Regenerate PIDL dissectors with our current PIDL.

Change-Id: I63a1874d157c55df6c3c3f69c68098528adbb384
Reviewed-on: https://code.wireshark.org/review/4330
Reviewed-by: Guy Harris <guy@alum.mit.edu>

1 files changed, 441 insertions, 441 deletions

diff --git a/epan/dissectors/packet-dcerpc-winreg.c b/epan/dissectors/packet-dcerpc-winreg.c
index f5b9ec3571..0b91ae19d0 100644
--- a/epan/dissectors/packet-dcerpc-winreg.c
+++ b/epan/dissectors/packet-dcerpc-winreg.c
@@ -43,155 +43,155 @@ static gint ett_winreg_QueryMultipleValue = -1;
 
 
 /* Header field declarations */
+static gint hf_winreg_winreg_AccessMask_KEY_ENUMERATE_SUB_KEYS = -1;
+static gint hf_winreg_winreg_NotifyChangeKeyValue_string2 = -1;
+static gint hf_winreg_winreg_InitiateSystemShutdown_message = -1;
+static gint hf_winreg_winreg_String_name = -1;
 static gint hf_winreg_winreg_InitiateSystemShutdownEx_message = -1;
-static gint hf_winreg_KeySecurityAttribute_data_size = -1;
-static gint hf_winreg_system_name = -1;
-static gint hf_winreg_winreg_KeyOptions_REG_OPTION_OPEN_LINK = -1;
-static gint hf_winreg_winreg_SetValue_size = -1;
-static gint hf_winreg_winreg_SecBuf_sd = -1;
-static gint hf_winreg_sd_offset = -1;
-static gint hf_winreg_winreg_RestoreKey_filename = -1;
-static gint hf_winreg_winreg_NotifyChangeKeyValue_watch_subtree = -1;
-static gint hf_winreg_sd_max_size = -1;
-static gint hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_NAME = -1;
-static gint hf_winreg_winreg_EnumValue_type = -1;
-static gint hf_winreg_winreg_QueryValue_value_name = -1;
-static gint hf_winreg_winreg_QueryMultipleValues_key_handle = -1;
-static gint hf_winreg_winreg_SaveKey_sec_attrib = -1;
-static gint hf_winreg_winreg_QueryMultipleValues_values_out = -1;
-static gint hf_winreg_winreg_CreateKey_secdesc = -1;
-static gint hf_winreg_winreg_InitiateSystemShutdown_do_reboot = -1;
-static gint hf_winreg_winreg_LoadKey_filename = -1;
+static gint hf_winreg_winreg_EnumValue_enum_index = -1;
+static gint hf_winreg_access_mask = -1;
 static gint hf_winreg_winreg_CreateKey_options = -1;
-static gint hf_winreg_winreg_InitiateSystemShutdown_message = -1;
-static gint hf_winreg_winreg_LoadKey_keyname = -1;
+static gint hf_winreg_winreg_InitiateSystemShutdownEx_timeout = -1;
+static gint hf_winreg_handle = -1;
+static gint hf_winreg_winreg_QueryInfoKey_max_valnamelen = -1;
+static gint hf_winreg_winreg_SecBuf_length = -1;
+static gint hf_winreg_winreg_InitiateSystemShutdown_do_reboot = -1;
+static gint hf_winreg_winreg_DeleteKeyEx_handle = -1;
+static gint hf_winreg_winreg_QueryMultipleValues_buffer_size = -1;
+static gint hf_winreg_winreg_CreateKey_new_handle = -1;
+static gint hf_winreg_winreg_QueryMultipleValues2_needed = -1;
+static gint hf_winreg_QueryMultipleValue_ve_valuelen = -1;
+static gint hf_winreg_KeySecurityAttribute_sec_data = -1;
+static gint hf_winreg_winreg_GetKeySecurity_sec_info = -1;
 static gint hf_winreg_winreg_SaveKeyEx_handle = -1;
-static gint hf_winreg_winreg_DeleteKeyEx_reserved = -1;
-static gint hf_winreg_winreg_UnLoadKey_handle = -1;
+static gint hf_winreg_winreg_KeyOptions_REG_OPTION_VOLATILE = -1;
+static gint hf_winreg_winreg_QueryMultipleValues2_num_values = -1;
+static gint hf_winreg_winreg_SetKeySecurity_sec_info = -1;
+static gint hf_winreg_winreg_StringBuf_size = -1;
+static gint hf_winreg_winreg_SecBuf_sd = -1;
 static gint hf_winreg_winreg_QueryInfoKey_secdescsize = -1;
-static gint hf_winreg_winreg_QueryValue_data_length = -1;
-static gint hf_winreg_KeySecurityAttribute_inherit = -1;
-static gint hf_winreg_winreg_AccessMask_KEY_NOTIFY = -1;
-static gint hf_winreg_winreg_ReplaceKey_handle = -1;
-static gint hf_winreg_winreg_QueryInfoKey_max_valnamelen = -1;
-static gint hf_winreg_winreg_NotifyChangeKeyValue_string1 = -1;
-static gint hf_winreg_winreg_AccessMask_KEY_WOW64_64KEY = -1;
 static gint hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_SECURITY = -1;
-static gint hf_winreg_handle = -1;
-static gint hf_winreg_winreg_AccessMask_KEY_CREATE_SUB_KEY = -1;
-static gint hf_winreg_werror = -1;
-static gint hf_winreg_winreg_QueryInfoKey_classname = -1;
-static gint hf_winreg_winreg_InitiateSystemShutdownEx_hostname = -1;
-static gint hf_winreg_winreg_EnumKey_last_changed_time = -1;
-static gint hf_winreg_KeySecurityData_data = -1;
-static gint hf_winreg_winreg_OpenHKCU_access_mask = -1;
-static gint hf_winreg_winreg_QueryMultipleValues_buffer_size = -1;
-static gint hf_winreg_winreg_QueryInfoKey_num_values = -1;
-static gint hf_winreg_winreg_String_name_len = -1;
+static gint hf_winreg_winreg_SetValue_name = -1;
+static gint hf_winreg_winreg_RestoreKey_flags = -1;
+static gint hf_winreg_QueryMultipleValue_ve_type = -1;
+static gint hf_winreg_winreg_CreateKey_secdesc = -1;
+static gint hf_winreg_winreg_DeleteKeyEx_reserved = -1;
+static gint hf_winreg_winreg_InitiateSystemShutdownEx_force_apps = -1;
+static gint hf_winreg_winreg_SetValue_type = -1;
+static gint hf_winreg_opnum = -1;
+static gint hf_winreg_winreg_EnumValue_name = -1;
+static gint hf_winreg_winreg_LoadKey_filename = -1;
 static gint hf_winreg_winreg_AccessMask_KEY_CREATE_LINK = -1;
+static gint hf_winreg_winreg_DeleteValue_value = -1;
+static gint hf_winreg_winreg_QueryMultipleValues2_offered = -1;
+static gint hf_winreg_winreg_QueryMultipleValues_values_in = -1;
+static gint hf_winreg_winreg_AccessMask_KEY_NOTIFY = -1;
+static gint hf_winreg_winreg_OpenKey_parent_handle = -1;
+static gint hf_winreg_winreg_QueryInfoKey_num_subkeys = -1;
+static gint hf_winreg_winreg_AccessMask_KEY_WOW64_32KEY = -1;
