIData { unsigned char pIPID[4]; /* +0x0000 4a 16 00 00 */ unsigned long cRefs; /* +0x0004 */ unsigned short cIids; /* +0x0008 */ unsigned char iids[4]; /* +0x000c 44 16 00 00 */ unsigned char ppQIResults[4]; /* +0x0010 eb 5d 00 00 */ unsigned char pRemUnk[4]; /* +0x0014 db 61 00 00 */ }; struct tagXAptAddRefData { unsigned short cIfs; /* +0x0000 */ unsigned char pIfRefs[4]; /* +0x0004 ef 5d 00 00 */ unsigned char pResults[4]; /* +0x0008 08 04 00 00 */ unsigned char pRemUnk[4]; /* +0x000c db 61 00 00 */ }; struct tagXAptReleaseData { unsigned short cIfs; /* +0x0000 */ unsigned char pIfRefs[4]; /* +0x0004 ef 5d 00 00 */ unsigned char pRemUnk[4]; /* +0x0008 db 61 00 00 */ }; struct SystemBlockHeader { long lIndex; /* +0x0000 */ unsigned long ulSignature; /* +0x0004 */ }; struct SNameHashNode { unsigned char chain[8]; /* +0x0000 ac 5c 00 00 */ unsigned long dwHash; /* +0x0008 */ unsigned long cRef; /* +0x000c */ unsigned char ipid[16]; /* +0x0010 dc 14 00 00 */ unsigned char sName[8]; /* +0x0020 da 5c 00 00 */ }; struct SNameKey { unsigned char pIpid[4]; /* +0x0000 4a 16 00 00 */ unsigned char pName[4]; /* +0x0004 db 5c 00 00 */ }; struct CVerifierStackData::tagNode { unsigned char lpvStack[4]; /* +0x0000 4f 13 00 00 */ unsigned char listEntry[8]; /* +0x0004 44 1f 00 00 */ }; struct CVerifierTlsData { unsigned char stackComInit[16]; /* +0x0000 54 83 00 00 */ unsigned char stackComUninit[16]; /* +0x0010 54 83 00 00 */ unsigned char stackOLEInit[16]; /* +0x0020 54 83 00 00 */ unsigned char stackOLEUninit[16]; /* +0x0030 54 83 00 00 */ unsigned char stackEnterSWC[16]; /* +0x0040 54 83 00 00 */ unsigned char stackLeaveSWC[16]; /* +0x0050 54 83 00 00 */ unsigned long long AggressiveDllUnloadTicksInSTA; /* +0x0060 */ }; struct VerifierThreadState { unsigned long cComInits; /* +0x0000 */ unsigned long cOleInits; /* +0x0004 */ unsigned char guidContext[16]; /* +0x0008 dc 14 00 00 */ void *pvTopSWCNode; /* +0x0018 */ }; struct VtblSplayNode { unsigned char SplayLinks[12]; /* +0x0000 a1 17 00 00 */ void *pvVtbl; /* +0x000c */ unsigned long cRefs; /* +0x0010 */ }; struct ObjectSplayNode { unsigned char SplayLinks[12]; /* +0x0000 a1 17 00 00 */ void *pvObject; /* +0x000c */ void *pvVtblTracking; /* +0x0010 */ }; struct tagSTREAM_HEADER { unsigned long ulStreamVersion; /* +0x0000 */ unsigned long ulPickledSize; /* +0x0004 */ }; enum MIDL_ES_CODE { MES_ENCODE = 0, MES_DECODE = 1, MES_ENCODE_NDR64 = 2 }; enum MIDL_ES_HANDLE_STYLE { MES_INCREMENTAL_HANDLE = 0, MES_FIXED_BUFFER_HANDLE = 1, MES_DYNAMIC_BUFFER_HANDLE = 2 }; struct CEffPermsCacheLUID::tagCACHE_ENTRY { unsigned char lClient[8]; /* +0x0000 21 15 00 00 */ unsigned long dwEffectivePermissions; /* +0x0008 */ }; struct tagSTREAM_ACL { unsigned long ulNumOfDenyEntries; /* +0x0000 */ unsigned long ulNumOfGrantEntries; /* +0x0004 */ unsigned char pACL[4]; /* +0x0008 e5 83 00 00 */ }; struct tagACL_DESCRIPTOR { void *pACLBuffer; /* +0x0000 */ unsigned long ulACLBufferSize; /* +0x0004 */ unsigned long ulSIDSize; /* +0x0008 */ unsigned char bDirtyACL[4]; /* +0x000c 74 00 00 00 */ unsigned char SecDesc[20]; /* +0x0010 ae 4d 00 00 */ }; struct tagSTREAM_ACE { unsigned long grfAccessPermissions; /* +0x0000 */ unsigned char grfAccessMode[4]; /* +0x0004 20 84 00 00 */ unsigned char TrusteeType[4]; /* +0x0008 b2 7c 00 00 */ unsigned char TrusteeForm[4]; /* +0x000c b1 7c 00 00 */ unsigned char pTrusteeName[4]; /* +0x0010 71 04 00 00 */ unsigned char pSID[4]; /* +0x0014 22 84 00 00 */ }; struct tagPCB { char *pPicklingBuff; /* +0x0000 */ char *pTruePicklingBuff; /* +0x0004 */ unsigned long ulPicklingBuffSize; /* +0x0008 */ unsigned long ulBytesUsed; /* +0x000c */ unsigned char StreamACL[12]; /* +0x0010 25 84 00 00 */ void *PickleHandle; /* +0x001c */ unsigned char bDirtyHandle[4]; /* +0x0020 74 00 00 00 */ unsigned char bPickled[4]; /* +0x0024 74 00 00 00 */ unsigned long ulMaxNumOfStreamACEs; /* +0x0028 */ unsigned long ulNumOfStreamACEs; /* +0x002c */ }; struct tagSTREAM_SID { unsigned char Revision; /* +0x0000 */ unsigned char SubAuthorityCount; /* +0x0001 */ unsigned char IdentifierAuthority[6]; /* +0x0002 3a 84 00 00 */ unsigned char SubAuthority[4]; /* +0x0008 f6 12 00 00 */ }; enum _ACCESS_MODE { NOT_USED_ACCESS = 0, GRANT_ACCESS = 1, SET_ACCESS = 2, DENY_ACCESS = 3, REVOKE_ACCESS = 4, SET_AUDIT_SUCCESS = 5, SET_AUDIT_FAILURE = 6 }; enum _SE_OBJECT_TYPE { SE_UNKNOWN_OBJECT_TYPE = 0, SE_FILE_OBJECT = 1, SE_SERVICE = 2, SE_PRINTER = 3, SE_REGISTRY_KEY = 4, SE_LMSHARE = 5, SE_KERNEL_OBJECT = 6, SE_WINDOW_OBJECT = 7, SE_DS_OBJECT = 8, SE_DS_OBJECT_ALL = 9, SE_PROVIDER_DEFINED_OBJECT = 10, SE_WMIGUID_OBJECT = 11, SE_REGISTRY_WOW64_32KEY = 12 }; struct _MIDL_STUB_DESC { void *RpcInterfaceInformation; /* +0x0000 */ unsigned char pfnAllocate[4]; /* +0x0004 66 19 00 00 */ unsigned char pfnFree[4]; /* +0x0008 c7 13 00 00 */ unsigned char IMPLICIT_HANDLE_INFO[4]; /* +0x000c 74 84 00 00 */ unsigned char apfnNdrRundownRoutines[4]; /* +0x0010 00 1a 00 00 */ unsigned char aGenericBindingRoutinePairs[4]; /* +0x0014 03 1a 00 00 */ unsigned char apfnExprEval[4]; /* +0x0018 09 1a 00 00 */ unsigned char aXmitQuintuple[4]; /* +0x001c 0c 1a 00 00 */ unsigned char pFormatTypes[4]; /* +0x0020 39 19 00 00 */ unsigned char fCheckBounds[4]; /* +0x0024 74 00 00 00 */ unsigned long Version; /* +0x0028 */ unsigned char pMallocFreeStruct[4]; /* +0x002c 0e 1a 00 00 */ long MIDLVersion; /* +0x0030 */ unsigned char CommFaultOffsets[4]; /* +0x0034 11 1a 00 00 */ unsigned char aUserMarshalQuadruple[4]; /* +0x0038 14 1a 00 00 */ unsigned char NotifyRoutineTable[4]; /* +0x003c 17 1a 00 00 */ unsigned long mFlags; /* +0x0040 */ unsigned char CsRoutineTables[4]; /* +0x0044 1a 1a 00 00 */ void *ProxyServerInfo; /* +0x0048 */ unsigned char pExprInfo[4]; /* +0x004c 1d 1a 00 00 */ }; enum _PROGRESS_INVOKE_SETTING { ProgressInvokeNever = 1, ProgressInvokeEveryObject = 2, ProgressInvokeOnError = 3, ProgressCancelOperation = 4, ProgressRetryOperation = 5, ProgressInvokePrePostError = 6 }; struct _MIDL_TYPE_PICKLING_INFO { unsigned long Version; /* +0x0000 */ unsigned long Flags; /* +0x0004 */ unsigned char Reserved[12]; /* +0x0008 79 84 00 00 */ }; struct _acpickl_MIDL_TYPE_FORMAT_STRING { short Pad; /* +0x0000 */ unsigned char Format[122]; /* +0x0002 7c 84 00 00 */ }; struct _acpickl_MIDL_EXPR_FORMAT_STRING { long Pad; /* +0x0000 */ unsigned char Format[16]; /* +0x0004 7f 84 00 00 */ }; struct _acpickl_MIDL_PROC_FORMAT_STRING { short Pad; /* +0x0000 */ unsigned char Format[2]; /* +0x0002 f9 12 00 00 */ }; enum RO_ERROR_REPORTING_FLAGS { RO_ERROR_REPORTING_NONE = 0, RO_ERROR_REPORTING_SUPPRESSEXCEPTIONS = 1, RO_ERROR_REPORTING_FORCEEXCEPTIONS = 2, RO_ERROR_REPORTING_USESETERRORINFO = 4, RO_ERROR_REPORTING_SUPPRESSSETERRORINFO = 8 }; enum Windows::Foundation::Diagnostics::RoErrorReportingFlags { None = 0, SuppressExceptions = 1, ForceExceptions = 2, UseSetErrorInfo = 4, SuppressSetErrorInfo = 8 }; enum LoadOrFreeWhy { LoadingInprocServer = 0, CoLoadLibraryCalled = 1, CoFreeLibraryCalled = 2, FailedToCreateAPathEntry = 3, AnotherThreadBeatUsHere = 4, NoValidEntryPoint = 5, NoLongerInUse = 6 }; enum tagHOSTDLLFLAGS { HDLLF_SINGLETHREADED = 1, HDLLF_APARTMENTTHREADED = 2, HDLLF_MULTITHREADED = 4, HDLLF_NEUTRALTHREADED = 8, HDLLF_APPLICATIONSTA = 16, HDLLF_HOSTTYPEMASK = 31, HDLLF_COMAPARTMENT = 32, HDLLF_SHUTTINGDOWN = 256 }; enum CClassCache::GetOrLoadWinRTInprocClass::__l2::<unnamed-type-activationLocation> { Here = 0, CrossApartmentASTA = 1, CrossApartmentMTA = 2 }; struct CClassCache::ReleaseCatalogObjects::__l2::STmpCI { unsigned char arCI[40]; /* +0x0000 2a 85 00 00 */ unsigned char pNext[4]; /* +0x0028 29 85 00 00 */ }; enum __MIDL_IDLLHost_0001 { DLLHOST_IS_DPE = 1, DLLHOST_IS_PFN = 2 }; struct tagSDBQUERYRESULT { unsigned char atrExes[64]; /* +0x0000 43 27 00 00 */ unsigned char adwExeFlags[64]; /* +0x0040 43 27 00 00 */ unsigned char atrLayers[32]; /* +0x0080 75 46 00 00 */ unsigned long dwLayerFlags; /* +0x00a0 */ unsigned long trAppHelp; /* +0x00a4 */ unsigned long dwExeCount; /* +0x00a8 */ unsigned long dwLayerCount; /* +0x00ac */ unsigned char guidID[16]; /* +0x00b0 dc 14 00 00 */ unsigned long dwExtraFlags; /* +0x00c0 */ unsigned long dwCustomSDBMap; /* +0x00c4 */ unsigned char rgGuidDB[256]; /* +0x00c8 53 85 00 00 */ }; struct tagAPPCOMPAT_EXE_DATA { unsigned char szShimEngine[520]; /* +0x0000 e4 15 00 00 */ unsigned long cbSize; /* +0x0208 */ unsigned long dwMagic; /* +0x020c */ unsigned short uExeType; /* +0x0210 */ unsigned char SdbQueryResult[460]; /* +0x0214 5b 85 00 00 */ unsigned char DbgLogChannels[1024]; /* +0x03e0 5c 85 00 00 */ unsigned char SwitchContext[1024]; /* +0x07e0 5c 85 00 00 */ unsigned short uParentExeType; /* +0x0be0 */ unsigned long dwParentProcessId; /* +0x0be4 */ unsigned char szParentImageName[520]; /* +0x0be8 e4 15 00 00 */ unsigned char szParentMitigations[512]; /* +0x0df0 3c 17 00 00 */ unsigned char szActiveCompatLayers[512]; /* +0x0ff0 3c 17 00 00 */ unsigned long ulSubSystemType; /* +0x11f0 */ unsigned short uSubSystemMinorVersion; /* +0x11f4 */ unsigned short uSubSystemMajorVersion; /* +0x11f6 */ unsigned long dwReason; /* +0x11f8 */ unsigned char bLatestOs[4]; /* +0x11fc 74 00 00 00 */ unsigned char bPackageId[4]; /* +0x1200 74 00 00 00 */ unsigned char bSwitchBackManifest[4]; /* +0x1204 74 00 00 00 */ unsigned char bUacManifest[4]; /* +0x1208 74 00 00 00 */ unsigned char bLegacyInstaller[4]; /* +0x120c 74 00 00 00 */ unsigned char bSystem[4]; /* +0x1210 74 00 00 00 */ unsigned long dwRunLevel; /* +0x1214 */ unsigned long dwElevationReason; /* +0x1218 */ unsigned long dwElevationFlags; /* +0x121c */ unsigned long dwInstallerFlags; /* +0x1220 */ unsigned long ulSamplingFlag; /* +0x1224 */ void *pAmiStoreHandle; /* +0x1228 */ void *pHookCOM; /* +0x1230 */ }; struct ServerContextWorkData { unsigned char pInActProps[4]; /* +0x0000 b1 5b 00 00 */ unsigned char xrpcOutProps[36]; /* +0x0004 7c 5e 00 00 */ }; enum PUSHSTATE { PUSHSTATE0_ENTRY = 0, PUSHSTATE1_FIRSTCALL = 1, PUSHSTATE2_FS_PSgeFS = 2, PUSHSTATE3_FS_PSltFS = 3, PUSHSTATE4_FS_PSZERO = 4, PUSHSTATE5_DONE_ERROR = 5 }; enum PULLSTATE { PULLSTATE0_ENTRY = 0, PULLSTATE1_FIRST_CALL = 1, PULLSTATE2_NS_RQlsRA = 2, PULLSTATE3_NS_RQgeRA = 3, PULLSTATE4_S_RQlsBS = 4, PULLSTATE5_S_RQgeBS = 5, PULLSTATE6_DONE = 6 }; struct RegistryKeyValue { unsigned char key[4]; /* +0x0000 71 04 00 00 */ unsigned char value[4]; /* +0x0004 71 04 00 00 */ }; struct tagCStdPSFactoryBuffer { unsigned char lpVtbl[4]; /* +0x0000 4c 87 00 00 */ long RefCount; /* +0x0004 */ unsigned char pProxyFileList[4]; /* +0x0008 50 87 00 00 */ long Filler1; /* +0x000c */ }; struct tagCInterfaceStubHeader { unsigned char piid[4]; /* +0x0000 4a 16 00 00 */ unsigned char pServerInfo[4]; /* +0x0004 58 87 00 00 */ unsigned long DispatchTableCount; /* +0x0008 */ unsigned char pDispatchTable[4]; /* +0x000c 5a 87 00 00 */ }; struct IRpcProxyBufferVtbl { unsigned char QueryInterface[4]; /* +0x0000 5f 87 00 00 */ unsigned char AddRef[4]; /* +0x0004 62 87 00 00 */ unsigned char Release[4]; /* +0x0008 62 87 00 00 */ unsigned char Connect[4]; /* +0x000c 65 87 00 00 */ unsigned char Disconnect[4]; /* +0x0010 67 87 00 00 */ }; struct tagCInterfaceStubVtbl { unsigned char header[16]; /* +0x0000 6a 87 00 00 */ unsigned char Vtbl[40]; /* +0x0010 6b 87 00 00 */ }; struct tagProxyFileInfo { unsigned char pProxyVtblList[4]; /* +0x0000 75 87 00 00 */ unsigned char pStubVtblList[4]; /* +0x0004 77 87 00 00 */ unsigned char pNamesArray[4]; /* +0x0008 78 87 00 00 */ unsigned char pDelegatedIIDs[4]; /* +0x000c 79 87 00 00 */ unsigned char pIIDLookupRtn[4]; /* +0x0010 7a 87 00 00 */ unsigned short TableSize; /* +0x0014 */ unsigned short TableVersion; /* +0x0016 */ unsigned char pAsyncIIDLookup[4]; /* +0x0018 79 87 00 00 */ long Filler2; /* +0x001c */ long Filler3; /* +0x0020 */ long Filler4; /* +0x0024 */ }; struct tagCInterfaceProxyVtbl { unsigned char header[4]; /* +0x0000 7d 87 00 00 */ /* unsigned char Vtbl[0]; +0x0004 7e 87 00 00 */ }; struct tagCInterfaceProxyHeader { unsigned char piid[4]; /* +0x0000 4a 16 00 00 */ }; struct IPSFactoryBufferVtbl { unsigned char QueryInterface[4]; /* +0x0000 86 87 00 00 */ unsigned char AddRef[4]; /* +0x0004 89 87 00 00 */ unsigned char Release[4]; /* +0x0008 89 87 00 00 */ unsigned char CreateProxy[4]; /* +0x000c 8c 87 00 00 */ unsigned char CreateStub[4]; /* +0x0010 8f 87 00 00 */ }; struct IRpcStubBufferVtbl { unsigned char QueryInterface[4]; /* +0x0000 94 87 00 00 */ unsigned char AddRef[4]; /* +0x0004 97 87 00 00 */ unsigned char Release[4]; /* +0x0008 97 87 00 00 */ unsigned char Connect[4]; /* +0x000c 9a 87 00 00 */ unsigned char Disconnect[4]; /* +0x0010 9c 87 00 00 */ unsigned char Invoke[4]; /* +0x0014 9f 87 00 00 */ unsigned char IsIIDSupported[4]; /* +0x0018 a2 87 00 00 */ unsigned char CountRefs[4]; /* +0x001c 97 87 00 00 */ unsigned char DebugServerQueryInterface[4]; /* +0x0020 a5 87 00 00 */ unsigned char DebugServerRelease[4]; /* +0x0024 a8 87 00 00 */ }; /* struct <unnamed-tag> { unsigned char header[8]; +0x0000 7d 87 00 00 unsigned char Vtbl[36]; +0x0008 66 2e 00 00 }; */ struct _MIDL_SERVER_INFO_ { unsigned char pStubDesc[4]; /* +0x0000 33 29 00 00 */ unsigned char DispatchTable[4]; /* +0x0004 b7 87 00 00 */ unsigned char ProcString[4]; /* +0x0008 39 19 00 00 */ unsigned char FmtStringOffset[4]; /* +0x000c 3b 19 00 00 */ unsigned char ThunkTable[4]; /* +0x0010 09 1a 00 00 */ unsigned char pTransferSyntax[4]; /* +0x0014 ec 23 00 00 */ unsigned long nCount; /* +0x0018 */ unsigned char pSyntaxInfo[4]; /* +0x001c aa 20 00 00 */ }; /* struct <unnamed-tag> { unsigned char header[8]; +0x0000 7d 87 00 00 unsigned char Vtbl[60]; +0x0008 ba 87 00 00 }; */ /* struct <unnamed-tag> { unsigned char header[8]; +0x0000 7d 87 00 00 unsigned char Vtbl[20]; +0x0008 d6 42 00 00 }; */ /* struct <unnamed-tag> { unsigned char header[8]; +0x0000 7d 87 00 00 unsigned char Vtbl[40]; +0x0008 c6 87 00 00 }; */ struct _mega_MIDL_EXPR_FORMAT_STRING { long Pad; /* +0x0000 */ unsigned char Format[32]; /* +0x0004 4e 4d 00 00 */ }; /* struct <unnamed-tag> { unsigned char header[8]; +0x0000 7d 87 00 00 unsigned char Vtbl[48]; +0x0008 d3 87 00 00 }; */ /* struct <unnamed-tag> { unsigned char header[8]; +0x0000 7d 87 00 00 unsigned char Vtbl[44]; +0x0008 d6 87 00 00 }; */ /* struct <unnamed-tag> { unsigned char header[8]; +0x0000 7d 87 00 00 unsigned char Vtbl[16]; +0x0008 84 2a 00 00 }; */ struct _mega_MIDL_PROC_FORMAT_STRING { short Pad; /* +0x0000 */ unsigned char Format[14252]; /* +0x0002 db 87 00 00 */ }; /* struct <unnamed-tag> { unsigned char header[8]; +0x0000 7d 87 00 00 unsigned char Vtbl[52]; +0x0008 df 87 00 00 }; */ /* struct <unnamed-tag> { unsigned char header[8]; +0x0000 7d 87 00 00 unsigned char Vtbl[28]; +0x0008 e2 87 00 00 }; */ /* struct <unnamed-tag> { unsigned char header[8]; +0x0000 7d 87 00 00 unsigned char Vtbl[24]; +0x0008 e6 87 00 00 }; */ /* struct <unnamed-tag> { unsigned char header[8]; +0x0000 7d 87 00 00 unsigned char Vtbl[32]; +0x0008 cb 73 00 00 }; */ /* struct <unnamed-tag> { unsigned char header[8]; +0x0000 7d 87 00 00 unsigned char Vtbl[56]; +0x0008 ee 87 00 00 }; */ enum tagExtentMode { DVEXTENT_CONTENT = 0, DVEXTENT_INTEGRAL = 1 }; /* struct <unnamed-tag> { unsigned char header[8]; +0x0000 7d 87 00 00 unsigned char Vtbl[96]; +0x0008 f8 87 00 00 }; */ /* struct <unnamed-tag> { unsigned char header[8]; +0x0000 7d 87 00 00 unsigned char Vtbl[72]; +0x0008 fc 87 00 00 }; */ /* struct <unnamed-tag> { unsigned char header[8]; +0x0000 7d 87 00 00 unsigned char Vtbl[68]; +0x0008 00 88 00 00 }; */ /* struct <unnamed-tag> { unsigned char header[8]; +0x0000 7d 87 00 00 unsigned char Vtbl[92]; +0x0008 03 88 00 00 }; */ struct _mega_MIDL_TYPE_FORMAT_STRING { short Pad; /* +0x0000 */ unsigned char Format[7332]; /* +0x0002 0a 88 00 00 */ }; struct IRunningObjectTableVtbl { unsigned char QueryInterface[4]; /* +0x0000 12 88 00 00 */ unsigned char AddRef[4]; /* +0x0004 15 88 00 00 */ unsigned char Release[4]; /* +0x0008 15 88 00 00 */ unsigned char Register[4]; /* +0x000c 18 88 00 00 */ unsigned char Revoke[4]; /* +0x0010 1b 88 00 00 */ unsigned char IsRunning[4]; /* +0x0014 1e 88 00 00 */ unsigned char GetObjectW[4]; /* +0x0018 21 88 00 00 */ unsigned char NoteChangeTime[4]; /* +0x001c 24 88 00 00 */ unsigned char GetTimeOfLastChange[4]; /* +0x0020 27 88 00 00 */ unsigned char EnumRunning[4]; /* +0x0024 2a 88 00 00 */ }; struct IConnectionPointContainerVtbl { unsigned char QueryInterface[4]; /* +0x0000 31 88 00 00 */ unsigned char AddRef[4]; /* +0x0004 34 88 00 00 */ unsigned char Release[4]; /* +0x0008 34 88 00 00 */ unsigned char EnumConnectionPoints[4]; /* +0x000c 3a 88 00 00 */ unsigned char FindConnectionPoint[4]; /* +0x0010 40 88 00 00 */ }; struct IConnectionPointContainer { unsigned char lpVtbl[4]; /* +0x0000 44 88 00 00 */ }; struct IConnectionPointVtbl { unsigned char QueryInterface[4]; /* +0x0000 49 88 00 00 */ unsigned char AddRef[4]; /* +0x0004 4c 88 00 00 */ unsigned char Release[4]; /* +0x0008 4c 88 00 00 */ unsigned char GetConnectionInterface[4]; /* +0x000c 4f 88 00 00 */ unsigned char GetConnectionPointContainer[4]; /* +0x0010 53 88 00 00 */ unsigned char Advise[4]; /* +0x0014 56 88 00 00 */ unsigned char Unadvise[4]; /* +0x0018 59 88 00 00 */ unsigned char EnumConnections[4]; /* +0x001c 5f 88 00 00 */ }; struct IStorageVtbl { unsigned char QueryInterface[4]; /* +0x0000 64 88 00 00 */ unsigned char AddRef[4]; /* +0x0004 66 88 00 00 */ unsigned char Release[4]; /* +0x0008 66 88 00 00 */ unsigned char CreateStream[4]; /* +0x000c 69 88 00 00 */ unsigned char OpenStream[4]; /* +0x0010 6c 88 00 00 */ unsigned char CreateStorage[4]; /* +0x0014 6f 88 00 00 */ unsigned char OpenStorage[4]; /* +0x0018 72 88 00 00 */ unsigned char CopyTo[4]; /* +0x001c 75 88 00 00 */ unsigned char MoveElementTo[4]; /* +0x0020 78 88 00 00 */ unsigned char Commit[4]; /* +0x0024 7b 88 00 00 */ unsigned char Revert[4]; /* +0x0028 7d 88 00 00 */ unsigned char EnumElements[4]; /* +0x002c 80 88 00 00 */ unsigned char DestroyElement[4]; /* +0x0030 82 88 00 00 */ unsigned char RenameElement[4]; /* +0x0034 85 88 00 00 */ unsigned char SetElementTimes[4]; /* +0x0038 88 88 00 00 */ unsigned char SetClass[4]; /* +0x003c 8b 88 00 00 */ unsigned char SetStateBits[4]; /* +0x0040 8e 88 00 00 */ unsigned char Stat[4]; /* +0x0044 91 88 00 00 */ }; struct IEnumConnectionPointsVtbl { unsigned char QueryInterface[4]; /* +0x0000 96 88 00 00 */ unsigned char AddRef[4]; /* +0x0004 99 88 00 00 */ unsigned char Release[4]; /* +0x0008 99 88 00 00 */ unsigned char Next[4]; /* +0x000c 9c 88 00 00 */ unsigned char Skip[4]; /* +0x0010 9f 88 00 00 */ unsigned char Reset[4]; /* +0x0014 a1 88 00 00 */ unsigned char Clone[4]; /* +0x0018 a4 88 00 00 */ }; struct IEnumUnknownVtbl { unsigned char QueryInterface[4]; /* +0x0000 a9 88 00 00 */ unsigned char AddRef[4]; /* +0x0004 ac 88 00 00 */ unsigned char Release[4]; /* +0x0008 ac 88 00 00 */ unsigned char Next[4]; /* +0x000c af 88 00 00 */ unsigned char Skip[4]; /* +0x0010 b2 88 00 00 */ unsigned char Reset[4]; /* +0x0014 b4 88 00 00 */ unsigned char Clone[4]; /* +0x0018 b7 88 00 00 */ }; struct IOleInPlaceUIWindowVtbl { unsigned char QueryInterface[4]; /* +0x0000 bd 88 00 00 */ unsigned char AddRef[4]; /* +0x0004 c0 88 00 00 */ unsigned char Release[4]; /* +0x0008 c0 88 00 00 */ unsigned char GetWindow[4]; /* +0x000c c3 88 00 00 */ unsigned char ContextSensitiveHelp[4]; /* +0x0010 c6 88 00 00 */ unsigned char GetBorder[4]; /* +0x0014 c9 88 00 00 */ unsigned char RequestBorderSpace[4]; /* +0x0018 cc 88 00 00 */ unsigned char SetBorderSpace[4]; /* +0x001c cc 88 00 00 */ unsigned char SetActiveObject[4]; /* +0x0020 cf 88 00 00 */ }; struct IAdviseSink2Vtbl { unsigned char QueryInterface[4]; /* +0x0000 d4 88 00 00 */ unsigned char AddRef[4]; /* +0x0004 d7 88 00 00 */ unsigned char Release[4]; /* +0x0008 d7 88 00 00 */ unsigned char OnDataChange[4]; /* +0x000c da 88 00 00 */ unsigned char OnViewChange[4]; /* +0x0010 dd 88 00 00 */ unsigned char OnRename[4]; /* +0x0014 e0 88 00 00 */ unsigned char OnSave[4]; /* +0x0018 e2 88 00 00 */ unsigned char OnClose[4]; /* +0x001c e2 88 00 00 */ unsigned char OnLinkSrcChange[4]; /* +0x0020 e0 88 00 00 */ }; struct IFillLockBytesVtbl { unsigned char QueryInterface[4]; /* +0x0000 e8 88 00 00 */ unsigned char AddRef[4]; /* +0x0004 eb 88 00 00 */ unsigned char Release[4]; /* +0x0008 eb 88 00 00 */ unsigned char FillAppend[4]; /* +0x000c ee 88 00 00 */ unsigned char FillAt[4]; /* +0x0010 f1 88 00 00 */ unsigned char SetFillSize[4]; /* +0x0014 f4 88 00 00 */ unsigned char Terminate[4]; /* +0x0018 f7 88 00 00 */ }; struct IEnumConnections { unsigned char lpVtbl[4]; /* +0x0000 fb 88 00 00 */ }; struct IContinueVtbl { unsigned char QueryInterface[4]; /* +0x0000 00 89 00 00 */ unsigned char AddRef[4]; /* +0x0004 03 89 00 00 */ unsigned char Release[4]; /* +0x0008 03 89 00 00 */ unsigned char FContinue[4]; /* +0x000c 05 89 00 00 */ }; struct IViewObjectVtbl { unsigned char QueryInterface[4]; /* +0x0000 0a 