Permalink
Switch branches/tags
Nothing to show
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
122 lines (115 sloc) 41 KB
import os, sys
from Pro.Core import *
from Pro.PE import *
xp_system32 = "C:\\Users\\Admin\\Desktop\\system32"
apisetschema = {'api-ms-onecoreuap-print-render-l1-1-0': ['printrenderapihost.dll'], 'api-ms-onecoreuap-settingsync-status-l1-1-0': ['settingsynccore.dll'], 'api-ms-win-appmodel-identity-l1-2-0': ['kernel.appcore.dll'], 'api-ms-win-appmodel-runtime-internal-l1-1-3': ['kernel.appcore.dll'], 'api-ms-win-appmodel-runtime-l1-1-2': ['kernel.appcore.dll'], 'api-ms-win-appmodel-state-l1-1-2': ['kernel.appcore.dll'], 'api-ms-win-appmodel-state-l1-2-0': ['kernel.appcore.dll'], 'api-ms-win-appmodel-unlock-l1-1-0': ['kernel.appcore.dll'], 'api-ms-win-base-bootconfig-l1-1-0': ['advapi32.dll'], 'api-ms-win-base-util-l1-1-0': ['advapi32.dll'], 'api-ms-win-composition-redirection-l1-1-0': ['dwmredir.dll'], 'api-ms-win-composition-windowmanager-l1-1-0': ['udwm.dll'], 'api-ms-win-core-apiquery-l1-1-0': ['ntdll.dll'], 'api-ms-win-core-appcompat-l1-1-1': ['kernelbase.dll'], 'api-ms-win-core-appinit-l1-1-0': ['kernel32.dll', 'kernelbase.dll'], 'api-ms-win-core-atoms-l1-1-0': ['kernel32.dll'], 'api-ms-win-core-bicltapi-l1-1-4': ['bi.dll'], 'api-ms-win-core-biplmapi-l1-1-5': ['twinapi.appcore.dll'], 'api-ms-win-core-biptcltapi-l1-1-4': ['twinapi.appcore.dll'], 'api-ms-win-core-calendar-l1-1-0': ['kernel32.dll'], 'api-ms-win-core-com-l1-1-1': ['combase.dll'], 'api-ms-win-core-com-l2-1-1': ['coml2.dll'], 'api-ms-win-core-com-midlproxystub-l1-1-0': ['combase.dll'], 'api-ms-win-core-com-private-l1-1-1': ['combase.dll'], 'api-ms-win-core-comm-l1-1-0': ['kernelbase.dll'], 'api-ms-win-core-console-ansi-l2-1-0': ['kernel32.dll'], 'api-ms-win-core-console-l1-1-0': ['kernelbase.dll'], 'api-ms-win-core-console-l2-1-0': ['kernelbase.dll'], 'api-ms-win-core-crt-l1-1-0': ['ntdll.dll'], 'api-ms-win-core-crt-l2-1-0': ['kernelbase.dll'], 'api-ms-win-core-datetime-l1-1-2': ['kernelbase.dll'], 'api-ms-win-core-debug-l1-1-2': ['kernelbase.dll'], 'api-ms-win-core-debug-minidump-l1-1-0': ['dbgcore.dll'], 'api-ms-win-core-delayload-l1-1-1': ['kernelbase.dll'], 'api-ms-win-core-enclave-l1-1-0': ['kernelbase.dll'], 'api-ms-win-core-errorhandling-l1-1-3': ['kernelbase.dll'], 'api-ms-win-core-featurestaging-l1-1-0': ['shcore.dll'], 'api-ms-win-core-fibers-l1-1-1': ['kernelbase.dll'], 'api-ms-win-core-fibers-l2-1-1': ['kernelbase.dll'], 'api-ms-win-core-file-ansi-l1-1-0': ['kernel32.dll'], 'api-ms-win-core-file-ansi-l2-1-0': ['kernel32.dll'], 'api-ms-win-core-file-l1-1-1': ['kernelbase.dll'], 'api-ms-win-core-file-l1-2-2': ['kernelbase.dll'], 'api-ms-win-core-file-l2-1-2': ['kernelbase.dll'], 'api-ms-win-core-firmware-l1-1-0': ['kernel32.dll'], 'api-ms-win-core-guard-l1-1-0': ['kernelbase.dll'], 'api-ms-win-core-handle-l1-1-0': ['kernelbase.dll'], 'api-ms-win-core-heap-l1-1-0': ['kernelbase.dll'], 'api-ms-win-core-heap-l1-2-0': ['kernelbase.dll'], 'api-ms-win-core-heap-l2-1-0': ['kernelbase.dll'], 'api-ms-win-core-heap-obsolete-l1-1-0': ['kernel32.dll'], 'api-ms-win-core-interlocked-l1-1-1': ['kernelbase.dll'], 'api-ms-win-core-interlocked-l1-2-0': ['kernelbase.dll'], 'api-ms-win-core-io-l1-1-1': ['kernel32.dll', 'kernelbase.dll'], 'api-ms-win-core-job-l1-1-0': ['kernelbase.dll'], 'api-ms-win-core-job-l2-1-1': ['kernel32.dll'], 'api-ms-win-core-kernel32-legacy-ansi-l1-1-0': ['kernel32.dll'], 'api-ms-win-core-kernel32-legacy-l1-1-5': ['kernel32.dll'], 'api-ms-win-core-kernel32-private-l1-1-2': ['kernel32.dll'], 'api-ms-win-core-largeinteger-l1-1-0': ['kernelbase.dll'], 'api-ms-win-core-libraryloader-l1-1-1': ['kernelbase.dll'], 'api-ms-win-core-libraryloader-l1-2-2': ['kernelbase.dll'], 'api-ms-win-core-libraryloader-l2-1-0': ['kernelbase.dll'], 'api-ms-win-core-libraryloader-private-l1-1-0': ['kernelbase.dll'], 'api-ms-win-core-localization-ansi-l1-1-0': ['kernel32.dll'], 'api-ms-win-core-localization-l1-1-0': ['kernelbase.dll'], 'api-ms-win-core-localization-l1-2-2': ['kernelbase.dll'], 'api-ms-win-core-localization-l2-1-0': ['kernelbase.dll'], 'api-ms-win-core-localization-obsolete-l1-1-0': ['kernelbase.dll'], 'api-ms-win-core-localization-obsolete-l1-2-0': ['kernelbase.dll'], 'api-ms-win-core-localization-obsolete-l1-3-0': ['kernelbase.dll'], 'api-ms-win-core-localization-private-l1-1-0': ['kernelbase.dll'], 'api-ms-win-core-localregistry-l1-1-0': ['kernelbase.dll'], 'api-ms-win-core-marshal-l1-1-0': ['combase.dll'], 'api-ms-win-core-memory-l1-1-4': ['kernelbase.dll'], 'api-ms-win-core-misc-l1-1-0': ['kernelbase.dll'], 'api-ms-win-core-multipleproviderrouter-l1-1-0': ['mpr.dll'], 'api-ms-win-core-namedpipe-ansi-l1-1-1': ['kernel32.dll'], 'api-ms-win-core-namedpipe-l1-1-0': ['kernelbase.dll'], 'api-ms-win-core-namedpipe-l1-2-2': ['kernelbase.dll'], 'api-ms-win-core-namespace-ansi-l1-1-0': ['kernel32.dll'], 'api-ms-win-core-namespace-l1-1-0': ['kernelbase.dll'], 'api-ms-win-core-normalization-l1-1-0': ['kernelbase.dll'], 'api-ms-win-core-path-l1-1-0': ['kernelbase.dll'], 'api-ms-win-core-perfcounters-l1-1-0': ['kernelbase.dll'], 'api-ms-win-core-privateprofile-l1-1-1': ['kernel32.dll'], 