+static gint hf_winreg_winreg_SaveKeyEx_sec_attrib = -1;
+static gint hf_winreg_winreg_QueryInfoKey_last_changed_time = -1;
+static gint hf_winreg_winreg_KeyOptions_REG_OPTION_OPEN_LINK = -1;
+static gint hf_winreg_winreg_OpenHKPD_access_mask = -1;
 static gint hf_winreg_winreg_AbortSystemShutdown_server = -1;
+static gint hf_winreg_winreg_QueryValue_type = -1;
+static gint hf_winreg_sd_actual_size = -1;
+static gint hf_winreg_winreg_RestoreKeyFlags_REG_FORCE_RESTORE = -1;
+static gint hf_winreg_winreg_SecBuf_inherit = -1;
+static gint hf_winreg_winreg_SetValue_size = -1;
 static gint hf_winreg_winreg_SaveKey_handle = -1;
-static gint hf_winreg_winreg_OpenKey_keyname = -1;
-static gint hf_winreg_KeySecurityAttribute_sec_data = -1;
-static gint hf_winreg_opnum = -1;
+static gint hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_LAST_SET = -1;
+static gint hf_winreg_winreg_ReplaceKey_handle = -1;
+static gint hf_winreg_winreg_GetVersion_version = -1;
 static gint hf_winreg_winreg_ReplaceKey_old_file = -1;
-static gint hf_winreg_winreg_SetValue_type = -1;
-static gint hf_winreg_winreg_ValNameBuf_length = -1;
+static gint hf_winreg_winreg_AccessMask_KEY_QUERY_VALUE = -1;
+static gint hf_winreg_winreg_CreateKey_action_taken = -1;
+static gint hf_winreg_winreg_QueryInfoKey_num_values = -1;
+static gint hf_winreg_winreg_RestoreKeyFlags_REG_WHOLE_HIVE_VOLATILE = -1;
+static gint hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_NAME = -1;
+static gint hf_winreg_winreg_AccessMask_KEY_SET_VALUE = -1;
+static gint hf_winreg_winreg_EnumKey_enum_index = -1;
+static gint hf_winreg_winreg_RestoreKey_handle = -1;
+static gint hf_winreg_winreg_SetValue_data = -1;
 static gint hf_winreg_winreg_InitiateSystemShutdown_force_apps = -1;
-static gint hf_winreg_winreg_StringBuf_name = -1;
-static gint hf_winreg_winreg_SetValue_name = -1;
-static gint hf_winreg_winreg_DeleteKeyEx_access_mask = -1;
-static gint hf_winreg_winreg_String_name_size = -1;
-static gint hf_winreg_KeySecurityData_size = -1;
-static gint hf_winreg_winreg_InitiateSystemShutdownEx_do_reboot = -1;
-static gint hf_winreg_winreg_OpenHKPD_access_mask = -1;
-static gint hf_winreg_winreg_EnumValue_value = -1;
-static gint hf_winreg_QueryMultipleValue_ve_valuelen = -1;
-static gint hf_winreg_winreg_EnumValue_enum_index = -1;
-static gint hf_winreg_winreg_InitiateSystemShutdownEx_force_apps = -1;
-static gint hf_winreg_winreg_QueryMultipleValues2_key_handle = -1;
-static gint hf_winreg_winreg_SaveKeyEx_sec_attrib = -1;
-static gint hf_winreg_winreg_NotifyChangeKeyValue_string2 = -1;
-static gint hf_winreg_winreg_CreateKey_name = -1;
-static gint hf_winreg_winreg_QueryMultipleValues2_needed = -1;
+static gint hf_winreg_winreg_NotifyChangeKeyValue_string1 = -1;
+static gint hf_winreg_winreg_SaveKeyEx_flags = -1;
+static gint hf_winreg_winreg_QueryMultipleValues_buffer = -1;
+static gint hf_winreg_winreg_QueryInfoKey_classname = -1;
+static gint hf_winreg_winreg_AccessMask_KEY_WOW64_64KEY = -1;
+static gint hf_winreg_winreg_ReplaceKey_subkey = -1;
+static gint hf_winreg_sd_max_size = -1;
+static gint hf_winreg_winreg_QueryInfoKey_max_classlen = -1;
+static gint hf_winreg_winreg_ValNameBuf_length = -1;
+static gint hf_winreg_winreg_NotifyChangeKeyValue_notify_filter = -1;
+static gint hf_winreg_winreg_UnLoadKey_subkey = -1;
 static gint hf_winreg_winreg_ReplaceKey_new_file = -1;
-static gint hf_winreg_winreg_RestoreKeyFlags_REG_REFRESH_HIVE = -1;
-static gint hf_winreg_winreg_QueryInfoKey_num_subkeys = -1;
-static gint hf_winreg_winreg_DeleteValue_value = -1;
-static gint hf_winreg_winreg_EnumKey_enum_index = -1;
-static gint hf_winreg_winreg_SecBuf_inherit = -1;
-static gint hf_winreg_winreg_OpenKey_options = -1;
-static gint hf_winreg_winreg_DeleteKeyEx_key = -1;
-static gint hf_winreg_winreg_QueryMultipleValues2_values_in = -1;
+static gint hf_winreg_winreg_SaveKeyEx_filename = -1;
 static gint hf_winreg_QueryMultipleValue_ve_valuename = -1;
-static gint hf_winreg_winreg_ValNameBuf_name = -1;
-static gint hf_winreg_winreg_UnLoadKey_subkey = -1;
-static gint hf_winreg_winreg_SaveKey_filename = -1;
-static gint hf_winreg_winreg_QueryMultipleValues2_offered = -1;
-static gint hf_winreg_QueryMultipleValue_ve_type = -1;
-static gint hf_winreg_winreg_QueryInfoKey_max_subkeylen = -1;
-static gint hf_winreg_winreg_DeleteKeyEx_handle = -1;
-static gint hf_winreg_winreg_KeyOptions_REG_OPTION_CREATE_LINK = -1;
-static gint hf_winreg_winreg_InitiateSystemShutdownEx_timeout = -1;
-static gint hf_winreg_winreg_CreateKey_action_taken = -1;
-static gint hf_winreg_winreg_StringBuf_size = -1;
-static gint hf_winreg_winreg_QueryMultipleValues_buffer = -1;
-static gint hf_winreg_winreg_GetVersion_version = -1;
-static gint hf_winreg_winreg_DeleteKey_key = -1;
-static gint hf_winreg_winreg_AccessMask_KEY_QUERY_VALUE = -1;
-static gint hf_winreg_winreg_NotifyChangeKeyValue_unknown = -1;
-static gint hf_winreg_winreg_RestoreKeyFlags_REG_NO_LAZY_FLUSH = -1;
-static gint hf_winreg_winreg_GetKeySecurity_sec_info = -1;
+static gint hf_winreg_winreg_QueryMultipleValues2_key_handle = -1;
+static gint hf_winreg_KeySecurityData_size = -1;
 static gint hf_winreg_winreg_KeyOptions_REG_OPTION_BACKUP_RESTORE = -1;
-static gint hf_winreg_winreg_AccessMask_KEY_ENUMERATE_SUB_KEYS = -1;
-static gint hf_winreg_winreg_CreateKey_keyclass = -1;
-static gint hf_winreg_winreg_SetKeySecurity_sec_info = -1;
-static gint hf_winreg_winreg_EnumValue_name = -1;
-static gint hf_winreg_winreg_QueryMultipleValues2_num_values = -1;