89 00 00 */ unsigned char AddRef[4]; /* +0x0004 0d 89 00 00 */ unsigned char Release[4]; /* +0x0008 0d 89 00 00 */ unsigned char Draw[4]; /* +0x000c 10 89 00 00 */ unsigned char GetColorSet[4]; /* +0x0010 13 89 00 00 */ unsigned char Freeze[4]; /* +0x0014 16 89 00 00 */ unsigned char Unfreeze[4]; /* +0x0018 19 89 00 00 */ unsigned char SetAdvise[4]; /* +0x001c 1c 89 00 00 */ unsigned char GetAdvise[4]; /* +0x0020 1f 89 00 00 */ }; struct IBindCtxVtbl { unsigned char QueryInterface[4]; /* +0x0000 24 89 00 00 */ unsigned char AddRef[4]; /* +0x0004 26 89 00 00 */ unsigned char Release[4]; /* +0x0008 26 89 00 00 */ unsigned char RegisterObjectBound[4]; /* +0x000c 29 89 00 00 */ unsigned char RevokeObjectBound[4]; /* +0x0010 29 89 00 00 */ unsigned char ReleaseBoundObjects[4]; /* +0x0014 2b 89 00 00 */ unsigned char SetBindOptions[4]; /* +0x0018 2e 89 00 00 */ unsigned char GetBindOptions[4]; /* +0x001c 2e 89 00 00 */ unsigned char GetRunningObjectTable[4]; /* +0x0020 31 89 00 00 */ unsigned char RegisterObjectParam[4]; /* +0x0024 34 89 00 00 */ unsigned char GetObjectParam[4]; /* +0x0028 37 89 00 00 */ unsigned char EnumObjectParam[4]; /* +0x002c 3a 89 00 00 */ unsigned char RevokeObjectParam[4]; /* +0x0030 3d 89 00 00 */ }; struct IEnumOLEVERBVtbl { unsigned char QueryInterface[4]; /* +0x0000 42 89 00 00 */ unsigned char AddRef[4]; /* +0x0004 45 89 00 00 */ unsigned char Release[4]; /* +0x0008 45 89 00 00 */ unsigned char Next[4]; /* +0x000c 48 89 00 00 */ unsigned char Skip[4]; /* +0x0010 4b 89 00 00 */ unsigned char Reset[4]; /* +0x0014 4d 89 00 00 */ unsigned char Clone[4]; /* +0x0018 50 89 00 00 */ }; struct AsyncIAdviseSinkVtbl { unsigned char QueryInterface[4]; /* +0x0000 56 89 00 00 */ unsigned char AddRef[4]; /* +0x0004 59 89 00 00 */ unsigned char Release[4]; /* +0x0008 59 89 00 00 */ unsigned char Begin_OnDataChange[4]; /* +0x000c 5c 89 00 00 */ unsigned char Finish_OnDataChange[4]; /* +0x0010 5e 89 00 00 */ unsigned char Begin_OnViewChange[4]; /* +0x0014 61 89 00 00 */ unsigned char Finish_OnViewChange[4]; /* +0x0018 5e 89 00 00 */ unsigned char Begin_OnRename[4]; /* +0x001c 64 89 00 00 */ unsigned char Finish_OnRename[4]; /* +0x0020 5e 89 00 00 */ unsigned char Begin_OnSave[4]; /* +0x0024 5e 89 00 00 */ unsigned char Finish_OnSave[4]; /* +0x0028 5e 89 00 00 */ unsigned char Begin_OnClose[4]; /* +0x002c 5e 89 00 00 */ unsigned char Finish_OnClose[4]; /* +0x0030 5e 89 00 00 */ }; struct IOleCache2Vtbl { unsigned char QueryInterface[4]; /* +0x0000 69 89 00 00 */ unsigned char AddRef[4]; /* +0x0004 6c 89 00 00 */ unsigned char Release[4]; /* +0x0008 6c 89 00 00 */ unsigned char Cache[4]; /* +0x000c 6f 89 00 00 */ unsigned char Uncache[4]; /* +0x0010 72 89 00 00 */ unsigned char EnumCache[4]; /* +0x0014 75 89 00 00 */ unsigned char InitCache[4]; /* +0x0018 78 89 00 00 */ unsigned char SetData[4]; /* +0x001c 7b 89 00 00 */ unsigned char UpdateCache[4]; /* +0x0020 7e 89 00 00 */ unsigned char DiscardCache[4]; /* +0x0024 72 89 00 00 */ }; struct IEnumConnectionPoints { unsigned char lpVtbl[4]; /* +0x0000 82 89 00 00 */ }; struct IEnumStringVtbl { unsigned char QueryInterface[4]; /* +0x0000 87 89 00 00 */ unsigned char AddRef[4]; /* +0x0004 8a 89 00 00 */ unsigned char Release[4]; /* +0x0008 8a 89 00 00 */ unsigned char Next[4]; /* +0x000c 8d 89 00 00 */ unsigned char Skip[4]; /* +0x0010 8f 89 00 00 */ unsigned char Reset[4]; /* +0x0014 91 89 00 00 */ unsigned char Clone[4]; /* +0x0018 94 89 00 00 */ }; struct ISequentialStreamVtbl { unsigned char QueryInterface[4]; /* +0x0000 9a 89 00 00 */ unsigned char AddRef[4]; /* +0x0004 9d 89 00 00 */ unsigned char Release[4]; /* +0x0008 9d 89 00 00 */ unsigned char Read[4]; /* +0x000c a0 89 00 00 */ unsigned char Write[4]; /* +0x0010 a3 89 00 00 */ }; struct tagCONNECTDATA { unsigned char pUnk[4]; /* +0x0000 7f 17 00 00 */ unsigned long dwCookie; /* +0x0004 */ }; struct ILockBytesVtbl { unsigned char QueryInterface[4]; /* +0x0000 aa 89 00 00 */ unsigned char AddRef[4]; /* +0x0004 ac 89 00 00 */ unsigned char Release[4]; /* +0x0008 ac 89 00 00 */ unsigned char ReadAt[4]; /* +0x000c af 89 00 00 */ unsigned char WriteAt[4]; /* +0x0010 b2 89 00 00 */ unsigned char Flush[4]; /* +0x0014 b4 89 00 00 */ unsigned char SetSize[4]; /* +0x0018 b7 89 00 00 */ unsigned char LockRegion[4]; /* +0x001c ba 89 00 00 */ unsigned char UnlockRegion[4]; /* +0x0020 ba 89 00 00 */ unsigned char Stat[4]; /* +0x0024 bd 89 00 00 */ }; struct IRunnableObjectVtbl { unsigned char QueryInterface[4]; /* +0x0000 c2 89 00 00 */ unsigned char AddRef[4]; /* +0x0004 c5 89 00 00 */ unsigned char Release[4]; /* +0x0008 c5 89 00 00 */ unsigned char GetRunningClass[4]; /* +0x000c c8 89 00 00 */ unsigned char Run[4]; /* +0x0010 cb 89 00 00 */ unsigned char IsRunning[4]; /* +0x0014 cd 89 00 00 */ unsigned char LockRunning[4]; /* +0x0018 d0 89 00 00 */ unsigned char SetContainedObject[4]; /* +0x001c d3 89 00 00 */ }; struct IEnumSTATDATAVtbl { unsigned char QueryInterface[4]; /* +0x0000 d8 89 00 00 */ unsigned char AddRef[4]; /* +0x0004 db 89 00 00 */ unsigned char Release[4]; /* +0x0008 db 89 00 00 */ unsigned char Next[4]; /* +0x000c de 89 00 00 */ unsigned char Skip[4]; /* +0x0010 e1 89 00 00 */ unsigned char Reset[4]; /* +0x0014 e3 89 00 00 */ unsigned char Clone[4]; /* +0x0018 e6 89 00 00 */ }; struct IConnectionPoint { unsigned char lpVtbl[4]; /* +0x0000 ea 89 00 00 */ }; struct IEnumSTATSTGVtbl { unsigned char QueryInterface[4]; /* +0x0000 ef 89 00 00 */ unsigned char AddRef[4]; /* +0x0004 f2 89 00 00 */ unsigned char Release[4]; /* +0x0008 f2 89 00 00 */ unsigned char Next[4]; /* +0x000c f5 89 00 00 */ unsigned char Skip[4]; /* +0x0010 f8 89 00 00 */ unsigned char Reset[4]; /* +0x0014 fa 89 00 00 */ unsigned char Clone[4]; /* +0x0018 fd 89 00 00 */ }; struct tagCInterfaceProxyVtbl { unsigned char header[8]; /* +0x0000 7d 87 00 00 */ /* unsigned char Vtbl[0]; +0x0008 7e 87 00 00 */ }; struct IClassFactoryVtbl { unsigned char QueryInterface[4]; /* +0x0000 06 8a 00 00 */ unsigned char AddRef[4]; /* +0x0004 08 8a 00 00 */ unsigned char Release[4]; /* +0x0008 08 8a 00 00 */ unsigned char CreateInstance[4]; /* +0x000c 0b 8a 00 00 */ unsigned char LockServer[4]; /* +0x0010 0e 8a 00 00 */ }; struct IDataObjectVtbl { unsigned char QueryInterface[4]; /* +0x0000 13 8a 00 00 */ unsigned char AddRef[4]; /* +0x0004 15 8a 00 00 */ unsigned char Release[4]; /* +0x0008 15 8a 00 00 */ unsigned char GetData[4]; /* +0x000c 18 8a 00 00 */ unsigned char GetDataHere[4]; /* +0x0010 18 8a 00 00 */ unsigned char QueryGetData[4]; /* +0x0014 1b 8a 00 00 */ unsigned char GetCanonicalFormatEtc[4]; /* +0x0018 1e 8a 00 00 */ unsigned char SetData[4]; /* +0x001c 21 8a 00 00 */ unsigned char EnumFormatEtc[4]; /* +0x0020 24 8a 00 00 */ unsigned char DAdvise[4]; /* +0x0024 26 8a 00 00 */ unsigned char DUnadvise[4]; /* +0x0028 29 8a 00 00 */ unsigned char EnumDAdvise[4]; /* +0x002c 2c 8a 00 00 */ }; struct IAdviseSinkVtbl { unsigned char QueryInterface[4]; /* +0x0000 31 8a 00 00 */ unsigned char AddRef[4]; /* +0x0004 34 8a 00 00 */ unsigned char Release[4]; /* +0x0008 34 8a 00 00 */ unsigned char OnDataChange[4]; /* +0x000c 37 8a 00 00 */ unsigned char OnViewChange[4]; /* +0x0010 3a 8a 00 00 */ unsigned char OnRename[4]; /* +0x0014 3d 8a 00 00 */ unsigned char OnSave[4]; /* +0x0018 3f 8a 00 00 */ unsigned char OnClose[4]; /* +0x001c 3f 8a 00 00 */ }; struct IEnumConnectionsVtbl { unsigned char QueryInterface[4]; /* +0x0000 44 8a 00 00 */ unsigned char AddRef[4]; /* +0x0004 47 8a 00 00 */ unsigned char Release[4]; /* +0x0008 47 8a 00 00 */ unsigned char Next[4]; /* +0x000c 4a 8a 00 00 */ unsigned char Skip[4]; /* +0x0010 4d 8a 00 00 */ unsigned char Reset[4]; /* +0x0014 4f 8a 00 00 */ unsigned char Clone[4]; /* +0x0018 52 8a 00 00 */ }; struct AsyncIAdviseSink2Vtbl { unsigned char QueryInterface[4]; /* +0x0000 58 8a 00 00 */ unsigned char AddRef[4]; /* +0x0004 5b 8a 00 00 */ unsigned char Release[4]; /* +0x0008 5b 8a 00 00 */ unsigned char Begin_OnDataChange[4]; /* +0x000c 5e 8a 00 00 */ unsigned char Finish_OnDataChange[4]; /* +0x0010 60 8a 00 00 */ unsigned char Begin_OnViewChange[4]; /* +0x0014 63 8a 00 00 */ unsigned char Finish_OnViewChange[4]; /* +0x0018 60 8a 00 00 */ unsigned char Begin_OnRename[4]; /* +0x001c 66 8a 00 00 */ unsigned char Finish_OnRename[4]; /* +0x0020 60 8a 00 00 */ unsigned char Begin_OnSave[4]; /* +0x0024 60 8a 00 00 */ unsigned char Finish_OnSave[4]; /* +0x0028 60 8a 00 00 */ unsigned char Begin_OnClose[4]; /* +0x002c 60 8a 00 00 */ unsigned char Finish_OnClose[4]; /* +0x0030 60 8a 00 00 */ unsigned char Begin_OnLinkSrcChange[4]; /* +0x0034 66 8a 00 00 */ unsigned char Finish_OnLinkSrcChange[4]; /* +0x0038 60 8a 00 00 */ }; struct IStreamVtbl { unsigned char QueryInterface[4]; /* +0x0000 6b 8a 00 00 */ unsigned char AddRef[4]; /* +0x0004 6d 8a 00 00 */ unsigned char Release[4]; /* +0x0008 6d 8a 00 00 */ unsigned char Read[4]; /* +0x000c 70 8a 00 00 */ unsigned char Write[4]; /* +0x0010 73 8a 00 00 */ unsigned char Seek[4]; /* +0x0014 76 8a 00 00 */ unsigned char SetSize[4]; /* +0x0018 79 8a 00 00 */ unsigned char CopyTo[4]; /* +0x001c 7c 8a 00 00 */ unsigned char Commit[4]; /* +0x0020 7e 8a 00 00 */ unsigned char Revert[4]; /* +0x0024 aa 63 00 00 */ unsigned char LockRegion[4]; /* +0x0028 81 8a 00 00 */ unsigned char UnlockRegion[4]; /* +0x002c 81 8a 00 00 */ unsigned char Stat[4]; /* +0x0030 84 8a 00 00 */ unsigned char Clone[4]; /* +0x0034 87 8a 00 00 */ }; struct IEnumMonikerVtbl { unsigned char QueryInterface[4]; /* +0x0000 8c 8a 00 00 */ unsigned char AddRef[4]; /* +0x0004 8f 8a 00 00 */ unsigned char Release[4]; /* +0x0008 8f 8a 00 00 */ unsigned char Next[4]; /* +0x000c 92 8a 00 00 */ unsigned char Skip[4]; /* +0x0010 95 8a 00 00 */ unsigned char Reset[4]; /* +0x0014 97 8a 00 00 */ unsigned char Clone[4]; /* +0x0018 9a 8a 00 00 */ }; struct IEnumFORMATETCVtbl { unsigned char QueryInterface[4]; /* +0x0000 9f 8a 00 00 */ unsigned char AddRef[4]; /* +0x0004 a2 8a 00 00 */ unsigned char Release[4]; /* +0x0008 a2 8a 00 00 */ unsigned char Next[4]; /* +0x000c a5 8a 00 00 */ unsigned char Skip[4]; /* +0x0010 a8 8a 00 00 */ unsigned char Reset[4]; /* +0x0014 aa 8a 00 00 */ unsigned char Clone[4]; /* +0x0018 ad 8a 00 00 */ }; struct IMonikerVtbl { unsigned char QueryInterface[4]; /* +0x0000 b2 8a 00 00 */ unsigned char AddRef[4]; /* +0x0004 b4 8a 00 00 */ unsigned char Release[4]; /* +0x0008 b4 8a 00 00 */ unsigned char GetClassID[4]; /* +0x000c b7 8a 00 00 */ unsigned char IsDirty[4]; /* +0x0010 b9 8a 00 00 */ unsigned char Load[4]; /* +0x0014 bc 8a 00 00 */ unsigned char Save[4]; /* +0x0018 bf 8a 00 00 */ unsigned char GetSizeMax[4]; /* +0x001c c2 8a 00 00 */ unsigned char BindToObject[4]; /* +0x0020 c5 8a 00 00 */ unsigned char BindToStorage[4]; /* +0x0024 c5 8a 00 00 */ unsigned char Reduce[4]; /* +0x0028 c8 8a 00 00 */ unsigned char ComposeWith[4]; /* +0x002c cb 8a 00 00 */ unsigned char Enum[4]; /* +0x0030 ce 8a 00 00 */ unsigned char IsEqual[4]; /* +0x0034 d1 8a 00 00 */ unsigned char Hash[4]; /* +0x0038 d4 8a 00 00 */ unsigned char IsRunning[4]; /* +0x003c d7 8a 00 00 */ unsigned char GetTimeOfLastChange[4]; /* +0x0040 da 8a 00 00 */ unsigned char Inverse[4]; /* +0x0044 dc 8a 00 00 */ unsigned char CommonPrefixWith[4]; /* +0x0048 df 8a 00 00 */ unsigned char RelativePathTo[4]; /* +0x004c df 8a 00 00 */ unsigned char GetDisplayName[4]; /* +0x0050 e2 8a 00 00 */ unsigned char ParseDisplayName[4]; /* +0x0054 e5 8a 00 00 */ unsigned char IsSystemMoniker[4]; /* +0x0058 d4 8a 00 00 */ }; struct IOleInPlaceActiveObjectVtbl { unsigned char QueryInterface[4]; /* +0x0000 ea 8a 00 00 */ unsigned char AddRef[4]; /* +0x0004 ec 8a 00 00 */ unsigned char Release[4]; /* +0x0008 ec 8a 00 00 */ unsigned char GetWindow[4]; /* +0x000c ef 8a 00 00 */ unsigned char ContextSensitiveHelp[4]; /* +0x0010 f2 8a 00 00 */ unsigned char TranslateAcceleratorW[4]; /* +0x0014 f5 8a 00 00 */ unsigned char OnFrameWindowActivate[4]; /* +0x0018 f2 8a 00 00 */ unsigned char OnDocWindowActivate[4]; /* +0x001c f2 8a 00 00 */ unsigned char ResizeBorder[4]; /* +0x0020 f8 8a 00 00 */ unsigned char EnableModeless[4]; /* +0x0024 f2 8a 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 55 8a 00 00 */ unsigned char pmk[4]; /* +0x0004 18 20 00 00 */ unsigned char _RetVal[4]; /* +0x0008 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 55 8a 00 00 */ unsigned char _RetVal[4]; /* +0x0004 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 53 89 00 00 */ unsigned char _RetVal[4]; /* +0x0004 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 53 89 00 00 */ unsigned char pFormatetc[4]; /* +0x0004 21 18 00 00 */ unsigned char pStgmed[4]; /* +0x0008 60 2d 00 00 */ unsigned char _RetVal[4]; /* +0x000c 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 53 89 00 00 */ unsigned char pmk[4]; /* +0x0004 18 20 00 00 */ unsigned char _RetVal[4]; /* +0x0008 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 53 89 00 00 */ unsigned long dwAspect; /* +0x0004 */ long lindex; /* +0x0008 */ unsigned char _RetVal[4]; /* +0x000c 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 88 40 00 00 */ unsigned char pmk[4]; /* +0x0004 18 20 00 00 */ unsigned char _RetVal[4]; /* +0x0008 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 23 18 00 00 */ unsigned char _RetVal[4]; /* +0x0004 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 23 18 00 00 */ unsigned char pFormatetc[4]; /* +0x0004 21 18 00 00 */ unsigned char pStgmed[4]; /* +0x0008 60 2d 00 00 */ unsigned char _RetVal[4]; /* +0x000c 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 23 18 00 00 */ unsigned char pmk[4]; /* +0x0004 18 20 00 00 */ unsigned char _RetVal[4]; /* +0x0008 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 23 18 00 00 */ unsigned long dwAspect; /* +0x0004 */ long lindex; /* +0x0008 */ unsigned char _RetVal[4]; /* +0x000c 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 44 1d 00 00 */ unsigned char pbindopts[4]; /* +0x0004 5a 41 00 00 */ unsigned char _RetVal[4]; /* +0x0008 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 d5 29 00 00 */ unsigned char riid[4]; /* +0x0004 4a 16 00 00 */ unsigned char ppvObject[4]; /* +0x0008 13 22 00 00 */ unsigned char _RetVal[4]; /* +0x000c 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 d5 29 00 00 */ unsigned char fLock[4]; /* +0x0004 74 00 00 00 */ unsigned char _RetVal[4]; /* +0x0008 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 c5 14 00 00 */ unsigned char pformatetc[4]; /* +0x0004 21 18 00 00 */ unsigned char pRemoteMedium[4]; /* +0x0008 60 2d 00 00 */ unsigned char _RetVal[4]; /* +0x000c 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 c5 14 00 00 */ unsigned char pformatetcIn[4]; /* +0x0004 21 18 00 00 */ unsigned char pRemoteMedium[4]; /* +0x0008 60 2d 00 00 */ unsigned char _RetVal[4]; /* +0x000c 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 c5 14 00 00 */ unsigned char pformatetc[4]; /* +0x0004 21 18 00 00 */ unsigned char pmedium[4]; /* +0x0008 67 8b 00 00 */ unsigned char fRelease[4]; /* +0x000c 74 00 00 00 */ unsigned char _RetVal[4]; /* +0x0010 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 36 88 00 00 */ unsigned long cConnections; /* +0x0004 */ unsigned char rgpcn[4]; /* +0x0008 3d 88 00 00 */ unsigned long *lpcFetched; /* +0x000c */ unsigned char _RetVal[4]; /* +0x0010 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 5b 88 00 00 */ unsigned long cConnections; /* +0x0004 */ unsigned char rgcd[4]; /* +0x0008 01 8a 00 00 */ unsigned long *lpcFetched; /* +0x000c */ unsigned char _RetVal[4]; /* +0x0010 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 2a 48 00 00 */ unsigned long celt; /* +0x0004 */ unsigned char rgelt[4]; /* +0x0008 21 18 00 00 */ unsigned long *pceltFetched; /* +0x000c */ unsigned char _RetVal[4]; /* +0x0010 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 55 2e 00 00 */ unsigned long celt; /* +0x0004 */ unsigned char rgelt[4]; /* +0x0008 19 20 00 00 */ unsigned long *pceltFetched; /* +0x000c */ unsigned char _RetVal[4]; /* +0x0010 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 7a 3e 00 00 */ unsigned long celt; /* +0x0004 */ unsigned char rgelt[4]; /* +0x0008 b0 15 00 00 */ unsigned long *pceltFetched; /* +0x000c */ unsigned char _RetVal[4]; /* +0x0010 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 28 18 00 00 */ unsigned long celt; /* +0x0004 */ unsigned char rgelt[4]; /* +0x0008 55 4f 00 00 */ unsigned long *pceltFetched; /* +0x000c */ unsigned char _RetVal[4]; /* +0x0010 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 7a 3b 00 00 */ unsigned long celt; /* +0x0004 */ unsigned char rgelt[4]; /* +0x0008 04 42 00 00 */ unsigned long *pceltFetched; /* +0x000c */ unsigned char _RetVal[4]; /* +0x0010 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 75 2d 00 00 */ unsigned long celt; /* +0x0004 */ unsigned char rgelt[4]; /* +0x0008 46 47 00 00 */ unsigned long *pceltFetched; /* +0x000c */ unsigned char _RetVal[4]; /* +0x0010 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 fc 28 00 00 */ unsigned long celt; /* +0x0004 */ unsigned char rgelt[4]; /* +0x0008 13 22 00 00 */ unsigned long *pceltFetched; /* +0x000c */ unsigned char _RetVal[4]; /* +0x0010 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 e5 88 00 00 */ unsigned char pv[4]; /* +0x0004 39 19 00 00 */ unsigned long cb; /* +0x0008 */ unsigned long *pcbWritten; /* +0x000c */ unsigned char _RetVal[4]; /* +0x0010 08 00 00 00 */ }; struct _ULARGE_INTEGER { unsigned long LowPart; /* +0x0000 */ unsigned long HighPart; /* +0x0004 */ /* unsigned char u[0]; +0x0000 9a 8b 00 00 */ unsigned long long QuadPart; /* +0x0000 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 e5 88 00 00 */ unsigned char ulOffset[8]; /* +0x0004 fd 22 00 00 */ unsigned char pv[4]; /* +0x000c 39 19 00 00 */ unsigned long cb; /* +0x0010 */ unsigned long *pcbWritten; /* +0x0014 */ unsigned char _RetVal[4]; /* +0x0018 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 c6 3e 00 00 */ unsigned char ulOffset[8]; /* +0x0004 fd 22 00 00 */ unsigned char *pv; /* +0x000c */ unsigned long cb; /* +0x0010 */ unsigned long *pcbRead; /* +0x0014 */ unsigned char _RetVal[4]; /* +0x0018 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 c6 3e 00 00 */ unsigned char ulOffset[8]; /* +0x0004 fd 22 00 00 */ unsigned char pv[4]; /* +0x000c 39 19 00 00 */ unsigned long cb; /* +0x0010 */ unsigned long *pcbWritten; /* +0x0014 */ unsigned char _RetVal[4]; /* +0x0018 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 18 20 00 00 */ unsigned char pbc[4]; /* +0x0004 44 1d 00 00 */ unsigned char pmkToLeft[4]; /* +0x0008 18 20 00 00 */ unsigned char riidResult[4]; /* +0x000c 4a 16 00 00 */ unsigned char ppvResult[4]; /* +0x0010 13 22 00 00 */ unsigned char _RetVal[4]; /* +0x0014 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 18 20 00 00 */ unsigned char pbc[4]; /* +0x0004 44 1d 00 00 */ unsigned char pmkToLeft[4]; /* +0x0008 18 20 00 00 */ unsigned char riid[4]; /* +0x000c 4a 16 00 00 */ unsigned char ppvObj[4]; /* +0x0010 13 22 00 00 */ unsigned char _RetVal[4]; /* +0x0014 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 12 4b 00 00 */ unsigned char pDataObject[4]; /* +0x0004 c5 14 00 00 */ unsigned long grfUpdf; /* +0x0008 */ long pReserved; /* +0x000c */ unsigned char _RetVal[4]; /* +0x0010 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 df 32 00 00 */ unsigned char prcBorder[4]; /* +0x0004 a6 1e 00 00 */ unsigned char riid[4]; /* +0x0008 4a 16 00 00 */ unsigned char pUIWindow[4]; /* +0x000c a8 1e 00 00 */ unsigned char fFrameWindow[4]; /* +0x0010 74 00 00 00 */ unsigned char _RetVal[4]; /* +0x0014 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 df 32 00 00 */ unsigned char _RetVal[4]; /* +0x0004 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 d9 52 00 00 */ unsigned char _RetVal[4]; /* +0x0004 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 97 89 00 00 */ unsigned char *pv; /* +0x0004 */ unsigned long cb; /* +0x0008 */ unsigned long *pcbRead; /* +0x000c */ unsigned char _RetVal[4]; /* +0x0010 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 97 89 00 00 */ unsigned char pv[4]; /* +0x0004 39 19 00 00 */ unsigned long cb; /* +0x0008 */ unsigned long *pcbWritten; /* +0x000c */ unsigned char _RetVal[4]; /* +0x0010 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 fc 15 00 00 */ unsigned long ciidExclude; /* +0x0004 */ unsigned char rgiidExclude[4]; /* +0x0008 4a 16 00 00 */ unsigned char snbExclude[4]; /* +0x000c 46 47 00 00 */ unsigned char pstgDest[4]; /* +0x0010 fc 15 00 00 */ unsigned char _RetVal[4]; /* +0x0014 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 fc 15 00 00 */ unsigned long reserved1; /* +0x0004 */ unsigned long cbReserved2; /* +0x0008 */ unsigned char *reserved2; /* +0x000c */ unsigned long reserved3; /* +0x0010 */ unsigned char ppenum[4]; /* +0x0014 9e 59 00 00 */ unsigned char _RetVal[4]; /* +0x0018 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 fc 15 00 00 */ unsigned char pwcsName[4]; /* +0x0004 c0 13 00 00 */ unsigned long cbReserved1; /* +0x0008 */ unsigned char *reserved1; /* +0x000c */ unsigned long grfMode; /* +0x0010 */ unsigned long reserved2; /* +0x0014 */ unsigned char ppstm[4]; /* +0x0018 3b 5b 00 00 */ unsigned char _RetVal[4]; /* +0x001c 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 dc 26 00 00 */ unsigned char pstm[4]; /* +0x0004 dc 26 00 00 */ unsigned char cb[8]; /* +0x0008 fd 22 00 00 */ unsigned char pcbRead[4]; /* +0x0010 ab 46 00 00 */ unsigned char pcbWritten[4]; /* +0x0014 ab 46 00 00 */ unsigned char _RetVal[4]; /* +0x0018 08 00 00 00 */ }; struct _LARGE_INTEGER { unsigned long LowPart; /* +0x0000 */ long HighPart; /* +0x0004 */ /* unsigned char u[0]; +0x0000 ec 8b 00 00 */ long long QuadPart; /* +0x0000 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 dc 26 00 00 */ unsigned char dlibMove[8]; /* +0x0004 3d 13 00 00 */ unsigned long dwOrigin; /* +0x000c */ unsigned char plibNewPosition[4]; /* +0x0010 ab 46 00 00 */ unsigned char _RetVal[4]; /* +0x0014 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 b3 22 00 00 */ unsigned long dwDrawAspect; /* +0x0004 */ long lindex; /* +0x0008 */ unsigned long pvAspect; /* +0x000c */ unsigned char ptd[4]; /* +0x0010 3c 35 00 00 */ unsigned char hdcTargetDev[4]; /* +0x0014 f1 1e 00 00 */ unsigned char hdcDraw[4]; /* +0x0018 f1 1e 00 00 */ unsigned char lprcBounds[4]; /* +0x001c c8 21 00 00 */ unsigned char lprcWBounds[4]; /* +0x0020 c8 21 00 00 */ unsigned char pContinue[4]; /* +0x0024 78 86 00 00 */ unsigned char _RetVal[4]; /* +0x0028 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 b3 22 00 00 */ unsigned long dwDrawAspect; /* +0x0004 */ long lindex; /* +0x0008 */ unsigned long pvAspect; /* +0x000c */ unsigned long *pdwFreeze; /* +0x0010 */ unsigned char _RetVal[4]; /* +0x0014 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 b3 22 00 00 */ unsigned long *pAspects; /* +0x0004 */ unsigned long *pAdvf; /* +0x0008 */ unsigned char ppAdvSink[4]; /* +0x000c 4b 35 00 00 */ unsigned char _RetVal[4]; /* +0x0010 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 b3 22 00 00 */ unsigned long dwDrawAspect; /* +0x0004 */ long lindex; /* +0x0008 */ unsigned long pvAspect; /* +0x000c */ unsigned char ptd[4]; /* +0x0010 3c 35 00 00 */ unsigned long hicTargetDev; /* +0x0014 */ unsigned char ppColorSet[4]; /* +0x0018 43 35 00 00 */ unsigned char _RetVal[4]; /* +0x001c 08 00 00 00 */ }; struct _prop_MIDL_PROC_FORMAT_STRING { short Pad; /* +0x0000 */ unsigned char Format[986]; /* +0x0002 09 8c 00 00 */ }; struct _prop_MIDL_TYPE_FORMAT_STRING { short Pad; /* +0x0000 */ unsigned char Format[3588]; /* +0x0002 0c 8c 00 00 */ }; struct _prop_MIDL_EXPR_FORMAT_STRING { long Pad; /* +0x0000 */ unsigned char Format[28]; /* +0x0004 10 8c 00 00 */ }; struct IEnumSTATPROPSETSTGVtbl { unsigned char QueryInterface[4]; /* +0x0000 18 8c 00 00 */ unsigned char AddRef[4]; /* +0x0004 1b 8c 00 00 */ unsigned char Release[4]; /* +0x0008 1b 8c 00 00 */ unsigned char Next[4]; /* +0x000c 1e 8c 00 00 */ unsigned char Skip[4]; /* +0x0010 21 8c 00 00 */ unsigned char Reset[4]; /* +0x0014 23 8c 00 00 */ unsigned char Clone[4]; /* +0x0018 26 8c 00 00 */ }; struct IEnumSTATPROPSTGVtbl { unsigned char QueryInterface[4]; /* +0x0000 2b 8c 00 00 */ unsigned char AddRef[4]; /* +0x0004 2e 8c 00 00 */ unsigned char Release[4]; /* +0x0008 2e 8c 00 00 */ unsigned char Next[4]; /* +0x000c 31 8c 00 00 */ unsigned char Skip[4]; /* +0x0010 34 8c 00 00 */ unsigned char Reset[4]; /* +0x0014 36 8c 00 00 */ unsigned char Clone[4]; /* +0x0018 39 8c 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 e2 1f 00 00 */ unsigned long celt; /* +0x0004 */ unsigned char rgelt[4]; /* +0x0008 9d 1c 00 00 */ unsigned long *pceltFetched; /* +0x000c */ unsigned char _RetVal[4]; /* +0x0010 08 00 00 00 */ }; struct _PARAM_STRUCT { unsigned char This[4]; /* +0x0000 93 1c 00 00 */ unsigned long celt; /* +0x0004 */ unsigned char rgelt[4]; /* +0x0008 0e 3b 00 00 */ unsigned long *pceltFetched; /* +0x000c */ unsigned char _RetVal[4]; /* +0x0010 08 00 00 00 */ }; struct ICallFactoryVtbl { unsigned char QueryInterface[4]; /* +0x0000 46 8c 00 00 */ unsigned char AddRef[4]; /* +0x0004 49 8c 00 00 */ unsigned char Release[4]; /* +0x0008 49 8c 00 00 */ unsigned char CreateCall[4]; /* +0x000c 4c 8c 00 00 */ }; struct tagBIND_OPTS2 { unsigned long cbStruct; /* +0x0000 */ unsigned long grfFlags; /* +0x0004 */ unsigned long grfMode; /* +0x0008 */ unsigned long dwTickCountDeadline; /* +0x000c */ unsigned long dwTrackFlags; /* +0x0010 */ unsigned long dwClassContext; /* +0x0014 */ unsigned long locale; /* +0x0018 */ unsigned char pServerInfo[4]; /* +0x001c 76 21 00 00 */ }; struct tagSTGMEDIUM { unsigned long tymed; /* +0x0000 */ /* unsigned char hBitmap[0]; +0x0004 06 18 00 00 */ void *hMetaFilePict; /* +0x0004 */ /* unsigned char hEnhMetaFile[0]; +0x0004 da 26 00 00 */ void *hGlobal; /* +0x0004 */ unsigned short *lpszFileName; /* +0x0004 */ /* unsigned char pstm[0]; +0x0004 dc 26 00 00 */ unsigned char pstg[4]; /* +0x0004 fc 15 00 00 */ unsigned char pUnkForRelease[4]; /* +0x0008 7f 17 00 00 */ }; enum _operators { OP_START = 0, OP_ILLEGAL = 0, OP_UNARY_START = 1, OP_UNARY_ARITHMETIC_START = 1, OP_UNARY_PLUS = 1, OP_UNARY_MINUS = 2, OP_UNARY_ARITHMETIC_END = 3, OP_UNARY_LOGICAL_START = 3, OP_UNARY_NOT = 3, OP_UNARY_COMPLEMENT = 4, OP_UNARY_LOGICAL_END = 5, OP_UNARY_INDIRECTION = 5, OP_UNARY_CAST = 6, OP_UNARY_AND = 7, OP_UNARY_SIZEOF = 8, OP_UNARY_ALIGNOF = 9, OP_PRE_INCR = 10, OP_PRE_DECR = 11, OP_POST_INCR = 12, OP_POST_DECR = 13, OP_UNARY_END = 14, OP_BINARY_START = 14, OP_BINARY_ARITHMETIC_START = 14, OP_PLUS = 14, OP_MINUS = 15, OP_STAR = 16, OP_SLASH = 17, OP_MOD = 18, OP_BINARY_ARITHMETIC_END = 19, OP_BINARY_SHIFT_START = 19, OP_LEFT_SHIFT = 19, OP_RIGHT_SHIFT = 20, OP_BINARY_SHIFT_END = 21, OP_BINARY_RELATIONAL_START = 21, OP_LESS = 21, OP_LESS_EQUAL = 22, OP_GREATER_EQUAL = 23, OP_GREATER = 24, OP_EQUAL = 25, OP_NOT_EQUAL = 26, OP_BINARY_RELATIONAL_END = 27, OP_BINARY_BITWISE_START = 27, OP_AND = 27, OP_OR = 28, OP_XOR = 29, OP_BINARY_BITWISE_END = 30, OP_BINARY_LOGICAL_START = 30, OP_LOGICAL_AND = 30, OP_LOGICAL_OR = 31, OP_BINARY_LOGICAL_END = 32, OP_BINARY_TERNARY_START = 32, OP_QM = 32, OP_COLON = 33, OP_BINARY_TERNARY_END = 34, OP_BINARY_END = 34, OP_INTERNAL_START = 34, OP_FUNCTION = 35, OP_PARAM = 36, OP_POINTSTO = 37, OP_DOT = 38, OP_INDEX = 39, OP_COMMA = 40, OP_STMT = 41, OP_ASSIGN = 42, OP_ASYNCSPLIT = 43, OP_CORR_POINTER = 44, OP_CORR_TOP_LEVEL = 45, OP_END = 46 }; enum tagMSIINSTALLCONTEXT { MSIINSTALLCONTEXT_FIRSTVISIBLE = 0, MSIINSTALLCONTEXT_NONE = 0, MSIINSTALLCONTEXT_USERMANAGED = 1, MSIINSTALLCONTEXT_USERUNMANAGED = 2, MSIINSTALLCONTEXT_MACHINE = 4, MSIINSTALLCONTEXT_ALL = 7, MSIINSTALLCONTEXT_ALLUSERMANAGED = 8 }; enum tagMSIPATCHSTATE { MSIPATCHSTATE_INVALID = 0, MSIPATCHSTATE_APPLIED = 1, MSIPATCHSTATE_SUPERSEDED = 2, MSIPATCHSTATE_OBSOLETED = 4, MSIPATCHSTATE_REGISTERED = 8, MSIPATCHSTATE_ALL = 15 }; enum tagINSTALLUILEVEL { INSTALLUILEVEL_NOCHANGE = 0, INSTALLUILEVEL_DEFAULT = 1, INSTALLUILEVEL_NONE = 2, INSTALLUILEVEL_BASIC = 3, INSTALLUILEVEL_REDUCED = 4, INSTALLUILEVEL_FULL = 5, INSTALLUILEVEL_ENDDIALOG = 128, INSTALLUILEVEL_PROGRESSONLY = 64, INSTALLUILEVEL_HIDECANCEL = 32, INSTALLUILEVEL_SOURCERESONLY = 256, INSTALLUILEVEL_UACONLY = 512 }; enum tagINSTALLMESSAGE { INSTALLMESSAGE_FATALEXIT = 0, /* INSTALLMESSAGE_ERROR = Unavail */ }; enum tagSCRIPTFLAGS { SCRIPTFLAGS_CACHEINFO = 1, SCRIPTFLAGS_SHORTCUTS = 4, SCRIPTFLAGS_MACHINEASSIGN = 8, SCRIPTFLAGS_REGDATA_CNFGINFO = 32, SCRIPTFLAGS_VALIDATE_TRANSFORMS_LIST = 64, SCRIPTFLAGS_REGDATA_CLASSINFO = 128, SCRIPTFLAGS_REGDATA_EXTENSIONINFO = 256, SCRIPTFLAGS_REGDATA_APPINFO = 384, SCRIPTFLAGS_REGDATA = 416 }; enum _REGQUERY_FLAGS { RQ_MULTISZ = 1, RQ_ALLOWQUOTEQUOTE = 2 }; struct PMSIHANDLE { unsigned long m_h; /* +0x0000 */ }; enum _com_error::<unnamed-tag> { = 32771 }; struct COM_CATALOG_CACHE_SECTION { unsigned char CacheTicks[8]; /* +0x0000 57 8e 00 00 */ unsigned char ComPlusCatalogVer[8]; /* +0x0008 57 8e 00 00 */ unsigned char WinRTActivationStoreSequence[8]; /* +0x0010 57 8e 00 00 */ }; struct PACKAGE_INFO { unsigned char reserved[4]; /* +0x0000 75 00 00 00 */ unsigned char flags[4]; /* +0x0004 75 00 00 00 */ unsigned char path[4]; /* +0x0008 71 04 00 00 */ unsigned char packageFullName[4]; /* +0x000c 71 04 00 00 */ unsigned char packageFamilyName[4]; /* +0x0010 71 04 00 00 */ unsigned char packageId[32]; /* +0x0014 5a 8e 00 00 */ }; struct PACKAGE_VERSION { unsigned long long Version; /* +0x0000 */ unsigned short Revision; /* +0x0000 */ unsigned short Build; /* +0x0002 */ unsigned short Minor; /* +0x0004 */ unsigned short Major; /* +0x0006 */ }; struct ActivationStore::Entry { unsigned char _baseKey[4]; /* +0x0000 cb 59 00 00 */ unsigned char _registrationScope[4]; /* +0x0004 96 67 00 00 */ }; struct ActivationStore::PropertyValueBuffer { void *_pBuffer; /* +0x0000 */ unsigned short _cbSize; /* +0x0004 */ unsigned char _usingStaticBuffer[1]; /* +0x0006 30 00 00 00 */ unsigned char _valueRead[1]; /* +0x0007 30 00 00 00 */ }; struct ActivationStore::BasicBuffer { void *_pBuffer; /* +0x0000 */ unsigned short _cbSize; /* +0x0004 */ unsigned short _cbLength; /* +0x0006 */ unsigned char _usingStaticBuffer[4]; /* +0x0008 30 00 00 00 */ }; enum ActivationStore::ServerType { NormalExe = 0, ExeService = 1, SvchostService = 2 }; struct PACKAGE_ID { unsigned char reserved[4]; /* +0x0000 75 00 00 00 */ unsigned char processorArchitecture[4]; /* +0x0004 75 00 00 00 */ unsigned char version[8]; /* +0x0008 6e 8f 00 00 */ unsigned char name[4]; /* +0x0010 71 04 00 00 */ unsigned char publisher[4]; /* +0x0014 71 04 00 00 */ unsigned char resourceId[4]; /* +0x0018 71 04 00 00 */ unsigned char publisherId[4]; /* +0x001c 71 04 00 00 */ }; enum BuiltInClassCache::GetCachedResult::__l2::Pass { Shared = 0, Exclusive = 1 }; struct _ACTIVATION_CONTEXT_DATA { unsigned long Magic; /* +0x0000 */ unsigned long HeaderSize; /* +0x0004 */ unsigned long FormatVersion; /* +0x0008 */ unsigned long TotalSize; /* +0x000c */ unsigned long DefaultTocOffset; /* +0x0010 */ unsigned long ExtendedTocOffset; /* +0x0014 */ unsigned long AssemblyRosterOffset; /* +0x0018 */ unsigned long Flags; /* +0x001c */ }; struct _ACTIVATION_CONTEXT_DATA_COM_SERVER_REDIRECTION { unsigned long Size; /* +0x0000 */ unsigned long Flags; /* +0x0004 */ unsigned long ThreadingModel; /* +0x0008 */ unsigned char ReferenceClsid[16]; /* +0x000c dc 14 00 00 */ unsigned char ConfiguredClsid[16]; /* +0x001c dc 14 00 00 */ unsigned char ImplementedClsid[16]; /* +0x002c dc 14 00 00 */ unsigned char TypeLibraryId[16]; /* +0x003c dc 14 00 00 */ unsigned long ModuleLength; /* +0x004c */ unsigned long ModuleOffset; /* +0x0050 */ unsigned long ProgIdLength; /* +0x0054 */ unsigned long ProgIdOffset; /* +0x0058 */ unsigned long ShimDataLength; /* +0x005c */ unsigned long ShimDataOffset; /* +0x0060 */ unsigned long MiscStatusDefault; /* +0x0064 */ unsigned long MiscStatusContent; /* +0x0068 */ unsigned long MiscStatusThumbnail; /* +0x006c */ unsigned long MiscStatusIcon; /* +0x0070 */ unsigned long MiscStatusDocPrint; /* +0x0074 */ }; struct _ACTIVATION_CONTEXT_DATA_COM_PROGID_REDIRECTION { unsigned long Size; /* +0x0000 */ unsigned long Flags; /* +0x0004 */ unsigned long ConfiguredClsidOffset; /* +0x0008 */ }; struct tagElement { unsigned char pNext[4]; /* +0x0000 52 8e 00 00 */ unsigned long iHashValue; /* +0x0004 */ unsigned short fValueFlags; /* +0x0008 */ unsigned short cbKey; /* +0x000a */ unsigned char pUnknown[4]; /* +0x000c 7f 17 00 00 */ /* unsigned char abKey[0]; +0x0010 02 2d 00 00 */ }; enum NCIFLAGS { NCI_HAVECLSID = 1, NCI_HAVEPROGID = 2 }; struct CRefMutexSem { long m_lRefs; /* +0x0000 */ unsigned char m_mxs[28]; /* +0x0004 1d 54 00 00 */ }; struct CRefMutexAutoLock { unsigned char m_pmxs[4]; /* +0x0000 b3 91 00 00 */ }; struct MEMSTM { unsigned long cb; /* +0x0000 */ unsigned long cRef; /* +0x0004 */ unsigned char *m_pBuf; /* +0x0008 */ void *hGlobal; /* +0x000c */ unsigned char fDeleteOnRelease[4]; /* +0x0010 74 00 00 00 */ }; enum WINDOWS_RUNTIME_HSTRING_FLAGS { WRHF_NONE = 0, WRHF_STRING_REFERENCE = 1, WRHF_VALID_UNICODE_FORMAT_INFO = 2, WRHF_WELL_FORMED_UNICODE = 4, WRHF_HAS_EMBEDDED_NULLS = 8, WRHF_EMBEDDED_NULLS_COMPUTED = 16, = 32771 }; struct HSTRING_HEADER_INTERNAL { unsigned char flags[4]; /* +0x0000 13 92 00 00 */ unsigned char length[4]; /* +0x0004 75 00 00 00 */ unsigned char padding1[4]; /* +0x0008 75 00 00 00 */ unsigned char padding2[4]; /* +0x000c 75 00 00 00 */ unsigned char stringRef[4]; /* +0x0010 c0 13 00 00 */ }; enum Microsoft::WRL::RuntimeClassType { WinRt = 1, ClassicCom = 2, WinRtClassicComMix = 3, InhibitWeakReference = 4, Delegate = 2 }; enum InstrumentationType { InstrumentNone = 0, InstrumentCallObjects = 1, InstrumentDisconnectableContextObjects = 2, NumInstrumenationTypes = 3 }; enum _RecordMatchType { ImageFileName = 0, SvchostServiceGroup = 1, DllhostAppId = 2 }; struct <unnamed-type-g_InstrumentationRecords> { unsigned char type[4]; /* +0x0000 61 95 00 00 */ unsigned char matchType[4]; /* +0x0004 62 95 00 00 */ unsigned char pwszMatchString[4]; /* +0x0008 c0 13 00 00 */ }; struct Ro::detail::ResolutionPathEntry { unsigned char _next[4]; /* +0x0000 d7 95 00 00 */ unsigned char _typeName[4]; /* +0x0004 c0 13 00 00 */ }; struct Ro::detail::SimpleMetaDataBuffer::ResolutionPathGuard { unsigned char _entry[8]; /* +0x0000 d6 95 00 00 */ unsigned char _buffer[4]; /* +0x0008 d2 95 00 00 */ }; struct Ro::detail::_IsBuiltin::__l2::BuiltinEntry { unsigned char name[4]; /* +0x0000 c0 13 00 00 */ unsigned char typeSignature[4]; /* +0x0004 62 14 00 00 */ }; enum FORMAT_CHARACTER { FC_ZERO = 0, FC_BYTE = 1, FC_CHAR = 2, FC_SMALL = 3, FC_USMALL = 4, FC_WCHAR = 5, FC_SHORT = 6, FC_USHORT = 7, FC_LONG = 8, FC_ULONG = 9, FC_FLOAT = 10, FC_HYPER = 11, FC_DOUBLE = 12, FC_ENUM16 = 13, FC_ENUM32 = 14, FC_IGNORE = 15, FC_ERROR_STATUS_T = 16, FC_RP = 17, FC_UP = 18, FC_OP = 19, FC_FP = 20, FC_STRUCT = 21, FC_PSTRUCT = 22, FC_CSTRUCT = 23, FC_CPSTRUCT = 24, FC_CVSTRUCT = 25, FC_BOGUS_STRUCT = 26, FC_CARRAY = 27, FC_CVARRAY = 28, FC_SMFARRAY = 29, FC_LGFARRAY = 30, FC_SMVARRAY = 31, FC_LGVARRAY = 32, FC_BOGUS_ARRAY = 33, FC_C_CSTRING = 34, FC_C_BSTRING = 35, FC_C_SSTRING = 36, FC_C_WSTRING = 37, FC_CSTRING = 38, FC_BSTRING = 39, FC_SSTRING = 40, FC_WSTRING = 41, FC_ENCAPSULATED_UNION = 42, FC_NON_ENCAPSULATED_UNION = 43, FC_BYTE_COUNT_POINTER = 44, FC_TRANSMIT_AS = 45, FC_REPRESENT_AS = 46, FC_IP = 47, FC_BIND_CONTEXT = 48, FC_BIND_GENERIC = 49, FC_BIND_PRIMITIVE = 50, FC_AUTO_HANDLE = 51, FC_CALLBACK_HANDLE = 52, FC_UNUSED1 = 53, FC_POINTER = 54, FC_ALIGNM2 = 55, FC_ALIGNM4 = 56, FC_ALIGNM8 = 57, FC_UNUSED2 = 58, FC_UNUSED3 = 59, FC_UNUSED4 = 60, FC_STRUCTPAD1 = 61, FC_STRUCTPAD2 = 62, FC_STRUCTPAD3 = 63, FC_STRUCTPAD4 = 64, FC_STRUCTPAD5 = 65, FC_STRUCTPAD6 = 66, FC_STRUCTPAD7 = 67, FC_STRING_SIZED = 68, FC_UNUSED5 = 69, FC_NO_REPEAT = 70, FC_FIXED_REPEAT = 71, FC_VARIABLE_REPEAT = 72, FC_FIXED_OFFSET = 73, FC_VARIABLE_OFFSET = 74, FC_PP = 75, FC_EMBEDDED_COMPLEX = 76, FC_IN_PARAM = 77, FC_IN_PARAM_BASETYPE = 78, FC_IN_PARAM_NO_FREE_INST = 79, FC_IN_OUT_PARAM = 80, FC_OUT_PARAM = 81, FC_RETURN_PARAM = 82, FC_RETURN_PARAM_BASETYPE = 83, FC_DEREFERENCE = 84, FC_DIV_2 = 85, FC_MULT_2 = 86, FC_ADD_1 = 87, FC_SUB_1 = 88, FC_CALLBACK = 89, FC_CONSTANT_IID = 90, FC_END = 91, FC_PAD = 92, FC_EXPR = 93, FC_PARTIAL_IGNORE_PARAM = 94, FC_SPLIT_DEREFERENCE = 116, FC_SPLIT_DIV_2 = 117, FC_SPLIT_MULT_2 = 118, FC_SPLIT_ADD_1 = 119, FC_SPLIT_SUB_1 = 120, FC_SPLIT_CALLBACK = 121, FC_FORCED_BOGUS_STRUCT = 177, FC_TRANSMIT_AS_PTR = 178, FC_REPRESENT_AS_PTR = 179, FC_USER_MARSHAL = 180, FC_PIPE = 181, FC_SUPPLEMENT = 182, FC_RANGE = 183, FC_INT3264 = 184, FC_UINT3264 = 185, FC_CSARRAY = 186, FC_CS_TAG = 187, FC_STRUCTPADN = 188, FC_UNUSED7 = 189, FC_UNUSED8 = 190, FC_UNUSED9 = 191, FC_UNUSED10 = 192, FC_BUFFER_ALIGN = 193, FC_INT128 = 194, FC_UINT128 = 195, FC_FLOAT80 = 196, FC_FLOAT128 = 197, FC_END_OF_UNIVERSE = 198 }; enum _CLI_ASYNC_CALL_STATE { cacsStart = 0, cacsFailedSynchronously = 1, cacsNotified = 2, cacsInCompletion = 3, cacsCompleted = 4 }; enum SYNTAX_TYPE { ]ˆŠXFER_SYNTAX_DCE = 32771, /* XFER_SYNTAX_NDR64 = Unavail, */ ©}S´XFER_SYNTAX_TEST_NDR64 = 32771 }; struct _NDR_FWD_ROUTINES { unsigned char CStdStubBuffer_AddRef[4]; /* +0x0000 97 87 00 00 */ unsigned char CStdStubBuffer_Connect[4]; /* +0x0004 9a 87 00 00 */ unsigned char CStdStubBuffer_CountRefs[4]; /* +0x0008 97 87 00 00 */ unsigned char CStdStubBuffer_DebugServerQueryInterface[4]; /* +0x000c a5 87 00 00 */ unsigned char CStdStubBuffer_DebugServerRelease[4]; /* +0x0010 a8 87 00 00 */ unsigned char CStdStubBuffer_Disconnect[4]; /* +0x0014 9c 87 00 00 */ unsigned char CStdStubBuffer_Invoke[4]; /* +0x0018 9f 87 00 00 */ unsigned char CStdStubBuffer_IsIIDSupported[4]; /* +0x001c 8d 96 00 00 */ unsigned char CStdStubBuffer_QueryInterface[4]; /* +0x0020 90 96 00 00 */ unsigned char CreateProxyFromTypeInfo[4]; /* +0x0024 93 96 00 00 */ unsigned char CreateStubFromTypeInfo[4]; /* +0x0028 96 96 00 00 */ unsigned char DllGetClassObject[4]; /* +0x002c ae 32 00 00 */ unsigned char DllRegisterServer[4]; /* +0x0030 b6 4e 00 00 */ unsigned char IUnknown_AddRef_Proxy[4]; /* +0x0034 ea 82 00 00 */ unsigned char IUnknown_QueryInterface_Proxy[4]; /* +0x0038 bd 78 00 00 */ unsigned char IUnknown_Release_Proxy[4]; /* +0x003c ea 82 00 00 */ unsigned char NdrCStdStubBuffer2_Release[4]; /* +0x0040 99 96 00 00 */ unsigned char NdrCStdStubBuffer_Release[4]; /* +0x0044 99 96 00 00 */ unsigned char NdrCreateServerInterfaceFromStub[4]; /* +0x0048 9c 96 00 00 */ unsigned char NdrpDcomAsyncClientCall[4]; /* +0x004c 9f 96 00 00 */ unsigned char NdrDcomAsyncStubCall[4]; /* +0x0050 a1 96 00 00 */ unsigned char Ndr64pDcomAsyncClientCall[4]; /* +0x0054 a4 96 00 00 */ unsigned char Ndr64DcomAsyncStubCall[4]; /* +0x0058 a1 96 00 00 */ unsigned char NdrDllCanUnloadNow[4]; /* +0x005c a7 96 00 00 */ unsigned char NdrDllGetClassObject[4]; /* +0x0060 aa 96 00 00 */ unsigned char NdrDllRegisterProxy[4]; /* +0x0064 ad 96 00 00 */ unsigned char NdrDllUnregisterProxy[4]; /* +0x0068 ad 96 00 00 */ unsigned char NdrGetBaseInterfaceFromStub[4]; /* +0x006c b0 96 00 00 */ unsigned char NdrOleAllocate[4]; /* +0x0070 66 19 00 00 */ unsigned char NdrOleFree[4]; /* +0x0074 c7 13 00 00 */ unsigned char NdrStubForwardingFunction[4]; /* +0x0078 56 87 00 00 */ unsigned char NdrStubInitializeMarshall[4]; /* +0x007c b3 96 00 00 */ unsigned char NdrpCreateProxy[4]; /* +0x0080 b6 96 00 00 */ unsigned char NdrpCreateStub[4]; /* +0x0084 b8 96 00 00 */ unsigned char NdrpGetProcFormatString[4]; /* +0x0088 bb 96 00 00 */ unsigned char NdrpGetTypeFormatString[4]; /* +0x008c be 96 00 00 */ unsigned char NdrpGetTypeGenCookie[4]; /* +0x0090 bf 96 00 00 */ unsigned char NdrpReleaseTypeFormatString[4]; /* +0x0094 c2 96 00 00 */ unsigned char NdrpReleaseTypeGenCookie[4]; /* +0x0098 d3 18 00 00 */ unsigned char NdrpVarVtOfTypeDesc[4]; /* +0x009c c5 96 00 00 */ }; struct _NDROLE_EXTENSION_ROUTINES_TABLE { unsigned char NdrExtGetCallMethod[4]; /* +0x0000 d5 96 00 00 */ unsigned char NdrExtGetServerObject[4]; /* +0x0004 07 15 00 00 */ unsigned char NdrExtStubInitialize[4]; /* +0x0008 d8 96 00 00 */ unsigned char NdrExtStubGetBuffer[4]; /* +0x000c db 96 00 00 */ unsigned char NdrExtSetErrorStatus[4]; /* +0x0010 de 96 00 00 */ unsigned char NdrExtInterfacePointerBufferSize[4]; /* +0x0014 df 96 00 00 */ unsigned char NdrExtProxyInitialize[4]; /* +0x0018 e2 96 00 00 */ unsigned char NdrExtFreeInterfacePointer[4]; /* +0x001c e4 96 00 00 */ unsigned char NdrExtInterfacePointerMemorySize[4]; /* +0x0020 e7 96 00 00 */ unsigned char NdrExtInterfacePointerMarshall[4]; /* +0x0024 e8 96 00 00 */ unsigned char NdrExtInterfacePointerUnmarshall[4]; /* +0x0028 eb 96 00 00 */ unsigned char NdrExtGetUDTFormat[4]; /* +0x002c ee 96 00 00 */ unsigned char NdrExtProxyGetBuffer[4]; /* +0x0030 f1 96 00 00 */ unsigned char NdrExtProxySendReceive[4]; /* +0x0034 f1 96 00 00 */ unsigned char NdrExtFreeBuffer[4]; /* +0x0038 f1 96 00 00 */ unsigned char NdrExtGetComProtocolVersion[4]; /* +0x003c f4 96 00 00 */ }; struct _GENERIC_PIPE_TYPE { unsigned char pfnPull[4]; /* +0x0000 ff 96 00 00 */ unsigned char pfnPush[4]; /* +0x0004 f9 96 00 00 */ unsigned char pfnAlloc[4]; /* +0x0008 fc 96 00 00 */ char *pState; /* +0x000c */ }; struct ITypeLibVtbl { unsigned char QueryInterface[4]; /* +0x0000 04 97 00 00 */ unsigned char AddRef[4]; /* +0x0004 07 97 00 00 */ unsigned char Release[4]; /* +0x0008 07 97 00 00 */ unsigned char GetTypeInfoCount[4]; /* +0x000c 09 97 00 00 */ unsigned char GetTypeInfo[4]; /* +0x0010 0c 97 00 00 */ unsigned char GetTypeInfoType[4]; /* +0x0014 0f 97 00 00 */ unsigned char GetTypeInfoOfGuid[4]; /* +0x0018 12 97 00 00 */ unsigned char GetLibAttr[4]; /* +0x001c 15 97 00 00 */ unsigned char GetTypeComp[4]; /* +0x0020 18 97 00 00 */ unsigned char GetDocumentation[4]; /* +0x0024 1b 97 00 00 */ unsigned