'api-ms-win-core-processenvironment-ansi-l1-1-0': ['kernel32.dll'], 'api-ms-win-core-processenvironment-l1-1-1': ['kernelbase.dll'], 'api-ms-win-core-processenvironment-l1-2-0': ['kernelbase.dll'], 'api-ms-win-core-processsecurity-l1-1-0': ['kernel32.dll', 'kernelbase.dll'], 'api-ms-win-core-processsnapshot-l1-1-0': ['kernelbase.dll'], 'api-ms-win-core-processthreads-l1-1-3': ['kernel32.dll', 'kernelbase.dll'], 'api-ms-win-core-processtopology-l1-1-0': ['kernelbase.dll'], 'api-ms-win-core-processtopology-l1-2-0': ['kernelbase.dll'], 'api-ms-win-core-processtopology-obsolete-l1-1-1': ['kernel32.dll'], 'api-ms-win-core-processtopology-private-l1-1-0': ['kernelbase.dll'], 'api-ms-win-core-profile-l1-1-0': ['kernelbase.dll'], 'api-ms-win-core-psapi-ansi-l1-1-0': ['kernelbase.dll'], 'api-ms-win-core-psapi-l1-1-0': ['kernelbase.dll'], 'api-ms-win-core-psapi-obsolete-l1-1-0': ['kernelbase.dll'], 'api-ms-win-core-psapiansi-l1-1-0': ['kernelbase.dll'], 'api-ms-win-core-psm-app-l1-1-0': ['twinapi.appcore.dll'], 'api-ms-win-core-psm-appnotify-l1-1-0': ['twinapi.appcore.dll'], 'api-ms-win-core-psm-info-l1-1-1': ['appsruprov.dll'], 'api-ms-win-core-psm-key-l1-1-1': ['kernelbase.dll'], 'api-ms-win-core-psm-plm-l1-1-3': ['twinapi.appcore.dll'], 'api-ms-win-core-psm-plm-l1-2-0': ['twinapi.appcore.dll'], 'api-ms-win-core-psm-rtimer-l1-1-1': ['twinapi.appcore.dll'], 'api-ms-win-core-psm-tc-l1-1-1': ['twinapi.appcore.dll'], 'api-ms-win-core-quirks-l1-1-1': ['kernelbase.dll'], 'api-ms-win-core-realtime-l1-1-1': ['kernelbase.dll'], 'api-ms-win-core-registry-l1-1-1': ['kernelbase.dll'], 'api-ms-win-core-registry-l2-1-0': ['advapi32.dll'], 'api-ms-win-core-registry-l2-2-0': ['advapi32.dll'], 'api-ms-win-core-registry-private-l1-1-0': ['advapi32.dll'], 'api-ms-win-core-registryuserspecific-l1-1-0': ['kernelbase.dll'], 'api-ms-win-core-rtlsupport-l1-1-1': ['ntdll.dll'], 'api-ms-win-core-rtlsupport-l1-2-0': ['ntdll.dll'], 'api-ms-win-core-shlwapi-legacy-l1-1-0': ['kernelbase.dll'], 'api-ms-win-core-shlwapi-obsolete-l1-1-0': ['kernelbase.dll'], 'api-ms-win-core-shlwapi-obsolete-l1-2-0': ['kernelbase.dll'], 'api-ms-win-core-shutdown-ansi-l1-1-0': ['advapi32.dll'], 'api-ms-win-core-shutdown-l1-1-1': ['advapi32.dll'], 'api-ms-win-core-sidebyside-ansi-l1-1-0': ['kernel32.dll'], 'api-ms-win-core-sidebyside-l1-1-0': ['kernelbase.dll'], 'api-ms-win-core-slapi-l1-1-0': ['clipc.dll'], 'api-ms-win-core-string-l1-1-0': ['kernelbase.dll'], 'api-ms-win-core-string-l2-1-1': ['kernelbase.dll'], 'api-ms-win-core-string-obsolete-l1-1-1': ['kernel32.dll'], 'api-ms-win-core-stringansi-l1-1-0': ['kernelbase.dll'], 'api-ms-win-core-stringloader-l1-1-1': ['kernelbase.dll'], 'api-ms-win-core-synch-ansi-l1-1-0': ['kernel32.dll'], 'api-ms-win-core-synch-l1-1-1': ['kernelbase.dll'], 'api-ms-win-core-synch-l1-2-1': ['kernelbase.dll'], 'api-ms-win-core-sysinfo-l1-1-1': ['kernelbase.dll'], 'api-ms-win-core-sysinfo-l1-2-3': ['kernelbase.dll'], 'api-ms-win-core-sysinfo-l2-1-0': ['advapi32.dll'], 'api-ms-win-core-systemtopology-l1-1-1': ['kernelbase.dll'], 'api-ms-win-core-textinput-client-l1-1-0': ['textinputframework.dll'], 'api-ms-win-core-threadpool-l1-1-0': ['kernelbase.dll'], 'api-ms-win-core-threadpool-l1-2-0': ['kernelbase.dll'], 'api-ms-win-core-threadpool-legacy-l1-1-0': ['kernelbase.dll'], 'api-ms-win-core-threadpool-private-l1-1-0': ['kernelbase.dll'], 'api-ms-win-core-timezone-l1-1-0': ['kernelbase.dll'], 'api-ms-win-core-timezone-private-l1-1-0': ['kernelbase.dll'], 'api-ms-win-core-toolhelp-l1-1-1': ['kernel32.dll'], 'api-ms-win-core-ums-l1-1-0': ['kernel32.dll'], 'api-ms-win-core-url-l1-1-0': ['kernelbase.dll'], 'api-ms-win-core-util-l1-1-1': ['kernel32.dll', 'kernelbase.dll'], 'api-ms-win-core-version-l1-1-1': ['kernelbase.dll'], 'api-ms-win-core-version-private-l1-1-0': ['kernelbase.dll'], 'api-ms-win-core-versionansi-l1-1-1': ['kernelbase.dll'], 'api-ms-win-core-windowsceip-l1-1-0': ['kernelbase.dll'], 'api-ms-win-core-windowserrorreporting-l1-1-0': ['kernelbase.dll'], 'api-ms-win-core-winrt-error-l1-1-1': ['combase.dll'], 'api-ms-win-core-winrt-errorprivate-l1-1-1': ['combase.dll'], 'api-ms-win-core-winrt-l1-1-0': ['combase.dll'], 'api-ms-win-core-winrt-propertysetprivate-l1-1-1': ['wintypes.dll'], 'api-ms-win-core-winrt-registration-l1-1-0': ['combase.dll'], 'api-ms-win-core-winrt-robuffer-l1-1-0': ['wintypes.dll'], 'api-ms-win-core-winrt-roparameterizediid-l1-1-0': ['combase.dll'], 'api-ms-win-core-winrt-string-l1-1-1': ['combase.dll'], 'api-ms-win-core-wow64-l1-1-1': ['kernelbase.dll'], 'api-ms-win-core-xstate-l1-1-2': ['ntdll.dll'], 'api-ms-win-core-xstate-l2-1-0': ['kernelbase.dll'], 'api-ms-win-coremessaging-host-l1-1-0': [''], 'api-ms-win-coreui-secruntime-l1-1-0': [''], 'api-ms-win-crt-conio-l1-1-0': ['ucrtbase.dll'], 'api-ms-win-crt-convert-l1-1-0': ['ucrtbase.dll'], 'api-ms-win-crt-environment-l1-1-0': ['ucrtbase.dll'], 'api-ms-win-crt-filesystem-l1-1-0': ['ucrtbase.dll'], 'api-ms-win-crt-heap-l1-1-0': ['ucrtbase.dll'], 'api-ms-win-crt-locale-l1-1-0': ['ucrtbase.dll'], 'api-ms-win-crt-math-l1-1-0': ['ucrtbase.dll'], 'api-ms-win-crt-multibyte-l1-1-0': ['ucrtbase.dll'], 