/* Header autogenerated by Brandon Falk's PDB Dumper * * Invocation: C:\projects\pdbdump_2\pdbdump.exe L:\symbolarchive\win8_spB_x64\acxtrnal.pdb\FF88E278F9DC4E8385F2AA15D700AAE11\acxtrnal.pdb */ struct LIST_ENTRY64 { unsigned long long Flink; /* +0x0000 */ unsigned long long Blink; /* +0x0008 */ }; struct LIST_ENTRY32 { unsigned long Flink; /* +0x0000 */ unsigned long Blink; /* +0x0004 */ }; enum _NT_PRODUCT_TYPE { NtProductWinNt = 1, NtProductLanManNt = 2, NtProductServer = 3 }; enum _ALTERNATIVE_ARCHITECTURE_TYPE { StandardDesign = 0, NEC98x86 = 1, EndAlternatives = 2 }; struct _KUSER_SHARED_DATA { unsigned long TickCountLowDeprecated; /* +0x0000 */ unsigned long TickCountMultiplier; /* +0x0004 */ unsigned char InterruptTime[12]; /* +0x0008 20 10 00 00 */ unsigned char SystemTime[12]; /* +0x0014 20 10 00 00 */ unsigned char TimeZoneBias[12]; /* +0x0020 20 10 00 00 */ unsigned short ImageNumberLow; /* +0x002c */ unsigned short ImageNumberHigh; /* +0x002e */ unsigned char NtSystemRoot[520]; /* +0x0030 21 10 00 00 */ unsigned long MaxStackTraceDepth; /* +0x0238 */ unsigned long CryptoExponent; /* +0x023c */ unsigned long TimeZoneId; /* +0x0240 */ unsigned long LargePageMinimum; /* +0x0244 */ unsigned long AitSamplingValue; /* +0x0248 */ unsigned long AppCompatFlag; /* +0x024c */ unsigned long long RNGSeedVersion; /* +0x0250 */ unsigned long GlobalValidationRunlevel; /* +0x0258 */ unsigned char Reserved2[8]; /* +0x025c 22 10 00 00 */ unsigned char NtProductType[4]; /* +0x0264 24 10 00 00 */ unsigned char ProductTypeIsValid; /* +0x0268 */ unsigned char Reserved0[1]; /* +0x0269 25 10 00 00 */ unsigned short NativeProcessorArchitecture; /* +0x026a */ unsigned long NtMajorVersion; /* +0x026c */ unsigned long NtMinorVersion; /* +0x0270 */ unsigned char ProcessorFeatures[64]; /* +0x0274 26 10 00 00 */ unsigned long Reserved1; /* +0x02b4 */ unsigned long Reserved3; /* +0x02b8 */ unsigned char TimeSlip[4]; /* +0x02bc 27 10 00 00 */ unsigned char AlternativeArchitecture[4]; /* +0x02c0 29 10 00 00 */ unsigned char AltArchitecturePad[4]; /* +0x02c4 2a 10 00 00 */ unsigned char SystemExpirationDate[8]; /* +0x02c8 2b 10 00 00 */ unsigned long SuiteMask; /* +0x02d0 */ unsigned char KdDebuggerEnabled; /* +0x02d4 */ unsigned char MitigationPolicies; /* +0x02d5 */ /* unsigned char NXSupportPolicy[0]; +0x02d5 2c 10 00 00 */ /* unsigned char SEHValidationPolicy[0]; +0x02d5 2d 10 00 00 */ /* unsigned char CurDirDevicesSkippedForDlls[0]; +0x02d5 2e 10 00 00 */ unsigned char Reserved[1]; /* +0x02d5 2f 10 00 00 */ unsigned char Reserved6[2]; /* +0x02d6 30 10 00 00 */ unsigned char ActiveConsoleId[4]; /* +0x02d8 27 10 00 00 */ unsigned char DismountCount[4]; /* +0x02dc 27 10 00 00 */ unsigned long ComPlusPackage; /* +0x02e0 */ unsigned long LastSystemRITEventTickCount; /* +0x02e4 */ unsigned long NumberOfPhysicalPages; /* +0x02e8 */ unsigned char SafeBootMode; /* +0x02ec */ unsigned char Reserved12[3]; /* +0x02ed 31 10 00 00 */ unsigned long SharedDataFlags; /* +0x02f0 */ /* unsigned char DbgErrorPortPresent[0]; +0x02f0 32 10 00 00 */ /* unsigned char DbgElevationEnabled[0]; +0x02f0 33 10 00 00 */ /* unsigned char DbgVirtEnabled[0]; +0x02f0 34 10 00 00 */ /* unsigned char DbgInstallerDetectEnabled[0]; +0x02f0 35 10 00 00 */ /* unsigned char DbgLkgEnabled[0]; +0x02f0 36 10 00 00 */ /* unsigned char DbgDynProcessorEnabled[0]; +0x02f0 37 10 00 00 */ /* unsigned char DbgConsoleBrokerEnabled[0]; +0x02f0 38 10 00 00 */ unsigned char SpareBits[4]; /* +0x02f0 39 10 00 00 */ unsigned char DataFlagsPad[4]; /* +0x02f4 2a 10 00 00 */ unsigned long long TestRetInstruction; /* +0x02f8 */ unsigned long Reserved9; /* +0x0300 */ unsigned long Reserved10; /* +0x0304 */ unsigned char SystemCallPad[24]; /* +0x0308 3a 10 00 00 */ /* unsigned char TickCount[0]; +0x0320 20 10 00 00 */ /* unsigned char TickCountQuad[0]; +0x0320 3b 10 00 00 */ unsigned char ReservedTickCountOverlay[12]; /* +0x0320 3c 10 00 00 */ unsigned char TickCountPad[4]; /* +0x032c 2a 10 00 00 */ unsigned long Cookie; /* +0x0330 */ unsigned char CookiePad[4]; /* +0x0334 2a 10 00 00 */ long long ConsoleSessionForegroundProcessId; /* +0x0338 */ unsigned char TimeUpdateSequence[8]; /* +0x0340 3b 10 00 00 */ unsigned long long LastTimeUpdateQpcValue; /* +0x0348 */ unsigned long long LastInterruptTimeUpdateQpcValue; /* +0x0350 */ unsigned long long QpcTimeIncrement; /* +0x0358 */ unsigned long QpcTimeIncrement32; /* +0x0360 */ unsigned char Reserved8[28]; /* +0x0364 3d 10 00 00 */ unsigned char UserModeGlobalLogger[32]; /* +0x0380 3e 10 00 00 */ unsigned long ImageFileExecutionOptions; /* +0x03a0 */ unsigned long LangGenerationCount; /* +0x03a4 */ unsigned char InterruptTimeBias[8]; /* +0x03a8 3b 10 00 00 */ unsigned char TscQpcBias[8]; /* +0x03b0 3b 10 00 00 */ unsigned char ActiveProcessorCount[4]; /* +0x03b8 27 10 00 00 */ unsigned char ActiveGroupCount[1]; /* +0x03bc 3f 10 00 00 */ unsigned char QpcTimeIncrementShift; /* +0x03bd */ unsigned short TscQpcData; /* +0x03be */ unsigned char TscQpcEnabled[1]; /* +0x03be 3f 10 00 00 */ unsigned char TscQpcShift; /* +0x03bf */ unsigned char XState[528]; /* +0x03c0 40 10 00 00 */ }; /* struct { unsigned long LowPart; +0x0000 unsigned long HighPart; +0x0004 }; */ struct _ULARGE_INTEGER { unsigned long LowPart; /* +0x0000 */ unsigned long HighPart; /* +0x0004 */ /* unsigned char u[0]; +0x0000 46 10 00 00 */ unsigned long long QuadPart; /* +0x0000 */ }; /* struct { unsigned long LowPart; +0x0000 long HighPart; +0x0004 }; */ struct _LARGE_INTEGER { unsigned long LowPart; /* +0x0000 */ long HighPart; /* +0x0004 */ /* unsigned char u[0]; +0x0000 4a 10 00 00 */ long long QuadPart; /* +0x0000 */ }; /* struct { /* unsigned char LongFunction[0]; +0x0000 32 10 00 00 /* unsigned char Persistent[0]; +0x0000 33 10 00 00 unsigned char Private[4]; +0x0000 60 10 00 00 }; */ /* struct { unsigned long Flags; +0x0000 unsigned char s[4]; +0x0000 62 10 00 00 }; */ enum _TP_CALLBACK_PRIORITY { TP_CALLBACK_PRIORITY_HIGH = 0, TP_CALLBACK_PRIORITY_NORMAL = 1, TP_CALLBACK_PRIORITY_LOW = 2, TP_CALLBACK_PRIORITY_INVALID = 3, TP_CALLBACK_PRIORITY_COUNT = 3 }; struct _TP_CALLBACK_ENVIRON_V3 { unsigned long Version; /* +0x0000 */ unsigned char Pool[8]; /* +0x0008 53 10 00 00 */ unsigned char CleanupGroup[8]; /* +0x0010 55 10 00 00 */ unsigned char CleanupGroupCancelCallback[8]; /* +0x0018 58 10 00 00 */ void *RaceDll; /* +0x0020 */ unsigned char ActivationContext[8]; /* +0x0028 5a 10 00 00 */ unsigned char FinalizationCallback[8]; /* +0x0030 5f 10 00 00 */ unsigned char u[4]; /* +0x0038 64 10 00 00 */ unsigned char CallbackPriority[4]; /* +0x003c 66 10 00 00 */ unsigned long Size; /* +0x0040 */ }; struct _TP_TASK { unsigned char Callbacks[8]; /* +0x0000 74 10 00 00 */ unsigned long NumaNode; /* +0x0008 */ unsigned char IdealProcessor; /* +0x000c */ unsigned char ListEntry[16]; /* +0x0010 75 10 00 00 */ }; struct _TP_TASK_CALLBACKS { unsigned char ExecuteCallback[8]; /* +0x0000 7b 10 00 00 */ unsigned char Unposted[8]; /* +0x0008 7e 10 00 00 */ }; struct _TEB { unsigned char NtTib[56]; /* +0x0000 88 10 00 00 */ void *EnvironmentPointer; /* +0x0038 */ unsigned char ClientId[16]; /* +0x0040 89 10 00 00 */ void *ActiveRpcHandle; /* +0x0050 */ void *ThreadLocalStoragePointer; /* +0x0058 */ unsigned char ProcessEnvironmentBlock[8]; /* +0x0060 8b 10 00 00 */ unsigned long LastErrorValue; /* +0x0068 */ unsigned long CountOfOwnedCriticalSections; /* +0x006c */ void *CsrClientThread; /* +0x0070 */ void *Win32ThreadInfo; /* +0x0078 */ unsigned char User32Reserved[104]; /* +0x0080 8c 10 00 00 */ unsigned char UserReserved[24]; /* +0x00e8 8d 10 00 00 */ void *WOW32Reserved; /* +0x0100 */ unsigned long CurrentLocale; /* +0x0108 */ unsigned long FpSoftwareStatusRegister; /* +0x010c */ unsigned char SystemReserved1[432]; /* +0x0110 8e 10 00 00 */ long ExceptionCode; /* +0x02c0 */ unsigned char ActivationContextStackPointer[8]; /* +0x02c8 90 10 00 00 */ unsigned char SpareBytes[24]; /* +0x02d0 91 10 00 00 */ unsigned long TxFsContext; /* +0x02e8 */ unsigned char GdiTebBatch[1256]; /* +0x02f0 92 10 00 00 */ unsigned char RealClientId[16]; /* +0x07d8 89 10 00 00 */ void *GdiCachedProcessHandle; /* +0x07e8 */ unsigned long GdiClientPID; /* +0x07f0 */ unsigned long GdiClientTID; /* +0x07f4 */ void *GdiThreadLocalInfo; /* +0x07f8 */ unsigned char Win32ClientInfo[496]; /* +0x0800 93 10 00 00 */ unsigned char glDispatchTable[1864]; /* +0x09f0 94 10 00 00 */ unsigned char glReserved1[232]; /* +0x1138 95 10 00 00 */ void *glReserved2; /* +0x1220 */ void *glSectionInfo; /* +0x1228 */ void *glSection; /* +0x1230 */ void *glTable; /* +0x1238 */ void *glCurrentRC; /* +0x1240 */ void *glContext; /* +0x1248 */ unsigned long LastStatusValue; /* +0x1250 */ unsigned char StaticUnicodeString[16]; /* +0x1258 96 10 00 00 */ unsigned char StaticUnicodeBuffer[528]; /* +0x1268 97 10 00 00 */ void *DeallocationStack; /* +0x1478 */ unsigned char TlsSlots[512]; /* +0x1480 98 10 00 00 */ unsigned char TlsLinks[16]; /* +0x1680 75 10 00 00 */ void *Vdm; /* +0x1690 */ void *ReservedForNtRpc; /* +0x1698 */ unsigned char DbgSsReserved[16]; /* +0x16a0 99 10 00 00 */ unsigned long HardErrorMode; /* +0x16b0 */ unsigned char