{"functions":[{"name":"IsDebuggerPresent","module":"kernel32.dll","ret_type":21,"params":[]},{"name":"DebugActiveProcessStop","module":"kernel32.dll","ret_type":21,"params":[{"name":"dwProcessId","direct":1,"type":19,"used":1}]},{"name":"CryptExportKey","module":"advapi32.dll","ret_type":21,"params":[{"name":"hKey","direct":1,"type":50,"used":1},{"name":"hExpKey","direct":1,"type":50,"used":1},{"name":"dwBlobType","direct":1,"type":19,"used":1},{"name":"dwFlags","direct":1,"type":19,"used":1},{"name":"pbData","direct":6,"type":3221225474,"used":1},{"name":"pdwDataLen","direct":3,"type":2147483668,"used":1}]},{"name":"CryptImportKey","module":"advapi32.dll","ret_type":21,"params":[{"name":"hProv","direct":1,"type":49,"used":1},{"name":"pbData","direct":1,"type":3221225474,"used":1},{"name":"dwDataLen","direct":1,"type":19,"used":1},{"name":"hPubKey","direct":1,"type":50,"used":1},{"name":"dwFlags","direct":1,"type":19,"used":1},{"name":"phKey","direct":2,"type":2147483699,"used":1}]},{"name":"CreateToolhelp32Snapshot","module":"kernel32.dll","ret_type":23,"params":[{"name":"dwFlags","direct":1,"type":19,"used":1},{"name":"th32ProcessID","direct":1,"type":19,"used":1}]},{"name":"EnumProcesses","module":"psapi.dll","ret_type":21,"params":[{"name":"lpidProcess","direct":2,"type":2684354613,"used":1},{"name":"cb","direct":1,"type":19,"used":1},{"name":"lpcbNeeded","direct":2,"type":2147483668,"used":1}]},{"name":"EnumProcessModules","module":"psapi.dll","ret_type":21,"params":[{"name":"hProcess","direct":1,"type":48,"used":1},{"name":"phModule","direct":2,"type":2684354612,"used":1},{"name":"cb","direct":1,"type":19,"used":1},{"name":"lpcbNeeded","direct":2,"type":2147483668,"used":1}]},{"name":"EnumProcessModulesEx","module":"psapi.dll","ret_type":21,"params":[{"name":"hProcess","direct":1,"type":48,"used":1},{"name":"lphModule","direct":2,"type":2684354612,"used":1},{"name":"cb","direct":1,"type":19,"used":1},{"name":"lpcbNeeded","direct":2,"type":2147483668,"used":1},{"name":"dwFilterFlag","direct":1,"type":19,"used":1}]},{"name":"GetAsyncKeyState","module":"user32.dll","ret_type":58,"params":[{"name":"vKey","direct":1,"type":38,"used":1}]},{"name":"GetKeyState","module":"user32.dll","ret_type":58,"params":[{"name":"nVirtKey","direct":1,"type":38,"used":1}]},{"name":"SetWindowsHookExW","module":"user32.dll","ret_type":23,"params":[{"name":"idHook","direct":1,"type":38,"used":1},{"name":"lpfn","direct":1,"type":4,"used":1},{"name":"hmod","direct":5,"type":23,"used":1},{"name":"dwThreadId","direct":1,"type":19,"used":1}]},{"name":"SetWindowsHookExA","module":"user32.dll","ret_type":23,"params":[{"name":"idHook","direct":1,"type":38,"used":1},{"name":"lpfn","direct":1,"type":4,"used":1},{"name":"hmod","direct":5,"type":23,"used":1},{"name":"dwThreadId","direct":1,"type":19,"used":1}]},{"name":"RtlCreateUserThread","module":"ntdll.dll","ret_type":16,"params":[{"name":"Process","direct":1,"type":48,"used":1},{"name":"ThreadSecurityDescriptor","direct":5,"type":0,"used":1},{"name":"CreateSuspended","direct":1,"type":21,"used":1},{"name":"ZeroBits","direct":5,"type":19,"used":1},{"name":"MaximumStackSize","direct":5,"type":43,"used":1},{"name":"CommittedStackSize","direct":5,"type":43,"used":1},{"name":"StartAddress","direct":1,"type":4,"used":1},{"name":"Parameter","direct":5,"type":4,"used":1},{"name":"Thread","direct":6,"type":2147483672,"used":1},{"name":"ClientId","direct":6,"type":2147483678,"used":1}]},{"name":"CreateProcessW","module":"kernel32.dll","ret_type":21,"params":[{"name":"lpApplicationName","direct":5,"type":3221225528,"used":1},{"name":"lpCommandLine","direct":7,"type":3221225528,"used":1},{"name":"lpProcessAttributes","direct":5,"type":0,"used":1},{"name":"lpThreadAttributes","direct":5,"type":0,"used":1},{"name":"bInheritHandles","direct":1,"type":21,"used":1},{"name":"dwCreationFlags","direct":1,"type":19,"used":1},{"name":"lpEnvironment","direct":5,"type":4,"used":1},{"name":"lpCurrentDirectory","direct":5,"type":3221225528,"used":1},{"name":"lpStartupInfo","direct":1,"type":0,"used":1},{"name":"lpProcessInformation","direct":2,"type":2147483705,"used":1}]},{"name":"CreateRemoteThread","module":"kernel32.dll","ret_type":23,"params":[{"name":"hProcess","direct":1,"type":48,"used":1},{"name":"lpThreadAttributes","direct":5,"type":0,"used":1},{"name":"dwStackSize","direct":1,"type":43,"used":1},{"name":"lpStartAddress","direct":1,"type":4,"used":1},{"name":"lpParameter","direct":5,"type":4,"used":1},{"name