mismatch in ntdll.dll::CsrAllocateCaptureBuffer 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 88 9d 98 7c PUSH 0x7c989d88 mismatch in ntdll.dll::CsrAllocateMessagePointer 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 f0 9c 98 7c PUSH 0x7c989cf0 mismatch in ntdll.dll::CsrCaptureMessageBuffer 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 58 9c 98 7c PUSH 0x7c989c58 mismatch in ntdll.dll::CsrCaptureMessageMultiUnicodeStringsInPlace 5d POP EBP 5b POP EBX c3 RET 8b ff MOV EDI,EDI 53 PUSH EBX 55 PUSH EBP 8b e9 MOV EBP,ECX mismatch in ntdll.dll::CsrCaptureMessageString 00 8d 64 24 00 LEA ESP,DWORD PTR SS:[ESP+0x0] 8b c1 MOV EAX,ECX 0f c8 BSWAP EAX c3 RET 8d a4 24 00 00 00 00 LEA ESP,DWORD PTR SS:[ESP+0x0] 8d 64 24 00 LEA ESP,DWORD PTR SS:[ESP+0x0] mismatch in ntdll.dll::CsrCaptureTimeout 00 8d 64 24 00 LEA ESP,DWORD PTR SS:[ESP+0x0] 8b 54 24 08 MOV EDX,DWORD PTR SS:[ESP+0x8] 8b 44 24 04 MOV EAX,DWORD PTR SS:[ESP+0x4] 0f ca BSWAP EDX 0f c8 BSWAP EAX 8b c8 MOV ECX,EAX mismatch in ntdll.dll::CsrClientCallServer 5d POP EBP 5b POP EBX c2 04 00 RET 0x4 8a e1 MOV AH,CL 8a c5 MOV AL,CH c3 RET 8d a4 24 00 00 00 00 LEA ESP,DWORD PTR SS:[ESP+0x0] match in ntdll.dll::CsrClientConnectToServer match in ntdll.dll::CsrFreeCaptureBuffer match in ntdll.dll::CsrGetProcessId match in ntdll.dll::CsrIdentifyAlertableThread match in ntdll.dll::CsrNewThread match in ntdll.dll::CsrProbeForRead match in ntdll.dll::CsrProbeForWrite match in ntdll.dll::CsrSetPriorityClass match in ntdll.dll::DbgBreakPoint mismatch in ntdll.dll::DbgPrint 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP a1 80 03 9b 7c MOV EAX,DWORD PTR DS:[0x7c9b0380] c3 RET match in ntdll.dll::DbgPrintEx mismatch in ntdll.dll::DbgPrintReturnControlC 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP ff 35 d4 e1 9a 7c PUSH DWORD PTR DS:[0x7c9ae1d4] e8 81 50 ff ff CALL $+0xffff5081 match in ntdll.dll::DbgPrompt match in ntdll.dll::DbgQueryDebugFilterState match in ntdll.dll::DbgSetDebugFilterState mismatch in ntdll.dll::DbgUiConnectToDbg 5e POP ESI c9 LEAVE c2 04 00 RET 0x4 cc INT 0x3 c3 RET 8b ff MOV EDI,EDI cc INT 0x3 match in ntdll.dll::DbgUiContinue match in ntdll.dll::DbgUiConvertStateChangeStructure mismatch in ntdll.dll::DbgUiDebugActiveProcess 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 64 02 00 00 PUSH 0x264 68 88 9f 98 7c PUSH 0x7c989f88 match in ntdll.dll::DbgUiGetThreadDebugObject match in ntdll.dll::DbgUiIssueRemoteBreakin match in ntdll.dll::DbgUiRemoteBreakin match in ntdll.dll::DbgUiSetThreadDebugObject match in ntdll.dll::DbgUiStopDebugging match in ntdll.dll::DbgUiWaitStateChange match in ntdll.dll::DbgUserBreakPoint mismatch in ntdll.dll::KiFastSystemCall 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 64 a1 18 00 00 00 MOV EAX,DWORD PTR FS:[0x18] 8b 80 24 0f 00 00 MOV EAX,DWORD PTR DS:[EAX+0xf24] match in ntdll.dll::KiFastSystemCallRet mismatch in ntdll.dll::KiIntSystemCall 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 08 PUSH 0x8 68 58 1e 98 7c PUSH 0x7c981e58 match in ntdll.dll::KiRaiseUserExceptionDispatcher match in ntdll.dll::KiUserApcDispatcher match in ntdll.dll::KiUserCallbackDispatcher mismatch in ntdll.dll::KiUserExceptionDispatcher 00 cc INT 0x3 c3 RET 8b ff MOV EDI,EDI cc INT 0x3 c3 RET 8b ff MOV EDI,EDI mismatch in ntdll.dll::LdrAccessOutOfProcessResource 00 00 8d 49 00 LEA ECX,DWORD PTR DS:[ECX+0x0] 8b d4 MOV EDX,ESP 0f POP CS 34 c3 XOR AL,0xc3 8d a4 24 00 00 00 00 LEA ESP,DWORD PTR SS:[ESP+0x0] mismatch in ntdll.dll::LdrAccessResource 00 8b d4 MOV EDX,ESP 0f POP CS 34 c3 XOR AL,0xc3 8d a4 24 00 00 00 00 LEA ESP,DWORD PTR SS:[ESP+0x0] 8d 64 24 00 LEA ESP,DWORD PTR SS:[ESP+0x0] 8d 54 24 08 LEA EDX,DWORD PTR SS:[ESP+0x8] mismatch in ntdll.dll::LdrAddRefDll 00 8d 64 24 00 LEA ESP,DWORD PTR SS:[ESP+0x0] 8d 54 24 08 LEA EDX,DWORD PTR SS:[ESP+0x8] cd 2e INT 0x2e c3 RET 90 NOP 55 PUSH EBP mismatch in ntdll.dll::LdrAlternateResourcesEnabled 00 00 c2 08 00 RET 0x8 55 PUSH EBP 8b ec MOV EBP,ESP 83 ec 50 SUB ESP,0x50 89 44 24 0c MOV DWORD PTR SS:[ESP+0xc],EAX mismatch in ntdll.dll::LdrCreateOutOfProcessImage 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 8d 7c 24 10 LEA EDI,DWORD PTR SS:[ESP+0x10] 58 POP EAX mismatch in ntdll.dll::LdrDestroyOutOfProcessImage ff eb JMP $+0x0 mismatch in ntdll.dll::LdrDisableThreadCalloutsForDll cd 2b INT 0x2b cc INT 0x3 8b ff MOV EDI,EDI 8b 4c 24 04 MOV ECX,DWORD PTR SS:[ESP+0x4] 8b 1c 24 MOV EBX,DWORD PTR SS:[ESP] 51 PUSH ECX 53 PUSH EBX match in ntdll.dll::LdrEnumResources mismatch in ntdll.dll::LdrEnumerateLoadedModules 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP ff 74 24 10 PUSH DWORD PTR SS:[ESP+0x10] ff 74 24 10 PUSH DWORD PTR SS:[ESP+0x10] mismatch in ntdll.dll::LdrFindCreateProcessManifest 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 38 d2 95 7c PUSH 0x7c95d238 mismatch in ntdll.dll::LdrFindEntryForAddress 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 66 83 3d cc e0 9a 7c 00 CMP WORD PTR DS:[0x7c9ae0cc],0x0 0f 84 81 b9 00 00 JE $+0xb981 match in ntdll.dll::LdrFindResourceDirectory_U match in ntdll.dll::LdrFindResourceEx_U mismatch in ntdll.dll::LdrFindResource_U 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 b0 d5 94 7c PUSH 0x7c94d5b0 match in ntdll.dll::LdrFlushAlternateResourceModules mismatch in ntdll.dll::LdrGetDllHandle 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 f8 11 95 7c PUSH 0x7c9511f8 mismatch in ntdll.dll::LdrGetDllHandleEx 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 40 02 00 00 PUSH 0x240 68 f8 f8 94 7c PUSH 0x7c94f8f8 match in ntdll.dll::LdrGetProcedureAddress match in ntdll.dll::LdrHotPatchRoutine match in ntdll.dll::LdrInitShimEngineDynamic match in ntdll.dll::LdrInitializeThunk mismatch in ntdll.dll::LdrLoadAlternateResourceModule 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 20 f4 95 7c PUSH 0x7c95f420 match in ntdll.dll::LdrLoadDll mismatch in ntdll.dll::LdrLockLoaderLock 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 44 PUSH 0x44 68 e0 60 94 7c PUSH 0x7c9460e0 match in ntdll.dll::LdrProcessRelocationBlock mismatch in ntdll.dll::LdrQueryImageFileExecutionOptions 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 60 PUSH 0x60 68 58 24 98 7c PUSH 0x7c982458 match in ntdll.dll::LdrQueryProcessModuleInformation mismatch in ntdll.dll::LdrSetAppCompatDllRedirectionCallback 00 00 c2 04 00 RET 0x4 8d 44 24 10 LEA EAX,DWORD PTR SS:[ESP+0x10] 89 44 24 04 MOV DWORD PTR SS:[ESP+0x4],EAX 33 ed XOR EBP,EBP e9 da 77 01 00 JMP $+0x177da mismatch in ntdll.dll::LdrSetDllManifestProber 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 2c 0d 00 00 PUSH 0xd2c 68 28 28 94 7c PUSH 0x7c942828 mismatch in ntdll.dll::LdrShutdownProcess 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 6c 02 00 00 PUSH 0x26c 68 10 5e 94 7c PUSH 0x7c945e10 mismatch in ntdll.dll::LdrShutdownThread 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 08 2d 94 7c PUSH 0x7c942d08 match in ntdll.dll::LdrUnloadAlternateResourceModule match in ntdll.dll::LdrUnloadDll match in ntdll.dll::LdrUnlockLoaderLock mismatch in ntdll.dll::LdrVerifyImageMatchesChecksum 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 0c PUSH 0xc 68 a8 2a 98 7c PUSH 0x7c982aa8 match in ntdll.dll::NlsAnsiCodePage mismatch in ntdll.dll::NlsMbCodePageTag 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 50 PUSH 0x50 68 a0 37 95 7c PUSH 0x7c9537a0 mismatch in ntdll.dll::NlsMbOemCodePageTag 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 44 PUSH 0x44 68 70 8c 94 7c PUSH 0x7c948c70 mismatch in ntdll.dll::NtAcceptConnectPort 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 1c PUSH 0x1c 68 08 98 94 7c PUSH 0x7c949808 mismatch in ntdll.dll::NtAccessCheck 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 c4 00 00 00 PUSH 0xc4 68 48 6e 94 7c PUSH 0x7c946e48 mismatch in ntdll.dll::NtAccessCheckAndAuditAlarm 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 0c PUSH 0xc 68 80 2d 94 7c PUSH 0x7c942d80 mismatch in ntdll.dll::NtAccessCheckByType 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 50 PUSH 0x50 68 b0 11 96 7c PUSH 0x7c9611b0 mismatch in ntdll.dll::NtAccessCheckByTypeAndAuditAlarm ff 00 INC DWORD PTR DS:[EAX] 00 00 00 b5 03 MOV CH,0x3 00 00 mismatch in ntdll.dll::NtAccessCheckByTypeResultList 00 00 00 00 00 01 00 ADD DWORD PTR DS:[EAX],EAX 00 mismatch in ntdll.dll::NtAccessCheckByTypeResultListAndAuditAlarm 00 00 00 00 00 01 00 ADD DWORD PTR DS:[EAX],EAX 00 mismatch in ntdll.dll::NtAccessCheckByTypeResultListAndAuditAlarmByHandle 74 6f JE $+0x6f 75 6c JNE $+0x6c 00 b8 00 00 00 00 MOV EAX,0x0 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 18 00 RET 0x18 mismatch in ntdll.dll::NtAddAtom 12 c2 ADC AL,DL 18 00 SBB BYTE PTR DS:[EAX],AL 90 NOP b8 01 00 00 00 MOV EAX,0x1 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 20 00 RET 0x20 mismatch in ntdll.dll::NtAddBootEntry 12 c2 ADC AL,DL 20 00 AND BYTE PTR DS:[EAX],AL 90 NOP b8 02 00 00 00 MOV EAX,0x2 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 2c 00 RET 0x2c mismatch in ntdll.dll::NtAdjustGroupsToken 12 c2 ADC AL,DL 2c 00 SUB AL,0x0 90 NOP b8 03 00 00 00 MOV EAX,0x3 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 2c 00 RET 0x2c mismatch in ntdll.dll::NtAdjustPrivilegesToken 12 c2 ADC AL,DL 2c 00 SUB AL,0x0 90 NOP b8 04 00 00 00 MOV EAX,0x4 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 40 00 RET 0x40 mismatch in ntdll.dll::NtAlertResumeThread 12 c2 ADC AL,DL 40 INC EAX 00 90 NOP b8 05 00 00 00 MOV EAX,0x5 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] mismatch in ntdll.dll::NtAlertThread 12 c2 ADC AL,DL 2c 00 SUB AL,0x0 90 NOP b8 06 00 00 00 MOV EAX,0x6 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 40 00 RET 0x40 mismatch in ntdll.dll::NtAllocateLocallyUniqueId 12 c2 ADC AL,DL 40 INC EAX 00 90 NOP b8 07 00 00 00 MOV EAX,0x7 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] mismatch in ntdll.dll::NtAllocateUserPhysicalPages 12 c2 ADC AL,DL 44 INC ESP 00 90 NOP b8 08 00 00 00 MOV EAX,0x8 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] mismatch in ntdll.dll::NtAllocateUuids 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 09 00 00 00 MOV EAX,0x9 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtAllocateVirtualMemory 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 0a 00 00 00 MOV EAX,0xa ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 18 00 RET 0x18 mismatch in ntdll.dll::NtAreMappedFilesTheSame 12 c2 ADC AL,DL 18 00 SBB BYTE PTR DS:[EAX],AL 90 NOP b8 0b 00 00 00 MOV EAX,0xb ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 18 00 RET 0x18 mismatch in ntdll.dll::NtAssignProcessToJobObject 12 c2 ADC AL,DL 18 00 SBB BYTE PTR DS:[EAX],AL 90 NOP b8 0c 00 00 00 MOV EAX,0xc ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtCallbackReturn 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 0d 00 00 00 MOV EAX,0xd ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::NtCancelDeviceWakeupRequest 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 0e 00 00 00 MOV EAX,0xe ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::NtCancelIoFile 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 0f 00 00 00 MOV EAX,0xf ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtCancelTimer 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 10 00 00 00 MOV EAX,0x10 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::NtClearEvent 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 11 00 00 00 MOV EAX,0x11 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 18 00 RET 0x18 mismatch in ntdll.dll::NtClose 12 c2 ADC AL,DL 18 00 SBB BYTE PTR DS:[EAX],AL 90 NOP b8 12 00 00 00 MOV EAX,0x12 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtCloseObjectAuditAlarm 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 13 00 00 00 MOV EAX,0x13 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtCompactKeys 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 14 00 00 00 MOV EAX,0x14 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtCompareTokens 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 15 00 00 00 MOV EAX,0x15 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::NtCompleteConnectPort 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 16 00 00 00 MOV EAX,0x16 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtCompressKey 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 17 00 00 00 MOV EAX,0x17 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtConnectPort 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 18 00 00 00 MOV EAX,0x18 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::NtContinue 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 19 00 00 00 MOV EAX,0x19 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::NtCreateDebugObject 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 1a 00 00 00 MOV EAX,0x1a ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtCreateDirectoryObject 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 1b 00 00 00 MOV EAX,0x1b ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtCreateEvent 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 1c 00 00 00 MOV EAX,0x1c ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtCreateEventPair 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 1d 00 00 00 MOV EAX,0x1d ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::NtCreateFile 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 1e 00 00 00 MOV EAX,0x1e ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::NtCreateIoCompletion 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 1f 00 00 00 MOV EAX,0x1f ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 20 00 RET 0x20 mismatch in ntdll.dll::NtCreateJobObject 12 c2 ADC AL,DL 20 00 AND BYTE PTR DS:[EAX],AL 90 NOP b8 20 00 00 00 MOV EAX,0x20 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtCreateJobSet 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 21 00 00 00 MOV EAX,0x21 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::NtCreateKey 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 22 00 00 00 MOV EAX,0x22 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtCreateKeyedEvent 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 23 00 00 00 MOV EAX,0x23 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::NtCreateMailslotFile 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 24 00 00 00 MOV EAX,0x24 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtCreateMutant 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 25 00 00 00 MOV EAX,0x25 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 2c 00 RET 0x2c mismatch in ntdll.dll::NtCreateNamedPipeFile 12 c2 ADC AL,DL 2c 00 SUB AL,0x0 90 NOP b8 26 00 00 00 MOV EAX,0x26 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::NtCreatePagingFile 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 27 00 00 00 MOV EAX,0x27 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtCreatePort 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 28 00 00 00 MOV EAX,0x28 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtCreateProcess 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 29 00 00 00 MOV EAX,0x29 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 1c 00 RET 0x1c mismatch in ntdll.dll::NtCreateProcessEx 12 c3 ADC AL,BL 8d 49 00 LEA ECX,DWORD PTR DS:[ECX+0x0] b8 17 01 00 00 MOV EAX,0x117 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 90 NOP mismatch in ntdll.dll::NtCreateProfile 12 c2 ADC AL,DL 1c 00 SBB AL,0x0 90 NOP b8 2a 00 00 00 MOV EAX,0x2a ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 20 00 RET 0x20 mismatch in ntdll.dll::NtCreateSection 12 c2 ADC AL,DL 20 00 AND BYTE PTR DS:[EAX],AL 90 NOP b8 2b 00 00 00 MOV EAX,0x2b ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::NtCreateSemaphore 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 2c 00 00 00 MOV EAX,0x2c ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 38 00 RET 0x38 mismatch in ntdll.dll::NtCreateSymbolicLinkObject 12 c2 ADC AL,DL 38 00 CMP BYTE PTR DS:[EAX],AL 90 NOP b8 2d 00 00 00 MOV EAX,0x2d ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::NtCreateThread 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 2e 00 00 00 MOV EAX,0x2e ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::NtCreateTimer 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 2f 00 00 00 MOV EAX,0x2f ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 20 00 RET 0x20 mismatch in ntdll.dll::NtCreateToken 12 c2 ADC AL,DL 20 00 AND BYTE PTR DS:[EAX],AL 90 NOP b8 30 00 00 00 MOV EAX,0x30 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 24 00 RET 0x24 mismatch in ntdll.dll::NtCreateWaitablePort 12 c2 ADC AL,DL 24 00 AND AL,0x0 90 NOP b8 31 00 00 00 MOV EAX,0x31 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 24 00 RET 0x24 mismatch in ntdll.dll::NtCurrentTeb 12 c2 ADC AL,DL 24 00 AND AL,0x0 90 NOP b8 32 00 00 00 MOV EAX,0x32 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 1c 00 RET 0x1c mismatch in ntdll.dll::NtDebugActiveProcess 12 c2 ADC AL,DL 1c 00 SBB AL,0x0 90 NOP b8 33 00 00 00 MOV EAX,0x33 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::NtDebugContinue 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 34 00 00 00 MOV EAX,0x34 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::NtDelayExecution 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 35 00 00 00 MOV EAX,0x35 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 20 00 RET 0x20 mismatch in ntdll.dll::NtDeleteAtom 12 c2 ADC AL,DL 20 00 AND BYTE PTR DS:[EAX],AL 90 NOP b8 36 00 00 00 MOV EAX,0x36 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::NtDeleteBootEntry 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 37 00 00 00 MOV EAX,0x37 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 34 00 RET 0x34 mismatch in ntdll.dll::NtDeleteFile 12 c2 ADC AL,DL 34 00 XOR AL,0x0 90 NOP b8 38 00 00 00 MOV EAX,0x38 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::NtDeleteKey 04 cc ADD AL,0xcc c2 04 00 RET 0x4 64 a1 18 00 00 00 MOV EAX,DWORD PTR FS:[0x18] c3 RET 57 PUSH EDI 8b 7c 24 0c MOV EDI,DWORD PTR SS:[ESP+0xc] 8b 54 24 08 MOV EDX,DWORD PTR SS:[ESP+0x8] mismatch in ntdll.dll::NtDeleteObjectAuditAlarm 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 39 00 00 00 MOV EAX,0x39 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtDeleteValueKey 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 3a 00 00 00 MOV EAX,0x3a ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtDeviceIoControlFile 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 3b 00 00 00 MOV EAX,0x3b ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtDisplayString 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 3c 00 00 00 MOV EAX,0x3c ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::NtDuplicateObject 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 3d 00 00 00 MOV EAX,0x3d ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::NtDuplicateToken 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 3e 00 00 00 MOV EAX,0x3e ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::NtEnumerateBootEntries 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 3f 00 00 00 MOV EAX,0x3f ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::NtEnumerateKey 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 40 00 00 00 MOV EAX,0x40 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtEnumerateSystemEnvironmentValuesEx 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 41 00 00 00 MOV EAX,0x41 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtEnumerateValueKey 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 42 00 00 00 MOV EAX,0x42 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 28 00 RET 0x28 mismatch in ntdll.dll::NtExtendSection 12 c2 ADC AL,DL 28 00 SUB BYTE PTR DS:[EAX],AL 90 NOP b8 43 00 00 00 MOV EAX,0x43 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::NtFilterToken 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 44 00 00 00 MOV EAX,0x44 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 1c 00 RET 0x1c mismatch in ntdll.dll::NtFindAtom 12 c2 ADC AL,DL 1c 00 SBB AL,0x0 90 NOP b8 45 00 00 00 MOV EAX,0x45 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 18 00 RET 0x18 mismatch in ntdll.dll::NtFlushBuffersFile 12 c2 ADC AL,DL 18 00 SBB BYTE PTR DS:[EAX],AL 90 NOP b8 46 00 00 00 MOV EAX,0x46 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtFlushInstructionCache 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 47 00 00 00 MOV EAX,0x47 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 18 00 RET 0x18 mismatch in ntdll.dll::NtFlushKey 12 c2 ADC AL,DL 18 00 SBB BYTE PTR DS:[EAX],AL 90 NOP b8 48 00 00 00 MOV EAX,0x48 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtFlushVirtualMemory 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 49 00 00 00 MOV EAX,0x49 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 18 00 RET 0x18 mismatch in ntdll.dll::NtFlushWriteBuffer 12 c2 ADC AL,DL 18 00 SBB BYTE PTR DS:[EAX],AL 90 NOP b8 4a 00 00 00 MOV EAX,0x4a ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtFreeUserPhysicalPages 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 4b 00 00 00 MOV EAX,0x4b ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 18 00 RET 0x18 mismatch in ntdll.dll::NtFreeVirtualMemory 12 c2 ADC AL,DL 18 00 SBB BYTE PTR DS:[EAX],AL 90 NOP b8 4c 00 00 00 MOV EAX,0x4c ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtFsControlFile 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 4d 00 00 00 MOV EAX,0x4d ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtGetContextThread 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 4e 00 00 00 MOV EAX,0x4e ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtGetDevicePowerState 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 4f 00 00 00 MOV EAX,0x4f ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::NtGetPlugPlayEvent 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 50 00 00 00 MOV EAX,0x50 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::NtGetWriteWatch 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 51 00 00 00 MOV EAX,0x51 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c3 RET mismatch in ntdll.dll::NtImpersonateAnonymousToken 12 c3 ADC AL,BL 8d 49 00 LEA ECX,DWORD PTR DS:[ECX+0x0] b8 52 00 00 00 MOV EAX,0x52 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc 90 NOP mismatch in ntdll.dll::NtImpersonateClientOfPort 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 53 00 00 00 MOV EAX,0x53 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::NtImpersonateThread 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 54 00 00 00 MOV EAX,0x54 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 28 00 RET 0x28 mismatch in ntdll.dll::NtInitializeRegistry 12 c2 ADC AL,DL 28 00 SUB BYTE PTR DS:[EAX],AL 90 NOP b8 55 00 00 00 MOV EAX,0x55 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtInitiatePowerAction 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 56 00 00 00 MOV EAX,0x56 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtIsProcessInJob 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 57 00 00 00 MOV EAX,0x57 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::NtIsSystemResumeAutomatic 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 58 00 00 00 MOV EAX,0x58 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 1c 00 RET 0x1c mismatch in ntdll.dll::NtListenPort 12 c2 ADC AL,DL 1c 00 SBB AL,0x0 90 NOP b8 59 00 00 00 MOV EAX,0x59 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::NtLoadDriver 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 5a 00 00 00 MOV EAX,0x5a ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtLoadKey 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 5b 00 00 00 MOV EAX,0x5b ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtLoadKey2 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 5c 00 00 00 MOV EAX,0x5c ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::NtLockFile 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 5d 00 00 00 MOV EAX,0x5d ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::NtLockProductActivationKeys 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 5e 00 00 00 MOV EAX,0x5e ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtLockRegistryKey 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 5f 00 00 00 MOV EAX,0x5f ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c3 RET mismatch in ntdll.dll::NtLockVirtualMemory 12 c3 ADC AL,BL 8d 49 00 LEA ECX,DWORD PTR DS:[ECX+0x0] b8 60 00 00 00 MOV EAX,0x60 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 90 NOP mismatch in ntdll.dll::NtMakePermanentObject 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 61 00 00 00 MOV EAX,0x61 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::NtMakeTemporaryObject 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 63 00 00 00 MOV EAX,0x63 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtMapUserPhysicalPages 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 62 00 00 00 MOV EAX,0x62 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtMapUserPhysicalPagesScatter 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 64 00 00 00 MOV EAX,0x64 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 28 00 RET 0x28 mismatch in ntdll.dll::NtMapViewOfSection 12 c2 ADC AL,DL 28 00 SUB BYTE PTR DS:[EAX],AL 90 NOP b8 65 00 00 00 MOV EAX,0x65 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtModifyBootEntry 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 66 00 00 00 MOV EAX,0x66 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::NtNotifyChangeDirectoryFile 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 67 00 00 00 MOV EAX,0x67 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::NtNotifyChangeKey 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 68 00 00 00 MOV EAX,0x68 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::NtNotifyChangeMultipleKeys 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 69 00 00 00 MOV EAX,0x69 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::NtOpenDirectoryObject 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 6a 00 00 00 MOV EAX,0x6a ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtOpenEvent 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 6b 00 00 00 MOV EAX,0x6b ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtOpenEventPair 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 6c 00 00 00 MOV EAX,0x6c ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 28 00 RET 0x28 mismatch in ntdll.dll::NtOpenFile 12 c2 ADC AL,DL 28 00 SUB BYTE PTR DS:[EAX],AL 90 NOP b8 6d 00 00 00 MOV EAX,0x6d ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::NtOpenIoCompletion 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 6e 00 00 00 MOV EAX,0x6e ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 24 00 RET 0x24 mismatch in ntdll.dll::NtOpenJobObject 12 c2 ADC AL,DL 24 00 AND AL,0x0 90 NOP b8 6f 00 00 00 MOV EAX,0x6f ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 28 00 RET 0x28 mismatch in ntdll.dll::NtOpenKey 12 c2 ADC AL,DL 28 00 SUB BYTE PTR DS:[EAX],AL 90 NOP b8 70 00 00 00 MOV EAX,0x70 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 30 00 RET 0x30 mismatch in ntdll.dll::NtOpenKeyedEvent 12 c2 ADC AL,DL 30 00 XOR BYTE PTR DS:[EAX],AL 90 NOP b8 71 00 00 00 MOV EAX,0x71 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtOpenMutant 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 72 00 00 00 MOV EAX,0x72 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtOpenObjectAuditAlarm 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 73 00 00 00 MOV EAX,0x73 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtOpenProcess 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 74 00 00 00 MOV EAX,0x74 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 18 00 RET 0x18 mismatch in ntdll.dll::NtOpenProcessToken 12 c2 ADC AL,DL 18 00 SBB BYTE PTR DS:[EAX],AL 90 NOP b8 75 00 00 00 MOV EAX,0x75 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtOpenProcessTokenEx 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 76 00 00 00 MOV EAX,0x76 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtOpenSection 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 77 00 00 00 MOV EAX,0x77 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtOpenSemaphore 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 18 01 00 00 MOV EAX,0x118 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtOpenSymbolicLinkObject 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 78 00 00 00 MOV EAX,0x78 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtOpenThread 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 79 00 00 00 MOV EAX,0x79 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 30 00 RET 0x30 mismatch in ntdll.dll::NtOpenThreadToken 12 c2 ADC AL,DL 30 00 XOR BYTE PTR DS:[EAX],AL 90 NOP b8 7a 00 00 00 MOV EAX,0x7a ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::NtOpenThreadTokenEx 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 7b 00 00 00 MOV EAX,0x7b ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtOpenTimer 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 7c 00 00 00 MOV EAX,0x7c ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::NtPlugPlayControl 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 7d 00 00 00 MOV EAX,0x7d ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtPowerInformation 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 7e 00 00 00 MOV EAX,0x7e ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtPrivilegeCheck 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 7f 00 00 00 MOV EAX,0x7f ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtPrivilegeObjectAuditAlarm 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 80 00 00 00 MOV EAX,0x80 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::NtPrivilegedServiceAuditAlarm 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 81 00 00 00 MOV EAX,0x81 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::NtProtectVirtualMemory 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 82 00 00 00 MOV EAX,0x82 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::NtPulseEvent 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 83 00 00 00 MOV EAX,0x83 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtQueryAttributesFile 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 84 00 00 00 MOV EAX,0x84 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtQueryBootEntryOrder 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 85 00 00 00 MOV EAX,0x85 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::NtQueryBootOptions 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 86 00 00 00 MOV EAX,0x86 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtQueryDebugFilterState 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 87 00 00 00 MOV EAX,0x87 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 18 00 RET 0x18 mismatch in ntdll.dll::NtQueryDefaultLocale 12 c2 ADC AL,DL 18 00 SBB BYTE PTR DS:[EAX],AL 90 NOP b8 88 00 00 00 MOV EAX,0x88 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::NtQueryDefaultUILanguage 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 89 00 00 00 MOV EAX,0x89 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::NtQueryDirectoryFile 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 8a 00 00 00 MOV EAX,0x8a ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtQueryDirectoryObject 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 8b 00 00 00 MOV EAX,0x8b ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtQueryEaFile 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 8c 00 00 00 MOV EAX,0x8c ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtQueryEvent 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 8d 00 00 00 MOV EAX,0x8d ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtQueryFullAttributesFile 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 8e 00 00 00 MOV EAX,0x8e ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtQueryInformationAtom 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 8f 00 00 00 MOV EAX,0x8f ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtQueryInformationFile 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 90 00 00 00 MOV EAX,0x90 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::NtQueryInformationJobObject 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 91 00 00 00 MOV EAX,0x91 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 2c 00 RET 0x2c mismatch in ntdll.dll::NtQueryInformationPort 12 c2 ADC AL,DL 2c 00 SUB AL,0x0 90 NOP b8 92 00 00 00 MOV EAX,0x92 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 1c 00 RET 0x1c mismatch in ntdll.dll::NtQueryInformationProcess 12 c2 ADC AL,DL 1c 00 SBB AL,0x0 90 NOP b8 93 00 00 00 MOV EAX,0x93 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 24 00 RET 0x24 mismatch in ntdll.dll::NtQueryInformationThread 12 c2 ADC AL,DL 24 00 AND AL,0x0 90 NOP b8 94 00 00 00 MOV EAX,0x94 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::NtQueryInformationToken 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 95 00 00 00 MOV EAX,0x95 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtQueryInstallUILanguage 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 96 00 00 00 MOV EAX,0x96 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::NtQueryIntervalProfile 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 97 00 00 00 MOV EAX,0x97 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::NtQueryIoCompletion 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 98 00 00 00 MOV EAX,0x98 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::NtQueryKey 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 99 00 00 00 MOV EAX,0x99 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::NtQueryMultipleValueKey 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 9a 00 00 00 MOV EAX,0x9a ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::NtQueryMutant 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 9b 00 00 00 MOV EAX,0x9b ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::NtQueryObject 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 9c 00 00 00 MOV EAX,0x9c ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::NtQueryOpenSubKeys 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 9d 00 00 00 MOV EAX,0x9d ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::NtQueryPerformanceCounter 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 9e 00 00 00 MOV EAX,0x9e ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtQueryPortInformationProcess 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 9f 00 00 00 MOV EAX,0x9f ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::NtQueryQuotaInformationFile 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 a0 00 00 00 MOV EAX,0xa0 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::NtQuerySection 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 a1 00 00 00 MOV EAX,0xa1 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 18 00 RET 0x18 mismatch in ntdll.dll::NtQuerySecurityObject 12 c2 ADC AL,DL 18 00 SBB BYTE PTR DS:[EAX],AL 90 NOP b8 a2 00 00 00 MOV EAX,0xa2 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::NtQuerySemaphore 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 a3 00 00 00 MOV EAX,0xa3 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::NtQuerySymbolicLinkObject 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 a4 00 00 00 MOV EAX,0xa4 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtQuerySystemEnvironmentValue 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 a5 00 00 00 MOV EAX,0xa5 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtQuerySystemEnvironmentValueEx 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 1b 01 00 00 MOV EAX,0x11b ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c3 RET mismatch in ntdll.dll::NtQuerySystemInformation 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 a6 00 00 00 MOV EAX,0xa6 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 24 00 RET 0x24 mismatch in ntdll.dll::NtQuerySystemTime 12 c2 ADC AL,DL 24 00 AND AL,0x0 90 NOP b8 a7 00 00 00 MOV EAX,0xa7 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::NtQueryTimer 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 a8 00 00 00 MOV EAX,0xa8 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::NtQueryTimerResolution 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 a9 00 00 00 MOV EAX,0xa9 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::NtQueryValueKey 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 aa 00 00 00 MOV EAX,0xaa ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtQueryVirtualMemory 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 ab 00 00 00 MOV EAX,0xab ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::NtQueryVolumeInformationFile 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 ac 00 00 00 MOV EAX,0xac ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::NtQueueApcThread 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 ad 00 00 00 MOV EAX,0xad ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::NtRaiseException 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 ae 00 00 00 MOV EAX,0xae ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::NtRaiseHardError 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 af 00 00 00 MOV EAX,0xaf ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::NtReadFile 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 b0 00 00 00 MOV EAX,0xb0 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtReadFileScatter 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 b1 00 00 00 MOV EAX,0xb1 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 18 00 RET 0x18 mismatch in ntdll.dll::NtReadRequestData 12 c2 ADC AL,DL 18 00 SBB BYTE PTR DS:[EAX],AL 90 NOP b8 b2 00 00 00 MOV EAX,0xb2 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 18 00 RET 0x18 mismatch in ntdll.dll::NtReadVirtualMemory 12 c2 ADC AL,DL 18 00 SBB BYTE PTR DS:[EAX],AL 90 NOP b8 b3 00 00 00 MOV EAX,0xb3 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::NtRegisterThreadTerminatePort 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 b4 00 00 00 MOV EAX,0xb4 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::NtReleaseKeyedEvent 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 b5 00 00 00 MOV EAX,0xb5 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtReleaseMutant 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 b6 00 00 00 MOV EAX,0xb6 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 18 00 RET 0x18 mismatch in ntdll.dll::NtReleaseSemaphore 12 c2 ADC AL,DL 18 00 SBB BYTE PTR DS:[EAX],AL 90 NOP b8 b7 00 00 00 MOV EAX,0xb7 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 24 00 RET 0x24 mismatch in ntdll.dll::NtRemoveIoCompletion 12 c2 ADC AL,DL 24 00 AND AL,0x0 90 NOP b8 b8 00 00 00 MOV EAX,0xb8 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 24 00 RET 0x24 mismatch in ntdll.dll::NtRemoveProcessDebug 12 c2 ADC AL,DL 24 00 AND AL,0x0 90 NOP b8 b9 00 00 00 MOV EAX,0xb9 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 18 00 RET 0x18 mismatch in ntdll.dll::NtRenameKey 12 c2 ADC AL,DL 18 00 SBB BYTE PTR DS:[EAX],AL 90 NOP b8 ba 00 00 00 MOV EAX,0xba ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::NtReplaceKey 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 bb 00 00 00 MOV EAX,0xbb ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::NtReplyPort 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 19 01 00 00 MOV EAX,0x119 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::NtReplyWaitReceivePort 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 bc 00 00 00 MOV EAX,0xbc ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtReplyWaitReceivePortEx 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 bd 00 00 00 MOV EAX,0xbd ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtReplyWaitReplyPort 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 be 00 00 00 MOV EAX,0xbe ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::NtRequestDeviceWakeup 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 bf 00 00 00 MOV EAX,0xbf ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtRequestPort 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 c0 00 00 00 MOV EAX,0xc0 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtRequestWaitReplyPort 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 c1 00 00 00 MOV EAX,0xc1 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtRequestWakeupLatency 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 c2 00 00 00 MOV EAX,0xc2 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtResetEvent 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 c3 00 00 00 MOV EAX,0xc3 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::NtResetWriteWatch 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 c4 00 00 00 MOV EAX,0xc4 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::NtRestoreKey 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 c5 00 00 00 MOV EAX,0xc5 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtResumeProcess 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 c6 00 00 00 MOV EAX,0xc6 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::NtResumeThread 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 c7 00 00 00 MOV EAX,0xc7 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtSaveKey 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 c8 00 00 00 MOV EAX,0xc8 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtSaveKeyEx 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 c9 00 00 00 MOV EAX,0xc9 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::NtSaveMergedKeys 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 ca 00 00 00 MOV EAX,0xca ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtSecureConnectPort 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 cb 00 00 00 MOV EAX,0xcb ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtSetBootEntryOrder 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 cc 00 00 00 MOV EAX,0xcc ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtSetBootOptions 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 cd 00 00 00 MOV EAX,0xcd ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::NtSetContextThread 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 ce 00 00 00 MOV EAX,0xce ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtSetDebugFilterState 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 cf 00 00 00 MOV EAX,0xcf ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtSetDefaultHardErrorPort 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 d0 00 00 00 MOV EAX,0xd0 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtSetDefaultLocale 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 d1 00 00 00 MOV EAX,0xd1 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtSetDefaultUILanguage 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 d2 00 00 00 MOV EAX,0xd2 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 24 00 RET 0x24 mismatch in ntdll.dll::NtSetEaFile 12 c2 ADC AL,DL 24 00 AND AL,0x0 90 NOP b8 d3 00 00 00 MOV EAX,0xd3 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtSetEvent 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 d4 00 00 00 MOV EAX,0xd4 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtSetEventBoostPriority 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 d5 00 00 00 MOV EAX,0xd5 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtSetHighEventPair 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 d6 00 00 00 MOV EAX,0xd6 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtSetHighWaitLowEventPair 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 d7 00 00 00 MOV EAX,0xd7 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::NtSetInformationDebugObject 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 d8 00 00 00 MOV EAX,0xd8 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtSetInformationFile 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 d9 00 00 00 MOV EAX,0xd9 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::NtSetInformationJobObject 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 da 00 00 00 MOV EAX,0xda ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::NtSetInformationKey 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 db 00 00 00 MOV EAX,0xdb ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtSetInformationObject 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 dc 00 00 00 MOV EAX,0xdc ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::NtSetInformationProcess 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 dd 00 00 00 MOV EAX,0xdd ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::NtSetInformationThread 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 de 00 00 00 MOV EAX,0xde ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::NtSetInformationToken 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 df 00 00 00 MOV EAX,0xdf ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::NtSetIntervalProfile 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 e0 00 00 00 MOV EAX,0xe0 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::NtSetIoCompletion 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 e1 00 00 00 MOV EAX,0xe1 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::NtSetLdtEntries 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 e2 00 00 00 MOV EAX,0xe2 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::NtSetLowEventPair 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 e3 00 00 00 MOV EAX,0xe3 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::NtSetLowWaitHighEventPair 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 e4 00 00 00 MOV EAX,0xe4 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::NtSetQuotaInformationFile 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 e5 00 00 00 MOV EAX,0xe5 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::NtSetSecurityObject 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 e6 00 00 00 MOV EAX,0xe6 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::NtSetSystemEnvironmentValue 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 e7 00 00 00 MOV EAX,0xe7 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtSetSystemEnvironmentValueEx 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 e8 00 00 00 MOV EAX,0xe8 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::NtSetSystemInformation 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 e9 00 00 00 MOV EAX,0xe9 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 18 00 RET 0x18 mismatch in ntdll.dll::NtSetSystemPowerState 12 c2 ADC AL,DL 18 00 SBB BYTE PTR DS:[EAX],AL 90 NOP b8 ea 00 00 00 MOV EAX,0xea ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::NtSetSystemTime 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 eb 00 00 00 MOV EAX,0xeb ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::NtSetThreadExecutionState 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 ec 00 00 00 MOV EAX,0xec ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::NtSetTimer 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 ed 00 00 00 MOV EAX,0xed ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtSetTimerResolution 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 ee 00 00 00 MOV EAX,0xee ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtSetUuidSeed 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 ef 00 00 00 MOV EAX,0xef ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::NtSetValueKey 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 f0 00 00 00 MOV EAX,0xf0 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtSetVolumeInformationFile 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 f1 00 00 00 MOV EAX,0xf1 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtShutdownSystem 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 f2 00 00 00 MOV EAX,0xf2 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtSignalAndWaitForSingleObject 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 f3 00 00 00 MOV EAX,0xf3 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtStartProfile 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 f4 00 00 00 MOV EAX,0xf4 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 1c 00 RET 0x1c mismatch in ntdll.dll::NtStopProfile 12 c2 ADC AL,DL 1c 00 SBB AL,0x0 90 NOP b8 f5 00 00 00 MOV EAX,0xf5 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::NtSuspendProcess 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 f6 00 00 00 MOV EAX,0xf6 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::NtSuspendThread 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 f7 00 00 00 MOV EAX,0xf7 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 18 00 RET 0x18 mismatch in ntdll.dll::NtSystemDebugControl 12 c2 ADC AL,DL 18 00 SBB BYTE PTR DS:[EAX],AL 90 NOP b8 f8 00 00 00 MOV EAX,0xf8 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::NtTerminateJobObject 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 f9 00 00 00 MOV EAX,0xf9 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::NtTerminateProcess 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 fa 00 00 00 MOV EAX,0xfa ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::NtTerminateThread 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 fb 00 00 00 MOV EAX,0xfb ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::NtTestAlert 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 fc 00 00 00 MOV EAX,0xfc ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::NtTraceEvent 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 fd 00 00 00 MOV EAX,0xfd ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::NtTranslateFilePath 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 fe 00 00 00 MOV EAX,0xfe ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtUnloadDriver 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 ff 00 00 00 MOV EAX,0xff ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 18 00 RET 0x18 mismatch in ntdll.dll::NtUnloadKey 12 c2 ADC AL,DL 18 00 SBB BYTE PTR DS:[EAX],AL 90 NOP b8 00 01 00 00 MOV EAX,0x100 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtUnloadKeyEx 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 01 01 00 00 MOV EAX,0x101 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtUnlockFile 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 02 01 00 00 MOV EAX,0x102 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtUnlockVirtualMemory 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 03 01 00 00 MOV EAX,0x103 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c3 RET mismatch in ntdll.dll::NtUnmapViewOfSection 12 c3 ADC AL,BL 8d 49 00 LEA ECX,DWORD PTR DS:[ECX+0x0] b8 04 01 00 00 MOV EAX,0x104 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 90 NOP mismatch in ntdll.dll::NtVdmControl 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 05 01 00 00 MOV EAX,0x105 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::NtWaitForDebugEvent 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 06 01 00 00 MOV EAX,0x106 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::NtWaitForKeyedEvent 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 07 01 00 00 MOV EAX,0x107 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::NtWaitForMultipleObjects 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 08 01 00 00 MOV EAX,0x108 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtWaitForSingleObject 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 09 01 00 00 MOV EAX,0x109 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::NtWaitHighEventPair 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 0a 01 00 00 MOV EAX,0x10a ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::NtWaitLowEventPair 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 0b 01 00 00 MOV EAX,0x10b ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtWriteFile 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 0c 01 00 00 MOV EAX,0x10c ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::NtWriteFileGather 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 0d 01 00 00 MOV EAX,0x10d ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::NtWriteRequestData 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 1a 01 00 00 MOV EAX,0x11a ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::NtWriteVirtualMemory 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 0e 01 00 00 MOV EAX,0x10e ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::NtYieldExecution 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 0f 01 00 00 MOV EAX,0x10f ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::PfxFindPrefix 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 10 01 00 00 MOV EAX,0x110 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::PfxInitialize 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 11 01 00 00 MOV EAX,0x111 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::PfxInsertPrefix 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 12 01 00 00 MOV EAX,0x112 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 24 00 RET 0x24 mismatch in ntdll.dll::PfxRemovePrefix 12 c2 ADC AL,DL 24 00 AND AL,0x0 90 NOP b8 13 01 00 00 MOV EAX,0x113 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 24 00 RET 0x24 mismatch in ntdll.dll::PropertyLengthAsVariant 12 c2 ADC AL,DL 24 00 AND AL,0x0 90 NOP b8 14 01 00 00 MOV EAX,0x114 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 18 00 RET 0x18 mismatch in ntdll.dll::RtlAbortRXact 12 c2 ADC AL,DL 18 00 SBB BYTE PTR DS:[EAX],AL 90 NOP b8 15 01 00 00 MOV EAX,0x115 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::RtlAbsoluteToSelfRelativeSD 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 16 01 00 00 MOV EAX,0x116 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c3 RET match in ntdll.dll::RtlAcquirePebLock match in ntdll.dll::RtlAcquireResourceExclusive match in ntdll.dll::RtlAcquireResourceShared match in ntdll.dll::RtlActivateActivationContext match in ntdll.dll::RtlActivateActivationContextEx match in ntdll.dll::RtlActivateActivationContextUnsafeFast mismatch in ntdll.dll::RtlAddAccessAllowedAce 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 40 04 94 7c PUSH 0x7c940440 match in ntdll.dll::RtlAddAccessAllowedAceEx match in ntdll.dll::RtlAddAccessAllowedObjectAce match in ntdll.dll::RtlAddAccessDeniedAce match in ntdll.dll::RtlAddAccessDeniedAceEx match in ntdll.dll::RtlAddAccessDeniedObjectAce match in ntdll.dll::RtlAddAce match in ntdll.dll::RtlAddActionToRXact match in ntdll.dll::RtlAddAtomToAtomTable match in ntdll.dll::RtlAddAttributeActionToRXact match in ntdll.dll::RtlAddAuditAccessAce match in ntdll.dll::RtlAddAuditAccessAceEx match in ntdll.dll::RtlAddAuditAccessObjectAce match in ntdll.dll::RtlAddCompoundAce mismatch in ntdll.dll::RtlAddRange 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 20 PUSH 0x20 68 58 bd 95 7c PUSH 0x7c95bd58 match in ntdll.dll::RtlAddRefActivationContext match in ntdll.dll::RtlAddRefMemoryStream match in ntdll.dll::RtlAddVectoredExceptionHandler match in ntdll.dll::RtlAddressInSectionTable match in ntdll.dll::RtlAdjustPrivilege match in ntdll.dll::RtlAllocateAndInitializeSid match in ntdll.dll::RtlAllocateHandle match in ntdll.dll::RtlAllocateHeap match in ntdll.dll::RtlAnsiCharToUnicodeChar match in ntdll.dll::RtlAnsiStringToUnicodeSize match in ntdll.dll::RtlAnsiStringToUnicodeString match in ntdll.dll::RtlAppendAsciizToString mismatch in ntdll.dll::RtlAppendPathElement 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 20 PUSH 0x20 68 e0 ae 94 7c PUSH 0x7c94aee0 mismatch in ntdll.dll::RtlAppendStringToString 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 04 02 00 00 PUSH 0x204 68 e0 01 94 7c PUSH 0x7c9401e0 match in ntdll.dll::RtlAppendUnicodeStringToString match in ntdll.dll::RtlAppendUnicodeToString match in ntdll.dll::RtlApplicationVerifierStop match in ntdll.dll::RtlApplyRXact match in ntdll.dll::RtlApplyRXactNoFlush match in ntdll.dll::RtlAreAllAccessesGranted match in ntdll.dll::RtlAreAnyAccessesGranted match in ntdll.dll::RtlAreBitsClear match in ntdll.dll::RtlAreBitsSet match in ntdll.dll::RtlAssert match in ntdll.dll::RtlAssert2 match in ntdll.dll::RtlCancelTimer match in ntdll.dll::RtlCaptureContext match in ntdll.dll::RtlCaptureStackBackTrace match in ntdll.dll::RtlCaptureStackContext match in ntdll.dll::RtlCharToInteger match in ntdll.dll::RtlCheckForOrphanedCriticalSections match in ntdll.dll::RtlCheckProcessParameters mismatch in ntdll.dll::RtlCheckRegistryKey 00 00 c2 04 00 RET 0x4 53 PUSH EBX 8b 5c 24 08 MOV EBX,DWORD PTR SS:[ESP+0x8] 89 83 b0 00 00 00 MOV DWORD PTR DS:[EBX+0xb0],EAX 89 8b ac 00 00 00 MOV DWORD PTR DS:[EBX+0xac],ECX match in ntdll.dll::RtlClearAllBits match in ntdll.dll::RtlClearBits mismatch in ntdll.dll::RtlCloneMemoryStream 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 0c PUSH 0xc 68 30 b6 95 7c PUSH 0x7c95b630 mismatch in ntdll.dll::RtlCommitMemoryStream 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 6c PUSH 0x6c 68 b0 8d 94 7c PUSH 0x7c948db0 match in ntdll.dll::RtlCompactHeap match in ntdll.dll::RtlCompareMemory match in ntdll.dll::RtlCompareMemoryUlong match in ntdll.dll::RtlCompareString mismatch in ntdll.dll::RtlCompareUnicodeString 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 01 40 00 80 MOV EAX,0x80004001 c2 08 00 RET 0x8 mismatch in ntdll.dll::RtlCompressBuffer 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 01 40 00 80 MOV EAX,0x80004001 c2 08 00 RET 0x8 mismatch in ntdll.dll::RtlComputeCrc32 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 28 PUSH 0x28 68 88 62 96 7c PUSH 0x7c966288 mismatch in ntdll.dll::RtlComputeImportTableHash 8b c2 MOV EAX,EDX 8b d1 MOV EDX,ECX c3 RET 56 PUSH ESI 57 PUSH EDI fc CLD 8b 74 24 0c MOV ESI,DWORD PTR SS:[ESP+0xc] mismatch in ntdll.dll::RtlComputePrivatizedDllName_U 00 00 00 8b ff MOV EDI,EDI 57 PUSH EDI 8b 7c 24 08 MOV EDI,DWORD PTR SS:[ESP+0x8] 8b 4c 24 0c MOV ECX,DWORD PTR SS:[ESP+0xc] match in ntdll.dll::RtlConsoleMultiByteToUnicodeN match in ntdll.dll::RtlConvertExclusiveToShared match in ntdll.dll::RtlConvertLongToLargeInteger match in ntdll.dll::RtlConvertPropertyToVariant match in ntdll.dll::RtlConvertSharedToExclusive match in ntdll.dll::RtlConvertSidToUnicodeString match in ntdll.dll::RtlConvertToAutoInheritSecurityObject match in ntdll.dll::RtlConvertUiListToApiList mismatch in ntdll.dll::RtlConvertUlongToLargeInteger 10 c2 ADC DL,AL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP 8b 44 24 04 MOV EAX,DWORD PTR SS:[ESP+0x4] 99 CDQ c2 04 00 RET 0x4 8b 44 24 04 MOV EAX,DWORD PTR SS:[ESP+0x4] match in ntdll.dll::RtlConvertVariantToProperty match in ntdll.dll::RtlCopyLuid match in ntdll.dll::RtlCopyLuidAndAttributesArray mismatch in ntdll.dll::RtlCopyMemoryStreamTo 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 58 PUSH 0x58 68 c8 41 98 7c PUSH 0x7c9841c8 mismatch in ntdll.dll::RtlCopyOutOfProcessMemoryStreamTo 04 99 ADD AL,0x99 c2 04 00 RET 0x4 8b 44 24 04 MOV EAX,DWORD PTR SS:[ESP+0x4] 33 d2 XOR EDX,EDX