-static gint hf_winreg_winreg_InitiateSystemShutdown_hostname = -1;
+static gint hf_winreg_winreg_EnumKey_name = -1;
+static gint hf_winreg_winreg_LoadKey_keyname = -1;
+static gint hf_winreg_winreg_QueryMultipleValues_key_handle = -1;
+static gint hf_winreg_winreg_EnumValue_type = -1;
+static gint hf_winreg_winreg_EnumKey_last_changed_time = -1;
+static gint hf_winreg_winreg_EnumValue_size = -1;
+static gint hf_winreg_winreg_SaveKey_sec_attrib = -1;
+static gint hf_winreg_sd = -1;
+static gint hf_winreg_winreg_KeyOptions_REG_OPTION_CREATE_LINK = -1;
+static gint hf_winreg_winreg_OpenKey_options = -1;
+static gint hf_winreg_winreg_SaveKey_filename = -1;
 static gint hf_winreg_winreg_QueryValue_data = -1;
 static gint hf_winreg_winreg_QueryMultipleValues2_buffer = -1;
-static gint hf_winreg_QueryMultipleValue_ve_valueptr = -1;
-static gint hf_winreg_winreg_AccessMask_KEY_WOW64_32KEY = -1;
-static gint hf_winreg_winreg_EnumValue_length = -1;
-static gint hf_winreg_winreg_RestoreKeyFlags_REG_WHOLE_HIVE_VOLATILE = -1;
-static gint hf_winreg_winreg_KeyOptions_REG_OPTION_VOLATILE = -1;
+static gint hf_winreg_winreg_InitiateSystemShutdown_hostname = -1;
+static gint hf_winreg_winreg_UnLoadKey_handle = -1;
+static gint hf_winreg_winreg_QueryMultipleValues_values_out = -1;
+static gint hf_winreg_KeySecurityData_data = -1;
 static gint hf_winreg_winreg_OpenKey_access_mask = -1;
+static gint hf_winreg_winreg_OpenKey_keyname = -1;
+static gint hf_winreg_winreg_InitiateSystemShutdownEx_do_reboot = -1;
+static gint hf_winreg_winreg_NotifyChangeKeyValue_watch_subtree = -1;
+static gint hf_winreg_winreg_DeleteKeyEx_access_mask = -1;
+static gint hf_winreg_winreg_DeleteKeyEx_key = -1;
+static gint hf_winreg_winreg_QueryValue_data_length = -1;
+static gint hf_winreg_KeySecurityData_len = -1;
+static gint hf_winreg_winreg_ValNameBuf_size = -1;
+static gint hf_winreg_winreg_CreateKey_name = -1;
 static gint hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_ATTRIBUTES = -1;
+static gint hf_winreg_winreg_String_name_len = -1;
+static gint hf_winreg_winreg_DeleteKey_key = -1;
+static gint hf_winreg_winreg_QueryValue_data_size = -1;
+static gint hf_winreg_system_name = -1;
+static gint hf_winreg_QueryMultipleValue_ve_valueptr = -1;
+static gint hf_winreg_KeySecurityAttribute_data_size = -1;
 static gint hf_winreg_winreg_QueryMultipleValues_num_values = -1;
-static gint hf_winreg_winreg_RestoreKey_handle = -1;
+static gint hf_winreg_winreg_StringBuf_name = -1;
 static gint hf_winreg_winreg_NotifyChangeKeyValue_unknown2 = -1;
-static gint hf_winreg_winreg_QueryValue_data_size = -1;
-static gint hf_winreg_winreg_QueryMultipleValues2_values_out = -1;
-static gint hf_winreg_winreg_QueryInfoKey_max_classlen = -1;
-static gint hf_winreg_winreg_CreateKey_new_handle = -1;
-static gint hf_winreg_access_mask = -1;
-static gint hf_winreg_winreg_SecBuf_length = -1;
-static gint hf_winreg_winreg_NotifyChangeKeyValue_notify_filter = -1;
-static gint hf_winreg_winreg_SaveKeyEx_flags = -1;
-static gint hf_winreg_winreg_ReplaceKey_subkey = -1;
-static gint hf_winreg_winreg_InitiateSystemShutdownEx_reason = -1;
-static gint hf_winreg_winreg_QueryMultipleValues_values_in = -1;
-static gint hf_winreg_winreg_SetValue_data = -1;
-static gint hf_winreg_winreg_EnumValue_size = -1;
-static gint hf_winreg_winreg_SaveKeyEx_filename = -1;
+static gint hf_winreg_sd_offset = -1;
+static gint hf_winreg_winreg_ValNameBuf_name = -1;
 static gint hf_winreg_winreg_StringBuf_length = -1;
-static gint hf_winreg_winreg_OpenKey_parent_handle = -1;
-static gint hf_winreg_sd_actual_size = -1;
-static gint hf_winreg_winreg_EnumKey_name = -1;
+static gint hf_winreg_winreg_QueryMultipleValues2_values_in = -1;
+static gint hf_winreg_winreg_String_name_size = -1;
+static gint hf_winreg_winreg_NotifyChangeKeyValue_unknown = -1;
+static gint hf_winreg_winreg_AccessMask_KEY_CREATE_SUB_KEY = -1;
+static gint hf_winreg_winreg_RestoreKey_filename = -1;
+static gint hf_winreg_winreg_RestoreKeyFlags_REG_REFRESH_HIVE = -1;
 static gint hf_winreg_winreg_QueryInfoKey_max_valbufsize = -1;
-static gint hf_winreg_winreg_RestoreKey_flags = -1;
-static gint hf_winreg_winreg_EnumKey_keyclass = -1;
-static gint hf_winreg_winreg_RestoreKeyFlags_REG_FORCE_RESTORE = -1;
-static gint hf_winreg_winreg_QueryValue_type = -1;
-static gint hf_winreg_KeySecurityData_len = -1;
-static gint hf_winreg_winreg_String_name = -1;
-static gint hf_winreg_sd = -1;
-static gint hf_winreg_winreg_QueryInfoKey_last_changed_time = -1;
-static gint hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_LAST_SET = -1;
-static gint hf_winreg_winreg_AccessMask_KEY_SET_VALUE = -1;
-static gint hf_winreg_winreg_ValNameBuf_size = -1;
+static gint hf_winreg_winreg_InitiateSystemShutdownEx_reason = -1;
+static gint hf_winreg_winreg_EnumValue_length = -1;
+static gint hf_winreg_winreg_QueryInfoKey_max_subkeylen = -1;
 static gint hf_winreg_winreg_InitiateSystemShutdown_timeout = -1;
+static gint hf_winreg_winreg_InitiateSystemShutdownEx_hostname = -1;
+static gint hf_winreg_KeySecurityAttribute_inherit = -1;
+static gint hf_winreg_werror = -1;
+static gint hf_winreg_winreg_QueryMultipleValues2_values_out = -1;
+static gint hf_winreg_winreg_EnumKey_keyclass = -1;
+static gint hf_winreg_winreg_CreateKey_keyclass = -1;
+static gint hf_winreg_winreg_EnumValue_value = -1;
+static gint hf_winreg_winreg_OpenHKCU_access_mask = -1;
+static gint hf_winreg_winreg_QueryValue_value_name = -1;
+static gint hf_winreg_winreg_RestoreKeyFlags_REG_NO_LAZY_FLUSH = -1;
 