char IsName[4]; /* +0x0028 1e 97 00 00 */ unsigned char FindName[4]; /* +0x002c 21 97 00 00 */ unsigned char ReleaseTLibAttr[4]; /* +0x0030 24 97 00 00 */ }; struct ITypeCompVtbl { unsigned char QueryInterface[4]; /* +0x0000 29 97 00 00 */ unsigned char AddRef[4]; /* +0x0004 2c 97 00 00 */ unsigned char Release[4]; /* +0x0008 2c 97 00 00 */ unsigned char Bind[4]; /* +0x000c 2f 97 00 00 */ unsigned char BindType[4]; /* +0x0010 32 97 00 00 */ }; struct INTERPRETER_OPT_FLAGS { /* unsigned char ServerMustSize[0]; +0x0000 6f 1e 00 00 */ /* unsigned char ClientMustSize[0]; +0x0000 70 1e 00 00 */ /* unsigned char HasReturn[0]; +0x0000 71 1e 00 00 */ /* unsigned char HasPipes[0]; +0x0000 e3 25 00 00 */ /* unsigned char Unused[0]; +0x0000 c9 25 00 00 */ /* unsigned char HasAsyncUuid[0]; +0x0000 73 1e 00 00 */ /* unsigned char HasExtensions[0]; +0x0000 74 1e 00 00 */ unsigned char HasAsyncHandle[1]; /* +0x0000 75 1e 00 00 */ }; struct INTERPRETER_OPT_FLAGS2 { /* unsigned char HasNewCorrDesc[0]; +0x0000 6f 1e 00 00 */ /* unsigned char ClientCorrCheck[0]; +0x0000 70 1e 00 00 */ /* unsigned char ServerCorrCheck[0]; +0x0000 71 1e 00 00 */ /* unsigned char HasNotify[0]; +0x0000 e3 25 00 00 */ /* unsigned char HasNotify2[0]; +0x0000 c9 25 00 00 */ /* unsigned char HasComplexReturn[0]; +0x0000 73 1e 00 00 */ /* unsigned char HasConformanceRange[0]; +0x0000 74 1e 00 00 */ unsigned char HasBigByValueParam[1]; /* +0x0000 75 1e 00 00 */ }; struct NDR_PROC_HEADER_EXTS { unsigned char Size; /* +0x0000 */ unsigned char Flags2[1]; /* +0x0001 39 97 00 00 */ unsigned short ClientCorrHint; /* +0x0002 */ unsigned short ServerCorrHint; /* +0x0004 */ unsigned short NotifyIndex; /* +0x0006 */ }; struct _NDR_PROC_DESC { unsigned short ClientBufferSize; /* +0x0000 */ unsigned short ServerBufferSize; /* +0x0002 */ unsigned char Oi2Flags[1]; /* +0x0004 3c 97 00 00 */ unsigned char NumberParams; /* +0x0005 */ unsigned char NdrExts[8]; /* +0x0006 3d 97 00 00 */ }; struct INTERPRETER_FLAGS { /* unsigned char FullPtrUsed[0]; +0x0000 6f 1e 00 00 */ /* unsigned char RpcSsAllocUsed[0]; +0x0000 70 1e 00 00 */ /* unsigned char ObjectProc[0]; +0x0000 71 1e 00 00 */ /* unsigned char HasRpcFlags[0]; +0x0000 e3 25 00 00 */ /* unsigned char IgnoreObjectException[0]; +0x0000 c9 25 00 00 */ /* unsigned char HasCommOrFault[0]; +0x0000 73 1e 00 00 */ /* unsigned char UseNewInitRoutines[0]; +0x0000 74 1e 00 00 */ unsigned char Unused[1]; /* +0x0000 75 1e 00 00 */ }; struct _NDR_CORRELATION_INFO_DATA { unsigned char *pMemoryObject; /* +0x0000 */ unsigned char pCorrDesc[4]; /* +0x0004 39 19 00 00 */ long Value; /* +0x0008 */ long CheckKind; /* +0x000c */ }; struct _NDR_PIPE_MESSAGE { unsigned short Signature; /* +0x0000 */ unsigned short PipeId; /* +0x0002 */ unsigned short PipeStatus; /* +0x0004 */ unsigned short PipeFlags; /* +0x0006 */ unsigned char pTypeFormat[4]; /* +0x0008 39 19 00 00 */ unsigned char pStubMsg[4]; /* +0x000c 05 1a 00 00 */ unsigned char pPipeObject[4]; /* +0x0010 64 97 00 00 */ }; struct NDR_PIPE_STATE { unsigned char CurrentState[4]; /* +0x0000 74 00 00 00 */ unsigned char TotalElemsCount[4]; /* +0x0004 74 00 00 00 */ unsigned char OrigElemsInChunk[4]; /* +0x0008 74 00 00 00 */ unsigned char ElemsInChunk[4]; /* +0x000c 74 00 00 00 */ unsigned char ElemAlign[4]; /* +0x0010 74 00 00 00 */ unsigned char ElemWireSize[4]; /* +0x0014 74 00 00 00 */ unsigned char ElemMemSize[4]; /* +0x0018 74 00 00 00 */ unsigned char PartialBufferSize[4]; /* +0x001c 74 00 00 00 */ unsigned char *PartialElem; /* +0x0020 */ unsigned char PartialElemSize[4]; /* +0x0024 74 00 00 00 */ unsigned char PartialOffset[4]; /* +0x0028 74 00 00 00 */ /* unsigned char EndOfPipe[0]; +0x002c 1f 23 00 00 */ unsigned char EndOfPipePending[4]; /* +0x002c 20 23 00 00 */ unsigned char LowChunkLimit[4]; /* +0x0030 74 00 00 00 */ unsigned char HighChunkLimit[4]; /* +0x0034 74 00 00 00 */ unsigned char fBlockCopy[4]; /* +0x0038 74 00 00 00 */ unsigned char ElemPad[4]; /* +0x003c 74 00 00 00 */ unsigned char TypeFormat[4]; /* +0x0040 39 19 00 00 */ }; struct _NDR_CORRELATION_INFO_HEADER { unsigned char pCache[4]; /* +0x0000 52 15 00 00 */ unsigned char pInfo[4]; /* +0x0004 52 15 00 00 */ long DataSize; /* +0x0008 */ long DataLen; /* +0x000c */ }; struct _PIPEDESC_FLAGS { /* unsigned char AuxOutBufferAllocated[0]; +0x0000 6a 2e 00 00 */ /* unsigned char NoBufferCallPending[0]; +0x0000 6b 2e 00 00 */ /* unsigned char Reserved[0]; +0x0000 6c 2e 00 00 */ /* unsigned char NoMoreBuffersToRead[0]; +0x0000 6d 2e 00 00 */ /* unsigned char LastPipeSend[0]; +0x0000 6e 2e 00 00 */ unsigned char InPipePush[2]; /* +0x0000 6f 2e 00 00 */ }; struct IRecordInfoVtbl { unsigned char QueryInterface[4]; /* +0x0000 81 97 00 00 */ unsigned char AddRef[4]; /* +0x0004 83 97 00 00 */ unsigned char Release[4]; /* +0x0008 83 97 00 00 */ unsigned char RecordInit[4]; /* +0x000c 86 97 00 00 */ unsigned char RecordClear[4]; /* +0x0010 86 97 00 00 */ unsigned char RecordCopy[4]; /* +0x0014 89 97 00 00 */ unsigned char GetGuid[4]; /* +0x0018 8c 97 00 00 */ unsigned char GetName[4]; /* +0x001c 8f 97 00 00 */ unsigned char GetSize[4]; /* +0x0020 92 97 00 00 */ unsigned char GetTypeInfo[4]; /* +0x0024 95 97 00 00 */ unsigned char GetField[4]; /* +0x0028 98 97 00 00 */ unsigned char GetFieldNoCopy[4]; /* +0x002c 9b 97 00 00 */ unsigned char PutField[4]; /* +0x0030 9e 97 00 00 */ unsigned char PutFieldNoCopy[4]; /* +0x0034 9e 97 00 00 */ unsigned char GetFieldNames[4]; /* +0x0038 a1 97 00 00 */ unsigned char IsMatchingType[4]; /* +0x003c a4 97 00 00 */ unsigned char RecordCreate[4]; /* +0x0040 a6 97 00 00 */ unsigned char RecordCreateCopy[4]; /* +0x0044 a9 97 00 00 */ unsigned char RecordDestroy[4]; /* +0x0048 86 97 00 00 */ }; struct _NDR64_PROC_FORMAT { unsigned char Flags[4]; /* +0x0000 75 00 00 00 */ unsigned char StackSize[4]; /* +0x0004 75 00 00 00 */ unsigned char ConstantClientBufferSize[4]; /* +0x0008 75 00 00 00 */ unsigned char ConstantServerBufferSize[4]; /* +0x000c 75 00 00 00 */ unsigned short RpcFlags; /* +0x0010 */ unsigned short FloatDoubleMask; /* +0x0012 */ unsigned short NumberOfParams; /* +0x0014 */ unsigned short ExtensionSize; /* +0x0016 */ }; struct _NDR_PROC_INFO { unsigned char InterpreterFlags[4]; /* +0x0000 f9 97 00 00 */ unsigned char pProcDesc[4]; /* +0x0004 fb 97 00 00 */ }; struct _NDR_CORRELATION_INFO { unsigned char Header[16]; /* +0x0000 0c 98 00 00 */ unsigned char Data[16]; /* +0x0010 0e 98 00 00 */ }; struct _NDR_ASYNC_MESSAGE { long Version; /* +0x0000 */ long Signature; /* +0x0004 */ unsigned char AsyncHandle[4]; /* +0x0008 a3 13 00 00 */ unsigned char Flags[2]; /* +0x000c 13 98 00 00 */ unsigned short StubPhase; /* +0x000e */ unsigned long RefCount; /* +0x0010 */ unsigned long ErrorCode; /* +0x0014 */ unsigned char RpcMsg[44]; /* +0x0018 2b 29 00 00 */ unsigned char StubMsg[220]; /* +0x0044 04 1a 00 00 */ unsigned long *pdwStubPhase; /* +0x0120 */ unsigned char ProcContext[676]; /* +0x0124 47 29 00 00 */ unsigned char AsyncGuard[16]; /* +0x03c8 09 1c 00 00 */ }; struct tagFastCopyLUIDAccess { /* unsigned char Luid[0]; +0x0000 21 15 00 00 */ long long FastAccess; /* +0x0000 */ }; enum _tagEXPR_TOKEN { FC_EXPR_START = 0, FC_EXPR_ILLEGAL = 0, FC_EXPR_CONST32 = 1, FC_EXPR_CONST64 = 2, FC_EXPR_VAR = 3, FC_EXPR_OPER = 4, FC_EXPR_NOOP = 5, FC_EXPR_END = 6 }; struct _CONTEXT_HANDLE_ELEMENT { unsigned char Next[4]; /* +0x0000 4c 98 00 00 */ unsigned char pContext[4]; /* +0x0004 21 28 00 00 */ unsigned char pCtxtDesc[4]; /* +0x0008 4e 98 00 00 */ unsigned char *Key; /* +0x000c */ }; struct IDispatchVtbl { unsigned char QueryInterface[4]; /* +0x0000 59 98 00 00 */ unsigned char AddRef[4]; /* +0x0004 5b 98 00 00 */ unsigned char Release[4]; /* +0x0008 5b 98 00 00 */ unsigned char GetTypeInfoCount[4]; /* +0x000c 5e 98 00 00 */ unsigned char GetTypeInfo[4]; /* +0x0010 61 98 00 00 */ unsigned char GetIDsOfNames[4]; /* +0x0014 64 98 00 00 */ unsigned char Invoke[4]; /* +0x0018 67 98 00 00 */ }; struct _NDR_ALLOCA_CONTEXT { unsigned char *pBlockPointer; /* +0x0000 */ unsigned char MemoryList[8]; /* +0x0004 44 1f 00 00 */ unsigned long BytesRemaining; /* +0x000c */ unsigned char PreAllocatedBlock[512]; /* +0x0010 76 19 00 00 */ }; struct NONOICF_POINTER_QUEUE_STATE::AllocationElement { unsigned long ItemsAllocated; /* +0x0000 */ unsigned char pNext[4]; /* +0x0004 8f 98 00 00 */ unsigned char Data[440]; /* +0x0008 a5 98 00 00 */ }; struct _tRpcVerifierSettings { unsigned char fFaultInjectImpersonateClient[4]; /* +0x0000 74 00 00 00 */ unsigned char ProbFaultInjectImpersonateClient[4]; /* +0x0004 75 00 00 00 */ unsigned char DelayFaultInjectImpersonateClient[4]; /* +0x0008 75 00 00 00 */ unsigned char fCorruptionInjectServerReceives[4]; /* +0x000c 74 00 00 00 */ unsigned char fCorruptionInjectClientReceives[4]; /* +0x0010 74 00 00 00 */ unsigned char fCorruptionInjectSends[4]; /* +0x0014 74 00 00 00 */ unsigned char fCorruptionInjectNdrSends[4]; /* +0x0018 74 00 00 00 */ unsigned char fCorruptionInjectNdrReturns[4]; /* +0x001c 74 00 00 00 */ unsigned char fCorruptionInjectNdr[4]; /* +0x0020 74 00 00 00 */ unsigned char ProbRpcHeaderCorruption[4]; /* +0x0024 75 00 00 00 */ unsigned char ProbDataCorruption[4]; /* +0x0028 75 00 00 00 */ unsigned char ProbSecureDataCorruption[4]; /* +0x002c 75 00 00 00 */ unsigned char CorruptionPattern[4]; /* +0x0030 bc 98 00 00 */ unsigned char CorruptionSizeType[4]; /* +0x0034 bd 98 00 00 */ unsigned char CorruptionSize[4]; /* +0x0038 75 00 00 00 */ unsigned char CorruptionDistributionType[4]; /* +0x003c be 98 00 00 */ unsigned char ProbBufferTruncation[4]; /* +0x0040 75 00 00 00 */ unsigned char MaxBufferTruncationSize[4]; /* +0x0044 75 00 00 00 */ unsigned char fFaultInjectTransports[4]; /* +0x0048 74 00 00 00 */ unsigned char ProbFaultInjectTransports[4]; /* +0x004c 75 00 00 00 */ unsigned char DelayFaultInjectTransports[4]; /* +0x0050 75 00 00 00 */ unsigned char fSendReplay[4]; /* +0x0054 74 00 00 00 */ unsigned char SentBufferListSize[4]; /* +0x0058 75 00 00 00 */ unsigned char ReplayFrequency[4]; /* +0x005c 75 00 00 00 */ unsigned char fPauseInject[4]; /* +0x0060 74 00 00 00 */ unsigned char PauseInjectIntervalType[4]; /* +0x0064 bf 98 00 00 */ unsigned char PauseInjectIntervalLength[4]; /* +0x0068 75 00 00 00 */ unsigned char PauseInjectPauseType[4]; /* +0x006c bf 98 00 00 */ unsigned char PauseInjectPauseLength[4]; /* +0x0070 75 00 00 00 */ unsigned char fPauseInjectExternalAPIs[4]; /* +0x0074 74 00 00 00 */ unsigned char ProbPauseInjectExternalAPIs[4]; /* +0x0078 75 00 00 00 */ unsigned char PauseInjectExternalAPIsMaxWait[4]; /* +0x007c 75 00 00 00 */ unsigned char IsHighPrivilege[4]; /* +0x0080 74 00 00 00 */ unsigned char fSupressAppVerifierBreaks[4]; /* +0x0084 74 00 00 00 */ unsigned char TestCorruptionInjectCallback[4]; /* +0x0088 c3 98 00 00 */ unsigned char NdrCorruptionCallback[4]; /* +0x008c c7 13 00 00 */ unsigned long NDRVerifierMaxExtensionFactor; /* +0x0090 */ unsigned long NDRVerifierMaxExtensionBufferLength; /* +0x0094 */ unsigned char DelayCorruption[4]; /* +0x0098 75 00 00 00 */ unsigned char InitializeRpcShim[4]; /* +0x009c 26 1b 00 00 */ unsigned char CorruptionInject[4]; /* +0x00a0 c3 98 00 00 */ unsigned char NDRSendCorruptionInject[4]; /* +0x00a4 97 40 00 00 */ unsigned char NDRReturnCorruptionInject[4]; /* +0x00a8 94 25 00 00 */ unsigned char RegisterThreadForPauseInjection[4]; /* +0x00ac 05 21 00 00 */ unsigned char UnregisterThreadForPauseInjection[4]; /* +0x00b0 c7 13 00 00 */ unsigned char CloseAlpcPort[4]; /* +0x00b4 c7 13 00 00 */ }; struct _NDR_PROC_CONTEXT { unsigned char CurrentSyntaxType[4]; /* +0x0000 c6 98 00 00 */ /* unsigned char NdrInfo[0]; +0x0004 c7 98 00 00 */ unsigned char Ndr64Header[8]; /* +0x0004 c9 98 00 00 */ unsigned char pProcFormat[4]; /* +0x000c 39 19 00 00 */ unsigned long NumberParams; /* +0x0010 */ void *Params; /* +0x0014 */ unsigned char *StartofStack; /* +0x0018 */ unsigned char HandleType; /* +0x001c */ unsigned char CorrIncrement; /* +0x001d */ void *SavedGenericHandle; /* +0x0020 */ unsigned char pHandleFormatSave[4]; /* +0x0024 39 19 00 00 */ unsigned char DceTypeFormatString[4]; /* +0x0028 39 19 00 00 */ /* unsigned char IsAsync[0]; +0x002c 17 13 00 00 */ /* unsigned char IsObject[0]; +0x002c 7e 18 00 00 */ /* unsigned char HasPipe[0]; +0x002c 7f 18 00 00 */ /* unsigned char HasComplexReturn[0]; +0x002c 27 1e 00 00 */ /* unsigned char NeedsResend[0]; +0x002c 42 1e 00 00 */ /* unsigned char UseLocator[0]; +0x002c ce 23 00 00 */ /* unsigned char Reserved7[0]; +0x002c ff 1e 00 00 */ /* unsigned char Reserved8[0]; +0x002c 00 1f 00 00 */ unsigned char Reservedleft[4]; /* +0x002c 66 22 00 00 */ unsigned long FloatDoubleMask; /* +0x0030 */ unsigned long ResendCount; /* +0x0034 */ unsigned long RpcFlags; /* +0x0038 */ unsigned long ExceptionFlag; /* +0x003c */ unsigned long StackSize; /* +0x0040 */ unsigned char pSyntaxInfo[4]; /* +0x0044 aa 20 00 00 */ unsigned char pfnValidate[4]; /* +0x0048 cc 98 00 00 */ void *ValidateCookie; /* +0x004c */ unsigned char pfnInit[4]; /* +0x0050 48 98 00 00 */ unsigned char pfnSizing[4]; /* +0x0054 7e 97 00 00 */ unsigned char pfnMarshal[4]; /* +0x0058 7e 97 00 00 */ unsigned char pfnUnMarshal[4]; /* +0x005c 48 98 00 00 */ unsigned char pfnExceptionHandling[4]; /* +0x0060 f8 97 00 00 */ unsigned char pfnClientFinally[4]; /* +0x0064 48 98 00 00 */ unsigned char pfnGetBuffer[4]; /* +0x0068 e6 97 00 00 */ unsigned char pfnSendReceive[4]; /* +0x006c ce 98 00 00 */ unsigned char pPipeDesc[4]; /* +0x0070 42 97 00 00 */ unsigned char pQueueFreeList[4]; /* +0x0074 d5 97 00 00 */ unsigned char pMiniComputeQueue[4]; /* +0x0078 d0 98 00 00 */ unsigned char pConfQueueFreeList[4]; /* +0x007c d2 98 00 00 */ unsigned char pFormatSupplement[4]; /* +0x0080 39 19 00 00 */ unsigned char CurrentActivityID[16]; /* +0x0084 dc 14 00 00 */ unsigned char AllocateContext[528]; /* +0x0094 d3 98 00 00 */ }; struct ITypeInfoVtbl { unsigned char QueryInterface[4]; /* +0x0000 e6 98 00 00 */ unsigned char AddRef[4]; /* +0x0004 e9 98 00 00 */ unsigned char Release[4]; /* +0x0008 e9 98 00 00 */ unsigned char GetTypeAttr[4]; /* +0x000c ec 98 00 00 */ unsigned char GetTypeComp[4]; /* +0x0010 ef 98 00 00 */ unsigned char GetFuncDesc[4]; /* +0x0014 f2 98 00 00 */ unsigned char GetVarDesc[4]; /* +0x0018 f5 98 00 00 */ unsigned char GetNames[4]; /* +0x001c f8 98 00 00 */ unsigned char GetRefTypeOfImplType[4]; /* +0x0020 fb 98 00 00 */ unsigned char GetImplTypeFlags[4]; /* +0x0024 fe 98 00 00 */ unsigned char GetIDsOfNames[4]; /* +0x0028 01 99 00 00 */ unsigned char Invoke[4]; /* +0x002c 04 99 00 00 */ unsigned char GetDocumentation[4]; /* +0x0030 07 99 00 00 */ unsigned char GetDllEntry[4]; /* +0x0034 0a 99 00 00 */ unsigned char GetRefTypeInfo[4]; /* +0x0038 0d 99 00 00 */ unsigned char AddressOfMember[4]; /* +0x003c 10 99 00 00 */ unsigned char CreateInstance[4]; /* +0x0040 13 99 00 00 */ unsigned char GetMops[4]; /* +0x0044 16 99 00 00 */ unsigned char GetContainingTypeLib[4]; /* +0x0048 19 99 00 00 */ unsigned char ReleaseTypeAttr[4]; /* +0x004c 1c 99 00 00 */ unsigned char ReleaseFuncDesc[4]; /* +0x0050 1f 99 00 00 */ unsigned char ReleaseVarDesc[4]; /* +0x0054 22 99 00 00 */ }; struct NDR_POINTER_QUEUE { unsigned char pStubMsg[4]; /* +0x0000 05 1a 00 00 */ unsigned char pQueueState[20]; /* +0x0004 30 29 00 00 */ }; struct NDR_POINTER_QUEUE::STORAGE { unsigned char pHead[4]; /* +0x0000 d5 97 00 00 */ unsigned char pPrevHead[4]; /* +0x0004 d5 97 00 00 */ unsigned char pInsertPointer[4]; /* +0x0008 46 99 00 00 */ unsigned char pPrevInsertPointer[4]; /* +0x000c 46 99 00 00 */ }; struct POINTER_MEMSIZE_SWAP_CONTEXT { unsigned char pStubMsg[4]; /* +0x0000 05 1a 00 00 */ unsigned long MemorySave; /* +0x0004 */ unsigned char *pBufferSave; /* +0x0008 */ unsigned char DoSwap[4]; /* +0x000c 5b 54 00 00 */ }; struct NDR_ALLOC_ALL_NODES_CONTEXT { unsigned char *AllocAllNodesMemory; /* +0x0000 */ unsigned char *AllocAllNodesMemoryBegin; /* +0x0004 */ unsigned char *AllocAllNodesMemoryEnd; /* +0x0008 */ unsigned char IsByteCount[4]; /* +0x000c 74 00 00 00 */ }; struct POINTER_BUFFER_SWAP_CONTEXT { unsigned char pStubMsg[4]; /* +0x0000 05 1a 00 00 */ unsigned char *pBufferSave; /* +0x0004 */ unsigned char DoSwap[4]; /* +0x0008 5b 54 00 00 */ }; struct _NDR_PIPE_DESC { unsigned char pPipeMsg[4]; /* +0x0000 4b 97 00 00 */ short CurrentPipe; /* +0x0004 */ short PrevPipe; /* +0x0006 */ short InPipes; /* +0x0008 */ short OutPipes; /* +0x000a */ short TotalPipes; /* +0x000c */ short PipeVersion; /* +0x000e */ unsigned char Flags[4]; /* +0x0010 8f 99 00 00 */ unsigned long PipeException; /* +0x0014 */ unsigned char *DispatchBuffer; /* +0x0018 */ unsigned long DispatchBufferLength; /* +0x001c */ unsigned long LastPartialSize; /* +0x0020 */ unsigned char Leftover[8]; /* +0x0024 7f 19 00 00 */ unsigned long LeftoverSize; /* +0x002c */ unsigned char *BufferSave; /* +0x0030 */ unsigned long LengthSave; /* +0x0034 */ unsigned char RuntimeState[68]; /* +0x0038 90 99 00 00 */ void *ChainingBuffer; /* +0x007c */ unsigned long ChainingBufferSize; /* +0x0080 */ unsigned char pPipeHelper[4]; /* +0x0084 70 99 00 00 */ unsigned char pAllocContext[4]; /* +0x0088 91 99 00 00 */ }; struct _REFID_TO_FULLPTR_ELEMENT { unsigned char Next[4]; /* +0x0000 b7 99 00 00 */ void *Pointer; /* +0x0004 */ unsigned long RefId; /* +0x0008 */ unsigned char State; /* +0x000c */ }; struct PARAM_ATTRIBUTES { /* unsigned char MustSize[0]; +0x0000 6a 2e 00 00 */ /* unsigned char MustFree[0]; +0x0000 6b 2e 00 00 */ /* unsigned char IsPipe[0]; +0x0000 6c 2e 00 00 */ /* unsigned char IsIn[0]; +0x0000 6d 2e 00 00 */ /* unsigned char IsOut[0]; +0x0000 6e 2e 00 00 */ /* unsigned char IsReturn[0]; +0x0000 6f 2e 00 00 */ /* unsigned char IsBasetype[0]; +0x0000 70 2e 00 00 */ /* unsigned char IsByValue[0]; +0x0000 71 2e 00 00 */ /* unsigned char IsSimpleRef[0]; +0x0000 72 2e 00 00 */ /* unsigned char IsDontCallFreeInst[0]; +0x0000 73 2e 00 00 */ /* unsigned char SaveForAsyncFinish[0]; +0x0000 74 2e 00 00 */ /* unsigned char IsPartialIgnore[0]; +0x0000 75 2e 00 00 */ /* unsigned char IsForceAllocate[0]; +0x0000 76 2e 00 00 */ unsigned char ServerAllocSize[2]; /* +0x0000 77 2e 00 00 */ }; struct NDR_CONTEXT_HANDLE_FLAGS { /* unsigned char CannotBeNull[0]; +0x0000 6f 1e 00 00 */ /* unsigned char Serialize[0]; +0x0000 70 1e 00 00 */ /* unsigned char NoSerialize[0]; +0x0000 71 1e 00 00 */ /* unsigned char IsStrict[0]; +0x0000 e3 25 00 00 */ /* unsigned char IsReturn[0]; +0x0000 c9 25 00 00 */ /* unsigned char IsOut[0]; +0x0000 73 1e 00 00 */ /* unsigned char IsIn[0]; +0x0000 74 1e 00 00 */ unsigned char IsViaPtr[1]; /* +0x0000 75 1e 00 00 */ }; struct NDR_CONTEXT_HANDLE_ARG_DESC { unsigned char Fc; /* +0x0000 */ unsigned char Flags[1]; /* +0x0001 c1 99 00 00 */ unsigned char RundownRtnIndex; /* +0x0002 */ unsigned char ParamOrdinal; /* +0x0003 */ }; struct PARAM_DESCRIPTION { unsigned char ParamAttr[2]; /* +0x0000 c4 99 00 00 */ unsigned short StackOffset; /* +0x0002 */ unsigned short TypeOffset; /* +0x0004 */ unsigned char SimpleType[2]; /* +0x0004 c5 99 00 00 */ }; struct PARAM_DESCRIPTION::<unnamed-tag>::<unnamed-type-SimpleType> { unsigned char Type; /* +0x0000 */ unsigned char Unused; /* +0x0001 */ }; struct _NDR_CALLBACK_ROUTINES_TABLE { unsigned char NdrpServerMarshal[4]; /* +0x0000 7e 97 00 00 */ unsigned char NdrpServerOutInit[4]; /* +0x0004 94 25 00 00 */ unsigned char NdrpSizing[4]; /* +0x0008 7e 97 00 00 */ unsigned char NdrClientZeroOut[4]; /* +0x000c b8 98 00 00 */ unsigned char I_RpcSetNDRSlot[4]; /* +0x0010 cc 19 00 00 */ unsigned char I_RpcGetAndSetNDRSlot[4]; /* +0x0014 e4 99 00 00 */ unsigned char I_RpcGetNDRSlot[4]; /* +0x0018 25 99 00 00 */ unsigned char NdrpClientMarshal[4]; /* +0x001c 7e 97 00 00 */ unsigned char NdrpClientUnMarshal[4]; /* +0x0020 48 98 00 00 */ unsigned char NdrpFreeMemoryList[4]; /* +0x0024 94 25 00 00 */ unsigned char NdrpFreeParams[4]; /* +0x0028 2b 98 00 00 */ unsigned char NdrpServerUnMarshal[4]; /* +0x002c ce 98 00 00 */ unsigned char NdrpPerformRpcInitialization[4]; /* +0x0030 de 4f 00 00 */ unsigned char GlobalMutexClearExternal[4]; /* +0x0034 26 1b 00 00 */ unsigned char GlobalMutexRequestExternal[4]; /* +0x0038 26 1b 00 00 */ unsigned char PrintCurrentStackTrace[4]; /* +0x003c 27 99 00 00 */ unsigned char NdrpCheckMIDLRobust[4]; /* +0x0040 bb 98 00 00 */ unsigned char DbgPrintUUID[4]; /* +0x0044 e5 99 00 00 */ unsigned char NdrpAddCorrelationData[4]; /* +0x0048 cb 97 00 00 */ unsigned char NdrpRecordCustomUnmarshal[4]; /* +0x004c 56 98 00 00 */ unsigned char NdrpComputeConformance[4]; /* +0x0050 e7 99 00 00 */ unsigned char NdrpLogIIDMisMatchEvent[4]; /* +0x0054 39 99 00 00 */ unsigned char pfnMemSizeRoutines[4]; /* +0x0058 e9 99 00 00 */ unsigned char pfnConvertRoutines[4]; /* +0x005c eb 99 00 00 */ unsigned char pfnFreeRoutines[4]; /* +0x0060 d0 96 00 00 */ unsigned char pfnMarshallRoutines[4]; /* +0x0064 8a 96 00 00 */ unsigned char pfnSizeRoutines[4]; /* +0x0068 d0 96 00 00 */ unsigned char