c2 04 00 RET 0x4 ba bc 32 93 7c MOV EDX,0x7c9332bc eb 08 JMP SHORT $+0x8 match in ntdll.dll::RtlCopyRangeList match in ntdll.dll::RtlCopySecurityDescriptor match in ntdll.dll::RtlCopySid mismatch in ntdll.dll::RtlCopySidAndAttributesArray 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 01 40 00 80 MOV EAX,0x80004001 c2 18 00 RET 0x18 match in ntdll.dll::RtlCopyString match in ntdll.dll::RtlCopyUnicodeString match in ntdll.dll::RtlCreateAcl match in ntdll.dll::RtlCreateActivationContext match in ntdll.dll::RtlCreateAndSetSD match in ntdll.dll::RtlCreateAtomTable match in ntdll.dll::RtlCreateBootStatusDataFile match in ntdll.dll::RtlCreateEnvironment match in ntdll.dll::RtlCreateHeap match in ntdll.dll::RtlCreateProcessParameters match in ntdll.dll::RtlCreateQueryDebugBuffer mismatch in ntdll.dll::RtlCreateRegistryKey 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 2c PUSH 0x2c 68 78 d1 95 7c PUSH 0x7c95d178 mismatch in ntdll.dll::RtlCreateSecurityDescriptor 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 a4 00 00 00 PUSH 0xa4 68 f8 50 95 7c PUSH 0x7c9550f8 mismatch in ntdll.dll::RtlCreateServiceSid 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 2c PUSH 0x2c 68 78 2f 95 7c PUSH 0x7c952f78 match in ntdll.dll::RtlCreateSystemVolumeInformationFolder match in ntdll.dll::RtlCreateTagHeap match in ntdll.dll::RtlCreateTimer match in ntdll.dll::RtlCreateTimerQueue match in ntdll.dll::RtlCreateUnicodeString mismatch in ntdll.dll::RtlCreateUnicodeStringFromAsciiz 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 34 PUSH 0x34 68 e0 1f 95 7c PUSH 0x7c951fe0 match in ntdll.dll::RtlCreateUserProcess match in ntdll.dll::RtlCreateUserSecurityObject match in ntdll.dll::RtlCreateUserThread match in ntdll.dll::RtlCustomCPToUnicodeN mismatch in ntdll.dll::RtlCutoverTimeToSystemTime 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 60 PUSH 0x60 68 d0 0d 96 7c PUSH 0x7c960dd0 match in ntdll.dll::RtlDeNormalizeProcessParams mismatch in ntdll.dll::RtlDeactivateActivationContext 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 24 03 00 00 PUSH 0x324 68 48 e7 95 7c PUSH 0x7c95e748 match in ntdll.dll::RtlDeactivateActivationContextUnsafeFast match in ntdll.dll::RtlDebugPrintTimes match in ntdll.dll::RtlDecodePointer match in ntdll.dll::RtlDecodeSystemPointer match in ntdll.dll::RtlDecompressBuffer mismatch in ntdll.dll::RtlDecompressFragment 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 8b c0 MOV EAX,EAX c3 RET match in ntdll.dll::RtlDefaultNpAcl match in ntdll.dll::RtlDelete match in ntdll.dll::RtlDeleteAce match in ntdll.dll::RtlDeleteAtomFromAtomTable match in ntdll.dll::RtlDeleteCriticalSection match in ntdll.dll::RtlDeleteElementGenericTable match in ntdll.dll::RtlDeleteElementGenericTableAvl mismatch in ntdll.dll::RtlDeleteNoSplay 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 e0 99 95 7c PUSH 0x7c9599e0 mismatch in ntdll.dll::RtlDeleteOwnersRanges 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 1c PUSH 0x1c 68 f8 13 94 7c PUSH 0x7c9413f8 match in ntdll.dll::RtlDeleteRange match in ntdll.dll::RtlDeleteRegistryValue match in ntdll.dll::RtlDeleteResource match in ntdll.dll::RtlDeleteSecurityObject match in ntdll.dll::RtlDeleteTimer match in ntdll.dll::RtlDeleteTimerQueue match in ntdll.dll::RtlDeleteTimerQueueEx match in ntdll.dll::RtlDeregisterWait match in ntdll.dll::RtlDeregisterWaitEx match in ntdll.dll::RtlDestroyAtomTable match in ntdll.dll::RtlDestroyEnvironment match in ntdll.dll::RtlDestroyHandleTable match in ntdll.dll::RtlDestroyHeap mismatch in ntdll.dll::RtlDestroyProcessParameters 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 20 PUSH 0x20 68 40 ca 98 7c PUSH 0x7c98ca40 match in ntdll.dll::RtlDestroyQueryDebugBuffer match in ntdll.dll::RtlDetermineDosPathNameType_U match in ntdll.dll::RtlDllShutdownInProgress match in ntdll.dll::RtlDnsHostNameToComputerName match in ntdll.dll::RtlDoesFileExists_U match in ntdll.dll::RtlDosApplyFileIsolationRedirection_Ustr mismatch in ntdll.dll::RtlDosPathNameToNtPathName_U 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 80 3d c4 e0 9a 7c 00 CMP BYTE PTR DS:[0x7c9ae0c4],0x0 0f 95 c0 SETNE AL match in ntdll.dll::RtlDosSearchPath_U match in ntdll.dll::RtlDosSearchPath_Ustr match in ntdll.dll::RtlDowncaseUnicodeChar match in ntdll.dll::RtlDowncaseUnicodeString match in ntdll.dll::RtlDumpResource match in ntdll.dll::RtlDuplicateUnicodeString match in ntdll.dll::RtlEmptyAtomTable match in ntdll.dll::RtlEnableEarlyCriticalSectionEventCreation match in ntdll.dll::RtlEncodePointer match in ntdll.dll::RtlEncodeSystemPointer mismatch in ntdll.dll::RtlEnlargedIntegerMultiply 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 20 PUSH 0x20 68 08 cb 98 7c PUSH 0x7c98cb08 mismatch in ntdll.dll::RtlEnlargedUnsignedDivide 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 64 a1 18 00 00 00 MOV EAX,DWORD PTR FS:[0x18] 8b 40 30 MOV EAX,DWORD PTR DS:[EAX+0x30] match in ntdll.dll::RtlEnlargedUnsignedMultiply match in ntdll.dll::RtlEnterCriticalSection mismatch in ntdll.dll::RtlEnumProcessHeaps 10 c2 ADC DL,AL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP 8b 44 24 04 MOV EAX,DWORD PTR SS:[ESP+0x4] f7 6c 24 08 IMUL DWORD PTR SS:[ESP+0x8] c2 08 00 RET 0x8 90 NOP mismatch in ntdll.dll::RtlEnumerateGenericTable 08 c2 OR DL,AL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP 8b 44 24 04 MOV EAX,DWORD PTR SS:[ESP+0x4] 8b 54 24 08 MOV EDX,DWORD PTR SS:[ESP+0x8] 8b 4c 24 10 MOV ECX,DWORD PTR SS:[ESP+0x10] f7 74 24 0c DIV DWORD PTR SS:[ESP+0xc] mismatch in ntdll.dll::RtlEnumerateGenericTableAvl 08 c2 OR DL,AL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP 8b 44 24 04 MOV EAX,DWORD PTR SS:[ESP+0x4] f7 64 24 08 MUL DWORD PTR SS:[ESP+0x8] c2 08 00 RET 0x8 90 NOP mismatch in ntdll.dll::RtlEnumerateGenericTableLikeADirectory 00 00 00 00 00 64 8b 0d 18 00 00 00 MOV ECX,DWORD PTR FS:[0x18] 8b 54 24 04 MOV EDX,DWORD PTR SS:[ESP+0x4] mismatch in ntdll.dll::RtlEnumerateGenericTableWithoutSplaying 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 a8 18 99 7c PUSH 0x7c9918a8 match in ntdll.dll::RtlEnumerateGenericTableWithoutSplayingAvl match in ntdll.dll::RtlEqualComputerName match in ntdll.dll::RtlEqualDomainName match in ntdll.dll::RtlEqualLuid match in ntdll.dll::RtlEqualPrefixSid match in ntdll.dll::RtlEqualSid match in ntdll.dll::RtlEqualString match in ntdll.dll::RtlEqualUnicodeString match in ntdll.dll::RtlEraseUnicodeString match in ntdll.dll::RtlExitUserThread match in ntdll.dll::RtlExpandEnvironmentStrings_U match in ntdll.dll::RtlExtendHeap match in ntdll.dll::RtlExtendedIntegerMultiply match in ntdll.dll::RtlExtendedLargeIntegerDivide match in ntdll.dll::RtlExtendedMagicDivide mismatch in ntdll.dll::RtlFillMemory 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 4c PUSH 0x4c 68 68 17 99 7c PUSH 0x7c991768 mismatch in ntdll.dll::RtlFillMemoryUlong c2 14 00 RET 0x14 8b ff MOV EDI,EDI 55 PUSH EBP 8b ec MOV EBP,ESP 56 PUSH ESI 8b 75 10 MOV ESI,DWORD PTR DS:[EBP+0x10] 33 75 0c XOR ESI,DWORD PTR DS:[EBP+0xc] mismatch in ntdll.dll::RtlFinalReleaseOutOfProcessMemoryStream 10 00 ADC BYTE PTR DS:[EAX],AL 8d 49 00 LEA ECX,DWORD PTR DS:[ECX+0x0] 56 PUSH ESI 57 PUSH EDI 53 PUSH EBX 8b 44 24 10 MOV EAX,DWORD PTR SS:[ESP+0x10] 8b 54 24 14 MOV EDX,DWORD PTR SS:[ESP+0x14] mismatch in ntdll.dll::RtlFindActivationContextSectionGuid c2 10 00 RET 0x10 8b ff MOV EDI,EDI 55 PUSH EBP 8b ec MOV EBP,ESP 83 ec 0c SUB ESP,0xc 56 PUSH ESI 8b 75 0c MOV ESI,DWORD PTR DS:[EBP+0xc] mismatch in ntdll.dll::RtlFindActivationContextSectionString 00 00 00 00 90 NOP 57 PUSH EDI 8b 7c 24 08 MOV EDI,DWORD PTR SS:[ESP+0x8] mismatch in ntdll.dll::RtlFindCharInUnicodeString 00 00 00 8b ff MOV EDI,EDI 57 PUSH EDI 8b 7c 24 08 MOV EDI,DWORD PTR SS:[ESP+0x8] 8b 4c 24 0c MOV ECX,DWORD PTR SS:[ESP+0xc] match in ntdll.dll::RtlFindClearBits match in ntdll.dll::RtlFindClearBitsAndSet match in ntdll.dll::RtlFindClearRuns match in ntdll.dll::RtlFindLastBackwardRunClear match in ntdll.dll::RtlFindLeastSignificantBit match in ntdll.dll::RtlFindLongestRunClear match in ntdll.dll::RtlFindMessage match in ntdll.dll::RtlFindMostSignificantBit match in ntdll.dll::RtlFindNextForwardRunClear match in ntdll.dll::RtlFindRange match in ntdll.dll::RtlFindSetBits match in ntdll.dll::RtlFindSetBitsAndClear match in ntdll.dll::RtlFirstEntrySList match in ntdll.dll::RtlFirstFreeAce match in ntdll.dll::RtlFlushSecureMemoryCache match in ntdll.dll::RtlFormatCurrentUserKeyPath mismatch in ntdll.dll::RtlFormatMessage 5d POP EBP 5b POP EBX c2 08 00 RET 0x8 8b 44 24 04 MOV EAX,DWORD PTR SS:[ESP+0x4] 8b 00 MOV EAX,DWORD PTR DS:[EAX] c2 04 00 RET 0x4 8d 49 00 LEA ECX,DWORD PTR DS:[ECX+0x0] match in ntdll.dll::RtlFreeAnsiString match in ntdll.dll::RtlFreeHandle match in ntdll.dll::RtlFreeHeap match in ntdll.dll::RtlFreeOemString match in ntdll.dll::RtlFreeRangeList match in ntdll.dll::RtlFreeSid mismatch in ntdll.dll::RtlFreeThreadActivationContextStack 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 a0 00 00 00 PUSH 0xa0 68 60 00 94 7c PUSH 0x7c940060 match in ntdll.dll::RtlFreeUnicodeString match in ntdll.dll::RtlFreeUserThreadStack match in ntdll.dll::RtlGUIDFromString match in ntdll.dll::RtlGenerate8dot3Name match in ntdll.dll::RtlGetAce match in ntdll.dll::RtlGetActiveActivationContext match in ntdll.dll::RtlGetCallersAddress match in ntdll.dll::RtlGetCompressionWorkSpaceSize match in ntdll.dll::RtlGetControlSecurityDescriptor match in ntdll.dll::RtlGetCurrentDirectory_U match in ntdll.dll::RtlGetCurrentPeb match in ntdll.dll::RtlGetDaclSecurityDescriptor match in ntdll.dll::RtlGetElementGenericTable mismatch in ntdll.dll::RtlGetElementGenericTableAvl 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 0c PUSH 0xc 68 80 3e 94 7c PUSH 0x7c943e80 mismatch in ntdll.dll::RtlGetFirstRange 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 64 a1 18 00 00 00 MOV EAX,DWORD PTR FS:[0x18] 8b 40 30 MOV EAX,DWORD PTR DS:[EAX+0x30] match in ntdll.dll::RtlGetFrame match in ntdll.dll::RtlGetFullPathName_U match in ntdll.dll::RtlGetGroupSecurityDescriptor match in ntdll.dll::RtlGetLastNtStatus mismatch in ntdll.dll::RtlGetLastWin32Error 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 64 a1 18 00 00 00 MOV EAX,DWORD PTR FS:[0x18] 8b 80 b0 0f 00 00 MOV EAX,DWORD PTR DS:[EAX+0xfb0] match in ntdll.dll::RtlGetLengthWithoutLastFullDosOrNtPathElement match in ntdll.dll::RtlGetLengthWithoutTrailingPathSeperators mismatch in ntdll.dll::RtlGetLongestNtPathLength 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 64 a1 18 00 00 00 MOV EAX,DWORD PTR FS:[0x18] 8b 80 f4 0b 00 00 MOV EAX,DWORD PTR DS:[EAX+0xbf4] mismatch in ntdll.dll::RtlGetNativeSystemInformation 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 64 a1 18 00 00 00 MOV EAX,DWORD PTR FS:[0x18] 8b 40 34 MOV EAX,DWORD PTR DS:[EAX+0x34] match in ntdll.dll::RtlGetNextRange match in ntdll.dll::RtlGetNtGlobalFlags mismatch in ntdll.dll::RtlGetNtProductType 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 15 01 00 00 MOV EAX,0x115 c3 RET mismatch in ntdll.dll::RtlGetNtVersionNumbers 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 ad 00 00 00 MOV EAX,0xad ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 match in ntdll.dll::RtlGetOwnerSecurityDescriptor mismatch in ntdll.dll::RtlGetProcessHeaps 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 64 a1 18 00 00 00 MOV EAX,DWORD PTR FS:[0x18] 8b 40 30 MOV EAX,DWORD PTR DS:[EAX+0x30] match in ntdll.dll::RtlGetSaclSecurityDescriptor match in ntdll.dll::RtlGetSecurityDescriptorRMControl match in ntdll.dll::RtlGetSetBootStatusData mismatch in ntdll.dll::RtlGetUnloadEventTrace 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 20 18 99 7c PUSH 0x7c991820 match in ntdll.dll::RtlGetUserInfoHeap match in ntdll.dll::RtlGetVersion match in ntdll.dll::RtlHashUnicodeString mismatch in ntdll.dll::RtlIdentifierAuthoritySid 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 00 fa 9a 7c MOV EAX,0x7c9afa00 c3 RET mismatch in ntdll.dll::RtlImageDirectoryEntryToData 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 2c PUSH 0x2c 68 48 90 94 7c PUSH 0x7c949048 match in ntdll.dll::RtlImageNtHeader match in ntdll.dll::RtlImageRvaToSection match in ntdll.dll::RtlImageRvaToVa match in ntdll.dll::RtlImpersonateSelf match in ntdll.dll::RtlInitAnsiString match in ntdll.dll::RtlInitCodePageTable match in ntdll.dll::RtlInitMemoryStream match in ntdll.dll::RtlInitNlsTables mismatch in ntdll.dll::RtlInitOutOfProcessMemoryStream 0a 5f c2 OR BL,BYTE PTR DS:[EDI+0xc2] 08 00 OR BYTE PTR DS:[EAX],AL 57 PUSH EDI 8b 7c 24 0c MOV EDI,DWORD PTR SS:[ESP+0xc] 8b 54 24 08 MOV EDX,DWORD PTR SS:[ESP+0x8] c7 02 00 00 00 00 MOV DWORD PTR DS:[EDX],0x0 89 7a 04 MOV DWORD PTR DS:[EDX+0x4],EDI match in ntdll.dll::RtlInitString match in ntdll.dll::RtlInitUnicodeString match in ntdll.dll::RtlInitUnicodeStringEx match in ntdll.dll::RtlInitializeAtomPackage mismatch in ntdll.dll::RtlInitializeBitMap 18 00 SBB BYTE PTR DS:[EAX],AL 00 00 c3 RET 57 PUSH EDI 8b 7c 24 0c MOV EDI,DWORD PTR SS:[ESP+0xc] 8b 54 24 08 MOV EDX,DWORD PTR SS:[ESP+0x8] mismatch in ntdll.dll::RtlInitializeContext 0a 5f c2 OR BL,BYTE PTR DS:[EDI+0xc2] 08 00 OR BYTE PTR DS:[EAX],AL 57 PUSH EDI 8b 7c 24 0c MOV EDI,DWORD PTR SS:[ESP+0xc] 8b 54 24 08 MOV EDX,DWORD PTR SS:[ESP+0x8] c7 02 00 00 00 00 MOV DWORD PTR DS:[EDX],0x0 89 7a 04 MOV DWORD PTR DS:[EDX+0x4],EDI match in ntdll.dll::RtlInitializeCriticalSection match in ntdll.dll::RtlInitializeCriticalSectionAndSpinCount match in ntdll.dll::RtlInitializeGenericTable match in ntdll.dll::RtlInitializeGenericTableAvl match in ntdll.dll::RtlInitializeHandleTable match in ntdll.dll::RtlInitializeRXact match in ntdll.dll::RtlInitializeRangeList match in ntdll.dll::RtlInitializeResource match in ntdll.dll::RtlInitializeSListHead match in ntdll.dll::RtlInitializeSid match in ntdll.dll::RtlInitializeStackTraceDataBase match in ntdll.dll::RtlInsertElementGenericTable match in ntdll.dll::RtlInsertElementGenericTableAvl match in ntdll.dll::RtlInt64ToUnicodeString match in ntdll.dll::RtlIntegerToChar match in ntdll.dll::RtlIntegerToUnicodeString match in ntdll.dll::RtlInterlockedFlushSList match in ntdll.dll::RtlInterlockedPopEntrySList mismatch in ntdll.dll::RtlInterlockedPushEntrySList 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 3c PUSH 0x3c 68 a0 86 94 7c PUSH 0x7c9486a0 match in ntdll.dll::RtlInterlockedPushListSList match in ntdll.dll::RtlInvertRangeList mismatch in ntdll.dll::RtlIpv4AddressToStringA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 0c PUSH 0xc 68 d0 b6 95 7c PUSH 0x7c95b6d0 match in ntdll.dll::RtlIpv4AddressToStringExA match in ntdll.dll::RtlIpv4AddressToStringExW match in ntdll.dll::RtlIpv4AddressToStringW match in ntdll.dll::RtlIpv4StringToAddressA match in ntdll.dll::RtlIpv4StringToAddressExA match in ntdll.dll::RtlIpv4StringToAddressExW match in ntdll.dll::RtlIpv4StringToAddressW match in ntdll.dll::RtlIpv6AddressToStringA match in ntdll.dll::RtlIpv6AddressToStringExA match in ntdll.dll::RtlIpv6AddressToStringExW match in ntdll.dll::RtlIpv6AddressToStringW match in ntdll.dll::RtlIpv6StringToAddressA match in ntdll.dll::RtlIpv6StringToAddressExA match in ntdll.dll::RtlIpv6StringToAddressExW match in ntdll.dll::RtlIpv6StringToAddressW match in ntdll.dll::RtlIsActivationContextActive match in ntdll.dll::RtlIsDosDeviceName_U match in ntdll.dll::RtlIsGenericTableEmpty match in ntdll.dll::RtlIsGenericTableEmptyAvl match in ntdll.dll::RtlIsNameLegalDOS8Dot3 match in ntdll.dll::RtlIsRangeAvailable match in ntdll.dll::RtlIsTextUnicode match in ntdll.dll::RtlIsThreadWithinLoaderCallout match in ntdll.dll::RtlIsValidHandle match in ntdll.dll::RtlIsValidIndexHandle mismatch in ntdll.dll::RtlLargeIntegerAdd 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 64 a1 18 00 00 00 MOV EAX,DWORD PTR FS:[0x18] 39 05 18 f3 9a 7c CMP DWORD PTR DS:[0x7c9af318],EAX match in ntdll.dll::RtlLargeIntegerArithmeticShift match in ntdll.dll::RtlLargeIntegerDivide mismatch in ntdll.dll::RtlLargeIntegerNegate 5e POP ESI 5d POP EBP c2 0c 00 RET 0xc 8b 44 24 04 MOV EAX,DWORD PTR SS:[ESP+0x4] 03 44 24 0c ADD EAX,DWORD PTR SS:[ESP+0xc] 8b 54 24 08 MOV EDX,DWORD PTR SS:[ESP+0x8] 13 54 24 10 ADC EDX,DWORD PTR SS:[ESP+0x10] mismatch in ntdll.dll::RtlLargeIntegerShiftLeft e8 c2 0c 00 90 CALL $+0x90000cc2 8b 4c 24 0c MOV ECX,DWORD PTR SS:[ESP+0xc] 83 e1 3f AND ECX,0x3f 83 f9 20 CMP ECX,0x20 72 10 JB $+0x10 8b 44 24 08 MOV EAX,DWORD PTR SS:[ESP+0x8] d3 f8 SAR EAX,CL match in ntdll.dll::RtlLargeIntegerShiftRight mismatch in ntdll.dll::RtlLargeIntegerSubtract d3 fa SAR EDX,CL c2 0c 00 RET 0xc 8b 44 24 04 MOV EAX,DWORD PTR SS:[ESP+0x4] 8b 54 24 08 MOV EDX,DWORD PTR SS:[ESP+0x8] f7 da NEG EDX f7 d8 NEG EAX 83 da 00 SBB EDX,0x0 mismatch in ntdll.dll::RtlLargeIntegerToChar c2 0c 00 RET 0xc 8b ff MOV EDI,EDI 8b 4c 24 0c MOV ECX,DWORD PTR SS:[ESP+0xc] 83 e1 3f AND ECX,0x3f 83 f9 20 CMP ECX,0x20 73 10 JNB $+0x10 8b 44 24 04 MOV EAX,DWORD PTR SS:[ESP+0x4] mismatch in ntdll.dll::RtlLeaveCriticalSection e2 c2 LOOP $+0xffffffc2 0c 00 OR AL,0x0 90 NOP 8b 4c 24 0c MOV ECX,DWORD PTR SS:[ESP+0xc] 83 e1 3f AND ECX,0x3f 83 f9 20 CMP ECX,0x20 73 10 JNB $+0x10 mismatch in ntdll.dll::RtlLengthRequiredSid c2 08 00 RET 0x8 8b ff MOV EDI,EDI 8b 44 24 04 MOV EAX,DWORD PTR SS:[ESP+0x4] 2b 44 24 0c SUB EAX,DWORD PTR SS:[ESP+0xc] 8b 54 24 08 MOV EDX,DWORD PTR SS:[ESP+0x8] 1b 54 24 10 SBB EDX,DWORD PTR SS:[ESP+0x10] c2 10 00 RET 0x10 mismatch in ntdll.dll::RtlLengthSecurityDescriptor 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 90 00 00 00 PUSH 0x90 68 18 0c 99 7c PUSH 0x7c990c18 mismatch in ntdll.dll::RtlLengthSid 24 00 AND AL,0x0 00 00 00 8b 54 24 04 MOV EDX,DWORD PTR SS:[ESP+0x4] 33 c0 XOR EAX,EAX ff 4a 08 DEC DWORD PTR DS:[EDX+0x8] match in ntdll.dll::RtlLocalTimeToSystemTime match in ntdll.dll::RtlLockBootStatusData match in ntdll.dll::RtlLockHeap match in ntdll.dll::RtlLockMemoryStreamRegion match in ntdll.dll::RtlLogStackBackTrace match in ntdll.dll::RtlLookupAtomInAtomTable mismatch in ntdll.dll::RtlLookupElementGenericTable 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 01 40 00 80 MOV EAX,0x80004001 c2 18 00 RET 0x18 mismatch in ntdll.dll::RtlLookupElementGenericTableAvl 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 a8 00 00 00 PUSH 0xa8 68 00 16 94 7c PUSH 0x7c941600 mismatch in ntdll.dll::RtlMakeSelfRelativeSD 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 20 7c 95 7c PUSH 0x7c957c20 match in ntdll.dll::RtlMapGenericMask match in ntdll.dll::RtlMapSecurityErrorToNtStatus match in ntdll.dll::RtlMergeRangeLists match in ntdll.dll::RtlMoveMemory match in ntdll.dll::RtlMultiAppendUnicodeStringBuffer match in ntdll.dll::RtlMultiByteToUnicodeN mismatch in ntdll.dll::RtlMultiByteToUnicodeSize 05 00 00 00 00 ADD EAX,0x0 56 PUSH ESI 57 PUSH EDI 8b 74 24 10 MOV ESI,DWORD PTR SS:[ESP+0x10] 8b 7c 24 0c MOV EDI,DWORD PTR SS:[ESP+0xc] 8b 4c 24 14 MOV ECX,DWORD PTR SS:[ESP+0x14] fc CLD match in ntdll.dll::RtlNewInstanceSecurityObject match in ntdll.dll::RtlNewSecurityGrantedAccess match in ntdll.dll::RtlNewSecurityObject match in ntdll.dll::RtlNewSecurityObjectEx match in ntdll.dll::RtlNewSecurityObjectWithMultipleInheritance match in ntdll.dll::RtlNormalizeProcessParams match in ntdll.dll::RtlNtPathNameToDosPathName match in ntdll.dll::RtlNtStatusToDosError match in ntdll.dll::RtlNtStatusToDosErrorNoTeb match in ntdll.dll::RtlNumberGenericTableElements mismatch in ntdll.dll::RtlNumberGenericTableElementsAvl 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 08 PUSH 0x8 68 68 f6 93 7c PUSH 0x7c93f668 match in ntdll.dll::RtlNumberOfClearBits match in ntdll.dll::RtlNumberOfSetBits match in ntdll.dll::RtlOemStringToUnicodeSize match in ntdll.dll::RtlOemStringToUnicodeString match in ntdll.dll::RtlOemToUnicodeN match in ntdll.dll::RtlOpenCurrentUser match in ntdll.dll::RtlPcToFileHeader match in ntdll.dll::RtlPinAtomInAtomTable match in ntdll.dll::RtlPopFrame mismatch in ntdll.dll::RtlPrefixString 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 4c PUSH 0x4c 68 78 b9 95 7c PUSH 0x7c95b978 mismatch in ntdll.dll::RtlPrefixUnicodeString 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 c0 cb 98 7c PUSH 0x7c98cbc0 match in ntdll.dll::RtlProtectHeap match in ntdll.dll::RtlPushFrame match in ntdll.dll::RtlQueryAtomInAtomTable match in ntdll.dll::RtlQueryDepthSList match in ntdll.dll::RtlQueryEnvironmentVariable_U mismatch in ntdll.dll::RtlQueryHeapInformation 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 44 PUSH 0x44 68 d8 bf 95 7c PUSH 0x7c95bfd8 match in ntdll.dll::RtlQueryInformationAcl mismatch in ntdll.dll::RtlQueryInformationActivationContext 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 34 PUSH 0x34 68 78 3f 94 7c PUSH 0x7c943f78 match in ntdll.dll::RtlQueryInformationActiveActivationContext match in ntdll.dll::RtlQueryInterfaceMemoryStream mismatch in ntdll.dll::RtlQueryProcessBackTraceInformation 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 30 PUSH 0x30 68 e0 fd 93 7c PUSH 0x7c93fde0 match in ntdll.dll::RtlQueryProcessDebugInformation match in ntdll.dll::RtlQueryProcessHeapInformation mismatch in ntdll.dll::RtlQueryProcessLockInformation 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 24 PUSH 0x24 68 48 48 98 7c PUSH 0x7c984848 match in ntdll.dll::RtlQueryRegistryValues mismatch in ntdll.dll::RtlQuerySecurityObject 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 58 PUSH 0x58 68 98 4d 98 7c PUSH 0x7c984d98 mismatch in ntdll.dll::RtlQueryTagHeap 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 28 PUSH 0x28 68 40 4f 98 7c PUSH 0x7c984f40 match in ntdll.dll::RtlQueryTimeZoneInformation match in ntdll.dll::RtlQueueApcWow64Thread mismatch in ntdll.dll::RtlQueueWorkItem 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 58 15 99 7c PUSH 0x7c991558 match in ntdll.dll::RtlRaiseException match in ntdll.dll::RtlRaiseStatus match in ntdll.dll::RtlRandom mismatch in ntdll.dll::RtlRandomEx 08 cd OR CH,CL 2e c3 RET 90 NOP 55 PUSH EBP 8b ec MOV EBP,ESP 9c PUSHFD 81 ec d0 02 00 00 SUB ESP,0x2d0 match in ntdll.dll::RtlReAllocateHeap match in ntdll.dll::RtlReadMemoryStream match in ntdll.dll::RtlReadOutOfProcessMemoryStream mismatch in ntdll.dll::RtlRealPredecessor 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 b4 01 00 00 PUSH 0x1b4 68 f8 76 94 7c PUSH 0x7c9476f8 match in ntdll.dll::RtlRealSuccessor match in ntdll.dll::RtlRegisterSecureMemoryCacheCallback match in ntdll.dll::RtlRegisterWait match in ntdll.dll::RtlReleaseActivationContext match in ntdll.dll::RtlReleaseMemoryStream match in ntdll.dll::RtlReleasePebLock match in ntdll.dll::RtlReleaseResource match in ntdll.dll::RtlRemoteCall mismatch in ntdll.dll::RtlRemoveVectoredExceptionHandler 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 64 a1 18 00 00 00 MOV EAX,DWORD PTR FS:[0x18] 8b 40 30 MOV EAX,DWORD PTR DS:[EAX+0x30] match in ntdll.dll::RtlResetRtlTranslations match in ntdll.dll::RtlRestoreLastWin32Error match in ntdll.dll::RtlRevertMemoryStream match in ntdll.dll::RtlRunDecodeUnicodeString match in ntdll.dll::RtlRunEncodeUnicodeString mismatch in ntdll.dll::RtlSecondsSince1970ToTime 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 01 40 00 80 MOV EAX,0x80004001 c2 04 00 RET 0x4 match in ntdll.dll::RtlSecondsSince1980ToTime match in ntdll.dll::RtlSeekMemoryStream match in ntdll.dll::RtlSelfRelativeToAbsoluteSD match in ntdll.dll::RtlSelfRelativeToAbsoluteSD2 match in ntdll.dll::RtlSetAllBits match in ntdll.dll::RtlSetAttributesSecurityDescriptor match in ntdll.dll::RtlSetBits match in ntdll.dll::RtlSetControlSecurityDescriptor match in ntdll.dll::RtlSetCriticalSectionSpinCount match in ntdll.dll::RtlSetCurrentDirectory_U match in ntdll.dll::RtlSetCurrentEnvironment match in ntdll.dll::RtlSetDaclSecurityDescriptor mismatch in ntdll.dll::RtlSetEnvironmentVariable 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 6c PUSH 0x6c 68 68 08 95 7c PUSH 0x7c950868 mismatch in ntdll.dll::RtlSetGroupSecurityDescriptor 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 30 33 99 7c PUSH 0x7c993330 match in ntdll.dll::RtlSetHeapInformation mismatch in ntdll.dll::RtlSetInformationAcl 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 78 PUSH 0x78 68 88 66 95 7c PUSH 0x7c956688 match in ntdll.dll::RtlSetIoCompletionCallback match in ntdll.dll::RtlSetLastWin32Error match in ntdll.dll::RtlSetLastWin32ErrorAndNtStatusFromNtStatus match in ntdll.dll::RtlSetMemoryStreamSize match in ntdll.dll::RtlSetOwnerSecurityDescriptor match in ntdll.dll::RtlSetProcessIsCritical mismatch in ntdll.dll::RtlSetSaclSecurityDescriptor 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 01 40 00 80 MOV EAX,0x80004001 c2 0c 00 RET 0xc match in ntdll.dll::RtlSetSecurityDescriptorRMControl match in ntdll.dll::RtlSetSecurityObject match in ntdll.dll::RtlSetSecurityObjectEx match in ntdll.dll::RtlSetThreadIsCritical match in ntdll.dll::RtlSetThreadPoolStartFunc match in ntdll.dll::RtlSetTimeZoneInformation match in ntdll.dll::RtlSetTimer match in ntdll.dll::RtlSetUnicodeCallouts match in ntdll.dll::RtlSetUserFlagsHeap match in ntdll.dll::RtlSetUserValueHeap mismatch in ntdll.dll::RtlSizeHeap 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP c2 04 00 RET 0x4 8b ff MOV EDI,EDI mismatch in ntdll.dll::RtlSplay 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 28 PUSH 0x28 68 f0 13 99 7c PUSH 0x7c9913f0 mismatch in ntdll.dll::RtlStartRXact 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 20 PUSH 0x20 68 68 af 94 7c PUSH 0x7c94af68 match in ntdll.dll::RtlStatMemoryStream match in ntdll.dll::RtlStringFromGUID match in ntdll.dll::RtlSubAuthorityCountSid match in ntdll.dll::RtlSubAuthoritySid match in ntdll.dll::RtlSubtreePredecessor match in ntdll.dll::RtlSubtreeSuccessor match in ntdll.dll::RtlSystemTimeToLocalTime match in ntdll.dll::RtlTimeFieldsToTime match in ntdll.dll::RtlTimeToElapsedTimeFields match in ntdll.dll::RtlTimeToSecondsSince1970 match in ntdll.dll::RtlTimeToSecondsSince1980 match in ntdll.dll::RtlTimeToTimeFields match in ntdll.dll::RtlTraceDatabaseAdd match in ntdll.dll::RtlTraceDatabaseCreate match in ntdll.dll::RtlTraceDatabaseDestroy match in ntdll.dll::RtlTraceDatabaseEnumerate match in ntdll.dll::RtlTraceDatabaseFind match in ntdll.dll::RtlTraceDatabaseLock match in ntdll.dll::RtlTraceDatabaseUnlock match in ntdll.dll::RtlTraceDatabaseValidate match in ntdll.dll::RtlTryEnterCriticalSection match in ntdll.dll::RtlUlongByteSwap match in ntdll.dll::RtlUlonglongByteSwap mismatch in ntdll.dll::RtlUnhandledExceptionFilter 04 c2 ADD AL,0xc2 04 00 ADD AL,0x0 90 NOP 8b 4c 24 04 MOV ECX,DWORD PTR SS:[ESP+0x4] b8 ff ff ff ff MOV EAX,0xffffffff ba 00 00 00 00 MOV EDX,0x0 f0 0f b1 51 04 LOCK CMPXCHG DWORD PTR DS:[ECX+0x4],EDX mismatch in ntdll.dll::RtlUnhandledExceptionFilter2 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 1c PUSH 0x1c 68 d0 71 99 7c PUSH 0x7c9971d0 match in ntdll.dll::RtlUnicodeStringToAnsiSize match in ntdll.dll::RtlUnicodeStringToAnsiString match in ntdll.dll::RtlUnicodeStringToCountedOemString match in ntdll.dll::RtlUnicodeStringToInteger mismatch in ntdll.dll::RtlUnicodeStringToOemSize 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 18 88 94 7c PUSH 0x7c948818 match in ntdll.dll::RtlUnicodeStringToOemString match in ntdll.dll::RtlUnicodeToCustomCPN match in ntdll.dll::RtlUnicodeToMultiByteN match in ntdll.dll::RtlUnicodeToMultiByteSize match in ntdll.dll::RtlUnicodeToOemN match in ntdll.dll::RtlUniform match in ntdll.dll::RtlUnlockBootStatusData match in ntdll.dll::RtlUnlockHeap match in ntdll.dll::RtlUnlockMemoryStreamRegion mismatch in ntdll.dll::RtlUnwind 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 01 40 00 80 MOV EAX,0x80004001 c2 18 00 RET 0x18 match in ntdll.dll::RtlUpcaseUnicodeChar match in ntdll.dll::RtlUpcaseUnicodeString match in ntdll.dll::RtlUpcaseUnicodeStringToAnsiString match in ntdll.dll::RtlUpcaseUnicodeStringToCountedOemString match in ntdll.dll::RtlUpcaseUnicodeStringToOemString match in ntdll.dll::RtlUpcaseUnicodeToCustomCPN match in ntdll.dll::RtlUpcaseUnicodeToMultiByteN match in ntdll.dll::RtlUpcaseUnicodeToOemN match in ntdll.dll::RtlUpdateTimer match in ntdll.dll::RtlUpperChar match in ntdll.dll::RtlUpperString match in ntdll.dll::RtlUsageHeap mismatch in ntdll.dll::RtlUshortByteSwap 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 68 PUSH 0x68 68 c8 29 99 7c PUSH 0x7c9929c8 mismatch in ntdll.dll::RtlValidAcl 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 2c PUSH 0x2c 68 f8 9f 94 7c PUSH 0x7c949ff8 match in ntdll.dll::RtlValidRelativeSecurityDescriptor mismatch in ntdll.dll::RtlValidSecurityDescriptor 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 b0 c0 95 7c PUSH 0x7c95c0b0 mismatch in ntdll.dll::RtlValidSid 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 08 PUSH 0x8 68 d0 2f 94 7c PUSH 0x7c942fd0 mismatch in ntdll.dll::RtlValidateHeap 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 34 PUSH 0x34 68 90 23 99 7c PUSH 0x7c992390 match in ntdll.dll::RtlValidateProcessHeaps match in ntdll.dll::RtlValidateUnicodeString match in ntdll.dll::RtlVerifyVersionInfo mismatch in ntdll.dll::RtlWalkFrameChain 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 24 PUSH 0x24 68 88 07 99 7c PUSH 0x7c990788 match in ntdll.dll::RtlWalkHeap mismatch in ntdll.dll::RtlWriteMemoryStream 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 01 40 00 80 MOV EAX,0x80004001 c2 10 00 RET 0x10 match in ntdll.dll::RtlWriteRegistryValue mismatch in ntdll.dll::RtlZeroHeap 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 30 PUSH 0x30 68 88 f2 98 7c PUSH 0x7c98f288 mismatch in ntdll.dll::RtlZeroMemory 00 00 8d 49 00 LEA ECX,DWORD PTR DS:[ECX+0x0] 57 PUSH EDI 8b 7c 24 08 MOV EDI,DWORD PTR SS:[ESP+0x8] 8b 4c 24 0c MOV ECX,DWORD PTR SS:[ESP+0xc] 33 c0 XOR EAX,EAX match in ntdll.dll::RtlZombifyActivationContext match in ntdll.dll::RtlpApplyLengthFunction match in ntdll.dll::RtlpEnsureBufferSize match in ntdll.dll::RtlpNotOwnerCriticalSection match in ntdll.dll::RtlpNtCreateKey match in ntdll.dll::RtlpNtEnumerateSubKey match in ntdll.dll::RtlpNtMakeTemporaryKey match in ntdll.dll::RtlpNtOpenKey match in ntdll.dll::RtlpNtQueryValueKey match in ntdll.dll::RtlpNtSetValueKey match in ntdll.dll::RtlpUnWaitCriticalSection match in ntdll.dll::RtlpWaitForCriticalSection match in ntdll.dll::RtlxAnsiStringToUnicodeSize match in ntdll.dll::RtlxOemStringToUnicodeSize match in ntdll.dll::RtlxUnicodeStringToAnsiSize match in ntdll.dll::RtlxUnicodeStringToOemSize match in ntdll.dll::VerSetConditionMask mismatch in ntdll.dll::ZwAcceptConnectPort 74 6f JE $+0x6f 75 6c JNE $+0x6c 00 b8 00 00 00 00 MOV EAX,0x0 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 18 00 RET 0x18 mismatch in ntdll.dll::ZwAccessCheck 12 c2 ADC AL,DL 18 00 SBB BYTE PTR DS:[EAX],AL 90 NOP b8 01 00 00 00 MOV EAX,0x1 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 20 00 RET 0x20 mismatch in ntdll.dll::ZwAccessCheckAndAuditAlarm 12 c2 ADC AL,DL 20 00 AND BYTE PTR DS:[EAX],AL 90 NOP b8 02 00 00 00 MOV EAX,0x2 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 2c 00 RET 0x2c mismatch in ntdll.dll::ZwAccessCheckByType 12 c2 ADC AL,DL 2c 00 SUB AL,0x0 90 NOP b8 03 00 00 00 MOV EAX,0x3 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 2c 00 RET 0x2c mismatch in ntdll.dll::ZwAccessCheckByTypeAndAuditAlarm 12 c2 ADC AL,DL 2c 00 SUB AL,0x0 90 NOP b8 04 00 00 00 MOV EAX,0x4 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 40 00 RET 0x40 mismatch in ntdll.dll::ZwAccessCheckByTypeResultList 12 c2 ADC AL,DL 40 INC EAX 00 90 NOP b8 05 00 00 00 MOV EAX,0x5 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] mismatch in ntdll.dll::ZwAccessCheckByTypeResultListAndAuditAlarm 12 c2 ADC AL,DL 2c 00 SUB AL,0x0 90 NOP b8 06 00 00 00 MOV EAX,0x6 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 40 00 RET 0x40 mismatch in ntdll.dll::ZwAccessCheckByTypeResultListAndAuditAlarmByHandle 12 c2 ADC AL,DL 40 INC EAX 00 90 NOP b8 07 00 00 00 MOV EAX,0x7 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] mismatch in ntdll.dll::ZwAddAtom 12 c2 ADC AL,DL 44 INC ESP 00 90 NOP b8 08 00 00 00 MOV EAX,0x8 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] mismatch in ntdll.dll::ZwAddBootEntry 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 09 00 00 00 MOV EAX,0x9 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwAdjustGroupsToken 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 0a 00 00 00 MOV EAX,0xa ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 18 00 RET 0x18 mismatch in ntdll.dll::ZwAdjustPrivilegesToken 12 c2 ADC AL,DL 18 00 SBB BYTE PTR DS:[EAX],AL 90 NOP b8 0b 00 00 00 MOV EAX,0xb ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 18 00 RET 0x18 mismatch in ntdll.dll::ZwAlertResumeThread 12 c2 ADC AL,DL 18 00 SBB BYTE PTR DS:[EAX],AL 90 NOP b8 0c 00 00 00 MOV EAX,0xc ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwAlertThread 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 0d 00 00 00 MOV EAX,0xd ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwAllocateLocallyUniqueId 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 0e 00 00 00 MOV EAX,0xe ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwAllocateUserPhysicalPages 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 0f 00 00 00 MOV EAX,0xf ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwAllocateUuids 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 10 00 00 00 MOV EAX,0x10 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::ZwAllocateVirtualMemory 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 11 00 00 00 MOV EAX,0x11 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 18 00 RET 0x18 mismatch in ntdll.dll::ZwAreMappedFilesTheSame 12 c2 ADC AL,DL 18 00 SBB BYTE PTR DS:[EAX],AL 90 NOP b8 12 00 00 00 MOV EAX,0x12 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwAssignProcessToJobObject 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 13 00 00 00 MOV EAX,0x13 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwCallbackReturn 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 14 00 00 00 MOV EAX,0x14 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwCancelDeviceWakeupRequest 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 15 00 00 00 MOV EAX,0x15 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwCancelIoFile 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 16 00 00 00 MOV EAX,0x16 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwCancelTimer 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 17 00 00 00 MOV EAX,0x17 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwClearEvent 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 18 00 00 00 MOV EAX,0x18 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwClose 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 19 00 00 00 MOV EAX,0x19 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwCloseObjectAuditAlarm 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 1a 00 00 00 MOV EAX,0x1a ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwCompactKeys 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 1b 00 00 00 MOV EAX,0x1b ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwCompareTokens 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 1c 00 00 00 MOV EAX,0x1c ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwCompleteConnectPort 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 1d 00 00 00 MOV EAX,0x1d ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwCompressKey 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 1e 00 00 00 MOV EAX,0x1e ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwConnectPort 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 1f 00 00 00 MOV EAX,0x1f ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 20 00 RET 0x20 mismatch in ntdll.dll::ZwContinue 12 c2 ADC AL,DL 20 00 AND BYTE PTR DS:[EAX],AL 90 NOP b8 20 00 00 00 MOV EAX,0x20 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwCreateDebugObject 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 21 00 00 00 MOV EAX,0x21 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::ZwCreateDirectoryObject 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 22 00 00 00 MOV EAX,0x22 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwCreateEvent 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 23 00 00 00 MOV EAX,0x23 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::ZwCreateEventPair 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 24 00 00 00 MOV EAX,0x24 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwCreateFile 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 25 00 00 00 MOV EAX,0x25 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 2c 00 RET 0x2c mismatch in ntdll.dll::ZwCreateIoCompletion 12 c2 ADC AL,DL 2c 00 SUB AL,0x0 90 NOP b8 26 00 00 00 MOV EAX,0x26 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::ZwCreateJobObject 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 27 00 00 00 MOV EAX,0x27 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwCreateJobSet 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 28 00 00 00 MOV EAX,0x28 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwCreateKey 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 29 00 00 00 MOV EAX,0x29 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 1c 00 RET 0x1c mismatch in ntdll.dll::ZwCreateKeyedEvent 12 c3 ADC AL,BL 8d 49 00 LEA ECX,DWORD PTR DS:[ECX+0x0] b8 17 01 00 00 MOV EAX,0x117 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 90 NOP mismatch in ntdll.dll::ZwCreateMailslotFile 12 c2 ADC AL,DL 1c 00 SBB AL,0x0 90 NOP b8 2a 00 00 00 MOV EAX,0x2a ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 20 00 RET 0x20 mismatch in ntdll.dll::ZwCreateMutant 12 c2 ADC AL,DL 20 00 AND BYTE PTR DS:[EAX],AL 90 NOP b8 2b 00 00 00 MOV EAX,0x2b ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::ZwCreateNamedPipeFile 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 2c 00 00 00 MOV EAX,0x2c ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 38 00 RET 0x38 mismatch in ntdll.dll::ZwCreatePagingFile 12 c2 ADC AL,DL 38 00 CMP BYTE PTR DS:[EAX],AL 90 NOP b8 2d 00 00 00 MOV EAX,0x2d ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::ZwCreatePort 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 2e 00 00 00 MOV EAX,0x2e ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::ZwCreateProcess 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 2f 00 00 00 MOV EAX,0x2f ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 20 00 RET 0x20 mismatch in ntdll.dll::ZwCreateProcessEx 12 c2 ADC AL,DL 20 00 AND BYTE PTR DS:[EAX],AL 90 NOP b8 30 00 00 00 MOV EAX,0x30 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 24 00 RET 0x24 mismatch in ntdll.dll::ZwCreateProfile 12 c2 ADC AL,DL 24 00 AND AL,0x0 90 NOP b8 31 00 00 00 MOV EAX,0x31 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 24 00 RET 0x24 mismatch in ntdll.dll::ZwCreateSection 12 c2 ADC AL,DL 24 00 AND AL,0x0 90 NOP b8 32 00 00 00 MOV EAX,0x32 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 1c 00 RET 0x1c mismatch in ntdll.dll::ZwCreateSemaphore 12 c2 ADC AL,DL 1c 00 SBB AL,0x0 90 NOP b8 33 00 00 00 MOV EAX,0x33 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::ZwCreateSymbolicLinkObject 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 34 00 00 00 MOV EAX,0x34 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::ZwCreateThread 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 35 00 00 00 MOV EAX,0x35 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 20 00 RET 0x20 mismatch in ntdll.dll::ZwCreateTimer 12 c2 ADC AL,DL 20 00 AND BYTE PTR DS:[EAX],AL 90 NOP b8 36 00 00 00 MOV EAX,0x36 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::ZwCreateToken 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 37 00 00 00 MOV EAX,0x37 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 34 00 RET 0x34 mismatch in ntdll.dll::ZwCreateWaitablePort 12 c2 ADC AL,DL 34 00 XOR AL,0x0 90 NOP b8 38 00 00 00 MOV EAX,0x38 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::ZwDebugActiveProcess 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 39 00 00 00 MOV EAX,0x39 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwDebugContinue 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 3a 00 00 00 MOV EAX,0x3a ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwDelayExecution 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 3b 00 00 00 MOV EAX,0x3b ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwDeleteAtom 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 3c 00 00 00 MOV EAX,0x3c ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwDeleteBootEntry 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 3d 00 00 00 MOV EAX,0x3d ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwDeleteFile 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 3e 00 00 00 MOV EAX,0x3e ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwDeleteKey 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 3f 00 00 00 MOV EAX,0x3f ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwDeleteObjectAuditAlarm 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 40 00 00 00 MOV EAX,0x40 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwDeleteValueKey 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 41 00 00 00 MOV EAX,0x41 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwDeviceIoControlFile 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 42 00 00 00 MOV EAX,0x42 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 28 00 RET 0x28 mismatch in ntdll.dll::ZwDisplayString 12 c2 ADC AL,DL 28 00 SUB BYTE PTR DS:[EAX],AL 90 NOP b8 43 00 00 00 MOV EAX,0x43 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwDuplicateObject 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 44 00 00 00 MOV EAX,0x44 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 1c 00 RET 0x1c mismatch in ntdll.dll::ZwDuplicateToken 12 c2 ADC AL,DL 1c 00 SBB AL,0x0 90 NOP b8 45 00 00 00 MOV EAX,0x45 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 18 00 RET 0x18 mismatch in ntdll.dll::ZwEnumerateBootEntries 12 c2 ADC AL,DL 18 00 SBB BYTE PTR DS:[EAX],AL 90 NOP b8 46 00 00 00 MOV EAX,0x46 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwEnumerateKey 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 47 00 00 00 MOV EAX,0x47 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 18 00 RET 0x18 mismatch in ntdll.dll::ZwEnumerateSystemEnvironmentValuesEx 12 c2 ADC AL,DL 18 00 SBB BYTE PTR DS:[EAX],AL 90 NOP b8 48 00 00 00 MOV EAX,0x48 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwEnumerateValueKey 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 49 00 00 00 MOV EAX,0x49 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 18 00 RET 0x18 mismatch in ntdll.dll::ZwExtendSection 12 c2 ADC AL,DL 18 00 SBB BYTE PTR DS:[EAX],AL 90 NOP b8 4a 00 00 00 MOV EAX,0x4a ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwFilterToken 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 4b 00 00 00 MOV EAX,0x4b ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 18 00 RET 0x18 mismatch in ntdll.dll::ZwFindAtom 12 c2 ADC AL,DL 18 00 SBB BYTE PTR DS:[EAX],AL 90 NOP b8 4c 00 00 00 MOV EAX,0x4c ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwFlushBuffersFile 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 4d 00 00 00 MOV EAX,0x4d ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwFlushInstructionCache 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 4e 00 00 00 MOV EAX,0x4e ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwFlushKey 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 4f 00 00 00 MOV EAX,0x4f ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwFlushVirtualMemory 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 50 00 00 00 MOV EAX,0x50 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::ZwFlushWriteBuffer 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 51 00 00 00 MOV EAX,0x51 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c3 RET mismatch in ntdll.dll::ZwFreeUserPhysicalPages 12 c3 ADC AL,BL 8d 49 00 LEA ECX,DWORD PTR DS:[ECX+0x0] b8 52 00 00 00 MOV EAX,0x52 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc 90 NOP mismatch in ntdll.dll::ZwFreeVirtualMemory 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 53 00 00 00 MOV EAX,0x53 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::ZwFsControlFile 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 54 00 00 00 MOV EAX,0x54 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 28 00 RET 0x28 mismatch in ntdll.dll::ZwGetContextThread 12 c2 ADC AL,DL 28 00 SUB BYTE PTR DS:[EAX],AL 90 NOP b8 55 00 00 00 MOV EAX,0x55 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwGetDevicePowerState 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 56 00 00 00 MOV EAX,0x56 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwGetPlugPlayEvent 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 57 00 00 00 MOV EAX,0x57 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::ZwGetWriteWatch 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 58 00 00 00 MOV EAX,0x58 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 1c 00 RET 0x1c mismatch in ntdll.dll::ZwImpersonateAnonymousToken 12 c2 ADC AL,DL 1c 00 SBB AL,0x0 90 NOP b8 59 00 00 00 MOV EAX,0x59 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwImpersonateClientOfPort 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 5a 00 00 00 MOV EAX,0x5a ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwImpersonateThread 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 5b 00 00 00 MOV EAX,0x5b ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwInitializeRegistry 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 5c 00 00 00 MOV EAX,0x5c ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwInitiatePowerAction 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 5d 00 00 00 MOV EAX,0x5d ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::ZwIsProcessInJob 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 5e 00 00 00 MOV EAX,0x5e ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwIsSystemResumeAutomatic 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 5f 00 00 00 MOV EAX,0x5f ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c3 RET mismatch in ntdll.dll::ZwListenPort 12 c3 ADC AL,BL 8d 49 00 LEA ECX,DWORD PTR DS:[ECX+0x0] b8 60 00 00 00 MOV EAX,0x60 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 90 NOP mismatch in ntdll.dll::ZwLoadDriver 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 61 00 00 00 MOV EAX,0x61 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwLoadKey 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 63 00 00 00 MOV EAX,0x63 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwLoadKey2 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 62 00 00 00 MOV EAX,0x62 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwLockFile 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 64 00 00 00 MOV EAX,0x64 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 28 00 RET 0x28 mismatch in ntdll.dll::ZwLockProductActivationKeys 12 c2 ADC AL,DL 28 00 SUB BYTE PTR DS:[EAX],AL 90 NOP b8 65 00 00 00 MOV EAX,0x65 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwLockRegistryKey 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 66 00 00 00 MOV EAX,0x66 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwLockVirtualMemory 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 67 00 00 00 MOV EAX,0x67 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::ZwMakePermanentObject 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 68 00 00 00 MOV EAX,0x68 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwMakeTemporaryObject 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 69 00 00 00 MOV EAX,0x69 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwMapUserPhysicalPages 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 6a 00 00 00 MOV EAX,0x6a ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwMapUserPhysicalPagesScatter 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 6b 00 00 00 MOV EAX,0x6b ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwMapViewOfSection 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 6c 00 00 00 MOV EAX,0x6c ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 28 00 RET 0x28 mismatch in ntdll.dll::ZwModifyBootEntry 12 c2 ADC AL,DL 28 00 SUB BYTE PTR DS:[EAX],AL 90 NOP b8 6d 00 00 00 MOV EAX,0x6d ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwNotifyChangeDirectoryFile 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 6e 00 00 00 MOV EAX,0x6e ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 24 00 RET 0x24 mismatch in ntdll.dll::ZwNotifyChangeKey 12 c2 ADC AL,DL 24 00 AND AL,0x0 90 NOP b8 6f 00 00 00 MOV EAX,0x6f ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 28 00 RET 0x28 mismatch in ntdll.dll::ZwNotifyChangeMultipleKeys 12 c2 ADC AL,DL 28 00 SUB BYTE PTR DS:[EAX],AL 90 NOP b8 70 00 00 00 MOV EAX,0x70 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 30 00 RET 0x30 mismatch in ntdll.dll::ZwOpenDirectoryObject 12 c2 ADC AL,DL 30 00 XOR BYTE PTR DS:[EAX],AL 90 NOP b8 71 00 00 00 MOV EAX,0x71 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwOpenEvent 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 72 00 00 00 MOV EAX,0x72 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwOpenEventPair 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 73 00 00 00 MOV EAX,0x73 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwOpenFile 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 74 00 00 00 MOV EAX,0x74 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 18 00 RET 0x18 mismatch in ntdll.dll::ZwOpenIoCompletion 12 c2 ADC AL,DL 18 00 SBB BYTE PTR DS:[EAX],AL 90 NOP b8 75 00 00 00 MOV EAX,0x75 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwOpenJobObject 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 76 00 00 00 MOV EAX,0x76 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwOpenKey 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 77 00 00 00 MOV EAX,0x77 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwOpenKeyedEvent 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 18 01 00 00 MOV EAX,0x118 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwOpenMutant 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 78 00 00 00 MOV EAX,0x78 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwOpenObjectAuditAlarm 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 79 00 00 00 MOV EAX,0x79 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 30 00 RET 0x30 mismatch in ntdll.dll::ZwOpenProcess 12 c2 ADC AL,DL 30 00 XOR BYTE PTR DS:[EAX],AL 90 NOP b8 7a 00 00 00 MOV EAX,0x7a ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::ZwOpenProcessToken 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 7b 00 00 00 MOV EAX,0x7b ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwOpenProcessTokenEx 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 7c 00 00 00 MOV EAX,0x7c ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::ZwOpenSection 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 7d 00 00 00 MOV EAX,0x7d ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwOpenSemaphore 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 7e 00 00 00 MOV EAX,0x7e ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwOpenSymbolicLinkObject 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 7f 00 00 00 MOV EAX,0x7f ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwOpenThread 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 80 00 00 00 MOV EAX,0x80 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::ZwOpenThreadToken 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 81 00 00 00 MOV EAX,0x81 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::ZwOpenThreadTokenEx 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 82 00 00 00 MOV EAX,0x82 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::ZwOpenTimer 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 83 00 00 00 MOV EAX,0x83 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwPlugPlayControl 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 84 00 00 00 MOV EAX,0x84 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwPowerInformation 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 85 00 00 00 MOV EAX,0x85 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::ZwPrivilegeCheck 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 86 00 00 00 MOV EAX,0x86 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwPrivilegeObjectAuditAlarm 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 87 00 00 00 MOV EAX,0x87 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 18 00 RET 0x18 mismatch in ntdll.dll::ZwPrivilegedServiceAuditAlarm 12 c2 ADC AL,DL 18 00 SBB BYTE PTR DS:[EAX],AL 90 NOP b8 88 00 00 00 MOV EAX,0x88 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::ZwProtectVirtualMemory 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 89 00 00 00 MOV EAX,0x89 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::ZwPulseEvent 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 8a 00 00 00 MOV EAX,0x8a ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwQueryAttributesFile 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 8b 00 00 00 MOV EAX,0x8b ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwQueryBootEntryOrder 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 8c 00 00 00 MOV EAX,0x8c ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwQueryBootOptions 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 8d 00 00 00 MOV EAX,0x8d ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwQueryDebugFilterState 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 8e 00 00 00 MOV EAX,0x8e ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwQueryDefaultLocale 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 8f 00 00 00 MOV EAX,0x8f ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwQueryDefaultUILanguage 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 90 00 00 00 MOV EAX,0x90 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwQueryDirectoryFile 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 91 00 00 00 MOV EAX,0x91 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 2c 00 RET 0x2c mismatch in ntdll.dll::ZwQueryDirectoryObject 12 c2 ADC AL,DL 2c 00 SUB AL,0x0 90 NOP b8 92 00 00 00 MOV EAX,0x92 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 1c 00 RET 0x1c mismatch in ntdll.dll::ZwQueryEaFile 12 c2 ADC AL,DL 1c 00 SBB AL,0x0 90 NOP b8 93 00 00 00 MOV EAX,0x93 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 24 00 RET 0x24 mismatch in ntdll.dll::ZwQueryEvent 12 c2 ADC AL,DL 24 00 AND AL,0x0 90 NOP b8 94 00 00 00 MOV EAX,0x94 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::ZwQueryFullAttributesFile 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 95 00 00 00 MOV EAX,0x95 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwQueryInformationAtom 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 96 00 00 00 MOV EAX,0x96 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::ZwQueryInformationFile 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 97 00 00 00 MOV EAX,0x97 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::ZwQueryInformationJobObject 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 98 00 00 00 MOV EAX,0x98 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::ZwQueryInformationPort 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 99 00 00 00 MOV EAX,0x99 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::ZwQueryInformationProcess 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 9a 00 00 00 MOV EAX,0x9a ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::ZwQueryInformationThread 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 9b 00 00 00 MOV EAX,0x9b ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::ZwQueryInformationToken 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 9c 00 00 00 MOV EAX,0x9c ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::ZwQueryInstallUILanguage 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 9d 00 00 00 MOV EAX,0x9d ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwQueryIntervalProfile 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 9e 00 00 00 MOV EAX,0x9e ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwQueryIoCompletion 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 9f 00 00 00 MOV EAX,0x9f ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::ZwQueryKey 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 a0 00 00 00 MOV EAX,0xa0 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::ZwQueryMultipleValueKey 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 a1 00 00 00 MOV EAX,0xa1 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 18 00 RET 0x18 mismatch in ntdll.dll::ZwQueryMutant 12 c2 ADC AL,DL 18 00 SBB BYTE PTR DS:[EAX],AL 90 NOP b8 a2 00 00 00 MOV EAX,0xa2 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::ZwQueryObject 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 a3 00 00 00 MOV EAX,0xa3 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::ZwQueryOpenSubKeys 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 a4 00 00 00 MOV EAX,0xa4 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwQueryPerformanceCounter 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 a5 00 00 00 MOV EAX,0xa5 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwQueryPortInformationProcess 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 1b 01 00 00 MOV EAX,0x11b ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c3 RET mismatch in ntdll.dll::ZwQueryQuotaInformationFile 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 a6 00 00 00 MOV EAX,0xa6 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 24 00 RET 0x24 mismatch in ntdll.dll::ZwQuerySection 12 c2 ADC AL,DL 24 00 AND AL,0x0 90 NOP b8 a7 00 00 00 MOV EAX,0xa7 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::ZwQuerySecurityObject 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 a8 00 00 00 MOV EAX,0xa8 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::ZwQuerySemaphore 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 a9 00 00 00 MOV EAX,0xa9 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::ZwQuerySymbolicLinkObject 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 aa 00 00 00 MOV EAX,0xaa ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwQuerySystemEnvironmentValue 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 ab 00 00 00 MOV EAX,0xab ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::ZwQuerySystemEnvironmentValueEx 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 ac 00 00 00 MOV EAX,0xac ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::ZwQuerySystemInformation 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 ad 00 00 00 MOV EAX,0xad ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::ZwQuerySystemTime 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 ae 00 00 00 MOV EAX,0xae ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwQueryTimer 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 af 00 00 00 MOV EAX,0xaf ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::ZwQueryTimerResolution 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 b0 00 00 00 MOV EAX,0xb0 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwQueryValueKey 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 b1 00 00 00 MOV EAX,0xb1 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 18 00 RET 0x18 mismatch in ntdll.dll::ZwQueryVirtualMemory 12 c2 ADC AL,DL 18 00 SBB BYTE PTR DS:[EAX],AL 90 NOP b8 b2 00 00 00 MOV EAX,0xb2 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 18 00 RET 0x18 mismatch in ntdll.dll::ZwQueryVolumeInformationFile 12 c2 ADC AL,DL 18 00 SBB BYTE PTR DS:[EAX],AL 90 NOP b8 b3 00 00 00 MOV EAX,0xb3 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::ZwQueueApcThread 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 b4 00 00 00 MOV EAX,0xb4 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::ZwRaiseException 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 b5 00 00 00 MOV EAX,0xb5 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwRaiseHardError 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 b6 00 00 00 MOV EAX,0xb6 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 18 00 RET 0x18 mismatch in ntdll.dll::ZwReadFile 12 c2 ADC AL,DL 18 00 SBB BYTE PTR DS:[EAX],AL 90 NOP b8 b7 00 00 00 MOV EAX,0xb7 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 24 00 RET 0x24 mismatch in ntdll.dll::ZwReadFileScatter 12 c2 ADC AL,DL 24 00 AND AL,0x0 90 NOP b8 b8 00 00 00 MOV EAX,0xb8 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 24 00 RET 0x24 mismatch in ntdll.dll::ZwReadRequestData 12 c2 ADC AL,DL 24 00 AND AL,0x0 90 NOP b8 b9 00 00 00 MOV EAX,0xb9 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 18 00 RET 0x18 mismatch in ntdll.dll::ZwReadVirtualMemory 12 c2 ADC AL,DL 18 00 SBB BYTE PTR DS:[EAX],AL 90 NOP b8 ba 00 00 00 MOV EAX,0xba ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::ZwRegisterThreadTerminatePort 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 bb 00 00 00 MOV EAX,0xbb ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwReleaseKeyedEvent 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 19 01 00 00 MOV EAX,0x119 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::ZwReleaseMutant 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 bc 00 00 00 MOV EAX,0xbc ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwReleaseSemaphore 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 bd 00 00 00 MOV EAX,0xbd ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwRemoveIoCompletion 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 be 00 00 00 MOV EAX,0xbe ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::ZwRemoveProcessDebug 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 bf 00 00 00 MOV EAX,0xbf ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwRenameKey 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 c0 00 00 00 MOV EAX,0xc0 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwReplaceKey 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 c1 00 00 00 MOV EAX,0xc1 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwReplyPort 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 c2 00 00 00 MOV EAX,0xc2 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwReplyWaitReceivePort 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 c3 00 00 00 MOV EAX,0xc3 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::ZwReplyWaitReceivePortEx 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 c4 00 00 00 MOV EAX,0xc4 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::ZwReplyWaitReplyPort 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 c5 00 00 00 MOV EAX,0xc5 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwRequestDeviceWakeup 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 c6 00 00 00 MOV EAX,0xc6 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwRequestPort 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 c7 00 00 00 MOV EAX,0xc7 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwRequestWaitReplyPort 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 c8 00 00 00 MOV EAX,0xc8 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwRequestWakeupLatency 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 c9 00 00 00 MOV EAX,0xc9 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwResetEvent 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 ca 00 00 00 MOV EAX,0xca ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwResetWriteWatch 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 cb 00 00 00 MOV EAX,0xcb ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwRestoreKey 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 cc 00 00 00 MOV EAX,0xcc ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwResumeProcess 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 cd 00 00 00 MOV EAX,0xcd ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwResumeThread 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 ce 00 00 00 MOV EAX,0xce ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwSaveKey 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 cf 00 00 00 MOV EAX,0xcf ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwSaveKeyEx 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 d0 00 00 00 MOV EAX,0xd0 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwSaveMergedKeys 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 d1 00 00 00 MOV EAX,0xd1 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwSecureConnectPort 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 d2 00 00 00 MOV EAX,0xd2 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 24 00 RET 0x24 mismatch in ntdll.dll::ZwSetBootEntryOrder 12 c2 ADC AL,DL 24 00 AND AL,0x0 90 NOP b8 d3 00 00 00 MOV EAX,0xd3 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwSetBootOptions 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 d4 00 00 00 MOV EAX,0xd4 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwSetContextThread 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 d5 00 00 00 MOV EAX,0xd5 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwSetDebugFilterState 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 d6 00 00 00 MOV EAX,0xd6 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwSetDefaultHardErrorPort 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 d7 00 00 00 MOV EAX,0xd7 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwSetDefaultLocale 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 d8 00 00 00 MOV EAX,0xd8 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwSetDefaultUILanguage 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 d9 00 00 00 MOV EAX,0xd9 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwSetEaFile 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 da 00 00 00 MOV EAX,0xda ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::ZwSetEvent 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 db 00 00 00 MOV EAX,0xdb ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwSetEventBoostPriority 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 dc 00 00 00 MOV EAX,0xdc ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwSetHighEventPair 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 dd 00 00 00 MOV EAX,0xdd ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwSetHighWaitLowEventPair 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 de 00 00 00 MOV EAX,0xde ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwSetInformationDebugObject 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 df 00 00 00 MOV EAX,0xdf ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::ZwSetInformationFile 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 e0 00 00 00 MOV EAX,0xe0 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::ZwSetInformationJobObject 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 e1 00 00 00 MOV EAX,0xe1 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::ZwSetInformationKey 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 e2 00 00 00 MOV EAX,0xe2 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::ZwSetInformationObject 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 e3 00 00 00 MOV EAX,0xe3 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::ZwSetInformationProcess 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 e4 00 00 00 MOV EAX,0xe4 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::ZwSetInformationThread 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 e5 00 00 00 MOV EAX,0xe5 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::ZwSetInformationToken 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 e6 00 00 00 MOV EAX,0xe6 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::ZwSetIntervalProfile 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 e7 00 00 00 MOV EAX,0xe7 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwSetIoCompletion 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 e8 00 00 00 MOV EAX,0xe8 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::ZwSetLdtEntries 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 e9 00 00 00 MOV EAX,0xe9 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 18 00 RET 0x18 mismatch in ntdll.dll::ZwSetLowEventPair 12 c2 ADC AL,DL 18 00 SBB BYTE PTR DS:[EAX],AL 90 NOP b8 ea 00 00 00 MOV EAX,0xea ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwSetLowWaitHighEventPair 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 eb 00 00 00 MOV EAX,0xeb ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwSetQuotaInformationFile 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 ec 00 00 00 MOV EAX,0xec ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::ZwSetSecurityObject 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 ed 00 00 00 MOV EAX,0xed ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwSetSystemEnvironmentValue 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 ee 00 00 00 MOV EAX,0xee ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwSetSystemEnvironmentValueEx 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 ef 00 00 00 MOV EAX,0xef ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::ZwSetSystemInformation 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 f0 00 00 00 MOV EAX,0xf0 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwSetSystemPowerState 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 f1 00 00 00 MOV EAX,0xf1 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwSetSystemTime 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 f2 00 00 00 MOV EAX,0xf2 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwSetThreadExecutionState 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 f3 00 00 00 MOV EAX,0xf3 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwSetTimer 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 f4 00 00 00 MOV EAX,0xf4 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 1c 00 RET 0x1c mismatch in ntdll.dll::ZwSetTimerResolution 12 c2 ADC AL,DL 1c 00 SBB AL,0x0 90 NOP b8 f5 00 00 00 MOV EAX,0xf5 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwSetUuidSeed 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 f6 00 00 00 MOV EAX,0xf6 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwSetValueKey 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 f7 00 00 00 MOV EAX,0xf7 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 18 00 RET 0x18 mismatch in ntdll.dll::ZwSetVolumeInformationFile 12 c2 ADC AL,DL 18 00 SBB BYTE PTR DS:[EAX],AL 90 NOP b8 f8 00 00 00 MOV EAX,0xf8 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::ZwShutdownSystem 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 f9 00 00 00 MOV EAX,0xf9 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwSignalAndWaitForSingleObject 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 fa 00 00 00 MOV EAX,0xfa ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::ZwStartProfile 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 fb 00 00 00 MOV EAX,0xfb ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwStopProfile 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 fc 00 00 00 MOV EAX,0xfc ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwSuspendProcess 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 fd 00 00 00 MOV EAX,0xfd ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwSuspendThread 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 fe 00 00 00 MOV EAX,0xfe ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwSystemDebugControl 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 ff 00 00 00 MOV EAX,0xff ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 18 00 RET 0x18 mismatch in ntdll.dll::ZwTerminateJobObject 12 c2 ADC AL,DL 18 00 SBB BYTE PTR DS:[EAX],AL 90 NOP b8 00 01 00 00 MOV EAX,0x100 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwTerminateProcess 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 01 01 00 00 MOV EAX,0x101 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwTerminateThread 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 02 01 00 00 MOV EAX,0x102 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwTestAlert 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 03 01 00 00 MOV EAX,0x103 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c3 RET mismatch in ntdll.dll::ZwTraceEvent 12 c3 ADC AL,BL 8d 49 00 LEA ECX,DWORD PTR DS:[ECX+0x0] b8 04 01 00 00 MOV EAX,0x104 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 90 NOP mismatch in ntdll.dll::ZwTranslateFilePath 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 05 01 00 00 MOV EAX,0x105 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::ZwUnloadDriver 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 06 01 00 00 MOV EAX,0x106 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwUnloadKey 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 07 01 00 00 MOV EAX,0x107 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwUnloadKeyEx 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 08 01 00 00 MOV EAX,0x108 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwUnlockFile 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 09 01 00 00 MOV EAX,0x109 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::ZwUnlockVirtualMemory 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 0a 01 00 00 MOV EAX,0x10a ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::ZwUnmapViewOfSection 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 0b 01 00 00 MOV EAX,0x10b ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwVdmControl 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 0c 01 00 00 MOV EAX,0x10c ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 08 00 RET 0x8 mismatch in ntdll.dll::ZwWaitForDebugEvent 12 c2 ADC AL,DL 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP b8 0d 01 00 00 MOV EAX,0x10d ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::ZwWaitForKeyedEvent 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 1a 01 00 00 MOV EAX,0x11a ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 10 00 RET 0x10 mismatch in ntdll.dll::ZwWaitForMultipleObjects 12 c2 ADC AL,DL 10 00 ADC BYTE PTR DS:[EAX],AL 90 NOP b8 0e 01 00 00 MOV EAX,0x10e ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::ZwWaitForSingleObject 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 0f 01 00 00 MOV EAX,0x10f ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 0c 00 RET 0xc mismatch in ntdll.dll::ZwWaitHighEventPair 12 c2 ADC AL,DL 0c 00 OR AL,0x0 90 NOP b8 10 01 00 00 MOV EAX,0x110 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwWaitLowEventPair 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 11 01 00 00 MOV EAX,0x111 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 04 00 RET 0x4 mismatch in ntdll.dll::ZwWriteFile 12 c2 ADC AL,DL 04 00 ADD AL,0x0 90 NOP b8 12 01 00 00 MOV EAX,0x112 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 24 00 RET 0x24 mismatch in ntdll.dll::ZwWriteFileGather 12 c2 ADC AL,DL 24 00 AND AL,0x0 90 NOP b8 13 01 00 00 MOV EAX,0x113 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 24 00 RET 0x24 mismatch in ntdll.dll::ZwWriteRequestData 12 c2 ADC AL,DL 24 00 AND AL,0x0 90 NOP b8 14 01 00 00 MOV EAX,0x114 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 18 00 RET 0x18 mismatch in ntdll.dll::ZwWriteVirtualMemory 12 c2 ADC AL,DL 18 00 SBB BYTE PTR DS:[EAX],AL 90 NOP b8 15 01 00 00 MOV EAX,0x115 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c2 14 00 RET 0x14 mismatch in ntdll.dll::ZwYieldExecution 12 c2 ADC AL,DL 14 00 ADC AL,0x0 90 NOP b8 16 01 00 00 MOV EAX,0x116 ba 00 03 fe 7f MOV EDX,0x7ffe0300 ff 12 CALL DWORD PTR DS:[EDX] c3 RET mismatch in ntdll.dll::_CIcos cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 83 ec 0c SUB ESP,0xc mismatch in ntdll.dll::_CIlog 40 INC EAX eb 18 JMP SHORT $+0x18 8b ff MOV EDI,EDI eb 00 JMP SHORT $+0x0 83 ec 0c SUB ESP,0xc mismatch in ntdll.dll::_CIpow eb 1e JMP SHORT $+0x1e 90 NOP 8b ff MOV EDI,EDI eb 00 JMP SHORT $+0x0 83 ec 14 SUB ESP,0x14 mismatch in ntdll.dll::_CIsin 0a 5f c2 OR BL,BYTE PTR DS:[EDI+0xc2] 08 00 OR BYTE PTR DS:[EAX],AL 83 ec 0c SUB ESP,0xc mismatch in ntdll.dll::_CIsqrt d0 00 ROL BYTE PTR DS:[EAX],0x1 00 5a POP EDX c3 RET 83 ec 0c SUB ESP,0xc match in ntdll.dll::__isascii match in ntdll.dll::__iscsym match in ntdll.dll::__iscsymf match in ntdll.dll::__toascii mismatch in ntdll.dll::_alldiv cf IRET/IRETD 00 00 5a POP EDX c3 RET 57 PUSH EDI 56 PUSH ESI mismatch in ntdll.dll::_alldvrm 5e POP ESI 5f POP EDI c2 10 00 RET 0x10 57 PUSH EDI 56 PUSH ESI 55 PUSH EBP 33 ff XOR EDI,EDI mismatch in ntdll.dll::_allmul 5e POP ESI 5f POP EDI c2 10 00 RET 0x10 8b 44 24 08 MOV EAX,DWORD PTR SS:[ESP+0x8] 8b 4c 24 10 MOV ECX,DWORD PTR SS:[ESP+0x10] 0b c8 OR ECX,EAX 8b 4c 24 0c MOV ECX,DWORD PTR SS:[ESP+0xc] mismatch in ntdll.dll::_alloca_probe d3 5b c2 RCR DWORD PTR DS:[EBX+0xc2],CL 10 00 ADC BYTE PTR DS:[EAX],AL 3d 00 10 00 00 CMP EAX,0x1000 73 0e JNB $+0xe f7 d8 NEG EAX 03 c4 ADD EAX,ESP 83 c0 04 ADD EAX,0x4 mismatch in ntdll.dll::_allrem 8b 40 04 MOV EAX,DWORD PTR DS:[EAX+0x4] 50 PUSH EAX c3 RET 53 PUSH EBX 57 PUSH EDI 33 ff XOR EDI,EDI 8b 44 24 10 MOV EAX,DWORD PTR SS:[ESP+0x10] mismatch in ntdll.dll::_allshl 5f POP EDI 5b POP EBX c2 10 00 RET 0x10 80 f9 40 CMP CL,0x40 73 15 JNB $+0x15 80 f9 20 CMP CL,0x20 73 06 JNB $+0x6 mismatch in ntdll.dll::_allshr 33 c0 XOR EAX,EAX 33 d2 XOR EDX,EDX c3 RET 80 f9 40 CMP CL,0x40 73 16 JNB $+0x16 80 f9 20 CMP CL,0x20 73 06 JNB $+0x6 match in ntdll.dll::_atoi64 mismatch in ntdll.dll::_aulldiv mismatch in ntdll.dll::_aulldvrm 5e POP ESI 5b POP EBX c2 10 00 RET 0x10 56 PUSH ESI 8b 44 24 14 MOV EAX,DWORD PTR SS:[ESP+0x14] 0b c0 OR EAX,EAX 75 28 JNE $+0x28 mismatch in ntdll.dll::_aullrem mismatch in ntdll.dll::_aullshr 00 5b POP EBX c2 10 00 RET 0x10 80 f9 40 CMP CL,0x40 73 15 JNB $+0x15 80 f9 20 CMP CL,0x20 73 06 JNB $+0x6 mismatch in ntdll.dll::_chkstk d3 5b c2 RCR DWORD PTR DS:[EBX+0xc2],CL 10 00 ADC BYTE PTR DS:[EAX],AL 3d 00 10 00 00 CMP EAX,0x1000 73 0e JNB $+0xe f7 d8 NEG EAX 03 c4 ADD EAX,ESP 83 c0 04 ADD EAX,0x4 mismatch in ntdll.dll::_fltused 74 00 JE $+0x0 00 00 00 75 98 JNE $+0xffffff98 00 00 mismatch in ntdll.dll::_ftol 33 c0 XOR EAX,EAX 33 d2 XOR EDX,EDX c3 RET 55 PUSH EBP 8b ec MOV EBP,ESP 83 c4 f4 ADD ESP,0xfffffff4 9b WAIT match in ntdll.dll::_i64toa match in ntdll.dll::_i64tow match in ntdll.dll::_itoa match in ntdll.dll::_itow match in ntdll.dll::_lfind match in ntdll.dll::_ltoa match in ntdll.dll::_ltow mismatch in ntdll.dll::_memccpy 8b 55 f8 MOV EDX,DWORD PTR DS:[EBP+0xf8] c9 LEAVE c3 RET 8b 4c 24 10 MOV ECX,DWORD PTR SS:[ESP+0x10] 53 PUSH EBX 85 c9 TEST ECX,ECX 74 40 JE $+0x40 match in ntdll.dll::_memicmp match in ntdll.dll::_snprintf match in ntdll.dll::_snwprintf match in ntdll.dll::_splitpath match in ntdll.dll::_strcmpi match in ntdll.dll::_stricmp match in ntdll.dll::_strlwr match in ntdll.dll::_strnicmp match in ntdll.dll::_strupr match in ntdll.dll::_tolower match in ntdll.dll::_toupper match in ntdll.dll::_ui64toa match in ntdll.dll::_ui64tow match in ntdll.dll::_ultoa match in ntdll.dll::_ultow match in ntdll.dll::_vsnprintf match in ntdll.dll::_vsnwprintf match in ntdll.dll::_wcsicmp match in ntdll.dll::_wcslwr match in ntdll.dll::_wcsnicmp match in ntdll.dll::_wcsupr match in ntdll.dll::_wtoi match in ntdll.dll::_wtoi64 match in ntdll.dll::_wtol match in ntdll.dll::abs mismatch in ntdll.dll::atan 18 40 5e SBB BYTE PTR DS:[EAX+0x5e],AL 5b POP EBX c3 RET eb 16 JMP SHORT $+0x16 8b ff MOV EDI,EDI 83 ec 0c SUB ESP,0xc match in ntdll.dll::atoi match in ntdll.dll::atol match in ntdll.dll::bsearch mismatch in ntdll.dll::ceil ca 00 00 RET FAR 0x0 5a POP EDX c3 RET e9 2d 0c 07 00 JMP $+0x70c2d 8d a4 24 00 00 00 00 LEA ESP,DWORD PTR SS:[ESP+0x0] 8d 64 24 00 LEA ESP,DWORD PTR SS:[ESP+0x0] f3 0f REP POP CS mismatch in ntdll.dll::cos 00 83 c4 0c ADD ESP,0xc c3 RET 8d 54 24 04 LEA EDX,DWORD PTR SS:[ESP+0x4] e8 73 fc ff ff CALL $+0xfffffc73 52 PUSH EDX 9b WAIT match in ntdll.dll::fabs mismatch in ntdll.dll::floor 00 00 00 00 80 e9 ca SUB CL,0xca 14 07 ADC AL,0x7 00 match in ntdll.dll::isalnum match in ntdll.dll::isalpha match in ntdll.dll::iscntrl match in ntdll.dll::isdigit match in ntdll.dll::isgraph match in ntdll.dll::islower match in ntdll.dll::isprint match in ntdll.dll::ispunct match in ntdll.dll::isspace match in ntdll.dll::isupper match in ntdll.dll::iswalpha match in ntdll.dll::iswctype match in ntdll.dll::iswdigit match in ntdll.dll::iswlower match in ntdll.dll::iswspace match in ntdll.dll::iswxdigit match in ntdll.dll::isxdigit match in ntdll.dll::labs mismatch in ntdll.dll::log match in ntdll.dll::mbstowcs mismatch in ntdll.dll::memchr 00 00 00 00 00 8b 44 24 0c MOV EAX,DWORD PTR SS:[ESP+0xc] 53 PUSH EBX mismatch in ntdll.dll::memcmp 42 INC EDX fc CLD 5f POP EDI 5b POP EBX c3 RET 8b 44 24 0c MOV EAX,DWORD PTR SS:[ESP+0xc] 85 c0 TEST EAX,EAX mismatch in ntdll.dll::memcpy cd 48 INT 0x48 5f POP EDI 5e POP ESI c3 RET 55 PUSH EBP 8b ec MOV EBP,ESP 57 PUSH EDI mismatch in ntdll.dll::memmove 08 5e 5f OR BYTE PTR DS:[ESI+0x5f],BL c9 LEAVE c3 RET 55 PUSH EBP 8b ec MOV EBP,ESP 57 PUSH EDI 56 PUSH ESI mismatch in ntdll.dll::memset 08 5e 5f OR BYTE PTR DS:[ESI+0x5f],BL c9 LEAVE c3 RET 8b 54 24 0c MOV EDX,DWORD PTR SS:[ESP+0xc] 8b 4c 24 04 MOV ECX,DWORD PTR SS:[ESP+0x4] 85 d2 TEST EDX,EDX 74 47 JE $+0x47 mismatch in ntdll.dll::pow match in ntdll.dll::qsort mismatch in ntdll.dll::sin 00 83 c4 0c ADD ESP,0xc c3 RET 8d 54 24 04 LEA EDX,DWORD PTR SS:[ESP+0x4] e8 88 cf 00 00 CALL $+0xcf88 52 PUSH EDX 9b WAIT match in ntdll.dll::sprintf mismatch in ntdll.dll::sqrt 00 83 c4 0c ADD ESP,0xc c3 RET 8d 54 24 04 LEA EDX,DWORD PTR SS:[ESP+0x4] e8 da ce 00 00 CALL $+0xceda 52 PUSH EDX 9b WAIT match in ntdll.dll::sscanf mismatch in ntdll.dll::strcat 00 00 00 8b ff MOV EDI,EDI 8b 4c 24 04 MOV ECX,DWORD PTR SS:[ESP+0x4] 57 PUSH EDI f7 c1 03 00 00 00 TEST ECX,0x3 mismatch in ntdll.dll::strchr 00 8d 64 24 00 LEA ESP,DWORD PTR SS:[ESP+0x0] 33 c0 XOR EAX,EAX 8a 44 24 08 MOV AL,BYTE PTR SS:[ESP+0x8] 53 PUSH EBX 8b d8 MOV EBX,EAX c1 e0 08 SHL EAX,0x8 mismatch in ntdll.dll::strcmp 44 INC ESP 24 08 AND AL,0x8 5f POP EDI c3 RET 8b 54 24 04 MOV EDX,DWORD PTR SS:[ESP+0x4] 8b 4c 24 08 MOV ECX,DWORD PTR SS:[ESP+0x8] f7 c2 03 00 00 00 TEST EDX,0x3 mismatch in ntdll.dll::strcpy 8b 44 24 04 MOV EAX,DWORD PTR SS:[ESP+0x4] c3 RET 57 PUSH EDI 8b 7c 24 08 MOV EDI,DWORD PTR SS:[ESP+0x8] eb 6c JMP SHORT $+0x6c 8d a4 24 00 00 00 00 LEA ESP,DWORD PTR SS:[ESP+0x0] 8b ff MOV EDI,EDI mismatch in ntdll.dll::strcspn 83 c1 02 ADD ECX,0x2 eb 8b JMP SHORT $+0xffffff8b 55 PUSH EBP 8b ec MOV EBP,ESP 56 PUSH ESI 33 c0 XOR EAX,EAX 50 PUSH EAX mismatch in ntdll.dll::strlen c4 20 LES ESP,FWORD PTR DS:[EAX] 5e POP ESI c9 LEAVE c3 RET 8b 4c 24 04 MOV ECX,DWORD PTR SS:[ESP+0x4] f7 c1 03 00 00 00 TEST ECX,0x3 74 12 JE $+0x12 mismatch in ntdll.dll::strncat 24 04 AND AL,0x4 2b c1 SUB EAX,ECX c3 RET 8b 4c 24 0c MOV ECX,DWORD PTR SS:[ESP+0xc] 57 PUSH EDI 85 c9 TEST ECX,ECX 0f 84 a9 00 00 00 JE $+0xa9 mismatch in ntdll.dll::strncmp 10 5b 5e ADC BYTE PTR DS:[EBX+0x5e],BL 5f POP EDI c3 RET 55 PUSH EBP 8b ec MOV EBP,ESP 57 PUSH EDI 56 PUSH ESI mismatch in ntdll.dll::strncpy 5b POP EBX 5e POP ESI 5f POP EDI c9 LEAVE c3 RET 8b 4c 24 0c MOV ECX,DWORD PTR SS:[ESP+0xc] 57 PUSH EDI mismatch in ntdll.dll::strpbrk 10 5b 5e ADC BYTE PTR DS:[EBX+0x5e],BL 5f POP EDI c3 RET 55 PUSH EBP 8b ec MOV EBP,ESP 56 PUSH ESI 33 c0 XOR EAX,EAX mismatch in ntdll.dll::strrchr c4 20 LES ESP,FWORD PTR DS:[EAX] 5e POP ESI c9 LEAVE c3 RET 55 PUSH EBP 8b ec MOV EBP,ESP 57 PUSH EDI mismatch in ntdll.dll::strspn mismatch in ntdll.dll::strstr 5a POP EDX c3 RET 90 NOP 7f 02 JNLE $+0x2 8b 4c 24 08 MOV ECX,DWORD PTR SS:[ESP+0x8] 57 PUSH EDI 53 PUSH EBX match in ntdll.dll::strtol match in ntdll.dll::strtoul match in ntdll.dll::swprintf mismatch in ntdll.dll::tan 00 83 c4 0c ADD ESP,0xc c3 RET 8d 54 24 04 LEA EDX,DWORD PTR SS:[ESP+0x4] e8 9f b8 00 00 CALL $+0xb89f 52 PUSH EDX 9b WAIT match in ntdll.dll::tolower match in ntdll.dll::toupper match in ntdll.dll::towlower match in ntdll.dll::towupper match in ntdll.dll::vDbgPrintEx mismatch in ntdll.dll::vDbgPrintExWithPrefix 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 74 02 00 00 PUSH 0x274 68 98 e2 94 7c PUSH 0x7c94e298 match in ntdll.dll::vsprintf match in ntdll.dll::wcscat match in ntdll.dll::wcschr match in ntdll.dll::wcscmp match in ntdll.dll::wcscpy match in ntdll.dll::wcscspn match in ntdll.dll::wcslen match in ntdll.dll::wcsncat match in ntdll.dll::wcsncmp match in ntdll.dll::wcsncpy match in ntdll.dll::wcspbrk match in ntdll.dll::wcsrchr match in ntdll.dll::wcsspn match in ntdll.dll::wcsstr match in ntdll.dll::wcstol match in ntdll.dll::wcstombs match in ntdll.dll::wcstoul match in kernel32.dll::ActivateActCtx match in kernel32.dll::AddAtomA match in kernel32.dll::AddAtomW match in kernel32.dll::AddConsoleAliasA match in kernel32.dll::AddConsoleAliasW match in kernel32.dll::AddLocalAlternateComputerNameA match in kernel32.dll::AddLocalAlternateComputerNameW match in kernel32.dll::AddRefActCtx mismatch in kernel32.dll::AddVectoredExceptionHandler 6c INSSB 65 6e OUTSB 57 PUSH EDI 00 4e DEC ESI 54 PUSH ESP 44 INC ESP mismatch in kernel32.dll::AllocConsole 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 70 04 00 00 PUSH 0x470 68 18 17 87 7c PUSH 0x7c871718 match in kernel32.dll::AllocateUserPhysicalPages mismatch in kernel32.dll::AreFileApisANSI 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP a1 e0 46 88 7c MOV EAX,DWORD PTR DS:[0x7c8846e0] c3 RET match in kernel32.dll::AssignProcessToJobObject mismatch in kernel32.dll::AttachConsole 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 18 01 00 00 PUSH 0x118 68 18 18 87 7c PUSH 0x7c871818 match in kernel32.dll::BackupRead match in kernel32.dll::BackupSeek match in kernel32.dll::BackupWrite mismatch in kernel32.dll::BaseCheckAppcompatCache 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 78 68 81 7c PUSH 0x7c816878 match in kernel32.dll::BaseCleanupAppcompatCache match in kernel32.dll::BaseCleanupAppcompatCacheSupport match in kernel32.dll::BaseDumpAppcompatCache mismatch in kernel32.dll::BaseFlushAppcompatCache 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 a0 be 86 7c PUSH 0x7c86bea0 mismatch in kernel32.dll::BaseInitAppcompatCache 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 08 PUSH 0x8 68 50 65 81 7c PUSH 0x7c816550 match in kernel32.dll::BaseInitAppcompatCacheSupport mismatch in kernel32.dll::BaseProcessInitPostImport 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP f6 05 d0 02 fe 7f 10 TEST BYTE PTR DS:[0x7ffe02d0],0x10 74 05 JE $+0x5 match in kernel32.dll::BaseQueryModuleData mismatch in kernel32.dll::BaseUpdateAppcompatCache 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 98 51 81 7c PUSH 0x7c815198 match in kernel32.dll::BasepCheckWinSaferRestrictions match in kernel32.dll::Beep match in kernel32.dll::BeginUpdateResourceA match in kernel32.dll::BeginUpdateResourceW match in kernel32.dll::BindIoCompletionCallback match in kernel32.dll::BuildCommDCBA match in kernel32.dll::BuildCommDCBAndTimeoutsA match in kernel32.dll::BuildCommDCBAndTimeoutsW match in kernel32.dll::BuildCommDCBW match in kernel32.dll::CallNamedPipeA mismatch in kernel32.dll::CallNamedPipeW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 48 fe 85 7c PUSH 0x7c85fe48 match in kernel32.dll::CancelDeviceWakeupRequest match in kernel32.dll::CancelIo match in kernel32.dll::CancelTimerQueueTimer match in kernel32.dll::CancelWaitableTimer match in kernel32.dll::ChangeTimerQueueTimer match in kernel32.dll::CheckNameLegalDOS8Dot3A match in kernel32.dll::CheckNameLegalDOS8Dot3W match in kernel32.dll::CheckRemoteDebuggerPresent match in kernel32.dll::ClearCommBreak match in kernel32.dll::ClearCommError match in kernel32.dll::CloseConsoleHandle match in kernel32.dll::CloseHandle mismatch in kernel32.dll::CloseProfileUserMapping 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP e8 e6 ff fe ff CALL $+0xfffeffe6 83 3d d4 40 88 7c 00 CMP DWORD PTR DS:[0x7c8840d4],0x0 match in kernel32.dll::CmdBatNotification mismatch in kernel32.dll::CommConfigDialogA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 20 PUSH 0x20 68 28 6b 86 7c PUSH 0x7c866b28 mismatch in kernel32.dll::CommConfigDialogW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 20 PUSH 0x20 68 50 6a 86 7c PUSH 0x7c866a50 match in kernel32.dll::CompareFileTime match in kernel32.dll::CompareStringA match in kernel32.dll::CompareStringW match in kernel32.dll::ConnectNamedPipe match in kernel32.dll::ConsoleMenuControl match in kernel32.dll::ContinueDebugEvent match in kernel32.dll::ConvertDefaultLocale mismatch in kernel32.dll::ConvertFiberToThread 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 64 a1 18 00 00 00 MOV EAX,DWORD PTR FS:[0x18] 8d 88 76 0f 00 00 LEA ECX,DWORD PTR DS:[EAX+0xf76] match in kernel32.dll::ConvertThreadToFiber match in kernel32.dll::CopyFileA match in kernel32.dll::CopyFileExA mismatch in kernel32.dll::CopyFileExW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 98 7b 82 7c PUSH 0x7c827b98 match in kernel32.dll::CopyFileW match in kernel32.dll::CopyLZFile match in kernel32.dll::CreateActCtxA mismatch in kernel32.dll::CreateActCtxW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 d0 02 00 00 PUSH 0x2d0 68 20 59 81 7c PUSH 0x7c815920 mismatch in kernel32.dll::CreateConsoleScreenBuffer 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 b4 00 00 00 PUSH 0xb4 68 28 34 87 7c PUSH 0x7c873428 match in kernel32.dll::CreateDirectoryA match in kernel32.dll::CreateDirectoryExA match in kernel32.dll::CreateDirectoryExW match in kernel32.dll::CreateDirectoryW match in kernel32.dll::CreateEventA match in kernel32.dll::CreateEventW match in kernel32.dll::CreateFiber match in kernel32.dll::CreateFiberEx match in kernel32.dll::CreateFileA match in kernel32.dll::CreateFileMappingA match in kernel32.dll::CreateFileMappingW match in kernel32.dll::CreateFileW match in kernel32.dll::CreateHardLinkA mismatch in kernel32.dll::CreateHardLinkW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 4c PUSH 0x4c 68 08 b8 86 7c PUSH 0x7c86b808 match in kernel32.dll::CreateIoCompletionPort match in kernel32.dll::CreateJobObjectA match in kernel32.dll::CreateJobObjectW match in kernel32.dll::CreateJobSet match in kernel32.dll::CreateMailslotA match in kernel32.dll::CreateMailslotW match in kernel32.dll::CreateMemoryResourceNotification match in kernel32.dll::CreateMutexA match in kernel32.dll::CreateMutexW match in kernel32.dll::CreateNamedPipeA match in kernel32.dll::CreateNamedPipeW match in kernel32.dll::CreateNlsSecurityDescriptor match in kernel32.dll::CreatePipe match in kernel32.dll::CreateProcessA mismatch in kernel32.dll::CreateProcessInternalA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 98 00 00 00 PUSH 0x98 68 f0 de 81 7c PUSH 0x7c81def0 mismatch in kernel32.dll::CreateProcessInternalW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 08 0a 00 00 PUSH 0xa08 68 f8 97 81 7c PUSH 0x7c8197f8 mismatch in kernel32.dll::CreateProcessInternalWSecure 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 8b c0 MOV EAX,EAX c3 RET match in kernel32.dll::CreateProcessW mismatch in kernel32.dll::CreateRemoteThread 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 10 04 00 00 PUSH 0x410 68 18 06 81 7c PUSH 0x7c810618 match in kernel32.dll::CreateSemaphoreA match in kernel32.dll::CreateSemaphoreW mismatch in kernel32.dll::CreateSocketHandle 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 78 PUSH 0x78 e8 41 da f9 ff CALL $+0xfff9da41 match in kernel32.dll::CreateTapePartition match in kernel32.dll::CreateThread match in kernel32.dll::CreateTimerQueue match in kernel32.dll::CreateTimerQueueTimer match in kernel32.dll::CreateToolhelp32Snapshot match in kernel32.dll::CreateVirtualBuffer match in kernel32.dll::CreateWaitableTimerA match in kernel32.dll::CreateWaitableTimerW match in kernel32.dll::DeactivateActCtx match in kernel32.dll::DebugActiveProcess match in kernel32.dll::DebugActiveProcessStop mismatch in kernel32.dll::DebugBreak 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP e9 7e 5d 02 00 JMP $+0x25d7e 90 NOP match in kernel32.dll::DebugBreakProcess match in kernel32.dll::DebugSetProcessKillOnExit mismatch in kernel32.dll::DecodePointer 64 6c INSSB 65 72 00 JB $+0x0 4e DEC ESI 54 PUSH ESP 44 INC ESP 4c DEC ESP 4c DEC ESP mismatch in kernel32.dll::DecodeSystemPointer 6e OUTSB 74 65 JE $+0x65 72 00 JB $+0x0 4e DEC ESI 54 PUSH ESP 44 INC ESP 4c DEC ESP match in kernel32.dll::DefineDosDeviceA match in kernel32.dll::DefineDosDeviceW match in kernel32.dll::DelayLoadFailureHook match in kernel32.dll::DeleteAtom mismatch in kernel32.dll::DeleteCriticalSection 6e OUTSB 74 65 JE $+0x65 72 00 JB $+0x0 4e DEC ESI 54 PUSH ESP 44 INC ESP 4c DEC ESP match in kernel32.dll::DeleteFiber match in kernel32.dll::DeleteFileA match in kernel32.dll::DeleteFileW match in kernel32.dll::DeleteTimerQueue match in kernel32.dll::DeleteTimerQueueEx match in kernel32.dll::DeleteTimerQueueTimer match in kernel32.dll::DeleteVolumeMountPointA match in kernel32.dll::DeleteVolumeMountPointW mismatch in kernel32.dll::DeviceIoControl 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 c0 0a 81 7c PUSH 0x7c810ac0 match in kernel32.dll::DisableThreadLibraryCalls match in kernel32.dll::DisconnectNamedPipe match in kernel32.dll::DnsHostnameToComputerNameA match in kernel32.dll::DnsHostnameToComputerNameW match in kernel32.dll::DosDateTimeToFileTime mismatch in kernel32.dll::DosPathToSessionPathA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 24 PUSH 0x24 68 10 1b 86 7c PUSH 0x7c861b10 mismatch in kernel32.dll::DosPathToSessionPathW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 0c PUSH 0xc 68 a0 c2 82 7c PUSH 0x7c82c2a0 match in kernel32.dll::DuplicateConsoleHandle mismatch in kernel32.dll::DuplicateHandle 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 08 PUSH 0x8 68 88 de 80 7c PUSH 0x7c80de88 mismatch in kernel32.dll::EncodePointer 74 69 JE $+0x69 6f OUTSD 6e OUTSB 00 4e DEC ESI 54 PUSH ESP 44 INC ESP mismatch in kernel32.dll::EncodeSystemPointer 6e OUTSB 74 65 JE $+0x65 72 00 JB $+0x0 4e DEC ESI 54 PUSH ESP 44 INC ESP 4c DEC ESP match in kernel32.dll::EndUpdateResourceA match in kernel32.dll::EndUpdateResourceW mismatch in kernel32.dll::EnterCriticalSection 6e OUTSB 74 65 JE $+0x65 72 00 JB $+0x0 4e DEC ESI 54 PUSH ESP 44 INC ESP 4c DEC ESP match in kernel32.dll::EnumCalendarInfoA match in kernel32.dll::EnumCalendarInfoExA match in kernel32.dll::EnumCalendarInfoExW match in kernel32.dll::EnumCalendarInfoW match in kernel32.dll::EnumDateFormatsA match in kernel32.dll::EnumDateFormatsExA match in kernel32.dll::EnumDateFormatsExW match in kernel32.dll::EnumDateFormatsW match in kernel32.dll::EnumLanguageGroupLocalesA match in kernel32.dll::EnumLanguageGroupLocalesW mismatch in kernel32.dll::EnumResourceLanguagesA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 28 PUSH 0x28 68 e8 e0 82 7c PUSH 0x7c82e0e8 mismatch in kernel32.dll::EnumResourceLanguagesW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 28 PUSH 0x28 68 90 f9 85 7c PUSH 0x7c85f990 mismatch in kernel32.dll::EnumResourceNamesA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 44 PUSH 0x44 68 58 f6 85 7c PUSH 0x7c85f658 mismatch in kernel32.dll::EnumResourceNamesW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 3c PUSH 0x3c 68 a0 5a 85 7c PUSH 0x7c855aa0 mismatch in kernel32.dll::EnumResourceTypesA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 40 PUSH 0x40 68 38 f4 85 7c PUSH 0x7c85f438 mismatch in kernel32.dll::EnumResourceTypesW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 3c PUSH 0x3c 68 40 f8 85 7c PUSH 0x7c85f840 match in kernel32.dll::EnumSystemCodePagesA match in kernel32.dll::EnumSystemCodePagesW match in kernel32.dll::EnumSystemGeoID match in kernel32.dll::EnumSystemLanguageGroupsA match in kernel32.dll::EnumSystemLanguageGroupsW match in kernel32.dll::EnumSystemLocalesA match in kernel32.dll::EnumSystemLocalesW match in kernel32.dll::EnumTimeFormatsA match in kernel32.dll::EnumTimeFormatsW match in kernel32.dll::EnumUILanguagesA match in kernel32.dll::EnumUILanguagesW match in kernel32.dll::EnumerateLocalComputerNamesA match in kernel32.dll::EnumerateLocalComputerNamesW match in kernel32.dll::EraseTape match in kernel32.dll::EscapeCommFunction match in kernel32.dll::ExitProcess mismatch in kernel32.dll::ExitThread 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 d0 c0 80 7c PUSH 0x7c80c0d0 match in kernel32.dll::ExitVDM match in kernel32.dll::ExpandEnvironmentStringsA match in kernel32.dll::ExpandEnvironmentStringsW match in kernel32.dll::ExpungeConsoleCommandHistoryA match in kernel32.dll::ExpungeConsoleCommandHistoryW match in kernel32.dll::ExtendVirtualBuffer match in kernel32.dll::FatalAppExitA match in kernel32.dll::FatalAppExitW match in kernel32.dll::FatalExit match in kernel32.dll::FileTimeToDosDateTime match in kernel32.dll::FileTimeToLocalFileTime match in kernel32.dll::FileTimeToSystemTime match in kernel32.dll::FillConsoleOutputAttribute match in kernel32.dll::FillConsoleOutputCharacterA match in kernel32.dll::FillConsoleOutputCharacterW match in kernel32.dll::FindActCtxSectionGuid match in kernel32.dll::FindActCtxSectionStringA match in kernel32.dll::FindActCtxSectionStringW match in kernel32.dll::FindAtomA match in kernel32.dll::FindAtomW mismatch in kernel32.dll::FindClose 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 24 PUSH 0x24 68 80 ee 80 7c PUSH 0x7c80ee80 match in kernel32.dll::FindCloseChangeNotification match in kernel32.dll::FindFirstChangeNotificationA match in kernel32.dll::FindFirstChangeNotificationW match in kernel32.dll::FindFirstFileA match in kernel32.dll::FindFirstFileExA match in kernel32.dll::FindFirstFileExW match in kernel32.dll::FindFirstFileW mismatch in kernel32.dll::FindFirstVolumeA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 28 PUSH 0x28 68 50 a5 86 7c PUSH 0x7c86a550 mismatch in kernel32.dll::FindFirstVolumeMountPointA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 28 PUSH 0x28 68 28 a0 86 7c PUSH 0x7c86a028 match in kernel32.dll::FindFirstVolumeMountPointW match in kernel32.dll::FindFirstVolumeW match in kernel32.dll::FindNextChangeNotification match in kernel32.dll::FindNextFileA mismatch in kernel32.dll::FindNextFileW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 2c PUSH 0x2c 68 48 f0 80 7c PUSH 0x7c80f048 mismatch in kernel32.dll::FindNextVolumeA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 28 PUSH 0x28 68 f8 9e 86 7c PUSH 0x7c869ef8 mismatch in kernel32.dll::FindNextVolumeMountPointA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 28 PUSH 0x28 68 40 a1 86 7c PUSH 0x7c86a140 match in kernel32.dll::FindNextVolumeMountPointW match in kernel32.dll::FindNextVolumeW mismatch in kernel32.dll::FindResourceA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 20 PUSH 0x20 68 28 bf 80 7c PUSH 0x7c80bf28 mismatch in kernel32.dll::FindResourceExA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 20 PUSH 0x20 68 50 60 83 7c PUSH 0x7c836050 mismatch in kernel32.dll::FindResourceExW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 20 PUSH 0x20 68 28 ad 80 7c PUSH 0x7c80ad28 mismatch in kernel32.dll::FindResourceW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 20 PUSH 0x20 68 68 bc 80 7c PUSH 0x7c80bc68 match in kernel32.dll::FindVolumeClose match in kernel32.dll::FindVolumeMountPointClose match in kernel32.dll::FlushConsoleInputBuffer match in kernel32.dll::FlushFileBuffers match in kernel32.dll::FlushInstructionCache match in kernel32.dll::FlushViewOfFile match in kernel32.dll::FoldStringA match in kernel32.dll::FoldStringW match in kernel32.dll::FormatMessageA match in kernel32.dll::FormatMessageW match in kernel32.dll::FreeConsole match in kernel32.dll::FreeEnvironmentStringsA mismatch in kernel32.dll::FreeEnvironmentStringsW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 33 c0 XOR EAX,EAX 40 INC EAX match in kernel32.dll::FreeLibrary match in kernel32.dll::FreeLibraryAndExitThread mismatch in kernel32.dll::FreeResource 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 33 c0 XOR EAX,EAX c2 04 00 RET 0x4 match in kernel32.dll::FreeUserPhysicalPages match in kernel32.dll::FreeVirtualBuffer match in kernel32.dll::GenerateConsoleCtrlEvent mismatch in kernel32.dll::GetACP 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP a1 80 43 88 7c MOV EAX,DWORD PTR DS:[0x7c884380] c3 RET match in kernel32.dll::GetAtomNameA match in kernel32.dll::GetAtomNameW match in kernel32.dll::GetBinaryType match in kernel32.dll::GetBinaryTypeA mismatch in kernel32.dll::GetBinaryTypeW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 8c 00 00 00 PUSH 0x8c 68 f8 7f 86 7c PUSH 0x7c867ff8 match in kernel32.dll::GetCPFileNameFromRegistry match in kernel32.dll::GetCPInfo match in kernel32.dll::GetCPInfoExA match in kernel32.dll::GetCPInfoExW match in kernel32.dll::GetCalendarInfoA match in kernel32.dll::GetCalendarInfoW match in kernel32.dll::GetComPlusPackageInstallStatus match in kernel32.dll::GetCommConfig match in kernel32.dll::GetCommMask match in kernel32.dll::GetCommModemStatus match in kernel32.dll::GetCommProperties match in kernel32.dll::GetCommState match in kernel32.dll::GetCommTimeouts mismatch in kernel32.dll::GetCommandLineA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP a1 f4 45 88 7c MOV EAX,DWORD PTR DS:[0x7c8845f4] c3 RET mismatch in kernel32.dll::GetCommandLineW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP a1 04 40 88 7c MOV EAX,DWORD PTR DS:[0x7c884004] c3 RET match in kernel32.dll::GetCompressedFileSizeA match in kernel32.dll::GetCompressedFileSizeW match in kernel32.dll::GetComputerNameA match in kernel32.dll::GetComputerNameExA match in kernel32.dll::GetComputerNameExW match in kernel32.dll::GetComputerNameW match in kernel32.dll::GetConsoleAliasA match in kernel32.dll::GetConsoleAliasExesA mismatch in kernel32.dll::GetConsoleAliasExesLengthA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 00 PUSH 0x0 e8 78 ff ff ff CALL $+0xffffff78 mismatch in kernel32.dll::GetConsoleAliasExesLengthW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 01 PUSH 0x1 e8 85 ff ff ff CALL $+0xffffff85 match in kernel32.dll::GetConsoleAliasExesW match in kernel32.dll::GetConsoleAliasW match in kernel32.dll::GetConsoleAliasesA match in kernel32.dll::GetConsoleAliasesLengthA match in kernel32.dll::GetConsoleAliasesLengthW match in kernel32.dll::GetConsoleAliasesW match in kernel32.dll::GetConsoleCP mismatch in kernel32.dll::GetConsoleCharType 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 ac 00 00 00 PUSH 0xac 68 90 54 87 7c PUSH 0x7c875490 match in kernel32.dll::GetConsoleCommandHistoryA match in kernel32.dll::GetConsoleCommandHistoryLengthA match in kernel32.dll::GetConsoleCommandHistoryLengthW match in kernel32.dll::GetConsoleCommandHistoryW mismatch in kernel32.dll::GetConsoleCursorInfo 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 ac 00 00 00 PUSH 0xac 68 48 38 87 7c PUSH 0x7c873848 mismatch in kernel32.dll::GetConsoleCursorMode 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 ac 00 00 00 PUSH 0xac 68 e8 4a 87 7c PUSH 0x7c874ae8 mismatch in kernel32.dll::GetConsoleDisplayMode 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 ac 00 00 00 PUSH 0xac 68 18 7d 83 7c PUSH 0x7c837d18 mismatch in kernel32.dll::GetConsoleFontInfo 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 b0 00 00 00 PUSH 0xb0 68 e0 3a 87 7c PUSH 0x7c873ae0 match in kernel32.dll::GetConsoleFontSize mismatch in kernel32.dll::GetConsoleHardwareState 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 ac 00 00 00 PUSH 0xac 68 08 1f 87 7c PUSH 0x7c871f08 match in kernel32.dll::GetConsoleInputExeNameA mismatch in kernel32.dll::GetConsoleInputExeNameW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 08 PUSH 0x8 68 80 0d 87 7c PUSH 0x7c870d80 mismatch in kernel32.dll::GetConsoleInputWaitHandle 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP a1 34 40 88 7c MOV EAX,DWORD PTR DS:[0x7c884034] c3 RET match in kernel32.dll::GetConsoleKeyboardLayoutNameA match in kernel32.dll::GetConsoleKeyboardLayoutNameW mismatch in kernel32.dll::GetConsoleMode 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 ac 00 00 00 PUSH 0xac 68 a8 af 81 7c PUSH 0x7c81afa8 mismatch in kernel32.dll::GetConsoleNlsMode 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 b0 00 00 00 PUSH 0xb0 68 f8 52 87 7c PUSH 0x7c8752f8 match in kernel32.dll::GetConsoleOutputCP mismatch in kernel32.dll::GetConsoleProcessList 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 b4 00 00 00 PUSH 0xb4 68 20 47 87 7c PUSH 0x7c874720 mismatch in kernel32.dll::GetConsoleScreenBufferInfo 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 ac 00 00 00 PUSH 0xac 68 c0 bc 81 7c PUSH 0x7c81bcc0 mismatch in kernel32.dll::GetConsoleSelectionInfo 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 ac 00 00 00 PUSH 0xac 68 00 39 87 7c PUSH 0x7c873900 match in kernel32.dll::GetConsoleTitleA match in kernel32.dll::GetConsoleTitleW match in kernel32.dll::GetConsoleWindow match in kernel32.dll::GetCurrencyFormatA match in kernel32.dll::GetCurrencyFormatW match in kernel32.dll::GetCurrentActCtx mismatch in kernel32.dll::GetCurrentConsoleFont 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 ac 00 00 00 PUSH 0xac 68 40 3c 87 7c PUSH 0x7c873c40 match in kernel32.dll::GetCurrentDirectoryA match in kernel32.dll::GetCurrentDirectoryW mismatch in kernel32.dll::GetCurrentProcess 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 83 c8 ff OR EAX,0xffffffff c3 RET mismatch in kernel32.dll::GetCurrentProcessId 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 64 a1 18 00 00 00 MOV EAX,DWORD PTR FS:[0x18] 8b 40 20 MOV EAX,DWORD PTR DS:[EAX+0x20] mismatch in kernel32.dll::GetCurrentThread 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a fe PUSH 0xfe 58 POP EAX mismatch in kernel32.dll::GetCurrentThreadId 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 64 a1 18 00 00 00 MOV EAX,DWORD PTR FS:[0x18] 8b 40 24 MOV EAX,DWORD PTR DS:[EAX+0x24] match in kernel32.dll::GetDateFormatA match in kernel32.dll::GetDateFormatW mismatch in kernel32.dll::GetDefaultCommConfigA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 20 PUSH 0x20 68 f8 6c 86 7c PUSH 0x7c866cf8 mismatch in kernel32.dll::GetDefaultCommConfigW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 20 PUSH 0x20 68 20 6c 86 7c PUSH 0x7c866c20 match in kernel32.dll::GetDefaultSortkeySize match in kernel32.dll::GetDevicePowerState match in kernel32.dll::GetDiskFreeSpaceA match in kernel32.dll::GetDiskFreeSpaceExA match in kernel32.dll::GetDiskFreeSpaceExW match in kernel32.dll::GetDiskFreeSpaceW match in kernel32.dll::GetDllDirectoryA match in kernel32.dll::GetDllDirectoryW match in kernel32.dll::GetDriveTypeA match in kernel32.dll::GetDriveTypeW match in kernel32.dll::GetEnvironmentStrings match in kernel32.dll::GetEnvironmentStringsA mismatch in kernel32.dll::GetEnvironmentStringsW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 64 a1 18 00 00 00 MOV EAX,DWORD PTR FS:[0x18] 8b 40 30 MOV EAX,DWORD PTR DS:[EAX+0x30] match in kernel32.dll::GetEnvironmentVariableA match in kernel32.dll::GetEnvironmentVariableW match in kernel32.dll::GetExitCodeProcess match in kernel32.dll::GetExitCodeThread match in kernel32.dll::GetExpandedNameA match in kernel32.dll::GetExpandedNameW match in kernel32.dll::GetFileAttributesA match in kernel32.dll::GetFileAttributesExA match in kernel32.dll::GetFileAttributesExW match in kernel32.dll::GetFileAttributesW match in kernel32.dll::GetFileInformationByHandle match in kernel32.dll::GetFileSize match in kernel32.dll::GetFileSizeEx match in kernel32.dll::GetFileTime match in kernel32.dll::GetFileType match in kernel32.dll::GetFirmwareEnvironmentVariableA match in kernel32.dll::GetFirmwareEnvironmentVariableW match in kernel32.dll::GetFullPathNameA match in kernel32.dll::GetFullPathNameW match in kernel32.dll::GetGeoInfoA match in kernel32.dll::GetGeoInfoW mismatch in kernel32.dll::GetHandleContext 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 78 PUSH 0x78 e8 52 da f9 ff CALL $+0xfff9da52 match in kernel32.dll::GetHandleInformation match in kernel32.dll::GetLargestConsoleWindowSize mismatch in kernel32.dll::GetLastError 74 69 JE $+0x69 6f OUTSD 6e OUTSB 00 4e DEC ESI 54 PUSH ESP 44 INC ESP match in kernel32.dll::GetLinguistLangSize match in kernel32.dll::GetLocalTime match in kernel32.dll::GetLocaleInfoA match in kernel32.dll::GetLocaleInfoW match in kernel32.dll::GetLogicalDriveStringsA match in kernel32.dll::GetLogicalDriveStringsW match in kernel32.dll::GetLogicalDrives mismatch in kernel32.dll::GetLongPathNameA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 44 02 00 00 PUSH 0x244 68 80 89 86 7c PUSH 0x7c868980 mismatch in kernel32.dll::GetLongPathNameW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 9c 02 00 00 PUSH 0x29c 68 e0 35 81 7c PUSH 0x7c8135e0 match in kernel32.dll::GetMailslotInfo match in kernel32.dll::GetModuleFileNameA mismatch in kernel32.dll::GetModuleFileNameW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 28 PUSH 0x28 68 40 b4 80 7c PUSH 0x7c80b440 match in kernel32.dll::GetModuleHandleA match in kernel32.dll::GetModuleHandleExA match in kernel32.dll::GetModuleHandleExW match in kernel32.dll::GetModuleHandleW match in kernel32.dll::GetNamedPipeHandleStateA match in kernel32.dll::GetNamedPipeHandleStateW match in kernel32.dll::GetNamedPipeInfo match in kernel32.dll::GetNativeSystemInfo mismatch in kernel32.dll::GetNextVDMCommand 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 dc 00 00 00 PUSH 0xdc 68 68 78 86 7c PUSH 0x7c867868 match in kernel32.dll::GetNlsSectionName match in kernel32.dll::GetNumaAvailableMemory match in kernel32.dll::GetNumaAvailableMemoryNode match in kernel32.dll::GetNumaHighestNodeNumber match in kernel32.dll::GetNumaNodeProcessorMask match in kernel32.dll::GetNumaProcessorMap match in kernel32.dll::GetNumaProcessorNode match in kernel32.dll::GetNumberFormatA match in kernel32.dll::GetNumberFormatW match in kernel32.dll::GetNumberOfConsoleFonts mismatch in kernel32.dll::GetNumberOfConsoleInputEvents 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 ac 00 00 00 PUSH 0xac 68 50 48 87 7c PUSH 0x7c874850 mismatch in kernel32.dll::GetNumberOfConsoleMouseButtons 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 ac 00 00 00 PUSH 0xac 68 b8 39 87 7c PUSH 0x7c8739b8 mismatch in kernel32.dll::GetOEMCP 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP a1 6c 46 88 7c MOV EAX,DWORD PTR DS:[0x7c88466c] c3 RET match in kernel32.dll::GetOverlappedResult match in kernel32.dll::GetPriorityClass match in kernel32.dll::GetPrivateProfileIntA match in kernel32.dll::GetPrivateProfileIntW match in kernel32.dll::GetPrivateProfileSectionA match in kernel32.dll::GetPrivateProfileSectionNamesA match in kernel32.dll::GetPrivateProfileSectionNamesW match in kernel32.dll::GetPrivateProfileSectionW match in kernel32.dll::GetPrivateProfileStringA match in kernel32.dll::GetPrivateProfileStringW match in kernel32.dll::GetPrivateProfileStructA match in kernel32.dll::GetPrivateProfileStructW match in kernel32.dll::GetProcAddress match in kernel32.dll::GetProcessAffinityMask match in kernel32.dll::GetProcessHandleCount mismatch in kernel32.dll::GetProcessHeap 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 64 a1 18 00 00 00 MOV EAX,DWORD PTR FS:[0x18] 8b 40 30 MOV EAX,DWORD PTR DS:[EAX+0x30] match in kernel32.dll::GetProcessHeaps match in kernel32.dll::GetProcessId match in kernel32.dll::GetProcessIoCounters match in kernel32.dll::GetProcessPriorityBoost match in kernel32.dll::GetProcessShutdownParameters match in kernel32.dll::GetProcessTimes mismatch in kernel32.dll::GetProcessVersion 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 50 PUSH 0x50 68 a0 2c 81 7c PUSH 0x7c812ca0 match in kernel32.dll::GetProcessWorkingSetSize match in kernel32.dll::GetProfileIntA match in kernel32.dll::GetProfileIntW match in kernel32.dll::GetProfileSectionA match in kernel32.dll::GetProfileSectionW match in kernel32.dll::GetProfileStringA match in kernel32.dll::GetProfileStringW match in kernel32.dll::GetQueuedCompletionStatus mismatch in kernel32.dll::GetShortPathNameA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 44 02 00 00 PUSH 0x244 68 30 5d 83 7c PUSH 0x7c835d30 mismatch in kernel32.dll::GetShortPathNameW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 a4 02 00 00 PUSH 0x2a4 68 70 f5 81 7c PUSH 0x7c81f570 mismatch in kernel32.dll::GetStartupInfoA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 38 2f 81 7c PUSH 0x7c812f38 match in kernel32.dll::GetStartupInfoW match in kernel32.dll::GetStdHandle match in kernel32.dll::GetStringTypeA match in kernel32.dll::GetStringTypeExA match in kernel32.dll::GetStringTypeExW match in kernel32.dll::GetStringTypeW mismatch in kernel32.dll::GetSystemDefaultLCID 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP a1 a8 43 88 7c MOV EAX,DWORD PTR DS:[0x7c8843a8] c3 RET mismatch in kernel32.dll::GetSystemDefaultLangID 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 66 a1 a8 43 88 7c MOV AX,WORD PTR DS:[0x7c8843a8] c3 RET mismatch in kernel32.dll::GetSystemDefaultUILanguage 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 66 83 3d 2a 47 88 7c 00 CMP WORD PTR DS:[0x7c88472a],0x0 0f 84 76 f8 01 00 JE $+0x1f876 match in kernel32.dll::GetSystemDirectoryA match in kernel32.dll::GetSystemDirectoryW match in kernel32.dll::GetSystemInfo match in kernel32.dll::GetSystemPowerStatus match in kernel32.dll::GetSystemRegistryQuota match in kernel32.dll::GetSystemTime match in kernel32.dll::GetSystemTimeAdjustment match in kernel32.dll::GetSystemTimeAsFileTime match in kernel32.dll::GetSystemTimes match in kernel32.dll::GetSystemWindowsDirectoryA match in kernel32.dll::GetSystemWindowsDirectoryW mismatch in kernel32.dll::GetSystemWow64DirectoryA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 78 PUSH 0x78 e8 49 7e fe ff CALL $+0xfffe7e49 mismatch in kernel32.dll::GetSystemWow64DirectoryW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 78 PUSH 0x78 e8 49 7e fe ff CALL $+0xfffe7e49 match in kernel32.dll::GetTapeParameters match in kernel32.dll::GetTapePosition match in kernel32.dll::GetTapeStatus match in kernel32.dll::GetTempFileNameA match in kernel32.dll::GetTempFileNameW match in kernel32.dll::GetTempPathA match in kernel32.dll::GetTempPathW match in kernel32.dll::GetThreadContext match in kernel32.dll::GetThreadIOPendingFlag mismatch in kernel32.dll::GetThreadLocale 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 64 a1 18 00 00 00 MOV EAX,DWORD PTR FS:[0x18] 8b 80 c4 00 00 00 MOV EAX,DWORD PTR DS:[EAX+0xc4] match in kernel32.dll::GetThreadPriority match in kernel32.dll::GetThreadPriorityBoost match in kernel32.dll::GetThreadSelectorEntry match in kernel32.dll::GetThreadTimes mismatch in kernel32.dll::GetTickCount 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP ba 00 00 fe 7f MOV EDX,0x7ffe0000 8b 02 MOV EAX,DWORD PTR DS:[EDX] match in kernel32.dll::GetTimeFormatA match in kernel32.dll::GetTimeFormatW match in kernel32.dll::GetTimeZoneInformation match in kernel32.dll::GetUserDefaultLCID mismatch in kernel32.dll::GetUserDefaultLangID 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP e9 a7 df ff ff JMP $+0xffffdfa7 80 4e 01 80 OR BYTE PTR DS:[ESI+0x1],0x80 match in kernel32.dll::GetUserDefaultUILanguage match in kernel32.dll::GetUserGeoID mismatch in kernel32.dll::GetVDMCurrentDirectories 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 d4 00 00 00 PUSH 0xd4 68 88 7b 86 7c PUSH 0x7c867b88 mismatch in kernel32.dll::GetVersion 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 64 a1 18 00 00 00 MOV EAX,DWORD PTR FS:[0x18] 8b 48 30 MOV ECX,DWORD PTR DS:[EAX+0x30] match in kernel32.dll::GetVersionExA match in kernel32.dll::GetVersionExW mismatch in kernel32.dll::GetVolumeInformationA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 44 PUSH 0x44 68 30 1d 82 7c PUSH 0x7c821d30 mismatch in kernel32.dll::GetVolumeInformationW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 5c PUSH 0x5c 68 f0 fb 80 7c PUSH 0x7c80fbf0 mismatch in kernel32.dll::GetVolumeNameForVolumeMountPointA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 28 PUSH 0x28 68 70 a2 86 7c PUSH 0x7c86a270 match in kernel32.dll::GetVolumeNameForVolumeMountPointW mismatch in kernel32.dll::GetVolumePathNameA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 28 PUSH 0x28 68 90 e9 82 7c PUSH 0x7c82e990 match in kernel32.dll::GetVolumePathNameW mismatch in kernel32.dll::GetVolumePathNamesForVolumeNameA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 2c PUSH 0x2c 68 38 a4 86 7c PUSH 0x7c86a438 match in kernel32.dll::GetVolumePathNamesForVolumeNameW match in kernel32.dll::GetWindowsDirectoryA match in kernel32.dll::GetWindowsDirectoryW match in kernel32.dll::GetWriteWatch match in kernel32.dll::GlobalAddAtomA match in kernel32.dll::GlobalAddAtomW mismatch in kernel32.dll::GlobalAlloc 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 1c PUSH 0x1c 68 38 fe 80 7c PUSH 0x7c80fe38 mismatch in kernel32.dll::GlobalCompact 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 00 PUSH 0x0 ff 35 a4 43 88 7c PUSH DWORD PTR DS:[0x7c8843a4] match in kernel32.dll::GlobalDeleteAtom match in kernel32.dll::GlobalFindAtomA match in kernel32.dll::GlobalFindAtomW match in kernel32.dll::GlobalFix mismatch in kernel32.dll::GlobalFlags 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 1c PUSH 0x1c 68 58 68 83 7c PUSH 0x7c836858 mismatch in kernel32.dll::GlobalFree 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 e8 fc 80 7c PUSH 0x7c80fce8 match in kernel32.dll::GlobalGetAtomNameA match in kernel32.dll::GlobalGetAtomNameW mismatch in kernel32.dll::GlobalHandle 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 78 4d 83 7c PUSH 0x7c834d78 mismatch in kernel32.dll::GlobalLock 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 b0 ff 80 7c PUSH 0x7c80ffb0 match in kernel32.dll::GlobalMemoryStatus match in kernel32.dll::GlobalMemoryStatusEx mismatch in kernel32.dll::GlobalReAlloc 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 