 static gint proto_dcerpc_winreg = -1;
 /* Version information */
@@ -767,7 +767,7 @@ winreg_dissect_struct_String(tvbuff_t *tvb _U_, int offset _U_, packet_info *pin
 
 
 /* IDL: struct { */
-/* IDL: 	[size_is(size)] [unique(1)] [length_is(len)] uint8 *data; */
+/* IDL: 	[unique(1)] [length_is(len)] [size_is(size)] uint8 *data; */
 /* IDL: 	uint32 size; */
 /* IDL: 	uint32 len; */
 /* IDL: } */
@@ -993,7 +993,7 @@ winreg_dissect_enum_CreateAction(tvbuff_t *tvb _U_, int offset _U_, packet_info
 /* IDL: struct { */
 /* IDL: 	[value(strlen_m_term_null(name)*2)] uint16 length; */
 /* IDL: 	uint16 size; */
-/* IDL: 	[charset(UTF16)] [length_is(length/2)] [unique(1)] [size_is(size/2)] uint16 *name; */
+/* IDL: 	[unique(1)] [length_is(length/2)] [charset(UTF16)] [size_is(size/2)] uint16 *name; */
 /* IDL: } */
 
 static int
@@ -1073,7 +1073,7 @@ winreg_dissect_struct_StringBuf(tvbuff_t *tvb _U_, int offset _U_, packet_info *
 /* IDL: struct { */
 /* IDL: 	[value(strlen_m_term(name)*2)] uint16 length; */
 /* IDL: 	uint16 size; */
-/* IDL: 	[charset(UTF16)] [length_is(length/2)] [unique(1)] [size_is(size/2)] uint16 *name; */
+/* IDL: 	[unique(1)] [length_is(length/2)] [charset(UTF16)] [size_is(size/2)] uint16 *name; */
 /* IDL: } */
 
 static int
@@ -1473,7 +1473,7 @@ winreg_dissect_element_OpenHKCR_handle_(tvbuff_t *tvb _U_, int offset _U_, packe
 /* IDL: WERROR winreg_OpenHKCR( */
 /* IDL: [unique(1)] [in] uint16 *system_name, */
 /* IDL: [in] winreg_AccessMask access_mask, */
-/* IDL: [ref] [out] policy_handle *handle */
+/* IDL: [out] [ref] policy_handle *handle */
 /* IDL: ); */
 
 static int
@@ -1693,9 +1693,9 @@ winreg_dissect_element_OpenHKPD_handle_(tvbuff_t *tvb _U_, int offset _U_, packe
 }
 