pfnUnmarshallRoutines[4]; /* +0x006c cd 96 00 00 */ unsigned char GetRpcVerifierSettings[4]; /* +0x0070 a2 99 00 00 */ unsigned char gfRPCVerifierEnabled[4]; /* +0x0074 74 00 00 00 */ unsigned char AllocWrapper[4]; /* +0x0078 66 19 00 00 */ unsigned char FreeWrapper[4]; /* +0x007c c7 13 00 00 */ }; struct POINTER_BUFFERLENGTH_SWAP_CONTEXT { unsigned char pStubMsg[4]; /* +0x0000 05 1a 00 00 */ unsigned long LengthSave; /* +0x0004 */ unsigned char DoSwap[4]; /* +0x0008 5b 54 00 00 */ }; struct CORRELATION_CONTEXT { unsigned char pStubMsg[4]; /* +0x0000 11 9a 00 00 */ unsigned char pCorrMemorySave[4]; /* +0x0004 d3 7d 00 00 */ }; struct SAVE_NDRSLOT { void *pOldSlotValue; /* +0x0000 */ unsigned char fSucceededInSet; /* +0x0004 */ }; struct _FULL_PTR_TO_REFID_ELEMENT { unsigned char Next[4]; /* +0x0000 29 9a 00 00 */ void *Pointer; /* +0x0004 */ unsigned long RefId; /* +0x0008 */ unsigned char State; /* +0x000c */ }; struct _Flags { /* unsigned char ValidCallPending[0]; +0x0000 6a 2e 00 00 */ /* unsigned char ErrorPending[0]; +0x0000 6b 2e 00 00 */ /* unsigned char BadStubData[0]; +0x0000 6c 2e 00 00 */ /* unsigned char RuntimeCleanedUp[0]; +0x0000 6d 2e 00 00 */ /* unsigned char ClientHandleCreated[0]; +0x0000 6e 2e 00 00 */ /* unsigned char HandlelessObjCall[0]; +0x0000 6f 2e 00 00 */ /* unsigned char HasBigByValueArg[0]; +0x0000 70 2e 00 00 */ /* unsigned char ClientDcomPipeCall[0]; +0x0000 71 2e 00 00 */ unsigned char Unused[2]; /* +0x0000 3d 9a 00 00 */ }; struct IRpcProxyBufferVtbl { unsigned char QueryInterface[4]; /* +0x0000 54 9a 00 00 */ unsigned char AddRef[4]; /* +0x0004 62 87 00 00 */ unsigned char Release[4]; /* +0x0008 62 87 00 00 */ unsigned char Connect[4]; /* +0x000c 65 87 00 00 */ unsigned char Disconnect[4]; /* +0x0010 67 87 00 00 */ }; struct _MIDL_TYPE_FORMAT_STRING { short Pad; /* +0x0000 */ unsigned char Format[2364]; /* +0x0002 57 9a 00 00 */ }; struct tagMethodInfo { unsigned char pFuncDesc[4]; /* +0x0000 c1 40 00 00 */ unsigned char pTypeInfo[4]; /* +0x0004 a1 2a 00 00 */ }; struct TypeInfoCache { unsigned char iid[16]; /* +0x0000 dc 14 00 00 */ unsigned char pVtbl[4]; /* +0x0010 6b 9a 00 00 */ unsigned long dwTickCount; /* +0x0014 */ }; struct tagCStdProxyBuffer2 { unsigned char lpVtbl[4]; /* +0x0000 70 9a 00 00 */ unsigned char pProxyVtbl[4]; /* +0x0004 3d 19 00 00 */ long RefCount; /* +0x0008 */ unsigned char punkOuter[4]; /* +0x000c 7f 17 00 00 */ unsigned char pChannel[4]; /* +0x0010 68 19 00 00 */ unsigned char pBaseProxy[4]; /* +0x0014 7f 17 00 00 */ unsigned char pBaseProxyBuffer[4]; /* +0x0018 63 1d 00 00 */ unsigned char pPSFactory[4]; /* +0x001c a4 72 00 00 */ unsigned char iidBase[16]; /* +0x0020 dc 14 00 00 */ unsigned char pCallFactoryVtbl[4]; /* +0x0030 73 9a 00 00 */ unsigned char pAsyncIID[4]; /* +0x0034 4a 16 00 00 */ unsigned char pRMBVtbl[4]; /* +0x0038 76 9a 00 00 */ }; struct tagCStdStubBuffer2 { unsigned char lpForwardingVtbl[4]; /* +0x0000 3d 19 00 00 */ unsigned char pBaseStubBuffer[4]; /* +0x0004 68 1d 00 00 */ unsigned char lpVtbl[4]; /* +0x0008 7a 9a 00 00 */ long RefCount; /* +0x000c */ unsigned char pvServerObject[4]; /* +0x0010 7f 17 00 00 */ unsigned char pCallFactoryVtbl[4]; /* +0x0014 73 9a 00 00 */ unsigned char pAsyncIID[4]; /* +0x0018 4a 16 00 00 */ unsigned char pPSFactory[4]; /* +0x001c a4 72 00 00 */ unsigned char pRMBVtbl[4]; /* +0x0020 76 9a 00 00 */ }; struct IReleaseMarshalBuffersVtbl { unsigned char QueryInterface[4]; /* +0x0000 86 9a 00 00 */ unsigned char AddRef[4]; /* +0x0004 89 9a 00 00 */ unsigned char Release[4]; /* +0x0008 89 9a 00 00 */ unsigned char ReleaseMarshalBuffer[4]; /* +0x000c 8c 9a 00 00 */ }; struct CProcGen { unsigned char _pProcFormatString[4]; /* +0x0000 39 19 00 00 */ unsigned short _offset; /* +0x0004 */ unsigned short _stackSize; /* +0x0006 */ unsigned long _clientBufferSize; /* +0x0008 */ unsigned long _serverBufferSize; /* +0x000c */ unsigned char _fClientMustSize[4]; /* +0x0010 74 00 00 00 */ unsigned char _fServerMustSize[4]; /* +0x0014 74 00 00 00 */ unsigned char _fClientCorrCheck[4]; /* +0x0018 74 00 00 00 */ unsigned char _fServerCorrCheck[4]; /* +0x001c 74 00 00 00 */ unsigned short _usFloatArgMask; /* +0x0020 */ unsigned short _usFloatSlots; /* +0x0022 */ unsigned char _pTypeGen[4]; /* +0x0024 90 9a 00 00 */ }; struct _MemoryInfo { unsigned short MemorySize; /* +0x0000 */ unsigned short MemoryAlignment; /* +0x0002 */ unsigned short WireSize; /* +0x0004 */ unsigned short WireAlignment; /* +0x0006 */ }; struct CTypeGen { unsigned char _pTypeFormat[4]; /* +0x0000 39 19 00 00 */ unsigned short _cbTypeFormat; /* +0x0004 */ unsigned short _offset; /* +0x0006 */ unsigned long _uStructSize; /* +0x0008 */ }; struct TypeInfoVtbl { long cRefs; /* +0x0000 */ unsigned char iid[16]; /* +0x0004 dc 14 00 00 */ unsigned char fIsDual[4]; /* +0x0014 74 00 00 00 */ unsigned char stubDesc[80]; /* +0x0018 31 29 00 00 */ unsigned char stubInfo[32]; /* +0x0068 12 48 00 00 */ unsigned char stubVtbl[56]; /* +0x0088 6e 87 00 00 */ unsigned char proxyInfo[24]; /* +0x00c0 f5 50 00 00 */ unsigned char proxyVtbl[8]; /* +0x00d8 73 87 00 00 */ }; struct ICallFactoryVtbl { unsigned char QueryInterface[4]; /* +0x0000 07 9b 00 00 */ unsigned char AddRef[4]; /* +0x0004 49 8c 00 00 */ unsigned char Release[4]; /* +0x0008 49 8c 00 00 */ unsigned char CreateCall[4]; /* +0x000c 0a 9b 00 00 */ }; struct ISynchronizeVtbl { unsigned char QueryInterface[4]; /* +0x0000 0f 9b 00 00 */ unsigned char AddRef[4]; /* +0x0004 11 9b 00 00 */ unsigned char Release[4]; /* +0x0008 11 9b 00 00 */ unsigned char Wait[4]; /* +0x000c 14 9b 00 00 */ unsigned char Signal[4]; /* +0x0010 16 9b 00 00 */ unsigned char Reset[4]; /* +0x0014 16 9b 00 00 */ }; struct _NdrDcomAsyncFlags { /* unsigned char AsyncMsgSet[0]; +0x0000 17 13 00 00 */ /* unsigned char BeginStarted[0]; +0x0000 7e 18 00 00 */ /* unsigned char BeginDone[0]; +0x0000 7f 18 00 00 */ /* unsigned char FinishStarted[0]; +0x0000 27 1e 00 00 */ /* unsigned char FinishDone[0]; +0x0000 42 1e 00 00 */ /* unsigned char BeginError[0]; +0x0000 ce 23 00 00 */ /* unsigned char FinishError[0]; +0x0000 ff 1e 00 00 */ /* unsigned char InvokeForwarded[0]; +0x0000 00 1f 00 00 */ unsigned char Unused[4]; /* +0x0000 19 9b 00 00 */ }; struct tagCStdAsyncStubBuffer { void *lpForwardingVtbl; /* +0x0000 */ unsigned char pBaseStubBuffer[4]; /* +0x0004 68 1d 00 00 */ unsigned char lpVtbl[4]; /* +0x0008 7a 9a 00 00 */ long RefCount; /* +0x000c */ unsigned char pvServerObject[4]; /* +0x0010 7f 17 00 00 */ unsigned char pCallFactoryVtbl[4]; /* +0x0014 73 9a 00 00 */ unsigned char pAsyncIID[4]; /* +0x0018 4a 16 00 00 */ unsigned char pPSFactory[4]; /* +0x001c a4 72 00 00 */ unsigned char pRMBVtbl[4]; /* +0x0020 76 9a 00 00 */ unsigned char pSynchronizeVtbl[4]; /* +0x0024 1e 9b 00 00 */ unsigned char CallState[20]; /* +0x0028 1f 9b 00 00 */ }; struct tagCStdStubBuffer { unsigned char lpVtbl[4]; /* +0x0000 7a 9a 00 00 */ long RefCount; /* +0x0004 */ unsigned char pvServerObject[4]; /* +0x0008 7f 17 00 00 */ unsigned char pCallFactoryVtbl[4]; /* +0x000c 73 9a 00 00 */ unsigned char pAsyncIID[4]; /* +0x0010 4a 16 00 00 */ unsigned char pPSFactory[4]; /* +0x0014 a4 72 00 00 */ unsigned char pRMBVtbl[4]; /* +0x0018 76 9a 00 00 */ }; struct _NdrDcomAsyncCallState { unsigned long Signature; /* +0x0000 */ unsigned long Lock; /* +0x0004 */ void *pAsyncMsg; /* +0x0008 */ unsigned char Flags[4]; /* +0x000c 24 9b 00 00 */ unsigned char Hr[4]; /* +0x0010 08 00 00 00 */ }; struct IRpcStubBufferVtbl { unsigned char QueryInterface[4]; /* +0x0000 90 96 00 00 */ unsigned char AddRef[4]; /* +0x0004 97 87 00 00 */ unsigned char Release[4]; /* +0x0008 97 87 00 00 */ unsigned char Connect[4]; /* +0x000c 9a 87 00 00 */ unsigned char Disconnect[4]; /* +0x0010 9c 87 00 00 */ unsigned char Invoke[4]; /* +0x0014 9f 87 00 00 */ unsigned char IsIIDSupported[4]; /* +0x0018 8d 96 00 00 */ unsigned char CountRefs[4]; /* +0x001c 97 87 00 00 */ unsigned char DebugServerQueryInterface[4]; /* +0x0020 a5 87 00 00 */ unsigned char DebugServerRelease[4]; /* +0x0024 a8 87 00 00 */ }; struct IPSFactoryHookVtbl { unsigned char QueryInterface[4]; /* +0x0000 38 9b 00 00 */ unsigned char AddRef[4]; /* +0x0004 89 87 00 00 */ unsigned char Release[4]; /* +0x0008 89 87 00 00 */ unsigned char CreateProxy[4]; /* +0x000c 3b 9b 00 00 */ unsigned char CreateStub[4]; /* +0x0010 3e 9b 00 00 */ unsigned char HkGetProxyFileInfo[4]; /* +0x0014 41 9b 00 00 */ }; struct tagCStdProxyBuffer { unsigned char lpVtbl[4]; /* +0x0000 70 9a 00 00 */ unsigned char pProxyVtbl[4]; /* +0x0004 3d 19 00 00 */ long RefCount; /* +0x0008 */ unsigned char punkOuter[4]; /* +0x000c 7f 17 00 00 */ unsigned char pChannel[4]; /* +0x0010 68 19 00 00 */ unsigned char pPSFactory[4]; /* +0x0014 a4 72 00 00 */ unsigned char Pad_pBaseProxyBuffer[4]; /* +0x0018 63 1d 00 00 */ unsigned char Pad_pPSFactory[4]; /* +0x001c a4 72 00 00 */ unsigned char Pad_iidBase[16]; /* +0x0020 dc 14 00 00 */ unsigned char pCallFactoryVtbl[4]; /* +0x0030 73 9a 00 00 */ unsigned char pAsyncIID[4]; /* +0x0034 4a 16 00 00 */ unsigned char pRMBVtbl[4]; /* +0x0038 76 9a 00 00 */ }; struct IRpcChannelBuffer3Vtbl { unsigned char QueryInterface[4]; /* +0x0000 5f 9b 00 00 */ unsigned char AddRef[4]; /* +0x0004 62 9b 00 00 */ unsigned char Release[4]; /* +0x0008 62 9b 00 00 */ unsigned char GetBuffer[4]; /* +0x000c 65 9b 00 00 */ unsigned char SendReceive[4]; /* +0x0010 68 9b 00 00 */ unsigned char FreeBuffer[4]; /* +0x0014 6b 9b 00 00 */ unsigned char GetDestCtx[4]; /* +0x0018 6e 9b 00 00 */ unsigned char IsConnected[4]; /* +0x001c 70 9b 00 00 */ unsigned char GetProtocolVersion[4]; /* +0x0020 73 9b 00 00 */ unsigned char Send[4]; /* +0x0024 68 9b 00 00 */ unsigned char Receive[4]; /* +0x0028 76 9b 00 00 */ unsigned char Cancel[4]; /* +0x002c 6b 9b 00 00 */ unsigned char GetCallContext[4]; /* +0x0030 79 9b 00 00 */ unsigned char GetDestCtxEx[4]; /* +0x0034 7c 9b 00 00 */ unsigned char GetState[4]; /* +0x0038 68 9b 00 00 */ unsigned char RegisterAsync[4]; /* +0x003c 7f 9b 00 00 */ }; struct IAsyncRpcChannelBufferVtbl { unsigned char QueryInterface[4]; /* +0x0000 85 9b 00 00 */ unsigned char AddRef[4]; /* +0x0004 88 9b 00 00 */ unsigned char Release[4]; /* +0x0008 88 9b 00 00 */ unsigned char GetBuffer[4]; /* +0x000c 8b 9b 00 00 */ unsigned char SendReceive[4]; /* +0x0010 8e 9b 00 00 */ unsigned char FreeBuffer[4]; /* +0x0014 91 9b 00 00 */ unsigned char GetDestCtx[4]; /* +0x0018 94 9b 00 00 */ unsigned char IsConnected[4]; /* +0x001c 96 9b 00 00 */ unsigned char GetProtocolVersion[4]; /* +0x0020 99 9b 00 00 */ unsigned char Send[4]; /* +0x0024 9c 9b 00 00 */ unsigned char Receive[4]; /* +0x0028 8e 9b 00 00 */ unsigned char GetDestCtxEx[4]; /* +0x002c 9f 9b 00 00 */ }; struct tagCStdAsyncProxyBuffer { unsigned char lpVtbl[4]; /* +0x0000 70 9a 00 00 */ unsigned char pProxyVtbl[4]; /* +0x0004 3d 19 00 00 */ long RefCount; /* +0x0008 */ unsigned char punkOuter[4]; /* +0x000c 7f 17 00 00 */ unsigned char pChannel[4]; /* +0x0010 68 19 00 00 */ unsigned char map[4]; /* +0x0014 a2 9b 00 00 */ unsigned char pBaseProxyBuffer[4]; /* +0x0018 63 1d 00 00 */ unsigned char pPSFactory[4]; /* +0x001c a4 72 00 00 */ unsigned char iidBase[16]; /* +0x0020 dc 14 00 00 */ unsigned char pCallFactoryVtbl[4]; /* +0x0030 73 9a 00 00 */ unsigned char pSyncIID[4]; /* +0x0034 4a 16 00 00 */ unsigned char pRMBVtbl[4]; /* +0x0038 76 9a 00 00 */ unsigned char CallState[20]; /* +0x003c 1f 9b 00 00 */ }; struct _CStdProxyBufferMap { unsigned char pBaseProxy[4]; /* +0x0000 7f 17 00 00 */ }; struct tagChannelWrapper { unsigned char lpVtbl[4]; /* +0x0000 a9 9b 00 00 */ long RefCount; /* +0x0004 */ unsigned char pIID[4]; /* +0x0008 4a 16 00 00 */ unsigned char pChannel[4]; /* +0x000c 68 19 00 00 */ }; struct IAsyncManagerVtbl { unsigned char QueryInterface[4]; /* +0x0000 ae 9b 00 00 */ unsigned char AddRef[4]; /* +0x0004 b1 9b 00 00 */ unsigned char Release[4]; /* +0x0008 b1 9b 00 00 */ unsigned char CompleteCall[4]; /* +0x000c b4 9b 00 00 */ unsigned char GetCallContext[4]; /* +0x0010 ae 9b 00 00 */ unsigned char GetState[4]; /* +0x0014 b7 9b 00 00 */ }; struct IRpcChannelBuffer2Vtbl { unsigned char QueryInterface[4]; /* +0x0000 bd 9b 00 00 */ unsigned char AddRef[4]; /* +0x0004 c0 9b 00 00 */ unsigned char Release[4]; /* +0x0008 c0 9b 00 00 */ unsigned char GetBuffer[4]; /* +0x000c c3 9b 00 00 */ unsigned char SendReceive[4]; /* +0x0010 c6 9b 00 00 */ unsigned char FreeBuffer[4]; /* +0x0014 c9 9b 00 00 */ unsigned char GetDestCtx[4]; /* +0x0018 cc 9b 00 00 */ unsigned char IsConnected[4]; /* +0x001c ce 9b 00 00 */ unsigned char GetProtocolVersion[4]; /* +0x0020 d1 9b 00 00 */ }; struct _NDR_DCOM_OI2_PROC_HEADER { unsigned char HandleType; /* +0x0000 */ unsigned char OldOiFlags[1]; /* +0x0001 f9 97 00 00 */ unsigned short RpcFlagsLow; /* +0x0002 */ unsigned short RpcFlagsHi; /* +0x0004 */ unsigned short ProcNum; /* +0x0006 */ unsigned short StackSize; /* +0x0008 */ unsigned short ClientBufferSize; /* +0x000a */ unsigned short ServerBufferSize; /* +0x000c */ unsigned char Oi2Flags[1]; /* +0x000e 3c 97 00 00 */ unsigned char NumberParams; /* +0x000f */ }; struct _NDR_DCOM_ASYNC_MESSAGE { long Version; /* +0x0000 */ long Signature; /* +0x0004 */ unsigned char SyntaxType[4]; /* +0x0008 c6 98 00 00 */ long nBeginParams; /* +0x000c */ void *BeginParams; /* +0x0010 */ long nFinishParams; /* +0x0014 */ void *FinishParams; /* +0x0018 */ unsigned char *BeginStack; /* +0x001c */ unsigned char *FinishStack; /* +0x0020 */ unsigned long BeginStackSize; /* +0x0024 */ unsigned long FinishStackSize; /* +0x0028 */ unsigned char Flags[4]; /* +0x002c 13 98 00 00 */ unsigned long RefCount; /* +0x0030 */ void *pThis; /* +0x0034 */ void *pAsyncPB; /* +0x0038 */ void *pAsyncSB; /* +0x003c */ unsigned long *pdwStubPhase; /* +0x0040 */ unsigned short StubPhase; /* +0x0044 */ unsigned long ErrorCode; /* +0x0048 */ unsigned char RpcMsg[44]; /* +0x004c 2b 29 00 00 */ unsigned char StubMsg[220]; /* +0x0078 04 1a 00 00 */ unsigned char ProcContext[676]; /* +0x0154 47 29 00 00 */ unsigned char *pArg; /* +0x03f8 */ unsigned long long AppStack; /* +0x0400 */ }; enum UDTAlignmentWorkaroundAction { UDT_ACTION_INVALID = 0, UDT_ACTION_NOOP = 1, UDT_ACTION_USEOLDDCOM56 = 2, UDT_ACTION_USE_NEWDCOM56_SIMPLESTRUCT = 3, UDT_ACTION_USE_NEWDCOM56_NORMAL = 4 }; struct _NDR_FCDEF_CORRELATION { /* unsigned char Type[0]; +0x0000 1c 9c 00 00 */ /* unsigned char Kind[0]; +0x0000 1d 9c 00 00 */ unsigned char Operation[2]; /* +0x0000 3d 9a 00 00 */ short Offset; /* +0x0002 */ unsigned char CorrFlags[2]; /* +0x0004 1e 9c 00 00 */ unsigned char Reserved[2]; /* +0x0006 c3 32 00 00 */ }; struct _NDR_CORRELATION_FLAGS { /* unsigned char Early[0]; +0x0000 6f 1e 00 00 */ /* unsigned char Split[0]; +0x0000 70 1e 00 00 */ /* unsigned char IsIidIs[0]; +0x0000 71 1e 00 00 */ /* unsigned char DontCheck[0]; +0x0000 e3 25 00 00 */ /* unsigned char Ranged[0]; +0x0000 c9 25 00 00 */ unsigned char Unused[1]; /* +0x0000 e4 25 00 00 */ }; struct tagForwardProcBuffer { unsigned char pMethodsa[96]; /* +0x0000 8a 9c 00 00 */ unsigned char pNext[4]; /* +0x0060 85 9c 00 00 */ unsigned char pAsm[29]; /* +0x0064 4e 4d 00 00 */ unsigned char pMethodsb[99]; /* +0x0081 8a 9c 00 00 */ }; struct tagStublessProcBuffer { unsigned char pMethodsa[112]; /* +0x0000 8d 9c 00 00 */ unsigned char pNext[4]; /* +0x0070 88 9c 00 00 */ unsigned char pAsm[16]; /* +0x0074 09 1c 00 00 */ unsigned char pMethodsb[112]; /* +0x0084 8d 9c 00 00 */ }; struct ActivatableClassRegistrationEntryProperties { unsigned char CLSID[4]; /* +0x0000 b9 9c 00 00 */ unsigned char ActivationType[4]; /* +0x0004 92 67 00 00 */ unsigned char Server[8]; /* +0x0008 b3 9c 00 00 */ unsigned char DllPath[12]; /* +0x0010 a0 9c 00 00 */ unsigned char Threading[8]; /* +0x001c 97 9c 00 00 */ unsigned char CustomAttributes[4]; /* +0x0024 44 9d 00 00 */ }; struct ClassIdRegistrationEntryProperties { unsigned char ActivatableClassId[4]; /* +0x0000 b9 9c 00 00 */ unsigned char PackageMoniker[4]; /* +0x0004 b9 9c 00 00 */ }; struct ExtensionRegistrationEntryProperties { unsigned char Vendor[4]; /* +0x0000 b9 9c 00 00 */ unsigned char Icon[4]; /* +0x0004 b9 9c 00 00 */ unsigned char DisplayName[4]; /* +0x0008 b9 9c 00 00 */ unsigned char Description[4]; /* +0x000c b9 9c 00 00 */ unsigned char CustomProperties[4]; /* +0x0010 44 9d 00 00 */ }; struct ServerRegistrationEntryProperties { unsigned char ExePath[8]; /* +0x0000 a6 9c 00 00 */ unsigned char CommandLine[12]; /* +0x0008 a0 9c 00 00 */ unsigned char AppUserModelId[8]; /* +0x0014 b3 9c 00 00 */ unsigned char Instancing[4]; /* +0x001c b3 8e 00 00 */ unsigned char IdentityType[4]; /* +0x0020 ac 8e 00 00 */ unsigned char Permissions[8]; /* +0x0024 65 9d 00 00 */ unsigned char ActivatableClasses[4]; /* +0x002c 2b 9d 00 00 */ unsigned char PackageMoniker[8]; /* +0x0030 b3 9c 00 00 */ }; struct DebugInformationRegistrationEntryProperties { unsigned char DebugPath[8]; /* +0x0000 a6 9c 00 00 */ unsigned char Environment[8]; /* +0x0008 25 9d 00 00 */ }; struct ExpandableString { unsigned char Unexpanded[4]; /* +0x0000 b9 9c 00 00 */ unsigned char IsExpandable[4]; /* +0x0004 30 00 00 00 */ }; struct ProxyStubRegistrationEntryProperties { unsigned char Description[4]; /* +0x0000 b9 9c 00 00 */ unsigned char DllPath[4]; /* +0x0004 b9 9c 00 00 */ }; enum ExtensionRegistrationEntryPropertyIndex { Vendor = 0, Icon = 1, DisplayName = 2, Description = 3, CustomProperties = 4, NumProperties = 5 }; struct InterfaceRegistrationEntryProperties { unsigned char InterfaceName[4]; /* +0x0000 b9 9c 00 00 */ unsigned char ProxyStubCLSID[4]; /* +0x0004 b9 9c 00 00 */ }; struct EntryPropertyStore { unsigned char MapView[4]; /* +0x0000 24 67 00 00 */ }; struct XWinRT::XPlex { unsigned char pNext[4]; /* +0x0000 03 a4 00 00 */ }; enum XWinRT::ComLock::Kind { Kind_Srw = 0, Kind_StaReentrancy = 1 }; struct XWinRT::detail::ReentrancyGuard<1> { unsigned char _hr[4]; /* +0x0000 08 00 00 00 */ unsigned char _pGuard[4]; /* +0x0004 6a 1e 00 00 */ }; struct XWinRT::FakeStl::_align_type<int,4> { /* unsigned char _val[0]; +0x0000 74 00 00 00 */ unsigned char _pad[4]; /* +0x0000 36 a6 00 00 */ }; struct XWinRT::IntVersionTag { unsigned char _iVersion[4]; /* +0x0000 74 00 00 00 */ }; enum Windows::Foundation::Collections::CollectionChange { Reset = 0, ItemInserted = 1, ItemRemoved = 2, ItemChanged = 3 }; struct _lclor_MIDL_TYPE_FORMAT_STRING { short Pad; /* +0x0000 */ unsigned char Format[806]; /* +0x0002 5d a8 00 00 */ }; struct _lclor_MIDL_PROC_FORMAT_STRING { short Pad; /* +0x0000 */ unsigned char Format[752]; /* +0x0002 61 a8 00 00 */ }; struct _srgtprot_MIDL_TYPE_FORMAT_STRING { short Pad; /* +0x0000 */ unsigned char Format[48]; /* +0x0002 76 a8 00 00 */ }; struct _srgtprot_MIDL_PROC_FORMAT_STRING { short Pad; /* +0x0000 */ unsigned char Format[330]; /* +0x0002 79 a8 00 00 */ }; struct _irot_MIDL_TYPE_FORMAT_STRING { short Pad; /* +0x0000 */ unsigned char Format[194]; /* +0x0002 80 a8 00 00 */ }; struct _irot_MIDL_PROC_FORMAT_STRING { short Pad; /* +0x0000 */ unsigned char Format[474]; /* +0x0002 83 a8 00 00 */ }; struct _scm_MIDL_PROC_FORMAT_STRING { short Pad; /* +0x0000 */ unsigned char Format[1028]; /* +0x0002 94 a8 00 00 */ }; struct _scm_MIDL_TYPE_FORMAT_STRING { short Pad; /* +0x0000 */ unsigned char Format[414]; /* +0x0002 97 a8 00 00 */ }; struct _orcb_MIDL_PROC_FORMAT_STRING { short Pad; /* +0x0000 */ unsigned char Format[250]; /* +0x0002 bf a8 00 00 */ }; struct _orcb_MIDL_TYPE_FORMAT_STRING { short Pad; /* +0x0000 */ unsigned char Format[58]; /* +0x0002 c2 a8 00 00 */ }; struct _KTIME_UPDATE { unsigned char UpdateA[12]; /* +0x0000 e8 4c 00 00 */ unsigned char UpdateB[12]; /* +0x000c e8 4c 00 00 */ }; struct Microsoft::WRL::Details::CreatorMap { unsigned char factoryCreator[20]; /* +0x0000 e4 a8 00 00 */ }; enum Microsoft::WRL::ModuleType { InProc = 1, OutOfProc = 2, DisableCaching = 4, InProcDisableCaching = 5, OutOfProcDisableCaching = 6 }; enum Microsoft::WRL::FactoryCacheFlags { FactoryCacheDefault = 0, FactoryCacheEnabled = 1, FactoryCacheDisabled = 2 }; struct Microsoft::WRL::Details::CreatorMap::<unnamed-type-activationId> { /* unsigned char clsid[0]; +0x0000 4a 16 00 00 */ unsigned char getRuntimeName[4]; /* +0x0000 e1 ac 00 00 */ }; struct Microsoft::WRL::Details::FactoryCache { unsigned char factory[8]; /* +0x0000 7f 17 00 00 */ }; struct Microsoft::WRL::Details::FactoryCache::<unnamed-type-cookie> { /* unsigned char winrt[0]; +0x0000 58 15 00 00 */ unsigned long com; /* +0x0000 */ }; /* enum <unnamed-tag> { WPP_VER_WIN2K_CB_FORWARD_PTR = 1, WPP_VER_WHISTLER_CB_FORWARD_PTR = 2, WPP_VER_LH_CB_FORWARD_PTR = 3 }; */ enum WMIDPREQUESTCODE { WMI_GET_ALL_DATA = 0, WMI_GET_SINGLE_INSTANCE = 1, WMI_SET_SINGLE_INSTANCE = 2, WMI_SET_SINGLE_ITEM = 3, WMI_ENABLE_EVENTS = 4, WMI_DISABLE_EVENTS = 5, WMI_ENABLE_COLLECTION = 6, WMI_DISABLE_COLLECTION = 7, WMI_REGINFO = 8, WMI_EXECUTE_METHOD = 9, WMI_CAPTURE_STATE = 10 }; enum _WPP_FLAG_LEN_ENUM_MAX { WPP_MAX_FLAG_LEN_CHECK = 1 }; struct _TRACE_GUID_REGISTRATION { unsigned char Guid[4]; /* +0x0000 4a 16 00 00 */ void *RegHandle; /* +0x0004 */ }; struct EventPoolEntry::InitState { /* unsigned char _ulInitState[0]; +0x0000 bb 17 00 00 */ /* unsigned char _ulNumInitedRWThreads[0]; +0x0000 73 ba 00 00 */ unsigned char _ulNumInitedRWLocks[4]; /* +0x0000 74 ba 00 00 */ }; struct Thread { unsigned char pHead[4]; /* +0x0000 8c ba 00 00 */ unsigned char pLastEmbeddedEnty[4]; /* +0x0004 8c ba 00 00 */ unsigned char embeddedEntry[16]; /* +0x0008 8d ba 00 00 */ }; struct CRWLock::GetPoolEntry::__l2::EventStatePoolEntry { /* unsigned char dwEventState[0]; +0x0000 bb 17 00 00 */ unsigned char pPoolEntry[4]; /* +0x0000 20 5c 00 00 */ }; struct CRWLock::ReleasePoolEntry::__l2::LockStatePoolEntry { unsigned char ulLockState[4]; /* +0x0000 bb 17 00 00 */ /* unsigned char dwEventState[0]; +0x0004 bb 17 00 00 */ /* unsigned char pPoolEntry[-4]; +0x0004 20 5c 00 00 */ unsigned char llState[8]; /* +0x0000 57 8e 00 00 */ }; enum EventPoolEntry::WaitForWriterEvent::__l2::AnyAbsorbtionState { NONE = 0, ABSORBED = 1, RELEIVED = 2 }; enum _AHC_SERVICE_CLASS { ApphelpCacheServiceLookup = 0, ApphelpCacheServiceRemove = 1, ApphelpCacheServiceUpdate = 2, ApphelpCacheServiceClear = 3, ApphelpCacheServiceDump = 4, ApphelpCacheServiceStartedService = 5, ApphelpCacheServiceStoppingService = 6, ApphelpCacheServiceForward = 7, ApphelpCacheServiceQuery = 8, ApphelpCacheServiceLookupCdb = 9, ApphelpCacheServiceRefreshCdb = 10, ApphelpCacheServiceMax = 11 }; enum _PERFINFO_KERNELMEMORY_USAGE_TYPE { PerfInfoMemUsagePfnMetadata = 0, PerfInfoMemUsageMax = 1 }; struct _AHC_STORE_STATISTICS { unsigned long LookupHits; /* +0x0000 */ unsigned long LookupMisses; /* +0x0004 */ unsigned long Inserted; /* +0x0008 */ unsigned long Replaced; /* +0x000c */ unsigned long Updated; /* +0x0010 */ }; struct _AHC_SERVICE_STATISTICS { unsigned long DropDueToServiceUnavailability; /* +0x0000 */ unsigned long DropDueToInvalidServicePort; /* +0x0004 */ unsigned long DropDueToServiceRequestError; /* +0x0008 */ unsigned long DropDueToServiceDisabled; /* +0x000c */ unsigned long DropDueToTimeout; /* +0x0010 */ unsigned long DropDueToBufferOverflow; /* +0x0014 */ unsigned long SumQueued; /* +0x0018 */ unsigned long SumExceedHeapQuota; /* +0x001c */ unsigned long SumDroppedQueueLimit; /* +0x0020 */ unsigned long SumSent; /* +0x0024 */ unsigned long SumDroppedService; /* +0x0028 */ unsigned long SumServiceConnectFailures; /* +0x002c */ unsigned long Padding1; /* +0x0030 */ unsigned long long SumBytesAllocated; /* +0x0038 */ }; struct _AHC_MAIN_STATISTICS { unsigned long Lookup; /* +0x0000 */ unsigned long Remove; /* +0x0004 */ unsigned long Update; /* +0x0008 */ unsigned long Clear; /* +0x000c */ unsigned long Dump; /* +0x0010 */ unsigned long StartedService; /* +0x0014 */ unsigned long StoppingService; /* +0x0018 */ unsigned long Forward; /* +0x001c */ unsigned long Query; /* +0x0020 */ }; struct _AHC_FORWARDQUEUE { unsigned long Size; /* +0x0000 */ unsigned long QueueLimit; /* +0x0004 */ unsigned long CurInQueue; /* +0x0008 */ unsigned long CurMaxInQueue; /* +0x000c */ }; struct _AHC_STATISTICS { unsigned long Size; /* +0x0000 */ unsigned char Main[36]; /* +0x0004 d8 ba 00 00 */ unsigned char Store[24]; /* +0x0028 d9 ba 00 00 */ unsigned char Service[64]; /* +0x0040 da ba 00 00 */ }; struct _AHC_SERVICE_DATAQUERY { unsigned char Stats[128]; /* +0x0000 dd ba 00 00 */ unsigned char Queue[16]; /* +0x0080 de ba 00 00 */ unsigned long DataSize; /* +0x0090 */ unsigned char *Data; /* +0x0094 */ }; struct _PERFINFO_GROUPMASK { unsigned char Masks[32]; /* +0x0000 75 46 00 00 */ }; struct _EVENT_HEADER { unsigned short Size; /* +0x0000 */ unsigned short HeaderType; /* +0x0002 */ unsigned short Flags; /* +0x0004 */ unsigned short EventProperty; /* +0x0006 */ unsigned long ThreadId; /* +0x0008 */ unsigned long ProcessId; /* +0x000c */ unsigned char TimeStamp[8]; /* +0x0010 3d 13 00 00 */ unsigned char ProviderId[16]; /* +0x0018 dc 14 00 00 */ unsigned char EventDescriptor[16]; /* +0x0028 62 67 00 00 */ unsigned long KernelTime; /* +0x0038 */ unsigned long UserTime; /* +0x003c */ unsigned long long ProcessorTime; /* +0x0038 */ unsigned char ActivityId[16]; /* +0x0040 dc 14 00 00 */ }; struct _EVENT_RECORD { unsigned char EventHeader[80]; /* +0x0000 e5 ba 00 00 */ unsigned char BufferContext[4]; /* +0x0050 e6 ba 00 00 */ unsigned short ExtendedDataCount; /* +0x0054 */ unsigned short UserDataLength; /* +0x0056 */ unsigned char ExtendedData[4]; /* +0x0058 e8 ba 00 00 */ void *UserData; /* +0x005c */ void *UserContext; /* +0x0060 */ }; struct _EVENT_HEADER_EXTENDED_DATA_ITEM { unsigned short Reserved1; /* +0x0000 */ unsigned short ExtType; /* +0x0002 */ /* unsigned char Linkage[0]; +0x0004 6a 2e 00 00 */ unsigned char Reserved2[2]; /* +0x0004 eb ba 00 00 */ unsigned short DataSize; /* +0x0006 */ unsigned long long DataPtr; /* +0x0008 */ }; enum _PERFINFO_MM_STAT { PerfInfoMMStatNotUsed = 0, PerfInfoMMStatAggregatePageCombine = 1, PerfInfoMMStatIterationPageCombine = 2, PerfInfoMMStatMax = 3 }; struct _AHC_SERVICE_DATAFORWARD { unsigned short ExecutableType; /* +0x0000 */ unsigned short Padding1; /* +0x0002 */ unsigned long Reason; /* +0x0004 */ unsigned char ExecutablePath[8]; /* +0x0008 dd 12 00 00 */ void *FileHandle; /* +0x0010 */ unsigned char Environment[8]; /* +0x0014 dd 12 00 00 */ unsigned char PackageMoniker[8]; /* +0x001c dd 12 00 00 */ }; struct _AHC_SERVICE_DATACACHE { unsigned long probed; /* +0x0000 */ unsigned long probeResult; /* +0x0004 */ void *FileHandle; /* +0x0008 */ void *ProcessHandle; /* +0x000c */ unsigned char FileName[8]; /* +0x0010 dd 12 00 00 */ unsigned long CustomDataSize; /* +0x0018 */ unsigned char *CustomData; /* +0x001c */ }; struct _ETW_BUFFER_CONTEXT { unsigned char ProcessorNumber; /* +0x0000 */ unsigned char Alignment; /* +0x0001 */ unsigned short ProcessorIndex; /* +0x0000 */ unsigned short LoggerId; /* +0x0002 */ }; struct _AHC_SERVICE_DATA { unsigned char Query[152]; /* +0x0000 f6 ba 00 00 */ unsigned char Cache[32]; /* +0x0098 f7 ba 00 00 */ unsigned char Forward[36]; /* +0x00b8 f8 ba 00 00 */ unsigned char Cdb[20]; /* +0x00dc f9 ba 00 00 */ }; struct _AHC_SERVICE_DATACDB { unsigned long Type; /* +0x0000 */ unsigned long Padding; /* +0x0004 */ unsigned char Name[8]; /* +0x0008 dd 12 00 00 */ }; enum LoadOrFreeWhat { LoadLibrarySucceeded = 0, LoadLibraryFailed = 1, CallingFreeLibrary = 2 }; enum RegistrationPropertyType { RequiredString = 0, RequiredGuidString = 1, RequiredMultiString = 2, RequiredExpandableString = 3, RequiredUInt32 = 4, RequiredUInt32Range = 5, RequiredUInt64 = 6, RequiredSecurityDescriptor = 7, OptionalString = 8, OptionalGuidString = 9, OptionalMultiString = 10, OptionalExpandableString = 11, OptionalUInt32 = 12, OptionalUInt32Range = 13, PropertyStoreInSubKey = 14 }; enum RegistrationStore::Node::WriteOperation { None = 0, Create = 1, RemoveForUpdate = 2, Remove = 3 }; /* enum RegistrationStore::NodeType { Nothing = Unavail, ExtensionsTopLevel = 0, Contracts = 1, Contract = 2, PackagesForContract = 3, PackageForContract = 4, ExtensionRegistrationsForContractAndPackage = 5, ExtensionRegistration = 6, ActivatableClassesTopLevel = 7, Package = 8, Packages = 9, ActivatableClassesForPackage = 10, ActivatableClassesM1 = 11, ActivatableClassRegistration = 12, ActivatableClassRegistrationM1 = 13, ServersForPackage = 14, ServersM1 = 15, ServerRegistration = 16, ServerRegistrationM1 = 17, DebugInformationForPackage = 18, DebugInformationRegistration = 19, ClassIds = 20, InterfaceRegistration = 21, InterfacesForPackage = 22, ProxyStubRegistration = 23, ProxyStubsForPackage = 24, ClassIdRegistration = 25, Count = 26 }; */ enum RegistrationStore::PackageNode::Children { ActivatableClassesForPackage = 0, ServersForPackage = 1, DebugInformationForPackage = 2, InterfacesForPackage = 3, ProxyStubsForPackage = 4, NumChildren = 5 }; enum RegistrationStore::ActivatableClassesTopLevelNode::Children { Packages = 0, ClassIds = 1, ActivatableClasses = 2, Servers = 3, NumChildren = 4 }; enum RegistrationStore::PackageForContractNode::Children { ExtensionRegistrationsForContractAndPackage = 0, NumChildren = 1 }; enum RegistrationStore::ContractNode::Children { PackagesForContract = 0, NumChildren = 1 }; enum RegistrationStore::ExtensionsTopLevelNode::Children { Contracts = 0, NumChildren = 1 }; enum ProxyStubRegistrationEntryPropertyIndex { Description = 0, DllPath = 1, NumProperties = 2 }; enum ActivatableClassRegistrationEntryPropertyIndex { CLSID = 0, ActivationType = 1, Server = 2, DllPath = 3, Threading = 4, CustomAttributes = 5, NumProperties = 6 }; enum InterfaceRegistrationEntryPropertyIndex { InterfaceName = 0, ProxyStubCLSID = 1, NumProperties = 2 }; enum ServerRegistrationEntryPropertyIndex { ExePath = 0, CommandLine = 1, AppUserModelId = 2, Instancing = 3, IdentityType = 4, Permissions = 5, ActivatableClasses = 6, NumProperties = 7 }; enum ServerRegistrationM1EntryPropertyIndex { ExePath = 0, CommandLine = 1, AppUserModelId = 2, Instancing = 3, IdentityType = 4, Permissions = 5, ActivatableClasses = 6, PackageMoniker = 7, NumProperties = 8 }; enum DebugInformationRegistrationEntryPropertyIndex { DebugPath = 0, Environment = 1, NumProperties = 2 }; enum ClassIdRegistrationEntryPropertyIndex { ActivatableClassId = 0, PackageMoniker = 1, NumProperties = 2 }; struct _custmact_MIDL_TYPE_FORMAT_STRING { short Pad; /* +0x0000 */ unsigned char Format[1086]; /* +0x0002 a0 bf 00 00 */ }; struct _UNICODE_STRING { unsigned short Length; /* +0x0000 */ unsigned short MaximumLength; /* +0x0002 */ unsigned short *Buffer; /* +0x0004 */ }; struct _IMAGE_THUNK_DATA32 { unsigned char u1[4]; /* +0x0000 d5 bf 00 00 */ }; /* struct <unnamed-tag> { unsigned long Flags; +0x0000 unsigned char s[4]; +0x0000 d8 bf 00 00 }; */ struct _TP_CALLBACK_ENVIRON_V3 { unsigned long Version; /* +0x0000 */ unsigned char Pool[4]; /* +0x0004 8a 48 00 00 */ unsigned char CleanupGroup[4]; /* +0x0008 8b 48 00 00 */ unsigned char CleanupGroupCancelCallback[4]; /* +0x000c 8d 48 00 00 */ void *RaceDll; /* +0x0010 */ unsigned char ActivationContext[4]; /* +0x0014 69 17 00 00 */ unsigned char FinalizationCallback[4]; /* +0x0018 90 48 00 00 */ unsigned char u[4]; /* +0x001c da bf 00 00 */ unsigned char CallbackPriority[4]; /* +0x0020 92 48 00 00 */ unsigned long Size; /* +0x0024 */ }; struct _IMAGE_DELAYLOAD_DESCRIPTOR { unsigned char Attributes[4]; /* +0x0000 dd bf 00 00 */ unsigned long DllNameRVA; /* +0x0004 */ unsigned long ModuleHandleRVA; /* +0x0008 */ unsigned long ImportAddressTableRVA; /* +0x000c */ unsigned long ImportNameTableRVA; /* +0x0010 */ unsigned long BoundImportAddressTableRVA; /* +0x0014 */ unsigned long UnloadInformationTableRVA; /* +0x0018 */ unsigned long TimeDateStamp; /* +0x001c */ }; struct _DELAYLOAD_INFO { unsigned long Size; /* +0x0000 */ unsigned char DelayloadDescriptor[4]; /* +0x0004 57 3b 00 00 */ unsigned char ThunkAddress[4]; /* +0x0008 d6 21 00 00 */ unsigned char TargetDllName[4]; /* +0x000c 62 14 00 00 */ unsigned char TargetApiDescriptor[8]; /* +0x0010 e0 bf 00 00 */ void *TargetModuleBase; /* +0x0018 */ void *Unused; /* +0x001c */ unsigned long LastError; /* +0x0020 */ }; /* struct <unnamed-tag> { /* unsigned char Name[0]; +0x0000 62 14 00 00 unsigned long Ordinal; +0x0000 }; */ struct _DELAYLOAD_PROC_DESCRIPTOR { unsigned long ImportDescribedByName; /* +0x0000 */ unsigned char Description[4]; /* +0x0004 e4 bf 00 00 */ }; struct $_TypeDescriptor$_extraBytes_24 { unsigned char pVFTable[4]; /* +0x0000 3d 19 00 00 */ void *spare; /* +0x0004 */ unsigned char name[24]; /* +0x0008 f1 bf 00 00 */ }; struct _s__CatchableType { unsigned char properties[4]; /* +0x0000 75 00 00 00 */ unsigned char pType[4]; /* +0x0004 52 17 00 00 */ unsigned char thisDisplacement[12]; /* +0x0008 d5 28 00 00 */ unsigned char sizeOrOffset[4]; /* +0x0014 74 00 00 00 */ unsigned char copyFunction[4]; /* +0x0018 f4 bf 00 00 */ }; struct _s__ThrowInfo { unsigned char attributes[4]; /* +0x0000 75 00 00 00 */ unsigned char pmfnUnwind[4]; /* +0x0004 f4 bf 00 00 */ unsigned char pForwardCompat[4]; /* +0x0008 da 17 00 00 */ unsigned char pCatchableTypeArray[4]; /* +0x000c 29 34 00 00 */ }; struct $_s__CatchableTypeArray$_extraBytes_8 { unsigned char nCatchableTypes[4]; /* +0x0000 74 00 00 00 */ unsigned char arrayOfCatchableTypes[8]; /* +0x0004 f9 bf 00 00 */ }; struct _IMAGE_SECTION_HEADER { unsigned char Name[8]; /* +0x0000 7f 19 00 00 */ unsigned char Misc[4]; /* +0x0008 03 c0 00 00 */ unsigned long VirtualAddress; /* +0x000c */ unsigned long SizeOfRawData; /* +0x0010 */ unsigned long PointerToRawData; /* +0x0014 */ unsigned long PointerToRelocations; /* +0x0018 */ unsigned long PointerToLinenumbers; /* +0x001c */ unsigned short NumberOfRelocations; /* +0x0020 */ unsigned short NumberOfLinenumbers; /* +0x0022 */ unsigned long Characteristics; /* +0x0024 */ }; struct _EXCEPTION_RECORD { unsigned long ExceptionCode; /* +0x0000 */ unsigned long ExceptionFlags; /* +0x0004 */ unsigned char ExceptionRecord[4]; /* +0x0008 cf 28 00 00 */ void *ExceptionAddress; /* +0x000c */ unsigned long NumberParameters; /* +0x0010 */ unsigned char ExceptionInformation[60]; /* +0x0014 99 28 00 00 */ }; struct FT { unsigned long long ft_scalar; /* +0x0000 */ unsigned char ft_struct[8]; /* +0x0000 31 13 00 00 */ }; struct _PEB { unsigned char InheritedAddressSpace; /* +0x0000 */ unsigned char ReadImageFileExecOptions; /* +0x0001 */ unsigned char BeingDebugged; /* +0x0002 */ unsigned char BitField; /* +0x0003 */ /* unsigned char ImageUsesLargePages[0]; +0x0003 6f 1e 00 00 */ /* unsigned char IsProtectedProcess[0]; +0x0003 70 1e 00 00 */ /* unsigned char IsLegacyProcess[0]; +0x0003 71 1e 00 00 */ /* unsigned char IsImageDynamicallyRelocated[0]; +0x0003 e3 25 00 00 */ /* unsigned char SkipPatchingUser32Forwarders[0]; +0x0003 c9 25 00 00 */ unsigned char SpareBits[1]; /* +0x0003 e4 25 00 00 */ void *Mutant; /* +0x0004 */ void *ImageBaseAddress; /* +0x0008 */ unsigned char Ldr[4]; /* +0x000c 28 30 00 00 */ unsigned char ProcessParameters[4]; /* +0x0010 b5 23 00 00 */ void *SubSystemData; /* +0x0014 */ void *ProcessHeap; /* +0x0018 */ unsigned char FastPebLock[4]; /* +0x001c 61 1f 00 00 */ void *AtlThunkSListPtr; /* +0x0020 */ void *IFEOKey; /* +0x0024 */ unsigned long CrossProcessFlags; /* +0x0028 */ /* unsigned char ProcessInJob[0]; +0x0028 17 13 00 00 */ /* unsigned char ProcessInitializing[0]; +0x0028 7e 18 00 00 */ /* unsigned char ProcessUsingVEH[0]; +0x0028 7f 18 00 00 */ /* unsigned char ProcessUsingVCH[0]; +0x0028 27 1e 00 00 */ /* unsigned char ProcessUsingFTH[0]; +0x0028 42 1e 00 00 */ unsigned char ReservedBits0[4]; /* +0x0028 43 1e 00 00 */ void *KernelCallbackTable; /* +0x002c */ void *UserSharedInfoPtr; /* +0x002c */ unsigned char SystemReserved[4]; /* +0x0030 f6 12 00 00 */ unsigned long AtlThunkSListPtr32; /* +0x0034 */ void *ApiSetMap; /* +0x0038 */ unsigned long TlsExpansionCounter; /* +0x003c */ void *TlsBitmap; /* +0x0040 */ unsigned char TlsBitmapBits[8]; /* +0x0044 69 15 00 00 */ void *ReadOnlySharedMemoryBase; /* +0x004c */ void *HotpatchInformation; /* +0x0050 */ unsigned char ReadOnlyStaticServerData[4]; /* +0x0054 4f 13 00 00 */ void *AnsiCodePageData; /* +0x0058 */ void *OemCodePageData; /* +0x005c */ void *UnicodeCaseTableData; /* +0x0060 */ unsigned long NumberOfProcessors; /* +0x0064 */ unsigned long NtGlobalFlag; /* +0x0068 */ unsigned char CriticalSectionTimeout[8]; /* +0x0070 3d 13 00 00 */ unsigned long HeapSegmentReserve; /* +0x0078 */ unsigned long HeapSegmentCommit; /* +0x007c */ unsigned long HeapDeCommitTotalFreeThreshold; /* +0x0080 */ unsigned long HeapDeCommitFreeBlockThreshold; /* +0x0084 */ unsigned long NumberOfHeaps; /* +0x0088 */ unsigned long MaximumNumberOfHeaps; /* +0x008c */ unsigned char ProcessHeaps[4]; /* +0x0090 4f 13 00 00 */ void *GdiSharedHandleTable; /* +0x0094 */ void *ProcessStarterHelper; /* +0x0098 */ unsigned long GdiDCAttributeList; /* +0x009c */ unsigned char LoaderLock[4]; /* +0x00a0 61 1f 00 00 */ unsigned long OSMajorVersion; /* +0x00a4 */ unsigned long OSMinorVersion; /* +0x00a8 */ unsigned short OSBuildNumber; /* +0x00ac */ unsigned short OSCSDVersion; /* +0x00ae */ unsigned long OSPlatformId; /* +0x00b0 */ unsigned long ImageSubsystem; /* +0x00b4 */ unsigned long ImageSubsystemMajorVersion; /* +0x00b8 */ unsigned long ImageSubsystemMinorVersion; /* +0x00bc */ unsigned long ActiveProcessAffinityMask; /* +0x00c0 */ unsigned char GdiHandleBuffer[136]; /* +0x00c4 29 30 00 00 */ unsigned char PostProcessInitRoutine[4]; /* +0x014c b2 54 00 00 */ void *TlsExpansionBitmap; /* +0x0150 */ unsigned char TlsExpansionBitmapBits[128]; /* +0x0154 9b 2c 00 00 */ unsigned long SessionId; /* +0x01d4 */ unsigned char AppCompatFlags[8]; /* +0x01d8 fd 22 00 00 */ unsigned char AppCompatFlagsUser[8]; /* +0x01e0 fd 22 00 00 */ void *pShimData; /* +0x01e8 */ void *AppCompatInfo; /* +0x01ec */ unsigned char CSDVersion[8]; /* +0x01f0 dd 12 00 00 */ unsigned char ActivationContextData[4]; /* +0x01f8 2c 30 00 00 */ unsigned char ProcessAssemblyStorageMap[4]; /* +0x01fc 2e 30 00 00 */ unsigned char SystemDefaultActivationContextData[4]; /* +0x0200 2c 30 00 00 */ unsigned char SystemAssemblyStorageMap[4]; /* +0x0204 2e 30 00 00 */ unsigned long MinimumStackCommit; /* +0x0208 */ unsigned char FlsCallback[4]; /* +0x020c 30 30 00 00 */ unsigned char FlsListHead[8]; /* +0x0210 44 1f 00 00 */ void *FlsBitmap; /* +0x0218 */ unsigned char FlsBitmapBits[16]; /* +0x021c 4f 1a 00 00 */ unsigned long FlsHighIndex; /* +0x022c */ void *WerRegistrationData; /* +0x0230 */ void *WerShipAssertPtr; /* +0x0234 */ void *pUnused; /* +0x0238 */ void *pImageHeaderHash; /* +0x023c */ unsigned long TracingFlags; /* +0x0240 */ /* unsigned char HeapTracingEnabled[0]; +0x0240 17 13 00 00 */ /* unsigned char CritSecTracingEnabled[0]; +0x0240 7e 18 00 00 */ /* unsigned char LibLoaderTracingEnabled[0]; +0x0240 7f 18 00 00 */ unsigned char SpareTracingBits[8]; /* +0x0240 b0 2c 00 00 */ unsigned long long CsrServerReadOnlySharedMemoryBase; /* +0x0248 */ }; enum __enative_startup_state { __uninitialized = 0, __initializing = 1, __initialized = 2 }; enum _REG_NOTIFY_CLASS { RegNtDeleteKey = 0, RegNtPreDeleteKey = 0, RegNtSetValueKey = 1, RegNtPreSetValueKey = 1, RegNtDeleteValueKey = 2, RegNtPreDeleteValueKey = 2, RegNtSetInformationKey = 3, RegNtPreSetInformationKey = 3, RegNtRenameKey = 4, RegNtPreRenameKey = 4, RegNtEnumerateKey = 5, RegNtPreEnumerateKey = 5, RegNtEnumerateValueKey = 6, RegNtPreEnumerateValueKey = 6, RegNtQueryKey = 7, RegNtPreQueryKey = 7, RegNtQueryValueKey = 8, RegNtPreQueryValueKey = 8, RegNtQueryMultipleValueKey = 9, RegNtPreQueryMultipleValueKey = 9, RegNtPreCreateKey = 10, RegNtPostCreateKey = 11, RegNtPreOpenKey = 12, RegNtPostOpenKey = 13, RegNtKeyHandleClose = 14, RegNtPreKeyHandleClose = 14, RegNtPostDeleteKey = 15, RegNtPostSetValueKey = 16, RegNtPostDeleteValueKey = 17, RegNtPostSetInformationKey = 18, RegNtPostRenameKey = 19, RegNtPostEnumerateKey = 20, RegNtPostEnumerateValueKey = 21, RegNtPostQueryKey = 22, RegNtPostQueryValueKey = 23, RegNtPostQueryMultipleValueKey = 24, RegNtPostKeyHandleClose = 25, RegNtPreCreateKeyEx = 26, RegNtPostCreateKeyEx = 27, RegNtPreOpenKeyEx = 28, RegNtPostOpenKeyEx = 29, RegNtPreFlushKey = 30, RegNtPostFlushKey = 31, RegNtPreLoadKey = 32, RegNtPostLoadKey = 33, RegNtPreUnLoadKey = 34, RegNtPostUnLoadKey = 35, RegNtPreQueryKeySecurity = 36, RegNtPostQueryKeySecurity = 37, RegNtPreSetKeySecurity = 38, RegNtPostSetKeySecurity = 39, RegNtCallbackObjectContextCleanup = 40, RegNtPreRestoreKey = 41, RegNtPostRestoreKey = 42, RegNtPreSaveKey = 43, RegNtPostSaveKey = 44, RegNtPreReplaceKey = 45, RegNtPostReplaceKey = 46, MaxRegNtNotifyClass = 47 }; enum _MEMORY_CACHING_TYPE { MmNonCached = 0, MmCached = 1, MmWriteCombined = 2, MmHardwareCoherentCached = 3, MmNonCachedUnordered = 4, MmUSWCCached = 5, MmMaximumCacheType = 6 }; enum _DEVICE_WAKE_DEPTH { DeviceWakeDepthNotWakeable = 0, DeviceWakeDepthD0 = 1, DeviceWakeDepthD1 = 2, DeviceWakeDepthD2 = 3, DeviceWakeDepthD3hot = 4, DeviceWakeDepthD3cold = 5, DeviceWakeDepthMaximum = 6 }; enum CPU_VENDORS { CPU_NONE = 0, CPU_INTEL = 1, CPU_AMD = 2, CPU_CYRIX = 3, CPU_TRANSMETA = 4, CPU_VIA = 5, CPU_CENTAUR = 5, CPU_RISE = 6, CPU_UNKNOWN = 7 }; enum _POOL_TYPE { NonPagedPool = 0, NonPagedPoolExecute = 0, PagedPool = 1, NonPagedPoolMustSucceed = 2, DontUseThisType = 3, NonPagedPoolCacheAligned = 4, PagedPoolCacheAligned = 5, NonPagedPoolCacheAlignedMustS = 6, MaxPoolType = 7, NonPagedPoolBase = 0, NonPagedPoolBaseMustSucceed = 2, NonPagedPoolBaseCacheAligned = 4, NonPagedPoolBaseCacheAlignedMustS = 6, NonPagedPoolSession = 32, PagedPoolSession = 33, NonPagedPoolMustSucceedSession = 34, DontUseThisTypeSession = 35, NonPagedPoolCacheAlignedSession = 36, PagedPoolCacheAlignedSession = 37, NonPagedPoolCacheAlignedMustSSession = 38, NonPagedPoolNx = 512, NonPagedPoolNxCacheAligned = 516, NonPagedPoolSessionNx = 544 }; enum _MODE { KernelMode = 0, UserMode = 1, MaximumMode = 2 }; struct _DESCRIPTOR { unsigned short Pad; /* +0x0000 */ unsigned short Limit; /* +0x0002 */ unsigned long Base; /* +0x0004 */ }; struct _KSPECIAL_REGISTERS { unsigned long Cr0; /* +0x0000 */ unsigned long Cr2; /* +0x0004 */ unsigned long Cr3; /* +0x0008 */ unsigned long Cr4; /* +0x000c */ unsigned long KernelDr0; /* +0x0010 */ unsigned long KernelDr1; /* +0x0014 */ unsigned long KernelDr2; /* +0x0018 */ unsigned long KernelDr3; /* +0x001c */ unsigned long KernelDr6; /* +0x0020 */ unsigned long KernelDr7; /* +0x0024 */ unsigned char Gdtr[8]; /* +0x0028 42 c0 00 00 */ unsigned char Idtr[8]; /* +0x0030 42 c0 00 00 */ unsigned short Tr; /* +0x0038 */ unsigned short Ldtr; /* +0x003a */ unsigned long long Xcr0; /* +0x003c */ unsigned char Reserved[16]; /* +0x0044 4f 1a 00 00 */ }; struct _OWNER_ENTRY { unsigned long OwnerThread; /* +0x0000 */ /* unsigned char IoPriorityBoosted[0]; +0x0004 17 13 00 00 */ /* unsigned char OwnerReferenced[0]; +0x0004 7e 18 00 00 */ /* unsigned char OwnerCount[0]; +0x0004 b3 19 00 00 */ unsigned long TableSize; /* +0x0004 */ }; /* struct <unnamed-tag> { /* unsigned char Port[0]; +0x0000 6b c0 00 00 /* unsigned char Memory[0]; +0x0000 6b c0 00 00 /* unsigned char Interrupt[0]; +0x0000 6c c0 00 00 /* unsigned char Dma[0]; +0x0000 6d c0 00 00 /* unsigned char DmaV3[0]; +0x0000 6e c0 00 00 /* unsigned char Generic[0]; +0x0000 6b c0 00 00 /* unsigned char DevicePrivate[0]; +0x0000 6f c0 00 00 /* unsigned char BusNumber[0]; +0x0000 70 c0 00 00 /* unsigned char ConfigData[0]; +0x0000 71 c0 00 00 /* unsigned char Memory40[0]; +0x0000 72 c0 00 00 /* unsigned char Memory48[0]; +0x0000 73 c0 00 00 /* unsigned char Memory64[0]; +0x0000 74 c0 00 00 unsigned char Connection[24]; +0x0000 75 c0 00 00 }; */ struct _IO_RESOURCE_DESCRIPTOR { unsigned char Option; /* +0x0000 */ unsigned char Type; /* +0x0001 */ unsigned char ShareDisposition; /* +0x0002 */ unsigned char Spare1; /* +0x0003 */ unsigned short Flags; /* +0x0004 */ unsigned short Spare2; /* +0x0006 */ unsigned char u[24]; /* +0x0008 77 c0 00 00 */ }; enum _SECURITY_OPERATION_CODE { SetSecurityDescriptor = 0, QuerySecurityDescriptor = 1, DeleteSecurityDescriptor = 2, AssignSecurityDescriptor = 3 }; /* struct <unnamed-tag> { /* unsigned char Raw[0]; +0x0000 7e c0 00 00 unsigned char Translated[12]; +0x0000 7d c0 00 00 }; */ /* struct <unnamed-tag> { /* unsigned char Generic[0]; +0x0000 7c c0 00 00 /* unsigned char Port[0]; +0x0000 7c c0 00 00 /* unsigned char Interrupt[0]; +0x0000 7d c0 00 00 /* unsigned char MessageInterrupt[0]; +0x0000 80 c0 00 00 /* unsigned char Memory[0]; +0x0000 7c c0 00 00 /* unsigned char Dma[0]; +0x0000 81 c0 00 00 /* unsigned char DmaV3[0]; +0x0000 82 c0 00 00 /* unsigned char DevicePrivate[0]; +0x0000 6f c0 00 00 /* unsigned char BusNumber[0]; +0x0000 83 c0 00 00 /* unsigned char DeviceSpecificData[0]; +0x0000 84 c0 00 00 /* unsigned char Memory40[0]; +0x0000 85 c0 00 00 /* unsigned char Memory48[0]; +0x0000 86 c0 00 00 /* unsigned char Memory64[0]; +0x0000 87 c0 00 00 unsigned char Connection[12]; +0x0000 75 c0 00 00 }; */ struct _CM_PARTIAL_RESOURCE_DESCRIPTOR { unsigned char Type; /* +0x0000 */ unsigned char ShareDisposition; /* +0x0001 */ unsigned short Flags; /* +0x0002 */ unsigned char u[12]; /* +0x0004 89 c0 00 00 */ }; struct _OBJECT_DUMP_CONTROL { void *Stream; /* +0x0000 */ unsigned long Detail; /* +0x0004 */ }; struct _PAGED_LOOKASIDE_LIST { unsigned char L[72]; /* +0x0000 b6 c0 00 00 */ unsigned char Lock__ObsoleteButDoNotDelete[32]; /* +0x0048 b7 c0 00 00 */ }; struct _TXN_PARAMETER_BLOCK { unsigned short Length; /* +0x0000 */ unsigned short TxFsContext; /* +0x0002 */ void *TransactionObject; /* +0x0004 */ }; enum _WHEA_ERROR_SEVERITY { WheaErrSevRecoverable = 0, WheaErrSevFatal = 1, WheaErrSevCorrected = 2, WheaErrSevInformational = 3 }; enum _KINTERRUPT_POLARITY { InterruptPolarityUnknown = 0, InterruptActiveHigh = 1, InterruptRisingEdge = 1, InterruptActiveLow = 2, InterruptFallingEdge = 2, InterruptActiveBoth = 3 }; enum _IO_ALLOCATION_ACTION { KeepObject = 1, DeallocateObject = 2, DeallocateObjectKeepRegisters = 3 }; struct _WHEA_PERSISTENCE_INFO { /* unsigned char Signature[0]; +0x0000 c6 c0 00 00 */ /* unsigned char Length[0]; +0x0000 c7 c0 00 00 */ /* unsigned char Identifier[0]; +0x0000 c8 c0 00 00 */ /* unsigned char Attributes[0]; +0x0000 c9 c0 00 00 */ /* unsigned char DoNotLog[0]; +0x0000 ca c0 00 00 */ /* unsigned char Reserved[0]; +0x0000 cb c0 00 00 */ unsigned long long AsULONGLONG; /* +0x0000 */ }; struct _KEVENT { unsigned char Header[16]; /* +0x0000 d1 c0 00 00 */ }; struct _KDPC { unsigned char Type; /* +0x0000 */ unsigned char Importance; /* +0x0001 */ unsigned char Number[2]; /* +0x0002 68 2e 00 00 */ unsigned char DpcListEntry[8]; /* +0x0004 44 1f 00 00 */ unsigned char DeferredRoutine[4]; /* +0x000c e3 c0 00 00 */ void *DeferredContext; /* +0x0010 */ void *SystemArgument1; /* +0x0014 */ void *SystemArgument2; /* +0x0018 */ void *DpcData; /* +0x001c */ }; struct _KDEVICE_QUEUE { short Type; /* +0x0000 */ short Size; /* +0x0002 */ unsigned char DeviceListHead[8]; /* +0x0004 44 1f 00 00 */ unsigned long Lock; /* +0x000c */ unsigned char Busy; /* +0x0010 */ }; struct _SECURITY_SUBJECT_CONTEXT { void *ClientToken; /* +0x0000 */ unsigned char ImpersonationLevel[4]; /* +0x0004 05 2e 00 00 */ void *PrimaryToken; /* +0x0008 */ void *ProcessAuditId; /* +0x000c */ }; enum _DEVICE_USAGE_NOTIFICATION_TYPE { DeviceUsageTypeUndefined = 0, DeviceUsageTypePaging = 1, DeviceUsageTypeHibernation = 2, DeviceUsageTypeDumpFile = 3, DeviceUsageTypeBoot = 4 }; struct _EX_PUSH_LOCK_CACHE_AWARE { unsigned char Locks[4]; /* +0x0000 f6 c0 00 00 */ }; struct _KAPC { unsigned char Type; /* +0x0000 */ unsigned char SpareByte0; /* +0x0001 */ unsigned char Size; /* +0x0002 */ unsigned char SpareByte1; /* +0x0003 */ unsigned long SpareLong0; /* +0x0004 */ unsigned char Thread[4]; /* +0x0008 b0 c0 00 00 */ unsigned char ApcListEntry[8]; /* +0x000c 44 1f 00 00 */ unsigned char KernelRoutine[4]; /* +0x0014 00 c1 00 00 */ unsigned char RundownRoutine[4]; /* +0x0018 03 c1 00 00 */ /* unsigned char NormalRoutine[-8]; +0x001c 4a 1a 00 00 */ unsigned char Reserved[12]; /* +0x0014 04 c1 00 00 */ void *NormalContext; /* +0x0020 */ void *SystemArgument1; /* +0x0024 */ void *SystemArgument2; /* +0x0028 */ char ApcStateIndex; /* +0x002c */ char ApcMode; /* +0x002d */ unsigned char Inserted; /* +0x002e */ }; struct _KSEMAPHORE { unsigned char Header[16]; /* +0x0000 d1 c0 00 00 */ long Limit; /* +0x0010 */ }; struct _ERESOURCE { unsigned char SystemResourcesList[8]; /* +0x0000 44 1f 00 00 */ unsigned char OwnerTable[4]; /* +0x0008 46 c0 00 00 */ short ActiveCount; /* +0x000c */ unsigned short Flag; /* +0x000e */ unsigned char ReservedLowFlags; /* +0x000e */ unsigned char WaiterPriority; /* +0x000f */ unsigned char SharedWaiters[4]; /* +0x0010 91 c0 00 00 */ unsigned char ExclusiveWaiters[4]; /* +0x0014 0a c1 00 00 */ unsigned char OwnerEntry[8]; /* +0x0018 45 c0 00 00 */ unsigned long ActiveEntries; /* +0x0020 */ unsigned long ContentionCount; /* +0x0024 */ unsigned long NumberOfSharedWaiters; /* +0x0028 */ unsigned long NumberOfExclusiveWaiters; /* +0x002c */ void *Address; /* +0x0030 */ unsigned long CreatorBackTraceIndex; /* +0x0030 */ unsigned long SpinLock; /* +0x0034 */ }; struct _KPROCESSOR_STATE { unsigned char ContextFrame[716]; /* +0x0000 57 13 00 00 */ unsigned char SpecialRegisters[84]; /* +0x02cc 0e c1 00 00 */ }; /* struct <unnamed-tag> { /* unsigned char InitialPrivilegeSet[0]; +0x0000 19 c1 00 00 unsigned char PrivilegeSet[44]; +0x0000 7f 13 00 00 }; */ struct _ACCESS_STATE { unsigned char OperationID[8]; /* +0x0000 21 15 00 00 */ unsigned char SecurityEvaluated; /* +0x0008 */ unsigned char GenerateAudit; /* +0x0009 */ unsigned char GenerateOnClose; /* +0x000a */ unsigned char PrivilegesAllocated; /* +0x000b */ unsigned long Flags; /* +0x000c */ unsigned long RemainingDesiredAccess; /* +0x0010 */ unsigned long PreviouslyGrantedAccess; /* +0x0014 */ unsigned long OriginalDesiredAccess; /* +0x0018 */ unsigned char SubjectSecurityContext[16]; /* +0x001c 18 c1 00 00 */ void *SecurityDescriptor; /* +0x002c */ void *AuxData; /* +0x0030 */ unsigned char Privileges[44]; /* +0x0034 1b c1 00 00 */ unsigned char AuditPrivileges; /* +0x0060 */ unsigned char ObjectName[8]; /* +0x0064 dd 12 00 00 */ unsigned char ObjectTypeName[8]; /* +0x006c dd 12 00 00 */ }; enum _WHEA_ERROR_PACKET_DATA_FORMAT { WheaDataFormatIPFSalRecord = 0, WheaDataFormatXPFMCA = 1, WheaDataFormatMemory = 2, WheaDataFormatPCIExpress = 3, WheaDataFormatNMIPort = 4, WheaDataFormatPCIXBus = 5, WheaDataFormatPCIXDevice = 6, WheaDataFormatGeneric = 7, WheaDataFormatMax = 8 }; struct _MDL { unsigned char Next[4]; /* +0x0000 5b c0 00 00 */ short Size; /* +0x0004 */ short MdlFlags; /* +0x0006 */ unsigned char Process[4]; /* +0x0008 54 c0 00 00 */ void *MappedSystemVa; /* +0x000c */ void *StartVa; /* +0x0010 */ unsigned long ByteCount; /* +0x0014 */ unsigned long ByteOffset; /* +0x0018 */ }; struct _INITIAL_PRIVILEGE_SET { unsigned long PrivilegeCount; /* +0x0000 */ unsigned long Control; /* +0x0004 */ unsigned char Privilege[36]; /* +0x0008 28 c1 00 00 */ }; struct _IO_DRIVER_CREATE_CONTEXT { short Size; /* +0x0000 */ unsigned char ExtraCreateParameter[4]; /* +0x0004 2c c1 00 00 */ void *DeviceObjectHint; /* +0x0008 */ unsigned char TxnParameters[4]; /* +0x000c 2e c1 00 00 */ }; struct _WHEA_ERROR_RECORD_HEADER_FLAGS { /* unsigned char Recovered[0]; +0x0000 17 13 00 00 */ /* unsigned char PreviousError[0]; +0x0000 7e 18 00 00 */ /* unsigned char Simulated[0]; +0x0000 7f 18 00 00 */ /* unsigned char Reserved[0]; +0x0000 b0 2c 00 00 */ unsigned long AsULONG; /* +0x0000 */ }; struct _GENERAL_LOOKASIDE_POOL { /* unsigned char ListHead[0]; +0x0000 3f 2a 00 00 */ unsigned char SingleListHead[8]; /* +0x0000 ba 17 00 00 */ unsigned short Depth; /* +0x0008 */ unsigned short MaximumDepth; /* +0x000a */ unsigned long TotalAllocates; /* +0x000c */ unsigned long AllocateMisses; /* +0x0010 */ unsigned long AllocateHits; /* +0x0010 */ unsigned long TotalFrees; /* +0x0014 */ unsigned long FreeMisses; /* +0x0018 */ unsigned long FreeHits; /* +0x0018 */ unsigned char Type[4]; /* +0x001c 35 c1 00 00 */ unsigned long Tag; /* +0x0020 */ unsigned long Size; /* +0x0024 */ /* unsigned char AllocateEx[0]; +0x0028 3a c1 00 00 */ unsigned char Allocate[4]; /* +0x0028 3d c1 00 00 */ /* unsigned char FreeEx[0]; +0x002c 40 c1 00 00 */ unsigned char Free[4]; /* +0x002c c7 13 00 00 */ unsigned char ListEntry[8]; /* +0x0030 44 1f 00 00 */ unsigned long LastTotalAllocates; /* +0x0038 */ unsigned long LastAllocateMisses; /* +0x003c */ unsigned long LastAllocateHits; /* +0x003c */ unsigned char Future[8]; /* +0x0040 69 15 00 00 */ }; enum DEVICE_TEXT_TYPE { DeviceTextDescription = 0, DeviceTextLocationInformation = 1 }; struct _WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_FLAGS { /* unsigned char Primary[0]; +0x0000 17 13 00 00 */ /* unsigned char ContainmentWarning[0]; +0x0000 7e 18 00 00 */ /* unsigned char Reset[0]; +0x0000 7f 18 00 00 */ /* unsigned char ThresholdExceeded[0]; +0x0000 27 1e 00 00 */ /* unsigned char ResourceNotAvailable[0]; +0x0000 42 1e 00 00 */ /* unsigned char LatentError[0]; +0x0000 ce 23 00 00 */ /* unsigned char Reserved[0]; +0x0000 ed 32 00 00 */ unsigned long AsULONG; /* +0x0000 */ }; struct _FAST_IO_DISPATCH { unsigned long SizeOfFastIoDispatch; /* +0x0000 */ unsigned char FastIoCheckIfPossible[4]; /* +0x0004 ab c0 00 00 */ unsigned char FastIoRead[4]; /* +0x0008 61 c0 00 00 */ unsigned char FastIoWrite[4]; /* +0x000c 61 c0 00 00 */ unsigned char FastIoQueryBasicInfo[4]; /* +0x0010 49 c1 00 00 */ unsigned char FastIoQueryStandardInfo[4]; /* +0x0014 4f c0 00 00 */ unsigned char FastIoLock[4]; /* +0x0018 57 c0 00 00 */ unsigned char FastIoUnlockSingle[4]; /* +0x001c 4a c1 00 00 */ unsigned char FastIoUnlockAll[4]; /* +0x0020 d6 c0 00 00 */ unsigned char FastIoUnlockAllByKey[4]; /* +0x0024 ae c0 00 00 */ unsigned char FastIoDeviceControl[4]; /* +0x0028 94 c0 00 00 */ unsigned char AcquireFileForNtCreateSection[4]; /* +0x002c 52 c0 00 00 */ unsigned char ReleaseFileForNtCreateSection[4]; /* +0x0030 52 c0 00 00 */ unsigned char FastIoDetachDevice[4]; /* +0x0034 4b c1 00 00 */ unsigned char FastIoQueryNetworkOpenInfo[4]; /* +0x0038 0d c1 00 00 */ unsigned char AcquireForModWrite[4]; /* +0x003c 16 c1 00 00 */ unsigned char MdlRead[4]; /* +0x0040 6a c0 00 00 */ unsigned char MdlReadComplete[4]; /* +0x0044 66 c0 00 00 */ unsigned char PrepareMdlWrite[4]; /* +0x0048 6a c0 00 00 */ unsigned char MdlWriteComplete[4]; /* +0x004c 5e c0 00 00 */ unsigned char FastIoReadCompressed[4]; /* +0x0050 25 c1 00 00 */ unsigned char FastIoWriteCompressed[4]; /* +0x0054 25 c1 00 00 */ unsigned char MdlReadCompleteCompressed[4]; /* +0x0058 66 c0 00 00 */ unsigned char MdlWriteCompleteCompressed[4]; /* +0x005c 5e c0 00 00 */ unsigned char FastIoQueryOpen[4]; /* +0x0060 4c c1 00 00 */ unsigned char ReleaseForModWrite[4]; /* +0x0064 4f c1 00 00 */ unsigned char AcquireForCcFlush[4]; /* +0x0068 17 c1 00 00 */ unsigned char ReleaseForCcFlush[4]; /* +0x006c 17 c1 00 00 */ }; struct _WHEA_ERROR_RECORD_HEADER { unsigned long Signature; /* +0x0000 */ unsigned char Revision[2]; /* +0x0004 5f c1 00 00 */ unsigned long SignatureEnd; /* +0x0006 */ unsigned short SectionCount; /* +0x000a */ unsigned char Severity[4]; /* +0x000c 60 c1 00 00 */ unsigned char ValidBits[4]; /* +0x0010 61 c1 00 00 */ unsigned long Length; /* +0x0014 */ unsigned char Timestamp[8]; /* +0x0018 62 c1 00 00 */ unsigned char PlatformId[16]; /* +0x0020 dc 14 00 00 */ unsigned char PartitionId[16]; /* +0x0030 dc 14 00 00 */ unsigned char CreatorId[16]; /* +0x0040 dc 14 00 00 */ unsigned char NotifyType[16]; /* +0x0050 dc 14 00 00 */ unsigned long long RecordId; /* +0x0060 */ unsigned char Flags[4]; /* +0x0068 63 c1 00 00 */ unsigned char PersistenceInfo[8]; /* +0x006c 64 c1 00 00 */ unsigned char Reserved[12]; /* +0x0074 6e 15 00 00 */ }; struct _KPRCB { unsigned short MinorVersion; /* +0x0000 */ unsigned short MajorVersion; /* +0x0002 */ unsigned char CurrentThread[4]; /* +0x0004 b0 c0 00 00 */ unsigned char NextThread[4]; /* +0x0008 b0 c0 00 00 */ unsigned char IdleThread[4]; /* +0x000c b0 c0 00 00 */ unsigned char LegacyNumber; /* +0x0010 */ unsigned char NestingLevel; /* +0x0011 */ unsigned short BuildType; /* +0x0012 */ char CpuType; /* +0x0014 */ char CpuID; /* +0x0015 */ unsigned short CpuStep; /* +0x0016 */ unsigned char CpuStepping; /* +0x0016 */ unsigned char CpuModel; /* +0x0017 */ unsigned char ProcessorState[800]; /* +0x0018 67 c1 00 00 */ unsigned char KernelReserved[64]; /* +0x0338 43 27 00 00 */ unsigned char HalReserved[64]; /* +0x0378 43 27 00 00 */ unsigned long CFlushSize; /* +0x03b8 */ unsigned char CoresPerPhysicalProcessor; /* +0x03bc */ unsigned char LogicalProcessorsPerCore; /* +0x03bd */ unsigned char PrcbPad0[2]; /* +0x03be a7 17 00 00 */ unsigned long MHz; /* +0x03c0 */ unsigned char CpuVendor; /* +0x03c4 */ unsigned char GroupIndex; /* +0x03c5 */ unsigned short Group; /* +0x03c6 */ unsigned long GroupSetMember; /* +0x03c8 */ unsigned long Number; /* +0x03cc */ unsigned char ClockOwner; /* +0x03d0 */ unsigned char PendingTick; /* +0x03d1 */ unsigned char PrcbPad1[70]; /* +0x03d2 68 c1 00 00 */ unsigned char LockQueue[136]; /* +0x0418 69 c1 00 00 */ }; struct _WHEA_ERROR_RECORD { unsigned char Header[128]; /* +0x0000 6e c1 00 00 */ unsigned char SectionDescriptor[72]; /* +0x0080 6f c1 00 00 */ }; struct _DEVOBJ_EXTENSION { short Type; /* +0x0000 */ unsigned short Size; /* +0x0002 */ unsigned char DeviceObject[4]; /* +0x0004 4c c0 00 00 */ unsigned long PowerFlags; /* +0x0008 */ unsigned char Dope[4]; /* +0x000c 77 c1 00 00 */ unsigned long ExtensionFlags; /* +0x0010 */ void *DeviceNode; /* +0x0014 */ unsigned char AttachedTo[4]; /* +0x0018 4c c0 00 00 */ long StartIoCount; /* +0x001c */ long StartIoKey; /* +0x0020 */ unsigned long StartIoFlags; /* +0x0024 */ unsigned char Vpb[4]; /* +0x0028 79 c1 00 00 */ unsigned char DependentList[8]; /* +0x002c 44 1f 00 00 */ unsigned char ProviderList[8]; /* +0x0034 44 1f 00 00 */ }; struct _SECTION_OBJECT_POINTERS { void *DataSectionObject; /* +0x0000 */ void *SharedCacheMap; /* +0x0004 */ void *ImageSectionObject; /* +0x0008 */ }; struct _NAMED_PIPE_CREATE_PARAMETERS { unsigned long NamedPipeType; /* +0x0000 */ unsigned long ReadMode; /* +0x0004 */ unsigned long CompletionMode; /* +0x0008 */ unsigned long MaximumInstances; /* +0x000c */ unsigned long InboundQuota; /* +0x0010 */ unsigned long OutboundQuota; /* +0x0014 */ unsigned char DefaultTimeout[8]; /* +0x0018 3d 13 00 00 */ unsigned char TimeoutSpecified; /* +0x0020 */ }; struct _MAILSLOT_CREATE_PARAMETERS { unsigned long MailslotQuota; /* +0x0000 */ unsigned long MaximumMessageSize; /* +0x0004 */ unsigned char ReadTimeout[8]; /* +0x0008 3d 13 00 00 */ unsigned char TimeoutSpecified; /* +0x0010 */ }; struct _WHEA_ERROR_RECORD_HEADER_VALIDBITS { /* unsigned char PlatformId[0]; +0x0000 17 13 00 00 */ /* unsigned char Timestamp[0]; +0x0000 7e 18 00 00 */ /* unsigned char PartitionId[0]; +0x0000 7f 18 00 00 */ /* unsigned char Reserved[0]; +0x0000 b0 2c 00 00 */ unsigned long AsULONG; /* +0x0000 */ }; struct _WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_VALIDBITS { /* unsigned char FRUId[0]; +0x0000 6f 1e 00 00 */ /* unsigned char FRUText[0]; +0x0000 70 1e 00 00 */ /* unsigned char Reserved[0]; +0x0000 05 20 00 00 */ unsigned char AsUCHAR; /* +0x0000 */ }; struct _IO_SECURITY_CONTEXT { unsigned char SecurityQos[4]; /* +0x0000 a7 3f 00 00 */ unsigned char AccessState[4]; /* +0x0004 21 c1 00 00 */ unsigned long DesiredAccess; /* +0x0008 */ unsigned long FullCreateOptions; /* +0x000c */ }; struct _OBJECT_HANDLE_INFORMATION { unsigned long HandleAttributes; /* +0x0000 */ unsigned long GrantedAccess; /* +0x0004 */ }; struct _DISPATCHER_HEADER { unsigned char Type; /* +0x0000 */ unsigned char TimerControlFlags; /* +0x0001 */ /* unsigned char Absolute[0]; +0x0001 6f 1e 00 00 */ /* unsigned char Wake[0]; +0x0001 70 1e 00 00 */ /* unsigned char Coalescable[0]; +0x0001 71 1e 00 00 */ /* unsigned char KeepShifting[0]; +0x0001 e3 25 00 00 */ /* unsigned char EncodedTolerableDelay[0]; +0x0001 fd 47 00 00 */ unsigned char Abandoned; /* +0x0001 */ unsigned char Signalling; /* +0x0001 */ unsigned char ThreadControlFlags; /* +0x0002 */ /* unsigned char CycleProfiling[0]; +0x0002 6f 1e 00 00 */ /* unsigned char CounterProfiling[0]; +0x0002 70 1e 00 00 */ /* unsigned char GroupScheduling[0]; +0x0002 71 1e 00 00 */ /* unsigned char AffinitySet[0]; +0x0002 e3 25 00 00 */ /* unsigned char Reserved[0]; +0x0002 fd 47 00 00 */ unsigned char Hand; /* +0x0002 */ unsigned char Size; /* +0x0002 */ unsigned char TimerMiscFlags; /* +0x0003 */ /* unsigned char Index[0]; +0x0003 6f 1e 00 00 */ /* unsigned char Processor[0]; +0x0003 94 c1 00 00 */ /* unsigned char Inserted[0]; +0x0003 74 1e 00 00 */ /* unsigned char Expired[0]; +0x0003 95 c1 00 00 */ unsigned char DebugActive; /* +0x0003 */ unsigned char DpcActive; /* +0x0003 */ unsigned char Lock[4]; /* +0x0000 c3 17 00 00 */ long SignalState; /* +0x0004 */ unsigned char WaitListHead[8]; /* +0x0008 44 1f 00 00 */ }; struct _VPB { short Type; /* +0x0000 */ short Size; /* +0x0002 */ unsigned short Flags; /* +0x0004 */ unsigned short VolumeLabelLength; /* +0x0006 */ unsigned char DeviceObject[4]; /* +0x0008 4c c0 00 00 */ unsigned char RealDevice[4]; /* +0x000c 4c c0 00 00 */ unsigned long SerialNumber; /* +0x0010 */ unsigned long ReferenceCount; /* +0x0014 */ unsigned char VolumeLabel[64]; /* +0x0018 a5 15 00 00 */ }; /* struct <unnamed-tag> { /* unsigned char MasterIrp[0]; +0x0000 8d c0 00 00 long IrpCount; +0x0000 void *SystemBuffer; +0x0000 }; */ /* struct <unnamed-tag> { /* unsigned char UserApcRoutine[0]; +0x0000 7b 51 00 00 void *IssuingProcess; +0x0000 void *UserApcContext; +0x0004 }; */ /* struct <unnamed-tag> { /* unsigned char AsynchronousParameters[0]; +0x0000 a3 c1 00 00 unsigned char AllocationSize[8]; +0x0000 3d 13 00 00 }; */ /* struct <unnamed-tag> { /* unsigned char DeviceQueueEntry[0]; +0x0000 a6 c1 00 00 unsigned char DriverContext[16]; +0x0000 84 2a 00 00 unsigned char Thread[4]; +0x0010 7f c1 00 00 char *AuxiliaryBuffer; +0x0014 unsigned char ListEntry[8]; +0x0018 44 1f 00 00 /* unsigned char CurrentStackLocation[0]; +0x0020 bd c0 00 00 unsigned long PacketType; +0x0020 unsigned char OriginalFileObject[4]; +0x0024 4a c0 00 00 void *IrpExtension; +0x0028 }; */ /* struct <unnamed-tag> { /* unsigned char Overlay[0]; +0x0000 a8 c1 00 00 /* unsigned char Apc[0]; +0x0000 fb c0 00 00 void *CompletionKey; +0x0000 }; */ struct _IRP { short Type; /* +0x0000 */ unsigned short Size; /* +0x0002 */ unsigned char MdlAddress[4]; /* +0x0004 5b c0 00 00 */ unsigned long Flags; /* +0x0008 */ unsigned char AssociatedIrp[4]; /* +0x000c a1 c1 00 00 */ unsigned char ThreadListEntry[8]; /* +0x0010 44 1f 00 00 */ unsigned