24 PUSH 0x24 68 d0 24 81 7c PUSH 0x7c8124d0 mismatch in kernel32.dll::GlobalSize 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 1c PUSH 0x1c 68 78 4e 83 7c PUSH 0x7c834e78 match in kernel32.dll::GlobalUnWire match in kernel32.dll::GlobalUnfix mismatch in kernel32.dll::GlobalUnlock 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 18 ff 80 7c PUSH 0x7c80ff18 match in kernel32.dll::GlobalWire match in kernel32.dll::Heap32First match in kernel32.dll::Heap32ListFirst match in kernel32.dll::Heap32ListNext match in kernel32.dll::Heap32Next mismatch in kernel32.dll::HeapAlloc 72 72 JB $+0x72 6f OUTSD 72 00 JB $+0x0 4e DEC ESI 54 PUSH ESP 44 INC ESP 4c DEC ESP match in kernel32.dll::HeapCompact match in kernel32.dll::HeapCreate match in kernel32.dll::HeapCreateTagsW match in kernel32.dll::HeapDestroy match in kernel32.dll::HeapExtend mismatch in kernel32.dll::HeapFree 48 DEC EAX 65 61 POPAD 70 00 JO $+0x0 4e DEC ESI 54 PUSH ESP 44 INC ESP 4c DEC ESP match in kernel32.dll::HeapLock match in kernel32.dll::HeapQueryInformation match in kernel32.dll::HeapQueryTagW mismatch in kernel32.dll::HeapReAlloc 48 DEC EAX 65 61 POPAD 70 00 JO $+0x0 4e DEC ESI 54 PUSH ESP 44 INC ESP 4c DEC ESP match in kernel32.dll::HeapSetInformation mismatch in kernel32.dll::HeapSize 48 DEC EAX 65 61 POPAD 70 00 JO $+0x0 4e DEC ESI 54 PUSH ESP 44 INC ESP 4c DEC ESP match in kernel32.dll::HeapSummary match in kernel32.dll::HeapUnlock match in kernel32.dll::HeapUsage match in kernel32.dll::HeapValidate match in kernel32.dll::HeapWalk match in kernel32.dll::InitAtomTable match in kernel32.dll::InitializeCriticalSection match in kernel32.dll::InitializeCriticalSectionAndSpinCount mismatch in kernel32.dll::InitializeSListHead 48 DEC EAX 65 61 POPAD 70 00 JO $+0x0 4e DEC ESI 54 PUSH ESP 44 INC ESP 4c DEC ESP mismatch in kernel32.dll::InterlockedCompareExchange mismatch in kernel32.dll::InterlockedDecrement 04 00 ADD AL,0x0 8d 49 00 LEA ECX,DWORD PTR DS:[ECX+0x0] 8b 4c 24 04 MOV ECX,DWORD PTR SS:[ESP+0x4] b8 ff ff ff ff MOV EAX,0xffffffff f0 0f c1 01 LOCK XADD DWORD PTR DS:[ECX],EAX 48 DEC EAX c2 04 00 RET 0x4 mismatch in kernel32.dll::InterlockedExchange 04 00 ADD AL,0x0 8d 49 00 LEA ECX,DWORD PTR DS:[ECX+0x0] 8b 4c 24 04 MOV ECX,DWORD PTR SS:[ESP+0x4] 8b 54 24 08 MOV EDX,DWORD PTR SS:[ESP+0x8] 8b 01 MOV EAX,DWORD PTR DS:[ECX] f0 0f b1 11 LOCK CMPXCHG DWORD PTR DS:[ECX],EDX 75 fa JNE $+0xfffffffa mismatch in kernel32.dll::InterlockedExchangeAdd 11 c2 ADC EDX,EAX 0c 00 OR AL,0x0 90 NOP 8b 4c 24 04 MOV ECX,DWORD PTR SS:[ESP+0x4] 8b 44 24 08 MOV EAX,DWORD PTR SS:[ESP+0x8] f0 0f c1 01 LOCK XADD DWORD PTR DS:[ECX],EAX c2 08 00 RET 0x8 mismatch in kernel32.dll::InterlockedFlushSList 48 DEC EAX 65 61 POPAD 64 00 4e 54 ADD BYTE PTR FS:[ESI+0x54],CL 44 INC ESP 4c DEC ESP 4c DEC ESP 2e 52 PUSH EDX mismatch in kernel32.dll::InterlockedIncrement 00 5d POP EBP c2 04 00 RET 0x4 8b 4c 24 04 MOV ECX,DWORD PTR SS:[ESP+0x4] b8 01 00 00 00 MOV EAX,0x1 f0 0f c1 01 LOCK XADD DWORD PTR DS:[ECX],EAX 40 INC EAX mismatch in kernel32.dll::InterlockedPopEntrySList 4c DEC ESP 69 73 74 00 4e 54 44 IMUL ESI,DWORD PTR DS:[EBX+0x74],0x44544e00 4c DEC ESP 4c DEC ESP 2e 52 PUSH EDX 74 6c JE $+0x6c 49 DEC ECX mismatch in kernel32.dll::InterlockedPushEntrySList 4c DEC ESP 69 73 74 00 4e 54 44 IMUL ESI,DWORD PTR DS:[EBX+0x74],0x44544e00 4c DEC ESP 4c DEC ESP 2e 52 PUSH EDX 74 6c JE $+0x6c 49 DEC ECX mismatch in kernel32.dll::InvalidateConsoleDIBits 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 ac 00 00 00 PUSH 0xac 68 00 35 87 7c PUSH 0x7c873500 match in kernel32.dll::IsBadCodePtr match in kernel32.dll::IsBadHugeReadPtr match in kernel32.dll::IsBadHugeWritePtr mismatch in kernel32.dll::IsBadReadPtr 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 78 9e 80 7c PUSH 0x7c809e78 mismatch in kernel32.dll::IsBadStringPtrA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 e0 22 83 7c PUSH 0x7c8322e0 mismatch in kernel32.dll::IsBadStringPtrW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 30 a6 80 7c PUSH 0x7c80a630 mismatch in kernel32.dll::IsBadWritePtr 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 f0 9e 80 7c PUSH 0x7c809ef0 match in kernel32.dll::IsDBCSLeadByte match in kernel32.dll::IsDBCSLeadByteEx mismatch in kernel32.dll::IsDebuggerPresent 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 64 a1 18 00 00 00 MOV EAX,DWORD PTR FS:[0x18] 8b 40 30 MOV EAX,DWORD PTR DS:[EAX+0x30] match in kernel32.dll::IsProcessInJob match in kernel32.dll::IsProcessorFeaturePresent mismatch in kernel32.dll::IsSystemResumeAutomatic 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP ff 15 ec 13 80 7c CALL DWORD PTR DS:[0x7c8013ec] 0f b6 c0 MOVZX EAX,AL match in kernel32.dll::IsValidCodePage match in kernel32.dll::IsValidLanguageGroup match in kernel32.dll::IsValidLocale match in kernel32.dll::IsValidUILanguage match in kernel32.dll::IsWow64Process match in kernel32.dll::LCMapStringA match in kernel32.dll::LCMapStringW match in kernel32.dll::LZClose match in kernel32.dll::LZCloseFile match in kernel32.dll::LZCopy match in kernel32.dll::LZCreateFileW mismatch in kernel32.dll::LZDone 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 8b c0 MOV EAX,EAX c3 RET match in kernel32.dll::LZInit match in kernel32.dll::LZOpenFileA match in kernel32.dll::LZOpenFileW match in kernel32.dll::LZRead match in kernel32.dll::LZSeek mismatch in kernel32.dll::LZStart 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 33 c0 XOR EAX,EAX 40 INC EAX mismatch in kernel32.dll::LeaveCriticalSection 4c DEC ESP 69 73 74 00 4e 54 44 IMUL ESI,DWORD PTR DS:[EBX+0x74],0x44544e00 4c DEC ESP 4c DEC ESP 2e 52 PUSH EDX 74 6c JE $+0x6c 4c DEC ESP match in kernel32.dll::LoadLibraryA match in kernel32.dll::LoadLibraryExA mismatch in kernel32.dll::LoadLibraryExW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 34 PUSH 0x34 68 68 e0 80 7c PUSH 0x7c80e068 match in kernel32.dll::LoadLibraryW mismatch in kernel32.dll::LoadModule 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 a4 00 00 00 PUSH 0xa4 68 a8 19 86 7c PUSH 0x7c8619a8 mismatch in kernel32.dll::LoadResource 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 08 a0 80 7c PUSH 0x7c80a008 mismatch in kernel32.dll::LocalAlloc 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 1c PUSH 0x1c 68 08 9a 80 7c PUSH 0x7c809a08 mismatch in kernel32.dll::LocalCompact 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 00 PUSH 0x0 ff 35 a4 43 88 7c PUSH DWORD PTR DS:[0x7c8843a4] match in kernel32.dll::LocalFileTimeToFileTime mismatch in kernel32.dll::LocalFlags 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 1c PUSH 0x1c 68 88 5c 85 7c PUSH 0x7c855c88 mismatch in kernel32.dll::LocalFree 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 80 99 80 7c PUSH 0x7c809980 mismatch in kernel32.dll::LocalHandle 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 30 5d 85 7c PUSH 0x7c855d30 mismatch in kernel32.dll::LocalLock 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 e8 2e 83 7c PUSH 0x7c832ee8 mismatch in kernel32.dll::LocalReAlloc 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 20 PUSH 0x20 68 f0 09 83 7c PUSH 0x7c8309f0 mismatch in kernel32.dll::LocalShrink 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 00 PUSH 0x0 ff 35 a4 43 88 7c PUSH DWORD PTR DS:[0x7c8843a4] mismatch in kernel32.dll::LocalSize 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 1c PUSH 0x1c 68 a0 26 83 7c PUSH 0x7c8326a0 mismatch in kernel32.dll::LocalUnlock 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 80 2f 83 7c PUSH 0x7c832f80 match in kernel32.dll::LockFile match in kernel32.dll::LockFileEx match in kernel32.dll::LockResource match in kernel32.dll::MapUserPhysicalPages match in kernel32.dll::MapUserPhysicalPagesScatter match in kernel32.dll::MapViewOfFile match in kernel32.dll::MapViewOfFileEx match in kernel32.dll::Module32First match in kernel32.dll::Module32FirstW match in kernel32.dll::Module32Next match in kernel32.dll::Module32NextW match in kernel32.dll::MoveFileA match in kernel32.dll::MoveFileExA match in kernel32.dll::MoveFileExW match in kernel32.dll::MoveFileW match in kernel32.dll::MoveFileWithProgressA mismatch in kernel32.dll::MoveFileWithProgressW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 9c 00 00 00 PUSH 0x9c 68 50 f9 81 7c PUSH 0x7c81f950 mismatch in kernel32.dll::MulDiv 01 c2 ADD EDX,EAX 08 00 OR BYTE PTR DS:[EAX],AL 90 NOP 8b 44 24 04 MOV EAX,DWORD PTR SS:[ESP+0x4] 0b c0 OR EAX,EAX 78 38 JS $+0x38 8b 54 24 08 MOV EDX,DWORD PTR SS:[ESP+0x8] match in kernel32.dll::MultiByteToWideChar match in kernel32.dll::NlsConvertIntegerToString mismatch in kernel32.dll::NlsGetCacheUpdateCount 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP a1 d8 46 88 7c MOV EAX,DWORD PTR DS:[0x7c8846d8] 8b 80 6c 18 00 00 MOV EAX,DWORD PTR DS:[EAX+0x186c] mismatch in kernel32.dll::NlsResetProcessLocale 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 64 a1 18 00 00 00 MOV EAX,DWORD PTR FS:[0x18] 83 b8 9c 0f 00 00 00 CMP DWORD PTR DS:[EAX+0xf9c],0x0 match in kernel32.dll::NumaVirtualQueryNode mismatch in kernel32.dll::OpenConsoleW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 0c PUSH 0xc 68 90 10 81 7c PUSH 0x7c811090 match in kernel32.dll::OpenDataFile match in kernel32.dll::OpenEventA match in kernel32.dll::OpenEventW mismatch in kernel32.dll::OpenFile 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 04 01 00 00 PUSH 0x104 68 d8 1a 82 7c PUSH 0x7c821ad8 match in kernel32.dll::OpenFileMappingA match in kernel32.dll::OpenFileMappingW match in kernel32.dll::OpenJobObjectA match in kernel32.dll::OpenJobObjectW match in kernel32.dll::OpenMutexA match in kernel32.dll::OpenMutexW match in kernel32.dll::OpenProcess match in kernel32.dll::OpenProfileUserMapping match in kernel32.dll::OpenSemaphoreA match in kernel32.dll::OpenSemaphoreW match in kernel32.dll::OpenThread match in kernel32.dll::OpenWaitableTimerA match in kernel32.dll::OpenWaitableTimerW mismatch in kernel32.dll::OutputDebugStringA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 34 02 00 00 PUSH 0x234 68 30 a2 85 7c PUSH 0x7c85a230 match in kernel32.dll::OutputDebugStringW match in kernel32.dll::PeekConsoleInputA match in kernel32.dll::PeekConsoleInputW mismatch in kernel32.dll::PeekNamedPipe 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 88 fc 85 7c PUSH 0x7c85fc88 match in kernel32.dll::PostQueuedCompletionStatus match in kernel32.dll::PrepareTape mismatch in kernel32.dll::PrivCopyFileExW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 d0 00 82 7c PUSH 0x7c8200d0 mismatch in kernel32.dll::PrivMoveFileIdentityW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 c8 00 00 00 PUSH 0xc8 68 f0 d4 85 7c PUSH 0x7c85d4f0 match in kernel32.dll::Process32First match in kernel32.dll::Process32FirstW match in kernel32.dll::Process32Next match in kernel32.dll::Process32NextW match in kernel32.dll::ProcessIdToSessionId match in kernel32.dll::PulseEvent match in kernel32.dll::PurgeComm match in kernel32.dll::QueryActCtxW mismatch in kernel32.dll::QueryDepthSList 74 69 JE $+0x69 6f OUTSD 6e OUTSB 00 4e DEC ESI 54 PUSH ESP 44 INC ESP match in kernel32.dll::QueryDosDeviceA mismatch in kernel32.dll::QueryDosDeviceW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 88 00 00 00 PUSH 0x88 68 00 1f 82 7c PUSH 0x7c821f00 match in kernel32.dll::QueryInformationJobObject match in kernel32.dll::QueryMemoryResourceNotification match in kernel32.dll::QueryPerformanceCounter match in kernel32.dll::QueryPerformanceFrequency match in kernel32.dll::QueryWin31IniFilesMappedToRegistry match in kernel32.dll::QueueUserAPC match in kernel32.dll::QueueUserWorkItem match in kernel32.dll::RaiseException match in kernel32.dll::ReadConsoleA match in kernel32.dll::ReadConsoleInputA match in kernel32.dll::ReadConsoleInputExA match in kernel32.dll::ReadConsoleInputExW match in kernel32.dll::ReadConsoleInputW match in kernel32.dll::ReadConsoleOutputA match in kernel32.dll::ReadConsoleOutputAttribute match in kernel32.dll::ReadConsoleOutputCharacterA match in kernel32.dll::ReadConsoleOutputCharacterW match in kernel32.dll::ReadConsoleOutputW match in kernel32.dll::ReadConsoleW match in kernel32.dll::ReadDirectoryChangesW mismatch in kernel32.dll::ReadFile 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 20 PUSH 0x20 68 b8 9b 80 7c PUSH 0x7c809bb8 match in kernel32.dll::ReadFileEx mismatch in kernel32.dll::ReadFileScatter 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 50 de 82 7c PUSH 0x7c82de50 match in kernel32.dll::ReadProcessMemory match in kernel32.dll::RegisterConsoleIME match in kernel32.dll::RegisterConsoleOS2 mismatch in kernel32.dll::RegisterConsoleVDM 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 b8 00 00 00 PUSH 0xb8 68 38 1e 87 7c PUSH 0x7c871e38 match in kernel32.dll::RegisterWaitForInputIdle match in kernel32.dll::RegisterWaitForSingleObject match in kernel32.dll::RegisterWaitForSingleObjectEx match in kernel32.dll::RegisterWowBaseHandlers match in kernel32.dll::RegisterWowExec match in kernel32.dll::ReleaseActCtx match in kernel32.dll::ReleaseMutex match in kernel32.dll::ReleaseSemaphore match in kernel32.dll::RemoveDirectoryA match in kernel32.dll::RemoveDirectoryW match in kernel32.dll::RemoveLocalAlternateComputerNameA match in kernel32.dll::RemoveLocalAlternateComputerNameW mismatch in kernel32.dll::RemoveVectoredExceptionHandler 4c DEC ESP 69 73 74 00 4e 54 44 IMUL ESI,DWORD PTR DS:[EBX+0x74],0x44544e00 4c DEC ESP 4c DEC ESP 2e 52 PUSH EDX 74 6c JE $+0x6c 52 PUSH EDX mismatch in kernel32.dll::ReplaceFile 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 ec 03 00 00 PUSH 0x3ec 68 90 6e 83 7c PUSH 0x7c836e90 match in kernel32.dll::ReplaceFileA mismatch in kernel32.dll::ReplaceFileW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 ec 03 00 00 PUSH 0x3ec 68 90 6e 83 7c PUSH 0x7c836e90 match in kernel32.dll::RequestDeviceWakeup match in kernel32.dll::RequestWakeupLatency match in kernel32.dll::ResetEvent match in kernel32.dll::ResetWriteWatch mismatch in kernel32.dll::RestoreLastError 64 6c INSSB 65 72 00 JB $+0x0 4e DEC ESI 54 PUSH ESP 44 INC ESP 4c DEC ESP 4c DEC ESP match in kernel32.dll::ResumeThread mismatch in kernel32.dll::RtlCaptureContext 72 72 JB $+0x72 6f OUTSD 72 00 JB $+0x0 4e DEC ESI 54 PUSH ESP 44 INC ESP 4c DEC ESP mismatch in kernel32.dll::RtlCaptureStackBackTrace 74 65 JE $+0x65 78 74 JS $+0x74 00 4e DEC ESI 54 PUSH ESP 44 INC ESP 4c DEC ESP mismatch in kernel32.dll::RtlFillMemory 72 61 JB $+0x61 63 65 00 ARPL WORD PTR DS:[EBP+0x0],SP 4e DEC ESI 54 PUSH ESP 44 INC ESP 4c DEC ESP 4c DEC ESP mismatch in kernel32.dll::RtlMoveMemory 6d INSSD 6f OUTSD 72 79 JB $+0x79 00 4e DEC ESI 54 PUSH ESP 44 INC ESP mismatch in kernel32.dll::RtlUnwind 6d INSSD 6f OUTSD 72 79 JB $+0x79 00 4e DEC ESI 54 PUSH ESP 44 INC ESP mismatch in kernel32.dll::RtlZeroMemory 77 69 JNBE $+0x69 6e OUTSB 64 00 4e 54 ADD BYTE PTR FS:[ESI+0x54],CL 44 INC ESP 4c DEC ESP 4c DEC ESP 2e 52 PUSH EDX match in kernel32.dll::ScrollConsoleScreenBufferA match in kernel32.dll::ScrollConsoleScreenBufferW match in kernel32.dll::SearchPathA match in kernel32.dll::SearchPathW match in kernel32.dll::SetCPGlobal match in kernel32.dll::SetCalendarInfoA match in kernel32.dll::SetCalendarInfoW match in kernel32.dll::SetClientTimeZoneInformation match in kernel32.dll::SetComPlusPackageInstallStatus match in kernel32.dll::SetCommBreak match in kernel32.dll::SetCommConfig match in kernel32.dll::SetCommMask match in kernel32.dll::SetCommState match in kernel32.dll::SetCommTimeouts match in kernel32.dll::SetComputerNameA match in kernel32.dll::SetComputerNameExA match in kernel32.dll::SetComputerNameExW match in kernel32.dll::SetComputerNameW match in kernel32.dll::SetConsoleActiveScreenBuffer match in kernel32.dll::SetConsoleCP match in kernel32.dll::SetConsoleCommandHistoryMode match in kernel32.dll::SetConsoleCtrlHandler match in kernel32.dll::SetConsoleCursor mismatch in kernel32.dll::SetConsoleCursorInfo 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 ac 00 00 00 PUSH 0xac 68 70 3f 87 7c PUSH 0x7c873f70 match in kernel32.dll::SetConsoleCursorMode match in kernel32.dll::SetConsoleCursorPosition mismatch in kernel32.dll::SetConsoleDisplayMode 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 ac 00 00 00 PUSH 0xac 68 e8 23 87 7c PUSH 0x7c8723e8 match in kernel32.dll::SetConsoleFont match in kernel32.dll::SetConsoleHardwareState match in kernel32.dll::SetConsoleIcon match in kernel32.dll::SetConsoleInputExeNameA mismatch in kernel32.dll::SetConsoleInputExeNameW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 08 PUSH 0x8 68 c0 b3 81 7c PUSH 0x7c81b3c0 match in kernel32.dll::SetConsoleKeyShortcuts match in kernel32.dll::SetConsoleLocalEUDC mismatch in kernel32.dll::SetConsoleMaximumWindowSize 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 33 c0 XOR EAX,EAX 40 INC EAX match in kernel32.dll::SetConsoleMenuClose match in kernel32.dll::SetConsoleMode match in kernel32.dll::SetConsoleNlsMode match in kernel32.dll::SetConsoleNumberOfCommandsA match in kernel32.dll::SetConsoleNumberOfCommandsW match in kernel32.dll::SetConsoleOS2OemFormat match in kernel32.dll::SetConsoleOutputCP match in kernel32.dll::SetConsolePalette match in kernel32.dll::SetConsoleScreenBufferSize match in kernel32.dll::SetConsoleTextAttribute mismatch in kernel32.dll::SetConsoleTitleA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 0c PUSH 0xc 68 f0 0c 87 7c PUSH 0x7c870cf0 mismatch in kernel32.dll::SetConsoleTitleW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 0c PUSH 0xc 68 08 da 82 7c PUSH 0x7c82da08 mismatch in kernel32.dll::SetConsoleWindowInfo 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 ac 00 00 00 PUSH 0xac 68 40 40 87 7c PUSH 0x7c874040 mismatch in kernel32.dll::SetCriticalSectionSpinCount 6d INSSD 6f OUTSD 72 79 JB $+0x79 00 4e DEC ESI 54 PUSH ESP 44 INC ESP match in kernel32.dll::SetCurrentDirectoryA match in kernel32.dll::SetCurrentDirectoryW mismatch in kernel32.dll::SetDefaultCommConfigA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 20 PUSH 0x20 68 d0 6e 86 7c PUSH 0x7c866ed0 mismatch in kernel32.dll::SetDefaultCommConfigW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 20 PUSH 0x20 68 f0 6d 86 7c PUSH 0x7c866df0 match in kernel32.dll::SetDllDirectoryA match in kernel32.dll::SetDllDirectoryW match in kernel32.dll::SetEndOfFile match in kernel32.dll::SetEnvironmentVariableA match in kernel32.dll::SetEnvironmentVariableW match in kernel32.dll::SetErrorMode match in kernel32.dll::SetEvent mismatch in kernel32.dll::SetFileApisToANSI 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP c7 05 e0 46 88 7c 01 00 00 00 MOV DWORD PTR DS:[0x7c8846e0],0x1 c3 RET mismatch in kernel32.dll::SetFileApisToOEM 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 83 25 e0 46 88 7c 00 AND DWORD PTR DS:[0x7c8846e0],0x0 c3 RET match in kernel32.dll::SetFileAttributesA match in kernel32.dll::SetFileAttributesW match in kernel32.dll::SetFilePointer match in kernel32.dll::SetFilePointerEx match in kernel32.dll::SetFileShortNameA match in kernel32.dll::SetFileShortNameW match in kernel32.dll::SetFileTime match in kernel32.dll::SetFileValidData match in kernel32.dll::SetFirmwareEnvironmentVariableA match in kernel32.dll::SetFirmwareEnvironmentVariableW mismatch in kernel32.dll::SetHandleContext 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 78 PUSH 0x78 e8 49 7e fe ff CALL $+0xfffe7e49 match in kernel32.dll::SetHandleCount match in kernel32.dll::SetHandleInformation match in kernel32.dll::SetInformationJobObject mismatch in kernel32.dll::SetLastConsoleEventActive 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP c7 05 a8 6b 88 7c 01 00 00 00 MOV DWORD PTR DS:[0x7c886ba8],0x1 eb aa JMP SHORT $+0xffffffaa mismatch in kernel32.dll::SetLastError 6f OUTSD 75 6e JNE $+0x6e 74 00 JE $+0x0 4e DEC ESI 54 PUSH ESP 44 INC ESP 4c DEC ESP match in kernel32.dll::SetLocalPrimaryComputerNameA match in kernel32.dll::SetLocalPrimaryComputerNameW match in kernel32.dll::SetLocalTime match in kernel32.dll::SetLocaleInfoA match in kernel32.dll::SetLocaleInfoW match in kernel32.dll::SetMailslotInfo mismatch in kernel32.dll::SetMessageWaitingIndicator 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 02 00 00 c0 PUSH 0xc0000002 e8 9e 85 fa ff CALL $+0xfffa859e match in kernel32.dll::SetNamedPipeHandleState match in kernel32.dll::SetPriorityClass match in kernel32.dll::SetProcessAffinityMask match in kernel32.dll::SetProcessPriorityBoost match in kernel32.dll::SetProcessShutdownParameters match in kernel32.dll::SetProcessWorkingSetSize match in kernel32.dll::SetSearchPathMode match in kernel32.dll::SetStdHandle match in kernel32.dll::SetSystemPowerState match in kernel32.dll::SetSystemTime match in kernel32.dll::SetSystemTimeAdjustment match in kernel32.dll::SetTapeParameters match in kernel32.dll::SetTapePosition match in kernel32.dll::SetTermsrvAppInstallMode match in kernel32.dll::SetThreadAffinityMask match in kernel32.dll::SetThreadContext match in kernel32.dll::SetThreadExecutionState match in kernel32.dll::SetThreadIdealProcessor match in kernel32.dll::SetThreadLocale match in kernel32.dll::SetThreadPriority match in kernel32.dll::SetThreadPriorityBoost match in kernel32.dll::SetThreadUILanguage match in kernel32.dll::SetTimeZoneInformation match in kernel32.dll::SetTimerQueueTimer match in kernel32.dll::SetUnhandledExceptionFilter match in kernel32.dll::SetUserGeoID mismatch in kernel32.dll::SetVDMCurrentDirectories 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 d4 00 00 00 PUSH 0xd4 68 28 7a 86 7c PUSH 0x7c867a28 match in kernel32.dll::SetVolumeLabelA mismatch in kernel32.dll::SetVolumeLabelW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 64 02 00 00 PUSH 0x264 68 20 0a 86 7c PUSH 0x7c860a20 match in kernel32.dll::SetVolumeMountPointA match in kernel32.dll::SetVolumeMountPointW match in kernel32.dll::SetWaitableTimer match in kernel32.dll::SetupComm match in kernel32.dll::ShowConsoleCursor mismatch in kernel32.dll::SignalObjectAndWait 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 34 PUSH 0x34 68 90 67 83 7c PUSH 0x7c836790 mismatch in kernel32.dll::SizeofResource 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 c0 bc 80 7c PUSH 0x7c80bcc0 match in kernel32.dll::Sleep mismatch in kernel32.dll::SleepEx 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 2c PUSH 0x2c 68 58 24 80 7c PUSH 0x7c802458 match in kernel32.dll::SuspendThread mismatch in kernel32.dll::SwitchToFiber 00 00 90 NOP 8b ff MOV EDI,EDI 64 8b 15 18 00 00 00 MOV EDX,DWORD PTR FS:[0x18] 8b 42 10 MOV EAX,DWORD PTR DS:[EDX+0x10] 8b cc MOV ECX,ESP mismatch in kernel32.dll::SwitchToThread 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP ff 15 24 15 80 7c CALL DWORD PTR DS:[0x7c801524] 33 c9 XOR ECX,ECX match in kernel32.dll::SystemTimeToFileTime match in kernel32.dll::SystemTimeToTzSpecificLocalTime match in kernel32.dll::TerminateJobObject match in kernel32.dll::TerminateProcess match in kernel32.dll::TerminateThread mismatch in kernel32.dll::TermsrvAppInstallMode 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 8b 0d 3c 40 88 7c MOV ECX,DWORD PTR DS:[0x7c88403c] 33 c0 XOR EAX,EAX match in kernel32.dll::Thread32First match in kernel32.dll::Thread32Next mismatch in kernel32.dll::TlsAlloc 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 10 2e 81 7c PUSH 0x7c812e10 mismatch in kernel32.dll::TlsFree 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 70 37 81 7c PUSH 0x7c813770 match in kernel32.dll::TlsGetValue match in kernel32.dll::TlsSetValue match in kernel32.dll::Toolhelp32ReadProcessMemory mismatch in kernel32.dll::TransactNamedPipe 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 88 13 83 7c PUSH 0x7c831388 match in kernel32.dll::TransmitCommChar match in kernel32.dll::TrimVirtualBuffer mismatch in kernel32.dll::TryEnterCriticalSection 72 72 JB $+0x72 6f OUTSD 72 00 JB $+0x0 4e DEC ESI 54 PUSH ESP 44 INC ESP 4c DEC ESP match in kernel32.dll::TzSpecificLocalTimeToSystemTime match in kernel32.dll::UTRegister mismatch in kernel32.dll::UTUnRegister 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP c2 04 00 RET 0x4 90 NOP mismatch in kernel32.dll::UnhandledExceptionFilter 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 74 06 00 00 PUSH 0x674 68 58 3b 86 7c PUSH 0x7c863b58 match in kernel32.dll::UnlockFile match in kernel32.dll::UnlockFileEx match in kernel32.dll::UnmapViewOfFile mismatch in kernel32.dll::UnregisterConsoleIME 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP e8 85 49 f9 ff CALL $+0xfff94985 50 PUSH EAX match in kernel32.dll::UnregisterWait match in kernel32.dll::UnregisterWaitEx match in kernel32.dll::UpdateResourceA match in kernel32.dll::UpdateResourceW mismatch in kernel32.dll::VDMConsoleOperation 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 b8 00 00 00 PUSH 0xb8 68 68 59 87 7c PUSH 0x7c875968 match in kernel32.dll::VDMOperationStarted match in kernel32.dll::ValidateLCType match in kernel32.dll::ValidateLocale match in kernel32.dll::VerLanguageNameA match in kernel32.dll::VerLanguageNameW mismatch in kernel32.dll::VerSetConditionMask 74 69 JE $+0x69 6f OUTSD 6e OUTSB 00 4e DEC ESI 54 PUSH ESP 44 INC ESP match in kernel32.dll::VerifyConsoleIoHandle match in kernel32.dll::VerifyVersionInfoA match in kernel32.dll::VerifyVersionInfoW match in kernel32.dll::VirtualAlloc mismatch in kernel32.dll::VirtualAllocEx 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 d0 9a 80 7c PUSH 0x7c809ad0 match in kernel32.dll::VirtualBufferExceptionHandler match in kernel32.dll::VirtualFree match in kernel32.dll::VirtualFreeEx match in kernel32.dll::VirtualLock match in kernel32.dll::VirtualProtect match in kernel32.dll::VirtualProtectEx match in kernel32.dll::VirtualQuery match in kernel32.dll::VirtualQueryEx match in kernel32.dll::VirtualUnlock mismatch in kernel32.dll::WTSGetActiveConsoleSessionId 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP a1 d8 02 fe 7f MOV EAX,DWORD PTR DS:[0x7ffe02d8] c3 RET match in kernel32.dll::WaitCommEvent match in kernel32.dll::WaitForDebugEvent match in kernel32.dll::WaitForMultipleObjects mismatch in kernel32.dll::WaitForMultipleObjectsEx 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 64 PUSH 0x64 68 f0 95 80 7c PUSH 0x7c8095f0 match in kernel32.dll::WaitForSingleObject mismatch in kernel32.dll::WaitForSingleObjectEx 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 34 PUSH 0x34 68 f8 25 80 7c PUSH 0x7c8025f8 match in kernel32.dll::WaitNamedPipeA match in kernel32.dll::WaitNamedPipeW match in kernel32.dll::WideCharToMultiByte match in kernel32.dll::WinExec match in kernel32.dll::WriteConsoleA match in kernel32.dll::WriteConsoleInputA match in kernel32.dll::WriteConsoleInputVDMA match in kernel32.dll::WriteConsoleInputVDMW match in kernel32.dll::WriteConsoleInputW match in kernel32.dll::WriteConsoleOutputA match in kernel32.dll::WriteConsoleOutputAttribute match in kernel32.dll::WriteConsoleOutputCharacterA match in kernel32.dll::WriteConsoleOutputCharacterW match in kernel32.dll::WriteConsoleOutputW match in kernel32.dll::WriteConsoleW mismatch in kernel32.dll::WriteFile 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 30 0e 81 7c PUSH 0x7c810e30 match in kernel32.dll::WriteFileEx mismatch in kernel32.dll::WriteFileGather 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 50 de 82 7c PUSH 0x7c82de50 match in kernel32.dll::WritePrivateProfileSectionA match in kernel32.dll::WritePrivateProfileSectionW match in kernel32.dll::WritePrivateProfileStringA match in kernel32.dll::WritePrivateProfileStringW match in kernel32.dll::WritePrivateProfileStructA match in kernel32.dll::WritePrivateProfileStructW match in kernel32.dll::WriteProcessMemory match in kernel32.dll::WriteProfileSectionA match in kernel32.dll::WriteProfileSectionW match in kernel32.dll::WriteProfileStringA match in kernel32.dll::WriteProfileStringW match in kernel32.dll::WriteTapemark match in kernel32.dll::ZombifyActCtx match in kernel32.dll::_hread match in kernel32.dll::_hwrite match in kernel32.dll::_lclose match in kernel32.dll::_lcreat match in kernel32.dll::_llseek match in kernel32.dll::_lopen match in kernel32.dll::_lread match in kernel32.dll::_lwrite mismatch in kernel32.dll::lstrcat 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 08 PUSH 0x8 68 d8 4d 83 7c PUSH 0x7c834dd8 mismatch in kernel32.dll::lstrcatA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 08 PUSH 0x8 68 d8 4d 83 7c PUSH 0x7c834dd8 mismatch in kernel32.dll::lstrcatW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 08 PUSH 0x8 68 70 0f 81 7c PUSH 0x7c810f70 match in kernel32.dll::lstrcmp match in kernel32.dll::lstrcmpA match in kernel32.dll::lstrcmpW match in kernel32.dll::lstrcmpi match in kernel32.dll::lstrcmpiA match in kernel32.dll::lstrcmpiW mismatch in kernel32.dll::lstrcpy 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 08 PUSH 0x8 68 40 be 80 7c PUSH 0x7c80be40 mismatch in kernel32.dll::lstrcpyA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 08 PUSH 0x8 68 40 be 80 7c PUSH 0x7c80be40 mismatch in kernel32.dll::lstrcpyW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 08 PUSH 0x8 68 a0 ba 80 7c PUSH 0x7c80baa0 mismatch in kernel32.dll::lstrcpyn 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 60 01 81 7c PUSH 0x7c810160 mismatch in kernel32.dll::lstrcpynA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 60 01 81 7c PUSH 0x7c810160 mismatch in kernel32.dll::lstrcpynW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 48 ba 80 7c PUSH 0x7c80ba48 mismatch in kernel32.dll::lstrlen 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 08 PUSH 0x8 68 00 be 80 7c PUSH 0x7c80be00 mismatch in kernel32.dll::lstrlenA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 08 PUSH 0x8 68 00 be 80 7c PUSH 0x7c80be00 mismatch in kernel32.dll::lstrlenW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 08 PUSH 0x8 68 50 9a 80 7c PUSH 0x7c809a50 mismatch in msvcrt.dll::$I10_OUTPUT cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::??0__non_rtti_object@@QAE@ABV0@@Z cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::??0__non_rtti_object@@QAE@PBD@Z cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::??0bad_cast@@AAE@PBQBD@Z cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::??0bad_cast@@QAE@ABQBD@Z cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::??0bad_cast@@QAE@ABV0@@Z cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::??0bad_cast@@QAE@PBD@Z cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::??0bad_typeid@@QAE@ABV0@@Z cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::??0bad_typeid@@QAE@PBD@Z cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::??0exception@@QAE@ABQBD@Z cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::??0exception@@QAE@ABV0@@Z cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b c1 MOV EAX,ECX 83 60 04 00 AND DWORD PTR DS:[EAX+0x4],0x0 mismatch in msvcrt.dll::??0exception@@QAE@XZ cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 c7 01 ec 13 bc 77 MOV DWORD PTR DS:[ECX],0x77bc13ec e9 c8 fe ff ff JMP $+0xfffffec8 mismatch in msvcrt.dll::??1__non_rtti_object@@UAE@XZ cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 c7 01 e0 13 bc 77 MOV DWORD PTR DS:[ECX],0x77bc13e0 e9 83 ff ff ff JMP $+0xffffff83 mismatch in msvcrt.dll::??1bad_cast@@UAE@XZ cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 c7 01 ec 13 bc 77 MOV DWORD PTR DS:[ECX],0x77bc13ec e9 c8 fe ff ff JMP $+0xfffffec8 mismatch in msvcrt.dll::??1bad_typeid@@UAE@XZ cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 83 79 08 00 CMP DWORD PTR DS:[ECX+0x8],0x0 c7 01 c0 13 bc 77 MOV DWORD PTR DS:[ECX],0x77bc13c0 mismatch in msvcrt.dll::??1exception@@UAE@XZ cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 56 PUSH ESI mismatch in msvcrt.dll::??1type_info@@UAE@XZ cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::??2@YAPAXI@Z cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::??3@YAXPAX@Z cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::??4__non_rtti_object@@QAEAAV0@ABV0@@Z cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::??4bad_cast@@QAEAAV0@ABV0@@Z cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::??4bad_typeid@@QAEAAV0@ABV0@@Z cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::??4exception@@QAEAAV0@ABV0@@Z cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::??8type_info@@QBEHABV0@@Z cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::??9type_info@@QBEHABV0@@Z 77 58 JNBE $+0x58 b9 bc 77 8f 17 MOV ECX,0x178f77bc bd 77 5b 15 bd MOV EBP,0xbd155b77 77 62 JNBE $+0x62 61 POPAD 64 20 63 61 AND BYTE PTR FS:[EBX+0x61],AH 73 74 JNB $+0x74 mismatch in msvcrt.dll::??_7__non_rtti_object@@6B@ 00 c4 b8 bc 77 2c 17 LES EDI,FWORD PTR DS:[EAX+0x172c77bc] bd 77 5b 15 bd MOV EBP,0xbd155b77 77 0c JNBE $+0xc b9 bc 77 8f 17 MOV ECX,0x178f77bc bd 77 5b 15 bd MOV EBP,0xbd155b77 77 58 JNBE $+0x58 mismatch in msvcrt.dll::??_7bad_cast@@6B@ 77 0c JNBE $+0xc b9 bc 77 8f 17 MOV ECX,0x178f77bc bd 77 5b 15 bd MOV EBP,0xbd155b77 77 58 JNBE $+0x58 b9 bc 77 8f 17 MOV ECX,0x178f77bc bd 77 5b 15 bd MOV EBP,0xbd155b77 77 62 JNBE $+0x62 mismatch in msvcrt.dll::??_7bad_typeid@@6B@ 00 7c b8 JL $+0xffffffb8 bc 77 a3 16 bd MOV ESP,0xbd16a377 77 5b JNBE $+0x5b 15 bd 77 55 6e ADC EAX,0x6e5577bd 6b 6e 6f 77 IMUL EBP,DWORD PTR DS:[ESI+0x6f],0x77 6e OUTSB mismatch in msvcrt.dll::??_7exception@@6B@ cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::??_E__non_rtti_object@@UAEPAXI@Z cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::??_Ebad_cast@@UAEPAXI@Z cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::??_Ebad_typeid@@UAEPAXI@Z cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::??_Eexception@@UAEPAXI@Z cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 68 00 14 bc 77 PUSH 0x77bc1400 e8 6d fe ff ff CALL $+0xfffffe6d mismatch in msvcrt.dll::??_Fbad_cast@@QAEXXZ cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 68 0c 14 bc 77 PUSH 0x77bc140c e8 5b fe ff ff CALL $+0xfffffe5b mismatch in msvcrt.dll::??_Fbad_typeid@@QAEXXZ cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::??_G__non_rtti_object@@UAEPAXI@Z cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::??_Gbad_cast@@UAEPAXI@Z cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::??_Gbad_typeid@@UAEPAXI@Z cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::??_Gexception@@UAEPAXI@Z cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::??_U@YAPAXI@Z cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::??_V@YAXPAX@Z cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 e8 6f 83 01 00 CALL $+0x1836f 33 c9 XOR ECX,ECX mismatch in msvcrt.dll::?_query_new_handler@@YAP6AHI@ZXZ cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 a1 00 18 c1 77 MOV EAX,DWORD PTR DS:[0x77c11800] c3 RET mismatch in msvcrt.dll::?_query_new_mode@@YAHXZ cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 a1 08 18 c1 77 MOV EAX,DWORD PTR DS:[0x77c11808] c3 RET mismatch in msvcrt.dll::?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::?_set_new_mode@@YAHH@Z cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::?before@type_info@@QBEHABV1@@Z cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::?name@type_info@@QBEPBDXZ cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 56 PUSH ESI mismatch in msvcrt.dll::?raw_name@type_info@@QBEPBDXZ cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8d 41 08 LEA EAX,DWORD PTR DS:[ECX+0x8] c3 RET mismatch in msvcrt.dll::?set_new_handler@@YAP6AXXZP6AXXZ@Z cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 00 PUSH 0x0 e8 67 ff ff ff CALL $+0xffffff67 mismatch in msvcrt.dll::?set_terminate@@YAP6AXXZP6AXXZ@Z cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::?set_unexpected@@YAP6AXXZP6AXXZ@Z cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::?terminate@@YAXXZ cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 08 PUSH 0x8 68 80 14 bc 77 PUSH 0x77bc1480 mismatch in msvcrt.dll::?unexpected@@YAXXZ cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 e8 79 78 01 00 CALL $+0x17879 83 78 70 00 CMP DWORD PTR DS:[EAX+0x70],0x0 mismatch in msvcrt.dll::?what@exception@@UBEPBDXZ cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b 41 04 MOV EAX,DWORD PTR DS:[ECX+0x4] 85 c0 TEST EAX,EAX mismatch in msvcrt.dll::_CIacos cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_CIasin cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 83 ec 0c SUB ESP,0xc mismatch in msvcrt.dll::_CIatan cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 83 ec 0c SUB ESP,0xc mismatch in msvcrt.dll::_CIatan2 59 POP ECX 41 INC ECX 00 00 90 NOP 83 3d c0 37 c1 77 00 CMP DWORD PTR DS:[0x77c137c0],0x0 74 32 JE $+0x32 mismatch in msvcrt.dll::_CIcos e9 81 44 00 00 JMP $+0x4481 ba 30 0c c1 77 MOV EDX,0x77c10c30 e9 fc 43 00 00 JMP $+0x43fc cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 mismatch in msvcrt.dll::_CIcosh cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 83 ec 0c SUB ESP,0xc mismatch in msvcrt.dll::_CIexp e9 4c 43 00 00 JMP $+0x434c ba aa 0c c1 77 MOV EDX,0x77c10caa eb f4 JMP SHORT $+0xfffffff4 ba ca 0c c1 77 MOV EDX,0x77c10cca eb ed JMP SHORT $+0xffffffed cc INT 0x3 cc INT 0x3 mismatch in msvcrt.dll::_CIfmod 6d INSSD 46 INC ESI 00 00 90 NOP 83 3d c0 37 c1 77 00 CMP DWORD PTR DS:[0x77c137c0],0x0 74 3c JE $+0x3c mismatch in msvcrt.dll::_CIlog e9 d1 42 00 00 JMP $+0x42d1 ba 40 04 c1 77 MOV EDX,0x77c10440 e9 4c 42 00 00 JMP $+0x424c mismatch in msvcrt.dll::_CIlog10 79 4a JNS $+0x4a 00 00 90 NOP 83 3d c0 37 c1 77 00 CMP DWORD PTR DS:[0x77c137c0],0x0 74 32 JE $+0x32 83 ec 08 SUB ESP,0x8 mismatch in msvcrt.dll::_CIpow 99 CDQ 4b DEC EBX 00 00 90 NOP 83 3d c0 37 c1 77 00 CMP DWORD PTR DS:[0x77c137c0],0x0 74 32 JE $+0x32 mismatch in msvcrt.dll::_CIsin mismatch in msvcrt.dll::_CIsinh cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 83 ec 0c SUB ESP,0xc mismatch in msvcrt.dll::_CIsqrt 0c c1 OR AL,0xc1 77 eb JNBE $+0xffffffeb ed IN EAX,DX ba 8a 0c c1 77 MOV EDX,0x77c10c8a e9 4c 43 00 00 JMP $+0x434c ba aa 0c c1 77 MOV EDX,0x77c10caa eb f4 JMP SHORT $+0xfffffff4 mismatch in msvcrt.dll::_CItan cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 83 ec 0c SUB ESP,0xc mismatch in msvcrt.dll::_CItanh cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 83 ec 0c SUB ESP,0xc mismatch in msvcrt.dll::_CxxThrowException 0c c1 OR AL,0xc1 77 eb JNBE $+0xffffffeb f4 HLT ba ca 0c c1 77 MOV EDX,0x77c10cca eb ed JMP SHORT $+0xffffffed cc INT 0x3 cc INT 0x3 mismatch in msvcrt.dll::_EH_prolog cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_Getdays cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a ff PUSH 0xff 50 PUSH EAX mismatch in msvcrt.dll::_Getmonths cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_Gettnames cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_HUGE cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_Strftime 00 00 00 00 00 00 00 mismatch in msvcrt.dll::_XcptFilter cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::__CxxCallUnwindDtor cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::__CxxDetectRethrow cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 08 PUSH 0x8 68 48 14 bc 77 PUSH 0x77bc1448 mismatch in msvcrt.dll::__CxxExceptionFilter cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::__CxxFrameHandler cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::__CxxLongjmpUnwind cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::__CxxQueryExceptionSize cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::__CxxRegisterExceptionObject cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 10 PUSH 0x10 58 POP EAX mismatch in msvcrt.dll::__CxxUnregisterExceptionObject cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::__DestructExceptionObject cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::__RTCastToVoid cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 08 PUSH 0x8 68 38 14 bc 77 PUSH 0x77bc1438 mismatch in msvcrt.dll::__RTDynamicCast cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 14 PUSH 0x14 68 38 15 bc 77 PUSH 0x77bc1538 mismatch in msvcrt.dll::__RTtypeid cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 34 PUSH 0x34 68 58 15 bc 77 PUSH 0x77bc1558 mismatch in msvcrt.dll::__STRINGTOLD cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 30 PUSH 0x30 68 28 15 bc 77 PUSH 0x77bc1528 mismatch in msvcrt.dll::___lc_codepage_func cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::___lc_handle_func cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 e8 2c 6e 00 00 CALL $+0x6e2c 8b 40 64 MOV EAX,DWORD PTR DS:[EAX+0x64] mismatch in msvcrt.dll::___mb_cur_max_func cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 e8 0e 6e 00 00 CALL $+0x6e0e 8b 40 64 MOV EAX,DWORD PTR DS:[EAX+0x64] mismatch in msvcrt.dll::___setlc_active_func cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 a1 7c f9 c0 77 MOV EAX,DWORD PTR DS:[0x77c0f97c] c3 RET mismatch in msvcrt.dll::___unguarded_readlc_active_add_func cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 a1 8c 27 c1 77 MOV EAX,DWORD PTR DS:[0x77c1278c] c3 RET mismatch in msvcrt.dll::__argc cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 b8 90 27 c1 77 MOV EAX,0x77c12790 c3 RET mismatch in msvcrt.dll::__argv 00 01 00 ADD DWORD PTR DS:[EAX],EAX 00 00 00 00 00 mismatch in msvcrt.dll::__badioinfo 00 00 00 00 00 00 00 mismatch in msvcrt.dll::__crtCompareStringA 00 00 00 00 00 mismatch in msvcrt.dll::__crtCompareStringW cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 48 PUSH 0x48 68 b8 27 bc 77 PUSH 0x77bc27b8 mismatch in msvcrt.dll::__crtGetLocaleInfoW cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 24 PUSH 0x24 68 d0 27 bc 77 PUSH 0x77bc27d0 mismatch in msvcrt.dll::__crtGetStringTypeW cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 18 PUSH 0x18 68 e8 27 bc 77 PUSH 0x77bc27e8 mismatch in msvcrt.dll::__crtLCMapStringA cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 24 PUSH 0x24 68 f8 27 bc 77 PUSH 0x77bc27f8 mismatch in msvcrt.dll::__crtLCMapStringW cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 34 PUSH 0x34 68 10 28 bc 77 PUSH 0x77bc2810 mismatch in msvcrt.dll::__dllonexit cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 24 PUSH 0x24 68 38 28 bc 77 PUSH 0x77bc2838 mismatch in msvcrt.dll::__doserrno cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 14 PUSH 0x14 68 60 28 bc 77 PUSH 0x77bc2860 mismatch in msvcrt.dll::__fpecode cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 e8 56 ac 01 00 CALL $+0x1ac56 83 c0 0c ADD EAX,0xc mismatch in msvcrt.dll::__getmainargs cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 e8 68 4f 00 00 CALL $+0x4f68 83 c0 5c ADD EAX,0x5c mismatch in msvcrt.dll::__initenv cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::__iob_func 00 f8 CLC 30 39 XOR BYTE PTR DS:[ECX],BH 00 00 00 00 mismatch in msvcrt.dll::__isascii cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 b8 80 fc c0 77 MOV EAX,0x77c0fc80 c3 RET mismatch in msvcrt.dll::__iscsym cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::__iscsymf cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::__lc_codepage cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::__lc_collate_cp 00 00 00 00 00 00 00 mismatch in msvcrt.dll::__lc_handle 00 00 00 00 00 00 00 mismatch in msvcrt.dll::__lconv_init 00 00 00 00 00 00 00 mismatch in msvcrt.dll::__mb_cur_max cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 0c ff OR AL,0xff a2 b8 fa c0 77 MOV BYTE PTR DS:[0x77c0fab8],AL mismatch in msvcrt.dll::__p___argc 77 01 JNBE $+0x1 00 00 00 01 00 ADD DWORD PTR DS:[EAX],EAX 00 00 mismatch in msvcrt.dll::__p___argv cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 b8 28 1a c1 77 MOV EAX,0x77c11a28 c3 RET mismatch in msvcrt.dll::__p___initenv cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 b8 2c 1a c1 77 MOV EAX,0x77c11a2c c3 RET mismatch in msvcrt.dll::__p___mb_cur_max cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 b8 38 1a c1 77 MOV EAX,0x77c11a38 c3 RET mismatch in msvcrt.dll::__p___wargv cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 b8 7c f9 c0 77 MOV EAX,0x77c0f97c c3 RET mismatch in msvcrt.dll::__p___winitenv cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 b8 30 1a c1 77 MOV EAX,0x77c11a30 c3 RET mismatch in msvcrt.dll::__p__acmdln cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 b8 40 1a c1 77 MOV EAX,0x77c11a40 c3 RET mismatch in msvcrt.dll::__p__amblksiz cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 b8 ac 17 c1 77 MOV EAX,0x77c117ac c3 RET mismatch in msvcrt.dll::__p__commode cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 b8 d8 d2 c0 77 MOV EAX,0x77c0d2d8 c3 RET mismatch in msvcrt.dll::__p__daylight cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 b8 fc 21 c1 77 MOV EAX,0x77c121fc c3 RET mismatch in msvcrt.dll::__p__dstbias cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 b8 d4 ff c0 77 MOV EAX,0x77c0ffd4 c3 RET mismatch in msvcrt.dll::__p__environ cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 b8 d8 ff c0 77 MOV EAX,0x77c0ffd8 c3 RET mismatch in msvcrt.dll::__p__fileinfo cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 b8 34 1a c1 77 MOV EAX,0x77c11a34 c3 RET mismatch in msvcrt.dll::__p__fmode cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 b8 a0 d2 c0 77 MOV EAX,0x77c0d2a0 c3 RET mismatch in msvcrt.dll::__p__iob cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 b8 5c 18 c1 77 MOV EAX,0x77c1185c c3 RET mismatch in msvcrt.dll::__p__mbcasemap cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 b8 80 fc c0 77 MOV EAX,0x77c0fc80 c3 RET mismatch in msvcrt.dll::__p__mbctype cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 b8 80 26 c1 77 MOV EAX,0x77c12680 c3 RET mismatch in msvcrt.dll::__p__osver cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 b8 60 25 c1 77 MOV EAX,0x77c12560 c3 RET mismatch in msvcrt.dll::__p__pctype cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 b8 18 1a c1 77 MOV EAX,0x77c11a18 c3 RET mismatch in msvcrt.dll::__p__pgmptr cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 b8 88 f9 c0 77 MOV EAX,0x77c0f988 c3 RET mismatch in msvcrt.dll::__p__pwctype cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 b8 44 1a c1 77 MOV EAX,0x77c11a44 c3 RET mismatch in msvcrt.dll::__p__timezone cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 b8 8c f9 c0 77 MOV EAX,0x77c0f98c c3 RET mismatch in msvcrt.dll::__p__tzname cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 b8 d0 ff c0 77 MOV EAX,0x77c0ffd0 c3 RET mismatch in msvcrt.dll::__p__wcmdln cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 b8 60 00 c1 77 MOV EAX,0x77c10060 c3 RET mismatch in msvcrt.dll::__p__wenviron cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 b8 a8 17 c1 77 MOV EAX,0x77c117a8 c3 RET mismatch in msvcrt.dll::__p__winmajor cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 b8 3c 1a c1 77 MOV EAX,0x77c11a3c c3 RET mismatch in msvcrt.dll::__p__winminor cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 b8 20 1a c1 77 MOV EAX,0x77c11a20 c3 RET mismatch in msvcrt.dll::__p__winver cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 b8 24 1a c1 77 MOV EAX,0x77c11a24 c3 RET mismatch in msvcrt.dll::__p__wpgmptr cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 b8 1c 1a c1 77 MOV EAX,0x77c11a1c c3 RET mismatch in msvcrt.dll::__pctype_func cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 b8 48 1a c1 77 MOV EAX,0x77c11a48 c3 RET mismatch in msvcrt.dll::__pioinfo cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 a1 88 f9 c0 77 MOV EAX,DWORD PTR DS:[0x77c0f988] c3 RET mismatch in msvcrt.dll::__pxcptinfoptrs 00 00 00 00 00 20 1f AND BYTE PTR DS:[EDI],BL 39 00 CMP DWORD PTR DS:[EAX],EAX mismatch in msvcrt.dll::__set_app_type cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 e8 5a 4f 00 00 CALL $+0x4f5a 83 c0 58 ADD EAX,0x58 mismatch in msvcrt.dll::__setlc_active cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::__setusermatherr 00 00 00 00 00 00 00 mismatch in msvcrt.dll::__threadhandle 00 00 00 00 00 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::__threadid cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 ff 25 24 12 bc 77 JMP DWORD PTR DS:[0x77bc1224] cc INT 0x3 mismatch in msvcrt.dll::__toascii cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 ff 25 3c 10 bc 77 JMP DWORD PTR DS:[0x77bc103c] cc INT 0x3 mismatch in msvcrt.dll::__unDName cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::__unDNameEx cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 68 84 00 00 00 PUSH 0x84 68 50 1e bc 77 PUSH 0x77bc1e50 mismatch in msvcrt.dll::__uncaught_exception cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 68 84 00 00 00 PUSH 0x84 68 60 1e bc 77 PUSH 0x77bc1e60 mismatch in msvcrt.dll::__unguarded_readlc_active 00 00 00 00 00 00 00 mismatch in msvcrt.dll::__wargv 00 00 00 00 00 00 00 mismatch in msvcrt.dll::__wcserror cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::__wgetmainargs cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::__winitenv 00 00 00 00 00 00 00 mismatch in msvcrt.dll::_abnormal_termination 10 5f 5e ADC BYTE PTR DS:[EDI+0x5e],BL 5b POP EBX c3 RET 33 c0 XOR EAX,EAX 64 8b 0d 00 00 00 00 MOV ECX,DWORD PTR FS:[0x0] 81 79 04 6c 54 be 77 CMP DWORD PTR DS:[ECX+0x4],0x77be546c 75 10 JNE $+0x10 mismatch in msvcrt.dll::_access cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_acmdln 00 b4 0b MOV AH,0xb 02 00 ADD AL,BYTE PTR DS:[EAX] d0 23 SHL BYTE PTR DS:[EBX],0x1 14 00 ADC AL,0x0 00 00 mismatch in msvcrt.dll::_adj_fdiv_m16i 08 58 c2 OR BYTE PTR DS:[EAX+0xc2],BL 08 00 OR BYTE PTR DS:[EAX],AL 50 PUSH EAX mismatch in msvcrt.dll::_adj_fdiv_m32 ff 83 c4 2c c3 50 INC DWORD PTR DS:[EBX+0x50c32cc4] 8b 44 24 08 MOV EAX,DWORD PTR SS:[ESP+0x8] 25 00 00 80 7f AND EAX,0x7f800000 3d 00 00 80 7f CMP EAX,0x7f800000 74 33 JE $+0x33 mismatch in msvcrt.dll::_adj_fdiv_m32i 0c 58 OR AL,0x58 c2 04 00 RET 0x4 50 PUSH EAX mismatch in msvcrt.dll::_adj_fdiv_m64 08 58 c2 OR BYTE PTR DS:[EAX+0xc2],BL 04 00 ADD AL,0x0 50 PUSH EAX 8b 44 24 0c MOV EAX,DWORD PTR SS:[ESP+0xc] 25 00 00 f0 7f AND EAX,0x7ff00000 3d 00 00 f0 7f CMP EAX,0x7ff00000 74 33 JE $+0x33 mismatch in msvcrt.dll::_adj_fdiv_r 24 1c AND AL,0x1c mismatch in msvcrt.dll::_adj_fdivr_m16i 08 58 c2 OR BYTE PTR DS:[EAX+0xc2],BL 08 00 OR BYTE PTR DS:[EAX],AL 50 PUSH EAX mismatch in msvcrt.dll::_adj_fdivr_m32 0c 58 OR AL,0x58 c2 04 00 RET 0x4 50 PUSH EAX 8b 44 24 08 MOV EAX,DWORD PTR SS:[ESP+0x8] 25 00 00 80 7f AND EAX,0x7f800000 3d 00 00 80 7f CMP EAX,0x7f800000 74 33 JE $+0x33 mismatch in msvcrt.dll::_adj_fdivr_m32i 0c 58 OR AL,0x58 c2 04 00 RET 0x4 50 PUSH EAX mismatch in msvcrt.dll::_adj_fdivr_m64 08 58 c2 OR BYTE PTR DS:[EAX+0xc2],BL 04 00 ADD AL,0x0 50 PUSH EAX 8b 44 24 0c MOV EAX,DWORD PTR SS:[ESP+0xc] 25 00 00 f0 7f AND EAX,0x7ff00000 3d 00 00 f0 7f CMP EAX,0x7ff00000 74 33 JE $+0x33 mismatch in msvcrt.dll::_adj_fpatan 40 INC EAX mismatch in msvcrt.dll::_adj_fprem 1c 59 SBB AL,0x59 5b POP EBX 58 POP EAX c3 RET 52 PUSH EDX 83 ec 30 SUB ESP,0x30 mismatch in msvcrt.dll::_adj_fprem1 1c 59 SBB AL,0x59 5b POP EBX 58 POP EAX c3 RET 52 PUSH EDX 83 ec 30 SUB ESP,0x30 mismatch in msvcrt.dll::_adj_fptan ff c3 INC EBX mismatch in msvcrt.dll::_adjust_fdiv 00 00 00 00 00 00 00 mismatch in msvcrt.dll::_aexit_rtn 00 00 00 00 00 9a 9e be 77 00 00 00 CALL FAR $+0x77be9e 00 mismatch in msvcrt.dll::_aligned_free cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_aligned_malloc cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_aligned_offset_malloc cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_aligned_offset_realloc cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_aligned_realloc cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_amsg_exit cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_assert cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_atodbl cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_atoi64 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_atoldbl cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_beep cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_beginthread cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_beginthreadex cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_c_exit cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 53 PUSH EBX mismatch in msvcrt.dll::_cabs cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_callnewh cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_cexit cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 53 PUSH EBX mismatch in msvcrt.dll::_cgets cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_cgetws cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_chdir cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_chdrive cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 10 PUSH 0x10 68 08 13 bc 77 PUSH 0x77bc1308 mismatch in msvcrt.dll::_chgsign cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_chkesp cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 75 01 JNE $+0x1 c3 RET mismatch in msvcrt.dll::_chmod cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_chsize cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 0c PUSH 0xc 68 b8 20 bc 77 PUSH 0x77bc20b8 mismatch in msvcrt.dll::_clearfp cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_close cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 0c PUSH 0xc 68 c8 20 bc 77 PUSH 0x77bc20c8 mismatch in msvcrt.dll::_commit cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 0c PUSH 0xc 68 d8 20 bc 77 PUSH 0x77bc20d8 mismatch in msvcrt.dll::_commode 00 00 00 00 00 00 00 mismatch in msvcrt.dll::_control87 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_controlfp cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_copysign cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_cprintf cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_cputs cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_cputws cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 10 PUSH 0x10 68 e8 20 bc 77 PUSH 0x77bc20e8 mismatch in msvcrt.dll::_creat cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_cscanf cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_ctime64 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_ctype 77 00 JNBE $+0x0 00 00 00 00 00 20 00 AND BYTE PTR DS:[EAX],AL mismatch in msvcrt.dll::_cwait cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_cwprintf cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_cwscanf cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_daylight 00 80 70 00 00 XOR BYTE PTR DS:[EAX+0x0],0x0 01 00 ADD DWORD PTR DS:[EAX],EAX 00 00 mismatch in msvcrt.dll::_dstbias 00 01 00 ADD DWORD PTR DS:[EAX],EAX 00 00 mismatch in msvcrt.dll::_dup cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 0c PUSH 0xc 68 08 21 bc 77 PUSH 0x77bc2108 mismatch in msvcrt.dll::_dup2 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 0c PUSH 0xc 68 18 21 bc 77 PUSH 0x77bc2118 mismatch in msvcrt.dll::_ecvt cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_endthread cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 a1 00 01 c1 77 MOV EAX,DWORD PTR DS:[0x77c10100] 85 c0 TEST EAX,EAX mismatch in msvcrt.dll::_endthreadex cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_environ 00 00 00 00 00 f8 CLC 30 39 XOR BYTE PTR DS:[ECX],BH mismatch in msvcrt.dll::_eof cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 1c PUSH 0x1c 68 28 21 bc 77 PUSH 0x77bc2128 mismatch in msvcrt.dll::_errno cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 e8 64 ac 01 00 CALL $+0x1ac64 83 c0 08 ADD EAX,0x8 mismatch in msvcrt.dll::_except_handler2 30 58 43 XOR BYTE PTR DS:[EAX+0x43],BL 30 30 XOR BYTE PTR DS:[EAX],DH 55 PUSH EBP 8b ec MOV EBP,ESP 83 ec 08 SUB ESP,0x8 53 PUSH EBX 56 PUSH ESI mismatch in msvcrt.dll::_except_handler3 30 58 43 XOR BYTE PTR DS:[EAX+0x43],BL 30 30 XOR BYTE PTR DS:[EAX],DH 55 PUSH EBP 8b ec MOV EBP,ESP 83 ec 08 SUB ESP,0x8 53 PUSH EBX 56 PUSH ESI mismatch in msvcrt.dll::_execl cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_execle cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_execlp cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_execlpe cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_execv cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_execve cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_execvp cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_execvpe cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_exit cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_expand cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 1c PUSH 0x1c 68 b8 1f bc 77 PUSH 0x77bc1fb8 mismatch in msvcrt.dll::_fcloseall cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 10 PUSH 0x10 68 40 44 bc 77 PUSH 0x77bc4440 mismatch in msvcrt.dll::_fcvt cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_fdopen cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 18 PUSH 0x18 68 50 44 bc 77 PUSH 0x77bc4450 mismatch in msvcrt.dll::_fgetchar cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 68 80 fc c0 77 PUSH 0x77c0fc80 e8 fd 1f 00 00 CALL $+0x1ffd mismatch in msvcrt.dll::_fgetwchar cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 68 80 fc c0 77 PUSH 0x77c0fc80 e8 e8 21 00 00 CALL $+0x21e8 mismatch in msvcrt.dll::_filbuf cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_fileinfo 77 34 JNBE $+0x34 13 bc 77 ff ff ff ff ADC EDI,DWORD PTR DS:[EDI+ESI*2+0xffffffff] 44 INC ESP 13 bc 77 3c 13 bc 77 ADC EDI,DWORD PTR DS:[EDI+ESI*2+0x77bc133c] 4c DEC ESP 13 bc 77 34 13 bc 77 ADC EDI,DWORD PTR DS:[EDI+ESI*2+0x77bc1334] 94 XCHG EAX,ESP mismatch in msvcrt.dll::_filelength cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 10 PUSH 0x10 68 38 21 bc 77 PUSH 0x77bc2138 mismatch in msvcrt.dll::_filelengthi64 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 18 PUSH 0x18 68 48 21 bc 77 PUSH 0x77bc2148 mismatch in msvcrt.dll::_fileno cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_findclose cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_findfirst cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_findfirst64 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_findfirsti64 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_findnext cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_findnext64 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_findnexti64 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_finite cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_flsbuf cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_flushall cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 01 PUSH 0x1 e8 ca fe ff ff CALL $+0xfffffeca mismatch in msvcrt.dll::_fmode 00 00 00 00 00 00 00 mismatch in msvcrt.dll::_fpclass cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_fpieee_flt cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 53 PUSH EBX mismatch in msvcrt.dll::_fpreset cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 56 PUSH ESI mismatch in msvcrt.dll::_fputchar cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_fputwchar cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_fsopen cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 10 PUSH 0x10 68 88 44 bc 77 PUSH 0x77bc4488 mismatch in msvcrt.dll::_fstat cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 