'api-ms-win-crt-private-l1-1-0': ['ucrtbase.dll'], 'api-ms-win-crt-process-l1-1-0': ['ucrtbase.dll'], 'api-ms-win-crt-runtime-l1-1-0': ['ucrtbase.dll'], 'api-ms-win-crt-stdio-l1-1-0': ['ucrtbase.dll'], 'api-ms-win-crt-string-l1-1-0': ['ucrtbase.dll'], 'api-ms-win-crt-time-l1-1-0': ['ucrtbase.dll'], 'api-ms-win-crt-utility-l1-1-0': ['ucrtbase.dll'], 'api-ms-win-deprecated-apis-advapi-l1-1-0': [''], 'api-ms-win-deprecated-apis-legacy-l1-1-0': [''], 'api-ms-win-deprecated-apis-legacy-l1-2-0': [''], 'api-ms-win-deprecated-apis-obsolete-l1-1-0': ['kernelbase.dll'], 'api-ms-win-devices-config-l1-1-1': ['cfgmgr32.dll'], 'api-ms-win-devices-query-l1-1-1': ['cfgmgr32.dll'], 'api-ms-win-devices-swdevice-l1-1-1': ['cfgmgr32.dll'], 'api-ms-win-downlevel-advapi32-l1-1-1': ['kernelbase.dll'], 'api-ms-win-downlevel-advapi32-l2-1-1': ['sechost.dll'], 'api-ms-win-downlevel-advapi32-l3-1-0': ['ntmarta.dll'], 'api-ms-win-downlevel-advapi32-l4-1-0': ['advapi32.dll'], 'api-ms-win-downlevel-kernel32-l1-1-0': ['kernelbase.dll'], 'api-ms-win-downlevel-kernel32-l2-1-0': ['kernel32.dll'], 'api-ms-win-downlevel-normaliz-l1-1-0': ['kernelbase.dll'], 'api-ms-win-downlevel-ole32-l1-1-1': ['combase.dll'], 'api-ms-win-downlevel-shell32-l1-1-0': ['shcore.dll'], 'api-ms-win-downlevel-shlwapi-l1-1-1': ['kernelbase.dll'], 'api-ms-win-downlevel-shlwapi-l2-1-1': ['shcore.dll'], 'api-ms-win-downlevel-user32-l1-1-1': ['kernelbase.dll'], 'api-ms-win-downlevel-version-l1-1-0': ['kernelbase.dll'], 'api-ms-win-dwmapi-l1-1-0': ['dwmapi.dll'], 'api-ms-win-dx-d3dkmt-l1-1-2': ['gdi32.dll'], 'api-ms-win-eventing-classicprovider-l1-1-0': ['kernelbase.dll'], 'api-ms-win-eventing-consumer-l1-1-0': ['sechost.dll'], 'api-ms-win-eventing-controller-l1-1-0': ['sechost.dll'], 'api-ms-win-eventing-legacy-l1-1-0': ['advapi32.dll'], 'api-ms-win-eventing-obsolete-l1-1-0': ['sechost.dll'], 'api-ms-win-eventing-provider-l1-1-0': ['kernelbase.dll'], 'api-ms-win-eventing-tdh-l1-1-0': ['tdh.dll', 'mintdh.dll'], 'api-ms-win-eventlog-legacy-l1-1-0': ['advapi32.dll'], 'api-ms-win-eventlog-private-l1-1-0': ['advapi32.dll'], 'api-ms-win-gaming-tcui-l1-1-2': ['gamingtcui.dll'], 'api-ms-win-gdi-dpiinfo-l1-1-0': ['gdi32.dll'], 'api-ms-win-gdi-internal-uap-l1-1-0': ['gdi32full.dll'], 'api-ms-win-http-time-l1-1-0': ['kernelbase.dll'], 'api-ms-win-input-ie-interactioncontext-l1-1-0': [''], 'api-ms-win-legacy-shlwapi-l1-1-0': ['kernelbase.dll'], 'api-ms-win-mm-joystick-l1-1-0': ['winmmbase.dll'], 'api-ms-win-mm-mci-l1-1-0': ['winmm.dll'], 'api-ms-win-mm-misc-l1-1-1': ['winmmbase.dll'], 'api-ms-win-mm-misc-l2-1-0': ['winmm.dll'], 'api-ms-win-mm-mme-l1-1-0': ['winmmbase.dll'], 'api-ms-win-mm-playsound-l1-1-0': ['winmm.dll'], 'api-ms-win-mm-time-l1-1-0': ['kernel32.dll'], 'api-ms-win-net-isolation-l1-1-1': ['firewallapi.dll'], 'api-ms-win-networking-interfacecontexts-l1-1-0': ['ondemandconnroutehelper.dll'], 'api-ms-win-ntuser-ie-message-l1-1-0': ['user32.dll'], 'api-ms-win-ntuser-ie-window-l1-1-0': ['user32.dll'], 'api-ms-win-ntuser-ie-wmpointer-l1-1-0': ['user32.dll'], 'api-ms-win-ntuser-rectangle-l1-1-0': ['user32.dll'], 'api-ms-win-ntuser-sysparams-l1-1-0': ['user32.dll'], 'api-ms-win-obsolete-localization-l1-1-0': ['kernelbase.dll'], 'api-ms-win-obsolete-psapi-l1-1-0': ['kernelbase.dll'], 'api-ms-win-obsolete-shlwapi-l1-1-0': ['kernelbase.dll'], 'api-ms-win-ole32-ie-l1-1-0': ['ole32.dll'], 'api-ms-win-oobe-notification-l1-1-0': ['kernel32.dll'], 'api-ms-win-perf-legacy-l1-1-0': ['advapi32.dll'], 'api-ms-win-power-base-l1-1-0': ['powrprof.dll'], 'api-ms-win-power-limitsmanagement-l1-1-0': ['powrprof.dll'], 'api-ms-win-power-setting-l1-1-0': ['powrprof.dll'], 'api-ms-win-ro-typeresolution-l1-1-0': ['wintypes.dll'], 'api-ms-win-rtcore-minuser-private-l1-1-1': [''], 'api-ms-win-rtcore-navigation-l1-1-0': [''], 'api-ms-win-rtcore-ntuser-clipboard-l1-1-0': ['user32.dll'], 'api-ms-win-rtcore-ntuser-draw-l1-1-0': ['user32.dll'], 'api-ms-win-rtcore-ntuser-powermanagement-l1-1-0': ['user32.dll'], 'api-ms-win-rtcore-ntuser-private-l1-1-4': ['user32.dll'], 'api-ms-win-rtcore-ntuser-shell-l1-1-0': ['user32.dll'], 'api-ms-win-rtcore-ntuser-synch-l1-1-0': ['user32.dll'], 'api-ms-win-rtcore-ntuser-window-l1-1-0': ['user32.dll'], 'api-ms-win-rtcore-ntuser-winevent-l1-1-0': ['user32.dll'], 'api-ms-win-rtcore-ntuser-wmpointer-l1-1-3': ['user32.dll'], 'api-ms-win-rtcore-ole32-clipboard-l1-1-1': ['ole32.dll'], 'api-ms-win-rtcore-session-l1-1-1': [''], 'api-ms-win-security-accesshlpr-l1-1-0': ['sechost.dll'], 'api-ms-win-security-activedirectoryclient-l1-1-1': ['kernelbase.dll'], 'api-ms-win-security-appcontainer-l1-1-0': ['kernelbase.dll'], 'api-ms-win-security-audit-l1-1-1': ['sechost.dll'], 'api-ms-win-security-base-ansi-l1-1-0': ['advapi32.dll'], 'api-ms-win-security-base-l1-1-1': ['kernelbase.dll'], 'api-ms-win-security-base-l1-2-1': ['kernelbase.dll'], 'api-ms-win-security-base-private-l1-1-1': ['kernelbase.dll'], 'api-ms-win-security-capability-l1-1-0': ['sechost.dll'], 'api-ms-win-security-cpwl-l1-1-0': ['advapi32.dll'], 'api-ms-win-security-credentials-l1-1-0': ['sechost.dll'], 'api-ms-win-security-credentials-l2-1-0': ['sechost.dll'], 