char IoStatus[8]; /* +0x0018 3a 13 00 00 */ char RequestorMode; /* +0x0020 */ unsigned char PendingReturned; /* +0x0021 */ char StackCount; /* +0x0022 */ char CurrentLocation; /* +0x0023 */ unsigned char Cancel; /* +0x0024 */ unsigned char CancelIrql; /* +0x0025 */ char ApcEnvironment; /* +0x0026 */ unsigned char AllocationFlags; /* +0x0027 */ unsigned char UserIosb[4]; /* +0x0028 dc 1f 00 00 */ unsigned char UserEvent[4]; /* +0x002c 0a c1 00 00 */ unsigned char Overlay[8]; /* +0x0030 a5 c1 00 00 */ unsigned char CancelRoutine[4]; /* +0x0038 5c c1 00 00 */ void *UserBuffer; /* +0x003c */ unsigned char Tail[48]; /* +0x0040 aa c1 00 00 */ }; enum BUS_QUERY_ID_TYPE { BusQueryDeviceID = 0, BusQueryHardwareIDs = 1, BusQueryCompatibleIDs = 2, BusQueryInstanceID = 3, BusQueryDeviceSerialNumber = 4, BusQueryContainerID = 5 }; struct _WORK_QUEUE_ITEM { unsigned char List[8]; /* +0x0000 44 1f 00 00 */ unsigned char WorkerRoutine[4]; /* +0x0008 c7 13 00 00 */ void *Parameter; /* +0x000c */ }; struct _WAIT_CONTEXT_BLOCK { /* unsigned char WaitQueueEntry[0]; +0x0000 a6 c1 00 00 */ unsigned char DmaWaitEntry[8]; /* +0x0000 44 1f 00 00 */ unsigned long NumberOfChannels; /* +0x0008 */ /* unsigned char SyncCallback[0]; +0x000c 17 13 00 00 */ /* unsigned char DmaContext[0]; +0x000c 7e 18 00 00 */ unsigned char Reserved[4]; /* +0x000c b3 19 00 00 */ unsigned char DeviceRoutine[4]; /* +0x0010 ef c0 00 00 */ void *DeviceContext; /* +0x0014 */ unsigned long NumberOfMapRegisters; /* +0x0018 */ void *DeviceObject; /* +0x001c */ void *CurrentIrp; /* +0x0020 */ unsigned char BufferChainingDpc[4]; /* +0x0024 e0 c0 00 00 */ }; struct _OBJECT_TYPE_INITIALIZER { unsigned short Length; /* +0x0000 */ unsigned char ObjectTypeFlags; /* +0x0002 */ /* unsigned char CaseInsensitive[0]; +0x0002 6f 1e 00 00 */ /* unsigned char UnnamedObjectsOnly[0]; +0x0002 70 1e 00 00 */ /* unsigned char UseDefaultObject[0]; +0x0002 71 1e 00 00 */ /* unsigned char SecurityRequired[0]; +0x0002 e3 25 00 00 */ /* unsigned char MaintainHandleCount[0]; +0x0002 c9 25 00 00 */ /* unsigned char MaintainTypeList[0]; +0x0002 73 1e 00 00 */ /* unsigned char SupportsObjectCallbacks[0]; +0x0002 74 1e 00 00 */ unsigned char CacheAligned[2]; /* +0x0002 75 1e 00 00 */ unsigned long ObjectTypeCode; /* +0x0004 */ unsigned long InvalidAttributes; /* +0x0008 */ unsigned char GenericMapping[16]; /* +0x000c 41 16 00 00 */ unsigned long ValidAccessMask; /* +0x001c */ unsigned long RetainAccess; /* +0x0020 */ unsigned char PoolType[4]; /* +0x0024 35 c1 00 00 */ unsigned long DefaultPagedPoolCharge; /* +0x0028 */ unsigned long DefaultNonPagedPoolCharge; /* +0x002c */ unsigned char DumpProcedure[4]; /* +0x0030 db c0 00 00 */ unsigned char OpenProcedure[4]; /* +0x0034 9d c1 00 00 */ unsigned char CloseProcedure[4]; /* +0x0038 a4 c0 00 00 */ unsigned char DeleteProcedure[4]; /* +0x003c c7 13 00 00 */ unsigned char ParseProcedure[4]; /* +0x0040 24 c1 00 00 */ unsigned char SecurityProcedure[4]; /* +0x0044 55 c1 00 00 */ unsigned char QueryNameProcedure[4]; /* +0x0048 b3 c1 00 00 */ unsigned char OkayToCloseProcedure[4]; /* +0x004c d0 c0 00 00 */ unsigned long WaitObjectFlagMask; /* +0x0050 */ unsigned short WaitObjectFlagOffset; /* +0x0054 */ unsigned short WaitObjectPointerOffset; /* +0x0056 */ }; struct _OBJECT_TYPE { unsigned char TypeList[8]; /* +0x0000 44 1f 00 00 */ unsigned char Name[8]; /* +0x0008 dd 12 00 00 */ void *DefaultObject; /* +0x0010 */ unsigned char Index; /* +0x0014 */ unsigned long TotalNumberOfObjects; /* +0x0018 */ unsigned long TotalNumberOfHandles; /* +0x001c */ unsigned long HighWaterNumberOfObjects; /* +0x0020 */ unsigned long HighWaterNumberOfHandles; /* +0x0024 */ unsigned char TypeInfo[88]; /* +0x0028 ba c1 00 00 */ unsigned char TypeLock[4]; /* +0x0080 f4 c0 00 00 */ unsigned long Key; /* +0x0084 */ unsigned char CallbackList[8]; /* +0x0088 44 1f 00 00 */ }; enum _OB_OPEN_REASON { ObCreateHandle = 0, ObOpenHandle = 1, ObDuplicateHandle = 2, ObInheritHandle = 3, ObMaxOpenReason = 4 }; struct _WHEA_ERROR_PACKET_V2 { unsigned long Signature; /* +0x0000 */ unsigned long Version; /* +0x0004 */ unsigned long Length; /* +0x0008 */ unsigned char Flags[4]; /* +0x000c bf c1 00 00 */ unsigned char ErrorType[4]; /* +0x0010 c0 c1 00 00 */ unsigned char ErrorSeverity[4]; /* +0x0014 60 c1 00 00 */ unsigned long ErrorSourceId; /* +0x0018 */ unsigned char ErrorSourceType[4]; /* +0x001c c1 c1 00 00 */ unsigned char NotifyType[16]; /* +0x0020 dc 14 00 00 */ unsigned long long Context; /* +0x0030 */ unsigned char DataFormat[4]; /* +0x0038 c2 c1 00 00 */ unsigned long Reserved1; /* +0x003c */ unsigned long DataOffset; /* +0x0040 */ unsigned long DataLength; /* +0x0044 */ unsigned long PshedDataOffset; /* +0x0048 */ unsigned long PshedDataLength; /* +0x004c */ }; struct _WHEA_TIMESTAMP { /* unsigned char Seconds[0]; +0x0000 c5 c1 00 00 */ /* unsigned char Minutes[0]; +0x0000 c6 c1 00 00 */ /* unsigned char Hours[0]; +0x0000 c7 c1 00 00 */ /* unsigned char Precise[0]; +0x0000 c8 c1 00 00 */ /* unsigned char Reserved[0]; +0x0000 c9 c1 00 00 */ /* unsigned char Day[0]; +0x0000 ca c1 00 00 */ /* unsigned char Month[0]; +0x0000 cb c1 00 00 */ /* unsigned char Year[0]; +0x0000 cc c1 00 00 */ /* unsigned char Century[0]; +0x0000 cd c1 00 00 */ unsigned char AsLARGE_INTEGER[8]; /* +0x0000 3d 13 00 00 */ }; struct _WHEA_REVISION { unsigned char MinorRevision; /* +0x0000 */ unsigned char MajorRevision; /* +0x0001 */ unsigned short AsUSHORT; /* +0x0000 */ }; struct _LOOKASIDE_LIST_EX { unsigned char L[72]; /* +0x0000 d2 c1 00 00 */ }; struct _FILE_OBJECT { short Type; /* +0x0000 */ short Size; /* +0x0002 */ unsigned char DeviceObject[4]; /* +0x0004 4c c0 00 00 */ unsigned char Vpb[4]; /* +0x0008 79 c1 00 00 */ void *FsContext; /* +0x000c */ void *FsContext2; /* +0x0010 */ unsigned char SectionObjectPointer[4]; /* +0x0014 83 c1 00 00 */ void *PrivateCacheMap; /* +0x0018 */ long FinalStatus; /* +0x001c */ unsigned char RelatedFileObject[4]; /* +0x0020 4a c0 00 00 */ unsigned char LockOperation; /* +0x0024 */ unsigned char DeletePending; /* +0x0025 */ unsigned char ReadAccess; /* +0x0026 */ unsigned char WriteAccess; /* +0x0027 */ unsigned char DeleteAccess; /* +0x0028 */ unsigned char SharedRead; /* +0x0029 */ unsigned char SharedWrite; /* +0x002a */ unsigned char SharedDelete; /* +0x002b */ unsigned long Flags; /* +0x002c */ unsigned char FileName[8]; /* +0x0030 dd 12 00 00 */ unsigned char CurrentByteOffset[8]; /* +0x0038 3d 13 00 00 */ unsigned long Waiters; /* +0x0040 */ unsigned long Busy; /* +0x0044 */ void *LastLock; /* +0x0048 */ unsigned char Lock[16]; /* +0x004c 09 c1 00 00 */ unsigned char Event[16]; /* +0x005c 09 c1 00 00 */ unsigned char CompletionContext[4]; /* +0x006c d6 c1 00 00 */ unsigned long IrpListLock; /* +0x0070 */ unsigned char IrpList[8]; /* +0x0074 44 1f 00 00 */ void *FileObjectExtension; /* +0x007c */ }; enum _DEVICE_RELATION_TYPE { BusRelations = 0, EjectionRelations = 1, PowerRelations = 2, RemovalRelations = 3, TargetDeviceRelation = 4, SingleBusRelations = 5, TransportRelations = 6 }; struct _NPAGED_LOOKASIDE_LIST { unsigned char L[72]; /* +0x0000 b6 c0 00 00 */ unsigned long Lock__ObsoleteButDoNotDelete; /* +0x0048 */ }; /* struct <unnamed-tag> { /* unsigned char ListEntry[0]; +0x0000 44 1f 00 00 unsigned char Wcb[40]; +0x0000 dd c1 00 00 }; */ struct _DEVICE_OBJECT { short Type; /* +0x0000 */ unsigned short Size; /* +0x0002 */ long ReferenceCount; /* +0x0004 */ unsigned char DriverObject[4]; /* +0x0008 b2 c0 00 00 */ unsigned char NextDevice[4]; /* +0x000c 4c c0 00 00 */ unsigned char AttachedDevice[4]; /* +0x0010 4c c0 00 00 */ unsigned char CurrentIrp[4]; /* +0x0014 8d c0 00 00 */ unsigned char Timer[4]; /* +0x0018 8d c1 00 00 */ unsigned long Flags; /* +0x001c */ unsigned long Characteristics; /* +0x0020 */ unsigned char Vpb[4]; /* +0x0024 79 c1 00 00 */ void *DeviceExtension; /* +0x0028 */ unsigned long DeviceType; /* +0x002c */ char StackSize; /* +0x0030 */ unsigned char Queue[40]; /* +0x0034 df c1 00 00 */ unsigned long AlignmentRequirement; /* +0x005c */ unsigned char DeviceQueue[20]; /* +0x0060 e0 c1 00 00 */ unsigned char Dpc[32]; /* +0x0074 df c0 00 00 */ unsigned long ActiveThreadCount; /* +0x0094 */ void *SecurityDescriptor; /* +0x0098 */ unsigned char DeviceLock[16]; /* +0x009c 09 c1 00 00 */ unsigned short SectorSize; /* +0x00ac */ unsigned short Spare1; /* +0x00ae */ unsigned char DeviceObjectExtension[4]; /* +0x00b0 e2 c1 00 00 */ void *Reserved; /* +0x00b4 */ }; enum _WHEA_ERROR_SOURCE_TYPE { WheaErrSrcTypeMCE = 0, WheaErrSrcTypeCMC = 1, WheaErrSrcTypeCPE = 2, WheaErrSrcTypeNMI = 3, WheaErrSrcTypePCIe = 4, WheaErrSrcTypeGeneric = 5, WheaErrSrcTypeINIT = 6, WheaErrSrcTypeBOOT = 7, WheaErrSrcTypeSCIGeneric = 8, WheaErrSrcTypeIPFMCA = 9, WheaErrSrcTypeIPFCMC = 10, WheaErrSrcTypeIPFCPE = 11, WheaErrSrcTypeMax = 12 }; enum _MEMORY_CACHING_TYPE_ORIG { MmFrameBufferCached = 2 }; struct _INTERFACE { unsigned short Size; /* +0x0000 */ unsigned short Version; /* +0x0002 */ void *Context; /* +0x0004 */ unsigned char InterfaceReference[4]; /* +0x0008 c7 13 00 00 */ unsigned char InterfaceDereference[4]; /* +0x000c c7 13 00 00 */ }; /* struct <unnamed-tag> { unsigned char SecurityContext[4]; +0x0000 5a c1 00 00 unsigned long Options; +0x0004 unsigned short FileAttributes; +0x0008 unsigned short ShareAccess; +0x000a unsigned long EaLength; +0x000c }; */ /* struct <unnamed-tag> { unsigned char SecurityContext[4]; +0x0000 5a c1 00 00 unsigned long Options; +0x0004 unsigned short Reserved; +0x0008 unsigned short ShareAccess; +0x000a unsigned char Parameters[4]; +0x000c 32 c1 00 00 }; */ /* struct <unnamed-tag> { unsigned char SecurityContext[4]; +0x0000 5a c1 00 00 unsigned long Options; +0x0004 unsigned short Reserved; +0x0008 unsigned short ShareAccess; +0x000a unsigned char Parameters[4]; +0x000c dd c0 00 00 }; */ /* struct <unnamed-tag> { unsigned long Length; +0x0000 unsigned long Key; +0x0004 unsigned char ByteOffset[8]; +0x0008 3d 13 00 00 }; */ /* struct <unnamed-tag> { unsigned long Length; +0x0000 unsigned char FileName[4]; +0x0004 a2 17 00 00 unsigned char FileInformationClass[4]; +0x0008 c7 3e 00 00 unsigned long FileIndex; +0x000c }; */ /* struct <unnamed-tag> { unsigned long Length; +0x0000 unsigned long CompletionFilter; +0x0004 }; */ /* struct <unnamed-tag> { unsigned long Length; +0x0000 unsigned char FileInformationClass[4]; +0x0004 c7 3e 00 00 }; */ /* struct <unnamed-tag> { unsigned long Length; +0x0000 unsigned char FileInformationClass[4]; +0x0004 c7 3e 00 00 unsigned char FileObject[4]; +0x0008 4a c0 00 00 unsigned char ReplaceIfExists; +0x000c unsigned char AdvanceOnly; +0x000d unsigned long ClusterCount; +0x000c void *DeleteHandle; +0x000c }; */ /* struct <unnamed-tag> { unsigned long Length; +0x0000 unsigned char FsInformationClass[4]; +0x0004 82 24 00 00 }; */ /* struct <unnamed-tag> { unsigned long OutputBufferLength; +0x0000 unsigned long InputBufferLength; +0x0004 unsigned long FsControlCode; +0x0008 void *Type3InputBuffer; +0x000c }; */ /* struct <unnamed-tag> { unsigned char Length[4]; +0x0000 53 16 00 00 unsigned long Key; +0x0004 unsigned char ByteOffset[8]; +0x0008 3d 13 00 00 }; */ /* struct <unnamed-tag> { unsigned long OutputBufferLength; +0x0000 unsigned long InputBufferLength; +0x0004 unsigned long IoControlCode; +0x0008 void *Type3InputBuffer; +0x000c }; */ /* struct <unnamed-tag> { unsigned long SecurityInformation; +0x0000 unsigned long Length; +0x0004 }; */ /* struct <unnamed-tag> { unsigned long SecurityInformation; +0x0000 void *SecurityDescriptor; +0x0004 }; */ /* struct <unnamed-tag> { unsigned char Vpb[4]; +0x0000 79 c1 00 00 unsigned char DeviceObject[4]; +0x0004 4c c0 00 00 }; */ /* struct <unnamed-tag> { unsigned char Srb[4]; +0x0000 0a c2 00 00 }; */ /* struct <unnamed-tag> { unsigned char Type[4]; +0x0000 0d c2 00 00 }; */ /* struct <unnamed-tag> { unsigned char InterfaceType[4]; +0x0000 4a 16 00 00 unsigned short Size; +0x0004 unsigned short Version; +0x0006 unsigned char Interface[4]; +0x0008 11 c2 00 00 void *InterfaceSpecificData; +0x000c }; */ /* struct <unnamed-tag> { unsigned char Capabilities[4]; +0x0000 15 c2 00 00 }; */ /* struct <unnamed-tag> { unsigned char IoResourceRequirementList[4]; +0x0000 d8 3c 00 00 }; */ /* struct <unnamed-tag> { unsigned long WhichSpace; +0x0000 void *Buffer; +0x0004 unsigned long Offset; +0x0008 unsigned long Length; +0x000c }; */ /* struct <unnamed-tag> { unsigned char Lock; +0x0000 }; */ /* struct <unnamed-tag> { unsigned char IdType[4]; +0x0000 1e c2 00 00 }; */ /* struct <unnamed-tag> { unsigned char DeviceTextType[4]; +0x0000 21 c2 00 00 unsigned long LocaleId; +0x0004 }; */ /* struct <unnamed-tag> { unsigned char InPath; +0x0000 unsigned char Reserved[3]; +0x0001 8d 13 00 00 unsigned char Type[4]; +0x0004 24 c2 00 00 }; */ /* struct <unnamed-tag> { unsigned char PowerState[4]; +0x0000 5a 16 00 00 }; */ /* struct <unnamed-tag> { unsigned char PowerSequence[4]; +0x0000 fa c0 00 00 }; */ /* struct <unnamed-tag> { unsigned long SystemContext; +0x0000 unsigned char SystemPowerStateContext[4]; +0x0000 4a 21 00 00 unsigned char Type[4]; +0x0004 8e 43 00 00 unsigned char State[4]; +0x0008 d4 50 00 00 unsigned char ShutdownType[4]; +0x000c cb 32 00 00 }; */ /* struct <unnamed-tag> { unsigned char AllocatedResources[4]; +0x0000 df 12 00 00 unsigned char AllocatedResourcesTranslated[4]; +0x0004 df 12 00 00 }; */ /* struct <unnamed-tag> { unsigned long ProviderId; +0x0000 void *DataPath; +0x0004 unsigned long BufferSize; +0x0008 void *Buffer; +0x000c }; */ /* struct <unnamed-tag> { void *Argument1; +0x0000 void *Argument2; +0x0004 void *Argument3; +0x0008 void *Argument4; +0x000c }; */ /* struct <unnamed-tag> { /* unsigned char Create[0]; +0x0000 ec c1 00 00 /* unsigned char CreatePipe[0]; +0x0000 ee c1 00 00 /* unsigned char CreateMailslot[0]; +0x0000 f0 c1 00 00 /* unsigned char Read[0]; +0x0000 f2 c1 00 00 /* unsigned char Write[0]; +0x0000 f2 c1 00 00 /* unsigned char QueryDirectory[0]; +0x0000 f4 c1 00 00 /* unsigned char NotifyDirectory[0]; +0x0000 f6 c1 00 00 /* unsigned char QueryFile[0]; +0x0000 f8 c1 00 00 /* unsigned char SetFile[0]; +0x0000 fa c1 00 00 /* unsigned char QueryVolume[0]; +0x0000 fc c1 00 00 /* unsigned char FileSystemControl[0]; +0x0000 fe c1 00 00 /* unsigned char LockControl[0]; +0x0000 00 c2 00 00 /* unsigned char DeviceIoControl[0]; +0x0000 02 c2 00 00 /* unsigned char QuerySecurity[0]; +0x0000 04 c2 00 00 /* unsigned char SetSecurity[0]; +0x0000 06 c2 00 00 /* unsigned char MountVolume[0]; +0x0000 08 c2 00 00 /* unsigned char VerifyVolume[0]; +0x0000 08 c2 00 00 /* unsigned char Scsi[0]; +0x0000 0c c2 00 00 /* unsigned char QueryDeviceRelations[0]; +0x0000 0f c2 00 00 /* unsigned char QueryInterface[0]; +0x0000 13 c2 00 00 /* unsigned char DeviceCapabilities[0]; +0x0000 17 c2 00 00 /* unsigned char FilterResourceRequirements[0]; +0x0000 19 c2 00 00 /* unsigned char ReadWriteConfig[0]; +0x0000 1b c2 00 00 /* unsigned char SetLock[0]; +0x0000 1d c2 00 00 /* unsigned char QueryId[0]; +0x0000 20 c2 00 00 /* unsigned char QueryDeviceText[0]; +0x0000 23 c2 00 00 /* unsigned char UsageNotification[0]; +0x0000 26 c2 00 00 /* unsigned char WaitWake[0]; +0x0000 28 c2 00 00 /* unsigned char PowerSequence[0]; +0x0000 2a c2 00 00 /* unsigned char Power[0]; +0x0000 2c c2 00 00 /* unsigned char StartDevice[0]; +0x0000 2e c2 00 00 /* unsigned char WMI[0]; +0x0000 30 c2 00 00 unsigned char Others[16]; +0x0000 32 c2 00 00 }; */ struct _IO_STACK_LOCATION { unsigned char MajorFunction; /* +0x0000 */ unsigned char MinorFunction; /* +0x0001 */ unsigned char Flags; /* +0x0002 */ unsigned char Control; /* +0x0003 */ unsigned char Parameters[16]; /* +0x0004 34 c2 00 00 */ unsigned char DeviceObject[4]; /* +0x0014 4c c0 00 00 */ unsigned char FileObject[4]; /* +0x0018 4a c0 00 00 */ unsigned char CompletionRoutine[4]; /* +0x001c 35 c2 00 00 */ void *Context; /* +0x0020 */ }; struct _KDEVICE_QUEUE_ENTRY { unsigned char DeviceListEntry[8]; /* +0x0000 44 1f 00 00 */ unsigned long SortKey; /* +0x0008 */ unsigned char Inserted; /* +0x000c */ }; struct _WHEA_ERROR_RECORD_SECTION_DESCRIPTOR { unsigned long SectionOffset; /* +0x0000 */ unsigned long SectionLength; /* +0x0004 */ unsigned char Revision[2]; /* +0x0008 5f c1 00 00 */ unsigned char ValidBits[1]; /* +0x000a 3a c2 00 00 */ unsigned char Reserved; /* +0x000b */ unsigned char Flags[4]; /* +0x000c 3b c2 00 00 */ unsigned char SectionType[16]; /* +0x0010 dc 14 00 00 */ unsigned char FRUId[16]; /* +0x0020 dc 14 00 00 */ unsigned char SectionSeverity[4]; /* +0x0030 60 c1 00 00 */ unsigned char FRUText[20]; /* +0x0034 b6 1e 00 00 */ }; struct _AUX_ACCESS_DATA { unsigned char PrivilegesUsed[4]; /* +0x0000 80 13 00 00 */ unsigned char GenericMapping[16]; /* +0x0004 41 16 00 00 */ unsigned long AccessesToAudit; /* +0x0014 */ unsigned long MaximumAuditMask; /* +0x0018 */ unsigned char TransactionId[16]; /* +0x001c dc 14 00 00 */ void *NewSecurityDescriptor; /* +0x002c */ void *ExistingSecurityDescriptor; /* +0x0030 */ void *ParentSecurityDescriptor; /* +0x0034 */ unsigned char DeRefSecurityDescriptor[4]; /* +0x0038 8d 48 00 00 */ void *SDLock; /* +0x003c */ unsigned char AccessReasons[128]; /* +0x0040 7d 13 00 00 */ unsigned char GenerateStagingEvents; /* +0x00c0 */ }; struct _FAST_MUTEX { unsigned char Count[4]; /* +0x0000 c3 17 00 00 */ void *Owner; /* +0x0004 */ unsigned long Contention; /* +0x0008 */ unsigned char Event[16]; /* +0x000c 09 c1 00 00 */ unsigned long OldIrql; /* +0x001c */ }; struct _WHEA_ERROR_PACKET_FLAGS { /* unsigned char PreviousError[0]; +0x0000 17 13 00 00 */ /* unsigned char Reserved1[0]; +0x0000 7e 18 00 00 */ /* unsigned char HypervisorError[0]; +0x0000 7f 18 00 00 */ /* unsigned char Simulated[0]; +0x0000 27 1e 00 00 */ /* unsigned char PlatformPfaControl[0]; +0x0000 42 1e 00 00 */ /* unsigned char PlatformDirectedOffline[0]; +0x0000 ce 23 00 00 */ /* unsigned char Reserved2[0]; +0x0000 ed 32 00 00 */ unsigned long AsULONG; /* +0x0000 */ }; struct _DEVICE_CAPABILITIES { unsigned short Size; /* +0x0000 */ unsigned short Version; /* +0x0002 */ /* unsigned char DeviceD1[0]; +0x0004 17 13 00 00 */ /* unsigned char DeviceD2[0]; +0x0004 7e 18 00 00 */ /* unsigned char LockSupported[0]; +0x0004 7f 18 00 00 */ /* unsigned char EjectSupported[0]; +0x0004 27 1e 00 00 */ /* unsigned char Removable[0]; +0x0004 42 1e 00 00 */ /* unsigned char DockDevice[0]; +0x0004 ce 23 00 00 */ /* unsigned char UniqueID[0]; +0x0004 ff 1e 00 00 */ /* unsigned char SilentInstall[0]; +0x0004 00 1f 00 00 */ /* unsigned char RawDeviceOK[0]; +0x0004 c4 1d 00 00 */ /* unsigned char SurpriseRemovalOK[0]; +0x0004 01 1f 00 00 */ /* unsigned char WakeFromD0[0]; +0x0004 02 1f 00 00 */ /* unsigned char WakeFromD1[0]; +0x0004 03 1f 00 00 */ /* unsigned char WakeFromD2[0]; +0x0004 d0 23 00 00 */ /* unsigned char WakeFromD3[0]; +0x0004 d1 23 00 00 */ /* unsigned char HardwareDisabled[0]; +0x0004 05 1f 00 00 */ /* unsigned char NonDynamic[0]; +0x0004 92 20 00 00 */ /* unsigned char WarmEjectSupported[0]; +0x0004 46 c2 00 00 */ /* unsigned char NoDisplayInUI[0]; +0x0004 47 c2 00 00 */ /* unsigned char Reserved1[0]; +0x0004 d3 23 00 00 */ unsigned char Reserved[4]; /* +0x0004 48 c2 00 00 */ unsigned long Address; /* +0x0008 */ unsigned long UINumber; /* +0x000c */ unsigned char DeviceState[28]; /* +0x0010 59 16 00 00 */ unsigned char SystemWake[4]; /* +0x002c 5a 16 00 00 */ unsigned char DeviceWake[4]; /* +0x0030 58 16 00 00 */ unsigned long D1Latency; /* +0x0034 */ unsigned long D2Latency; /* +0x0038 */ unsigned long D3Latency; /* +0x003c */ }; struct _POWER_SEQUENCE { unsigned long SequenceD1; /* +0x0000 */ unsigned long SequenceD2; /* +0x0004 */ unsigned long SequenceD3; /* +0x0008 */ }; enum _WHEA_ERROR_TYPE { WheaErrTypeProcessor = 0, WheaErrTypeMemory = 1, WheaErrTypePCIExpress = 2, WheaErrTypeNMI = 3, WheaErrTypePCIXBus = 4, WheaErrTypePCIXDevice = 5, WheaErrTypeGeneric = 6 }; struct _DRIVER_EXTENSION { unsigned char DriverObject[4]; /* +0x0000 b2 c0 00 00 */ unsigned char AddDevice[4]; /* +0x0004 4d c2 00 00 */ unsigned long Count; /* +0x0008 */ unsigned char ServiceKeyName[8]; /* +0x000c dd 12 00 00 */ }; struct _DRIVER_OBJECT { short Type; /* +0x0000 */ short Size; /* +0x0002 */ unsigned char DeviceObject[4]; /* +0x0004 4c c0 00 00 */ unsigned long Flags; /* +0x0008 */ void *DriverStart; /* +0x000c */ unsigned long DriverSize; /* +0x0010 */ void *DriverSection; /* +0x0014 */ unsigned char DriverExtension[4]; /* +0x0018 9a c0 00 00 */ unsigned char DriverName[8]; /* +0x001c dd 12 00 00 */ unsigned char HardwareDatabase[4]; /* +0x0024 a2 17 00 00 */ unsigned char FastIoDispatch[4]; /* +0x0028 99 c1 00 00 */ unsigned char DriverInit[4]; /* +0x002c b5 c0 00 00 */ unsigned char DriverStartIo[4]; /* +0x0030 5c c1 00 00 */ unsigned char DriverUnload[4]; /* +0x0034 13 c1 00 00 */ unsigned char MajorFunction[112]; /* +0x0038 5a c2 00 00 */ };
所有com结构体大全
猜你喜欢
转载自blog.csdn.net/oshuangyue12/article/details/80209184
今日推荐
周排行