68 PUSH 0x68 68 58 21 bc 77 PUSH 0x77bc2158 mismatch in msvcrt.dll::_fstat64 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 68 PUSH 0x68 68 68 21 bc 77 PUSH 0x77bc2168 mismatch in msvcrt.dll::_fstati64 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 68 PUSH 0x68 68 78 21 bc 77 PUSH 0x77bc2178 mismatch in msvcrt.dll::_ftime cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_ftime64 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_ftol cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 55 PUSH EBP 8b ec MOV EBP,ESP mismatch in msvcrt.dll::_fullpath cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_futime cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_futime64 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_gcvt cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_get_heap_handle cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 a1 18 24 c1 77 MOV EAX,DWORD PTR DS:[0x77c12418] c3 RET mismatch in msvcrt.dll::_get_osfhandle cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_get_sbh_threshold cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 a1 1c 24 c1 77 MOV EAX,DWORD PTR DS:[0x77c1241c] 83 f8 03 CMP EAX,0x3 mismatch in msvcrt.dll::_getch cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 56 PUSH ESI mismatch in msvcrt.dll::_getche cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 56 PUSH ESI mismatch in msvcrt.dll::_getcwd cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 0c PUSH 0xc 68 18 13 bc 77 PUSH 0x77bc1318 mismatch in msvcrt.dll::_getdcwd cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 0c PUSH 0xc 68 28 13 bc 77 PUSH 0x77bc1328 mismatch in msvcrt.dll::_getdiskfree cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_getdllprocaddr cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_getdrive cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_getdrives cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 ff 25 2c 10 bc 77 JMP DWORD PTR DS:[0x77bc102c] cc INT 0x3 mismatch in msvcrt.dll::_getmaxstdio cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 a1 00 ff c0 77 MOV EAX,DWORD PTR DS:[0x77c0ff00] c3 RET mismatch in msvcrt.dll::_getmbcp cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 a1 48 25 c1 77 MOV EAX,DWORD PTR DS:[0x77c12548] f7 d8 NEG EAX mismatch in msvcrt.dll::_getpid cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 ff 25 6c 10 bc 77 JMP DWORD PTR DS:[0x77bc106c] cc INT 0x3 mismatch in msvcrt.dll::_getsystime cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_getw cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 1c PUSH 0x1c 68 a8 44 bc 77 PUSH 0x77bc44a8 mismatch in msvcrt.dll::_getwch cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 56 PUSH ESI mismatch in msvcrt.dll::_getwche cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 56 PUSH ESI mismatch in msvcrt.dll::_getws cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 14 PUSH 0x14 68 b8 44 bc 77 PUSH 0x77bc44b8 mismatch in msvcrt.dll::_global_unwind2 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 55 PUSH EBP 8b ec MOV EBP,ESP mismatch in msvcrt.dll::_gmtime64 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_heapadd cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 e8 18 36 ff ff CALL $+0xffff3618 c7 00 28 00 00 00 MOV DWORD PTR DS:[EAX],0x28 mismatch in msvcrt.dll::_heapchk cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 0c PUSH 0xc 68 00 20 bc 77 PUSH 0x77bc2000 mismatch in msvcrt.dll::_heapmin cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 08 PUSH 0x8 68 18 20 bc 77 PUSH 0x77bc2018 mismatch in msvcrt.dll::_heapset cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 e9 2c ff ff ff JMP $+0xffffff2c cc INT 0x3 mismatch in msvcrt.dll::_heapused cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 e8 7d 34 ff ff CALL $+0xffff347d c7 00 28 00 00 00 MOV DWORD PTR DS:[EAX],0x28 mismatch in msvcrt.dll::_heapwalk cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 2c PUSH 0x2c 68 30 20 bc 77 PUSH 0x77bc2030 mismatch in msvcrt.dll::_hypot cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_i64toa cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_i64tow cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_initterm cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_inp cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 33 c0 XOR EAX,EAX 66 8b 54 24 04 MOV DX,WORD PTR SS:[ESP+0x4] mismatch in msvcrt.dll::_inpd 24 04 AND AL,0x4 66 ed IN AX,DX c3 RET 66 8b 54 24 04 MOV DX,WORD PTR SS:[ESP+0x4] ed IN EAX,DX c3 RET cc INT 0x3 mismatch in msvcrt.dll::_inpw 54 PUSH ESP 24 04 AND AL,0x4 ec IN AL,DX c3 RET 66 8b 54 24 04 MOV DX,WORD PTR SS:[ESP+0x4] 66 ed IN AX,DX c3 RET mismatch in msvcrt.dll::_iob 00 e4 40 IN AL,0x40 bc 77 c0 27 c1 MOV ESP,0xc127c077 77 00 JNBE $+0x0 00 00 00 mismatch in msvcrt.dll::_isatty cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_isctype cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_ismbbalnum cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_ismbbalpha cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_ismbbgraph cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_ismbbkalnum cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_ismbbkana cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_ismbbkprint cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_ismbbkpunct cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_ismbblead cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_ismbbprint cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_ismbbpunct cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_ismbbtrail cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_ismbcalnum cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_ismbcalpha cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_ismbcdigit cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_ismbcgraph cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_ismbchira cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_ismbckata cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_ismbcl0 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_ismbcl1 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_ismbcl2 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_ismbclegal cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_ismbclower cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_ismbcprint cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_ismbcpunct cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_ismbcspace cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_ismbcsymbol cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_ismbcupper cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_ismbslead cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_ismbstrail cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_isnan cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_itoa cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_itow cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_j0 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_j1 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_jn cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_kbhit cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 56 PUSH ESI mismatch in msvcrt.dll::_lfind cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_loaddll cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_local_unwind2 03 00 ADD EAX,DWORD PTR DS:[EAX] 00 00 c3 RET 53 PUSH EBX 56 PUSH ESI 57 PUSH EDI mismatch in msvcrt.dll::_localtime64 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_lock cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_locking cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 0c PUSH 0xc 68 d8 24 bc 77 PUSH 0x77bc24d8 mismatch in msvcrt.dll::_logb cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_longjmpex cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 e9 9b 0f 00 00 JMP $+0xf9b cc INT 0x3 mismatch in msvcrt.dll::_lrotl cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_lrotr cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_lsearch cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_lseek cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 0c PUSH 0xc 68 e8 24 bc 77 PUSH 0x77bc24e8 mismatch in msvcrt.dll::_lseeki64 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 10 PUSH 0x10 68 f8 24 bc 77 PUSH 0x77bc24f8 mismatch in msvcrt.dll::_ltoa cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_ltow cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_makepath cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbbtombc cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbbtype cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbcasemap 00 00 00 00 00 00 00 mismatch in msvcrt.dll::_mbccpy cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbcjistojms cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbcjmstojis cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbclen cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbctohira cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbctokata cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbctolower cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbctombb cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbctoupper cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbctype 00 00 00 00 00 00 00 mismatch in msvcrt.dll::_mbsbtype cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbscat 00 00 00 8b ff MOV EDI,EDI 8b 4c 24 04 MOV ECX,DWORD PTR SS:[ESP+0x4] 57 PUSH EDI f7 c1 03 00 00 00 TEST ECX,0x3 mismatch in msvcrt.dll::_mbschr cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbscmp cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbscoll cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbscpy cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 57 PUSH EDI 8b 7c 24 08 MOV EDI,DWORD PTR SS:[ESP+0x8] mismatch in msvcrt.dll::_mbscspn cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbsdec cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbsdup cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbsicmp cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbsicoll cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbsinc cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbslen cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbslwr cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbsnbcat cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbsnbcmp cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbsnbcnt cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbsnbcoll cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbsnbcpy cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbsnbicmp cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbsnbicoll cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbsnbset cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbsncat cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbsnccnt cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbsncmp cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbsncoll cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbsncpy cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbsnextc cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbsnicmp cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbsnicoll cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbsninc cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbsnset cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbspbrk cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbsrchr cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbsrev cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbsset cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbsspn cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbsspnp cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbsstr cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbstok cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbstrlen cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mbsupr cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_memccpy cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b 4c 24 10 MOV ECX,DWORD PTR SS:[ESP+0x10] 53 PUSH EBX mismatch in msvcrt.dll::_memicmp cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mkdir cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mktemp cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_mktime64 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_msize cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 1c PUSH 0x1c 68 40 20 bc 77 PUSH 0x77bc2040 mismatch in msvcrt.dll::_nextafter cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_onexit cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 0c PUSH 0xc 68 50 28 bc 77 PUSH 0x77bc2850 mismatch in msvcrt.dll::_open cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 14 PUSH 0x14 68 08 25 bc 77 PUSH 0x77bc2508 mismatch in msvcrt.dll::_open_osfhandle cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_osplatform 00 00 00 00 00 02 00 ADD AL,BYTE PTR DS:[EAX] 00 mismatch in msvcrt.dll::_osver 00 02 00 ADD AL,BYTE PTR DS:[EAX] 00 00 28 0a SUB BYTE PTR DS:[EDX],CL 00 00 mismatch in msvcrt.dll::_outp cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 33 c0 XOR EAX,EAX 66 8b 54 24 04 MOV DX,WORD PTR SS:[ESP+0x4] mismatch in msvcrt.dll::_outpd 24 08 AND AL,0x8 66 ef OUT AX,DX c3 RET 66 8b 54 24 04 MOV DX,WORD PTR SS:[ESP+0x4] 8b 44 24 08 MOV EAX,DWORD PTR SS:[ESP+0x8] ef OUT EAX,DX c3 RET mismatch in msvcrt.dll::_outpw 44 INC ESP 24 08 AND AL,0x8 ee OUT AL,DX c3 RET 66 8b 54 24 04 MOV DX,WORD PTR SS:[ESP+0x4] 66 8b 44 24 08 MOV AX,WORD PTR SS:[ESP+0x8] 66 ef OUT AX,DX mismatch in msvcrt.dll::_pclose cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 14 PUSH 0x14 68 e0 44 bc 77 PUSH 0x77bc44e0 mismatch in msvcrt.dll::_pctype 00 01 00 ADD DWORD PTR DS:[EAX],EAX 00 00 a2 28 bc 77 aa MOV BYTE PTR DS:[0xaa77bc28],AL 2a bc 77 20 05 93 19 SUB BH,BYTE PTR DS:[EDI+ESI*2+0x19930520] 00 mismatch in msvcrt.dll::_pgmptr 00 00 00 00 00 00 00 mismatch in msvcrt.dll::_pipe cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 24 PUSH 0x24 68 28 25 bc 77 PUSH 0x77bc2528 mismatch in msvcrt.dll::_popen cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 68 a4 00 00 00 PUSH 0xa4 68 d0 44 bc 77 PUSH 0x77bc44d0 mismatch in msvcrt.dll::_purecall cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 19 PUSH 0x19 e8 11 92 fe ff CALL $+0xfffe9211 mismatch in msvcrt.dll::_putch cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_putenv cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 0c PUSH 0xc 68 f0 2d bc 77 PUSH 0x77bc2df0 mismatch in msvcrt.dll::_putw cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 18 PUSH 0x18 68 f0 44 bc 77 PUSH 0x77bc44f0 mismatch in msvcrt.dll::_putwch cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 0c PUSH 0xc 68 f8 20 bc 77 PUSH 0x77bc20f8 mismatch in msvcrt.dll::_putws cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 10 PUSH 0x10 68 00 45 bc 77 PUSH 0x77bc4500 mismatch in msvcrt.dll::_pwctype 00 a2 28 bc 77 aa MOV BYTE PTR DS:[0xaa77bc28],AL 2a bc 77 20 05 93 19 SUB BH,BYTE PTR DS:[EDI+ESI*2+0x19930520] 00 00 00 00 mismatch in msvcrt.dll::_read cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 0c PUSH 0xc 68 40 25 bc 77 PUSH 0x77bc2540 mismatch in msvcrt.dll::_resetstkoflw cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_rmdir cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_rmtmp cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 10 PUSH 0x10 68 10 45 bc 77 PUSH 0x77bc4510 mismatch in msvcrt.dll::_rotl cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_rotr cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_safe_fdiv 0c 58 OR AL,0x58 c2 04 00 RET 0x4 50 PUSH EAX 83 ec 2c SUB ESP,0x2c mismatch in msvcrt.dll::_safe_fdivr 83 c4 2c ADD ESP,0x2c 58 POP EAX c3 RET 50 PUSH EAX 83 ec 2c SUB ESP,0x2c mismatch in msvcrt.dll::_safe_fprem 83 c4 30 ADD ESP,0x30 5a POP EDX c3 RET e8 8e fc ff ff CALL $+0xfffffc8e c3 RET e8 40 ff ff ff CALL $+0xffffff40 c3 RET mismatch in msvcrt.dll::_safe_fprem1 8e fc MOV ??,ESP mismatch in msvcrt.dll::_scalb cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_scprintf cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_scwprintf cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_searchenv cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_seh_longjmp_unwind 5b POP EBX 8b e5 MOV ESP,EBP 5d POP EBP c3 RET 55 PUSH EBP 8b 4c 24 08 MOV ECX,DWORD PTR SS:[ESP+0x8] 8b 29 MOV EBP,DWORD PTR DS:[ECX] mismatch in msvcrt.dll::_set_SSE2_enable cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_set_error_mode cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_set_sbh_threshold cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_seterrormode cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_setjmp cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b 54 24 04 MOV EDX,DWORD PTR SS:[ESP+0x4] 89 2a MOV DWORD PTR DS:[EDX],EBP mismatch in msvcrt.dll::_setjmp3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b 54 24 04 MOV EDX,DWORD PTR SS:[ESP+0x4] 89 2a MOV DWORD PTR DS:[EDX],EBP mismatch in msvcrt.dll::_setmaxstdio cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 14 PUSH 0x14 68 98 44 bc 77 PUSH 0x77bc4498 mismatch in msvcrt.dll::_setmbcp cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 14 PUSH 0x14 68 b0 25 bc 77 PUSH 0x77bc25b0 mismatch in msvcrt.dll::_setmode cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 0c PUSH 0xc 68 50 25 bc 77 PUSH 0x77bc2550 mismatch in msvcrt.dll::_setsystime cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_sleep cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_snprintf cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_snscanf cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_snwprintf cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_snwscanf cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_sopen cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 14 PUSH 0x14 68 18 25 bc 77 PUSH 0x77bc2518 mismatch in msvcrt.dll::_spawnl cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_spawnle cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_spawnlp cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_spawnlpe cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_spawnv cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_spawnve cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_spawnvp cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_spawnvpe cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_splitpath cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_stat cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_stat64 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_stati64 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_statusfp cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_strcmpi cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_strdate cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_strdup cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_strerror cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_stricmp cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_stricoll cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_strlwr cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 18 PUSH 0x18 68 a8 48 bc 77 PUSH 0x77bc48a8 mismatch in msvcrt.dll::_strncoll cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_strnicmp cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_strnicoll cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_strnset cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 55 PUSH EBP 8b ec MOV EBP,ESP mismatch in msvcrt.dll::_strrev cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 55 PUSH EBP 8b ec MOV EBP,ESP mismatch in msvcrt.dll::_strset cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 55 PUSH EBP 8b ec MOV EBP,ESP mismatch in msvcrt.dll::_strtime cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_strtoi64 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_strtoui64 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_strupr cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 18 PUSH 0x18 68 b8 48 bc 77 PUSH 0x77bc48b8 mismatch in msvcrt.dll::_swab cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_sys_errlist 77 01 JNBE $+0x1 00 00 00 2c 31 SUB AL,0x31 bc 77 14 31 bc MOV ESP,0xbc311477 77 f8 JNBE $+0xfffffff8 mismatch in msvcrt.dll::_sys_nerr 77 e4 JNBE $+0xffffffe4 2f DAS bc 77 2b 00 00 MOV ESP,0x2b77 00 2e 00 00 ADD BYTE PTR CS:[EAX],AL 00 8c fa MOV EDX,?? mismatch in msvcrt.dll::_tell cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_telli64 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_tempnam cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 18 PUSH 0x18 68 30 45 bc 77 PUSH 0x77bc4530 mismatch in msvcrt.dll::_time64 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_timezone 00 00 00 00 00 80 70 00 00 XOR BYTE PTR DS:[EAX+0x0],0x0 01 00 ADD DWORD PTR DS:[EAX],EAX mismatch in msvcrt.dll::_tolower cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_toupper cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_tzname 00 00 00 00 00 e0 ff LOOPNE $+0xffffffff mismatch in msvcrt.dll::_tzset cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 06 PUSH 0x6 e8 73 00 ff ff CALL $+0xffff0073 mismatch in msvcrt.dll::_ui64toa cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_ui64tow cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_ultoa cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_ultow cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_umask cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_ungetch cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_ungetwch cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_unlink cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_unloaddll cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_unlock cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_utime cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_utime64 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_vscprintf cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_vscwprintf cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_vsnprintf cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_vsnwprintf cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_waccess cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wasctime cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wchdir cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wchmod cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wcmdln 00 01 00 ADD DWORD PTR DS:[EAX],EAX 00 00 b4 0b MOV AH,0xb 02 00 ADD AL,BYTE PTR DS:[EAX] d0 23 SHL BYTE PTR DS:[EBX],0x1 mismatch in msvcrt.dll::_wcreat cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wcsdup cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wcserror cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wcsicmp cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wcsicoll cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wcslwr cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 18 PUSH 0x18 68 c8 48 bc 77 PUSH 0x77bc48c8 mismatch in msvcrt.dll::_wcsncoll cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wcsnicmp cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wcsnicoll cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wcsnset cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wcsrev cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wcsset cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wcstoi64 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wcstoui64 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wcsupr cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 18 PUSH 0x18 68 d8 48 bc 77 PUSH 0x77bc48d8 mismatch in msvcrt.dll::_wctime cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wctime64 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wenviron 00 00 00 00 00 00 00 mismatch in msvcrt.dll::_wexecl cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wexecle cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wexeclp cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wexeclpe cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wexecv cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wexecve cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wexecvp cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wexecvpe cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wfdopen cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 18 PUSH 0x18 68 40 45 bc 77 PUSH 0x77bc4540 mismatch in msvcrt.dll::_wfindfirst cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wfindfirst64 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wfindfirsti64 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wfindnext cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wfindnext64 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wfindnexti64 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wfopen cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wfreopen cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 10 PUSH 0x10 68 60 45 bc 77 PUSH 0x77bc4560 mismatch in msvcrt.dll::_wfsopen cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 10 PUSH 0x10 68 50 45 bc 77 PUSH 0x77bc4550 mismatch in msvcrt.dll::_wfullpath cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wgetcwd cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 0c PUSH 0xc 68 60 13 bc 77 PUSH 0x77bc1360 mismatch in msvcrt.dll::_wgetdcwd cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 0c PUSH 0xc 68 70 13 bc 77 PUSH 0x77bc1370 mismatch in msvcrt.dll::_wgetenv cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 0c PUSH 0xc 68 38 31 bc 77 PUSH 0x77bc3138 mismatch in msvcrt.dll::_winmajor 00 01 05 00 00 05 00 ADD DWORD PTR DS:[0x50000],EAX 00 00 01 00 ADD DWORD PTR DS:[EAX],EAX 00 00 mismatch in msvcrt.dll::_winminor 00 05 00 00 00 01 ADD EAX,0x1000000 00 00 00 00 00 mismatch in msvcrt.dll::_winver 00 28 0a SUB BYTE PTR DS:[EDX],CL 00 00 01 05 00 00 05 00 ADD DWORD PTR DS:[0x50000],EAX 00 00 mismatch in msvcrt.dll::_wmakepath cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wmkdir cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wmktemp cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wopen cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 14 PUSH 0x14 68 60 25 bc 77 PUSH 0x77bc2560 mismatch in msvcrt.dll::_wperror cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 10 PUSH 0x10 68 48 31 bc 77 PUSH 0x77bc3148 mismatch in msvcrt.dll::_wpgmptr 00 00 00 00 00 00 00 mismatch in msvcrt.dll::_wpopen cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 68 a4 00 00 00 PUSH 0xa4 68 78 45 bc 77 PUSH 0x77bc4578 mismatch in msvcrt.dll::_wputenv cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 0c PUSH 0xc 68 58 31 bc 77 PUSH 0x77bc3158 mismatch in msvcrt.dll::_wremove cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wrename cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_write cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 0c PUSH 0xc 68 80 25 bc 77 PUSH 0x77bc2580 mismatch in msvcrt.dll::_wrmdir cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wsearchenv cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wsetlocale cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wsopen cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 14 PUSH 0x14 68 70 25 bc 77 PUSH 0x77bc2570 mismatch in msvcrt.dll::_wspawnl cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wspawnle cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wspawnlp cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wspawnlpe cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wspawnv cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wspawnve cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wspawnvp cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wspawnvpe cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wsplitpath cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wstat cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wstat64 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wstati64 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wstrdate cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wstrtime cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wsystem cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wtempnam cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 18 PUSH 0x18 68 90 45 bc 77 PUSH 0x77bc4590 mismatch in msvcrt.dll::_wtmpnam cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 10 PUSH 0x10 68 a0 45 bc 77 PUSH 0x77bc45a0 mismatch in msvcrt.dll::_wtof cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 18 PUSH 0x18 68 e8 12 bc 77 PUSH 0x77bc12e8 mismatch in msvcrt.dll::_wtoi cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wtoi64 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wtol cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wunlink cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wutime cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_wutime64 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_y0 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_y1 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::_yn cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::abort cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 0a PUSH 0xa e8 cf 43 00 00 CALL $+0x43cf mismatch in msvcrt.dll::abs cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::acos 00 83 c4 0c ADD ESP,0xc c3 RET 8d 54 24 04 LEA EDX,DWORD PTR SS:[ESP+0x4] e8 a8 41 00 00 CALL $+0x41a8 52 PUSH EDX 9b WAIT mismatch in msvcrt.dll::asctime cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::asin 00 83 c4 0c ADD ESP,0xc c3 RET 8d 54 24 04 LEA EDX,DWORD PTR SS:[ESP+0x4] e8 d8 40 00 00 CALL $+0x40d8 52 PUSH EDX 9b WAIT mismatch in msvcrt.dll::atan cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 83 3d c0 37 c1 77 00 CMP DWORD PTR DS:[0x77c137c0],0x0 0f 84 82 00 00 00 JE $+0x82 mismatch in msvcrt.dll::atan2 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 ba 30 0c c1 77 MOV EDX,0x77c10c30 e9 81 44 00 00 JMP $+0x4481 mismatch in msvcrt.dll::atexit cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::atof cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::atoi cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::atol cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::bsearch cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::calloc cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 10 PUSH 0x10 68 58 20 bc 77 PUSH 0x77bc2058 mismatch in msvcrt.dll::ceil cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 83 3d c0 37 c1 77 00 CMP DWORD PTR DS:[0x77c137c0],0x0 0f 84 22 4a 00 00 JE $+0x4a22 mismatch in msvcrt.dll::clearerr cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 08 PUSH 0x8 68 b0 45 bc 77 PUSH 0x77bc45b0 mismatch in msvcrt.dll::clock cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::cos 00 83 c4 0c ADD ESP,0xc c3 RET 8d 54 24 04 LEA EDX,DWORD PTR SS:[ESP+0x4] e8 c8 3e 00 00 CALL $+0x3ec8 52 PUSH EDX 9b WAIT mismatch in msvcrt.dll::cosh e9 37 45 00 00 JMP $+0x4537 ba aa 0c c1 77 MOV EDX,0x77c10caa eb f4 JMP SHORT $+0xfffffff4 ba ca 0c c1 77 MOV EDX,0x77c10cca eb ed JMP SHORT $+0xffffffed ba 8a 0c c1 77 MOV EDX,0x77c10c8a e9 4c 43 00 00 JMP $+0x434c mismatch in msvcrt.dll::ctime cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::difftime cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::div cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::exit cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::exp cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 83 3d c0 37 c1 77 00 CMP DWORD PTR DS:[0x77c137c0],0x0 74 6e JE $+0x6e mismatch in msvcrt.dll::fabs cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::fclose cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 0c PUSH 0xc 68 c0 45 bc 77 PUSH 0x77bc45c0 mismatch in msvcrt.dll::feof cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::ferror cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::fflush cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 0c PUSH 0xc 68 78 44 bc 77 PUSH 0x77bc4478 mismatch in msvcrt.dll::fgetc cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 0c PUSH 0xc 68 d0 45 bc 77 PUSH 0x77bc45d0 mismatch in msvcrt.dll::fgetpos cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::fgets cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 18 PUSH 0x18 68 e0 45 bc 77 PUSH 0x77bc45e0 mismatch in msvcrt.dll::fgetwc cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 0c PUSH 0xc 68 f0 45 bc 77 PUSH 0x77bc45f0 mismatch in msvcrt.dll::fgetws cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 18 PUSH 0x18 68 00 46 bc 77 PUSH 0x77bc4600 mismatch in msvcrt.dll::floor cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 83 3d c0 37 c1 77 00 CMP DWORD PTR DS:[0x77c137c0],0x0 0f 84 1c 49 00 00 JE $+0x491c mismatch in msvcrt.dll::fmod cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 ba 40 04 c1 77 MOV EDX,0x77c10440 e9 d1 42 00 00 JMP $+0x42d1 mismatch in msvcrt.dll::fopen cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::fprintf cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 14 PUSH 0x14 68 10 46 bc 77 PUSH 0x77bc4610 mismatch in msvcrt.dll::fputc cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 0c PUSH 0xc 68 20 46 bc 77 PUSH 0x77bc4620 mismatch in msvcrt.dll::fputs cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 14 PUSH 0x14 68 30 46 bc 77 PUSH 0x77bc4630 mismatch in msvcrt.dll::fputwc cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 10 PUSH 0x10 68 40 46 bc 77 PUSH 0x77bc4640 mismatch in msvcrt.dll::fputws cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 10 PUSH 0x10 68 50 46 bc 77 PUSH 0x77bc4650 mismatch in msvcrt.dll::fread cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 0c PUSH 0xc 68 60 46 bc 77 PUSH 0x77bc4660 mismatch in msvcrt.dll::free cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 18 PUSH 0x18 68 70 20 bc 77 PUSH 0x77bc2070 mismatch in msvcrt.dll::freopen cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 10 PUSH 0x10 68 70 46 bc 77 PUSH 0x77bc4670 mismatch in msvcrt.dll::frexp cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::fscanf cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 0c PUSH 0xc 68 80 46 bc 77 PUSH 0x77bc4680 mismatch in msvcrt.dll::fseek cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 0c PUSH 0xc 68 90 46 bc 77 PUSH 0x77bc4690 mismatch in msvcrt.dll::fsetpos cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::ftell cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 0c PUSH 0xc 68 a0 46 bc 77 PUSH 0x77bc46a0 mismatch in msvcrt.dll::fwprintf cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 14 PUSH 0x14 68 b0 46 bc 77 PUSH 0x77bc46b0 mismatch in msvcrt.dll::fwrite cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 0c PUSH 0xc 68 c0 46 bc 77 PUSH 0x77bc46c0 mismatch in msvcrt.dll::fwscanf cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 0c PUSH 0xc 68 d0 46 bc 77 PUSH 0x77bc46d0 mismatch in msvcrt.dll::getc cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 0c PUSH 0xc 68 d0 45 bc 77 PUSH 0x77bc45d0 mismatch in msvcrt.dll::getchar cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 e9 ea ff ff ff JMP $+0xffffffea cc INT 0x3 mismatch in msvcrt.dll::getenv cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 0c PUSH 0xc 68 68 31 bc 77 PUSH 0x77bc3168 mismatch in msvcrt.dll::gets cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 14 PUSH 0x14 68 e0 46 bc 77 PUSH 0x77bc46e0 mismatch in msvcrt.dll::getwc cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::getwchar cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 e9 ea ff ff ff JMP $+0xffffffea cc INT 0x3 mismatch in msvcrt.dll::gmtime cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::is_wctype cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::isalnum cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::isalpha 00 00 00 00 00 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::iscntrl cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::isdigit cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::isgraph cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::isleadbyte cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::islower cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::isprint cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::ispunct cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::isspace cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::isupper cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::iswalnum cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::iswalpha cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::iswascii cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::iswcntrl cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::iswctype cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::iswdigit cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::iswgraph cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::iswlower cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::iswprint cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::iswpunct cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::iswspace cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::iswupper cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::iswxdigit cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::isxdigit cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::labs cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::ldexp cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::ldiv cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::localeconv cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 a1 c0 fa c0 77 MOV EAX,DWORD PTR DS:[0x77c0fac0] c3 RET mismatch in msvcrt.dll::localtime cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::log cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 83 3d c0 37 c1 77 00 CMP DWORD PTR DS:[0x77c137c0],0x0 0f 84 82 00 00 00 JE $+0x82 mismatch in msvcrt.dll::log10 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 83 3d c0 37 c1 77 00 CMP DWORD PTR DS:[0x77c137c0],0x0 0f 84 82 00 00 00 JE $+0x82 mismatch in msvcrt.dll::longjmp cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b 5c 24 04 MOV EBX,DWORD PTR SS:[ESP+0x4] 8b 2b MOV EBP,DWORD PTR DS:[EBX] mismatch in msvcrt.dll::malloc cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::mblen cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::mbstowcs cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::mbtowc cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::memchr cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b 44 24 0c MOV EAX,DWORD PTR SS:[ESP+0xc] 53 PUSH EBX mismatch in msvcrt.dll::memcmp cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b 44 24 0c MOV EAX,DWORD PTR SS:[ESP+0xc] 85 c0 TEST EAX,EAX mismatch in msvcrt.dll::memcpy cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 55 PUSH EBP 8b ec MOV EBP,ESP mismatch in msvcrt.dll::memmove cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 55 PUSH EBP 8b ec MOV EBP,ESP mismatch in msvcrt.dll::memset cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b 54 24 0c MOV EDX,DWORD PTR SS:[ESP+0xc] 8b 4c 24 04 MOV ECX,DWORD PTR SS:[ESP+0x4] mismatch in msvcrt.dll::mktime cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::modf cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 83 3d c0 37 c1 77 00 CMP DWORD PTR DS:[0x77c137c0],0x0 0f 84 26 46 00 00 JE $+0x4626 mismatch in msvcrt.dll::perror cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 0c PUSH 0xc 68 78 31 bc 77 PUSH 0x77bc3178 mismatch in msvcrt.dll::pow cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 83 3d c0 37 c1 77 00 CMP DWORD PTR DS:[0x77c137c0],0x0 0f 84 87 00 00 00 JE $+0x87 mismatch in msvcrt.dll::printf cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 10 PUSH 0x10 68 f0 46 bc 77 PUSH 0x77bc46f0 mismatch in msvcrt.dll::putc cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 0c PUSH 0xc 68 20 46 bc 77 PUSH 0x77bc4620 mismatch in msvcrt.dll::putchar cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::puts cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 18 PUSH 0x18 68 00 47 bc 77 PUSH 0x77bc4700 mismatch in msvcrt.dll::putwc cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::putwchar cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::qsort cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::raise cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 20 PUSH 0x20 68 90 28 bc 77 PUSH 0x77bc2890 mismatch in msvcrt.dll::rand cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 e8 4d 2d 00 00 CALL $+0x2d4d 8b 48 14 MOV ECX,DWORD PTR DS:[EAX+0x14] mismatch in msvcrt.dll::realloc cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 24 PUSH 0x24 68 a0 20 bc 77 PUSH 0x77bc20a0 mismatch in msvcrt.dll::remove cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::rename cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::rewind cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 0c PUSH 0xc 68 10 47 bc 77 PUSH 0x77bc4710 mismatch in msvcrt.dll::scanf cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 0c PUSH 0xc 68 20 47 bc 77 PUSH 0x77bc4720 mismatch in msvcrt.dll::setbuf cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::setlocale cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 14 PUSH 0x14 68 a8 27 bc 77 PUSH 0x77bc27a8 mismatch in msvcrt.dll::setvbuf cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 10 PUSH 0x10 68 30 47 bc 77 PUSH 0x77bc4730 mismatch in msvcrt.dll::signal cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 0c PUSH 0xc 68 80 28 bc 77 PUSH 0x77bc2880 mismatch in msvcrt.dll::sin 00 83 c4 0c ADD ESP,0xc c3 RET 8d 54 24 04 LEA EDX,DWORD PTR SS:[ESP+0x4] e8 b8 37 00 00 CALL $+0x37b8 52 PUSH EDX 9b WAIT mismatch in msvcrt.dll::sinh cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 ba 8a 0c c1 77 MOV EDX,0x77c10c8a e9 37 45 00 00 JMP $+0x4537 mismatch in msvcrt.dll::sprintf cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::sqrt 00 83 c4 0c ADD ESP,0xc c3 RET 8d 54 24 04 LEA EDX,DWORD PTR SS:[ESP+0x4] e8 f8 36 00 00 CALL $+0x36f8 52 PUSH EDX 9b WAIT mismatch in msvcrt.dll::srand cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::sscanf cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::strcat 00 00 00 8b ff MOV EDI,EDI 8b 4c 24 04 MOV ECX,DWORD PTR SS:[ESP+0x4] 57 PUSH EDI f7 c1 03 00 00 00 TEST ECX,0x3 mismatch in msvcrt.dll::strchr 00 8d 64 24 00 LEA ESP,DWORD PTR SS:[ESP+0x0] 33 c0 XOR EAX,EAX 8a 44 24 08 MOV AL,BYTE PTR SS:[ESP+0x8] 53 PUSH EBX 8b d8 MOV EBX,EAX c1 e0 08 SHL EAX,0x8 mismatch in msvcrt.dll::strcmp cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b 54 24 04 MOV EDX,DWORD PTR SS:[ESP+0x4] 8b 4c 24 08 MOV ECX,DWORD PTR SS:[ESP+0x8] mismatch in msvcrt.dll::strcoll cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::strcpy cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 57 PUSH EDI 8b 7c 24 08 MOV EDI,DWORD PTR SS:[ESP+0x8] mismatch in msvcrt.dll::strcspn cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 55 PUSH EBP 8b ec MOV EBP,ESP mismatch in msvcrt.dll::strerror cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::strftime cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::strlen cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b 4c 24 04 MOV ECX,DWORD PTR SS:[ESP+0x4] f7 c1 03 00 00 00 TEST ECX,0x3 mismatch in msvcrt.dll::strncat cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b 4c 24 0c MOV ECX,DWORD PTR SS:[ESP+0xc] 57 PUSH EDI mismatch in msvcrt.dll::strncmp cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 55 PUSH EBP 8b ec MOV EBP,ESP mismatch in msvcrt.dll::strncpy cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b 4c 24 0c MOV ECX,DWORD PTR SS:[ESP+0xc] 57 PUSH EDI mismatch in msvcrt.dll::strpbrk cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 55 PUSH EBP 8b ec MOV EBP,ESP mismatch in msvcrt.dll::strrchr cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 55 PUSH EBP 8b ec MOV EBP,ESP mismatch in msvcrt.dll::strspn cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 55 PUSH EBP 8b ec MOV EBP,ESP mismatch in msvcrt.dll::strstr cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b 4c 24 08 MOV ECX,DWORD PTR SS:[ESP+0x8] 57 PUSH EDI mismatch in msvcrt.dll::strtod cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::strtok cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::strtol cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::strtoul cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::strxfrm cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::swprintf cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::swscanf cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::system cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::tan 00 83 c4 0c ADD ESP,0xc c3 RET 8d 54 24 04 LEA EDX,DWORD PTR SS:[ESP+0x4] e8 38 36 00 00 CALL $+0x3638 52 PUSH EDX 9b WAIT mismatch in msvcrt.dll::tanh 0c c1 OR AL,0xc1 77 eb JNBE $+0xffffffeb f4 HLT ba ca 0c c1 77 MOV EDX,0x77c10cca eb ed JMP SHORT $+0xffffffed ba 8a 0c c1 77 MOV EDX,0x77c10c8a e9 4c 43 00 00 JMP $+0x434c mismatch in msvcrt.dll::time cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::tmpfile cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 18 PUSH 0x18 68 50 47 bc 77 PUSH 0x77bc4750 mismatch in msvcrt.dll::tmpnam cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 10 PUSH 0x10 68 40 47 bc 77 PUSH 0x77bc4740 mismatch in msvcrt.dll::tolower cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::toupper cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::towlower cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::towupper cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::ungetc cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 0c PUSH 0xc 68 60 47 bc 77 PUSH 0x77bc4760 mismatch in msvcrt.dll::ungetwc cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 0c PUSH 0xc 68 70 47 bc 77 PUSH 0x77bc4770 mismatch in msvcrt.dll::vfprintf cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 14 PUSH 0x14 68 80 47 bc 77 PUSH 0x77bc4780 mismatch in msvcrt.dll::vfwprintf cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 14 PUSH 0x14 68 90 47 bc 77 PUSH 0x77bc4790 mismatch in msvcrt.dll::vprintf cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 14 PUSH 0x14 68 a0 47 bc 77 PUSH 0x77bc47a0 mismatch in msvcrt.dll::vsprintf cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::vswprintf cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::vwprintf cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 14 PUSH 0x14 68 b0 47 bc 77 PUSH 0x77bc47b0 mismatch in msvcrt.dll::wcscat cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::wcschr cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::wcscmp cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::wcscoll cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::wcscpy cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::wcscspn cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::wcsftime cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 24 PUSH 0x24 68 70 4a bc 77 PUSH 0x77bc4a70 mismatch in msvcrt.dll::wcslen cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::wcsncat cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::wcsncmp cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::wcsncpy cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::wcspbrk cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::wcsrchr cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::wcsspn cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::wcsstr cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::wcstod cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 3c PUSH 0x3c 68 f8 12 bc 77 PUSH 0x77bc12f8 mismatch in msvcrt.dll::wcstok cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::wcstol cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::wcstombs cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::wcstoul cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::wcsxfrm cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::wctomb cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in msvcrt.dll::wprintf cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 10 PUSH 0x10 68 c0 47 bc 77 PUSH 0x77bc47c0 mismatch in msvcrt.dll::wscanf cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 6a 0c PUSH 0xc 68 d0 47 bc 77 PUSH 0x77bc47d0 mismatch in user32.dll::ActivateKeyboardLayout 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 30 11 00 00 MOV EAX,0x1130 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::AdjustWindowRect match in user32.dll::AdjustWindowRectEx match in user32.dll::AlignRects mismatch in user32.dll::AllowForegroundActivation 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 04 PUSH 0x4 e8 ff 22 fc ff CALL $+0xfffc22ff match in user32.dll::AllowSetForegroundWindow match in user32.dll::AnimateWindow mismatch in user32.dll::AnyPopup 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP e8 85 37 fb ff CALL $+0xfffb3785 8b 48 38 MOV ECX,DWORD PTR DS:[EAX+0x38] match in user32.dll::AppendMenuA match in user32.dll::AppendMenuW match in user32.dll::ArrangeIconicWindows mismatch in user32.dll::AttachThreadInput 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 33 11 00 00 MOV EAX,0x1133 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::BeginDeferWindowPos mismatch in user32.dll::BeginPaint 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 34 11 00 00 MOV EAX,0x1134 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::BlockInput 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 36 11 00 00 MOV EAX,0x1136 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::BringWindowToTop match in user32.dll::BroadcastSystemMessage match in user32.dll::BroadcastSystemMessageA match in user32.dll::BroadcastSystemMessageExA match in user32.dll::BroadcastSystemMessageExW match in user32.dll::BroadcastSystemMessageW match in user32.dll::BuildReasonArray mismatch in user32.dll::CalcMenuBar 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 36 12 00 00 MOV EAX,0x1236 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::CallMsgFilter match in user32.dll::CallMsgFilterA match in user32.dll::CallMsgFilterW match in user32.dll::CallNextHookEx match in user32.dll::CallWindowProcA match in user32.dll::CallWindowProcW match in user32.dll::CascadeChildWindows match in user32.dll::CascadeWindows mismatch in user32.dll::ChangeClipboardChain 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 45 11 00 00 MOV EAX,0x1145 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::ChangeDisplaySettingsA match in user32.dll::ChangeDisplaySettingsExA match in user32.dll::ChangeDisplaySettingsExW match in user32.dll::ChangeDisplaySettingsW match in user32.dll::ChangeMenuA match in user32.dll::ChangeMenuW match in user32.dll::CharLowerA match in user32.dll::CharLowerBuffA match in user32.dll::CharLowerBuffW match in user32.dll::CharLowerW match in user32.dll::CharNextA match in user32.dll::CharNextExA match in user32.dll::CharNextW match in user32.dll::CharPrevA match in user32.dll::CharPrevExA match in user32.dll::CharPrevW match in user32.dll::CharToOemA match in user32.dll::CharToOemBuffA match in user32.dll::CharToOemBuffW match in user32.dll::CharToOemW match in user32.dll::CharUpperA match in user32.dll::CharUpperBuffA match in user32.dll::CharUpperBuffW match in user32.dll::CharUpperW match in user32.dll::CheckDlgButton match in user32.dll::CheckMenuItem match in user32.dll::CheckMenuRadioItem match in user32.dll::CheckRadioButton match in user32.dll::ChildWindowFromPoint mismatch in user32.dll::ChildWindowFromPointEx 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 49 11 00 00 MOV EAX,0x1149 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::CliImmSetHotKey match in user32.dll::ClientThreadSetup match in user32.dll::ClientToScreen mismatch in user32.dll::ClipCursor 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 4a 11 00 00 MOV EAX,0x114a ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::CloseClipboard 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 4b 11 00 00 MOV EAX,0x114b ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::CloseDesktop 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 4c 11 00 00 MOV EAX,0x114c ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::CloseWindow mismatch in user32.dll::CloseWindowStation 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 4d 11 00 00 MOV EAX,0x114d ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::CopyAcceleratorTableA mismatch in user32.dll::CopyAcceleratorTableW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 50 11 00 00 MOV EAX,0x1150 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::CopyIcon match in user32.dll::CopyImage match in user32.dll::CopyRect mismatch in user32.dll::CountClipboardFormats 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 51 11 00 00 MOV EAX,0x1151 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::CreateAcceleratorTableA mismatch in user32.dll::CreateAcceleratorTableW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 52 11 00 00 MOV EAX,0x1152 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::CreateCaret 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 53 11 00 00 MOV EAX,0x1153 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::CreateCursor match in user32.dll::CreateDesktopA match in user32.dll::CreateDesktopW match in user32.dll::CreateDialogIndirectParamA match in user32.dll::CreateDialogIndirectParamAorW match in user32.dll::CreateDialogIndirectParamW match in user32.dll::CreateDialogParamA match in user32.dll::CreateDialogParamW match in user32.dll::CreateIcon match in user32.dll::CreateIconFromResource match in user32.dll::CreateIconFromResourceEx match in user32.dll::CreateIconIndirect match in user32.dll::CreateMDIWindowA match in user32.dll::CreateMDIWindowW mismatch in user32.dll::CreateMenu 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 00 PUSH 0x0 e8 ec 91 fe ff CALL $+0xfffe91ec mismatch in user32.dll::CreatePopupMenu 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 01 PUSH 0x1 e8 8a f8 fe ff CALL $+0xfffef88a mismatch in user32.dll::CreateSystemThreads 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 22 PUSH 0x22 6a 01 PUSH 0x1 match in user32.dll::CreateWindowExA match in user32.dll::CreateWindowExW match in user32.dll::CreateWindowStationA match in user32.dll::CreateWindowStationW match in user32.dll::CsrBroadcastSystemMessageExW match in user32.dll::CtxInitUser32 match in user32.dll::DdeAbandonTransaction match in user32.dll::DdeAccessData mismatch in user32.dll::DdeAddData 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 b0 0f d4 77 PUSH 0x77d40fb0 match in user32.dll::DdeClientTransaction match in user32.dll::DdeCmpStringHandles match in user32.dll::DdeConnect match in user32.dll::DdeConnectList match in user32.dll::DdeCreateDataHandle match in user32.dll::DdeCreateStringHandleA match in user32.dll::DdeCreateStringHandleW match in user32.dll::DdeDisconnect match in user32.dll::DdeDisconnectList match in user32.dll::DdeEnableCallback match in user32.dll::DdeFreeDataHandle match in user32.dll::DdeFreeStringHandle mismatch in user32.dll::DdeGetData 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 c8 10 d4 77 PUSH 0x77d410c8 match in user32.dll::DdeGetLastError mismatch in user32.dll::DdeGetQualityOfService 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 59 11 00 00 MOV EAX,0x1159 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::DdeImpersonateClient match in user32.dll::DdeInitializeA match in user32.dll::DdeInitializeW match in user32.dll::DdeKeepStringHandle match in user32.dll::DdeNameService match in user32.dll::DdePostAdvise mismatch in user32.dll::DdeQueryConvInfo 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 74 PUSH 0x74 68 f0 aa d4 77 PUSH 0x77d4aaf0 match in user32.dll::DdeQueryNextServer match in user32.dll::DdeQueryStringA match in user32.dll::DdeQueryStringW match in user32.dll::DdeReconnect mismatch in user32.dll::DdeSetQualityOfService 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 5b 11 00 00 MOV EAX,0x115b ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::DdeSetUserHandle match in user32.dll::DdeUnaccessData match in user32.dll::DdeUninitialize match in user32.dll::DefDlgProcA match in user32.dll::DefDlgProcW match in user32.dll::DefFrameProcA match in user32.dll::DefFrameProcW match in user32.dll::DefMDIChildProcA match in user32.dll::DefMDIChildProcW match in user32.dll::DefRawInputProc mismatch in user32.dll::DefWindowProcA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 60 d5 cf 77 PUSH 0x77cfd560 mismatch in user32.dll::DefWindowProcW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 b0 b3 cf 77 PUSH 0x77cfb3b0 mismatch in user32.dll::DeferWindowPos 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 5c 11 00 00 MOV EAX,0x115c ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::DeleteMenu 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 5e 11 00 00 MOV EAX,0x115e ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::DeregisterShellHookWindow match in user32.dll::DestroyAcceleratorTable mismatch in user32.dll::DestroyCaret 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 05 PUSH 0x5 e8 7d c2 ff ff CALL $+0xffffc27d match in user32.dll::DestroyCursor match in user32.dll::DestroyIcon mismatch in user32.dll::DestroyMenu 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 62 11 00 00 MOV EAX,0x1162 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::DestroyReasons mismatch in user32.dll::DestroyWindow 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 63 11 00 00 MOV EAX,0x1163 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::DeviceEventWorker match in user32.dll::DialogBoxIndirectParamA match in user32.dll::DialogBoxIndirectParamAorW match in user32.dll::DialogBoxIndirectParamW match in user32.dll::DialogBoxParamA match in user32.dll::DialogBoxParamW mismatch in user32.dll::DisableProcessWindowsGhosting 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 02 PUSH 0x2 e8 f2 22 fc ff CALL $+0xfffc22f2 match in user32.dll::DispatchMessageA match in user32.dll::DispatchMessageW match in user32.dll::DisplayExitWindowsWarnings match in user32.dll::DlgDirListA match in user32.dll::DlgDirListComboBoxA match in user32.dll::DlgDirListComboBoxW match in user32.dll::DlgDirListW match in user32.dll::DlgDirSelectComboBoxExA match in user32.dll::DlgDirSelectComboBoxExW match in user32.dll::DlgDirSelectExA match in user32.dll::DlgDirSelectExW mismatch in user32.dll::DragDetect 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 66 11 00 00 MOV EAX,0x1166 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::DragObject 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 67 11 00 00 MOV EAX,0x1167 