'api-ms-win-security-cryptoapi-l1-1-0': ['cryptsp.dll'], 'api-ms-win-security-grouppolicy-l1-1-0': ['kernelbase.dll'], 'api-ms-win-security-logon-l1-1-1': ['advapi32.dll'], 'api-ms-win-security-lsalookup-ansi-l2-1-0': ['advapi32.dll'], 'api-ms-win-security-lsalookup-l1-1-2': ['sechost.dll'], 'api-ms-win-security-lsalookup-l2-1-1': ['advapi32.dll'], 'api-ms-win-security-lsapolicy-l1-1-1': ['sechost.dll'], 'api-ms-win-security-provider-ansi-l1-1-0': ['advapi32.dll'], 'api-ms-win-security-provider-l1-1-0': ['ntmarta.dll'], 'api-ms-win-security-sddl-ansi-l1-1-0': ['advapi32.dll'], 'api-ms-win-security-sddl-l1-1-0': ['sechost.dll'], 'api-ms-win-security-sddlparsecond-l1-1-0': ['sechost.dll'], 'api-ms-win-security-systemfunctions-l1-1-0': ['advapi32.dll'], 'api-ms-win-security-trustee-l1-1-1': ['advapi32.dll'], 'api-ms-win-service-core-ansi-l1-1-1': ['advapi32.dll'], 'api-ms-win-service-core-l1-1-2': ['sechost.dll'], 'api-ms-win-service-management-l1-1-0': ['sechost.dll'], 'api-ms-win-service-management-l2-1-0': ['sechost.dll'], 'api-ms-win-service-private-l1-1-2': ['sechost.dll'], 'api-ms-win-service-winsvc-l1-1-0': ['sechost.dll'], 'api-ms-win-service-winsvc-l1-2-0': ['sechost.dll'], 'api-ms-win-shcore-comhelpers-l1-1-0': ['shcore.dll'], 'api-ms-win-shcore-obsolete-l1-1-0': ['shcore.dll'], 'api-ms-win-shcore-registry-l1-1-1': ['shcore.dll'], 'api-ms-win-shcore-scaling-l1-1-2': ['shcore.dll'], 'api-ms-win-shcore-stream-l1-1-0': ['shcore.dll'], 'api-ms-win-shcore-stream-winrt-l1-1-0': ['shcore.dll'], 'api-ms-win-shcore-sysinfo-l1-1-0': ['shcore.dll'], 'api-ms-win-shcore-thread-l1-1-0': ['shcore.dll'], 'api-ms-win-shcore-unicodeansi-l1-1-0': ['shcore.dll'], 'api-ms-win-shell-associations-l1-1-0': ['windows.storage.dll'], 'api-ms-win-shell-changenotify-l1-1-0': ['windows.storage.dll'], 'api-ms-win-shell-dataobject-l1-1-0': ['windows.storage.dll'], 'api-ms-win-shell-namespace-l1-1-0': ['windows.storage.dll'], 'api-ms-win-shell-shdirectory-l1-1-0': ['shcore.dll'], 'api-ms-win-shell-shellcom-l1-1-0': ['kernelbase.dll'], 'api-ms-win-shell-shellfolders-l1-1-0': ['windows.storage.dll'], 'api-ms-win-shlwapi-ie-l1-1-0': ['shlwapi.dll'], 'api-ms-win-shlwapi-winrt-storage-l1-1-1': ['shlwapi.dll'], 'api-ms-win-storage-exports-external-l1-1-0': ['windows.storage.dll'], 'api-ms-win-storage-exports-internal-l1-1-0': ['windows.storage.dll'], 'api-ms-win-winrt-search-folder-l1-1-0': ['windows.storage.search.dll'], 'ext-ms-mf-pal-l2-1-0': [''], 'ext-ms-net-eap-sim-l1-1-0': ['eapsimextdesktop.dll'], 'ext-ms-net-vpn-soh-l1-1-0': ['vpnsohdesktop.dll'], 'ext-ms-onecore-appchromeapi-l1-1-0': [''], 'ext-ms-onecore-appdefaults-l1-1-0': ['windows.storage.dll'], 'ext-ms-onecore-appmodel-emclient-l1-1-0': [''], 'ext-ms-onecore-appmodel-emsvcs-l1-1-0': [''], 'ext-ms-onecore-appmodel-pacmanclient-l1-1-0': [''], 'ext-ms-onecore-appmodel-plm-l1-1-1': ['execmodelclient.dll'], 'ext-ms-onecore-appmodel-staterepository-internal-l1-1-0': ['windows.staterepositoryclient.dll'], 'ext-ms-onecore-appmodel-veventdispatcher-l1-1-0': ['veeventdispatcher.dll'], 'ext-ms-onecore-comp-dwmmonitor-l1-1-0': [''], 'ext-ms-onecore-dcomp-l1-1-0': ['dcomp.dll'], 'ext-ms-onecore-defaultdiscovery-l1-1-0': [''], 'ext-ms-onecore-hcap-svf-l1-1-0': [''], 'ext-ms-onecore-hlink-l1-1-0': ['hlink.dll'], 'ext-ms-onecore-hsimulation-l1-1-0': [''], 'ext-ms-onecore-mpc-input-l1-1-0': [''], 'ext-ms-onecore-orientation-l1-1-0': [''], 'ext-ms-onecore-phoneinfo-l1-1-0': [''], 'ext-ms-onecore-shellchromeapi-l1-1-2': [''], 'ext-ms-onecore-shellremindersapi-l1-1-0': [''], 'ext-ms-onecore-spectrumsyncclient-l1-1-0': [''], 'ext-ms-win-advapi32-auth-l1-1-0': ['advapi32.dll'], 'ext-ms-win-advapi32-encryptedfile-l1-1-1': ['advapi32.dll'], 'ext-ms-win-advapi32-eventlog-ansi-l1-1-0': ['advapi32.dll'], 'ext-ms-win-advapi32-eventlog-l1-1-1': ['advapi32.dll'], 'ext-ms-win-advapi32-hwprof-l1-1-0': ['advapi32.dll'], 'ext-ms-win-advapi32-idletask-l1-1-0': ['advapi32.dll'], 'ext-ms-win-advapi32-lsa-l1-1-1': ['advapi32.dll'], 'ext-ms-win-advapi32-msi-l1-1-0': ['advapi32.dll'], 'ext-ms-win-advapi32-npusername-l1-1-0': ['advapi32.dll'], 'ext-ms-win-advapi32-ntmarta-l1-1-0': ['advapi32.dll'], 'ext-ms-win-advapi32-psm-app-l1-1-0': ['twinapi.appcore.dll'], 'ext-ms-win-advapi32-registry-l1-1-0': ['advapi32.dll'], 'ext-ms-win-advapi32-safer-l1-1-0': ['advapi32.dll'], 'ext-ms-win-advapi32-shutdown-l1-1-0': ['advapi32.dll'], 'ext-ms-win-appcompat-apphelp-l1-1-0': ['apphelp.dll'], 'ext-ms-win-appmodel-appcontainerpath-l1-1-0': [''], 'ext-ms-win-appmodel-datasharingservice-extensions-l1-1-0': [''], 'ext-ms-win-appmodel-daxcore-l1-1-0': ['daxexec.dll'], 'ext-ms-win-appmodel-deployment-l1-1-1': [''], 'ext-ms-win-appmodel-deploymentvolumes-l1-1-1': [''], 'ext-ms-win-appmodel-opc-l1-1-0': ['opcservices.dll'], 'ext-ms-win-appmodel-state-ext-l1-2-0': ['kernel.appcore.dll'], 'ext-ms-win-appmodel-usercontext-l1-1-0': [''], 'ext-ms-win-appmodel-viewscalefactor-l1-1-0': [''], 'ext-ms-win-appxdeploymentclient-appxdeploy-l1-1-0': ['appxdeploymentclient.dll'], 'ext-ms-win-appxdeploymentclient-appxdeployonecore-l1-1-0': ['appxdeploymentclient.dll'], 