 /* IDL: WERROR winreg_OpenHKPD( */
-/* IDL: [in] [unique(1)] uint16 *system_name, */
+/* IDL: [unique(1)] [in] uint16 *system_name, */
 /* IDL: [in] winreg_AccessMask access_mask, */
-/* IDL: [ref] [out] policy_handle *handle */
+/* IDL: [out] [ref] policy_handle *handle */
 /* IDL: ); */
 
 static int
@@ -1767,9 +1767,9 @@ winreg_dissect_element_OpenHKU_handle_(tvbuff_t *tvb _U_, int offset _U_, packet
 }
 
 /* IDL: WERROR winreg_OpenHKU( */
-/* IDL: [in] [unique(1)] uint16 *system_name, */
+/* IDL: [unique(1)] [in] uint16 *system_name, */
 /* IDL: [in] winreg_AccessMask access_mask, */
-/* IDL: [ref] [out] policy_handle *handle */
+/* IDL: [out] [ref] policy_handle *handle */
 /* IDL: ); */
 
 static int
@@ -1817,7 +1817,7 @@ winreg_dissect_element_CloseKey_handle_(tvbuff_t *tvb _U_, int offset _U_, packe
 }
 
 /* IDL: WERROR winreg_CloseKey( */
-/* IDL: [in] [out] [ref] policy_handle *handle */
+/* IDL: [out] [in] [ref] policy_handle *handle */
 /* IDL: ); */
 
 static int
@@ -1948,9 +1948,9 @@ winreg_dissect_element_CreateKey_action_taken_(tvbuff_t *tvb _U_, int offset _U_
 /* IDL: [in] winreg_String keyclass, */
 /* IDL: [in] winreg_KeyOptions options, */
 /* IDL: [in] winreg_AccessMask access_mask, */
-/* IDL: [in] [unique(1)] winreg_SecBuf *secdesc, */
-/* IDL: [ref] [out] policy_handle *new_handle, */
-/* IDL: [unique(1)] [out] [in] winreg_CreateAction *action_taken */
+/* IDL: [unique(1)] [in] winreg_SecBuf *secdesc, */
+/* IDL: [out] [ref] policy_handle *new_handle, */
+/* IDL: [out] [unique(1)] [in] winreg_CreateAction *action_taken */
 /* IDL: ); */
 
 static int
@@ -2019,7 +2019,7 @@ winreg_dissect_element_DeleteKey_key(tvbuff_t *tvb _U_, int offset _U_, packet_i
 }
 
 /* IDL: WERROR winreg_DeleteKey( */
-/* IDL: [ref] [in] policy_handle *handle, */
+/* IDL: [in] [ref] policy_handle *handle, */
 /* IDL: [in] winreg_String key */
 /* IDL: ); */
 
@@ -2175,11 +2175,11 @@ winreg_dissect_element_EnumKey_last_changed_time_(tvbuff_t *tvb _U_, int offset
 }
 
 /* IDL: WERROR winreg_EnumKey( */
-/* IDL: [ref] [in] policy_handle *handle, */
+/* IDL: [in] [ref] policy_handle *handle, */
 /* IDL: [in] uint32 enum_index, */
-/* IDL: [out] [ref] [in] winreg_StringBuf *name, */
-/* IDL: [unique(1)] [out] [in] winreg_StringBuf *keyclass, */
-/* IDL: [in] [out] [unique(1)] NTTIME *last_changed_time */
+/* IDL: [out] [in] [ref] winreg_StringBuf *name, */
+/* IDL: [out] [unique(1)] [in] winreg_StringBuf *keyclass, */
+/* IDL: [out] [unique(1)] [in] NTTIME *last_changed_time */
 /* IDL: ); */
 
 static int
@@ -2337,10 +2337,10 @@ winreg_dissect_element_EnumValue_length_(tvbuff_t *tvb _U_, int offset _U_, pack
 /* IDL: WERROR winreg_EnumValue( */
 /* IDL: [in] [ref] policy_handle *handle, */
 /* IDL: [in] uint32 enum_index, */
-/* IDL: [in] [out] [ref] winreg_ValNameBuf *name, */
-/* IDL: [in] [unique(1)] [out] winreg_Type *type, */
-/* IDL: [in] [unique(1)] [size_is(size?*size:0)] [range(0,0x4000000)] [length_is(length?*length:0)] [out] uint8 *value, */
-/* IDL: [in] [unique(1)] [out] uint32 *size, */
+/* IDL: [out] [in] [ref] winreg_ValNameBuf *name, */
+/* IDL: [out] [unique(1)] [in] winreg_Type *type, */
+/* IDL: [unique(1)] [out] [in] [range(0,0x4000000)] [length_is(length?*length:0)] [size_is(size?*size:0)] uint8 *value, */
+/* IDL: [out] [unique(1)] [in] uint32 *size, */
 /* IDL: [out] [unique(1)] [in] uint32 *length */
 /* IDL: ); */
 
@@ -2411,7 +2411,7 @@ winreg_dissect_element_FlushKey_handle_(tvbuff_t *tvb _U_, int offset _U_, packe
 }
 