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::DrawAnimatedRects 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 68 11 00 00 MOV EAX,0x1168 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::DrawCaption 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 f8 6b d4 77 PUSH 0x77d46bf8 match in user32.dll::DrawCaptionTempA match in user32.dll::DrawCaptionTempW match in user32.dll::DrawEdge match in user32.dll::DrawFocusRect match in user32.dll::DrawFrame mismatch in user32.dll::DrawFrameControl 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 60 e9 d1 77 PUSH 0x77d1e960 match in user32.dll::DrawIcon match in user32.dll::DrawIconEx match in user32.dll::DrawMenuBar match in user32.dll::DrawMenuBarTemp match in user32.dll::DrawStateA match in user32.dll::DrawStateW match in user32.dll::DrawTextA match in user32.dll::DrawTextExA match in user32.dll::DrawTextExW match in user32.dll::DrawTextW match in user32.dll::EditWndProc mismatch in user32.dll::EmptyClipboard 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 6d 11 00 00 MOV EAX,0x116d ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::EnableMenuItem mismatch in user32.dll::EnableScrollBar 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 60 7e d4 77 PUSH 0x77d47e60 match in user32.dll::EnableWindow match in user32.dll::EndDeferWindowPos match in user32.dll::EndDialog mismatch in user32.dll::EndMenu 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 71 11 00 00 MOV EAX,0x1171 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::EndPaint 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 72 11 00 00 MOV EAX,0x1172 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::EndTask match in user32.dll::EnterReaderModeHelper match in user32.dll::EnumChildWindows match in user32.dll::EnumClipboardFormats match in user32.dll::EnumDesktopWindows match in user32.dll::EnumDesktopsA match in user32.dll::EnumDesktopsW match in user32.dll::EnumDisplayDevicesA match in user32.dll::EnumDisplayDevicesW mismatch in user32.dll::EnumDisplayMonitors 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 74 11 00 00 MOV EAX,0x1174 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::EnumDisplaySettingsA match in user32.dll::EnumDisplaySettingsExA match in user32.dll::EnumDisplaySettingsExW match in user32.dll::EnumDisplaySettingsW match in user32.dll::EnumPropsA match in user32.dll::EnumPropsExA match in user32.dll::EnumPropsExW match in user32.dll::EnumPropsW match in user32.dll::EnumThreadWindows match in user32.dll::EnumWindowStationsA match in user32.dll::EnumWindowStationsW match in user32.dll::EnumWindows match in user32.dll::EqualRect mismatch in user32.dll::ExcludeUpdateRgn 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 77 11 00 00 MOV EAX,0x1177 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::ExitWindowsEx match in user32.dll::FillRect match in user32.dll::FindWindowA match in user32.dll::FindWindowExA match in user32.dll::FindWindowExW match in user32.dll::FindWindowW match in user32.dll::FlashWindow mismatch in user32.dll::FlashWindowEx 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 7b 11 00 00 MOV EAX,0x117b ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::FrameRect match in user32.dll::FreeDDElParam mismatch in user32.dll::GetActiveWindow 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 01 PUSH 0x1 e8 6f e8 ff ff CALL $+0xffffe86f match in user32.dll::GetAltTabInfo match in user32.dll::GetAltTabInfoA match in user32.dll::GetAltTabInfoW mismatch in user32.dll::GetAncestor 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 7d 11 00 00 MOV EAX,0x117d ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::GetAppCompatFlags mismatch in user32.dll::GetAppCompatFlags2 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 64 a1 18 00 00 00 MOV EAX,DWORD PTR FS:[0x18] 83 78 40 00 CMP DWORD PTR DS:[EAX+0x40],0x0 match in user32.dll::GetAsyncKeyState mismatch in user32.dll::GetCapture 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP a1 80 00 d5 77 MOV EAX,DWORD PTR DS:[0x77d50080] 83 b8 2c 09 00 00 00 CMP DWORD PTR DS:[EAX+0x92c],0x0 mismatch in user32.dll::GetCaretBlinkTime 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 81 11 00 00 MOV EAX,0x1181 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::GetCaretPos 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 82 11 00 00 MOV EAX,0x1182 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::GetClassInfoA match in user32.dll::GetClassInfoExA match in user32.dll::GetClassInfoExW match in user32.dll::GetClassInfoW mismatch in user32.dll::GetClassLongA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 08 PUSH 0x8 68 e8 f4 d0 77 PUSH 0x77d0f4e8 mismatch in user32.dll::GetClassLongW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 08 PUSH 0x8 68 48 c1 cf 77 PUSH 0x77cfc148 mismatch in user32.dll::GetClassNameA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 a0 f4 d0 77 PUSH 0x77d0f4a0 match in user32.dll::GetClassNameW mismatch in user32.dll::GetClassWord 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 0c PUSH 0xc 68 90 51 d3 77 PUSH 0x77d35190 match in user32.dll::GetClientRect mismatch in user32.dll::GetClipCursor 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 8a 11 00 00 MOV EAX,0x118a ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::GetClipboardData match in user32.dll::GetClipboardFormatNameA match in user32.dll::GetClipboardFormatNameW mismatch in user32.dll::GetClipboardOwner 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 87 11 00 00 MOV EAX,0x1187 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::GetClipboardSequenceNumber 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 88 11 00 00 MOV EAX,0x1188 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::GetClipboardViewer 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 89 11 00 00 MOV EAX,0x1189 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::GetComboBoxInfo 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 8b 11 00 00 MOV EAX,0x118b ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::GetCursor 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 06 PUSH 0x6 e8 7e e7 ff ff CALL $+0xffffe77e match in user32.dll::GetCursorFrameInfo mismatch in user32.dll::GetCursorInfo 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 90 11 00 00 MOV EAX,0x1190 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::GetCursorPos mismatch in user32.dll::GetDC 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 91 11 00 00 MOV EAX,0x1191 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::GetDCEx 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 92 11 00 00 MOV EAX,0x1192 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::GetDesktopWindow mismatch in user32.dll::GetDialogBaseUnits 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 8b 0d 80 00 d5 77 MOV ECX,DWORD PTR DS:[0x77d50080] 0f b7 81 cc 08 00 00 MOVZX EAX,WORD PTR DS:[ECX+0x8cc] match in user32.dll::GetDlgCtrlID match in user32.dll::GetDlgItem match in user32.dll::GetDlgItemInt match in user32.dll::GetDlgItemTextA match in user32.dll::GetDlgItemTextW mismatch in user32.dll::GetDoubleClickTime 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 93 11 00 00 MOV EAX,0x1193 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::GetFocus 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 00 PUSH 0x0 e8 d7 ff ff ff CALL $+0xffffffd7 mismatch in user32.dll::GetForegroundWindow 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 94 11 00 00 MOV EAX,0x1194 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::GetGUIThreadInfo 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 96 11 00 00 MOV EAX,0x1196 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::GetGuiResources 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 95 11 00 00 MOV EAX,0x1195 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::GetIconInfo mismatch in user32.dll::GetInputDesktop 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 08 PUSH 0x8 e8 f1 26 fc ff CALL $+0xfffc26f1 mismatch in user32.dll::GetInputState 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 64 a1 18 00 00 00 MOV EAX,DWORD PTR FS:[0x18] 8b 80 08 07 00 00 MOV EAX,DWORD PTR DS:[EAX+0x708] mismatch in user32.dll::GetInternalWindowPos 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 9b 11 00 00 MOV EAX,0x119b ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::GetKBCodePage 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP ff 25 18 13 cf 77 JMP DWORD PTR DS:[0x77cf1318] 90 NOP match in user32.dll::GetKeyNameTextA match in user32.dll::GetKeyNameTextW match in user32.dll::GetKeyState match in user32.dll::GetKeyboardLayout mismatch in user32.dll::GetKeyboardLayoutList 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 9c 11 00 00 MOV EAX,0x119c ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::GetKeyboardLayoutNameA match in user32.dll::GetKeyboardLayoutNameW mismatch in user32.dll::GetKeyboardState 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 9e 11 00 00 MOV EAX,0x119e ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::GetKeyboardType match in user32.dll::GetLastActivePopup match in user32.dll::GetLastInputInfo mismatch in user32.dll::GetLayeredWindowAttributes 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 44 12 00 00 MOV EAX,0x1244 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::GetListBoxInfo 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 a1 11 00 00 MOV EAX,0x11a1 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::GetMenu mismatch in user32.dll::GetMenuBarInfo 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 a2 11 00 00 MOV EAX,0x11a2 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::GetMenuCheckMarkDimensions 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 8b 0d 80 00 d5 77 MOV ECX,DWORD PTR DS:[0x77d50080] 0f b7 81 e0 06 00 00 MOVZX EAX,WORD PTR DS:[ECX+0x6e0] match in user32.dll::GetMenuContextHelpId match in user32.dll::GetMenuDefaultItem match in user32.dll::GetMenuInfo match in user32.dll::GetMenuItemCount match in user32.dll::GetMenuItemID match in user32.dll::GetMenuItemInfoA match in user32.dll::GetMenuItemInfoW mismatch in user32.dll::GetMenuItemRect 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 a4 11 00 00 MOV EAX,0x11a4 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::GetMenuState match in user32.dll::GetMenuStringA match in user32.dll::GetMenuStringW match in user32.dll::GetMessageA mismatch in user32.dll::GetMessageExtraInfo 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 09 PUSH 0x9 e8 65 58 fc ff CALL $+0xfffc5865 mismatch in user32.dll::GetMessagePos 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 09 PUSH 0x9 e8 1f c5 ff ff CALL $+0xffffc51f mismatch in user32.dll::GetMessageTime 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 0b PUSH 0xb e8 bf fa ff ff CALL $+0xfffffabf match in user32.dll::GetMessageW match in user32.dll::GetMonitorInfoA match in user32.dll::GetMonitorInfoW mismatch in user32.dll::GetMouseMovePointsEx 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 a6 11 00 00 MOV EAX,0x11a6 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::GetNextDlgGroupItem match in user32.dll::GetNextDlgTabItem mismatch in user32.dll::GetOpenClipboardWindow 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 a8 11 00 00 MOV EAX,0x11a8 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::GetParent 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 0c PUSH 0xc 68 88 b7 cf 77 PUSH 0x77cfb788 mismatch in user32.dll::GetPriorityClipboardFormat 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 a9 11 00 00 MOV EAX,0x11a9 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::GetProcessDefaultLayout mismatch in user32.dll::GetProcessWindowStation 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 aa 11 00 00 MOV EAX,0x11aa ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::GetProgmanWindow 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 64 a1 18 00 00 00 MOV EAX,DWORD PTR FS:[0x18] 83 78 40 00 CMP DWORD PTR DS:[EAX+0x40],0x0 match in user32.dll::GetPropA match in user32.dll::GetPropW match in user32.dll::GetQueueStatus match in user32.dll::GetRawInputBuffer mismatch in user32.dll::GetRawInputData 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 ac 11 00 00 MOV EAX,0x11ac ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::GetRawInputDeviceInfoA match in user32.dll::GetRawInputDeviceInfoW mismatch in user32.dll::GetRawInputDeviceList 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 ae 11 00 00 MOV EAX,0x11ae ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::GetReasonTitleFromReasonCode mismatch in user32.dll::GetRegisteredRawInputDevices 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 af 11 00 00 MOV EAX,0x11af ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::GetScrollBarInfo 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 b0 11 00 00 MOV EAX,0x11b0 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::GetScrollInfo 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 f8 0d d0 77 PUSH 0x77d00df8 match in user32.dll::GetScrollPos match in user32.dll::GetScrollRange mismatch in user32.dll::GetShellWindow 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 64 a1 18 00 00 00 MOV EAX,DWORD PTR FS:[0x18] 83 78 40 00 CMP DWORD PTR DS:[EAX+0x40],0x0 match in user32.dll::GetSubMenu match in user32.dll::GetSysColor match in user32.dll::GetSysColorBrush mismatch in user32.dll::GetSystemMenu 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 b1 11 00 00 MOV EAX,0x11b1 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::GetSystemMetrics 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 00 90 cf 77 PUSH 0x77cf9000 match in user32.dll::GetTabbedTextExtentA match in user32.dll::GetTabbedTextExtentW mismatch in user32.dll::GetTaskmanWindow 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 64 a1 18 00 00 00 MOV EAX,DWORD PTR FS:[0x18] 83 78 40 00 CMP DWORD PTR DS:[EAX+0x40],0x0 match in user32.dll::GetThreadDesktop mismatch in user32.dll::GetTitleBarInfo 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 b4 11 00 00 MOV EAX,0x11b4 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::GetTopWindow match in user32.dll::GetUpdateRect match in user32.dll::GetUpdateRgn match in user32.dll::GetUserObjectInformationA mismatch in user32.dll::GetUserObjectInformationW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 a7 11 00 00 MOV EAX,0x11a7 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::GetUserObjectSecurity match in user32.dll::GetWinStationInfo match in user32.dll::GetWindow match in user32.dll::GetWindowContextHelpId mismatch in user32.dll::GetWindowDC 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 b7 11 00 00 MOV EAX,0x11b7 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::GetWindowInfo 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 50 e8 cf 77 PUSH 0x77cfe850 mismatch in user32.dll::GetWindowLongA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 08 PUSH 0x8 68 98 94 cf 77 PUSH 0x77cf9498 mismatch in user32.dll::GetWindowLongW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 08 PUSH 0x8 68 e0 88 cf 77 PUSH 0x77cf88e0 match in user32.dll::GetWindowModuleFileName match in user32.dll::GetWindowModuleFileNameA match in user32.dll::GetWindowModuleFileNameW mismatch in user32.dll::GetWindowPlacement 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 b8 11 00 00 MOV EAX,0x11b8 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::GetWindowRect match in user32.dll::GetWindowRgn match in user32.dll::GetWindowRgnBox mismatch in user32.dll::GetWindowTextA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 0c PUSH 0xc 68 90 21 d1 77 PUSH 0x77d12190 match in user32.dll::GetWindowTextLengthA match in user32.dll::GetWindowTextLengthW mismatch in user32.dll::GetWindowTextW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 0c PUSH 0xc 68 10 ce cf 77 PUSH 0x77cfce10 match in user32.dll::GetWindowThreadProcessId match in user32.dll::GetWindowWord match in user32.dll::GrayStringA match in user32.dll::GrayStringW mismatch in user32.dll::HideCaret 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 bb 11 00 00 MOV EAX,0x11bb ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::HiliteMenuItem 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 bc 11 00 00 MOV EAX,0x11bc ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::IMPGetIMEA match in user32.dll::IMPGetIMEW match in user32.dll::IMPQueryIMEA match in user32.dll::IMPQueryIMEW match in user32.dll::IMPSetIMEA match in user32.dll::IMPSetIMEW mismatch in user32.dll::ImpersonateDdeClientWindow 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 bd 11 00 00 MOV EAX,0x11bd ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::InSendMessage 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 64 a1 18 00 00 00 MOV EAX,DWORD PTR FS:[0x18] 8b 80 08 07 00 00 MOV EAX,DWORD PTR DS:[EAX+0x708] mismatch in user32.dll::InSendMessageEx 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 64 a1 18 00 00 00 MOV EAX,DWORD PTR FS:[0x18] 8b 80 08 07 00 00 MOV EAX,DWORD PTR DS:[EAX+0x708] match in user32.dll::InflateRect match in user32.dll::InitializeLpkHooks match in user32.dll::InitializeWin32EntryTable match in user32.dll::InsertMenuA match in user32.dll::InsertMenuItemA match in user32.dll::InsertMenuItemW match in user32.dll::InsertMenuW match in user32.dll::InternalGetWindowText match in user32.dll::IntersectRect mismatch in user32.dll::InvalidateRect 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 c2 11 00 00 MOV EAX,0x11c2 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::InvalidateRgn 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 c3 11 00 00 MOV EAX,0x11c3 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::InvertRect match in user32.dll::IsCharAlphaA match in user32.dll::IsCharAlphaNumericA match in user32.dll::IsCharAlphaNumericW match in user32.dll::IsCharAlphaW match in user32.dll::IsCharLowerA match in user32.dll::IsCharLowerW match in user32.dll::IsCharUpperA match in user32.dll::IsCharUpperW match in user32.dll::IsChild mismatch in user32.dll::IsClipboardFormatAvailable 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 c4 11 00 00 MOV EAX,0x11c4 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::IsDialogMessage match in user32.dll::IsDialogMessageA match in user32.dll::IsDialogMessageW match in user32.dll::IsDlgButtonChecked match in user32.dll::IsGUIThread match in user32.dll::IsHungAppWindow match in user32.dll::IsIconic match in user32.dll::IsMenu match in user32.dll::IsRectEmpty match in user32.dll::IsServerSideWindow match in user32.dll::IsWinEventHookInstalled mismatch in user32.dll::IsWindow 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 0c PUSH 0xc 68 70 b9 cf 77 PUSH 0x77cfb970 match in user32.dll::IsWindowEnabled match in user32.dll::IsWindowInDestroy match in user32.dll::IsWindowUnicode mismatch in user32.dll::IsWindowVisible 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 0c PUSH 0xc 68 98 c4 cf 77 PUSH 0x77cfc498 match in user32.dll::IsZoomed match in user32.dll::KillSystemTimer mismatch in user32.dll::KillTimer 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 c5 11 00 00 MOV EAX,0x11c5 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::LoadAcceleratorsA match in user32.dll::LoadAcceleratorsW match in user32.dll::LoadBitmapA match in user32.dll::LoadBitmapW match in user32.dll::LoadCursorA match in user32.dll::LoadCursorFromFileA match in user32.dll::LoadCursorFromFileW match in user32.dll::LoadCursorW match in user32.dll::LoadIconA match in user32.dll::LoadIconW match in user32.dll::LoadImageA match in user32.dll::LoadImageW match in user32.dll::LoadKeyboardLayoutA match in user32.dll::LoadKeyboardLayoutEx match in user32.dll::LoadKeyboardLayoutW mismatch in user32.dll::LoadLocalFonts 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 2f PUSH 0x2f 6a 00 PUSH 0x0 match in user32.dll::LoadMenuA match in user32.dll::LoadMenuIndirectA match in user32.dll::LoadMenuIndirectW match in user32.dll::LoadMenuW mismatch in user32.dll::LoadRemoteFonts 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 2f PUSH 0x2f 6a 01 PUSH 0x1 match in user32.dll::LoadStringA match in user32.dll::LoadStringW match in user32.dll::LockSetForegroundWindow mismatch in user32.dll::LockWindowStation 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 c7 11 00 00 MOV EAX,0x11c7 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::LockWindowUpdate 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 c8 11 00 00 MOV EAX,0x11c8 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::LockWorkStation 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 c9 11 00 00 MOV EAX,0x11c9 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::LookupIconIdFromDirectory match in user32.dll::LookupIconIdFromDirectoryEx match in user32.dll::MBToWCSEx match in user32.dll::MB_GetString match in user32.dll::MapDialogRect match in user32.dll::MapVirtualKeyA match in user32.dll::MapVirtualKeyExA match in user32.dll::MapVirtualKeyExW match in user32.dll::MapVirtualKeyW match in user32.dll::MapWindowPoints mismatch in user32.dll::MenuItemFromPoint 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 cb 11 00 00 MOV EAX,0x11cb ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::MenuWindowProcA match in user32.dll::MenuWindowProcW match in user32.dll::MessageBeep match in user32.dll::MessageBoxA match in user32.dll::MessageBoxExA match in user32.dll::MessageBoxExW match in user32.dll::MessageBoxIndirectA match in user32.dll::MessageBoxIndirectW match in user32.dll::MessageBoxTimeoutA match in user32.dll::MessageBoxTimeoutW match in user32.dll::MessageBoxW match in user32.dll::ModifyMenuA match in user32.dll::ModifyMenuW mismatch in user32.dll::MonitorFromPoint 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 08 PUSH 0x8 68 28 f5 cf 77 PUSH 0x77cff528 mismatch in user32.dll::MonitorFromRect 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 08 PUSH 0x8 68 30 ea cf 77 PUSH 0x77cfea30 mismatch in user32.dll::MonitorFromWindow 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 08 PUSH 0x8 68 b0 ce cf 77 PUSH 0x77cfceb0 mismatch in user32.dll::MoveWindow 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 d1 11 00 00 MOV EAX,0x11d1 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::MsgWaitForMultipleObjects match in user32.dll::MsgWaitForMultipleObjectsEx match in user32.dll::NotifyWinEvent match in user32.dll::OemKeyScan match in user32.dll::OemToCharA match in user32.dll::OemToCharBuffA match in user32.dll::OemToCharBuffW match in user32.dll::OemToCharW match in user32.dll::OffsetRect match in user32.dll::OpenClipboard match in user32.dll::OpenDesktopA match in user32.dll::OpenDesktopW match in user32.dll::OpenIcon mismatch in user32.dll::OpenInputDesktop 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 d7 11 00 00 MOV EAX,0x11d7 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::OpenWindowStationA match in user32.dll::OpenWindowStationW match in user32.dll::PackDDElParam mismatch in user32.dll::PaintDesktop 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 d9 11 00 00 MOV EAX,0x11d9 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::PaintMenuBar 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 37 12 00 00 MOV EAX,0x1237 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::PeekMessageA match in user32.dll::PeekMessageW match in user32.dll::PostMessageA match in user32.dll::PostMessageW match in user32.dll::PostQuitMessage match in user32.dll::PostThreadMessageA match in user32.dll::PostThreadMessageW mismatch in user32.dll::PrintWindow 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 dd 11 00 00 MOV EAX,0x11dd ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::PrivateExtractIconExA match in user32.dll::PrivateExtractIconExW match in user32.dll::PrivateExtractIconsA match in user32.dll::PrivateExtractIconsW mismatch in user32.dll::PrivateSetDbgTag 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 02 12 00 00 MOV EAX,0x1202 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::PrivateSetRipFlags 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 14 12 00 00 MOV EAX,0x1214 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::PtInRect mismatch in user32.dll::QuerySendMessage 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 e1 11 00 00 MOV EAX,0x11e1 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::QueryUserCounters 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 e2 11 00 00 MOV EAX,0x11e2 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::RealChildWindowFromPoint 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 e4 11 00 00 MOV EAX,0x11e4 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::RealGetWindowClass match in user32.dll::RealGetWindowClassA match in user32.dll::RealGetWindowClassW match in user32.dll::ReasonCodeNeedsBugID match in user32.dll::ReasonCodeNeedsComment mismatch in user32.dll::RecordShutdownReason 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 48 04 00 00 PUSH 0x448 68 48 9b d3 77 PUSH 0x77d39b48 mismatch in user32.dll::RedrawWindow 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 e7 11 00 00 MOV EAX,0x11e7 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::RegisterClassA match in user32.dll::RegisterClassExA match in user32.dll::RegisterClassExW match in user32.dll::RegisterClassW match in user32.dll::RegisterClipboardFormatA match in user32.dll::RegisterClipboardFormatW match in user32.dll::RegisterDeviceNotificationA match in user32.dll::RegisterDeviceNotificationW mismatch in user32.dll::RegisterHotKey 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 ea 11 00 00 MOV EAX,0x11ea ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::RegisterLogonProcess match in user32.dll::RegisterMessagePumpHook mismatch in user32.dll::RegisterRawInputDevices 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 eb 11 00 00 MOV EAX,0x11eb ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::RegisterServicesProcess match in user32.dll::RegisterShellHookWindow match in user32.dll::RegisterSystemThread mismatch in user32.dll::RegisterTasklist 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 ec 11 00 00 MOV EAX,0x11ec ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::RegisterUserApiHook match in user32.dll::RegisterWindowMessageA match in user32.dll::RegisterWindowMessageW mismatch in user32.dll::ReleaseCapture 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 0d PUSH 0xd e8 c9 ad ff ff CALL $+0xffffadc9 match in user32.dll::ReleaseDC mismatch in user32.dll::RemoveMenu 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 ee 11 00 00 MOV EAX,0x11ee ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::RemovePropA match in user32.dll::RemovePropW match in user32.dll::ReplyMessage mismatch in user32.dll::ResolveDesktopForWOW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 f1 11 00 00 MOV EAX,0x11f1 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::ReuseDDElParam match in user32.dll::ScreenToClient match in user32.dll::ScrollChildren match in user32.dll::ScrollDC match in user32.dll::ScrollWindow match in user32.dll::ScrollWindowEx match in user32.dll::SendDlgItemMessageA match in user32.dll::SendDlgItemMessageW match in user32.dll::SendIMEMessageExA match in user32.dll::SendIMEMessageExW mismatch in user32.dll::SendInput 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 f6 11 00 00 MOV EAX,0x11f6 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::SendMessageA match in user32.dll::SendMessageCallbackA match in user32.dll::SendMessageCallbackW match in user32.dll::SendMessageTimeoutA match in user32.dll::SendMessageTimeoutW match in user32.dll::SendMessageW match in user32.dll::SendNotifyMessageA match in user32.dll::SendNotifyMessageW mismatch in user32.dll::SetActiveWindow 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 f7 11 00 00 MOV EAX,0x11f7 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::SetCapture 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 f9 11 00 00 MOV EAX,0x11f9 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::SetCaretBlinkTime match in user32.dll::SetCaretPos match in user32.dll::SetClassLongA match in user32.dll::SetClassLongW mismatch in user32.dll::SetClassWord 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 fb 11 00 00 MOV EAX,0x11fb ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::SetClipboardData mismatch in user32.dll::SetClipboardViewer 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 fd 11 00 00 MOV EAX,0x11fd ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::SetConsoleReserveKeys 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 fe 11 00 00 MOV EAX,0x11fe ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::SetCursor 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 ff 11 00 00 MOV EAX,0x11ff ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::SetCursorContents 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 00 12 00 00 MOV EAX,0x1200 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::SetCursorPos mismatch in user32.dll::SetDebugErrorLevel 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP c2 04 00 RET 0x4 90 NOP match in user32.dll::SetDeskWallpaper match in user32.dll::SetDlgItemInt match in user32.dll::SetDlgItemTextA match in user32.dll::SetDlgItemTextW match in user32.dll::SetDoubleClickTime mismatch in user32.dll::SetFocus 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 03 12 00 00 MOV EAX,0x1203 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::SetForegroundWindow mismatch in user32.dll::SetInternalWindowPos 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 09 12 00 00 MOV EAX,0x1209 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::SetKeyboardState 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 0a 12 00 00 MOV EAX,0x120a ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::SetLastErrorEx mismatch in user32.dll::SetLayeredWindowAttributes 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 45 12 00 00 MOV EAX,0x1245 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::SetLogonNotifyWindow 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 0b 12 00 00 MOV EAX,0x120b ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::SetMenu mismatch in user32.dll::SetMenuContextHelpId 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 0d 12 00 00 MOV EAX,0x120d ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::SetMenuDefaultItem 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 0e 12 00 00 MOV EAX,0x120e ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::SetMenuInfo match in user32.dll::SetMenuItemBitmaps match in user32.dll::SetMenuItemInfoA match in user32.dll::SetMenuItemInfoW match in user32.dll::SetMessageExtraInfo mismatch in user32.dll::SetMessageQueue 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 33 c0 XOR EAX,EAX 40 INC EAX mismatch in user32.dll::SetParent 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 11 12 00 00 MOV EAX,0x1211 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::SetProcessDefaultLayout mismatch in user32.dll::SetProcessWindowStation 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 12 12 00 00 MOV EAX,0x1212 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::SetProgmanWindow match in user32.dll::SetPropA match in user32.dll::SetPropW match in user32.dll::SetRect match in user32.dll::SetRectEmpty mismatch in user32.dll::SetScrollInfo 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 b0 90 cf 77 PUSH 0x77cf90b0 match in user32.dll::SetScrollPos match in user32.dll::SetScrollRange match in user32.dll::SetShellWindow mismatch in user32.dll::SetShellWindowEx 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 16 12 00 00 MOV EAX,0x1216 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::SetSysColors match in user32.dll::SetSysColorsTemp match in user32.dll::SetSystemCursor mismatch in user32.dll::SetSystemMenu 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 19 12 00 00 MOV EAX,0x1219 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::SetSystemTimer 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 1a 12 00 00 MOV EAX,0x121a ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::SetTaskmanWindow mismatch in user32.dll::SetThreadDesktop 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 1b 12 00 00 MOV EAX,0x121b ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::SetTimer 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 1e 12 00 00 MOV EAX,0x121e ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::SetUserObjectInformationA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 10 12 00 00 MOV EAX,0x1210 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::SetUserObjectInformationW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 10 12 00 00 MOV EAX,0x1210 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::SetUserObjectSecurity match in user32.dll::SetWinEventHook match in user32.dll::SetWindowContextHelpId match in user32.dll::SetWindowLongA match in user32.dll::SetWindowLongW mismatch in user32.dll::SetWindowPlacement 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 21 12 00 00 MOV EAX,0x1221 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::SetWindowPos 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 22 12 00 00 MOV EAX,0x1222 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::SetWindowRgn 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 08 00 d0 77 PUSH 0x77d00008 match in user32.dll::SetWindowStationUser match in user32.dll::SetWindowTextA match in user32.dll::SetWindowTextW mismatch in user32.dll::SetWindowWord 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 27 12 00 00 MOV EAX,0x1227 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::SetWindowsHookA match in user32.dll::SetWindowsHookExA match in user32.dll::SetWindowsHookExW match in user32.dll::SetWindowsHookW mismatch in user32.dll::ShowCaret 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 29 12 00 00 MOV EAX,0x1229 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::ShowCursor match in user32.dll::ShowOwnedPopups mismatch in user32.dll::ShowScrollBar 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 2a 12 00 00 MOV EAX,0x122a ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::ShowStartGlass mismatch in user32.dll::ShowWindow 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 2b 12 00 00 MOV EAX,0x122b ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::ShowWindowAsync 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 2c 12 00 00 MOV EAX,0x122c ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::SoftModalMessageBox match in user32.dll::SubtractRect match in user32.dll::SwapMouseButton mismatch in user32.dll::SwitchDesktop 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 2e 12 00 00 MOV EAX,0x122e ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::SwitchToThisWindow mismatch in user32.dll::SystemParametersInfoA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 c0 07 d0 77 PUSH 0x77d007c0 mismatch in user32.dll::SystemParametersInfoW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 78 9f cf 77 PUSH 0x77cf9f78 match in user32.dll::TabbedTextOutA match in user32.dll::TabbedTextOutW match in user32.dll::TileChildWindows match in user32.dll::TileWindows match in user32.dll::ToAscii match in user32.dll::ToAsciiEx match in user32.dll::ToUnicode match in user32.dll::ToUnicodeEx mismatch in user32.dll::TrackMouseEvent 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 34 12 00 00 MOV EAX,0x1234 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::TrackPopupMenu mismatch in user32.dll::TrackPopupMenuEx 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 35 12 00 00 MOV EAX,0x1235 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::TranslateAccelerator match in user32.dll::TranslateAcceleratorA match in user32.dll::TranslateAcceleratorW match in user32.dll::TranslateMDISysAccel match in user32.dll::TranslateMessage match in user32.dll::TranslateMessageEx mismatch in user32.dll::UnhookWinEvent 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 3b 12 00 00 MOV EAX,0x123b ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::UnhookWindowsHook mismatch in user32.dll::UnhookWindowsHookEx 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 3a 12 00 00 MOV EAX,0x123a ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::UnionRect match in user32.dll::UnloadKeyboardLayout mismatch in user32.dll::UnlockWindowStation 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 3d 12 00 00 MOV EAX,0x123d ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::UnpackDDElParam match in user32.dll::UnregisterClassA match in user32.dll::UnregisterClassW mismatch in user32.dll::UnregisterDeviceNotification 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 48 d0 d0 77 PUSH 0x77d0d048 mismatch in user32.dll::UnregisterHotKey 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 40 12 00 00 MOV EAX,0x1240 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::UnregisterMessagePumpHook mismatch in user32.dll::UnregisterUserApiHook 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 3f 12 00 00 MOV EAX,0x123f ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::UpdateLayeredWindow 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 43 12 00 00 MOV EAX,0x1243 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::UpdatePerUserSystemParameters match in user32.dll::UpdateWindow match in user32.dll::User32InitializeImmEntryTable match in user32.dll::UserClientDllInitialize mismatch in user32.dll::UserHandleGrantAccess 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 47 12 00 00 MOV EAX,0x1247 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::UserLpkPSMTextOut match in user32.dll::UserLpkTabbedTextOut match in user32.dll::UserRealizePalette match in user32.dll::UserRegisterWowHandlers mismatch in user32.dll::VRipOutput 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 33 c0 XOR EAX,EAX c3 RET mismatch in user32.dll::VTagOutput 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 33 c0 XOR EAX,EAX c3 RET mismatch in user32.dll::ValidateRect 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 49 12 00 00 MOV EAX,0x1249 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::ValidateRgn match in user32.dll::VkKeyScanA match in user32.dll::VkKeyScanExA match in user32.dll::VkKeyScanExW match in user32.dll::VkKeyScanW match in user32.dll::WCSToMBEx match in user32.dll::WINNLSEnableIME match in user32.dll::WINNLSGetEnableStatus mismatch in user32.dll::WINNLSGetIMEHotkey 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 33 c0 XOR EAX,EAX c2 04 00 RET 0x4 match in user32.dll::WaitForInputIdle mismatch in user32.dll::WaitMessage 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 4e 12 00 00 MOV EAX,0x124e ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in user32.dll::Win32PoolAllocationStats 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 4f 12 00 00 MOV EAX,0x124f ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::WinHelpA match in user32.dll::WinHelpW match in user32.dll::WindowFromDC mismatch in user32.dll::WindowFromPoint 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 50 12 00 00 MOV EAX,0x1250 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in user32.dll::keybd_event match in user32.dll::mouse_event match in user32.dll::wsprintfA match in user32.dll::wsprintfW match in user32.dll::wvsprintfA match in user32.dll::wvsprintfW match in GDI32.dll::AbortDoc match in GDI32.dll::AbortPath match in GDI32.dll::AddFontMemResourceEx match in GDI32.dll::AddFontResourceA mismatch in GDI32.dll::AddFontResourceExA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 2c 02 00 00 PUSH 0x22c 68 e8 90 e3 77 PUSH 0x77e390e8 match in GDI32.dll::AddFontResourceExW match in GDI32.dll::AddFontResourceTracking match in GDI32.dll::AddFontResourceW match in GDI32.dll::AngleArc match in GDI32.dll::AnimatePalette mismatch in GDI32.dll::AnyLinkedFonts 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 09 10 00 00 MOV EAX,0x1009 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in GDI32.dll::Arc match in GDI32.dll::ArcTo mismatch in GDI32.dll::BRUSHOBJ_hGetColorTransform 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 7d 12 00 00 MOV EAX,0x127d ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::BRUSHOBJ_pvAllocRbrush 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 7b 12 00 00 MOV EAX,0x127b ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::BRUSHOBJ_pvGetRbrush 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 7c 12 00 00 MOV EAX,0x127c ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::BRUSHOBJ_ulGetBrushColor 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 7a 12 00 00 MOV EAX,0x127a ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in GDI32.dll::BeginPath match in GDI32.dll::BitBlt mismatch in GDI32.dll::CLIPOBJ_bEnum 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 74 12 00 00 MOV EAX,0x1274 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::CLIPOBJ_cEnumStart 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 75 12 00 00 MOV EAX,0x1275 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::CLIPOBJ_ppoGetPath 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 76 12 00 00 MOV EAX,0x1276 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in GDI32.dll::CancelDC match in GDI32.dll::CheckColorsInGamut match in GDI32.dll::ChoosePixelFormat match in GDI32.dll::Chord match in GDI32.dll::ClearBitmapAttributes match in GDI32.dll::ClearBrushAttributes match in GDI32.dll::CloseEnhMetaFile match in GDI32.dll::CloseFigure match in GDI32.dll::CloseMetaFile match in GDI32.dll::ColorCorrectPalette match in GDI32.dll::ColorMatchToTarget match in GDI32.dll::CombineRgn match in GDI32.dll::CombineTransform match in GDI32.dll::CopyEnhMetaFileA match in GDI32.dll::CopyEnhMetaFileW match in GDI32.dll::CopyMetaFileA match in GDI32.dll::CopyMetaFileW match in GDI32.dll::CreateBitmap match in GDI32.dll::CreateBitmapIndirect match in GDI32.dll::CreateBrushIndirect match in GDI32.dll::CreateColorSpaceA match in GDI32.dll::CreateColorSpaceW match in GDI32.dll::CreateCompatibleBitmap match in GDI32.dll::CreateCompatibleDC match in GDI32.dll::CreateDCA match in GDI32.dll::CreateDCW match in GDI32.dll::CreateDIBPatternBrush match in GDI32.dll::CreateDIBPatternBrushPt match in GDI32.dll::CreateDIBSection match in GDI32.dll::CreateDIBitmap match in GDI32.dll::CreateDiscardableBitmap match in GDI32.dll::CreateEllipticRgn match in GDI32.dll::CreateEllipticRgnIndirect match in GDI32.dll::CreateEnhMetaFileA match in GDI32.dll::CreateEnhMetaFileW match in GDI32.dll::CreateFontA match in GDI32.dll::CreateFontIndirectA match in GDI32.dll::CreateFontIndirectExA match in GDI32.dll::CreateFontIndirectExW match in GDI32.dll::CreateFontIndirectW match in GDI32.dll::CreateFontW mismatch in GDI32.dll::CreateHalftonePalette 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 23 10 00 00 MOV EAX,0x1023 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in GDI32.dll::CreateHatchBrush match in GDI32.dll::CreateICA match in GDI32.dll::CreateICW match in GDI32.dll::CreateMetaFileA match in GDI32.dll::CreateMetaFileW match in GDI32.dll::CreatePalette match in GDI32.dll::CreatePatternBrush match in GDI32.dll::CreatePen match in GDI32.dll::CreatePenIndirect match in GDI32.dll::CreatePolyPolygonRgn match in GDI32.dll::CreatePolygonRgn match in GDI32.dll::CreateRectRgn match in GDI32.dll::CreateRectRgnIndirect match in GDI32.dll::CreateRoundRectRgn match in GDI32.dll::CreateScalableFontResourceA match in GDI32.dll::CreateScalableFontResourceW match in GDI32.dll::CreateSolidBrush match in GDI32.dll::DPtoLP mismatch in GDI32.dll::DdEntry0 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 76 10 00 00 MOV EAX,0x1076 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry1 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 36 10 00 00 MOV EAX,0x1036 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry10 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 37 10 00 00 MOV EAX,0x1037 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry11 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 38 10 00 00 MOV EAX,0x1038 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry12 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 39 10 00 00 MOV EAX,0x1039 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry13 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 3a 10 00 00 MOV EAX,0x103a ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry14 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 3b 10 00 00 MOV EAX,0x103b ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry15 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 3c 10 00 00 MOV EAX,0x103c ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry16 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 3d 10 00 00 MOV EAX,0x103d ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry17 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 3e 10 00 00 MOV EAX,0x103e ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry18 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 3f 10 00 00 MOV EAX,0x103f ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry19 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 2d 10 00 00 MOV EAX,0x102d ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry2 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 40 10 00 00 MOV EAX,0x1040 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry20 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 41 10 00 00 MOV EAX,0x1041 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry21 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 42 10 00 00 MOV EAX,0x1042 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry22 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 43 10 00 00 MOV EAX,0x1043 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry23 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 44 10 00 00 MOV EAX,0x1044 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry24 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 45 10 00 00 MOV EAX,0x1045 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry25 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 46 10 00 00 MOV EAX,0x1046 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry26 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 47 10 00 00 MOV EAX,0x1047 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry27 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 48 10 00 00 MOV EAX,0x1048 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry28 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 49 10 00 00 MOV EAX,0x1049 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry29 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 2e 10 00 00 MOV EAX,0x102e ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry3 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 4a 10 00 00 MOV EAX,0x104a ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry30 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 4b 10 00 00 MOV EAX,0x104b ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry31 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 4c 10 00 00 MOV EAX,0x104c ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry32 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 4d 10 00 00 MOV EAX,0x104d ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry33 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 4e 10 00 00 MOV EAX,0x104e ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry34 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 4f 10 00 00 MOV EAX,0x104f ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry35 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 50 10 00 00 MOV EAX,0x1050 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry36 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 51 10 00 00 MOV EAX,0x1051 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry37 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 52 10 00 00 MOV EAX,0x1052 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry38 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 53 10 00 00 MOV EAX,0x1053 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry39 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 2f 10 00 00 MOV EAX,0x102f ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry4 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 54 10 00 00 MOV EAX,0x1054 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry40 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 55 10 00 00 MOV EAX,0x1055 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry41 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 56 10 00 00 MOV EAX,0x1056 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry42 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 57 10 00 00 MOV EAX,0x1057 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry43 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 58 10 00 00 MOV EAX,0x1058 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry44 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 59 10 00 00 MOV EAX,0x1059 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry45 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 5a 10 00 00 MOV EAX,0x105a ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry46 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 5b 10 00 00 MOV EAX,0x105b ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry47 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 5c 10 00 00 MOV EAX,0x105c ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry48 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 5d 10 00 00 MOV EAX,0x105d ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry49 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 30 10 00 00 MOV EAX,0x1030 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry5 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 5e 10 00 00 MOV EAX,0x105e ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry50 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 5f 10 00 00 MOV EAX,0x105f ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry51 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 60 10 00 00 MOV EAX,0x1060 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry52 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 61 10 00 00 MOV EAX,0x1061 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry53 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 62 10 00 00 MOV EAX,0x1062 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry54 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 63 10 00 00 MOV EAX,0x1063 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry55 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 64 10 00 00 MOV EAX,0x1064 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry56 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 31 10 00 00 MOV EAX,0x1031 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry6 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 32 10 00 00 MOV EAX,0x1032 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry7 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 33 10 00 00 MOV EAX,0x1033 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry8 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 34 10 00 00 MOV EAX,0x1034 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::DdEntry9 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 35 10 00 00 MOV EAX,0x1035 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in GDI32.dll::DeleteColorSpace match in GDI32.dll::DeleteDC match in GDI32.dll::DeleteEnhMetaFile match in GDI32.dll::DeleteMetaFile match in GDI32.dll::DeleteObject match in GDI32.dll::DescribePixelFormat mismatch in GDI32.dll::DeviceCapabilitiesExA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 83 c8 ff OR EAX,0xffffffff c2 18 00 RET 0x18 mismatch in GDI32.dll::DeviceCapabilitiesExW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 83 c8 ff OR EAX,0xffffffff c2 18 00 RET 0x18 match in GDI32.dll::DrawEscape match in GDI32.dll::Ellipse mismatch in GDI32.dll::EnableEUDC 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 81 10 00 00 MOV EAX,0x1081 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in GDI32.dll::EndDoc match in GDI32.dll::EndFormPage match in GDI32.dll::EndPage match in GDI32.dll::EndPath match in GDI32.dll::EngAcquireSemaphore mismatch in GDI32.dll::EngAlphaBlend 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 6c 12 00 00 MOV EAX,0x126c ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::EngAssociateSurface 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 57 12 00 00 MOV EAX,0x1257 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::EngBitBlt 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 63 12 00 00 MOV EAX,0x1263 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::EngCheckAbort 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 93 12 00 00 MOV EAX,0x1293 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in GDI32.dll::EngComputeGlyphSet mismatch in GDI32.dll::EngCopyBits 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 5d 12 00 00 MOV EAX,0x125d ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::EngCreateBitmap 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 58 12 00 00 MOV EAX,0x1258 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::EngCreateClip 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 78 12 00 00 MOV EAX,0x1278 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::EngCreateDeviceBitmap 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 5a 12 00 00 MOV EAX,0x125a ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::EngCreateDeviceSurface 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 59 12 00 00 MOV EAX,0x1259 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::EngCreatePalette 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 5b 12 00 00 MOV EAX,0x125b ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in GDI32.dll::EngCreateSemaphore mismatch in GDI32.dll::EngDeleteClip 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 79 12 00 00 MOV EAX,0x1279 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::EngDeletePalette 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 5e 12 00 00 MOV EAX,0x125e ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::EngDeletePath 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 77 12 00 00 MOV EAX,0x1277 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in GDI32.dll::EngDeleteSemaphore mismatch in GDI32.dll::EngDeleteSurface 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 5f 12 00 00 MOV EAX,0x125f ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::EngEraseSurface 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 60 12 00 00 MOV EAX,0x1260 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::EngFillPath 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 68 12 00 00 MOV EAX,0x1268 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in GDI32.dll::EngFindResource match in GDI32.dll::EngFreeModule match in GDI32.dll::EngGetCurrentCodePage match in GDI32.dll::EngGetDriverName match in GDI32.dll::EngGetPrinterDataFileName mismatch in GDI32.dll::EngGradientFill 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 6d 12 00 00 MOV EAX,0x126d ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::EngLineTo 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 6b 12 00 00 MOV EAX,0x126b ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in GDI32.dll::EngLoadModule mismatch in GDI32.dll::EngLockSurface 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 62 12 00 00 MOV EAX,0x1262 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::EngMarkBandingSurface 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 66 12 00 00 MOV EAX,0x1266 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in GDI32.dll::EngMultiByteToUnicodeN match in GDI32.dll::EngMultiByteToWideChar mismatch in GDI32.dll::EngPaint 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 6a 12 00 00 MOV EAX,0x126a ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::EngPlgBlt 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 65 12 00 00 MOV EAX,0x1265 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::EngQueryEMFInfo 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 33 c0 XOR EAX,EAX c2 08 00 RET 0x8 match in GDI32.dll::EngQueryLocalTime match in GDI32.dll::EngReleaseSemaphore mismatch in GDI32.dll::EngStretchBlt 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 64 12 00 00 MOV EAX,0x1264 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::EngStretchBltROP 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 70 12 00 00 MOV EAX,0x1270 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::EngStrokeAndFillPath 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 69 12 00 00 MOV EAX,0x1269 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::EngStrokePath 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 67 12 00 00 MOV EAX,0x1267 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::EngTextOut 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 6f 12 00 00 MOV EAX,0x126f ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::EngTransparentBlt 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 6e 12 00 00 MOV EAX,0x126e ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in GDI32.dll::EngUnicodeToMultiByteN mismatch in GDI32.dll::EngUnlockSurface 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 61 12 00 00 MOV EAX,0x1261 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in GDI32.dll::EngWideCharToMultiByte match in GDI32.dll::EnumEnhMetaFile match in GDI32.dll::EnumFontFamiliesA match in GDI32.dll::EnumFontFamiliesExA match in GDI32.dll::EnumFontFamiliesExW match in GDI32.dll::EnumFontFamiliesW match in GDI32.dll::EnumFontsA match in GDI32.dll::EnumFontsW match in GDI32.dll::EnumICMProfilesA match in GDI32.dll::EnumICMProfilesW match in GDI32.dll::EnumMetaFile match in GDI32.dll::EnumObjects match in GDI32.dll::EqualRgn match in GDI32.dll::Escape match in GDI32.dll::EudcLoadLinkW match in GDI32.dll::EudcUnloadLinkW match in GDI32.dll::ExcludeClipRect match in GDI32.dll::ExtCreatePen match in GDI32.dll::ExtCreateRegion match in GDI32.dll::ExtEscape match in GDI32.dll::ExtFloodFill match in GDI32.dll::ExtSelectClipRgn match in GDI32.dll::ExtTextOutA match in GDI32.dll::ExtTextOutW mismatch in GDI32.dll::FONTOBJ_cGetAllGlyphHandles 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 87 12 00 00 MOV EAX,0x1287 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::FONTOBJ_cGetGlyphs 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 82 12 00 00 MOV EAX,0x1282 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::FONTOBJ_pQueryGlyphAttrs 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 85 12 00 00 MOV EAX,0x1285 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::FONTOBJ_pfdg 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 84 12 00 00 MOV EAX,0x1284 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::FONTOBJ_pifi 