! / 1516160836 0 0 0 1140 ` " 22 * *#B#B&8&8).).,,//2*2*54548B8B__C__Users_Peter_Code_winapi_rs_x86_64_lib_libwinapi_onecore_downlevel_wtsapi32_a_iname_head_C__Users_Peter_Code_winapi_rs_x86_64_lib_libwinapi_onecore_downlevel_wtsapi32_aWTSVirtualChannelQuery__imp_WTSVirtualChannelQueryWTSVirtualChannelOpenEx__imp_WTSVirtualChannelOpenExWTSVirtualChannelOpen__imp_WTSVirtualChannelOpenWTSVirtualChannelClose__imp_WTSVirtualChannelCloseWTSUnRegisterSessionNotification__imp_WTSUnRegisterSessionNotificationWTSRegisterSessionNotification__imp_WTSRegisterSessionNotificationWTSQueryUserToken__imp_WTSQueryUserTokenWTSQuerySessionInformationW__imp_WTSQuerySessionInformationWWTSLogoffSession__imp_WTSLogoffSessionWTSFreeMemoryExW__imp_WTSFreeMemoryExWWTSFreeMemory__imp_WTSFreeMemoryWTSEnumerateSessionsW__imp_WTSEnumerateSessionsWWTSEnumerateSessionsExW__imp_WTSEnumerateSessionsExWWTSEnumerateProcessesW__imp_WTSEnumerateProcessesWWTSEnumerateProcessesExW__imp_WTSEnumerateProcessesExWWTSDisconnectSession__imp_WTSDisconnectSessiondmkfbt.o/ 1516160836 0 0 100666 654 ` d$.text P`.data@P.bssP.idata$4@0.idata$5 @0.idata$7@0WTSAPI32.dll.filegfake.text.data.bss.idata$4.idata$5.idata$7 \__C__Users_Peter_Code_winapi_rs_x86_64_lib_libwinapi_onecore_downlevel_wtsapi32_a_inamedmkfbh.o/ 1516160836 0 0 100666 776 ` d6.text P`.data@P.bssP.idata$2@0.idata$5@0.idata$4@0   .filegfakehnamefthunk.text.data.bss.idata$2.idata$4.idata$5Z_head_C__Users_Peter_Code_winapi_rs_x86_64_lib_libwinapi_onecore_downlevel_wtsapi32_a__C__Users_Peter_Code_winapi_rs_x86_64_lib_libwinapi_onecore_downlevel_wtsapi32_a_inamedmkfbs00015.o/ 1516160836 0 0 100666 718 ` d .text,d 0`.data@0.bss0.idata$74n0.idata$58x0.idata$4@0.idata$6H %WTSVirtualChannelQuery .text.data.bss.idata$7.idata$5.idata$4.idata$68WTSVirtualChannelQuery__imp_WTSVirtualChannelQuery_head_C__Users_Peter_Code_winapi_rs_x86_64_lib_libwinapi_onecore_downlevel_wtsapi32_admkfbs00014.o/ 1516160836 0 0 100666 720 ` d .text,d 0`.data@0.bss0.idata$74n0.idata$58x0.idata$4@0.idata$6H %WTSVirtualChannelOpenEx .text.data.bss.idata$7.idata$5.idata$4.idata$6:WTSVirtualChannelOpenEx__imp_WTSVirtualChannelOpenEx_head_C__Users_Peter_Code_winapi_rs_x86_64_lib_libwinapi_onecore_downlevel_wtsapi32_admkfbs00013.o/ 1516160836 0 0 100666 712 ` d .text,` 0`.data@0.bss0.idata$74j0.idata$58t0.idata$4@~0.idata$6H % WTSVirtualChannelOpen .text.data.bss.idata$7.idata$5.idata$4.idata$66WTSVirtualChannelOpen__imp_WTSVirtualChannelOpen_head_C__Users_Peter_Code_winapi_rs_x86_64_lib_libwinapi_onecore_downlevel_wtsapi32_admkfbs00012.o/ 1516160836 0 0 100666 718 ` d .text,d 0`.data@0.bss0.idata$74n0.idata$58x0.idata$4@0.idata$6H % WTSVirtualChannelClose .text.data.bss.idata$7.idata$5.idata$4.idata$68WTSVirtualChannelClose__imp_WTSVirtualChannelClose_head_C__Users_Peter_Code_winapi_rs_x86_64_lib_libwinapi_onecore_downlevel_wtsapi32_admkfbs00011.o/ 1516160836 0 0 100666 746 ` d .text,l 0`.data@0.bss0.idata$74v0.idata$580.idata$4@0.idata$6$H % WTSUnRegisterSessionNotification .text.data.bss.idata$7.idata$5.idata$4.idata$6%LWTSUnRegisterSessionNotification__imp_WTSUnRegisterSessionNotification_head_C__Users_Peter_Code_winapi_rs_x86_64_lib_libwinapi_onecore_downlevel_wtsapi32_admkfbs00010.o/ 1516160836 0 0 100666 742 ` d .text,l 0`.data@0.bss0.idata$74v0.idata$580.idata$4@0.idata$6"H % WTSRegisterSessionNotification .text.data.bss.idata$7.idata$5.idata$4.idata$6#HWTSRegisterSessionNotification__imp_WTSRegisterSessionNotification_head_C__Users_Peter_Code_winapi_rs_x86_64_lib_libwinapi_onecore_downlevel_wtsapi32_admkfbs00009.o/ 1516160836 0 0 100666 700 ` d .text,\ 0`.data@0.bss0.idata$74f0.idata$58p0.idata$4@z0.idata$6H % WTSQueryUserToken .text.data.bss.idata$7.idata$5.idata$4.idata$6.WTSQueryUserToken__imp_WTSQueryUserToken_head_C__Users_Peter_Code_winapi_rs_x86_64_lib_libwinapi_onecore_downlevel_wtsapi32_admkfbs00008.o/ 1516160836 0 0 100666 732 ` d .text,h 0`.data@0.bss0.idata$74r0.idata$58|0.idata$4@0.idata$6H %WTSQuerySessionInformationW .text.data.bss.idata$7.idata$5.idata$4.idata$6 BWTSQuerySessionInformationW__imp_WTSQuerySessionInformationW_head_C__Users_Peter_Code_winapi_rs_x86_64_lib_libwinapi_onecore_downlevel_wtsapi32_admkfbs00007.o/ 1516160836 0 0 100666 698 ` d .text,\ 0`.data@0.bss0.idata$74f0.idata$58p0.idata$4@z0.idata$6H %WTSLogoffSession .text.data.bss.idata$7.idata$5.idata$4.idata$6,WTSLogoffSession__imp_WTSLogoffSession_head_C__Users_Peter_Code_winapi_rs_x86_64_lib_libwinapi_onecore_downlevel_wtsapi32_admkfbs00006.o/ 1516160836 0 0 100666 698 ` d .text,\ 0`.data@0.bss0.idata$74f0.idata$58p0.idata$4@z0.idata$6H %WTSFreeMemoryExW .text.data.bss.idata$7.idata$5.idata$4.idata$6,WTSFreeMemoryExW__imp_WTSFreeMemoryExW_head_C__Users_Peter_Code_winapi_rs_x86_64_lib_libwinapi_onecore_downlevel_wtsapi32_admkfbs00005.o/ 1516160836 0 0 100666 688 ` d .text,X 0`.data@0.bss0.idata$74b0.idata$58l0.idata$4@v0.idata$6H %WTSFreeMemory .text.data.bss.idata$7.idata$5.idata$4.idata$6&|WTSFreeMemory__imp_WTSFreeMemory_head_C__Users_Peter_Code_winapi_rs_x86_64_lib_libwinapi_onecore_downlevel_wtsapi32_admkfbs00004.o/ 1516160836 0 0 100666 712 ` d .text,` 0`.data@0.bss0.idata$74j0.idata$58t0.idata$4@~0.idata$6H %WTSEnumerateSessionsW .text.data.bss.idata$7.idata$5.idata$4.idata$66WTSEnumerateSessionsW__imp_WTSEnumerateSessionsW_head_C__Users_Peter_Code_winapi_rs_x86_64_lib_libwinapi_onecore_downlevel_wtsapi32_admkfbs00003.o/ 1516160836 0 0 100666 720 ` d .text,d 0`.data@0.bss0.idata$74n0.idata$58x0.idata$4@0.idata$6H %WTSEnumerateSessionsExW .text.data.bss.idata$7.idata$5.idata$4.idata$6:WTSEnumerateSessionsExW__imp_WTSEnumerateSessionsExW_head_C__Users_Peter_Code_winapi_rs_x86_64_lib_libwinapi_onecore_downlevel_wtsapi32_admkfbs00002.o/ 1516160836 0 0 100666 718 ` d .text,d 0`.data@0.bss0.idata$74n0.idata$58x0.idata$4@0.idata$6H %WTSEnumerateProcessesW .text.data.bss.idata$7.idata$5.idata$4.idata$68WTSEnumerateProcessesW__imp_WTSEnumerateProcessesW_head_C__Users_Peter_Code_winapi_rs_x86_64_lib_libwinapi_onecore_downlevel_wtsapi32_admkfbs00001.o/ 1516160836 0 0 100666 722 ` d .text,d 0`.data@0.bss0.idata$74n0.idata$58x0.idata$4@0.idata$6H %WTSEnumerateProcessesExW .text.data.bss.idata$7.idata$5.idata$4.idata$6<WTSEnumerateProcessesExW__imp_WTSEnumerateProcessesExW_head_C__Users_Peter_Code_winapi_rs_x86_64_lib_libwinapi_onecore_downlevel_wtsapi32_admkfbs00000.o/ 1516160836 0 0 100666 710 ` d .text,` 0`.data@0.bss0.idata$74j0.idata$58t0.idata$4@~0.idata$6H %WTSDisconnectSession .text.data.bss.idata$7.idata$5.idata$4.idata$64WTSDisconnectSession__imp_WTSDisconnectSession_head_C__Users_Peter_Code_winapi_rs_x86_64_lib_libwinapi_onecore_downlevel_wtsapi32_a