Instrumentation[88]; /* +0x16b8 9a 10 00 00 */ unsigned char ActivityId[16]; /* +0x1710 9b 10 00 00 */ void *SubProcessTag; /* +0x1720 */ void *EtwLocalData; /* +0x1728 */ void *EtwTraceData; /* +0x1730 */ void *WinSockData; /* +0x1738 */ unsigned long GdiBatchCount; /* +0x1740 */ /* unsigned char CurrentIdealProcessor[0]; +0x1744 9c 10 00 00 */ unsigned long IdealProcessorValue; /* +0x1744 */ unsigned char ReservedPad0; /* +0x1744 */ unsigned char ReservedPad1; /* +0x1745 */ unsigned char ReservedPad2; /* +0x1746 */ unsigned char IdealProcessor; /* +0x1747 */ unsigned long GuaranteedStackBytes; /* +0x1748 */ void *ReservedForPerf; /* +0x1750 */ void *ReservedForOle; /* +0x1758 */ unsigned long WaitingOnLoaderLock; /* +0x1760 */ void *SavedPriorityState; /* +0x1768 */ unsigned long long ReservedForCodeCoverage; /* +0x1770 */ void *ThreadPoolData; /* +0x1778 */ unsigned char TlsExpansionSlots[8]; /* +0x1780 6c 10 00 00 */ void *DeallocationBStore; /* +0x1788 */ void *BStoreLimit; /* +0x1790 */ unsigned long MuiGeneration; /* +0x1798 */ unsigned long IsImpersonating; /* +0x179c */ void *NlsCache; /* +0x17a0 */ void *pShimData; /* +0x17a8 */ unsigned short HeapVirtualAffinity; /* +0x17b0 */ unsigned short LowFragHeapDataSlot; /* +0x17b2 */ void *CurrentTransactionHandle; /* +0x17b8 */ unsigned char ActiveFrame[8]; /* +0x17c0 9e 10 00 00 */ void *FlsData; /* +0x17c8 */ void *PreferredLanguages; /* +0x17d0 */ void *UserPrefLanguages; /* +0x17d8 */ void *MergedPrefLanguages; /* +0x17e0 */ unsigned long MuiImpersonation; /* +0x17e8 */ /* unsigned char CrossTebFlags[0]; +0x17ec 9f 10 00 00 */ unsigned char SpareCrossTebBits[2]; /* +0x17ec a0 10 00 00 */ unsigned short SameTebFlags; /* +0x17ee */ /* unsigned char SafeThunkCall[0]; +0x17ee a1 10 00 00 */ /* unsigned char InDebugPrint[0]; +0x17ee a2 10 00 00 */ /* unsigned char HasFiberData[0]; +0x17ee a3 10 00 00 */ /* unsigned char SkipThreadAttach[0]; +0x17ee a4 10 00 00 */ /* unsigned char WerInShipAssertCode[0]; +0x17ee a5 10 00 00 */ /* unsigned char RanProcessInit[0]; +0x17ee a6 10 00 00 */ /* unsigned char ClonedThread[0]; +0x17ee a7 10 00 00 */ /* unsigned char SuppressDebugMsg[0]; +0x17ee a8 10 00 00 */ /* unsigned char DisableUserStackWalk[0]; +0x17ee a9 10 00 00 */ /* unsigned char RtlExceptionAttached[0]; +0x17ee aa 10 00 00 */ /* unsigned char InitialThread[0]; +0x17ee ab 10 00 00 */ /* unsigned char SessionAware[0]; +0x17ee ac 10 00 00 */ /* unsigned char DisabledStackCheck[0]; +0x17ee ad 10 00 00 */ unsigned char SpareSameTebBits[2]; /* +0x17ee ae 10 00 00 */ void *TxnScopeEnterCallback; /* +0x17f0 */ void *TxnScopeExitCallback; /* +0x17f8 */ void *TxnScopeContext; /* +0x1800 */ unsigned long LockCount; /* +0x1808 */ unsigned long SpareUlong0; /* +0x180c */ void *ResourceRetValue; /* +0x1810 */ void *ReservedForWdf; /* +0x1818 */ }; struct _LIST_ENTRY { unsigned char Flink[8]; /* +0x0000 b3 10 00 00 */ unsigned char Blink[8]; /* +0x0008 b3 10 00 00 */ }; struct _SINGLE_LIST_ENTRY { unsigned char Next[8]; /* +0x0000 c5 10 00 00 */ }; struct _RTL_SPLAY_LINKS { unsigned char Parent[8]; /* +0x0000 ca 10 00 00 */ unsigned char LeftChild[8]; /* +0x0008 ca 10 00 00 */ unsigned char RightChild[8]; /* +0x0010 ca 10 00 00 */ }; struct _RTL_DYNAMIC_HASH_TABLE_CONTEXT { unsigned char ChainHead[8]; /* +0x0000 b3 10 00 00 */ unsigned char PrevLinkage[8]; /* +0x0008 b3 10 00 00 */ unsigned long long Signature; /* +0x0010 */ }; struct _RTL_DYNAMIC_HASH_TABLE_ENUMERATOR { unsigned char HashEntry[24]; /* +0x0000 d4 10 00 00 */ unsigned char ChainHead[8]; /* +0x0018 b3 10 00 00 */ unsigned long BucketIndex; /* +0x0020 */ }; struct _RTL_DYNAMIC_HASH_TABLE { unsigned long Flags; /* +0x0000 */ unsigned long Shift; /* +0x0004 */ unsigned long TableSize; /* +0x0008 */ unsigned long Pivot; /* +0x000c */ unsigned long DivisorMask; /* +0x0010 */ unsigned long NumEntries; /* +0x0014 */ unsigned long NonEmptyBuckets; /* +0x0018 */ unsigned long NumEnumerators; /* +0x001c */ void *Directory; /* +0x0020 */ }; struct _UNICODE_STRING { unsigned short Length; /* +0x0000 */ unsigned short MaximumLength; /* +0x0002 */ unsigned short *Buffer; /* +0x0008 */ }; struct _STRING { unsigned short Length; /* +0x0000 */ unsigned short MaximumLength; /* +0x0002 */ char *Buffer; /* +0x0008 */ }; struct _RTL_BITMAP { unsigned long SizeOfBitMap; /* +0x0000 */ unsigned long *Buffer; /* +0x0008 */ }; struct _IMAGE_NT_HEADERS64 { unsigned long Signature; /* +0x0000 */ unsigned char FileHeader[20]; /* +0x0004 f1 10 00 00 */ unsigned char OptionalHeader[240]; /* +0x0018 f2 10 00 00 */ }; struct _IMAGE_DOS_HEADER { unsigned short e_magic; /* +0x0000 */ unsigned short e_cblp; /* +0x0002 */ unsigned short e_cp; /* +0x0004 */ unsigned short e_crlc; /* +0x0006 */ unsigned short e_cparhdr; /* +0x0008 */ unsigned short e_minalloc; /* +0x000a */ unsigned short e_maxalloc; /* +0x000c */ unsigned short e_ss; /* +0x000e */ unsigned short e_sp; /* +0x0010 */ unsigned short e_csum; /* +0x0012 */ unsigned short e_ip; /* +0x0014 */ unsigned short e_cs; /* +0x0016 */ unsigned short e_lfarlc; /* +0x0018 */ unsigned short e_ovno; /* +0x001a */ unsigned char e_res[8]; /* +0x001c f7 10 00 00 */ unsigned short e_oemid; /* +0x0024 */ unsigned short e_oeminfo; /* +0x0026 */ unsigned char e_res2[20]; /* +0x0028 f8 10 00 00 */ long e_lfanew; /* +0x003c */ }; struct _RTL_BALANCED_NODE { /* unsigned char Children[0]; +0x0000 ff 10 00 00 */ unsigned char Left[8]; /* +0x0000 fe 10 00 00 */ unsigned char Right[8]; /* +0x0008 fe 10 00 00 */ /* unsigned char Red[0]; +0x0010 00 11 00 00 */ /* unsigned char Balance[0]; +0x0010 2c 10 00 00 */ unsigned long long ParentValue; /* +0x0010 */ }; struct _RTL_RB_TREE { unsigned char Root[8]; /* +0x0000 fe 10 00 00 */ unsigned char Min[8]; /* +0x0008 fe 10 00 00 */ }; struct _RTL_AVL_TREE { unsigned char Root[8]; /* +0x0000 fe 10 00 00 */ }; struct _OVERLAPPED { unsigned long long Internal; /* +0x0000 */ unsigned long long InternalHigh; /* +0x0008 */ unsigned long Offset; /* +0x0010 */ unsigned long OffsetHigh; /* +0x0014 */ void *Pointer; /* +0x0010 */ void *hEvent; /* +0x0018 */ }; struct __FTH_CLIENT { unsigned char TrackingState[4]; /* +0x0000 19 10 00 00 */ unsigned char QueryingState[4]; /* +0x0004 19 10 00 00 */ unsigned char ServerEnabled[4]; /* +0x0008 19 10 00 00 */ unsigned char ConnectionAttemptsAllowed[4]; /* +0x000c 19 10 00 00 */ unsigned char ConnectionSkipsCounter[4]; /* +0x0010 19 10 00 00 */ unsigned char ConnectionsAttempted[4]; /* +0x0014 19 10 00 00 */ unsigned char Watson[8]; /* +0x0018 85 11 00 00 */ unsigned char WatsonInPassiveMode[144]; /* +0x0020 84 11 00 00 */ void *WatsonSection; /* +0x00b0 */ void *WatsonView; /* +0x00b8 */ unsigned char ClientLock[40]; /* +0x00c0 86 11 00 00 */ void *PipeHandle; /* +0x00e8 */ void *PipeEvent; /* +0x00f0 */ unsigned char PipeOverlapped[32]; /* +0x00f8 65 11 00 00 */ unsigned long MaximumAllocOverhead; /* +0x0118 */ unsigned long MaximumFreeOverhead; /* +0x011c */ unsigned long MaximumWatsonOverhead; /* +0x0120 */ }; struct _FTH_ISSUE { unsigned long Stamp; /* +0x0000 */ unsigned long Issue; /* +0x0004 */ void *Heap; /* +0x0008 */ void *Address; /* +0x0010 */ unsigned char Padder[48]; /* +0x0018 90 11 00 00 */ unsigned char Trace[256]; /* +0x0048 91 11 00 00 */ unsigned char LastTrace[256]; /* +0x0148 91 11 00 00 */ unsigned char OlderTrace[256]; /* +0x0248 91 11 00 00 */ }; struct __FTH_WATSON { unsigned char Counter[128]; /* +0x0000 94 11 00 00 */ void *MinAddress; /* +0x0080 */ void *MaxAddress; /* +0x0088 */ }; struct _TEB_ACTIVE_FRAME { unsigned long Flags; /* +0x0000 */ unsigned char Previous[8]; /* +0x0008 9e 10 00 00 */ unsigned char Context[8]; /* +0x0010 99 11 00 00 */ }; enum DISPLAYCONFIG_SCANLINE_ORDERING { DISPLAYCONFIG_SCANLINE_ORDERING_UNSPECIFIED = 0, DISPLAYCONFIG_SCANLINE_ORDERING_PROGRESSIVE = 1, DISPLAYCONFIG_SCANLINE_ORDERING_INTERLACED = 2, DISPLAYCONFIG_SCANLINE_ORDERING_INTERLACED_UPPERFIELDFIRST = 2, DISPLAYCONFIG_SCANLINE_ORDERING_INTERLACED_LOWERFIELDFIRST = 3, DISPLAYCONFIG_SCANLINE_ORDERING_FORCE_UINT32 = -1 }; struct _NT_TIB { unsigned char ExceptionList[8]; /* +0x0000 a0 11 00 00 */ void *StackBase; /* +0x0008 */ void *StackLimit; /* +0x0010 */ void *SubSystemTib; /* +0x0018 */ void *FiberData; /* +0x0020 */ unsigned long Version; /* +0x0020 */ void *ArbitraryUserPointer; /* +0x0028 */ unsigned char Self[8]; /* +0x0030 a1 11 00 00 */ }; struct _GUID { unsigned long Data1; /* +0x0000 */ unsigned short Data2; /* +0x0004 */ unsigned short Data3; /* +0x0006 */ unsigned char Data4[8]; /* +0x0008 a4 11 00 00 */ }; enum _PS_ATTRIBUTE_NUM { PsAttributeParentProcess = 0, PsAttributeDebugObject = 1, PsAttributeToken = 2, PsAttributeClientId = 3, PsAttributeTebAddress = 4, PsAttributeImageName = 5, PsAttributeImageInfo = 6, PsAttributeMemoryReserve = 7, PsAttributePriorityClass = 8, PsAttributeErrorMode = 9, PsAttributeStdHandleInfo = 10, PsAttributeHandleList = 11, PsAttributeGroupAffinity = 12, PsAttributePreferredNode = 13, PsAttributeIdealProcessor = 14, PsAttributeUmsThread = 15, PsAttributeMitigationOptions = 16, PsAttributeSecurityCapabilities = 17, PsAttributeMax = 18 }; struct _IMAGE_FILE_HEADER { unsigned