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 83 12 00 00 MOV EAX,0x1283 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::FONTOBJ_pvTrueTypeFontFile 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 86 12 00 00 MOV EAX,0x1286 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::FONTOBJ_pxoGetXform 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 81 12 00 00 MOV EAX,0x1281 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::FONTOBJ_vGetInfo 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 80 12 00 00 MOV EAX,0x1280 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in GDI32.dll::FillPath match in GDI32.dll::FillRgn mismatch in GDI32.dll::FixBrushOrgEx 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 33 c0 XOR EAX,EAX c2 10 00 RET 0x10 match in GDI32.dll::FlattenPath match in GDI32.dll::FloodFill mismatch in GDI32.dll::FontIsLinked 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 0a 10 00 00 MOV EAX,0x100a ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in GDI32.dll::FrameRgn match in GDI32.dll::GdiAddFontResourceW match in GDI32.dll::GdiAddGlsBounds match in GDI32.dll::GdiAddGlsRecord match in GDI32.dll::GdiAlphaBlend match in GDI32.dll::GdiArtificialDecrementDriver match in GDI32.dll::GdiCleanCacheDC match in GDI32.dll::GdiComment mismatch in GDI32.dll::GdiConsoleTextOut 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 17 10 00 00 MOV EAX,0x1017 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in GDI32.dll::GdiConvertAndCheckDC match in GDI32.dll::GdiConvertBitmap mismatch in GDI32.dll::GdiConvertBitmapV5 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 cc 02 00 00 PUSH 0x2cc 68 20 33 e5 77 PUSH 0x77e53320 match in GDI32.dll::GdiConvertBrush match in GDI32.dll::GdiConvertDC match in GDI32.dll::GdiConvertEnhMetaFile match in GDI32.dll::GdiConvertFont match in GDI32.dll::GdiConvertMetaFilePict match in GDI32.dll::GdiConvertPalette match in GDI32.dll::GdiConvertRegion match in GDI32.dll::GdiConvertToDevmodeW match in GDI32.dll::GdiCreateLocalEnhMetaFile match in GDI32.dll::GdiCreateLocalMetaFilePict mismatch in GDI32.dll::GdiDeleteLocalDC 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 33 c0 XOR EAX,EAX 40 INC EAX mismatch in GDI32.dll::GdiDeleteSpoolFileHandle 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 0c PUSH 0xc 68 18 e2 e3 77 PUSH 0x77e3e218 match in GDI32.dll::GdiDescribePixelFormat match in GDI32.dll::GdiDllInitialize match in GDI32.dll::GdiDrawStream mismatch in GDI32.dll::GdiEndDocEMF 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 08 PUSH 0x8 68 c8 df e3 77 PUSH 0x77e3dfc8 mismatch in GDI32.dll::GdiEndPageEMF 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 20 PUSH 0x20 68 b0 db e3 77 PUSH 0x77e3dbb0 match in GDI32.dll::GdiEntry1 match in GDI32.dll::GdiEntry10 match in GDI32.dll::GdiEntry11 mismatch in GDI32.dll::GdiEntry12 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP a1 40 40 e6 77 MOV EAX,DWORD PTR DS:[0x77e64040] 8b 80 90 00 10 00 MOV EAX,DWORD PTR DS:[EAX+0x100090] match in GDI32.dll::GdiEntry13 match in GDI32.dll::GdiEntry14 mismatch in GDI32.dll::GdiEntry15 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 33 c0 XOR EAX,EAX 40 INC EAX match in GDI32.dll::GdiEntry16 match in GDI32.dll::GdiEntry2 match in GDI32.dll::GdiEntry3 match in GDI32.dll::GdiEntry4 match in GDI32.dll::GdiEntry5 match in GDI32.dll::GdiEntry6 match in GDI32.dll::GdiEntry7 match in GDI32.dll::GdiEntry8 match in GDI32.dll::GdiEntry9 match in GDI32.dll::GdiFixUpHandle mismatch in GDI32.dll::GdiFlush 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP e8 e9 ff ff ff CALL $+0xffffffe9 33 c0 XOR EAX,EAX mismatch in GDI32.dll::GdiFullscreenControl 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 9a 10 00 00 MOV EAX,0x109a ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::GdiGetBatchLimit 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP a1 0c 40 e6 77 MOV EAX,DWORD PTR DS:[0x77e6400c] c3 RET match in GDI32.dll::GdiGetCharDimensions match in GDI32.dll::GdiGetCodePage mismatch in GDI32.dll::GdiGetDC 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 08 PUSH 0x8 68 58 fd e3 77 PUSH 0x77e3fd58 mismatch in GDI32.dll::GdiGetDevmodeForPage 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 08 PUSH 0x8 68 10 ee e3 77 PUSH 0x77e3ee10 match in GDI32.dll::GdiGetLocalBrush match in GDI32.dll::GdiGetLocalDC match in GDI32.dll::GdiGetLocalFont mismatch in GDI32.dll::GdiGetPageCount 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 08 PUSH 0x8 68 20 73 e5 77 PUSH 0x77e57320 mismatch in GDI32.dll::GdiGetPageHandle 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 08 PUSH 0x8 68 b8 da e3 77 PUSH 0x77e3dab8 match in GDI32.dll::GdiGetSpoolFileHandle mismatch in GDI32.dll::GdiGetSpoolMessage 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 c6 10 00 00 MOV EAX,0x10c6 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in GDI32.dll::GdiGradientFill mismatch in GDI32.dll::GdiInitSpool 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 dd 10 00 00 MOV EAX,0x10dd ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in GDI32.dll::GdiInitializeLanguagePack match in GDI32.dll::GdiIsMetaFileDC match in GDI32.dll::GdiIsMetaPrintDC match in GDI32.dll::GdiIsPlayMetafileDC mismatch in GDI32.dll::GdiPlayDCScript 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 33 c0 XOR EAX,EAX c2 18 00 RET 0x18 match in GDI32.dll::GdiPlayEMF mismatch in GDI32.dll::GdiPlayJournal 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 33 c0 XOR EAX,EAX c2 14 00 RET 0x14 mismatch in GDI32.dll::GdiPlayPageEMF 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 38 PUSH 0x38 68 e8 f2 e3 77 PUSH 0x77e3f2e8 match in GDI32.dll::GdiPlayPrivatePageEMF mismatch in GDI32.dll::GdiPlayScript 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 33 c0 XOR EAX,EAX c2 1c 00 RET 0x1c match in GDI32.dll::GdiPrinterThunk match in GDI32.dll::GdiProcessSetup mismatch in GDI32.dll::GdiQueryFonts 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 f3 10 00 00 MOV EAX,0x10f3 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::GdiQueryTable 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP a1 00 40 e6 77 MOV EAX,DWORD PTR DS:[0x77e64000] c3 RET match in GDI32.dll::GdiRealizationInfo match in GDI32.dll::GdiReleaseDC mismatch in GDI32.dll::GdiReleaseLocalDC 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 33 c0 XOR EAX,EAX 40 INC EAX mismatch in GDI32.dll::GdiResetDCEMF 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 08 PUSH 0x8 68 d8 fd e3 77 PUSH 0x77e3fdd8 mismatch in GDI32.dll::GdiSetAttrs 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 33 c0 XOR EAX,EAX 40 INC EAX match in GDI32.dll::GdiSetBatchLimit match in GDI32.dll::GdiSetLastError match in GDI32.dll::GdiSetPixelFormat mismatch in GDI32.dll::GdiSetServerAttr 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP c2 08 00 RET 0x8 90 NOP mismatch in GDI32.dll::GdiStartDocEMF 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 08 PUSH 0x8 68 a8 ee e3 77 PUSH 0x77e3eea8 mismatch in GDI32.dll::GdiStartPageEMF 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 08 PUSH 0x8 68 38 f0 e3 77 PUSH 0x77e3f038 match in GDI32.dll::GdiSwapBuffers match in GDI32.dll::GdiTransparentBlt match in GDI32.dll::GdiValidateHandle match in GDI32.dll::GetArcDirection match in GDI32.dll::GetAspectRatioFilterEx match in GDI32.dll::GetBitmapAttributes match in GDI32.dll::GetBitmapBits match in GDI32.dll::GetBitmapDimensionEx match in GDI32.dll::GetBkColor match in GDI32.dll::GetBkMode match in GDI32.dll::GetBoundsRect match in GDI32.dll::GetBrushAttributes match in GDI32.dll::GetBrushOrgEx match in GDI32.dll::GetCharABCWidthsA match in GDI32.dll::GetCharABCWidthsFloatA match in GDI32.dll::GetCharABCWidthsFloatW match in GDI32.dll::GetCharABCWidthsI match in GDI32.dll::GetCharABCWidthsW match in GDI32.dll::GetCharWidth32A match in GDI32.dll::GetCharWidth32W match in GDI32.dll::GetCharWidthA match in GDI32.dll::GetCharWidthFloatA match in GDI32.dll::GetCharWidthFloatW match in GDI32.dll::GetCharWidthI mismatch in GDI32.dll::GetCharWidthInfo 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 a4 10 00 00 MOV EAX,0x10a4 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in GDI32.dll::GetCharWidthW match in GDI32.dll::GetCharacterPlacementA match in GDI32.dll::GetCharacterPlacementW match in GDI32.dll::GetClipBox match in GDI32.dll::GetClipRgn match in GDI32.dll::GetColorAdjustment match in GDI32.dll::GetColorSpace match in GDI32.dll::GetCurrentObject match in GDI32.dll::GetCurrentPositionEx match in GDI32.dll::GetDCBrushColor match in GDI32.dll::GetDCOrgEx match in GDI32.dll::GetDCPenColor match in GDI32.dll::GetDIBColorTable match in GDI32.dll::GetDIBits match in GDI32.dll::GetDeviceCaps match in GDI32.dll::GetDeviceGammaRamp match in GDI32.dll::GetETM mismatch in GDI32.dll::GetEUDCTimeStamp 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 01 PUSH 0x1 6a 00 PUSH 0x0 match in GDI32.dll::GetEUDCTimeStampExW match in GDI32.dll::GetEnhMetaFileA match in GDI32.dll::GetEnhMetaFileBits match in GDI32.dll::GetEnhMetaFileDescriptionA match in GDI32.dll::GetEnhMetaFileDescriptionW match in GDI32.dll::GetEnhMetaFileHeader match in GDI32.dll::GetEnhMetaFilePaletteEntries match in GDI32.dll::GetEnhMetaFilePixelFormat match in GDI32.dll::GetEnhMetaFileW match in GDI32.dll::GetFontAssocStatus match in GDI32.dll::GetFontData match in GDI32.dll::GetFontLanguageInfo match in GDI32.dll::GetFontResourceInfoW mismatch in GDI32.dll::GetFontUnicodeRanges 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 d7 10 00 00 MOV EAX,0x10d7 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in GDI32.dll::GetGlyphIndicesA mismatch in GDI32.dll::GetGlyphIndicesW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 b3 10 00 00 MOV EAX,0x10b3 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in GDI32.dll::GetGlyphOutline match in GDI32.dll::GetGlyphOutlineA match in GDI32.dll::GetGlyphOutlineW match in GDI32.dll::GetGlyphOutlineWow match in GDI32.dll::GetGraphicsMode match in GDI32.dll::GetHFONT match in GDI32.dll::GetICMProfileA match in GDI32.dll::GetICMProfileW match in GDI32.dll::GetKerningPairs match in GDI32.dll::GetKerningPairsA match in GDI32.dll::GetKerningPairsW match in GDI32.dll::GetLayout match in GDI32.dll::GetLogColorSpaceA match in GDI32.dll::GetLogColorSpaceW match in GDI32.dll::GetMapMode match in GDI32.dll::GetMetaFileA match in GDI32.dll::GetMetaFileBitsEx match in GDI32.dll::GetMetaFileW match in GDI32.dll::GetMetaRgn match in GDI32.dll::GetMiterLimit match in GDI32.dll::GetNearestColor match in GDI32.dll::GetNearestPaletteIndex match in GDI32.dll::GetObjectA match in GDI32.dll::GetObjectType match in GDI32.dll::GetObjectW match in GDI32.dll::GetOutlineTextMetricsA match in GDI32.dll::GetOutlineTextMetricsW match in GDI32.dll::GetPaletteEntries match in GDI32.dll::GetPath match in GDI32.dll::GetPixel match in GDI32.dll::GetPixelFormat match in GDI32.dll::GetPolyFillMode match in GDI32.dll::GetROP2 match in GDI32.dll::GetRandomRgn match in GDI32.dll::GetRasterizerCaps match in GDI32.dll::GetRegionData match in GDI32.dll::GetRelAbs match in GDI32.dll::GetRgnBox match in GDI32.dll::GetStockObject match in GDI32.dll::GetStretchBltMode match in GDI32.dll::GetStringBitmapA match in GDI32.dll::GetStringBitmapW match in GDI32.dll::GetSystemPaletteEntries match in GDI32.dll::GetSystemPaletteUse match in GDI32.dll::GetTextAlign match in GDI32.dll::GetTextCharacterExtra match in GDI32.dll::GetTextCharset mismatch in GDI32.dll::GetTextCharsetInfo 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 cb 10 00 00 MOV EAX,0x10cb ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in GDI32.dll::GetTextColor match in GDI32.dll::GetTextExtentExPointA match in GDI32.dll::GetTextExtentExPointI match in GDI32.dll::GetTextExtentExPointW match in GDI32.dll::GetTextExtentExPointWPri match in GDI32.dll::GetTextExtentPoint32A match in GDI32.dll::GetTextExtentPoint32W match in GDI32.dll::GetTextExtentPointA match in GDI32.dll::GetTextExtentPointI match in GDI32.dll::GetTextExtentPointW match in GDI32.dll::GetTextFaceA match in GDI32.dll::GetTextFaceAliasW match in GDI32.dll::GetTextFaceW match in GDI32.dll::GetTextMetricsA match in GDI32.dll::GetTextMetricsW match in GDI32.dll::GetTransform match in GDI32.dll::GetViewportExtEx match in GDI32.dll::GetViewportOrgEx match in GDI32.dll::GetWinMetaFileBits match in GDI32.dll::GetWindowExtEx match in GDI32.dll::GetWindowOrgEx match in GDI32.dll::GetWorldTransform mismatch in GDI32.dll::HT_Get8BPPFormatPalette 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 94 12 00 00 MOV EAX,0x1294 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::HT_Get8BPPMaskPalette 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 95 12 00 00 MOV EAX,0x1295 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in GDI32.dll::IntersectClipRect match in GDI32.dll::InvertRgn match in GDI32.dll::IsValidEnhMetaRecord match in GDI32.dll::IsValidEnhMetaRecordOffExt match in GDI32.dll::LPtoDP match in GDI32.dll::LineDDA match in GDI32.dll::LineTo match in GDI32.dll::MaskBlt match in GDI32.dll::MirrorRgn match in GDI32.dll::ModifyWorldTransform match in GDI32.dll::MoveToEx match in GDI32.dll::NamedEscape match in GDI32.dll::OffsetClipRgn match in GDI32.dll::OffsetRgn match in GDI32.dll::OffsetViewportOrgEx match in GDI32.dll::OffsetWindowOrgEx mismatch in GDI32.dll::PATHOBJ_bEnum 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 8e 12 00 00 MOV EAX,0x128e ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::PATHOBJ_bEnumClipLines 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 91 12 00 00 MOV EAX,0x1291 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::PATHOBJ_vEnumStart 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 8f 12 00 00 MOV EAX,0x128f ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::PATHOBJ_vEnumStartClipLines 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 90 12 00 00 MOV EAX,0x1290 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::PATHOBJ_vGetBounds 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 8d 12 00 00 MOV EAX,0x128d ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in GDI32.dll::PaintRgn match in GDI32.dll::PatBlt match in GDI32.dll::PathToRegion match in GDI32.dll::Pie match in GDI32.dll::PlayEnhMetaFile match in GDI32.dll::PlayEnhMetaFileRecord match in GDI32.dll::PlayMetaFile mismatch in GDI32.dll::PlayMetaFileRecord 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 30 01 00 00 PUSH 0x130 68 48 40 e3 77 PUSH 0x77e34048 match in GDI32.dll::PlgBlt match in GDI32.dll::PolyBezier match in GDI32.dll::PolyBezierTo match in GDI32.dll::PolyDraw match in GDI32.dll::PolyPatBlt match in GDI32.dll::PolyPolygon match in GDI32.dll::PolyPolyline match in GDI32.dll::PolyTextOutA match in GDI32.dll::PolyTextOutW match in GDI32.dll::Polygon match in GDI32.dll::Polyline match in GDI32.dll::PolylineTo match in GDI32.dll::PtInRegion match in GDI32.dll::PtVisible mismatch in GDI32.dll::QueryFontAssocStatus 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP a1 10 40 e6 77 MOV EAX,DWORD PTR DS:[0x77e64010] c3 RET match in GDI32.dll::RealizePalette match in GDI32.dll::RectInRegion match in GDI32.dll::RectVisible match in GDI32.dll::Rectangle match in GDI32.dll::RemoveFontMemResourceEx match in GDI32.dll::RemoveFontResourceA mismatch in GDI32.dll::RemoveFontResourceExA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 2c 02 00 00 PUSH 0x22c 68 50 8e e3 77 PUSH 0x77e38e50 match in GDI32.dll::RemoveFontResourceExW match in GDI32.dll::RemoveFontResourceTracking match in GDI32.dll::RemoveFontResourceW match in GDI32.dll::ResetDCA match in GDI32.dll::ResetDCW match in GDI32.dll::ResizePalette match in GDI32.dll::RestoreDC match in GDI32.dll::RoundRect mismatch in GDI32.dll::STROBJ_bEnum 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 88 12 00 00 MOV EAX,0x1288 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::STROBJ_bEnumPositionsOnly 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 89 12 00 00 MOV EAX,0x1289 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::STROBJ_bGetAdvanceWidths 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 8a 12 00 00 MOV EAX,0x128a ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::STROBJ_dwGetCodePage 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 8c 12 00 00 MOV EAX,0x128c ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::STROBJ_vEnumStart 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 8b 12 00 00 MOV EAX,0x128b ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in GDI32.dll::SaveDC match in GDI32.dll::ScaleViewportExtEx match in GDI32.dll::ScaleWindowExtEx match in GDI32.dll::SelectBrushLocal match in GDI32.dll::SelectClipPath match in GDI32.dll::SelectClipRgn match in GDI32.dll::SelectFontLocal match in GDI32.dll::SelectObject match in GDI32.dll::SelectPalette match in GDI32.dll::SetAbortProc match in GDI32.dll::SetArcDirection match in GDI32.dll::SetBitmapAttributes match in GDI32.dll::SetBitmapBits match in GDI32.dll::SetBitmapDimensionEx match in GDI32.dll::SetBkColor match in GDI32.dll::SetBkMode match in GDI32.dll::SetBoundsRect match in GDI32.dll::SetBrushAttributes match in GDI32.dll::SetBrushOrgEx match in GDI32.dll::SetColorAdjustment match in GDI32.dll::SetColorSpace match in GDI32.dll::SetDCBrushColor match in GDI32.dll::SetDCPenColor match in GDI32.dll::SetDIBColorTable match in GDI32.dll::SetDIBits mismatch in GDI32.dll::SetDIBitsToDevice 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 64 PUSH 0x64 68 08 9a e2 77 PUSH 0x77e29a08 match in GDI32.dll::SetDeviceGammaRamp match in GDI32.dll::SetEnhMetaFileBits match in GDI32.dll::SetFontEnumeration match in GDI32.dll::SetGraphicsMode match in GDI32.dll::SetICMMode match in GDI32.dll::SetICMProfileA match in GDI32.dll::SetICMProfileW match in GDI32.dll::SetLayout match in GDI32.dll::SetLayoutWidth mismatch in GDI32.dll::SetMagicColors 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 14 11 00 00 MOV EAX,0x1114 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in GDI32.dll::SetMapMode match in GDI32.dll::SetMapperFlags match in GDI32.dll::SetMetaFileBitsEx match in GDI32.dll::SetMetaRgn match in GDI32.dll::SetMiterLimit match in GDI32.dll::SetPaletteEntries match in GDI32.dll::SetPixel match in GDI32.dll::SetPixelFormat match in GDI32.dll::SetPixelV match in GDI32.dll::SetPolyFillMode match in GDI32.dll::SetROP2 match in GDI32.dll::SetRectRgn match in GDI32.dll::SetRelAbs match in GDI32.dll::SetStretchBltMode match in GDI32.dll::SetSystemPaletteUse match in GDI32.dll::SetTextAlign match in GDI32.dll::SetTextCharacterExtra match in GDI32.dll::SetTextColor match in GDI32.dll::SetTextJustification match in GDI32.dll::SetViewportExtEx match in GDI32.dll::SetViewportOrgEx match in GDI32.dll::SetVirtualResolution match in GDI32.dll::SetWinMetaFileBits match in GDI32.dll::SetWindowExtEx match in GDI32.dll::SetWindowOrgEx match in GDI32.dll::SetWorldTransform mismatch in GDI32.dll::StartDocA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 40 06 00 00 PUSH 0x640 68 08 58 e5 77 PUSH 0x77e55808 mismatch in GDI32.dll::StartDocW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 14 01 00 00 PUSH 0x114 68 78 56 e5 77 PUSH 0x77e55678 match in GDI32.dll::StartFormPage match in GDI32.dll::StartPage match in GDI32.dll::StretchBlt match in GDI32.dll::StretchDIBits match in GDI32.dll::StrokeAndFillPath match in GDI32.dll::StrokePath match in GDI32.dll::SwapBuffers match in GDI32.dll::TextOutA match in GDI32.dll::TextOutW mismatch in GDI32.dll::TranslateCharsetInfo 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 54 PUSH 0x54 68 b8 a2 e2 77 PUSH 0x77e2a2b8 match in GDI32.dll::UnloadNetworkFonts match in GDI32.dll::UnrealizeObject match in GDI32.dll::UpdateColors match in GDI32.dll::UpdateICMRegKeyA match in GDI32.dll::UpdateICMRegKeyW match in GDI32.dll::WidenPath mismatch in GDI32.dll::XFORMOBJ_bApplyXform 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 7e 12 00 00 MOV EAX,0x127e ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::XFORMOBJ_iGetXform 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 7f 12 00 00 MOV EAX,0x127f ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::XLATEOBJ_cGetPalette 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 71 12 00 00 MOV EAX,0x1271 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::XLATEOBJ_hGetColorTransform 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 73 12 00 00 MOV EAX,0x1273 ba 00 03 fe 7f MOV EDX,0x7ffe0300 mismatch in GDI32.dll::XLATEOBJ_iXlate 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 72 12 00 00 MOV EAX,0x1272 ba 00 03 fe 7f MOV EDX,0x7ffe0300 match in GDI32.dll::XLATEOBJ_piVector match in GDI32.dll::bInitSystemAndFontsDirectoriesW match in GDI32.dll::bMakePathNameW mismatch in GDI32.dll::cGetTTFFromFOT 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 70 04 00 00 PUSH 0x470 68 60 cc e2 77 PUSH 0x77e2cc60 match in GDI32.dll::gdiPlaySpoolStream match in IMM32.DLL::CtfAImmActivate match in IMM32.DLL::CtfAImmDeactivate match in IMM32.DLL::CtfAImmIsIME mismatch in IMM32.DLL::CtfImmCoUninitialize 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 64 a1 18 00 00 00 MOV EAX,DWORD PTR FS:[0x18] f6 80 cc 06 00 00 80 TEST BYTE PTR DS:[EAX+0x6cc],0x80 match in IMM32.DLL::CtfImmDispatchDefImeMessage mismatch in IMM32.DLL::CtfImmEnterCoInitCountSkipMode 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP e8 e1 ff ff ff CALL $+0xffffffe1 85 c0 TEST EAX,EAX match in IMM32.DLL::CtfImmGenerateMessage match in IMM32.DLL::CtfImmGetGuidAtom match in IMM32.DLL::CtfImmHideToolbarWnd mismatch in IMM32.DLL::CtfImmIsCiceroEnabled 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP a1 00 60 2f 76 MOV EAX,DWORD PTR DS:[0x762f6000] 85 c0 TEST EAX,EAX mismatch in IMM32.DLL::CtfImmIsCiceroStartedInThread 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 64 a1 18 00 00 00 MOV EAX,DWORD PTR FS:[0x18] 8b 80 cc 06 00 00 MOV EAX,DWORD PTR DS:[EAX+0x6cc] match in IMM32.DLL::CtfImmIsGuidMapEnable mismatch in IMM32.DLL::CtfImmIsTextFrameServiceDisabled 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 64 a1 18 00 00 00 MOV EAX,DWORD PTR FS:[0x18] 8b 80 cc 06 00 00 MOV EAX,DWORD PTR DS:[EAX+0x6cc] match in IMM32.DLL::CtfImmLastEnabledWndDestroy mismatch in IMM32.DLL::CtfImmLeaveCoInitCountSkipMode 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP e8 cb ff ff ff CALL $+0xffffffcb 85 c0 TEST EAX,EAX match in IMM32.DLL::CtfImmRestoreToolbarWnd match in IMM32.DLL::CtfImmSetAppCompatFlags match in IMM32.DLL::CtfImmSetCiceroStartInThread match in IMM32.DLL::CtfImmTIMActivate match in IMM32.DLL::GetKeyboardLayoutCP match in IMM32.DLL::ImmActivateLayout match in IMM32.DLL::ImmAssociateContext match in IMM32.DLL::ImmAssociateContextEx match in IMM32.DLL::ImmCallImeConsoleIME match in IMM32.DLL::ImmConfigureIMEA match in IMM32.DLL::ImmConfigureIMEW mismatch in IMM32.DLL::ImmCreateContext 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP a1 00 60 2f 76 MOV EAX,DWORD PTR DS:[0x762f6000] 56 PUSH ESI match in IMM32.DLL::ImmCreateIMCC match in IMM32.DLL::ImmCreateSoftKeyboard match in IMM32.DLL::ImmDestroyContext match in IMM32.DLL::ImmDestroyIMCC match in IMM32.DLL::ImmDestroySoftKeyboard match in IMM32.DLL::ImmDisableIME match in IMM32.DLL::ImmDisableIme match in IMM32.DLL::ImmDisableTextFrameService match in IMM32.DLL::ImmEnumInputContext match in IMM32.DLL::ImmEnumRegisterWordA match in IMM32.DLL::ImmEnumRegisterWordW mismatch in IMM32.DLL::ImmEscapeA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 6c 01 00 00 PUSH 0x16c 68 b0 7e 2e 76 PUSH 0x762e7eb0 mismatch in IMM32.DLL::ImmEscapeW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 cc 00 00 00 PUSH 0xcc 68 c8 80 2e 76 PUSH 0x762e80c8 match in IMM32.DLL::ImmFreeLayout match in IMM32.DLL::ImmGenerateMessage match in IMM32.DLL::ImmGetAppCompatFlags match in IMM32.DLL::ImmGetCandidateListA match in IMM32.DLL::ImmGetCandidateListCountA match in IMM32.DLL::ImmGetCandidateListCountW match in IMM32.DLL::ImmGetCandidateListW match in IMM32.DLL::ImmGetCandidateWindow match in IMM32.DLL::ImmGetCompositionFontA match in IMM32.DLL::ImmGetCompositionFontW match in IMM32.DLL::ImmGetCompositionStringA match in IMM32.DLL::ImmGetCompositionStringW match in IMM32.DLL::ImmGetCompositionWindow match in IMM32.DLL::ImmGetContext match in IMM32.DLL::ImmGetConversionListA match in IMM32.DLL::ImmGetConversionListW match in IMM32.DLL::ImmGetConversionStatus match in IMM32.DLL::ImmGetDefaultIMEWnd match in IMM32.DLL::ImmGetDescriptionA match in IMM32.DLL::ImmGetDescriptionW match in IMM32.DLL::ImmGetGuideLineA match in IMM32.DLL::ImmGetGuideLineW match in IMM32.DLL::ImmGetHotKey match in IMM32.DLL::ImmGetIMCCLockCount match in IMM32.DLL::ImmGetIMCCSize match in IMM32.DLL::ImmGetIMCLockCount match in IMM32.DLL::ImmGetIMEFileNameA match in IMM32.DLL::ImmGetIMEFileNameW match in IMM32.DLL::ImmGetImeInfoEx match in IMM32.DLL::ImmGetImeMenuItemsA match in IMM32.DLL::ImmGetImeMenuItemsW match in IMM32.DLL::ImmGetOpenStatus match in IMM32.DLL::ImmGetProperty match in IMM32.DLL::ImmGetRegisterWordStyleA match in IMM32.DLL::ImmGetRegisterWordStyleW match in IMM32.DLL::ImmGetStatusWindowPos match in IMM32.DLL::ImmGetVirtualKey match in IMM32.DLL::ImmIMPGetIMEA match in IMM32.DLL::ImmIMPGetIMEW match in IMM32.DLL::ImmIMPQueryIMEA match in IMM32.DLL::ImmIMPQueryIMEW match in IMM32.DLL::ImmIMPSetIMEA match in IMM32.DLL::ImmIMPSetIMEW match in IMM32.DLL::ImmInstallIMEA match in IMM32.DLL::ImmInstallIMEW match in IMM32.DLL::ImmIsIME match in IMM32.DLL::ImmIsUIMessageA match in IMM32.DLL::ImmIsUIMessageW match in IMM32.DLL::ImmLoadIME match in IMM32.DLL::ImmLoadLayout match in IMM32.DLL::ImmLockClientImc match in IMM32.DLL::ImmLockIMC match in IMM32.DLL::ImmLockIMCC match in IMM32.DLL::ImmLockImeDpi match in IMM32.DLL::ImmNotifyIME match in IMM32.DLL::ImmPenAuxInput match in IMM32.DLL::ImmProcessKey match in IMM32.DLL::ImmPutImeMenuItemsIntoMappedFile match in IMM32.DLL::ImmReSizeIMCC match in IMM32.DLL::ImmRegisterClient match in IMM32.DLL::ImmRegisterWordA match in IMM32.DLL::ImmRegisterWordW mismatch in IMM32.DLL::ImmReleaseContext 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 33 c0 XOR EAX,EAX 40 INC EAX match in IMM32.DLL::ImmRequestMessageA match in IMM32.DLL::ImmRequestMessageW match in IMM32.DLL::ImmSendIMEMessageExA match in IMM32.DLL::ImmSendIMEMessageExW match in IMM32.DLL::ImmSendMessageToActiveDefImeWndW match in IMM32.DLL::ImmSetActiveContext match in IMM32.DLL::ImmSetActiveContextConsoleIME match in IMM32.DLL::ImmSetCandidateWindow match in IMM32.DLL::ImmSetCompositionFontA match in IMM32.DLL::ImmSetCompositionFontW match in IMM32.DLL::ImmSetCompositionStringA match in IMM32.DLL::ImmSetCompositionStringW match in IMM32.DLL::ImmSetCompositionWindow match in IMM32.DLL::ImmSetConversionStatus mismatch in IMM32.DLL::ImmSetHotKey 74 6b JE $+0x6b 65 79 00 JNS $+0x0 55 PUSH EBP 53 PUSH EBX 45 INC EBP 52 PUSH EDX 33 32 XOR ESI,DWORD PTR DS:[EDX] match in IMM32.DLL::ImmSetOpenStatus match in IMM32.DLL::ImmSetStatusWindowPos match in IMM32.DLL::ImmShowSoftKeyboard match in IMM32.DLL::ImmSimulateHotKey match in IMM32.DLL::ImmSystemHandler match in IMM32.DLL::ImmTranslateMessage match in IMM32.DLL::ImmUnlockClientImc match in IMM32.DLL::ImmUnlockIMC match in IMM32.DLL::ImmUnlockIMCC match in IMM32.DLL::ImmUnlockImeDpi match in IMM32.DLL::ImmUnregisterWordA match in IMM32.DLL::ImmUnregisterWordW match in IMM32.DLL::ImmWINNLSEnableIME match in IMM32.DLL::ImmWINNLSGetEnableStatus mismatch in IMM32.DLL::ImmWINNLSGetIMEHotkey 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 33 c0 XOR EAX,EAX c2 04 00 RET 0x4 mismatch in ADVAPI32.dll::A_SHAFinal 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 32 PUSH 0x32 58 POP EAX match in ADVAPI32.dll::A_SHAInit match in ADVAPI32.dll::A_SHAUpdate match in ADVAPI32.dll::AbortSystemShutdownA match in ADVAPI32.dll::AbortSystemShutdownW match in ADVAPI32.dll::AccessCheck match in ADVAPI32.dll::AccessCheckAndAuditAlarmA match in ADVAPI32.dll::AccessCheckAndAuditAlarmW match in ADVAPI32.dll::AccessCheckByType match in ADVAPI32.dll::AccessCheckByTypeAndAuditAlarmA match in ADVAPI32.dll::AccessCheckByTypeAndAuditAlarmW match in ADVAPI32.dll::AccessCheckByTypeResultList match in ADVAPI32.dll::AccessCheckByTypeResultListAndAuditAlarmA match in ADVAPI32.dll::AccessCheckByTypeResultListAndAuditAlarmByHandleA match in ADVAPI32.dll::AccessCheckByTypeResultListAndAuditAlarmByHandleW match in ADVAPI32.dll::AccessCheckByTypeResultListAndAuditAlarmW match in ADVAPI32.dll::AddAccessAllowedAce match in ADVAPI32.dll::AddAccessAllowedAceEx match in ADVAPI32.dll::AddAccessAllowedObjectAce match in ADVAPI32.dll::AddAccessDeniedAce match in ADVAPI32.dll::AddAccessDeniedAceEx match in ADVAPI32.dll::AddAccessDeniedObjectAce match in ADVAPI32.dll::AddAce match in ADVAPI32.dll::AddAuditAccessAce match in ADVAPI32.dll::AddAuditAccessAceEx match in ADVAPI32.dll::AddAuditAccessObjectAce match in ADVAPI32.dll::AddUsersToEncryptedFile match in ADVAPI32.dll::AdjustTokenGroups match in ADVAPI32.dll::AdjustTokenPrivileges match in ADVAPI32.dll::AllocateAndInitializeSid match in ADVAPI32.dll::AllocateLocallyUniqueId match in ADVAPI32.dll::AreAllAccessesGranted match in ADVAPI32.dll::AreAnyAccessesGranted match in ADVAPI32.dll::BackupEventLogA match in ADVAPI32.dll::BackupEventLogW match in ADVAPI32.dll::BuildExplicitAccessWithNameA match in ADVAPI32.dll::BuildExplicitAccessWithNameW match in ADVAPI32.dll::BuildImpersonateExplicitAccessWithNameA match in ADVAPI32.dll::BuildImpersonateExplicitAccessWithNameW match in ADVAPI32.dll::BuildImpersonateTrusteeA match in ADVAPI32.dll::BuildImpersonateTrusteeW match in ADVAPI32.dll::BuildSecurityDescriptorA match in ADVAPI32.dll::BuildSecurityDescriptorW match in ADVAPI32.dll::BuildTrusteeWithNameA match in ADVAPI32.dll::BuildTrusteeWithNameW match in ADVAPI32.dll::BuildTrusteeWithObjectsAndNameA match in ADVAPI32.dll::BuildTrusteeWithObjectsAndNameW match in ADVAPI32.dll::BuildTrusteeWithObjectsAndSidA match in ADVAPI32.dll::BuildTrusteeWithObjectsAndSidW match in ADVAPI32.dll::BuildTrusteeWithSidA match in ADVAPI32.dll::BuildTrusteeWithSidW match in ADVAPI32.dll::CancelOverlappedAccess mismatch in ADVAPI32.dll::ChangeServiceConfig2A 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 0c PUSH 0xc 68 30 34 fa 77 PUSH 0x77fa3430 mismatch in ADVAPI32.dll::ChangeServiceConfig2W 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 20 70 fb 77 PUSH 0x77fb7020 mismatch in ADVAPI32.dll::ChangeServiceConfigA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 a8 70 fb 77 PUSH 0x77fb70a8 mismatch in ADVAPI32.dll::ChangeServiceConfigW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 2c PUSH 0x2c 68 98 6e fb 77 PUSH 0x77fb6e98 mismatch in ADVAPI32.dll::CheckTokenMembership 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 1c PUSH 0x1c 68 98 6f fb 77 PUSH 0x77fb6f98 match in ADVAPI32.dll::ClearEventLogA match in ADVAPI32.dll::ClearEventLogW match in ADVAPI32.dll::CloseCodeAuthzLevel match in ADVAPI32.dll::CloseEncryptedFileRaw match in ADVAPI32.dll::CloseEventLog match in ADVAPI32.dll::CloseServiceHandle mismatch in ADVAPI32.dll::CloseTrace 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 20 5c f6 77 PUSH 0x77f65c20 match in ADVAPI32.dll::CommandLineFromMsiDescriptor match in ADVAPI32.dll::ComputeAccessTokenFromCodeAuthzLevel match in ADVAPI32.dll::ControlService mismatch in ADVAPI32.dll::ControlTraceA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 90 e0 f6 77 PUSH 0x77f6e090 mismatch in ADVAPI32.dll::ControlTraceW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 78 PUSH 0x78 68 78 a2 fa 77 PUSH 0x77faa278 mismatch in ADVAPI32.dll::ConvertAccessToSecurityDescriptorA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 50 PUSH 0x50 68 e0 ce f7 77 PUSH 0x77f7cee0 match in ADVAPI32.dll::ConvertAccessToSecurityDescriptorW match in ADVAPI32.dll::ConvertSDToStringSDRootDomainA match in ADVAPI32.dll::ConvertSDToStringSDRootDomainW match in ADVAPI32.dll::ConvertSecurityDescriptorToAccessA match in ADVAPI32.dll::ConvertSecurityDescriptorToAccessNamedA match in ADVAPI32.dll::ConvertSecurityDescriptorToAccessNamedW match in ADVAPI32.dll::ConvertSecurityDescriptorToAccessW match in ADVAPI32.dll::ConvertSecurityDescriptorToStringSecurityDescriptorA match in ADVAPI32.dll::ConvertSecurityDescriptorToStringSecurityDescriptorW match in ADVAPI32.dll::ConvertSidToStringSidA match in ADVAPI32.dll::ConvertSidToStringSidW match in ADVAPI32.dll::ConvertStringSDToSDDomainA match in ADVAPI32.dll::ConvertStringSDToSDDomainW match in ADVAPI32.dll::ConvertStringSDToSDRootDomainA match in ADVAPI32.dll::ConvertStringSDToSDRootDomainW match in ADVAPI32.dll::ConvertStringSecurityDescriptorToSecurityDescriptorA match in ADVAPI32.dll::ConvertStringSecurityDescriptorToSecurityDescriptorW match in ADVAPI32.dll::ConvertStringSidToSidA match in ADVAPI32.dll::ConvertStringSidToSidW match in ADVAPI32.dll::ConvertToAutoInheritPrivateObjectSecurity match in ADVAPI32.dll::CopySid match in ADVAPI32.dll::CreateCodeAuthzLevel match in ADVAPI32.dll::CreatePrivateObjectSecurity match in ADVAPI32.dll::CreatePrivateObjectSecurityEx match in ADVAPI32.dll::CreatePrivateObjectSecurityWithMultipleInheritance match in ADVAPI32.dll::CreateProcessAsUserA match in ADVAPI32.dll::CreateProcessAsUserSecure mismatch in ADVAPI32.dll::CreateProcessAsUserW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 8b c0 MOV EAX,EAX c3 RET match in ADVAPI32.dll::CreateProcessWithLogonW mismatch in ADVAPI32.dll::CreateRestrictedToken 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 a8 07 00 00 PUSH 0x7a8 68 70 6b f9 77 PUSH 0x77f96b70 match in ADVAPI32.dll::CreateServiceA mismatch in ADVAPI32.dll::CreateServiceW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 30 PUSH 0x30 68 40 72 fb 77 PUSH 0x77fb7240 mismatch in ADVAPI32.dll::CreateTraceInstanceId 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 20 PUSH 0x20 68 48 73 fb 77 PUSH 0x77fb7348 mismatch in ADVAPI32.dll::CreateWellKnownSid 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 78 ad fa 77 PUSH 0x77faad78 match in ADVAPI32.dll::CredDeleteA mismatch in ADVAPI32.dll::CredDeleteW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 b0 83 f9 77 PUSH 0x77f983b0 mismatch in ADVAPI32.dll::CredEnumerateA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 58 84 f9 77 PUSH 0x77f98458 mismatch in ADVAPI32.dll::CredEnumerateW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 20 PUSH 0x20 68 98 7e f9 77 PUSH 0x77f97e98 mismatch in ADVAPI32.dll::CredFree 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 20 PUSH 0x20 68 88 7f f9 77 PUSH 0x77f97f88 match in ADVAPI32.dll::CredGetSessionTypes mismatch in ADVAPI32.dll::CredGetTargetInfoA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 28 88 f9 77 PUSH 0x77f98828 mismatch in ADVAPI32.dll::CredGetTargetInfoW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 1c PUSH 0x1c 68 d8 86 f9 77 PUSH 0x77f986d8 mismatch in ADVAPI32.dll::CredIsMarshaledCredentialA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 1c PUSH 0x1c 68 a8 87 f9 77 PUSH 0x77f987a8 match in ADVAPI32.dll::CredIsMarshaledCredentialW match in ADVAPI32.dll::CredMarshalCredentialA match in ADVAPI32.dll::CredMarshalCredentialW match in ADVAPI32.dll::CredProfileLoaded mismatch in ADVAPI32.dll::CredReadA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 d8 fa f6 77 PUSH 0x77f6fad8 mismatch in ADVAPI32.dll::CredReadDomainCredentialsA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 1c PUSH 0x1c 68 d0 7c f9 77 PUSH 0x77f97cd0 mismatch in ADVAPI32.dll::CredReadDomainCredentialsW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 20 PUSH 0x20 68 18 82 f9 77 PUSH 0x77f98218 mismatch in ADVAPI32.dll::CredReadW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 20 PUSH 0x20 68 08 83 f9 77 PUSH 0x77f98308 mismatch in ADVAPI32.dll::CredRenameA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 1c PUSH 0x1c 68 a8 7d f9 77 PUSH 0x77f97da8 mismatch in ADVAPI32.dll::CredRenameW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 1c PUSH 0x1c 68 30 85 f9 77 PUSH 0x77f98530 mismatch in ADVAPI32.dll::CredUnmarshalCredentialA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 1c PUSH 0x1c 68 08 86 f9 77 PUSH 0x77f98608 match in ADVAPI32.dll::CredUnmarshalCredentialW match in ADVAPI32.dll::CredWriteA mismatch in ADVAPI32.dll::CredWriteDomainCredentialsA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 58 7b f9 77 PUSH 0x77f97b58 mismatch in ADVAPI32.dll::CredWriteDomainCredentialsW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 1c PUSH 0x1c 68 58 80 f9 77 PUSH 0x77f98058 mismatch in ADVAPI32.dll::CredWriteW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 1c PUSH 0x1c 68 28 81 f9 77 PUSH 0x77f98128 mismatch in ADVAPI32.dll::CredpConvertCredential 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 f8 7b f9 77 PUSH 0x77f97bf8 mismatch in ADVAPI32.dll::CredpConvertTargetInfo 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 d0 76 f9 77 PUSH 0x77f976d0 mismatch in ADVAPI32.dll::CredpDecodeCredential 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 e0 78 f9 77 PUSH 0x77f978e0 match in ADVAPI32.dll::CredpEncodeCredential match in ADVAPI32.dll::CryptAcquireContextA mismatch in ADVAPI32.dll::CryptAcquireContextW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 94 00 00 00 PUSH 0x94 68 80 7d f6 77 PUSH 0x77f67d80 mismatch in ADVAPI32.dll::CryptContextAddRef 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 30 PUSH 0x30 68 d0 81 f6 77 PUSH 0x77f681d0 mismatch in ADVAPI32.dll::CryptCreateHash 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 a8 0d f9 77 PUSH 0x77f90da8 mismatch in ADVAPI32.dll::CryptDecrypt 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 24 PUSH 0x24 68 e8 9e f6 77 PUSH 0x77f69ee8 mismatch in ADVAPI32.dll::CryptDeriveKey 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 24 PUSH 0x24 68 88 a3 f6 77 PUSH 0x77f6a388 mismatch in ADVAPI32.dll::CryptDestroyHash 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 30 PUSH 0x30 68 c0 a2 f6 77 PUSH 0x77f6a2c0 mismatch in ADVAPI32.dll::CryptDestroyKey 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 08 9e f6 77 PUSH 0x77f69e08 mismatch in ADVAPI32.dll::CryptDuplicateHash 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 20 PUSH 0x20 68 28 a1 f6 77 PUSH 0x77f6a128 mismatch in ADVAPI32.dll::CryptDuplicateKey 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 24 PUSH 0x24 68 d8 1a f9 77 PUSH 0x77f91ad8 mismatch in ADVAPI32.dll::CryptEncrypt 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 20 PUSH 0x20 68 08 17 f9 77 PUSH 0x77f91708 mismatch in ADVAPI32.dll::CryptEnumProviderTypesA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 24 PUSH 0x24 68 b8 09 f7 77 PUSH 0x77f709b8 mismatch in ADVAPI32.dll::CryptEnumProviderTypesW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 68 PUSH 0x68 68 18 11 f9 77 PUSH 0x77f91118 mismatch in ADVAPI32.dll::CryptEnumProvidersA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 28 PUSH 0x28 68 b8 27 f9 77 PUSH 0x77f927b8 mismatch in ADVAPI32.dll::CryptEnumProvidersW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 50 PUSH 0x50 68 f0 12 f9 77 PUSH 0x77f912f0 mismatch in ADVAPI32.dll::CryptExportKey 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 28 PUSH 0x28 68 00 29 f9 77 PUSH 0x77f92900 mismatch in ADVAPI32.dll::CryptGenKey 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 24 PUSH 0x24 68 b0 19 f9 77 PUSH 0x77f919b0 mismatch in ADVAPI32.dll::CryptGenRandom 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 f0 15 f9 77 PUSH 0x77f915f0 mismatch in ADVAPI32.dll::CryptGetDefaultProviderA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 58 b3 f7 77 PUSH 0x77f7b358 mismatch in ADVAPI32.dll::CryptGetDefaultProviderW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 3c PUSH 0x3c 68 58 26 f9 77 PUSH 0x77f92658 mismatch in ADVAPI32.dll::CryptGetHashParam 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 28 PUSH 0x28 68 78 2b f9 77 PUSH 0x77f92b78 mismatch in ADVAPI32.dll::CryptGetKeyParam 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 1c PUSH 0x1c 68 e8 9f f6 77 PUSH 0x77f69fe8 mismatch in ADVAPI32.dll::CryptGetProvParam 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 1c PUSH 0x1c 68 68 0f f7 77 PUSH 0x77f70f68 mismatch in ADVAPI32.dll::CryptGetUserKey 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 e0 0f f7 77 PUSH 0x77f70fe0 mismatch in ADVAPI32.dll::CryptHashData 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 b0 18 f9 77 PUSH 0x77f918b0 mismatch in ADVAPI32.dll::CryptHashSessionKey 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 20 PUSH 0x20 68 f8 9c f6 77 PUSH 0x77f69cf8 mismatch in ADVAPI32.dll::CryptImportKey 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 24 PUSH 0x24 68 c8 1b f9 77 PUSH 0x77f91bc8 mismatch in ADVAPI32.dll::CryptReleaseContext 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 2c PUSH 0x2c 68 a0 a4 f6 77 PUSH 0x77f6a4a0 mismatch in ADVAPI32.dll::CryptSetHashParam 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 10 81 f6 77 PUSH 0x77f68110 mismatch in ADVAPI32.dll::CryptSetKeyParam 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 18 1e f9 77 PUSH 0x77f91e18 mismatch in ADVAPI32.dll::CryptSetProvParam 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 d8 17 f9 77 PUSH 0x77f917d8 mismatch in ADVAPI32.dll::CryptSetProviderA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 b8 0e f9 77 PUSH 0x77f90eb8 mismatch in ADVAPI32.dll::CryptSetProviderExA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 38 PUSH 0x38 68 e0 1f f9 77 PUSH 0x77f91fe0 mismatch in ADVAPI32.dll::CryptSetProviderExW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 4c PUSH 0x4c 68 98 23 f9 77 PUSH 0x77f92398 mismatch in ADVAPI32.dll::CryptSetProviderW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 20 PUSH 0x20 68 28 2a f9 77 PUSH 0x77f92a28 mismatch in ADVAPI32.dll::CryptSignHashA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 20 PUSH 0x20 68 90 29 f9 77 PUSH 0x77f92990 mismatch in ADVAPI32.dll::CryptSignHashW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 20 PUSH 0x20 68 48 1d f9 77 PUSH 0x77f91d48 match in ADVAPI32.dll::CryptVerifySignatureA mismatch in ADVAPI32.dll::CryptVerifySignatureW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 20 PUSH 0x20 68 78 c7 f7 77 PUSH 0x77f7c778 match in ADVAPI32.dll::DecryptFileA match in ADVAPI32.dll::DecryptFileW match in ADVAPI32.dll::DeleteAce match in ADVAPI32.dll::DeleteService mismatch in ADVAPI32.dll::DeregisterEventSource 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 c0 73 fb 77 PUSH 0x77fb73c0 match in ADVAPI32.dll::DestroyPrivateObjectSecurity match in ADVAPI32.dll::DuplicateEncryptionInfoFile match in ADVAPI32.dll::DuplicateToken match in ADVAPI32.dll::DuplicateTokenEx match in ADVAPI32.dll::ElfBackupEventLogFileA mismatch in ADVAPI32.dll::ElfBackupEventLogFileW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 40 89 fb 77 PUSH 0x77fb8940 mismatch in ADVAPI32.dll::ElfChangeNotify 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 f8 86 fb 77 PUSH 0x77fb86f8 mismatch in ADVAPI32.dll::ElfClearEventLogFileA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 58 85 fb 77 PUSH 0x77fb8558 mismatch in ADVAPI32.dll::ElfClearEventLogFileW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 a0 88 fb 77 PUSH 0x77fb88a0 mismatch in ADVAPI32.dll::ElfCloseEventLog 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 58 86 fb 77 PUSH 0x77fb8658 mismatch in ADVAPI32.dll::ElfDeregisterEventSource 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 00 f8 f6 77 PUSH 0x77f6f800 mismatch in ADVAPI32.dll::ElfFlushEventLog 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 80 7a f7 77 PUSH 0x77f77a80 mismatch in ADVAPI32.dll::ElfNumberOfRecords 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 a0 89 fb 77 PUSH 0x77fb89a0 mismatch in ADVAPI32.dll::ElfOldestRecord 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 18 35 f7 77 PUSH 0x77f73518 mismatch in ADVAPI32.dll::ElfOpenBackupEventLogA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 a8 35 f7 77 PUSH 0x77f735a8 mismatch in ADVAPI32.dll::ElfOpenBackupEventLogW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 38 88 fb 77 PUSH 0x77fb8838 mismatch in ADVAPI32.dll::ElfOpenEventLogA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 f0 85 fb 77 PUSH 0x77fb85f0 mismatch in ADVAPI32.dll::ElfOpenEventLogW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 28 PUSH 0x28 68 d8 36 f7 77 PUSH 0x77f736d8 mismatch in ADVAPI32.dll::ElfReadEventLogA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 28 PUSH 0x28 68 f0 0d f7 77 PUSH 0x77f70df0 mismatch in ADVAPI32.dll::ElfReadEventLogW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 78 34 f7 77 PUSH 0x77f73478 mismatch in ADVAPI32.dll::ElfRegisterEventSourceA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 a0 87 fb 77 PUSH 0x77fb87a0 mismatch in ADVAPI32.dll::ElfRegisterEventSourceW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 78 7c f7 77 PUSH 0x77f77c78 mismatch in ADVAPI32.dll::ElfReportEventA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 50 81 f7 77 PUSH 0x77f78150 mismatch in ADVAPI32.dll::ElfReportEventW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 1c PUSH 0x1c 68 a0 7e f7 77 PUSH 0x77f77ea0 mismatch in ADVAPI32.dll::EnableTrace 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 1c PUSH 0x1c 68 28 db f6 77 PUSH 0x77f6db28 mismatch in ADVAPI32.dll::EncryptFileA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 54 PUSH 0x54 68 38 a5 fa 77 PUSH 0x77faa538 match in ADVAPI32.dll::EncryptFileW match in ADVAPI32.dll::EncryptedFileKeyInfo match in ADVAPI32.dll::EncryptionDisable match in ADVAPI32.dll::EnumDependentServicesA mismatch in ADVAPI32.dll::EnumDependentServicesW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 34 PUSH 0x34 68 78 74 fb 77 PUSH 0x77fb7478 mismatch in ADVAPI32.dll::EnumServiceGroupW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 34 PUSH 0x34 68 30 75 fb 77 PUSH 0x77fb7530 mismatch in ADVAPI32.dll::EnumServicesStatusA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 34 PUSH 0x34 68 00 6a fb 77 PUSH 0x77fb6a00 mismatch in ADVAPI32.dll::EnumServicesStatusExA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 34 PUSH 0x34 68 20 d9 f6 77 PUSH 0x77f6d920 mismatch in ADVAPI32.dll::EnumServicesStatusExW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 3c PUSH 0x3c 68 98 6b fb 77 PUSH 0x77fb6b98 mismatch in ADVAPI32.dll::EnumServicesStatusW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 3c PUSH 0x3c 68 20 69 fb 77 PUSH 0x77fb6920 match in ADVAPI32.dll::EnumerateTraceGuids mismatch in ADVAPI32.dll::EqualDomainSid 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 28 PUSH 0x28 68 e0 ae fa 77 PUSH 0x77faaee0 match in ADVAPI32.dll::EqualPrefixSid match in ADVAPI32.dll::EqualSid match in ADVAPI32.dll::FileEncryptionStatusA match in ADVAPI32.dll::FileEncryptionStatusW match in ADVAPI32.dll::FindFirstFreeAce match in ADVAPI32.dll::FlushTraceA match in ADVAPI32.dll::FlushTraceW match in ADVAPI32.dll::FreeEncryptedFileKeyInfo match in ADVAPI32.dll::FreeEncryptionCertificateHashList match in ADVAPI32.dll::FreeInheritedFromArray match in ADVAPI32.dll::FreeSid match in ADVAPI32.dll::GetAccessPermissionsForObjectA match in ADVAPI32.dll::GetAccessPermissionsForObjectW mismatch in ADVAPI32.dll::GetAce 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 18 35 fa 77 PUSH 0x77fa3518 match in ADVAPI32.dll::GetAclInformation match in ADVAPI32.dll::GetAuditedPermissionsFromAclA match in ADVAPI32.dll::GetAuditedPermissionsFromAclW match in ADVAPI32.dll::GetCurrentHwProfileA mismatch in ADVAPI32.dll::GetCurrentHwProfileW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 08 01 00 00 PUSH 0x108 68 a8 c7 f8 77 PUSH 0x77f8c7a8 mismatch in ADVAPI32.dll::GetEffectiveRightsFromAclA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 2c 02 00 00 PUSH 0x22c 68 f8 05 f7 77 PUSH 0x77f705f8 match in ADVAPI32.dll::GetEffectiveRightsFromAclW match in ADVAPI32.dll::GetEventLogInformation match in ADVAPI32.dll::GetExplicitEntriesFromAclA match in ADVAPI32.dll::GetExplicitEntriesFromAclW match in ADVAPI32.dll::GetFileSecurityA match in ADVAPI32.dll::GetFileSecurityW match in ADVAPI32.dll::GetInformationCodeAuthzLevelW match in ADVAPI32.dll::GetInformationCodeAuthzPolicyW match in ADVAPI32.dll::GetInheritanceSourceA mismatch in ADVAPI32.dll::GetInheritanceSourceW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 78 PUSH 0x78 58 POP EAX match in ADVAPI32.dll::GetKernelObjectSecurity match in ADVAPI32.dll::GetLengthSid match in ADVAPI32.dll::GetLocalManagedApplicationData match in ADVAPI32.dll::GetLocalManagedApplications match in ADVAPI32.dll::GetManagedApplicationCategories match in ADVAPI32.dll::GetManagedApplications match in ADVAPI32.dll::GetMultipleTrusteeA match in ADVAPI32.dll::GetMultipleTrusteeOperationA match in ADVAPI32.dll::GetMultipleTrusteeOperationW match in ADVAPI32.dll::GetMultipleTrusteeW match in ADVAPI32.dll::GetNamedSecurityInfoA match in ADVAPI32.dll::GetNamedSecurityInfoExA match in ADVAPI32.dll::GetNamedSecurityInfoExW mismatch in ADVAPI32.dll::GetNamedSecurityInfoW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 1c PUSH 0x1c 68 30 25 fa 77 PUSH 0x77fa2530 match in ADVAPI32.dll::GetNumberOfEventLogRecords match in ADVAPI32.dll::GetOldestEventLogRecord match in ADVAPI32.dll::GetOverlappedAccessResults mismatch in ADVAPI32.dll::GetPrivateObjectSecurity 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 b8 33 fa 77 PUSH 0x77fa33b8 match in ADVAPI32.dll::GetSecurityDescriptorControl match in ADVAPI32.dll::GetSecurityDescriptorDacl match in ADVAPI32.dll::GetSecurityDescriptorGroup match in ADVAPI32.dll::GetSecurityDescriptorLength match in ADVAPI32.dll::GetSecurityDescriptorOwner match in ADVAPI32.dll::GetSecurityDescriptorRMControl match in ADVAPI32.dll::GetSecurityDescriptorSacl match in ADVAPI32.dll::GetSecurityInfo match in ADVAPI32.dll::GetSecurityInfoExA match in ADVAPI32.dll::GetSecurityInfoExW mismatch in ADVAPI32.dll::GetServiceDisplayNameA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 1c PUSH 0x1c 68 b0 28 fa 77 PUSH 0x77fa28b0 mismatch in ADVAPI32.dll::GetServiceDisplayNameW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 d0 75 fb 77 PUSH 0x77fb75d0 mismatch in ADVAPI32.dll::GetServiceKeyNameA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 70 76 fb 77 PUSH 0x77fb7670 mismatch in ADVAPI32.dll::GetServiceKeyNameW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 10 77 fb 77 PUSH 0x77fb7710 mismatch in ADVAPI32.dll::GetSidIdentifierAuthority 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 b0 77 fb 77 PUSH 0x77fb77b0 match in ADVAPI32.dll::GetSidLengthRequired match in ADVAPI32.dll::GetSidSubAuthority match in ADVAPI32.dll::GetSidSubAuthorityCount match in ADVAPI32.dll::GetTokenInformation match in ADVAPI32.dll::GetTraceEnableFlags match in ADVAPI32.dll::GetTraceEnableLevel match in ADVAPI32.dll::GetTraceLoggerHandle mismatch in ADVAPI32.dll::GetTrusteeFormA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 38 ac fa 77 PUSH 0x77faac38 match in ADVAPI32.dll::GetTrusteeFormW match in ADVAPI32.dll::GetTrusteeNameA match in ADVAPI32.dll::GetTrusteeNameW match in ADVAPI32.dll::GetTrusteeTypeA match in ADVAPI32.dll::GetTrusteeTypeW match in ADVAPI32.dll::GetUserNameA match in ADVAPI32.dll::GetUserNameW match in ADVAPI32.dll::GetWindowsAccountDomainSid match in ADVAPI32.dll::I_ScGetCurrentGroupStateW mismatch in ADVAPI32.dll::I_ScIsSecurityProcess 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP c7 05 c8 76 fc 77 01 00 00 00 MOV DWORD PTR DS:[0x77fc76c8],0x1 c3 RET match in ADVAPI32.dll::I_ScPnPGetServiceName mismatch in ADVAPI32.dll::I_ScSendTSMessage 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 b8 fd f6 77 PUSH 0x77f6fdb8 mismatch in ADVAPI32.dll::I_ScSetServiceBitsA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 90 6a fb 77 PUSH 0x77fb6a90 mismatch in ADVAPI32.dll::I_ScSetServiceBitsW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 40 fe f6 77 PUSH 0x77f6fe40 match in ADVAPI32.dll::IdentifyCodeAuthzLevelW match in ADVAPI32.dll::ImpersonateAnonymousToken match in ADVAPI32.dll::ImpersonateLoggedOnUser match in ADVAPI32.dll::ImpersonateNamedPipeClient match in ADVAPI32.dll::ImpersonateSelf match in ADVAPI32.dll::InitializeAcl match in ADVAPI32.dll::InitializeSecurityDescriptor match in ADVAPI32.dll::InitializeSid match in ADVAPI32.dll::InitiateSystemShutdownA match in ADVAPI32.dll::InitiateSystemShutdownExA match in ADVAPI32.dll::InitiateSystemShutdownExW match in ADVAPI32.dll::InitiateSystemShutdownW match in ADVAPI32.dll::InstallApplication match in ADVAPI32.dll::IsTextUnicode match in ADVAPI32.dll::IsTokenRestricted match in ADVAPI32.dll::IsTokenUntrusted match in ADVAPI32.dll::IsValidAcl match in ADVAPI32.dll::IsValidSecurityDescriptor match in ADVAPI32.dll::IsValidSid match in ADVAPI32.dll::IsWellKnownSid mismatch in ADVAPI32.dll::LockServiceDatabase 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 30 78 fb 77 PUSH 0x77fb7830 match in ADVAPI32.dll::LogonUserA match in ADVAPI32.dll::LogonUserExA match in ADVAPI32.dll::LogonUserExExW match in ADVAPI32.dll::LogonUserExW match in ADVAPI32.dll::LogonUserW match in ADVAPI32.dll::LookupAccountNameA match in ADVAPI32.dll::LookupAccountNameW match in ADVAPI32.dll::LookupAccountSidA match in ADVAPI32.dll::LookupAccountSidW match in ADVAPI32.dll::LookupPrivilegeDisplayNameA match in ADVAPI32.dll::LookupPrivilegeDisplayNameW match in ADVAPI32.dll::LookupPrivilegeNameA match in ADVAPI32.dll::LookupPrivilegeNameW match in ADVAPI32.dll::LookupPrivilegeValueA match in ADVAPI32.dll::LookupPrivilegeValueW match in ADVAPI32.dll::LookupSecurityDescriptorPartsA match in ADVAPI32.dll::LookupSecurityDescriptorPartsW mismatch in ADVAPI32.dll::LsaAddAccountRights 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 90 aa f9 77 PUSH 0x77f9aa90 mismatch in ADVAPI32.dll::LsaAddPrivilegesToAccount 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 78 b9 f9 77 PUSH 0x77f9b978 mismatch in ADVAPI32.dll::LsaClearAuditLog 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 d0 ae f9 77 PUSH 0x77f9aed0 mismatch in ADVAPI32.dll::LsaClose 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 08 1e f6 77 PUSH 0x77f61e08 mismatch in ADVAPI32.dll::LsaCreateAccount 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 a0 b2 f9 77 PUSH 0x77f9b2a0 mismatch in ADVAPI32.dll::LsaCreateSecret 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 28 b8 f9 77 PUSH 0x77f9b828 mismatch in ADVAPI32.dll::LsaCreateTrustedDomain 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 b0 b3 f9 77 PUSH 0x77f9b3b0 mismatch in ADVAPI32.dll::LsaCreateTrustedDomainEx 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 b8 a0 f9 77 PUSH 0x77f9a0b8 mismatch in ADVAPI32.dll::LsaDelete 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 c0 b0 f9 77 PUSH 0x77f9b0c0 mismatch in ADVAPI32.dll::LsaDeleteTrustedDomain 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 e8 97 f9 77 PUSH 0x77f997e8 mismatch in ADVAPI32.dll::LsaEnumerateAccountRights 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 30 94 f7 77 PUSH 0x77f79430 mismatch in ADVAPI32.dll::LsaEnumerateAccounts 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 38 b3 f9 77 PUSH 0x77f9b338 mismatch in ADVAPI32.dll::LsaEnumerateAccountsWithUserRight 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 f0 a9 f9 77 PUSH 0x77f9a9f0 mismatch in ADVAPI32.dll::LsaEnumeratePrivileges 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 90 b7 f9 77 PUSH 0x77f9b790 mismatch in ADVAPI32.dll::LsaEnumeratePrivilegesOfAccount 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 08 b9 f9 77 PUSH 0x77f9b908 mismatch in ADVAPI32.dll::LsaEnumerateTrustedDomains 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 f8 b6 f9 77 PUSH 0x77f9b6f8 mismatch in ADVAPI32.dll::LsaEnumerateTrustedDomainsEx 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 b0 9f f9 77 PUSH 0x77f99fb0 match in ADVAPI32.dll::LsaFreeMemory mismatch in ADVAPI32.dll::LsaGetQuotasForAccount 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 58 ba f9 77 PUSH 0x77f9ba58 mismatch in ADVAPI32.dll::LsaGetRemoteUserName 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 1c PUSH 0x1c 68 70 c0 f9 77 PUSH 0x77f9c070 mismatch in ADVAPI32.dll::LsaGetSystemAccessAccount 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 40 bb f9 77 PUSH 0x77f9bb40 mismatch in ADVAPI32.dll::LsaGetUserName 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 c8 08 f7 77 PUSH 0x77f708c8 mismatch in ADVAPI32.dll::LsaICLookupNames 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 80 00 00 00 PUSH 0x80 68 d8 91 f7 77 PUSH 0x77f791d8 mismatch in ADVAPI32.dll::LsaICLookupNamesWithCreds 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 20 PUSH 0x20 68 00 c2 f9 77 PUSH 0x77f9c200 mismatch in ADVAPI32.dll::LsaICLookupSids 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 3c PUSH 0x3c 68 c8 8d f7 77 PUSH 0x77f78dc8 mismatch in ADVAPI32.dll::LsaICLookupSidsWithCreds 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 28 PUSH 0x28 68 e8 c3 f9 77 PUSH 0x77f9c3e8 match in ADVAPI32.dll::LsaLookupNames match in ADVAPI32.dll::LsaLookupNames2 mismatch in ADVAPI32.dll::LsaLookupPrivilegeDisplayName 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 20 PUSH 0x20 68 00 b0 f9 77 PUSH 0x77f9b000 mismatch in ADVAPI32.dll::LsaLookupPrivilegeName 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 58 af f9 77 PUSH 0x77f9af58 mismatch in ADVAPI32.dll::LsaLookupPrivilegeValue 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 b8 42 f6 77 PUSH 0x77f642b8 match in ADVAPI32.dll::LsaLookupSids match in ADVAPI32.dll::LsaNtStatusToWinError mismatch in ADVAPI32.dll::LsaOpenAccount 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 98 b8 f9 77 PUSH 0x77f9b898 mismatch in ADVAPI32.dll::LsaOpenPolicy 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 20 PUSH 0x20 68 88 1d f6 77 PUSH 0x77f61d88 mismatch in ADVAPI32.dll::LsaOpenPolicySce 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 1c PUSH 0x1c 68 a8 ad f9 77 PUSH 0x77f9ada8 mismatch in ADVAPI32.dll::LsaOpenSecret 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 28 bc f9 77 PUSH 0x77f9bc28 mismatch in ADVAPI32.dll::LsaOpenTrustedDomain 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 20 b4 f9 77 PUSH 0x77f9b420 mismatch in ADVAPI32.dll::LsaOpenTrustedDomainByName 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 30 a2 f9 77 PUSH 0x77f9a230 mismatch in ADVAPI32.dll::LsaQueryDomainInformationPolicy 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 40 a1 f9 77 PUSH 0x77f9a140 mismatch in ADVAPI32.dll::LsaQueryForestTrustInformation 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 a0 a2 f9 77 PUSH 0x77f9a2a0 mismatch in ADVAPI32.dll::LsaQueryInfoTrustedDomain 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 c0 b4 f9 77 PUSH 0x77f9b4c0 mismatch in ADVAPI32.dll::LsaQueryInformationPolicy 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 40 2d f6 77 PUSH 0x77f62d40 mismatch in