 /* IDL: WERROR winreg_FlushKey( */
-/* IDL: [ref] [in] policy_handle *handle */
+/* IDL: [in] [ref] policy_handle *handle */
 /* IDL: ); */
 
 static int
@@ -2480,7 +2480,7 @@ winreg_dissect_element_GetKeySecurity_sd_(tvbuff_t *tvb _U_, int offset _U_, pac
 /* IDL: WERROR winreg_GetKeySecurity( */
 /* IDL: [in] [ref] policy_handle *handle, */
 /* IDL: [in] security_secinfo sec_info, */
-/* IDL: [out] [ref] [in] KeySecurityData *sd */
+/* IDL: [out] [in] [ref] KeySecurityData *sd */
 /* IDL: ); */
 
 static int
@@ -2564,7 +2564,7 @@ winreg_dissect_element_LoadKey_filename_(tvbuff_t *tvb _U_, int offset _U_, pack
 /* IDL: WERROR winreg_LoadKey( */
 /* IDL: [in] [ref] policy_handle *handle, */
 /* IDL: [unique(1)] [in] winreg_String *keyname, */
-/* IDL: [in] [unique(1)] winreg_String *filename */
+/* IDL: [unique(1)] [in] winreg_String *filename */
 /* IDL: ); */
 
 static int
@@ -2760,11 +2760,11 @@ winreg_dissect_element_OpenKey_handle_(tvbuff_t *tvb _U_, int offset _U_, packet
 }
 
 /* IDL: WERROR winreg_OpenKey( */
-/* IDL: [ref] [in] policy_handle *parent_handle, */
+/* IDL: [in] [ref] policy_handle *parent_handle, */
 /* IDL: [in] winreg_String keyname, */
 /* IDL: [in] winreg_KeyOptions options, */
 /* IDL: [in] winreg_AccessMask access_mask, */
-/* IDL: [ref] [out] policy_handle *handle */
+/* IDL: [out] [ref] policy_handle *handle */
 /* IDL: ); */
 
 static int
@@ -2961,15 +2961,15 @@ winreg_dissect_element_QueryInfoKey_last_changed_time_(tvbuff_t *tvb _U_, int of
 
 /* IDL: WERROR winreg_QueryInfoKey( */
 /* IDL: [in] [ref] policy_handle *handle, */
-/* IDL: [ref] [out] [in] winreg_String *classname, */
-/* IDL: [ref] [out] uint32 *num_subkeys, */
-/* IDL: [ref] [out] uint32 *max_subkeylen, */
+/* IDL: [out] [in] [ref] winreg_String *classname, */
+/* IDL: [out] [ref] uint32 *num_subkeys, */
+/* IDL: [out] [ref] uint32 *max_subkeylen, */
 /* IDL: [out] [ref] uint32 *max_classlen, */
-/* IDL: [ref] [out] uint32 *num_values, */
+/* IDL: [out] [ref] uint32 *num_values, */
 /* IDL: [out] [ref] uint32 *max_valnamelen, */
 /* IDL: [out] [ref] uint32 *max_valbufsize, */
 /* IDL: [out] [ref] uint32 *secdescsize, */
-/* IDL: [ref] [out] NTTIME *last_changed_time */
+/* IDL: [out] [ref] NTTIME *last_changed_time */
 /* IDL: ); */
 
 static int
@@ -3129,12 +3129,12 @@ winreg_dissect_element_QueryValue_data_length_(tvbuff_t *tvb _U_, int offset _U_
 }
 
 /* IDL: WERROR winreg_QueryValue( */
-/* IDL: [ref] [in] policy_handle *handle, */
-/* IDL: [ref] [in] winreg_String *value_name, */
+/* IDL: [in] [ref] policy_handle *handle, */
+/* IDL: [in] [ref] winreg_String *value_name, */
 /* IDL: [out] [unique(1)] [in] winreg_Type *type, */
-/* IDL: [unique(1)] [size_is(data_size?*data_size:0)] [range(0,0x4000000)] [out] [length_is(data_length?*data_length:0)] [in] uint8 *data, */
+/* IDL: [unique(1)] [out] [in] [range(0,0x4000000)] [length_is(data_length?*data_length:0)] [size_is(data_size?*data_size:0)] uint8 *data, */
 /* IDL: [out] [unique(1)] [in] uint32 *data_size, */
-/* IDL: [unique(1)] [out] [in] uint32 *data_length */
+/* IDL: [out] [unique(1)] [in] uint32 *data_length */
 /* IDL: ); */
 
 static int
@@ -3248,9 +3248,9 @@ winreg_dissect_element_ReplaceKey_old_file_(tvbuff_t *tvb _U_, int offset _U_, p
 
 /* IDL: WERROR winreg_ReplaceKey( */
 /* IDL: [in] [ref] policy_handle *handle, */
-/* IDL: [ref] [in] winreg_String *subkey, */
-/* IDL: [ref] [in] winreg_String *new_file, */
-/* IDL: [ref] [in] winreg_String *old_file */
+/* IDL: [in] [ref] winreg_String *subkey, */
+/* IDL: [in] [ref] winreg_String *new_file, */
+/* IDL: [in] [ref] winreg_String *old_file */
 /* IDL: ); */
 
 static int
@@ -3324,7 +3324,7 @@ winreg_dissect_element_RestoreKey_flags(tvbuff_t *tvb _U_, int offset _U_, packe
 
 /* IDL: WERROR winreg_RestoreKey( */
 /* IDL: [in] [ref] policy_handle *handle, */
-/* IDL: [ref] [in] winreg_String *filename, */
+/* IDL: [in] [ref] winreg_String *filename, */
 /* IDL: [in] winreg_RestoreKeyFlags flags */
 /* IDL: ); */
 
@@ -3406,7 +3406,7 @@ winreg_dissect_element_SaveKey_sec_attrib_(tvbuff_t *tvb _U_, int offset _U_, pa
 /* IDL: WERROR winreg_SaveKey( */
 /* IDL: [in] [ref] policy_handle *handle, */
 /* IDL: [in] [ref] winreg_String *filename, */
-/* IDL: [in] [unique(1)] KeySecurityAttribute *sec_attrib */
+/* IDL: [unique(1)] [in] KeySecurityAttribute *sec_attrib */
 /* IDL: ); */
 
 static int
@@ -3477,9 +3477,9 @@ winreg_dissect_element_SetKeySecurity_sd_(tvbuff_t *tvb _U_, int offset _U_, pac
 }
 
