synthetic iat · rva-keyed
Decoded API Map
The synthetic IAT thunk table at RVA 0x1DAE190 holds 248per-API polymorphic trampolines. The table below lists every slot decoded by the emulator, cross-referenced against the target module’s export table and listed by target-RVA(offset within kernelbase / ntdll / kernel32).
64 decoded · 184 unresolved (modified fold variants; extending the emulator to handle arithmetic-interleaved folds would unlock most of them).
48
kernelbase APIs
11
ntdll APIs
5
kernel32 APIs
| Thunk RVA | API | Module | Target RVA | Folds |
|---|---|---|---|---|
| +0x38 | CreateEventW | kernelbase | +0x56ED0 | 1 |
| +0x40 | CreateFiber | kernelbase | +0x57840 | 2 |
| +0x60 | CreateProcessW | kernelbase | +0x3C690 | 0 |
| +0x68 | CreateThread | kernelbase | +0x33110 | 0 |
| +0x80 | DeactivateActCtx | kernelbase | +0x3B000 | 3 |
| +0xB8 | RtlExitUserThread | ntdll | +0x8C440 | 0 |
| +0xE8 | FlsAlloc | kernelbase | +0x3FC00 | 2 |
| +0x110 | FlushInstructionCache | kernelbase | +0x3B560 | 1 |
| +0x158 | GetCommandLineW | kernelbase | +0x40F10 | 1 |
| +0x160 | GetComputerNameW | kernelbase | +0x3BE80 | 0 |
| +0x178 | GetCurrentDirectoryW | kernelbase | +0x3EBD0 | 2 |
| +0x188 | GetCurrentProcessId | kernelbase | +0x236E0 | 0 |
| +0x1E8 | GetFinalPathNameByHandleW | kernelbase | +0x57390 | 0 |
| +0x218 | GetModuleFileNameW | kernelbase | +0x3C590 | 0 |
| +0x220 | GetModuleHandleA | kernelbase | +0x3C5F0 | 2 |
| +0x228 | GetModuleHandleExW | kernelbase | +0x3E520 | 2 |
| +0x230 | GetModuleHandleW | kernelbase | +0x3B460 | 1 |
| +0x240 | GetOEMCP | kernelbase | +0x449C0 | 0 |
| +0x260 | GetProcessId | kernelbase | +0x35230 | 2 |
| +0x268 | GetStartupInfoW | kernelbase | +0x3E4D0 | 1 |
| +0x2F0 | GetVersionExW | kernelbase | +0x3FAC0 | 0 |
| +0x300 | GlobalMemoryStatusEx | kernelbase | +0x3AFC0 | 1 |
| +0x358 | RtlRunOnceInitialize | ntdll | +0xEB450 | 1 |
| +0x380 | IsThreadAFiber | kernelbase | +0x32050 | 2 |
| +0x3C0 | MapViewOfFile | kernelbase | +0x38320 | 0 |
| +0x3D0 | Module32FirstW | kernelbase | +0x33570 | 2 |
| +0x3D8 | Module32NextW | kernelbase | +0x244E0 | 2 |
| +0x420 | QueryPerformanceFrequency | kernelbase | +0x331F0 | 2 |
| +0x440 | ReadFile | kernelbase | +0x574C0 | 2 |
| +0x450 | RtlReleaseSRWLockShared | ntdll | +0x1B020 | 0 |
| +0x460 | ResetEvent | kernelbase | +0x56FE0 | 2 |
| +0x478 | SetEndOfFile | kernelbase | +0x57530 | 3 |
| +0x488 | SetEvent | kernelbase | +0x56FF0 | 1 |
| +0x498 | SetFilePointer | kernelbase | +0x57570 | 1 |
| +0x4A0 | SetFilePointerEx | kernelbase | +0x57580 | 0 |
| +0x4A8 | SetLastError | kernelbase | +0x28DB0 | 0 |
| +0x4B0 | SetStdHandle | kernelbase | +0x54E20 | 2 |
| +0x4C0 | SetThreadContext | kernelbase | +0x45100 | 1 |
| +0x4D0 | SetUnhandledExceptionFilter | kernelbase | +0x43610 | 1 |
| +0x4E0 | Sleep | kernelbase | +0x31990 | 1 |
| +0x4F0 | SleepEx | kernelbase | +0x57010 | 1 |
| +0x4F8 | TpStartAsyncIoOperation | ntdll | +0x71860 | 2 |
| +0x500 | SuspendThread | kernelbase | +0x3E880 | 0 |
| +0x518 | SystemTimeToTzSpecificLocalTime | kernelbase | +0x3F6E0 | 2 |
| +0x530 | Thread32First | kernelbase | +0xDAC0 | 1 |
| +0x550 | TlsGetValue | kernelbase | +0x842E0 | 2 |
| +0x560 | RtlTryAcquireSRWLockExclusive | ntdll | +0x14850 | 0 |
| +0x578 | UnmapViewOfFile | kernelbase | +0x38 | 4 |
| +0x580 | VerifyVersionInfoW | kernelbase | +0x2E0D0 | 1 |
| +0x588 | VirtualAlloc | kernelbase | +0x33CA0 | 2 |
| +0x590 | VirtualFree | kernelbase | +0x35C00 | 1 |
| +0x598 | VirtualProtect | kernelbase | +0x382C0 | 2 |
| +0x5A8 | WaitForMultipleObjects | kernelbase | +0x57020 | 2 |
| +0x5F8 | ZwContinue | ntdll | +0x162350 | 2 |
| +0x610 | ZwQueryInformationProcess | ntdll | +0x161E10 | 2 |
| +0x628 | RtlCaptureContext | ntdll | +0x120BE0 | 1 |
| +0x630 | RtlLookupFunctionEntry | ntdll | +0xE010 | 1 |
| +0x640 | RtlRestoreContext | ntdll | +0x4CD90 | 1 |
| +0x660 | VerSetConditionMask | ntdll | +0xEA2C0 | 2 |
| +0x690 | CryptDestroyKey | kernel32 | +0x34590 | 0 |
| +0x698 | CryptEncrypt | kernel32 | +0x37670 | 0 |
| +0x6C8 | GetUserNameW | kernel32 | +0x30360 | 2 |
| +0x6D0 | RegCloseKey | kernel32 | +0x287B0 | 0 |
| +0x6E8 | RegOpenKeyExW | kernel32 | +0x27300 | 1 |