short Machine; /* +0x0000 */ unsigned short NumberOfSections; /* +0x0002 */ unsigned long TimeDateStamp; /* +0x0004 */ unsigned long PointerToSymbolTable; /* +0x0008 */ unsigned long NumberOfSymbols; /* +0x000c */ unsigned short SizeOfOptionalHeader; /* +0x0010 */ unsigned short Characteristics; /* +0x0012 */ }; enum _USER_ACTIVITY_PRESENCE { PowerUserPresent = 0, PowerUserNotPresent = 1, PowerUserInactive = 2, PowerUserMaximum = 3, PowerUserInvalid = 3 }; struct _PEB { unsigned char InheritedAddressSpace; /* +0x0000 */ unsigned char ReadImageFileExecOptions; /* +0x0001 */ unsigned char BeingDebugged; /* +0x0002 */ unsigned char BitField; /* +0x0003 */ /* unsigned char ImageUsesLargePages[0]; +0x0003 00 11 00 00 */ /* unsigned char IsProtectedProcess[0]; +0x0003 ad 11 00 00 */ /* unsigned char IsLegacyProcess[0]; +0x0003 ae 11 00 00 */ /* unsigned char IsImageDynamicallyRelocated[0]; +0x0003 af 11 00 00 */ /* unsigned char SkipPatchingUser32Forwarders[0]; +0x0003 b0 11 00 00 */ unsigned char SpareBits[5]; /* +0x0003 b1 11 00 00 */ void *Mutant; /* +0x0008 */ void *ImageBaseAddress; /* +0x0010 */ unsigned char Ldr[8]; /* +0x0018 b3 11 00 00 */ unsigned char ProcessParameters[8]; /* +0x0020 b5 11 00 00 */ void *SubSystemData; /* +0x0028 */ void *ProcessHeap; /* +0x0030 */ unsigned char FastPebLock[8]; /* +0x0038 b6 11 00 00 */ void *AtlThunkSListPtr; /* +0x0040 */ void *IFEOKey; /* +0x0048 */ unsigned long CrossProcessFlags; /* +0x0050 */ /* unsigned char ProcessInJob[0]; +0x0050 32 10 00 00 */ /* unsigned char ProcessInitializing[0]; +0x0050 33 10 00 00 */ /* unsigned char ProcessUsingVEH[0]; +0x0050 34 10 00 00 */ /* unsigned char ProcessUsingVCH[0]; +0x0050 35 10 00 00 */ /* unsigned char ProcessUsingFTH[0]; +0x0050 36 10 00 00 */ unsigned char ReservedBits0[8]; /* +0x0050 b7 11 00 00 */ void *KernelCallbackTable; /* +0x0058 */ void *UserSharedInfoPtr; /* +0x0058 */ unsigned char SystemReserved[4]; /* +0x0060 2a 10 00 00 */ unsigned long AtlThunkSListPtr32; /* +0x0064 */ void *ApiSetMap; /* +0x0068 */ unsigned long TlsExpansionCounter; /* +0x0070 */ void *TlsBitmap; /* +0x0078 */ unsigned char TlsBitmapBits[8]; /* +0x0080 22 10 00 00 */ void *ReadOnlySharedMemoryBase; /* +0x0088 */ void *HotpatchInformation; /* +0x0090 */ unsigned char ReadOnlyStaticServerData[8]; /* +0x0098 6c 10 00 00 */ void *AnsiCodePageData; /* +0x00a0 */ void *OemCodePageData; /* +0x00a8 */ void *UnicodeCaseTableData; /* +0x00b0 */ unsigned long NumberOfProcessors; /* +0x00b8 */ unsigned long NtGlobalFlag; /* +0x00bc */ unsigned char CriticalSectionTimeout[8]; /* +0x00c0 2b 10 00 00 */ unsigned long long HeapSegmentReserve; /* +0x00c8 */ unsigned long long HeapSegmentCommit; /* +0x00d0 */ unsigned long long HeapDeCommitTotalFreeThreshold; /* +0x00d8 */ unsigned long long HeapDeCommitFreeBlockThreshold; /* +0x00e0 */ unsigned long NumberOfHeaps; /* +0x00e8 */ unsigned long MaximumNumberOfHeaps; /* +0x00ec */ unsigned char ProcessHeaps[8]; /* +0x00f0 6c 10 00 00 */ void *GdiSharedHandleTable; /* +0x00f8 */ void *ProcessStarterHelper; /* +0x0100 */ unsigned long GdiDCAttributeList; /* +0x0108 */ unsigned char LoaderLock[8]; /* +0x0110 b6 11 00 00 */ unsigned long OSMajorVersion; /* +0x0118 */ unsigned long OSMinorVersion; /* +0x011c */ unsigned short OSBuildNumber; /* +0x0120 */ unsigned short OSCSDVersion; /* +0x0122 */ unsigned long OSPlatformId; /* +0x0124 */ unsigned long ImageSubsystem; /* +0x0128 */ unsigned long ImageSubsystemMajorVersion; /* +0x012c */ unsigned long ImageSubsystemMinorVersion; /* +0x0130 */ unsigned long long ActiveProcessAffinityMask; /* +0x0138 */ unsigned char GdiHandleBuffer[240]; /* +0x0140 b8 11 00 00 */ unsigned char PostProcessInitRoutine[8]; /* +0x0230 ba 11 00 00 */ void *TlsExpansionBitmap; /* +0x0238 */ unsigned char TlsExpansionBitmapBits[128]; /* +0x0240 94 11 00 00 */ unsigned long SessionId; /* +0x02c0 */ unsigned char AppCompatFlags[8]; /* +0x02c8 44 10 00 00 */ unsigned char AppCompatFlagsUser[8]; /* +0x02d0 44 10 00 00 */ void *pShimData; /* +0x02d8 */ void *AppCompatInfo; /* +0x02e0 */ unsigned char CSDVersion[16]; /* +0x02e8 96 10 00 00 */ unsigned char ActivationContextData[8]; /* +0x02f8 bd 11 00 00 */ unsigned char ProcessAssemblyStorageMap[8]; /* +0x0300 bf 11 00 00 */ unsigned char SystemDefaultActivationContextData[8]; /* +0x0308 bd 11 00 00 */ unsigned char SystemAssemblyStorageMap[8]; /* +0x0310 bf 11 00 00 */ unsigned long long MinimumStackCommit; /* +0x0318 */ unsigned char FlsCallback[8]; /* +0x0320 c1 11 00 00 */ unsigned char FlsListHead[16]; /* +0x0328 75 10 00 00 */ void *FlsBitmap; /* +0x0338 */ unsigned char FlsBitmapBits[16]; /* +0x0340 c2 11 00 00 */ unsigned long FlsHighIndex; /* +0x0350 */ void *WerRegistrationData; /* +0x0358 */ void *WerShipAssertPtr; /* +0x0360 */ void *pUnused; /* +0x0368 */ void *pImageHeaderHash; /* +0x0370 */ unsigned long TracingFlags; /* +0x0378 */ /* unsigned char HeapTracingEnabled[0]; +0x0378 32 10 00 00 */ /* unsigned char CritSecTracingEnabled[0]; +0x0378 33 10 00 00 */ /* unsigned char LibLoaderTracingEnabled[0]; +0x0378 34 10 00 00 */ unsigned char SpareTracingBits[8]; /* +0x0378 c3 11 00 00 */ unsigned long long CsrServerReadOnlySharedMemoryBase; /* +0x0380 */ }; enum _JOBOBJECTINFOCLASS { JobObjectBasicAccountingInformation = 1, JobObjectBasicLimitInformation = 2, JobObjectBasicProcessIdList = 3, JobObjectBasicUIRestrictions = 4, JobObjectSecurityLimitInformation = 5, JobObjectEndOfJobTimeInformation = 6, JobObjectAssociateCompletionPortInformation = 7, JobObjectBasicAndIoAccountingInformation = 8, JobObjectExtendedLimitInformation = 9, JobObjectJobSetInformation = 10, JobObjectGroupInformation = 11, JobObjectNotificationLimitInformation = 12, JobObjectLimitViolationInformation = 13, JobObjectGroupInformationEx = 14, JobObjectCpuRateControlInformation = 15, JobObjectCompletionFilter = 16, JobObjectCompletionCounter = 17, JobObjectFreezeInformation = 18, JobObjectExtendedAccountingInformation = 19, JobObjectWakeInformation = 20, JobObjectIdleAwareInformation = 21, JobObjectSchedulingRankBiasInformation = 22, JobObjectTimerVirtualizationInformation = 23, JobObjectCycleTimeNotification = 24, JobObjectReserved1Information = 18, JobObjectReserved2Information = 19, JobObjectReserved3Information = 20, JobObjectReserved4Information = 21, JobObjectReserved5Information = 22, JobObjectReserved6Information = 23, JobObjectReserved7Information = 24, MaxJobObjectInfoClass = 25 }; struct _TEB_ACTIVE_FRAME_CONTEXT { unsigned long Flags; /* +0x0000 */ unsigned char FrameName[8]; /* +0x0008 10 10 00 00 */ }; struct _XSTATE_CONFIGURATION { unsigned long long EnabledFeatures; /* +0x0000 */ unsigned long Size; /* +0x0008 */ unsigned char OptimizedSave[4]; /* +0x000c 32 10 00 00 */ unsigned char Features[512]; /* +0x0010 cb 11 00 00 */ }; struct _RTL_CRITICAL_SECTION { unsigned char DebugInfo[8]; /* +0x0000 cf 11 00 00 */ long LockCount; /* +0x0008 */ long RecursionCount; /* +0x000c */ void *OwningThread; /* +0x0010 */ void *LockSemaphore; /* +0x0018 */ unsigned long long SpinCount; /* +0x0020 */ }; struct _GDI_TEB_BATCH { unsigned long Offset; /* +0x0000 */ unsigned long long HDC; /* +0x0008 */ unsigned char Buffer[1240]; /* +0x0010 d2 11 00 00 */ }; struct _KSYSTEM_TIME { unsigned long LowPart; /* +0x0000 */ long High1Time; /* +0x0004 */ long High2Time; /* +0x0008 */ }; struct _XSTATE_FEATURE { unsigned long Offset; /* +0x0000 */ unsigned long Size; /* +0x0004 */ }; enum PS_CREATE_STATE { PsCreateInitialState = 0, PsCreateFailOnFileOpen = 1, PsCreateFailOnSectionCreate = 2, PsCreateFailExeFormat = 3, PsCreateFailMachineMismatch = 4, PsCreateFailExeName = 5, PsCreateSuccess = 6, PsCreateMaximumStates = 7 }; struct _FTH_BLOCK_PADDER { unsigned long long Padding; /* +0x0000 */ unsigned long Checksum; /* +0x0000 */ unsigned long StartStamp; /* +0x0008 */ /* unsigned char RequestedSize[0]; +0x000c db 11 00 00 */ unsigned char ActualSize[4]; /* +0x000c dc 11 00 00 */ void *Heap; /* +0x0010 */ unsigned char FreeQueue[16]; /* +0x0018 75 10 00 00 */ unsigned long Filler; /* +0x0028 */ unsigned long EndStamp; /* +0x002c */ }; struct _RTL_CRITICAL_SECTION_DEBUG { unsigned short Type; /* +0x0000 */ unsigned short CreatorBackTraceIndex; /* +0x0002 */ unsigned char CriticalSection[8]; /* +0x0008 b6 11 00 00 */ unsigned char ProcessLocksList[16]; /* +0x0010 75 10 00 00 */ unsigned long EntryCount; /* +0x0020 */ unsigned long ContentionCount; /* +0x0024 */ unsigned long Flags; /* +0x0028 */ unsigned short CreatorBackTraceIndexHigh; /* +0x002c */ unsigned short SpareUSHORT; /* +0x002e */ }; enum _EXCEPTION_DISPOSITION { ExceptionContinueExecution = 0, ExceptionContinueSearch = 1, ExceptionNestedException = 2, ExceptionCollidedUnwind = 3 }; struct _EXCEPTION_REGISTRATION_RECORD { unsigned char Next[8]; /* +0x0000 a0 11 00 00 */ unsigned char Handler[8]; /* +0x0008 e9 11 00 00 */ }; struct _CONTEXT { unsigned long long P1Home; /* +0x0000 */ unsigned long long P2Home; /* +0x0008 */ unsigned long long P3Home; /* +0x0010 */ unsigned long long P4Home; /* +0x0018 */ unsigned long long P5Home; /* +0x0020 */ unsigned long long P6Home; /* +0x0028 */ unsigned long ContextFlags; /* +0x0030 */ unsigned long MxCsr; /* +0x0034 */ unsigned short SegCs; /* +0x0038 */ unsigned short SegDs; /* +0x003a */ unsigned short SegEs; /* +0x003c */ unsigned short SegFs; /* +0x003e */ unsigned short SegGs; /* +0x0040 */ unsigned short SegSs; /* +0x0042 */ unsigned long EFlags; /* +0x0044 */ unsigned long long Dr0; /* +0x0048 */ unsigned long long Dr1; /* +0x0050 */ unsigned long long Dr2; /* +0x0058 */ unsigned long long Dr3; /* +0x0060 */ unsigned long long Dr6; /* +0x0068 */ unsigned long long Dr7; /* +0x0070 */ unsigned long long Rax; /* +0x0078 */ unsigned long long Rcx; /* +0x0080 */ unsigned long long Rdx; /* +0x0088 */ unsigned long long Rbx; /* +0x0090 */ unsigned long long Rsp; /* +0x0098 */ unsigned long long Rbp; /* +0x00a0 */ unsigned long long Rsi; /* +0x00a8 */ unsigned long long Rdi; /* +0x00b0 */ unsigned long long R8; /* +0x00b8 */ unsigned long long R9; /* +0x00c0 */ unsigned long long R10; /* +0x00c8 */ unsigned long long R11; /* +0x00d0 */ unsigned long long R12; /* +0x00d8 */ unsigned long long R13; /* +0x00e0 */ unsigned long long R14; /* +0x00e8 */ unsigned long long R15; /* +0x00f0 */ unsigned long long Rip; /* +0x00f8 */ /* unsigned char FltSave[0]; +0x0100 ec 11 00 00 */ unsigned char Header[32]; /* +0x0100 ee 11 00 00 */ unsigned char Legacy[128]; /* +0x0120 ef 11 00 00 */ unsigned char Xmm0[16]; /* +0x01a0 ed 11 00 00 */ unsigned char Xmm1[16]; /* +0x01b0 ed 11 00 00 */ unsigned char Xmm2[16]; /* +0x01c0 ed 11 00 00 */ unsigned char Xmm3[16]; /* +0x01d0 ed 11 00 00 */ unsigned char Xmm4[16]; /* +0x01e0 ed 11 00 00 */ unsigned char Xmm5[16]; /* +0x01f0 ed 11 00 00 */ unsigned char Xmm6[16]; /* +0x0200 ed 11 00 00 */ unsigned char Xmm7[16]; /* +0x0210 ed 11 00 00 */ unsigned char Xmm8[16]; /* +0x0220 ed 11 00 00 */ unsigned char Xmm9[16]; /* +0x0230 ed 11 00 00 */ unsigned char Xmm10[16]; /* +0x0240 ed 11 00 00 */ unsigned char Xmm11[16]; /* +0x0250 ed 11 00 00 */ unsigned char Xmm12[16]; /* +0x0260 ed 11 00 00 */ unsigned char Xmm13[16]; /* +0x0270 ed 11 00 00 */ unsigned char Xmm14[16]; /* +0x0280 ed 11 00 00 */ unsigned char Xmm15[112]; /* +0x0290 ed 11 00 00 */ unsigned char VectorRegister[416]; /* +0x0300 f0 11 00 00 */ unsigned long long VectorControl; /* +0x04a0 */ unsigned long long DebugControl; /* +0x04a8 */ unsigned long long LastBranchToRip; /* +0x04b0 */ unsigned long long LastBranchFromRip; /* +0x04b8 */ unsigned long long LastExceptionToRip; /* +0x04c0 */ unsigned long long LastExceptionFromRip; /* +0x04c8 */ }; struct _PROCESSOR_NUMBER { unsigned short Group; /* +0x0000 */ unsigned char Number; /* +0x0002 */ unsigned char Reserved; /* +0x0003 */ }; struct _RTL_DYNAMIC_HASH_TABLE_ENTRY { unsigned char Linkage[16]; /* +0x0000 75 10 00 00 */ unsigned long long Signature; /* +0x0010 */ }; struct _M128A { unsigned long long Low; /* +0x0000 */ long long High; /* +0x0008 */ }; struct _IMAGE_OPTIONAL_HEADER64 { unsigned short Magic; /* +0x0000 */ unsigned char MajorLinkerVersion; /* +0x0002 */ unsigned char MinorLinkerVersion; /* +0x0003 */ unsigned long SizeOfCode; /* +0x0004 */ unsigned long SizeOfInitializedData; /* +0x0008 */ unsigned long SizeOfUninitializedData; /* +0x000c */ unsigned long AddressOfEntryPoint; /* +0x0010 */ unsigned long BaseOfCode; /* +0x0014 */ unsigned long long ImageBase; /* +0x0018 */ unsigned long SectionAlignment; /* +0x0020 */ unsigned long FileAlignment; /* +0x0024 */ unsigned short MajorOperatingSystemVersion; /* +0x0028 */ unsigned short MinorOperatingSystemVersion; /* +0x002a */ unsigned short MajorImageVersion; /* +0x002c */ unsigned short MinorImageVersion; /* +0x002e */ unsigned short MajorSubsystemVersion; /* +0x0030 */ unsigned short MinorSubsystemVersion; /* +0x0032 */ unsigned long Win32VersionValue; /* +0x0034 */ unsigned long SizeOfImage; /* +0x0038 */ unsigned long SizeOfHeaders; /* +0x003c */ unsigned long CheckSum; /* +0x0040 */ unsigned short Subsystem; /* +0x0044 */ unsigned short DllCharacteristics; /* +0x0046 */ unsigned long long SizeOfStackReserve; /* +0x0048 */ unsigned long long SizeOfStackCommit; /* +0x0050 */ unsigned long long SizeOfHeapReserve; /* +0x0058 */ unsigned long long SizeOfHeapCommit; /* +0x0060 */ unsigned long LoaderFlags; /* +0x0068 */ unsigned long NumberOfRvaAndSizes; /* +0x006c */ unsigned char DataDirectory[128]; /* +0x0070 fa 11 00 00 */ }; enum _PS_STD_HANDLE_STATE { PsNeverDuplicate = 0, PsRequestDuplicate = 1, PsAlwaysDuplicate = 2, PsMaxStdHandleStates = 3 }; struct _RTL_USER_PROCESS_PARAMETERS { unsigned long MaximumLength; /* +0x0000 */ unsigned long Length; /* +0x0004 */ unsigned long