 /* IDL: WERROR winreg_SetKeySecurity( */
-/* IDL: [ref] [in] policy_handle *handle, */
+/* IDL: [in] [ref] policy_handle *handle, */
 /* IDL: [in] security_secinfo sec_info, */
-/* IDL: [ref] [in] KeySecurityData *sd */
+/* IDL: [in] [ref] KeySecurityData *sd */
 /* IDL: ); */
 
 static int
@@ -3577,7 +3577,7 @@ winreg_dissect_element_SetValue_size(tvbuff_t *tvb _U_, int offset _U_, packet_i
 /* IDL: [in] [ref] policy_handle *handle, */
 /* IDL: [in] winreg_String name, */
 /* IDL: [in] winreg_Type type, */
-/* IDL: [ref] [size_is(size)] [in] uint8 *data, */
+/* IDL: [in] [ref] [size_is(size)] uint8 *data, */
 /* IDL: [in] uint32 size */
 /* IDL: ); */
 
@@ -3646,7 +3646,7 @@ winreg_dissect_element_UnLoadKey_subkey_(tvbuff_t *tvb _U_, int offset _U_, pack
 
 /* IDL: WERROR winreg_UnLoadKey( */
 /* IDL: [in] [ref] policy_handle *handle, */
-/* IDL: [ref] [in] winreg_String *subkey */
+/* IDL: [in] [ref] winreg_String *subkey */
 /* IDL: ); */
 
 static int
@@ -3731,7 +3731,7 @@ winreg_dissect_element_InitiateSystemShutdown_do_reboot(tvbuff_t *tvb _U_, int o
 }
 
 /* IDL: WERROR winreg_InitiateSystemShutdown( */
-/* IDL: [in] [unique(1)] uint16 *hostname, */
+/* IDL: [unique(1)] [in] uint16 *hostname, */
 /* IDL: [unique(1)] [in] lsa_StringLarge *message, */
 /* IDL: [in] uint32 timeout, */
 /* IDL: [in] uint8 force_apps, */
@@ -3786,7 +3786,7 @@ winreg_dissect_element_AbortSystemShutdown_server_(tvbuff_t *tvb _U_, int offset
 }
 
 /* IDL: WERROR winreg_AbortSystemShutdown( */
-/* IDL: [in] [unique(1)] uint16 *server */
+/* IDL: [unique(1)] [in] uint16 *server */
 /* IDL: ); */
 
 static int
@@ -3846,7 +3846,7 @@ winreg_dissect_element_GetVersion_version_(tvbuff_t *tvb _U_, int offset _U_, pa
 
 /* IDL: WERROR winreg_GetVersion( */
 /* IDL: [in] [ref] policy_handle *handle, */
-/* IDL: [ref] [out] uint32 *version */
+/* IDL: [out] [ref] uint32 *version */
 /* IDL: ); */
 
 static int
@@ -3918,7 +3918,7 @@ winreg_dissect_element_OpenHKCC_handle_(tvbuff_t *tvb _U_, int offset _U_, packe
 /* IDL: WERROR winreg_OpenHKCC( */
 /* IDL: [unique(1)] [in] uint16 *system_name, */
 /* IDL: [in] winreg_AccessMask access_mask, */
-/* IDL: [ref] [out] policy_handle *handle */
+/* IDL: [out] [ref] policy_handle *handle */
 /* IDL: ); */
 
 static int
@@ -4137,11 +4137,11 @@ winreg_dissect_element_QueryMultipleValues_buffer_size_(tvbuff_t *tvb _U_, int o
 
 /* IDL: WERROR winreg_QueryMultipleValues( */
 /* IDL: [in] [ref] policy_handle *key_handle, */
-/* IDL: [in] [length_is(num_values)] [ref] [size_is(num_values)] QueryMultipleValue *values_in, */
-/* IDL: [size_is(num_values)] [length_is(num_values)] [out] [ref] QueryMultipleValue *values_out, */
+/* IDL: [in] [ref] [length_is(num_values)] [size_is(num_values)] QueryMultipleValue *values_in, */
+/* IDL: [out] [ref] [length_is(num_values)] [size_is(num_values)] QueryMultipleValue *values_out, */
 /* IDL: [in] uint32 num_values, */
-/* IDL: [length_is(*buffer_size)] [out] [size_is(*buffer_size)] [unique(1)] [in] uint8 *buffer, */
-/* IDL: [in] [out] [ref] uint32 *buffer_size */
+/* IDL: [out] [unique(1)] [in] [length_is(*buffer_size)] [size_is(*buffer_size)] uint8 *buffer, */
+/* IDL: [out] [in] [ref] uint32 *buffer_size */
 /* IDL: ); */
 
 static int
@@ -4249,7 +4249,7 @@ winreg_dissect_element_InitiateSystemShutdownEx_reason(tvbuff_t *tvb _U_, int of
 }
 
 /* IDL: WERROR winreg_InitiateSystemShutdownEx( */
-/* IDL: [in] [unique(1)] uint16 *hostname, */
+/* IDL: [unique(1)] [in] uint16 *hostname, */
 /* IDL: [unique(1)] [in] lsa_StringLarge *message, */
 /* IDL: [in] uint32 timeout, */
 /* IDL: [in] uint8 force_apps, */
@@ -4348,7 +4348,7 @@ winreg_dissect_element_SaveKeyEx_flags(tvbuff_t *tvb _U_, int offset _U_, packet
 
 /* IDL: WERROR winreg_SaveKeyEx( */
 /* IDL: [in] [ref] policy_handle *handle, */
-/* IDL: [ref] [in] winreg_String *filename, */
+/* IDL: [in] [ref] winreg_String *filename, */
 /* IDL: [unique(1)] [in] KeySecurityAttribute *sec_attrib, */
 /* IDL: [in] uint32 flags */
 /* IDL: ); */
@@ -4423,7 +4423,7 @@ winreg_dissect_element_OpenHKPT_handle_(tvbuff_t *tvb _U_, int offset _U_, packe
 }
 
 /* IDL: WERROR winreg_OpenHKPT( */
-/* IDL: [in] [unique(1)] uint16 *system_name, */
+/* IDL: [unique(1)] [in] uint16 *system_name, */
 /* IDL: [in] winreg_AccessMask access_mask, */
 /* IDL: [out] [ref] policy_handle *handle */
 /* IDL: ); */
@@ -4660,11 +4660,11 @@ winreg_dissect_element_QueryMultipleValues2_needed_(tvbuff_t *tvb _U_, int offse
 