'ext-ms-win-audiocore-coreaudiopolicymanager-l1-1-0': ['coreaudiopolicymanagerext.dll'], 'ext-ms-win-audiocore-pal-l1-1-2': [''], 'ext-ms-win-audiocore-policymanager-l1-1-0': [''], 'ext-ms-win-authz-claimpolicies-l1-1-0': ['authz.dll'], 'ext-ms-win-authz-context-l1-1-0': ['authz.dll'], 'ext-ms-win-authz-remote-l1-1-0': ['logoncli.dll'], 'ext-ms-win-biometrics-winbio-core-l1-1-1': ['winbio.dll'], 'ext-ms-win-biometrics-winbio-l1-1-0': ['winbio.dll'], 'ext-ms-win-biometrics-winbio-l1-2-0': ['winbioext.dll'], 'ext-ms-win-biometrics-winbio-l1-3-0': ['winbioext.dll'], 'ext-ms-win-bluetooth-apis-l1-1-0': ['bluetoothapis.dll'], 'ext-ms-win-bluetooth-apis-private-l1-1-0': ['bluetoothapis.dll'], 'ext-ms-win-branding-winbrand-l1-1-1': ['winbrand.dll'], 'ext-ms-win-casting-device-l1-1-0': [''], 'ext-ms-win-casting-lockscreen-l1-1-0': ['castingshellext.dll'], 'ext-ms-win-casting-receiver-l1-1-1': [''], 'ext-ms-win-casting-shell-l1-1-0': ['castingshellext.dll'], 'ext-ms-win-ci-xbox-l1-1-0': [''], 'ext-ms-win-cloudap-tbal-l1-1-0': [''], 'ext-ms-win-clouddomainjoin-usermanagement-l1-1-0': [''], 'ext-ms-win-cluster-clusapi-l1-1-2': ['clusapi.dll'], 'ext-ms-win-cluster-resutils-l1-1-1': ['resutils.dll'], 'ext-ms-win-cmd-util-l1-1-0': ['cmdext.dll'], 'ext-ms-win-cng-rng-l1-1-1': ['bcryptprimitives.dll'], 'ext-ms-win-com-clbcatq-l1-1-0': ['clbcatq.dll'], 'ext-ms-win-com-coml2-l1-1-1': ['coml2.dll'], 'ext-ms-win-com-ole32-l1-1-4': ['ole32.dll'], 'ext-ms-win-com-psmregister-l1-1-0': ['kernel.appcore.dll'], 'ext-ms-win-com-psmregister-l1-2-1': ['kernel.appcore.dll'], 'ext-ms-win-com-suspendresiliency-l1-1-0': [''], 'ext-ms-win-composition-ghost-l1-1-0': ['dwmghost.dll'], 'ext-ms-win-composition-init-l1-1-0': ['dwminit.dll'], 'ext-ms-win-compositor-hosting-l1-1-0': ['user32.dll'], 'ext-ms-win-core-app-package-registration-l1-1-1': [''], 'ext-ms-win-core-app-package-volume-l1-1-0': [''], 'ext-ms-win-core-dhcp6client-l1-1-0': [''], 'ext-ms-win-core-licensemanager-l1-1-0': [''], 'ext-ms-win-core-psm-extendedresourcemode-l1-1-0': [''], 'ext-ms-win-core-psm-service-l1-1-3': ['psmserviceexthost.dll'], 'ext-ms-win-core-resourcemanager-l1-1-0': ['rmclient.dll'], 'ext-ms-win-core-resourcemanager-l1-2-0': ['rmclient.dll'], 'ext-ms-win-core-resourcepolicy-l1-1-1': ['resourcepolicyclient.dll'], 'ext-ms-win-core-resourcepolicyserver-l1-1-0': ['resourcepolicyserver.dll'], 'ext-ms-win-core-stateseparationext-l1-1-0': [''], 'ext-ms-win-core-storelicensing-l1-1-0': ['licensemanagerapi.dll'], 'ext-ms-win-core-winrt-remote-l1-1-0': [''], 'ext-ms-win-coreui-l1-1-0': [''], 'ext-ms-win-coreui-navshutdown-l1-1-0': ['navshutdown.dll'], 'ext-ms-win-crypto-xbox-l1-1-0': [''], 'ext-ms-win-desktopappx-l1-1-0': ['daxexec.dll'], 'ext-ms-win-devmgmt-dm-l1-1-0': ['dmapisetextimpldesktop.dll'], 'ext-ms-win-devmgmt-policy-l1-1-0': ['policymanager.dll'], 'ext-ms-win-direct2d-desktop-l1-1-0': ['direct2ddesktop.dll'], 'ext-ms-win-domainjoin-netjoin-l1-1-0': ['netjoin.dll'], 'ext-ms-win-dwmapi-ext-l1-1-0': ['dwmapi.dll'], 'ext-ms-win-dwmapidxgi-ext-l1-1-0': ['dwmapi.dll'], 'ext-ms-win-dx-d3d9-l1-1-0': ['d3d9.dll'], 'ext-ms-win-dx-ddraw-l1-1-0': ['ddraw.dll'], 'ext-ms-win-edputil-policy-l1-1-0': ['edputil.dll'], 'ext-ms-win-els-elscore-l1-1-0': ['elscore.dll'], 'ext-ms-win-eventing-rundown-l1-1-0': ['etwrundown.dll'], 'ext-ms-win-eventing-tdh-ext-l1-1-0': ['tdh.dll'], 'ext-ms-win-familysafety-childaccount-l1-1-0': ['familysafetyext.dll'], 'ext-ms-win-feclient-encryptedfile-l1-1-0': ['feclient.dll'], 'ext-ms-win-firewallapi-webproxy-l1-1-1': ['firewallapi.dll'], 'ext-ms-win-font-fontgroups-l1-1-0': ['fontgroupsoverride.dll'], 'ext-ms-win-fs-clfs-l1-1-0': ['clfs.sys'], 'ext-ms-win-fs-vssapi-l1-1-0': ['vssapi.dll'], 'ext-ms-win-fsutilext-ifsutil-l1-1-0': ['fsutilext.dll'], 'ext-ms-win-fsutilext-ulib-l1-1-0': ['fsutilext.dll'], 'ext-ms-win-fveapi-query-l1-1-0': ['fveapi.dll'], 'ext-ms-win-gaming-xblgamesave-l1-1-0': ['xblgamesaveext.dll'], 'ext-ms-win-gaming-xinput-l1-1-0': ['xinputuap.dll'], 'ext-ms-win-gdi-clipping-l1-1-0': ['gdi32full.dll'], 'ext-ms-win-gdi-dc-create-l1-1-2': ['gdi32full.dll'], 'ext-ms-win-gdi-dc-l1-2-1': ['gdi32full.dll'], 'ext-ms-win-gdi-devcaps-l1-1-0': ['gdi32full.dll'], 'ext-ms-win-gdi-draw-l1-1-3': ['gdi32full.dll'], 'ext-ms-win-gdi-font-l1-1-3': ['gdi32full.dll'], 'ext-ms-win-gdi-internal-desktop-l1-1-0': ['gdi32full.dll'], 'ext-ms-win-gdi-metafile-l1-1-2': ['gdi32full.dll'], 'ext-ms-win-gdi-path-l1-1-0': ['gdi32full.dll'], 'ext-ms-win-gdi-print-l1-1-0': ['gdi32full.dll'], 'ext-ms-win-gdi-private-l1-1-0': ['gdi32full.dll'], 'ext-ms-win-gdi-render-l1-1-0': ['gdi32.dll'], 'ext-ms-win-gdi-rgn-l1-1-0': ['gdi32full.dll'], 'ext-ms-win-gdi-wcs-l1-1-0': ['gdi32full.dll'], 'ext-ms-win-globalization-collation-l1-1-0': ['globcollationhost.dll'], 'ext-ms-win-globalization-input-l1-1-1': ['globinputhost.dll'], 'ext-ms-win-gpapi-grouppolicy-l1-1-0': ['gpapi.dll'], 'ext-ms-win-gpsvc-grouppolicy-l1-1-0': ['gpsvc.dll'], 'ext-ms-win-gui-dui70-l1-1-0': ['dui70.dll'], 'ext-ms-win-gui-ieui-l1-1-0': ['ieui.dll'], 'ext-ms-win-gui-uxinit-l1-1-0': ['uxinit.dll'], 'ext-ms-win-imm-l1-1-1': ['imm32.dll'], 