Flags; /* +0x0008 */ unsigned long DebugFlags; /* +0x000c */ void *ConsoleHandle; /* +0x0010 */ unsigned long ConsoleFlags; /* +0x0018 */ void *StandardInput; /* +0x0020 */ void *StandardOutput; /* +0x0028 */ void *StandardError; /* +0x0030 */ unsigned char CurrentDirectory[24]; /* +0x0038 ff 11 00 00 */ unsigned char DllPath[16]; /* +0x0050 96 10 00 00 */ unsigned char ImagePathName[16]; /* +0x0060 96 10 00 00 */ unsigned char CommandLine[16]; /* +0x0070 96 10 00 00 */ void *Environment; /* +0x0080 */ unsigned long StartingX; /* +0x0088 */ unsigned long StartingY; /* +0x008c */ unsigned long CountX; /* +0x0090 */ unsigned long CountY; /* +0x0094 */ unsigned long CountCharsX; /* +0x0098 */ unsigned long CountCharsY; /* +0x009c */ unsigned long FillAttribute; /* +0x00a0 */ unsigned long WindowFlags; /* +0x00a4 */ unsigned long ShowWindowFlags; /* +0x00a8 */ unsigned char WindowTitle[16]; /* +0x00b0 96 10 00 00 */ unsigned char DesktopInfo[16]; /* +0x00c0 96 10 00 00 */ unsigned char ShellInfo[16]; /* +0x00d0 96 10 00 00 */ unsigned char RuntimeData[16]; /* +0x00e0 96 10 00 00 */ unsigned char CurrentDirectores[768]; /* +0x00f0 01 12 00 00 */ unsigned char EnvironmentSize[8]; /* +0x03f0 3b 10 00 00 */ unsigned char EnvironmentVersion[8]; /* +0x03f8 3b 10 00 00 */ unsigned char PackageMoniker[16]; /* +0x0400 96 10 00 00 */ void *PackageDependencyData; /* +0x0410 */ unsigned long ProcessGroupId; /* +0x0418 */ }; struct _CLIENT_ID { void *UniqueProcess; /* +0x0000 */ void *UniqueThread; /* +0x0008 */ }; struct _PEB_LDR_DATA { unsigned long Length; /* +0x0000 */ unsigned char Initialized; /* +0x0004 */ void *SsHandle; /* +0x0008 */ unsigned char InLoadOrderModuleList[16]; /* +0x0010 75 10 00 00 */ unsigned char InMemoryOrderModuleList[16]; /* +0x0020 75 10 00 00 */ unsigned char InInitializationOrderModuleList[16]; /* +0x0030 75 10 00 00 */ void *EntryInProgress; /* +0x0040 */ unsigned char ShutdownInProgress; /* +0x0048 */ void *ShutdownThreadId; /* +0x0050 */ }; enum ReplacesCorHdrNumericDefines { COMIMAGE_FLAGS_ILONLY = 1, COMIMAGE_FLAGS_32BITREQUIRED = 2, COMIMAGE_FLAGS_IL_LIBRARY = 4, COMIMAGE_FLAGS_STRONGNAMESIGNED = 8, COMIMAGE_FLAGS_NATIVE_ENTRYPOINT = 16, /* COMIMAGE_FLAGS_TRACKDEBUGDATA = Unavail */ }; struct _ACTIVATION_CONTEXT_STACK { unsigned char ActiveFrame[8]; /* +0x0000 0b 12 00 00 */ unsigned char FrameListCache[16]; /* +0x0008 75 10 00 00 */ unsigned long Flags; /* +0x0018 */ unsigned long NextCookieSequenceNumber; /* +0x001c */ unsigned long StackId; /* +0x0020 */ }; struct _RTL_DRIVE_LETTER_CURDIR { unsigned short Flags; /* +0x0000 */ unsigned short Length; /* +0x0002 */ unsigned long TimeStamp; /* +0x0004 */ unsigned char DosPath[16]; /* +0x0008 df 10 00 00 */ }; enum _PS_WAKE_REASON { PsWakeReasonUser = 0, PsWakeReasonDevice = 1, PsWakeReasonKernel = 2, PsWakeReasonPower = 3, PsMaxWakeReasons = 4 }; enum _SE_SIGNING_LEVEL { SE_SIGNING_LEVEL_UNCHECKED = 0, SE_SIGNING_LEVEL_PROTECTED_PROCESS = 1, SE_SIGNING_LEVEL_UNSIGNED = 2, SE_SIGNING_LEVEL_AUTHENTICODE = 4, SE_SIGNING_LEVEL_DRM_PROTECTED = 5, SE_SIGNING_LEVEL_WINDOWS = 6, SE_SIGNING_LEVEL_WINDOWS_PROTECTED = 7 }; struct _XSAVE_FORMAT { unsigned short ControlWord; /* +0x0000 */ unsigned short StatusWord; /* +0x0002 */ unsigned char TagWord; /* +0x0004 */ unsigned char Reserved1; /* +0x0005 */ unsigned short ErrorOpcode; /* +0x0006 */ unsigned long ErrorOffset; /* +0x0008 */ unsigned short ErrorSelector; /* +0x000c */ unsigned short Reserved2; /* +0x000e */ unsigned long DataOffset; /* +0x0010 */ unsigned short DataSelector; /* +0x0014 */ unsigned short Reserved3; /* +0x0016 */ unsigned long MxCsr; /* +0x0018 */ unsigned long MxCsr_Mask; /* +0x001c */ unsigned char FloatRegisters[128]; /* +0x0020 ef 11 00 00 */ unsigned char XmmRegisters[256]; /* +0x00a0 14 12 00 00 */ unsigned char Reserved4[96]; /* +0x01a0 15 12 00 00 */ }; struct _EXCEPTION_RECORD { long ExceptionCode; /* +0x0000 */ unsigned long ExceptionFlags; /* +0x0004 */ unsigned char ExceptionRecord[8]; /* +0x0008 e4 11 00 00 */ void *ExceptionAddress; /* +0x0010 */ unsigned long NumberParameters; /* +0x0018 */ unsigned char ExceptionInformation[120]; /* +0x0020 18 12 00 00 */ }; struct _IMAGE_DATA_DIRECTORY { unsigned long VirtualAddress; /* +0x0000 */ unsigned long Size; /* +0x0004 */ }; struct _CURDIR { unsigned char DosPath[16]; /* +0x0000 96 10 00 00 */ void *Handle; /* +0x0010 */ }; struct _RTL_ACTIVATION_CONTEXT_STACK_FRAME { unsigned char Previous[8]; /* +0x0000 0b 12 00 00 */ unsigned char ActivationContext[8]; /* +0x0008 5a 10 00 00 */ unsigned long Flags; /* +0x0010 */ };