":"dwCreationFlags","direct":1,"type":19,"used":1},{"name":"lpThreadId","direct":6,"type":2147483668,"used":1}]},{"name":"CreateRemoteThreadEx","module":"kernel32.dll","ret_type":23,"params":[{"name":"hProcess","direct":1,"type":48,"used":1},{"name":"lpThreadAttributes","direct":5,"type":0,"used":1},{"name":"dwStackSize","direct":1,"type":43,"used":1},{"name":"lpStartAddress","direct":1,"type":4,"used":1},{"name":"lpParameter","direct":5,"type":4,"used":1},{"name":"dwCreationFlags","direct":1,"type":19,"used":1},{"name":"lpAttributeList","direct":5,"type":4,"used":1},{"name":"lpThreadId","direct":6,"type":2147483668,"used":1}]},{"name":"Wow64SuspendThread","module":"kernel32.dll","ret_type":19,"params":[{"name":"hThread","direct":1,"type":23,"used":1}]},{"name":"SuspendThread","module":"kernel32.dll","ret_type":19,"params":[{"name":"hThread","direct":1,"type":23,"used":1}]},{"name":"SetThreadContext","module":"kernel32.dll","ret_type":21,"params":[{"name":"hThread","direct":1,"type":23,"used":1},{"name":"lpContext","direct":1,"type":2147483689,"used":1}]},{"name":"Wow64SetThreadContext","module":"kernel32.dll","ret_type":21,"params":[{"name":"hThread","direct":1,"type":23,"used":1},{"name":"lpContext","direct":1,"type":2147483708,"used":1}]},{"name":"gethostbyname","module":"ws2_32.dll","ret_type":2147483695,"params":[{"name":"name","direct":1,"type":3221225518,"used":1}]},{"name":"WriteProcessMemory","module":"kernel32.dll","ret_type":21,"params":[{"name":"hProcess","direct":1,"type":48,"used":1},{"name":"lpBaseAddress","direct":1,"type":4,"used":1},{"name":"lpBuffer","direct":1,"type":3221225474,"used":1},{"name":"nSize","direct":1,"type":43,"used":1},{"name":"lpNumberOfBytesWritten","direct":6,"type":2147483673,"used":1}]},{"name":"Sleep","module":"kernel32.dll","ret_type":63,"params":[{"name":"dwMilliseconds","direct":1,"type":19,"used":1}]},{"name":"SleepEx","module":"kernel32.dll","ret_type":19,"params":[{"name":"dwMilliseconds","direct":1,"type":19,"used":1},{"name":"bAlertable","direct":1,"type":21,"used":1}]},{"name":"InitiateSystemShutdownA","module":"advapi32.dll","ret_type":21,"params":[{"name":"lpMachineName","direct":5,"type":3221225518,"used":1},{"name":"lpMessage","direct":5,"type":3221225518,"used":1},{"name":"dwTimeout","direct":1,"type":19,"used":1},{"name":"bForceAppsClosed","direct":1,"type":21,"used":1},{"name":"bRebootAfterShutdown","direct":1,"type":21,"used":1}]},{"name":"InitiateSystemShutdownW","module":"advapi32.dll","ret_type":21,"params":[{"name":"lpMachineName","direct":5,"type":3221225528,"used":1},{"name":"lpMessage","direct":5,"type":3221225528,"used":1},{"name":"dwTimeout","direct":1,"type":19,"used":1},{"name":"bForceAppsClosed","direct":1,"type":21,"used":1},{"name":"bRebootAfterShutdown","direct":1,"type":21,"used":1}]},{"name":"InitiateSystemShutdownExA","module":"advapi32.dll","ret_type":21,"params":[{"name":"lpMachineName","direct":5,"type":3221225518,"used":1},{"name":"lpMessage","direct":5,"type":3221225518,"used":1},{"name":"dwTimeout","direct":1,"type":19,"used":1},{"name":"bForceAppsClosed","direct":1,"type":21,"used":1},{"name":"bRebootAfterShutdown","direct":1,"type":21,"used":1},{"name":"dwReason","direct":1,"type":19,"used":1}]},{"name":"InitiateSystemShutdownExW","module":"advapi32.dll","ret_type":21,"params":[{"name":"lpMachineName","direct":5,"type":3221225528,"used":1},{"name":"lpMessage","direct":5,"type":3221225528,"used":1},{"name":"dwTimeout","direct":1,"type":19,"used":1},{"name":"bForceAppsClosed","direct":1,"type":21,"used":1},{"name":"bRebootAfterShutdown","direct":1,"type":21,"used":1},{"name":"dwReason","direct":1,"type":19,"used":1}]},{"name":"InitiateShutdownA","module":"advapi32.dll","ret_type":19,"params":[{"name":"lpMachineName","direct":5,"type":3221225518,"used":1},{"name":"lpMessage","direct":5,"type":3221225518,"used":1},{"name":"dwGracePeriod","direct":1,"type":19,"used":1},{"name":"dwShutdownFlags","direct":1,"type":19,"used":1},{"name":"dwReason","direct":1,"type":19,"used":1}]},{"name":"InitiateShutdownW","module":"advapi32.dll","ret_type":19,"params":[{"name":"lpMachineName","direct":5,"type":3221225528,"used":1},{"name":"lpMessage","direct":5,"type":3221225528,"used":1},{"name":"dwGracePeriod","direct":1,"type":19,"used":1},{"name":"dwShutdownFlags","direct":1,"type":19,"used":1},{"name":"dwReason","direct":1,"type":19,"used":1}]}],"process_include":["*\\TestAppForInject_x64.exe","*\\TestAppForInject_x86.exe"],"process_exclude":[""]}