'ext-ms-win-kernel32-appcompat-l1-1-0': ['kernel32.dll'], 'ext-ms-win-kernel32-datetime-l1-1-0': ['kernel32.dll'], 'ext-ms-win-kernel32-elevation-l1-1-0': ['kernel32.dll'], 'ext-ms-win-kernel32-errorhandling-l1-1-0': ['kernel32.dll', 'faultrep.dll'], 'ext-ms-win-kernel32-file-l1-1-0': ['kernel32.dll'], 'ext-ms-win-kernel32-localization-l1-1-0': ['kernel32.dll'], 'ext-ms-win-kernel32-package-current-l1-1-0': ['kernel.appcore.dll'], 'ext-ms-win-kernel32-package-l1-1-2': ['kernel.appcore.dll'], 'ext-ms-win-kernel32-quirks-l1-1-1': ['kernel32.dll'], 'ext-ms-win-kernel32-registry-l1-1-0': ['kernel32.dll'], 'ext-ms-win-kernel32-sidebyside-l1-1-0': ['kernel32.dll'], 'ext-ms-win-kernel32-transacted-l1-1-0': ['kernel32.dll'], 'ext-ms-win-kernel32-windowserrorreporting-l1-1-1': ['kernel32.dll'], 'ext-ms-win-kernelbase-processthread-l1-1-0': ['kernel32.dll'], 'ext-ms-win-media-avi-l1-1-0': ['avifil32.dll'], 'ext-ms-win-mf-pal-l1-1-0': [''], 'ext-ms-win-mf-vfw-l1-1-0': ['mfvfw.dll'], 'ext-ms-win-mininput-cursorhost-l1-1-0': [''], 'ext-ms-win-mininput-inputhost-l1-1-0': [''], 'ext-ms-win-mininput-systeminputhost-l1-1-0': ['ism32k.dll'], 'ext-ms-win-mm-msacm-l1-1-0': ['msacm32.dll'], 'ext-ms-win-mm-pehelper-l1-1-0': ['mf.dll'], 'ext-ms-win-mobilecore-boot-l1-1-0': [''], 'ext-ms-win-mobilecore-deviceinfo-l1-1-0': [''], 'ext-ms-win-mobilecore-ie-textinput-l1-1-0': [''], 'ext-ms-win-moderncore-win32k-base-ntgdi-l1-1-0': ['win32kfull.sys'], 'ext-ms-win-moderncore-win32k-base-ntuser-l1-1-0': ['win32kfull.sys'], 'ext-ms-win-moderncore-win32k-base-sysentry-l1-1-0': ['win32k.sys'], 'ext-ms-win-mpr-multipleproviderrouter-l1-1-0': ['mprext.dll'], 'ext-ms-win-mrmcorer-environment-l1-1-0': [''], 'ext-ms-win-mrmcorer-resmanager-l1-1-0': ['mrmcorer.dll'], 'ext-ms-win-msa-device-l1-1-0': [''], 'ext-ms-win-msa-ui-l1-1-0': ['msauserext.dll'], 'ext-ms-win-msa-user-l1-1-1': ['msauserext.dll'], 'ext-ms-win-msi-misc-l1-1-0': ['msi.dll'], 'ext-ms-win-msiltcfg-msi-l1-1-0': ['msiltcfg.dll'], 'ext-ms-win-msimg-draw-l1-1-0': ['msimg32.dll'], 'ext-ms-win-net-cmvpn-l1-1-0': ['cmintegrator.dll'], 'ext-ms-win-net-httpproxyext-l1-1-0': ['httpprxc.dll'], 'ext-ms-win-net-isoext-l1-1-0': ['firewallapi.dll'], 'ext-ms-win-net-vpn-l1-1-0': [''], 'ext-ms-win-netprovision-netprovfw-l1-1-0': ['netprovfw.dll'], 'ext-ms-win-networking-iphlpsvc-l1-1-0': [''], 'ext-ms-win-networking-mpssvc-l1-1-0': [''], 'ext-ms-win-networking-ncsiuserprobe-l1-1-0': [''], 'ext-ms-win-networking-nlaapi-l1-1-0': ['nlaapi.dll'], 'ext-ms-win-networking-radiomonitor-l1-1-0': ['windows.devices.radios.dll'], 'ext-ms-win-networking-wcmapi-l1-1-0': ['wcmapi.dll'], 'ext-ms-win-networking-winipsec-l1-1-0': ['winipsec.dll'], 'ext-ms-win-networking-wlanapi-l1-1-0': ['wlanapi.dll'], 'ext-ms-win-networking-wlanstorage-l1-1-0': [''], 'ext-ms-win-networking-xblconnectivity-l1-1-0': [''], 'ext-ms-win-newdev-config-l1-1-1': ['newdev.dll'], 'ext-ms-win-nfc-semgr-l1-1-0': [''], 'ext-ms-win-ntdsa-activedirectoryserver-l1-1-0': ['ntdsa.dll'], 'ext-ms-win-ntdsapi-activedirectoryclient-l1-1-1': ['ntdsapi.dll'], 'ext-ms-win-ntos-clipsp-l1-1-0': ['clipsp.sys'], 'ext-ms-win-ntos-ium-l1-1-0': [''], 'ext-ms-win-ntos-kcminitcfg-l1-1-0': ['cmimcext.sys'], 'ext-ms-win-ntos-ksecurity-l1-1-1': [''], 'ext-ms-win-ntos-ksigningpolicy-l1-1-0': [''], 'ext-ms-win-ntos-ksr-l1-1-1': [''], 'ext-ms-win-ntos-tm-l1-1-0': ['tm.sys'], 'ext-ms-win-ntos-ucode-l1-1-0': ['ntosext.sys'], 'ext-ms-win-ntos-werkernel-l1-1-0': ['werkernel.sys'], 'ext-ms-win-ntuser-caret-l1-1-0': ['user32.dll'], 'ext-ms-win-ntuser-chartranslation-l1-1-0': ['user32.dll'], 'ext-ms-win-ntuser-dc-access-ext-l1-1-0': ['user32.dll'], 'ext-ms-win-ntuser-dialogbox-l1-1-2': ['user32.dll'], 'ext-ms-win-ntuser-draw-l1-1-2': ['user32.dll'], 'ext-ms-win-ntuser-gui-l1-1-1': ['user32.dll'], 'ext-ms-win-ntuser-gui-l1-2-0': ['user32.dll'], 'ext-ms-win-ntuser-gui-l1-3-0': ['user32.dll'], 'ext-ms-win-ntuser-keyboard-l1-1-1': ['user32.dll'], 'ext-ms-win-ntuser-keyboard-l1-2-0': ['user32.dll'], 'ext-ms-win-ntuser-keyboard-l1-3-0': ['user32.dll'], 'ext-ms-win-ntuser-menu-l1-1-3': ['user32.dll'], 'ext-ms-win-ntuser-message-l1-1-3': ['user32.dll'], 'ext-ms-win-ntuser-misc-l1-1-0': ['user32.dll'], 'ext-ms-win-ntuser-misc-l1-2-0': ['user32.dll'], 'ext-ms-win-ntuser-misc-l1-3-0': ['user32.dll'], 'ext-ms-win-ntuser-misc-l1-5-1': ['user32.dll'], 'ext-ms-win-ntuser-mouse-l1-1-0': ['user32.dll'], 'ext-ms-win-ntuser-powermanagement-l1-1-0': ['user32.dll'], 'ext-ms-win-ntuser-private-l1-1-1': ['user32.dll'], 'ext-ms-win-ntuser-private-l1-2-0': ['user32.dll'], 'ext-ms-win-ntuser-private-l1-3-1': ['user32.dll'], 'ext-ms-win-ntuser-rectangle-ext-l1-1-0': ['user32.dll'], 'ext-ms-win-ntuser-rim-l1-1-0': ['user32.dll'], 'ext-ms-win-ntuser-rotationmanager-l1-1-1': ['user32.dll'], 'ext-ms-win-ntuser-server-l1-1-0': ['user32.dll'], 'ext-ms-win-ntuser-string-l1-1-0': ['user32.dll'], 'ext-ms-win-ntuser-synch-l1-1-0': ['user32.dll'], 'ext-ms-win-ntuser-sysparams-ext-l1-1-0': ['user32.dll'], 'ext-ms-win-ntuser-touch-hittest-l1-1-0': ['user32.dll'], 'ext-ms-win-ntuser-uicontext-ext-l1-1-0': ['user32.dll'], 'ext-ms-win-ntuser-window-l1-1-4': ['user32.dll'], 