ADVAPI32.dll::LsaQuerySecret 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 28 PUSH 0x28 68 48 bf f9 77 PUSH 0x77f9bf48 mismatch in ADVAPI32.dll::LsaQuerySecurityObject 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 1c PUSH 0x1c 68 58 b1 f9 77 PUSH 0x77f9b158 mismatch in ADVAPI32.dll::LsaQueryTrustedDomainInfo 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 24 PUSH 0x24 68 88 95 f9 77 PUSH 0x77f99588 mismatch in ADVAPI32.dll::LsaQueryTrustedDomainInfoByName 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 70 9b f9 77 PUSH 0x77f99b70 mismatch in ADVAPI32.dll::LsaRemoveAccountRights 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 30 ab f9 77 PUSH 0x77f9ab30 mismatch in ADVAPI32.dll::LsaRemovePrivilegesFromAccount 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 e8 b9 f9 77 PUSH 0x77f9b9e8 mismatch in ADVAPI32.dll::LsaRetrievePrivateData 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 20 PUSH 0x20 68 d8 d6 f6 77 PUSH 0x77f6d6d8 mismatch in ADVAPI32.dll::LsaSetDomainInformationPolicy 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 c0 a1 f9 77 PUSH 0x77f9a1c0 mismatch in ADVAPI32.dll::LsaSetForestTrustInformation 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 18 a3 f9 77 PUSH 0x77f9a318 mismatch in ADVAPI32.dll::LsaSetInformationPolicy 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 68 ae f9 77 PUSH 0x77f9ae68 mismatch in ADVAPI32.dll::LsaSetInformationTrustedDomain 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 44 PUSH 0x44 68 48 b6 f9 77 PUSH 0x77f9b648 mismatch in ADVAPI32.dll::LsaSetQuotasForAccount 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 c8 ba f9 77 PUSH 0x77f9bac8 mismatch in ADVAPI32.dll::LsaSetSecret 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 38 PUSH 0x38 68 80 bd f9 77 PUSH 0x77f9bd80 mismatch in ADVAPI32.dll::LsaSetSecurityObject 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 1c PUSH 0x1c 68 30 b2 f9 77 PUSH 0x77f9b230 mismatch in ADVAPI32.dll::LsaSetSystemAccessAccount 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 b8 bb f9 77 PUSH 0x77f9bbb8 mismatch in ADVAPI32.dll::LsaSetTrustedDomainInfoByName 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 44 PUSH 0x44 68 00 9f f9 77 PUSH 0x77f99f00 mismatch in ADVAPI32.dll::LsaSetTrustedDomainInformation 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 40 PUSH 0x40 68 58 97 f9 77 PUSH 0x77f99758 mismatch in ADVAPI32.dll::LsaStorePrivateData 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 28 PUSH 0x28 68 a8 d0 f7 77 PUSH 0x77f7d0a8 match in ADVAPI32.dll::MD4Final match in ADVAPI32.dll::MD4Init match in ADVAPI32.dll::MD4Update match in ADVAPI32.dll::MD5Final match in ADVAPI32.dll::MD5Init match in ADVAPI32.dll::MD5Update match in ADVAPI32.dll::MSChapSrvChangePassword match in ADVAPI32.dll::MSChapSrvChangePassword2 match in ADVAPI32.dll::MakeAbsoluteSD match in ADVAPI32.dll::MakeAbsoluteSD2 match in ADVAPI32.dll::MakeSelfRelativeSD match in ADVAPI32.dll::MapGenericMask mismatch in ADVAPI32.dll::NotifyBootConfigStatus 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 f0 0b f7 77 PUSH 0x77f70bf0 match in ADVAPI32.dll::NotifyChangeEventLog match in ADVAPI32.dll::ObjectCloseAuditAlarmA match in ADVAPI32.dll::ObjectCloseAuditAlarmW match in ADVAPI32.dll::ObjectDeleteAuditAlarmA match in ADVAPI32.dll::ObjectDeleteAuditAlarmW match in ADVAPI32.dll::ObjectOpenAuditAlarmA match in ADVAPI32.dll::ObjectOpenAuditAlarmW match in ADVAPI32.dll::ObjectPrivilegeAuditAlarmA match in ADVAPI32.dll::ObjectPrivilegeAuditAlarmW match in ADVAPI32.dll::OpenBackupEventLogA match in ADVAPI32.dll::OpenBackupEventLogW match in ADVAPI32.dll::OpenEncryptedFileRawA match in ADVAPI32.dll::OpenEncryptedFileRawW match in ADVAPI32.dll::OpenEventLogA match in ADVAPI32.dll::OpenEventLogW match in ADVAPI32.dll::OpenProcessToken mismatch in ADVAPI32.dll::OpenSCManagerA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 58 d7 f6 77 PUSH 0x77f6d758 mismatch in ADVAPI32.dll::OpenSCManagerW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 b0 5e f6 77 PUSH 0x77f65eb0 mismatch in ADVAPI32.dll::OpenServiceA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 f0 e2 f6 77 PUSH 0x77f6e2f0 mismatch in ADVAPI32.dll::OpenServiceW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 48 5f f6 77 PUSH 0x77f65f48 match in ADVAPI32.dll::OpenThreadToken mismatch in ADVAPI32.dll::OpenTraceA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 1c PUSH 0x1c 68 00 83 fa 77 PUSH 0x77fa8300 mismatch in ADVAPI32.dll::OpenTraceW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 1c PUSH 0x1c 68 18 84 fa 77 PUSH 0x77fa8418 match in ADVAPI32.dll::PrivilegeCheck match in ADVAPI32.dll::PrivilegedServiceAuditAlarmA match in ADVAPI32.dll::PrivilegedServiceAuditAlarmW mismatch in ADVAPI32.dll::ProcessIdleTasks 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 a8 6d f9 77 PUSH 0x77f96da8 mismatch in ADVAPI32.dll::ProcessTrace 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 48 03 00 00 PUSH 0x348 68 88 8f fa 77 PUSH 0x77fa8f88 mismatch in ADVAPI32.dll::QueryAllTracesA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 94 00 00 00 PUSH 0x94 68 80 ab fa 77 PUSH 0x77faab80 mismatch in ADVAPI32.dll::QueryAllTracesW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 94 00 00 00 PUSH 0x94 68 b0 ca f7 77 PUSH 0x77f7cab0 match in ADVAPI32.dll::QueryRecoveryAgentsOnEncryptedFile mismatch in ADVAPI32.dll::QueryServiceConfig2A 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 30 PUSH 0x30 68 48 79 fb 77 PUSH 0x77fb7948 mismatch in ADVAPI32.dll::QueryServiceConfig2W 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 30 PUSH 0x30 68 60 7a fb 77 PUSH 0x77fb7a60 mismatch in ADVAPI32.dll::QueryServiceConfigA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 34 PUSH 0x34 68 a8 4d f7 77 PUSH 0x77f74da8 mismatch in ADVAPI32.dll::QueryServiceConfigW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 34 PUSH 0x34 68 70 6f f6 77 PUSH 0x77f66f70 mismatch in ADVAPI32.dll::QueryServiceLockStatusA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 1c PUSH 0x1c 68 f0 7a fb 77 PUSH 0x77fb7af0 mismatch in ADVAPI32.dll::QueryServiceLockStatusW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 1c PUSH 0x1c 68 80 7b fb 77 PUSH 0x77fb7b80 mismatch in ADVAPI32.dll::QueryServiceObjectSecurity 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 18 6c fb 77 PUSH 0x77fb6c18 mismatch in ADVAPI32.dll::QueryServiceStatus 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 90 5c f6 77 PUSH 0x77f65c90 mismatch in ADVAPI32.dll::QueryServiceStatusEx 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 a0 0e f7 77 PUSH 0x77f70ea0 match in ADVAPI32.dll::QueryTraceA match in ADVAPI32.dll::QueryTraceW match in ADVAPI32.dll::QueryUsersOnEncryptedFile mismatch in ADVAPI32.dll::QueryWindows31FilesMigration 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 1c 03 00 00 PUSH 0x31c 68 a8 53 f7 77 PUSH 0x77f753a8 match in ADVAPI32.dll::ReadEncryptedFileRaw match in ADVAPI32.dll::ReadEventLogA match in ADVAPI32.dll::ReadEventLogW match in ADVAPI32.dll::RegCloseKey match in ADVAPI32.dll::RegConnectRegistryA match in ADVAPI32.dll::RegConnectRegistryW match in ADVAPI32.dll::RegCreateKeyA match in ADVAPI32.dll::RegCreateKeyExA match in ADVAPI32.dll::RegCreateKeyExW match in ADVAPI32.dll::RegCreateKeyW match in ADVAPI32.dll::RegDeleteKeyA match in ADVAPI32.dll::RegDeleteKeyW match in ADVAPI32.dll::RegDeleteValueA match in ADVAPI32.dll::RegDeleteValueW mismatch in ADVAPI32.dll::RegDisablePredefinedCache 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 01 00 00 80 PUSH 0x80000001 e8 0d 00 00 00 CALL $+0xd match in ADVAPI32.dll::RegEnumKeyA match in ADVAPI32.dll::RegEnumKeyExA match in ADVAPI32.dll::RegEnumKeyExW match in ADVAPI32.dll::RegEnumKeyW match in ADVAPI32.dll::RegEnumValueA match in ADVAPI32.dll::RegEnumValueW match in ADVAPI32.dll::RegFlushKey match in ADVAPI32.dll::RegGetKeySecurity match in ADVAPI32.dll::RegLoadKeyA match in ADVAPI32.dll::RegLoadKeyW match in ADVAPI32.dll::RegNotifyChangeKeyValue match in ADVAPI32.dll::RegOpenCurrentUser match in ADVAPI32.dll::RegOpenKeyA match in ADVAPI32.dll::RegOpenKeyExA match in ADVAPI32.dll::RegOpenKeyExW match in ADVAPI32.dll::RegOpenKeyW match in ADVAPI32.dll::RegOpenUserClassesRoot match in ADVAPI32.dll::RegOverridePredefKey match in ADVAPI32.dll::RegQueryInfoKeyA match in ADVAPI32.dll::RegQueryInfoKeyW match in ADVAPI32.dll::RegQueryMultipleValuesA match in ADVAPI32.dll::RegQueryMultipleValuesW match in ADVAPI32.dll::RegQueryValueA match in ADVAPI32.dll::RegQueryValueExA match in ADVAPI32.dll::RegQueryValueExW match in ADVAPI32.dll::RegQueryValueW match in ADVAPI32.dll::RegReplaceKeyA match in ADVAPI32.dll::RegReplaceKeyW match in ADVAPI32.dll::RegRestoreKeyA match in ADVAPI32.dll::RegRestoreKeyW match in ADVAPI32.dll::RegSaveKeyA match in ADVAPI32.dll::RegSaveKeyExA match in ADVAPI32.dll::RegSaveKeyExW match in ADVAPI32.dll::RegSaveKeyW match in ADVAPI32.dll::RegSetKeySecurity match in ADVAPI32.dll::RegSetValueA mismatch in ADVAPI32.dll::RegSetValueExA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 2c PUSH 0x2c 68 68 ea f5 77 PUSH 0x77f5ea68 mismatch in ADVAPI32.dll::RegSetValueExW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 50 d7 f5 77 PUSH 0x77f5d750 match in ADVAPI32.dll::RegSetValueW match in ADVAPI32.dll::RegUnLoadKeyA match in ADVAPI32.dll::RegUnLoadKeyW match in ADVAPI32.dll::RegisterEventSourceA match in ADVAPI32.dll::RegisterEventSourceW match in ADVAPI32.dll::RegisterIdleTask match in ADVAPI32.dll::RegisterServiceCtrlHandlerA match in ADVAPI32.dll::RegisterServiceCtrlHandlerExA match in ADVAPI32.dll::RegisterServiceCtrlHandlerExW match in ADVAPI32.dll::RegisterServiceCtrlHandlerW match in ADVAPI32.dll::RegisterTraceGuidsA mismatch in ADVAPI32.dll::RegisterTraceGuidsW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 d0 00 00 00 PUSH 0xd0 68 e0 6b f6 77 PUSH 0x77f66be0 mismatch in ADVAPI32.dll::RemoveTraceCallback 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 24 PUSH 0x24 68 e8 60 fa 77 PUSH 0x77fa60e8 match in ADVAPI32.dll::RemoveUsersFromEncryptedFile mismatch in ADVAPI32.dll::ReportEventA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 98 7d f7 77 PUSH 0x77f77d98 mismatch in ADVAPI32.dll::ReportEventW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 20 da f6 77 PUSH 0x77f6da20 match in ADVAPI32.dll::RevertToSelf match in ADVAPI32.dll::SaferCloseLevel match in ADVAPI32.dll::SaferComputeTokenFromLevel match in ADVAPI32.dll::SaferCreateLevel match in ADVAPI32.dll::SaferGetLevelInformation match in ADVAPI32.dll::SaferGetPolicyInformation match in ADVAPI32.dll::SaferIdentifyLevel match in ADVAPI32.dll::SaferRecordEventLogEntry match in ADVAPI32.dll::SaferSetLevelInformation match in ADVAPI32.dll::SaferSetPolicyInformation match in ADVAPI32.dll::SaferiChangeRegistryScope match in ADVAPI32.dll::SaferiCompareTokenLevels match in ADVAPI32.dll::SaferiIsExecutableFileType match in ADVAPI32.dll::SaferiPopulateDefaultsInRegistry match in ADVAPI32.dll::SaferiRecordEventLogEntry match in ADVAPI32.dll::SaferiReplaceProcessThreadTokens match in ADVAPI32.dll::SaferiSearchMatchingHashRules match in ADVAPI32.dll::SetAclInformation match in ADVAPI32.dll::SetEntriesInAccessListA match in ADVAPI32.dll::SetEntriesInAccessListW match in ADVAPI32.dll::SetEntriesInAclA match in ADVAPI32.dll::SetEntriesInAclW match in ADVAPI32.dll::SetEntriesInAuditListA match in ADVAPI32.dll::SetEntriesInAuditListW match in ADVAPI32.dll::SetFileSecurityA match in ADVAPI32.dll::SetFileSecurityW match in ADVAPI32.dll::SetInformationCodeAuthzLevelW match in ADVAPI32.dll::SetInformationCodeAuthzPolicyW match in ADVAPI32.dll::SetKernelObjectSecurity match in ADVAPI32.dll::SetNamedSecurityInfoA mismatch in ADVAPI32.dll::SetNamedSecurityInfoExA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 84 00 00 00 PUSH 0x84 68 00 3b fa 77 PUSH 0x77fa3b00 mismatch in ADVAPI32.dll::SetNamedSecurityInfoExW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 68 PUSH 0x68 68 48 38 fa 77 PUSH 0x77fa3848 match in ADVAPI32.dll::SetNamedSecurityInfoW match in ADVAPI32.dll::SetPrivateObjectSecurity match in ADVAPI32.dll::SetPrivateObjectSecurityEx match in ADVAPI32.dll::SetSecurityDescriptorControl match in ADVAPI32.dll::SetSecurityDescriptorDacl match in ADVAPI32.dll::SetSecurityDescriptorGroup match in ADVAPI32.dll::SetSecurityDescriptorOwner match in ADVAPI32.dll::SetSecurityDescriptorRMControl match in ADVAPI32.dll::SetSecurityDescriptorSacl match in ADVAPI32.dll::SetSecurityInfo mismatch in ADVAPI32.dll::SetSecurityInfoExA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 80 00 00 00 PUSH 0x80 68 b8 3f fa 77 PUSH 0x77fa3fb8 mismatch in ADVAPI32.dll::SetSecurityInfoExW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 68 PUSH 0x68 68 08 3d fa 77 PUSH 0x77fa3d08 match in ADVAPI32.dll::SetServiceBits mismatch in ADVAPI32.dll::SetServiceObjectSecurity 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 00 6d fb 77 PUSH 0x77fb6d00 mismatch in ADVAPI32.dll::SetServiceStatus 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 08 dc f6 77 PUSH 0x77f6dc08 match in ADVAPI32.dll::SetThreadToken match in ADVAPI32.dll::SetTokenInformation mismatch in ADVAPI32.dll::SetTraceCallback 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 2c PUSH 0x2c 68 e0 5f fa 77 PUSH 0x77fa5fe0 match in ADVAPI32.dll::SetUserFileEncryptionKey mismatch in ADVAPI32.dll::StartServiceA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 10 26 f7 77 PUSH 0x77f72610 match in ADVAPI32.dll::StartServiceCtrlDispatcherA mismatch in ADVAPI32.dll::StartServiceCtrlDispatcherW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 30 02 00 00 PUSH 0x230 68 b8 df f6 77 PUSH 0x77f6dfb8 mismatch in ADVAPI32.dll::StartServiceW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 e0 e5 f6 77 PUSH 0x77f6e5e0 mismatch in ADVAPI32.dll::StartTraceA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 64 PUSH 0x64 68 10 97 fa 77 PUSH 0x77fa9710 mismatch in ADVAPI32.dll::StartTraceW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 74 PUSH 0x74 68 d8 9c fa 77 PUSH 0x77fa9cd8 match in ADVAPI32.dll::StopTraceA match in ADVAPI32.dll::StopTraceW mismatch in ADVAPI32.dll::SynchronizeWindows31FilesAndWindowsNTRegistry 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 30 03 00 00 PUSH 0x330 68 00 ed f8 77 PUSH 0x77f8ed00 match in ADVAPI32.dll::SystemFunction001 match in ADVAPI32.dll::SystemFunction002 match in ADVAPI32.dll::SystemFunction003 match in ADVAPI32.dll::SystemFunction004 match in ADVAPI32.dll::SystemFunction005 match in ADVAPI32.dll::SystemFunction006 match in ADVAPI32.dll::SystemFunction007 match in ADVAPI32.dll::SystemFunction008 match in ADVAPI32.dll::SystemFunction009 match in ADVAPI32.dll::SystemFunction010 match in ADVAPI32.dll::SystemFunction011 match in ADVAPI32.dll::SystemFunction012 match in ADVAPI32.dll::SystemFunction013 match in ADVAPI32.dll::SystemFunction014 match in ADVAPI32.dll::SystemFunction015 match in ADVAPI32.dll::SystemFunction016 match in ADVAPI32.dll::SystemFunction017 match in ADVAPI32.dll::SystemFunction018 match in ADVAPI32.dll::SystemFunction019 match in ADVAPI32.dll::SystemFunction020 match in ADVAPI32.dll::SystemFunction021 match in ADVAPI32.dll::SystemFunction022 match in ADVAPI32.dll::SystemFunction023 match in ADVAPI32.dll::SystemFunction024 match in ADVAPI32.dll::SystemFunction025 match in ADVAPI32.dll::SystemFunction026 match in ADVAPI32.dll::SystemFunction027 match in ADVAPI32.dll::SystemFunction028 match in ADVAPI32.dll::SystemFunction029 match in ADVAPI32.dll::SystemFunction030 match in ADVAPI32.dll::SystemFunction031 match in ADVAPI32.dll::SystemFunction032 match in ADVAPI32.dll::SystemFunction033 match in ADVAPI32.dll::SystemFunction034 match in ADVAPI32.dll::SystemFunction035 match in ADVAPI32.dll::SystemFunction036 match in ADVAPI32.dll::SystemFunction040 match in ADVAPI32.dll::SystemFunction041 mismatch in ADVAPI32.dll::TraceEvent 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 2c PUSH 0x2c 68 b0 a6 fa 77 PUSH 0x77faa6b0 mismatch in ADVAPI32.dll::TraceEventInstance 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 24 PUSH 0x24 68 e8 a7 fa 77 PUSH 0x77faa7e8 mismatch in ADVAPI32.dll::TraceMessage 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 e0 b2 fa 77 PUSH 0x77fab2e0 mismatch in ADVAPI32.dll::TraceMessageVa 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 70 b3 fa 77 PUSH 0x77fab370 mismatch in ADVAPI32.dll::TreeResetNamedSecurityInfoA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 78 PUSH 0x78 58 POP EAX match in ADVAPI32.dll::TreeResetNamedSecurityInfoW mismatch in ADVAPI32.dll::TrusteeAccessToObjectA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 48 PUSH 0x48 68 a0 32 fa 77 PUSH 0x77fa32a0 mismatch in ADVAPI32.dll::TrusteeAccessToObjectW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 e8 30 fa 77 PUSH 0x77fa30e8 match in ADVAPI32.dll::UninstallApplication mismatch in ADVAPI32.dll::UnlockServiceDatabase 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 f8 7b fb 77 PUSH 0x77fb7bf8 match in ADVAPI32.dll::UnregisterIdleTask mismatch in ADVAPI32.dll::UnregisterTraceGuids 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 74 PUSH 0x74 68 e8 57 f7 77 PUSH 0x77f757e8 match in ADVAPI32.dll::UpdateTraceA match in ADVAPI32.dll::UpdateTraceW match in ADVAPI32.dll::WdmWmiServiceMain mismatch in ADVAPI32.dll::WmiCloseBlock 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 0c PUSH 0xc 68 c8 28 f7 77 PUSH 0x77f728c8 match in ADVAPI32.dll::WmiCloseTraceWithCursor match in ADVAPI32.dll::WmiConvertTimestamp match in ADVAPI32.dll::WmiDevInstToInstanceNameA match in ADVAPI32.dll::WmiDevInstToInstanceNameW mismatch in ADVAPI32.dll::WmiEnumerateGuids 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 1c PUSH 0x1c 68 60 c5 fa 77 PUSH 0x77fac560 match in ADVAPI32.dll::WmiExecuteMethodA mismatch in ADVAPI32.dll::WmiExecuteMethodW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 28 PUSH 0x28 68 88 c1 fa 77 PUSH 0x77fac188 mismatch in ADVAPI32.dll::WmiFileHandleToInstanceNameA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 28 PUSH 0x28 68 98 cb fa 77 PUSH 0x77facb98 mismatch in ADVAPI32.dll::WmiFileHandleToInstanceNameW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 30 02 00 00 PUSH 0x230 68 c0 c3 fa 77 PUSH 0x77fac3c0 match in ADVAPI32.dll::WmiFreeBuffer match in ADVAPI32.dll::WmiGetFirstTraceOffset match in ADVAPI32.dll::WmiGetNextEvent mismatch in ADVAPI32.dll::WmiGetTraceHeader 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 e0 6c fa 77 PUSH 0x77fa6ce0 mismatch in ADVAPI32.dll::WmiMofEnumerateResourcesA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 30 PUSH 0x30 68 88 cd fa 77 PUSH 0x77facd88 match in ADVAPI32.dll::WmiMofEnumerateResourcesW match in ADVAPI32.dll::WmiNotificationRegistrationA match in ADVAPI32.dll::WmiNotificationRegistrationW mismatch in ADVAPI32.dll::WmiOpenBlock 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 20 PUSH 0x20 68 a0 66 f6 77 PUSH 0x77f666a0 mismatch in ADVAPI32.dll::WmiOpenTraceWithCursor 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 34 PUSH 0x34 68 30 89 fa 77 PUSH 0x77fa8930 match in ADVAPI32.dll::WmiParseTraceEvent match in ADVAPI32.dll::WmiQueryAllDataA match in ADVAPI32.dll::WmiQueryAllDataMultipleA mismatch in ADVAPI32.dll::WmiQueryAllDataMultipleW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 64 PUSH 0x64 68 f0 b5 fa 77 PUSH 0x77fab5f0 mismatch in ADVAPI32.dll::WmiQueryAllDataW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 6c PUSH 0x6c 68 20 4c f6 77 PUSH 0x77f64c20 mismatch in ADVAPI32.dll::WmiQueryGuidInformation 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 1c PUSH 0x1c 68 78 c7 fa 77 PUSH 0x77fac778 match in ADVAPI32.dll::WmiQuerySingleInstanceA match in ADVAPI32.dll::WmiQuerySingleInstanceMultipleA mismatch in ADVAPI32.dll::WmiQuerySingleInstanceMultipleW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 6c PUSH 0x6c 68 38 ba fa 77 PUSH 0x77faba38 mismatch in ADVAPI32.dll::WmiQuerySingleInstanceW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 20 PUSH 0x20 68 58 b8 fa 77 PUSH 0x77fab858 match in ADVAPI32.dll::WmiReceiveNotificationsA match in ADVAPI32.dll::WmiReceiveNotificationsW match in ADVAPI32.dll::WmiSetSingleInstanceA mismatch in ADVAPI32.dll::WmiSetSingleInstanceW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 00 bd fa 77 PUSH 0x77fabd00 match in ADVAPI32.dll::WmiSetSingleItemA mismatch in ADVAPI32.dll::WmiSetSingleItemW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 a0 be fa 77 PUSH 0x77fabea0 mismatch in ADVAPI32.dll::Wow64Win32ApiEntry 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 33 c0 XOR EAX,EAX 40 INC EAX match in ADVAPI32.dll::WriteEncryptedFileRaw match in RPCRT4.dll::CStdStubBuffer_AddRef match in RPCRT4.dll::CStdStubBuffer_Connect match in RPCRT4.dll::CStdStubBuffer_CountRefs match in RPCRT4.dll::CStdStubBuffer_DebugServerQueryInterface match in RPCRT4.dll::CStdStubBuffer_DebugServerRelease match in RPCRT4.dll::CStdStubBuffer_Disconnect match in RPCRT4.dll::CStdStubBuffer_Invoke mismatch in RPCRT4.dll::CStdStubBuffer_IsIIDSupported 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP c2 08 00 RET 0x8 90 NOP match in RPCRT4.dll::CStdStubBuffer_QueryInterface mismatch in RPCRT4.dll::CheckVerificationTrailer 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 24 PUSH 0x24 68 f0 a0 d9 77 PUSH 0x77d9a0f0 match in RPCRT4.dll::CreateProxyFromTypeInfo match in RPCRT4.dll::CreateStubFromTypeInfo match in RPCRT4.dll::DceErrorInqTextA match in RPCRT4.dll::DceErrorInqTextW match in RPCRT4.dll::DllGetClassObject mismatch in RPCRT4.dll::DllRegisterServer 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 18 PUSH 0x18 68 a8 24 de 77 PUSH 0x77de24a8 match in RPCRT4.dll::GlobalMutexClearExternal mismatch in RPCRT4.dll::GlobalMutexRequestExternal 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 78 b0 e0 77 PUSH 0x77e0b078 ff 15 58 13 d8 77 CALL DWORD PTR DS:[0x77d81358] mismatch in RPCRT4.dll::IUnknown_AddRef_Proxy 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 78 b0 e0 77 PUSH 0x77e0b078 ff 15 5c 13 d8 77 CALL DWORD PTR DS:[0x77d8135c] match in RPCRT4.dll::IUnknown_QueryInterface_Proxy match in RPCRT4.dll::IUnknown_Release_Proxy match in RPCRT4.dll::I_RpcAbortAsyncCall mismatch in RPCRT4.dll::I_RpcAllocate 5f POP EDI 6e OUTSB 64 72 00 JB $+0x0 52 PUSH EDX 50 PUSH EAX 43 INC EBX 52 PUSH EDX match in RPCRT4.dll::I_RpcAsyncAbortCall match in RPCRT4.dll::I_RpcAsyncSetHandle match in RPCRT4.dll::I_RpcBCacheAllocate match in RPCRT4.dll::I_RpcBCacheFree match in RPCRT4.dll::I_RpcBindingCopy match in RPCRT4.dll::I_RpcBindingHandleToAsyncHandle match in RPCRT4.dll::I_RpcBindingInqConnId match in RPCRT4.dll::I_RpcBindingInqDynamicEndpoint mismatch in RPCRT4.dll::I_RpcBindingInqDynamicEndpointA 43 INC EBX 61 POPAD 6c INSSB 6c INSSB 00 52 PUSH EDX 50 PUSH EAX mismatch in RPCRT4.dll::I_RpcBindingInqDynamicEndpointW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 e4 06 00 00 MOV EAX,0x6e4 c2 08 00 RET 0x8 match in RPCRT4.dll::I_RpcBindingInqLocalClientPID match in RPCRT4.dll::I_RpcBindingInqSecurityContext match in RPCRT4.dll::I_RpcBindingInqTransportType match in RPCRT4.dll::I_RpcBindingInqWireIdForSnego match in RPCRT4.dll::I_RpcBindingIsClientLocal match in RPCRT4.dll::I_RpcBindingToStaticStringBindingW match in RPCRT4.dll::I_RpcClearMutex match in RPCRT4.dll::I_RpcConnectionInqSockBuffSize match in RPCRT4.dll::I_RpcConnectionSetSockBuffSize match in RPCRT4.dll::I_RpcDeleteMutex match in RPCRT4.dll::I_RpcEnableWmiTrace match in RPCRT4.dll::I_RpcExceptionFilter match in RPCRT4.dll::I_RpcFree match in RPCRT4.dll::I_RpcFreeBuffer match in RPCRT4.dll::I_RpcFreePipeBuffer match in RPCRT4.dll::I_RpcGetBuffer match in RPCRT4.dll::I_RpcGetBufferWithObject match in RPCRT4.dll::I_RpcGetCurrentCallHandle mismatch in RPCRT4.dll::I_RpcGetExtendedError 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 83 3d dc b0 e0 77 00 CMP DWORD PTR DS:[0x77e0b0dc],0x0 75 09 JNE $+0x9 mismatch in RPCRT4.dll::I_RpcIfInqTransferSyntaxes 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP e8 28 d6 fb ff CALL $+0xfffbd628 85 c0 TEST EAX,EAX match in RPCRT4.dll::I_RpcLogEvent mismatch in RPCRT4.dll::I_RpcMapWin32Status 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP c2 1c 00 RET 0x1c 90 NOP match in RPCRT4.dll::I_RpcNegotiateTransferSyntax match in RPCRT4.dll::I_RpcNsBindingSetEntryName mismatch in RPCRT4.dll::I_RpcNsBindingSetEntryNameA 69 6e 74 57 00 52 50 IMUL EBP,DWORD PTR DS:[ESI+0x74],0x50520057 43 INC EBX 52 PUSH EDX 54 PUSH ESP 34 2e XOR AL,0x2e 49 DEC ECX 5f POP EDI mismatch in RPCRT4.dll::I_RpcNsBindingSetEntryNameW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 e4 06 00 00 MOV EAX,0x6e4 c2 0c 00 RET 0xc match in RPCRT4.dll::I_RpcNsInterfaceExported match in RPCRT4.dll::I_RpcNsInterfaceUnexported match in RPCRT4.dll::I_RpcParseSecurity match in RPCRT4.dll::I_RpcPauseExecution match in RPCRT4.dll::I_RpcProxyNewConnection match in RPCRT4.dll::I_RpcReallocPipeBuffer match in RPCRT4.dll::I_RpcReceive match in RPCRT4.dll::I_RpcRequestMutex match in RPCRT4.dll::I_RpcSend match in RPCRT4.dll::I_RpcSendReceive match in RPCRT4.dll::I_RpcServerAllocateIpPort match in RPCRT4.dll::I_RpcServerCheckClientRestriction mismatch in RPCRT4.dll::I_RpcServerInqAddressChangeFn 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP a1 98 b2 e0 77 MOV EAX,DWORD PTR DS:[0x77e0b298] c3 RET match in RPCRT4.dll::I_RpcServerInqLocalConnAddress match in RPCRT4.dll::I_RpcServerInqTransportType match in RPCRT4.dll::I_RpcServerRegisterForwardFunction match in RPCRT4.dll::I_RpcServerSetAddressChangeFn match in RPCRT4.dll::I_RpcServerUseProtseq2A match in RPCRT4.dll::I_RpcServerUseProtseq2W match in RPCRT4.dll::I_RpcServerUseProtseqEp2A match in RPCRT4.dll::I_RpcServerUseProtseqEp2W mismatch in RPCRT4.dll::I_RpcSessionStrictContextHandle 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP e8 3a ea fb ff CALL $+0xfffbea3a 85 c0 TEST EAX,EAX mismatch in RPCRT4.dll::I_RpcSetAsyncHandle 61 POPAD 6d INSSD 65 57 PUSH EDI 00 52 PUSH EDX 50 PUSH EAX 43 INC EBX mismatch in RPCRT4.dll::I_RpcSsDontSerializeContext 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP c7 05 4c b3 e0 77 01 00 00 00 MOV DWORD PTR DS:[0x77e0b34c],0x1 c3 RET mismatch in RPCRT4.dll::I_RpcSystemFunction001 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 a8 a8 da 77 PUSH 0x77daa8a8 match in RPCRT4.dll::I_RpcTransConnectionAllocatePacket match in RPCRT4.dll::I_RpcTransConnectionFreePacket match in RPCRT4.dll::I_RpcTransConnectionReallocPacket match in RPCRT4.dll::I_RpcTransDatagramAllocate match in RPCRT4.dll::I_RpcTransDatagramAllocate2 match in RPCRT4.dll::I_RpcTransDatagramFree mismatch in RPCRT4.dll::I_RpcTransGetThreadEvent 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 64 a1 18 00 00 00 MOV EAX,DWORD PTR FS:[0x18] 8b 80 1c 0f 00 00 MOV EAX,DWORD PTR DS:[EAX+0xf1c] match in RPCRT4.dll::I_RpcTransIoCancelled match in RPCRT4.dll::I_RpcTransServerNewConnection mismatch in RPCRT4.dll::I_RpcTurnOnEEInfoPropagation 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP c7 05 a8 b5 e0 77 01 00 00 00 MOV DWORD PTR DS:[0x77e0b5a8],0x1 33 c0 XOR EAX,EAX match in RPCRT4.dll::I_UuidCreate match in RPCRT4.dll::MIDL_wchar_strcpy match in RPCRT4.dll::MIDL_wchar_strlen match in RPCRT4.dll::MesBufferHandleReset match in RPCRT4.dll::MesDecodeBufferHandleCreate match in RPCRT4.dll::MesDecodeIncrementalHandleCreate match in RPCRT4.dll::MesEncodeDynBufferHandleCreate match in RPCRT4.dll::MesEncodeFixedBufferHandleCreate match in RPCRT4.dll::MesEncodeIncrementalHandleCreate match in RPCRT4.dll::MesHandleFree match in RPCRT4.dll::MesIncrementalHandleReset mismatch in RPCRT4.dll::MesInqProcEncodingId 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 20 40 de 77 PUSH 0x77de4020 mismatch in RPCRT4.dll::NDRCContextBinding 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 08 PUSH 0x8 68 08 da d8 77 PUSH 0x77d8da08 mismatch in RPCRT4.dll::NDRCContextMarshall 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 08 PUSH 0x8 68 80 d6 d8 77 PUSH 0x77d8d680 match in RPCRT4.dll::NDRCContextUnmarshall match in RPCRT4.dll::NDRSContextMarshall match in RPCRT4.dll::NDRSContextMarshall2 match in RPCRT4.dll::NDRSContextMarshallEx match in RPCRT4.dll::NDRSContextUnmarshall match in RPCRT4.dll::NDRSContextUnmarshall2 match in RPCRT4.dll::NDRSContextUnmarshallEx match in RPCRT4.dll::NDRcopy match in RPCRT4.dll::NdrAllocate mismatch in RPCRT4.dll::NdrAsyncClientCall 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 90 03 00 00 PUSH 0x390 68 30 b5 d9 77 PUSH 0x77d9b530 mismatch in RPCRT4.dll::NdrAsyncServerCall 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 58 PUSH 0x58 68 e0 6f da 77 PUSH 0x77da6fe0 match in RPCRT4.dll::NdrByteCountPointerBufferSize match in RPCRT4.dll::NdrByteCountPointerFree match in RPCRT4.dll::NdrByteCountPointerMarshall match in RPCRT4.dll::NdrByteCountPointerUnmarshall match in RPCRT4.dll::NdrCStdStubBuffer2_Release match in RPCRT4.dll::NdrCStdStubBuffer_Release match in RPCRT4.dll::NdrClearOutParameters mismatch in RPCRT4.dll::NdrClientCall 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 78 02 00 00 PUSH 0x278 68 40 50 dc 77 PUSH 0x77dc5040 mismatch in RPCRT4.dll::NdrClientCall2 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 b0 03 00 00 PUSH 0x3b0 68 68 aa d8 77 PUSH 0x77d8aa68 match in RPCRT4.dll::NdrClientContextMarshall match in RPCRT4.dll::NdrClientContextUnmarshall match in RPCRT4.dll::NdrClientInitialize match in RPCRT4.dll::NdrClientInitializeNew match in RPCRT4.dll::NdrComplexArrayBufferSize match in RPCRT4.dll::NdrComplexArrayFree match in RPCRT4.dll::NdrComplexArrayMarshall match in RPCRT4.dll::NdrComplexArrayMemorySize match in RPCRT4.dll::NdrComplexArrayUnmarshall match in RPCRT4.dll::NdrComplexStructBufferSize match in RPCRT4.dll::NdrComplexStructFree match in RPCRT4.dll::NdrComplexStructMarshall match in RPCRT4.dll::NdrComplexStructMemorySize match in RPCRT4.dll::NdrComplexStructUnmarshall match in RPCRT4.dll::NdrConformantArrayBufferSize match in RPCRT4.dll::NdrConformantArrayFree match in RPCRT4.dll::NdrConformantArrayMarshall match in RPCRT4.dll::NdrConformantArrayMemorySize match in RPCRT4.dll::NdrConformantArrayUnmarshall match in RPCRT4.dll::NdrConformantStringBufferSize match in RPCRT4.dll::NdrConformantStringMarshall match in RPCRT4.dll::NdrConformantStringMemorySize match in RPCRT4.dll::NdrConformantStringUnmarshall match in RPCRT4.dll::NdrConformantStructBufferSize match in RPCRT4.dll::NdrConformantStructFree match in RPCRT4.dll::NdrConformantStructMarshall match in RPCRT4.dll::NdrConformantStructMemorySize match in RPCRT4.dll::NdrConformantStructUnmarshall match in RPCRT4.dll::NdrConformantVaryingArrayBufferSize match in RPCRT4.dll::NdrConformantVaryingArrayFree match in RPCRT4.dll::NdrConformantVaryingArrayMarshall match in RPCRT4.dll::NdrConformantVaryingArrayMemorySize match in RPCRT4.dll::NdrConformantVaryingArrayUnmarshall match in RPCRT4.dll::NdrConformantVaryingStructBufferSize match in RPCRT4.dll::NdrConformantVaryingStructFree match in RPCRT4.dll::NdrConformantVaryingStructMarshall match in RPCRT4.dll::NdrConformantVaryingStructMemorySize match in RPCRT4.dll::NdrConformantVaryingStructUnmarshall match in RPCRT4.dll::NdrContextHandleInitialize match in RPCRT4.dll::NdrContextHandleSize match in RPCRT4.dll::NdrConvert match in RPCRT4.dll::NdrConvert2 match in RPCRT4.dll::NdrCorrelationFree match in RPCRT4.dll::NdrCorrelationInitialize match in RPCRT4.dll::NdrCorrelationPass mismatch in RPCRT4.dll::NdrCreateServerInterfaceFromStub 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 33 c0 XOR EAX,EAX c2 08 00 RET 0x8 match in RPCRT4.dll::NdrDcomAsyncClientCall mismatch in RPCRT4.dll::NdrDcomAsyncStubCall 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 74 PUSH 0x74 68 68 52 dc 77 PUSH 0x77dc5268 match in RPCRT4.dll::NdrDllCanUnloadNow match in RPCRT4.dll::NdrDllGetClassObject match in RPCRT4.dll::NdrDllRegisterProxy match in RPCRT4.dll::NdrDllUnregisterProxy match in RPCRT4.dll::NdrEncapsulatedUnionBufferSize match in RPCRT4.dll::NdrEncapsulatedUnionFree match in RPCRT4.dll::NdrEncapsulatedUnionMarshall match in RPCRT4.dll::NdrEncapsulatedUnionMemorySize match in RPCRT4.dll::NdrEncapsulatedUnionUnmarshall match in RPCRT4.dll::NdrFixedArrayBufferSize match in RPCRT4.dll::NdrFixedArrayFree match in RPCRT4.dll::NdrFixedArrayMarshall match in RPCRT4.dll::NdrFixedArrayMemorySize match in RPCRT4.dll::NdrFixedArrayUnmarshall match in RPCRT4.dll::NdrFreeBuffer match in RPCRT4.dll::NdrFullPointerFree match in RPCRT4.dll::NdrFullPointerInsertRefId match in RPCRT4.dll::NdrFullPointerQueryPointer match in RPCRT4.dll::NdrFullPointerQueryRefId match in RPCRT4.dll::NdrFullPointerXlatFree match in RPCRT4.dll::NdrFullPointerXlatInit match in RPCRT4.dll::NdrGetBuffer match in RPCRT4.dll::NdrGetDcomProtocolVersion match in RPCRT4.dll::NdrGetSimpleTypeBufferAlignment match in RPCRT4.dll::NdrGetSimpleTypeBufferSize match in RPCRT4.dll::NdrGetSimpleTypeMemorySize match in RPCRT4.dll::NdrGetTypeFlags mismatch in RPCRT4.dll::NdrGetUserMarshalInfo 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 08 PUSH 0x8 68 d8 c1 d9 77 PUSH 0x77d9c1d8 match in RPCRT4.dll::NdrInterfacePointerBufferSize match in RPCRT4.dll::NdrInterfacePointerFree match in RPCRT4.dll::NdrInterfacePointerMarshall match in RPCRT4.dll::NdrInterfacePointerMemorySize match in RPCRT4.dll::NdrInterfacePointerUnmarshall match in RPCRT4.dll::NdrMapCommAndFaultStatus match in RPCRT4.dll::NdrMesProcEncodeDecode mismatch in RPCRT4.dll::NdrMesProcEncodeDecode2 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 9c 02 00 00 PUSH 0x29c 68 e0 3a de 77 PUSH 0x77de3ae0 match in RPCRT4.dll::NdrMesSimpleTypeAlignSize match in RPCRT4.dll::NdrMesSimpleTypeDecode match in RPCRT4.dll::NdrMesSimpleTypeEncode match in RPCRT4.dll::NdrMesTypeAlignSize match in RPCRT4.dll::NdrMesTypeAlignSize2 mismatch in RPCRT4.dll::NdrMesTypeDecode 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 50 24 da 77 PUSH 0x77da2450 match in RPCRT4.dll::NdrMesTypeDecode2 mismatch in RPCRT4.dll::NdrMesTypeEncode 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 0c PUSH 0xc 68 b0 1f da 77 PUSH 0x77da1fb0 match in RPCRT4.dll::NdrMesTypeEncode2 match in RPCRT4.dll::NdrMesTypeFree2 match in RPCRT4.dll::NdrNonConformantStringBufferSize match in RPCRT4.dll::NdrNonConformantStringMarshall match in RPCRT4.dll::NdrNonConformantStringMemorySize match in RPCRT4.dll::NdrNonConformantStringUnmarshall match in RPCRT4.dll::NdrNonEncapsulatedUnionBufferSize match in RPCRT4.dll::NdrNonEncapsulatedUnionFree match in RPCRT4.dll::NdrNonEncapsulatedUnionMarshall match in RPCRT4.dll::NdrNonEncapsulatedUnionMemorySize match in RPCRT4.dll::NdrNonEncapsulatedUnionUnmarshall match in RPCRT4.dll::NdrNsGetBuffer match in RPCRT4.dll::NdrNsSendReceive match in RPCRT4.dll::NdrOleAllocate match in RPCRT4.dll::NdrOleFree match in RPCRT4.dll::NdrOutInit match in RPCRT4.dll::NdrPartialIgnoreClientBufferSize match in RPCRT4.dll::NdrPartialIgnoreClientMarshall match in RPCRT4.dll::NdrPartialIgnoreServerInitialize match in RPCRT4.dll::NdrPartialIgnoreServerUnmarshall match in RPCRT4.dll::NdrPointerBufferSize match in RPCRT4.dll::NdrPointerFree match in RPCRT4.dll::NdrPointerMarshall match in RPCRT4.dll::NdrPointerMemorySize match in RPCRT4.dll::NdrPointerUnmarshall match in RPCRT4.dll::NdrProxyErrorHandler match in RPCRT4.dll::NdrProxyFreeBuffer match in RPCRT4.dll::NdrProxyGetBuffer match in RPCRT4.dll::NdrProxyInitialize match in RPCRT4.dll::NdrProxySendReceive match in RPCRT4.dll::NdrRangeUnmarshall match in RPCRT4.dll::NdrRpcSmClientAllocate match in RPCRT4.dll::NdrRpcSmClientFree match in RPCRT4.dll::NdrRpcSmSetClientToOsf match in RPCRT4.dll::NdrRpcSsDefaultAllocate match in RPCRT4.dll::NdrRpcSsDefaultFree match in RPCRT4.dll::NdrRpcSsDisableAllocate match in RPCRT4.dll::NdrRpcSsEnableAllocate match in RPCRT4.dll::NdrSendReceive match in RPCRT4.dll::NdrServerCall match in RPCRT4.dll::NdrServerCall2 match in RPCRT4.dll::NdrServerContextMarshall match in RPCRT4.dll::NdrServerContextNewMarshall match in RPCRT4.dll::NdrServerContextNewUnmarshall match in RPCRT4.dll::NdrServerContextUnmarshall match in RPCRT4.dll::NdrServerInitialize mismatch in RPCRT4.dll::NdrServerInitializeMarshall 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP c2 08 00 RET 0x8 90 NOP match in RPCRT4.dll::NdrServerInitializeNew match in RPCRT4.dll::NdrServerInitializePartial match in RPCRT4.dll::NdrServerInitializeUnmarshall match in RPCRT4.dll::NdrServerMarshall mismatch in RPCRT4.dll::NdrServerUnmarshall 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 40 PUSH 0x40 68 b0 95 de 77 PUSH 0x77de95b0 match in RPCRT4.dll::NdrSimpleStructBufferSize match in RPCRT4.dll::NdrSimpleStructFree match in RPCRT4.dll::NdrSimpleStructMarshall match in RPCRT4.dll::NdrSimpleStructMemorySize match in RPCRT4.dll::NdrSimpleStructUnmarshall match in RPCRT4.dll::NdrSimpleTypeMarshall match in RPCRT4.dll::NdrSimpleTypeUnmarshall mismatch in RPCRT4.dll::NdrStubCall 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 c8 03 00 00 PUSH 0x3c8 68 88 a2 d8 77 PUSH 0x77d8a288 mismatch in RPCRT4.dll::NdrStubCall2 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 c4 02 00 00 PUSH 0x2c4 68 d8 52 dc 77 PUSH 0x77dc52d8 match in RPCRT4.dll::NdrStubForwardingFunction match in RPCRT4.dll::NdrStubGetBuffer match in RPCRT4.dll::NdrStubInitialize match in RPCRT4.dll::NdrStubInitializeMarshall mismatch in RPCRT4.dll::NdrTypeFlags 65 78 74 JS $+0x74 00 90 NOP 00 00 00 00 match in RPCRT4.dll::NdrTypeFree match in RPCRT4.dll::NdrTypeMarshall match in RPCRT4.dll::NdrTypeSize match in RPCRT4.dll::NdrTypeUnmarshall match in RPCRT4.dll::NdrUnmarshallBasetypeInline match in RPCRT4.dll::NdrUserMarshalBufferSize match in RPCRT4.dll::NdrUserMarshalFree match in RPCRT4.dll::NdrUserMarshalMarshall match in RPCRT4.dll::NdrUserMarshalMemorySize match in RPCRT4.dll::NdrUserMarshalSimpleTypeConvert match in RPCRT4.dll::NdrUserMarshalUnmarshall match in RPCRT4.dll::NdrVaryingArrayBufferSize match in RPCRT4.dll::NdrVaryingArrayFree match in RPCRT4.dll::NdrVaryingArrayMarshall match in RPCRT4.dll::NdrVaryingArrayMemorySize match in RPCRT4.dll::NdrVaryingArrayUnmarshall mismatch in RPCRT4.dll::NdrXmitOrRepAsBufferSize 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 20 PUSH 0x20 68 d0 4e de 77 PUSH 0x77de4ed0 match in RPCRT4.dll::NdrXmitOrRepAsFree mismatch in RPCRT4.dll::NdrXmitOrRepAsMarshall 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 20 PUSH 0x20 68 a8 57 de 77 PUSH 0x77de57a8 mismatch in RPCRT4.dll::NdrXmitOrRepAsMemorySize 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 14 PUSH 0x14 68 78 66 de 77 PUSH 0x77de6678 mismatch in RPCRT4.dll::NdrXmitOrRepAsUnmarshall 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 40 PUSH 0x40 68 f0 62 de 77 PUSH 0x77de62f0 match in RPCRT4.dll::NdrpCreateProxy match in RPCRT4.dll::NdrpCreateStub match in RPCRT4.dll::NdrpGetProcFormatString match in RPCRT4.dll::NdrpGetTypeFormatString match in RPCRT4.dll::NdrpGetTypeGenCookie match in RPCRT4.dll::NdrpMemoryIncrement match in RPCRT4.dll::NdrpReleaseTypeFormatString match in RPCRT4.dll::NdrpReleaseTypeGenCookie match in RPCRT4.dll::NdrpSetRpcSsDefaults match in RPCRT4.dll::NdrpVarVtOfTypeDesc mismatch in RPCRT4.dll::RpcAbortAsyncCall 6e OUTSB 64 6c INSSB 65 00 52 50 ADD BYTE PTR GS:[EDX+0x50],DL 43 INC EBX 52 PUSH EDX 54 PUSH ESP 34 2e XOR AL,0x2e match in RPCRT4.dll::RpcAsyncAbortCall match in RPCRT4.dll::RpcAsyncCancelCall match in RPCRT4.dll::RpcAsyncCompleteCall match in RPCRT4.dll::RpcAsyncGetCallStatus match in RPCRT4.dll::RpcAsyncInitializeHandle mismatch in RPCRT4.dll::RpcAsyncRegisterInfo 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 33 c0 XOR EAX,EAX c2 04 00 RET 0x4 match in RPCRT4.dll::RpcBindingCopy match in RPCRT4.dll::RpcBindingFree match in RPCRT4.dll::RpcBindingFromStringBindingA match in RPCRT4.dll::RpcBindingFromStringBindingW match in RPCRT4.dll::RpcBindingInqAuthClientA match in RPCRT4.dll::RpcBindingInqAuthClientExA match in RPCRT4.dll::RpcBindingInqAuthClientExW match in RPCRT4.dll::RpcBindingInqAuthClientW match in RPCRT4.dll::RpcBindingInqAuthInfoA match in RPCRT4.dll::RpcBindingInqAuthInfoExA match in RPCRT4.dll::RpcBindingInqAuthInfoExW match in RPCRT4.dll::RpcBindingInqAuthInfoW match in RPCRT4.dll::RpcBindingInqObject match in RPCRT4.dll::RpcBindingInqOption match in RPCRT4.dll::RpcBindingReset match in RPCRT4.dll::RpcBindingServerFromClient match in RPCRT4.dll::RpcBindingSetAuthInfoA match in RPCRT4.dll::RpcBindingSetAuthInfoExA match in RPCRT4.dll::RpcBindingSetAuthInfoExW match in RPCRT4.dll::RpcBindingSetAuthInfoW match in RPCRT4.dll::RpcBindingSetObject match in RPCRT4.dll::RpcBindingSetOption match in RPCRT4.dll::RpcBindingToStringBindingA match in RPCRT4.dll::RpcBindingToStringBindingW match in RPCRT4.dll::RpcBindingVectorFree mismatch in RPCRT4.dll::RpcCancelAsyncCall 43 INC EBX 61 POPAD 6c INSSB 6c INSSB 00 52 PUSH EDX 50 PUSH EAX match in RPCRT4.dll::RpcCancelThread match in RPCRT4.dll::RpcCancelThreadEx match in RPCRT4.dll::RpcCertGeneratePrincipalNameA match in RPCRT4.dll::RpcCertGeneratePrincipalNameW mismatch in RPCRT4.dll::RpcCompleteAsyncCall 43 INC EBX 61 POPAD 6c INSSB 6c INSSB 00 52 PUSH EDX 50 PUSH EAX match in RPCRT4.dll::RpcEpRegisterA match in RPCRT4.dll::RpcEpRegisterNoReplaceA match in RPCRT4.dll::RpcEpRegisterNoReplaceW match in RPCRT4.dll::RpcEpRegisterW match in RPCRT4.dll::RpcEpResolveBinding mismatch in RPCRT4.dll::RpcEpUnregister 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 50 PUSH 0x50 68 68 01 dd 77 PUSH 0x77dd0168 match in RPCRT4.dll::RpcErrorAddRecord mismatch in RPCRT4.dll::RpcErrorClearInformation 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 64 a1 18 00 00 00 MOV EAX,DWORD PTR FS:[0x18] 8b 80 1c 0f 00 00 MOV EAX,DWORD PTR DS:[EAX+0xf1c] match in RPCRT4.dll::RpcErrorEndEnumeration match in RPCRT4.dll::RpcErrorGetNextRecord match in RPCRT4.dll::RpcErrorGetNumberOfRecords match in RPCRT4.dll::RpcErrorLoadErrorInfo match in RPCRT4.dll::RpcErrorResetEnumeration mismatch in RPCRT4.dll::RpcErrorSaveErrorInfo 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 28 PUSH 0x28 68 50 0a dd 77 PUSH 0x77dd0a50 match in RPCRT4.dll::RpcErrorStartEnumeration match in RPCRT4.dll::RpcFreeAuthorizationContext mismatch in RPCRT4.dll::RpcGetAsyncCallStatus 43 INC EBX 61 POPAD 6c INSSB 6c INSSB 00 52 PUSH EDX 50 PUSH EAX match in RPCRT4.dll::RpcGetAuthorizationContextForClient match in RPCRT4.dll::RpcIfIdVectorFree match in RPCRT4.dll::RpcIfInqId match in RPCRT4.dll::RpcImpersonateClient mismatch in RPCRT4.dll::RpcInitializeAsyncHandle 61 POPAD 74 75 JE $+0x75 73 00 JNB $+0x0 52 PUSH EDX 50 PUSH EAX 43 INC EBX 52 PUSH EDX mismatch in RPCRT4.dll::RpcMgmtEnableIdleCleanup 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 83 3d dc b0 e0 77 00 CMP DWORD PTR DS:[0x77e0b0dc],0x0 75 0a JNE $+0xa match in RPCRT4.dll::RpcMgmtEpEltInqBegin match in RPCRT4.dll::RpcMgmtEpEltInqDone mismatch in RPCRT4.dll::RpcMgmtEpEltInqNextA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 68 94 00 00 00 PUSH 0x94 68 78 1c dd 77 PUSH 0x77dd1c78 match in RPCRT4.dll::RpcMgmtEpEltInqNextW mismatch in RPCRT4.dll::RpcMgmtEpUnregister 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 70 PUSH 0x70 68 c8 1e dd 77 PUSH 0x77dd1ec8 match in RPCRT4.dll::RpcMgmtInqComTimeout match in RPCRT4.dll::RpcMgmtInqDefaultProtectLevel match in RPCRT4.dll::RpcMgmtInqIfIds match in RPCRT4.dll::RpcMgmtInqServerPrincNameA match in RPCRT4.dll::RpcMgmtInqServerPrincNameW match in RPCRT4.dll::RpcMgmtInqStats match in RPCRT4.dll::RpcMgmtIsServerListening match in RPCRT4.dll::RpcMgmtSetAuthorizationFn match in RPCRT4.dll::RpcMgmtSetCancelTimeout match in RPCRT4.dll::RpcMgmtSetComTimeout match in RPCRT4.dll::RpcMgmtSetServerStackSize match in RPCRT4.dll::RpcMgmtStatsVectorFree match in RPCRT4.dll::RpcMgmtStopServerListening mismatch in RPCRT4.dll::RpcMgmtWaitServerListen 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 83 3d dc b0 e0 77 00 CMP DWORD PTR DS:[0x77e0b0dc],0x0 0f 84 ce 39 00 00 JE $+0x39ce match in RPCRT4.dll::RpcNetworkInqProtseqsA match in RPCRT4.dll::RpcNetworkInqProtseqsW match in RPCRT4.dll::RpcNetworkIsProtseqValidA match in RPCRT4.dll::RpcNetworkIsProtseqValidW match in RPCRT4.dll::RpcNsBindingInqEntryNameA match in RPCRT4.dll::RpcNsBindingInqEntryNameW match in RPCRT4.dll::RpcObjectInqType match in RPCRT4.dll::RpcObjectSetInqFn match in RPCRT4.dll::RpcObjectSetType match in RPCRT4.dll::RpcProtseqVectorFreeA match in RPCRT4.dll::RpcProtseqVectorFreeW match in RPCRT4.dll::RpcRaiseException mismatch in RPCRT4.dll::RpcRegisterAsyncInfo 6e OUTSB 64 6c INSSB 65 00 52 50 ADD BYTE PTR GS:[EDX+0x50],DL 43 INC EBX 52 PUSH EDX 54 PUSH ESP 34 2e XOR AL,0x2e mismatch in RPCRT4.dll::RpcRevertToSelf 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 00 PUSH 0x0 e8 f2 25 00 00 CALL $+0x25f2 match in RPCRT4.dll::RpcRevertToSelfEx match in RPCRT4.dll::RpcServerInqBindings match in RPCRT4.dll::RpcServerInqCallAttributesA match in RPCRT4.dll::RpcServerInqCallAttributesW match in RPCRT4.dll::RpcServerInqDefaultPrincNameA match in RPCRT4.dll::RpcServerInqDefaultPrincNameW match in RPCRT4.dll::RpcServerInqIf match in RPCRT4.dll::RpcServerListen match in RPCRT4.dll::RpcServerRegisterAuthInfoA match in RPCRT4.dll::RpcServerRegisterAuthInfoW match in RPCRT4.dll::RpcServerRegisterIf match in RPCRT4.dll::RpcServerRegisterIf2 match in RPCRT4.dll::RpcServerRegisterIfEx match in RPCRT4.dll::RpcServerTestCancel match in RPCRT4.dll::RpcServerUnregisterIf match in RPCRT4.dll::RpcServerUnregisterIfEx match in RPCRT4.dll::RpcServerUseAllProtseqs match in RPCRT4.dll::RpcServerUseAllProtseqsEx match in RPCRT4.dll::RpcServerUseAllProtseqsIf match in RPCRT4.dll::RpcServerUseAllProtseqsIfEx match in RPCRT4.dll::RpcServerUseProtseqA match in RPCRT4.dll::RpcServerUseProtseqEpA match in RPCRT4.dll::RpcServerUseProtseqEpExA match in RPCRT4.dll::RpcServerUseProtseqEpExW match in RPCRT4.dll::RpcServerUseProtseqEpW match in RPCRT4.dll::RpcServerUseProtseqExA match in RPCRT4.dll::RpcServerUseProtseqExW match in RPCRT4.dll::RpcServerUseProtseqIfA match in RPCRT4.dll::RpcServerUseProtseqIfExA match in RPCRT4.dll::RpcServerUseProtseqIfExW match in RPCRT4.dll::RpcServerUseProtseqIfW match in RPCRT4.dll::RpcServerUseProtseqW mismatch in RPCRT4.dll::RpcServerYield 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 64 a1 18 00 00 00 MOV EAX,DWORD PTR FS:[0x18] 8b 88 1c 0f 00 00 MOV ECX,DWORD PTR DS:[EAX+0xf1c] mismatch in RPCRT4.dll::RpcSmAllocate 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 f0 8c de 77 PUSH 0x77de8cf0 mismatch in RPCRT4.dll::RpcSmClientFree 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 0c PUSH 0xc 68 48 8d de 77 PUSH 0x77de8d48 mismatch in RPCRT4.dll::RpcSmDestroyClientContext 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 0c PUSH 0xc 68 f8 18 db 77 PUSH 0x77db18f8 mismatch in RPCRT4.dll::RpcSmDisableAllocate 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 0c PUSH 0xc 68 a0 8d de 77 PUSH 0x77de8da0 mismatch in RPCRT4.dll::RpcSmEnableAllocate 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 0c PUSH 0xc 68 40 91 de 77 PUSH 0x77de9140 mismatch in RPCRT4.dll::RpcSmFree 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 0c PUSH 0xc 68 f8 8d de 77 PUSH 0x77de8df8 mismatch in RPCRT4.dll::RpcSmGetThreadHandle 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 10 PUSH 0x10 68 60 8e de 77 PUSH 0x77de8e60 mismatch in RPCRT4.dll::RpcSmSetClientAllocFree 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 0c PUSH 0xc 68 c0 8e de 77 PUSH 0x77de8ec0 mismatch in RPCRT4.dll::RpcSmSetThreadHandle 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 0c PUSH 0xc 68 18 8f de 77 PUSH 0x77de8f18 mismatch in RPCRT4.dll::RpcSmSwapClientAllocFree 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 0c PUSH 0xc 68 80 8f de 77 PUSH 0x77de8f80 match in RPCRT4.dll::RpcSsAllocate match in RPCRT4.dll::RpcSsContextLockExclusive match in RPCRT4.dll::RpcSsContextLockShared match in RPCRT4.dll::RpcSsDestroyClientContext mismatch in RPCRT4.dll::RpcSsDisableAllocate 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 00 PUSH 0x0 e8 64 ff ff ff CALL $+0xffffff64 mismatch in RPCRT4.dll::RpcSsDontSerializeContext 49 DEC ECX 6e OUTSB 66 6f OUTSW 00 52 PUSH EDX 50 PUSH EAX 43 INC EBX mismatch in RPCRT4.dll::RpcSsEnableAllocate 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 00 PUSH 0x0 e8 e2 fe ff ff CALL $+0xfffffee2 mismatch in RPCRT4.dll::RpcSsFree 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP e8 90 fd ff ff CALL $+0xfffffd90 c2 04 00 RET 0x4 mismatch in RPCRT4.dll::RpcSsGetContextBinding 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 0c PUSH 0xc 68 40 fa dd 77 PUSH 0x77ddfa40 match in RPCRT4.dll::RpcSsGetThreadHandle match in RPCRT4.dll::RpcSsSetClientAllocFree match in RPCRT4.dll::RpcSsSetThreadHandle match in RPCRT4.dll::RpcSsSwapClientAllocFree match in RPCRT4.dll::RpcStringBindingComposeA match in RPCRT4.dll::RpcStringBindingComposeW match in RPCRT4.dll::RpcStringBindingParseA match in RPCRT4.dll::RpcStringBindingParseW match in RPCRT4.dll::RpcStringFreeA match in RPCRT4.dll::RpcStringFreeW mismatch in RPCRT4.dll::RpcTestCancel 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP 6a 00 PUSH 0x0 e8 9f ff ff ff CALL $+0xffffff9f match in RPCRT4.dll::RpcUserFree mismatch in RPCRT4.dll::SimpleTypeAlignment 00 00 00 00 00 00 00 mismatch in RPCRT4.dll::SimpleTypeBufferSize 03 00 ADD EAX,DWORD PTR DS:[EAX] 00 00 00 00 01 01 ADD DWORD PTR DS:[ECX],EAX 01 01 ADD DWORD PTR DS:[ECX],EAX mismatch in RPCRT4.dll::SimpleTypeMemorySize 04 00 ADD AL,0x0 00 00 00 00 01 01 ADD DWORD PTR DS:[ECX],EAX 01 01 ADD DWORD PTR DS:[ECX],EAX match in RPCRT4.dll::TowerConstruct match in RPCRT4.dll::TowerExplode match in RPCRT4.dll::UuidCompare match in RPCRT4.dll::UuidCreate match in RPCRT4.dll::UuidCreateNil match in RPCRT4.dll::UuidCreateSequential match in RPCRT4.dll::UuidEqual match in RPCRT4.dll::UuidFromStringA match in RPCRT4.dll::UuidFromStringW match in RPCRT4.dll::UuidHash match in RPCRT4.dll::UuidIsNil match in RPCRT4.dll::UuidToStringA match in RPCRT4.dll::UuidToStringW match in RPCRT4.dll::char_array_from_ndr match in RPCRT4.dll::char_from_ndr match in RPCRT4.dll::data_from_ndr match in RPCRT4.dll::data_into_ndr match in RPCRT4.dll::data_size_ndr match in RPCRT4.dll::double_array_from_ndr match in RPCRT4.dll::double_from_ndr match in RPCRT4.dll::enum_from_ndr match in RPCRT4.dll::float_array_from_ndr match in RPCRT4.dll::float_from_ndr match in RPCRT4.dll::long_array_from_ndr match in RPCRT4.dll::long_from_ndr match in RPCRT4.dll::long_from_ndr_temp mismatch in RPCRT4.dll::pfnFreeRoutines 00 mismatch in RPCRT4.dll::pfnMarshallRoutines 77 78 JNBE $+0x78 13 d8 ADC EBX,EAX 77 78 JNBE $+0x78 14 d8 ADC AL,0xd8 77 68 JNBE $+0x68 15 d8 77 4f bc ADC EAX,0xbc4f77d8 00 mismatch in RPCRT4.dll::pfnSizeRoutines 00 00 00 00 00 mismatch in RPCRT4.dll::pfnUnmarshallRoutines 77 78 JNBE $+0x78 14 d8 ADC AL,0xd8 77 68 JNBE $+0x68 15 d8 77 4f bc ADC EAX,0xbc4f77d8 00 00 00 match in RPCRT4.dll::short_array_from_ndr match in RPCRT4.dll::short_from_ndr match in RPCRT4.dll::short_from_ndr_temp match in RPCRT4.dll::tree_into_ndr match in RPCRT4.dll::tree_peek_ndr match in RPCRT4.dll::tree_size_ndr match in Secur32.dll::AcceptSecurityContext match in Secur32.dll::AcquireCredentialsHandleA match in Secur32.dll::AcquireCredentialsHandleW match in Secur32.dll::AddCredentialsA match in Secur32.dll::AddCredentialsW match in Secur32.dll::AddSecurityPackageA match in Secur32.dll::AddSecurityPackageW match in Secur32.dll::ApplyControlToken match in Secur32.dll::CompleteAuthToken match in Secur32.dll::CredMarshalTargetInfo match in Secur32.dll::CredUnmarshalTargetInfo match in Secur32.dll::DecryptMessage match in Secur32.dll::DeleteSecurityContext match in Secur32.dll::DeleteSecurityPackageA match in Secur32.dll::DeleteSecurityPackageW mismatch in Secur32.dll::EncryptMessage 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 02 03 09 80 MOV EAX,0x80090302 c2 04 00 RET 0x4 mismatch in Secur32.dll::EnumerateSecurityPackagesA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 02 03 09 80 MOV EAX,0x80090302 c2 04 00 RET 0x4 match in Secur32.dll::EnumerateSecurityPackagesW match in Secur32.dll::ExportSecurityContext match in Secur32.dll::FreeContextBuffer match in Secur32.dll::FreeCredentialsHandle match in Secur32.dll::GetComputerObjectNameA match in Secur32.dll::GetComputerObjectNameW match in Secur32.dll::GetSecurityUserInfo match in Secur32.dll::GetUserNameExA match in Secur32.dll::GetUserNameExW match in Secur32.dll::ImpersonateSecurityContext match in Secur32.dll::ImportSecurityContextA match in Secur32.dll::ImportSecurityContextW match in Secur32.dll::InitSecurityInterfaceA match in Secur32.dll::InitSecurityInterfaceW mismatch in Secur32.dll::InitializeSecurityContextA 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 e8 e2 ef 77 MOV EAX,0x77efe2e8 c3 RET mismatch in Secur32.dll::InitializeSecurityContextW 90 NOP 90 NOP 90 NOP 90 NOP 90 NOP b8 08 e2 ef 77 MOV EAX,0x77efe208 c3 RET match in Secur32.dll::LsaCallAuthenticationPackage match in Secur32.dll::LsaConnectUntrusted match in Secur32.dll::LsaDeregisterLogonProcess match in Secur32.dll::LsaEnumerateLogonSessions match in Secur32.dll::LsaFreeReturnBuffer match in Secur32.dll::LsaGetLogonSessionData match in Secur32.dll::LsaLogonUser match in Secur32.dll::LsaLookupAuthenticationPackage match in Secur32.dll::LsaRegisterLogonProcess match in Secur32.dll::LsaRegisterPolicyChangeNotification match in Secur32.dll::LsaUnregisterPolicyChangeNotification match in Secur32.dll::MakeSignature match in Secur32.dll::QueryContextAttributesA match in Secur32.dll::QueryContextAttributesW match in Secur32.dll::QueryCredentialsAttributesA match in Secur32.dll::QueryCredentialsAttributesW match in Secur32.dll::QuerySecurityContextToken match in Secur32.dll::QuerySecurityPackageInfoA match in Secur32.dll::QuerySecurityPackageInfoW match in Secur32.dll::RevertSecurityContext match in Secur32.dll::SaslAcceptSecurityContext match in Secur32.dll::SaslEnumerateProfilesA match in Secur32.dll::SaslEnumerateProfilesW match in Secur32.dll::SaslGetProfilePackageA match in Secur32.dll::SaslGetProfilePackageW match in Secur32.dll::SaslIdentifyPackageA match in Secur32.dll::SaslIdentifyPackageW match in Secur32.dll::SaslInitializeSecurityContextA match in Secur32.dll::SaslInitializeSecurityContextW match in Secur32.dll::SealMessage match in Secur32.dll::SecCacheSspiPackages match in Secur32.dll::SecDeleteUserModeContext match in Secur32.dll::SecGetLocaleSpecificEncryptionRules match in Secur32.dll::SecInitUserModeContext match in Secur32.dll::SecpFreeMemory match in Secur32.dll::SecpTranslateName match in Secur32.dll::SecpTranslateNameEx match in Secur32.dll::SetContextAttributesA match in Secur32.dll::SetContextAttributesW match in Secur32.dll::TranslateNameA match in Secur32.dll::TranslateNameW match in Secur32.dll::UnsealMessage match in Secur32.dll::VerifySignature mismatch in LPK.DLL::LpkDllInitialize cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in LPK.DLL::LpkDrawTextEx cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in LPK.DLL::LpkEditControl cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in LPK.DLL::LpkExtTextOut 00 00 00 00 00 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in LPK.DLL::LpkGetCharacterPlacement 00 6d INSSD 49 DEC ECX 34 62 XOR AL,0x62 mismatch in LPK.DLL::LpkGetTextExtentExPoint cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in LPK.DLL::LpkInitialize cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in LPK.DLL::LpkPSMTextOut cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in LPK.DLL::LpkTabbedTextOut cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in LPK.DLL::LpkUseGDIWidthCache cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in LPK.DLL::ftsWordBreak cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in USP10.dll::LpkPresent cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 c7 05 54 02 fd 73 01 00 00 00 MOV DWORD PTR DS:[0x73fd0254],0x1 c3 RET mismatch in USP10.dll::ScriptApplyDigitSubstitution cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in USP10.dll::ScriptApplyLogicalWidth cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in USP10.dll::ScriptBreak cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in USP10.dll::ScriptCPtoX cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in USP10.dll::ScriptCacheGetHeight cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in USP10.dll::ScriptFreeCache 00 00 00 00 00 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in USP10.dll::ScriptGetCMap cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in USP10.dll::ScriptGetFontProperties cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in USP10.dll::ScriptGetGlyphABCWidth cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in USP10.dll::ScriptGetLogicalWidths cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in USP10.dll::ScriptGetProperties cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in USP10.dll::ScriptIsComplex cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in USP10.dll::ScriptItemize cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in USP10.dll::ScriptJustify cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in USP10.dll::ScriptLayout cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in USP10.dll::ScriptPlace cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in USP10.dll::ScriptRecordDigitSubstitution cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in USP10.dll::ScriptShape cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in USP10.dll::ScriptStringAnalyse cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in USP10.dll::ScriptStringCPtoX cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in USP10.dll::ScriptStringFree cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in USP10.dll::ScriptStringGetLogicalWidths cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in USP10.dll::ScriptStringGetOrder cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in USP10.dll::ScriptStringOut cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in USP10.dll::ScriptStringValidate cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in USP10.dll::ScriptStringXtoCP cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in USP10.dll::ScriptString_pLogAttr cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in USP10.dll::ScriptString_pSize cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in USP10.dll::ScriptString_pcOutChars cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in USP10.dll::ScriptTextOut cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in USP10.dll::ScriptXtoCP cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in USP10.dll::UspAllocCache cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in USP10.dll::UspAllocTemp cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP mismatch in USP10.dll::UspFreeMem cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 cc INT 0x3 8b ff MOV EDI,EDI 55 PUSH EBP Press any key to continue