'ext-ms-win-ntuser-windowclass-l1-1-2': ['user32.dll'], 'ext-ms-win-ntuser-windowstation-ansi-l1-1-1': ['user32.dll'], 'ext-ms-win-ntuser-windowstation-l1-1-2': ['user32.dll'], 'ext-ms-win-ole32-bindctx-l1-1-0': ['ole32.dll'], 'ext-ms-win-ole32-ie-ext-l1-1-0': ['ole32.dll'], 'ext-ms-win-ole32-oleautomation-l1-1-0': ['ole32.dll'], 'ext-ms-win-oleacc-l1-1-1': ['oleacc.dll'], 'ext-ms-win-onecore-shutdown-l1-1-0': [''], 'ext-ms-win-pinenrollment-enrollment-l1-1-0': ['pinenrollmenthelper.dll'], 'ext-ms-win-printer-prntvpt-l1-1-0': ['prntvpt.dll'], 'ext-ms-win-printer-winspool-l1-1-3': ['winspool.drv'], 'ext-ms-win-profile-extender-l1-1-0': ['userenv.dll'], 'ext-ms-win-profile-load-l1-1-0': [''], 'ext-ms-win-profile-profsvc-l1-1-0': ['profsvcext.dll'], 'ext-ms-win-profile-userenv-l1-1-1': ['profext.dll'], 'ext-ms-win-provisioning-platform-l1-1-0': ['provplatformdesktop.dll'], 'ext-ms-win-ras-rasapi32-l1-1-1': ['rasapi32.dll'], 'ext-ms-win-ras-rasdlg-l1-1-0': ['rasdlg.dll'], 'ext-ms-win-ras-rasman-l1-1-0': ['rasman.dll'], 'ext-ms-win-ras-tapi32-l1-1-0': ['tapi32.dll'], 'ext-ms-win-raschapext-eap-l1-1-0': ['raschapext.dll'], 'ext-ms-win-rastlsext-eap-l1-1-0': ['rastlsext.dll'], 'ext-ms-win-rdr-davhlpr-l1-1-0': ['davhlpr.dll'], 'ext-ms-win-reinfo-query-l1-1-0': ['reinfo.dll'], 'ext-ms-win-resourcemanager-gamemode-l1-1-0': ['rmclient.dll'], 'ext-ms-win-ro-typeresolution-l1-1-0': ['wintypes.dll'], 'ext-ms-win-rometadata-dispenser-l1-1-0': ['rometadata.dll'], 'ext-ms-win-rpc-firewallportuse-l1-1-0': ['rpcrtremote.dll'], 'ext-ms-win-rpc-ssl-l1-1-0': ['rpcrtremote.dll'], 'ext-ms-win-rtcore-gdi-devcaps-l1-1-1': ['gdi32.dll'], 'ext-ms-win-rtcore-gdi-object-l1-1-0': ['gdi32.dll'], 'ext-ms-win-rtcore-gdi-rgn-l1-1-1': ['gdi32.dll'], 'ext-ms-win-rtcore-minuser-host-l1-1-0': [''], 'ext-ms-win-rtcore-minuser-input-l1-1-2': [''], 'ext-ms-win-rtcore-minuser-private-ext-l1-1-0': [''], 'ext-ms-win-rtcore-ntuser-console-l1-1-0': [''], 'ext-ms-win-rtcore-ntuser-controllernavigation-l1-1-0': [''], 'ext-ms-win-rtcore-ntuser-cursor-l1-1-0': ['user32.dll'], 'ext-ms-win-rtcore-ntuser-dc-access-l1-1-1': ['user32.dll'], 'ext-ms-win-rtcore-ntuser-dpi-l1-1-0': ['user32.dll'], 'ext-ms-win-rtcore-ntuser-dpi-l1-2-0': ['user32.dll'], 'ext-ms-win-rtcore-ntuser-iam-l1-1-1': ['user32.dll'], 'ext-ms-win-rtcore-ntuser-inputintercept-l1-1-0': ['user32.dll'], 'ext-ms-win-rtcore-ntuser-integration-l1-1-0': ['user32.dll'], 'ext-ms-win-rtcore-ntuser-mininit-l1-1-0': [''], 'ext-ms-win-rtcore-ntuser-rawinput-l1-1-0': ['user32.dll'], 'ext-ms-win-rtcore-ntuser-synch-ext-l1-1-0': ['user32.dll'], 'ext-ms-win-rtcore-ntuser-syscolors-l1-1-0': ['user32.dll'], 'ext-ms-win-rtcore-ntuser-sysparams-l1-1-0': ['user32.dll'], 'ext-ms-win-rtcore-ntuser-window-ext-l1-1-0': ['user32.dll'], 'ext-ms-win-rtcore-ntuser-wmpointer-l1-1-0': ['user32.dll'], 'ext-ms-win-samsrv-accountstore-l1-1-0': ['samsrv.dll'], 'ext-ms-win-scesrv-server-l1-1-0': ['scesrv.dll'], 'ext-ms-win-search-folder-l1-1-0': ['searchfolder.dll'], 'ext-ms-win-secur32-translatename-l1-1-1': ['secur32.dll'], 'ext-ms-win-security-authbrokerui-l1-1-0': ['authbrokerui.dll'], 'ext-ms-win-security-capauthz-ext-l1-1-0': [''], 'ext-ms-win-security-capauthz-l1-1-0': ['capauthz.dll'], 'ext-ms-win-security-chambers-l1-1-0': [''], 'ext-ms-win-security-credui-internal-l1-1-0': ['wincredui.dll'], 'ext-ms-win-security-credui-l1-1-1': ['credui.dll'], 'ext-ms-win-security-cryptui-l1-1-1': ['cryptui.dll'], 'ext-ms-win-security-developerunlock-l1-1-0': [''], 'ext-ms-win-security-deviceid-l1-1-0': [''], 'ext-ms-win-security-efs-l1-1-0': ['efsext.dll'], 'ext-ms-win-security-efswrt-l1-1-1': ['efswrt.dll'], 'ext-ms-win-security-kerberos-l1-1-0': ['kerberos.dll'], 'ext-ms-win-security-shutdownext-l1-1-0': ['shutdownext.dll'], 'ext-ms-win-security-srp-l1-1-1': ['srpapi.dll'], 'ext-ms-win-security-tokenbrokerui-l1-1-0': ['tokenbrokerui.dll'], 'ext-ms-win-security-vaultcli-l1-1-1': ['vaultcli.dll'], 'ext-ms-win-security-winscard-l1-1-0': ['winscard.dll'], 'ext-ms-win-sensors-core-private-l1-1-1': ['sensorsnativeapi.dll'], 'ext-ms-win-sensors-utilities-private-l1-1-1': ['sensorsutilsv2.dll'], 'ext-ms-win-session-userinit-l1-1-0': ['userinitext.dll'], 'ext-ms-win-session-usermgr-l1-1-0': ['usermgrcli.dll'], 'ext-ms-win-session-usertoken-l1-1-0': ['wtsapi32.dll'], 'ext-ms-win-session-wininit-l1-1-0': ['wininitext.dll'], 'ext-ms-win-session-winlogon-l1-1-0': ['winlogonext.dll'], 'ext-ms-win-session-winsta-l1-1-2': ['winsta.dll'], 'ext-ms-win-session-wtsapi32-l1-1-0': ['wtsapi32.dll'], 'ext-ms-win-setupapi-classinstallers-l1-1-2': ['setupapi.dll'], 'ext-ms-win-setupapi-inf-l1-1-1': ['setupapi.dll'], 'ext-ms-win-setupapi-logging-l1-1-0': ['setupapi.dll'], 'ext-ms-win-shell-browsersettingsync-l1-1-0': [''], 'ext-ms-win-shell-comctl32-init-l1-1-1': ['comctl32.dll'], 'ext-ms-win-shell-comctl32-l1-1-0': ['comctl32.dll'], 'ext-ms-win-shell-comdlg32-l1-1-0': ['comdlg32.dll'], 'ext-ms-win-shell-directory-l1-1-0': ['windows.storage.dll'], 'ext-ms-win-shell-embeddedmode-l1-1-0': ['embeddedmodesvcapi.dll'], 'ext-ms-win-shell-exports-internal-l1-1-0': ['shell32.dll'], 'ext-ms-win-shell-knownfolderext-l1-1-0': [''], 'ext-ms-win-shell-propsys-l1-1-0': ['propsys.dll'], 'ext-ms-win-shell-settingsync-l1-1-3': ['settingsyncpolicy.dll'], 'ext-ms-win-shell-shell32-l1-2-2': ['shell32.dll'], 'ext-ms-win-shell-shlwapi-l1-1-2': ['shlwapi.dll'], 'ext-ms-win-shell32-shellcom-l1-1-0': ['windows.storage.dll'], 'ext-ms-win-shell32-shellfolders-l1-1-1': ['windows.storage.dll'], 'ext-ms-win-smbshare-browser-l1-1-0': ['browser.dll'], 'ext-ms-win-smbshare-browserclient-l1-1-0': ['browcli.dll'], 'ext-ms-win-smbshare-sscore-l1-1-0': ['sscoreext.dll'], 'ext-ms-win-spinf-inf-l1-1-0': ['spinf.dll'], 'ext-ms-win-srhinproc-entrypoint-l1-1-0': ['srhinproc.dll'], 'ext-ms-win-storage-iscsidsc-l1-1-0': ['iscsidsc.dll'], 'ext-ms-win-storage-sense-l1-1-0': ['storageusage.dll'], 'ext-ms-win-sxs-oleautomation-l1-1-0': ['sxs.dll'], 'ext-ms-win-test-sys1-l1-1-0': [''], 'ext-ms-win-test-sys2-l1-1-0': [''], 'ext-ms-win-tsf-msctf-l1-1-1': ['msctf.dll'], 'ext-ms-win-ttlsext-eap-l1-1-0': ['ttlsext.dll'], 'ext-ms-win-ui-viewmanagement-l1-1-0': [''], 'ext-ms-win-uiacore-l1-1-3': ['uiautomationcore.dll'], 'ext-ms-win-umpoext-umpo-l1-1-0': ['umpoext.dll'], 'ext-ms-win-usp10-l1-1-0': ['gdi32full.dll'], 'ext-ms-win-uwf-servicing-apis-l1-1-0': ['uwfservicingapi.dll'], 'ext-ms-win-uxtheme-themes-l1-1-1': ['uxtheme.dll'], 'ext-ms-win-wer-reporting-l1-1-1': ['wer.dll'], 'ext-ms-win-wer-ui-l1-1-0': ['werui.dll'], 'ext-ms-win-wer-wct-l1-1-0': ['wer.dll'], 'ext-ms-win-wer-xbox-l1-1-0': [''], 'ext-ms-win-wevtapi-eventlog-l1-1-3': ['wevtapi.dll'], 'ext-ms-win-winbici-l1-1-0': ['winbici.dll'], 'ext-ms-win-winlogon-mincreds-l1-1-0': [''], 'ext-ms-win-winrt-networking-connectivity-l1-1-0': [''], 'ext-ms-win-winrt-storage-fileexplorer-l1-1-0': [''], 'ext-ms-win-winrt-storage-l1-1-0': ['windows.storage.dll'], 'ext-ms-win-winrt-storage-removable-l1-1-0': [''], 'ext-ms-win-wlan-grouppolicy-l1-1-0': ['wlgpclnt.dll'], 'ext-ms-win-wlan-onexui-l1-1-0': ['onexui.dll'], 'ext-ms-win-wlan-scard-l1-1-0': ['winscard.dll'], 'ext-ms-win-wpn-phoneext-l1-1-0': [''], 'ext-ms-win-wrp-sfc-l1-1-0': ['sfc.dll'], 'ext-ms-win-wsclient-devlicense-l1-1-1': ['wsclient.dll'], 'ext-ms-win-wwaext-misc-l1-1-0': ['wwaext.dll'], 'ext-ms-win-wwaext-module-l1-1-0': ['wwaext.dll'], 'ext-ms-win-wwan-wwapi-l1-1-1': ['wwapi.dll'], 'ext-ms-win-xaml-controls-l1-1-0': ['windows.ui.xaml.phone.dll'], 'ext-ms-win-xaml-pal-l1-1-0': [''], 'ext-ms-win-xblauth-console-l1-1-0': [''], 'ext-ms-win-xboxlive-xboxnetapisvc-l1-1-0': ['']}
cached_apis = {}
missing_result = {}
def getAPIs(dllpath):
apis = {}
c = createContainerFromFile(dllpath)
dll = PEObject()
if not dll.Load(c):
print("error: couldn't load dll")
return apis
ordbase = dll.ExportDirectory().Num("Base")
functions = dll.ExportDirectoryFunctions()
names = dll.ExportDirectoryNames()
nameords = dll.ExportDirectoryNameOrdinals()
n = functions.Count()
it = functions.iterator()
for x in range(n):
func = it.next()
ep = func.Num(0)
if ep == 0:
continue
apiord = str(ordbase + x)
n2 = nameords.Count()
it2 = nameords.iterator()
name_found = False
for y in range(n2):
no = it2.next()
if no.Num(0) == x:
name = names.At(y)
offs = dll.RvaToOffset(name.Num(0))
name, ret = dll.ReadUInt8String(offs, 500)
apiname = name.decode("ascii")
apis[apiname] = apiord
apis[apiord] = apiname
name_found = True
break
if not name_found:
apis[apiord] = apiord
return apis
def checkMissingAPIs(pe, ndescr, dllname, xpdll_apis):
ordfl = pe.ImportOrdinalFlag()
ofts = pe.ImportThunks(ndescr)
it = ofts.iterator()
while it.hasNext():
ft = it.next().Num(0)
if (ft & ordfl) != 0:
name = str(ft ^ ordfl)
else:
offs = pe.RvaToOffset(ft)
name, ret = pe.ReadUInt8String(offs + 2, 400)
if not ret:
continue
name = name.decode("ascii")
if not name in xpdll_apis:
print(" ", "missing:", name)
temp = missing_result.get(dllname, set())
temp.add(name)
missing_result[dllname] = temp
def verifyXPCompatibility(fname):
print("file:", fname)
c = createContainerFromFile(fname)
pe = PEObject()
if not pe.Load(c):
return
it = pe.ImportDescriptors().iterator()
ndescr = -1
while it.hasNext():
descr = it.next()
ndescr += 1
offs = pe.RvaToOffset(descr.Num("Name"))
name, ret = pe.ReadUInt8String(offs, 400)
if not ret:
continue
name = name.decode("ascii").lower()
if not name.endswith(".dll"):
continue
fwdlls = apisetschema.get(name[:-4], [])
if len(fwdlls) == 0:
print(" ", name)
else:
fwdll = fwdlls[0]
print(" ", name, "->", fwdll)
name = fwdll
if name == "ucrtbase.dll":
continue
xpdll_path = os.path.join(xp_system32, name)
if not os.path.isfile(xpdll_path):
continue
if not name in cached_apis:
cached_apis[name] = getAPIs(xpdll_path)
checkMissingAPIs(pe, ndescr, name, cached_apis[name])
print()
def main():
if os.path.isfile(sys.argv[1]):
verifyXPCompatibility(sys.argv[1])
else:
files = [os.path.join(dp, f) for dp, dn, fn in os.walk(sys.argv[1]) for f in fn]
for fname in files:
with open(fname, "rb") as f:
if f.read(2) == b"MZ":
verifyXPCompatibility(fname)
# summary
n = 0
print("\nsummary:")
for rdll, rapis in missing_result.items():
print(" ", rdll)
for rapi in rapis:
print(" ", "missing:", rapi)
n += 1
print("total of missing APIs:", str(n))
main()