 /* IDL: WERROR winreg_QueryMultipleValues2( */
 /* IDL: [in] [ref] policy_handle *key_handle, */
-/* IDL: [size_is(num_values)] [ref] [length_is(num_values)] [in] QueryMultipleValue *values_in, */
-/* IDL: [size_is(num_values)] [length_is(num_values)] [ref] [out] QueryMultipleValue *values_out, */
+/* IDL: [in] [ref] [length_is(num_values)] [size_is(num_values)] QueryMultipleValue *values_in, */
+/* IDL: [out] [ref] [length_is(num_values)] [size_is(num_values)] QueryMultipleValue *values_out, */
 /* IDL: [in] uint32 num_values, */
-/* IDL: [in] [unique(1)] [size_is(*offered)] [out] [length_is(*offered)] uint8 *buffer, */
-/* IDL: [ref] [in] uint32 *offered, */
+/* IDL: [out] [unique(1)] [in] [length_is(*offered)] [size_is(*offered)] uint8 *buffer, */
+/* IDL: [in] [ref] uint32 *offered, */
 /* IDL: [out] [ref] uint32 *needed */
 /* IDL: ); */
 
@@ -4758,7 +4758,7 @@ winreg_dissect_element_DeleteKeyEx_reserved(tvbuff_t *tvb _U_, int offset _U_, p
 
 /* IDL: WERROR winreg_DeleteKeyEx( */
 /* IDL: [in] [ref] policy_handle *handle, */
-/* IDL: [ref] [in] winreg_String *key, */
+/* IDL: [in] [ref] winreg_String *key, */
 /* IDL: [in] winreg_AccessMask access_mask, */
 /* IDL: [in] uint32 reserved */
 /* IDL: ); */
@@ -4872,304 +4872,304 @@ static dcerpc_sub_dissector winreg_dissectors[] = {
 void proto_register_dcerpc_winreg(void)
 {
 	static hf_register_info hf[] = {
+	{ &hf_winreg_winreg_AccessMask_KEY_ENUMERATE_SUB_KEYS,
+		{ "Key Enumerate Sub Keys", "winreg.winreg_AccessMask.KEY_ENUMERATE_SUB_KEYS", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_ENUMERATE_SUB_KEYS_tfs), ( 0x00008 ), NULL, HFILL }},
+	{ &hf_winreg_winreg_NotifyChangeKeyValue_string2,
+		{ "String2", "winreg.winreg_NotifyChangeKeyValue.string2", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_InitiateSystemShutdown_message,
+		{ "Message", "winreg.winreg_InitiateSystemShutdown.message", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_String_name,
+		{ "Name", "winreg.winreg_String.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_winreg_winreg_InitiateSystemShutdownEx_message,
 		{ "Message", "winreg.winreg_InitiateSystemShutdownEx.message", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_KeySecurityAttribute_data_size,
-		{ "Data Size", "winreg.KeySecurityAttribute.data_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_system_name,
-		{ "System Name", "winreg.system_name", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_KeyOptions_REG_OPTION_OPEN_LINK,
-		{ "Reg Option Open Link", "winreg.winreg_KeyOptions.REG_OPTION_OPEN_LINK", FT_BOOLEAN, 32, TFS(&winreg_KeyOptions_REG_OPTION_OPEN_LINK_tfs), ( 0x00000008 ), NULL, HFILL }},
-	{ &hf_winreg_winreg_SetValue_size,
-		{ "Size", "winreg.winreg_SetValue.size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_SecBuf_sd,
-		{ "Sd", "winreg.winreg_SecBuf.sd", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_sd_offset,
-		{ "Offset", "winreg.sd.offset", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_RestoreKey_filename,
-		{ "Filename", "winreg.winreg_RestoreKey.filename", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_NotifyChangeKeyValue_watch_subtree,
-		{ "Watch Subtree", "winreg.winreg_NotifyChangeKeyValue.watch_subtree", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_sd_max_size,
-		{ "Max Size", "winreg.sd.max_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_NAME,
-		{ "Reg Notify Change Name", "winreg.winreg_NotifyChangeType.REG_NOTIFY_CHANGE_NAME", FT_BOOLEAN, 32, TFS(&winreg_NotifyChangeType_REG_NOTIFY_CHANGE_NAME_tfs), ( 0x00000001 ), NULL, HFILL }},
-	{ &hf_winreg_winreg_EnumValue_type,
-		{ "Type", "winreg.winreg_EnumValue.type", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryValue_value_name,
-		{ "Value Name", "winreg.winreg_QueryValue.value_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryMultipleValues_key_handle,
-		{ "Key Handle", "winreg.winreg_QueryMultipleValues.key_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_SaveKey_sec_attrib,
-		{ "Sec Attrib", "winreg.winreg_SaveKey.sec_attrib", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryMultipleValues_values_out,
-		{ "Values Out", "winreg.winreg_QueryMultipleValues.values_out", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_CreateKey_secdesc,
-		{ "Secdesc", "winreg.winreg_CreateKey.secdesc", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_InitiateSystemShutdown_do_reboot,
-		{ "Do Reboot", "winreg.winreg_InitiateSystemShutdown.do_reboot", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_LoadKey_filename,
-		{ "Filename", "winreg.winreg_LoadKey.filename", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_EnumValue_enum_index,
+		{ "Enum Index", "winreg.winreg_EnumValue.enum_index", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_access_mask,
+		{ "Access Mask", "winreg.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
 	{ &hf_winreg_winreg_CreateKey_options,
 		{ "Options", "winreg.winreg_CreateKey.options", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_InitiateSystemShutdown_message,
-		{ "Message", "winreg.winreg_InitiateSystemShutdown.message", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_LoadKey_keyname,
-		{ "Keyname", "winreg.winreg_LoadKey.keyname", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_InitiateSystemShutdownEx_timeout,
+		{ "Timeout", "winreg.winreg_InitiateSystemShutdownEx.timeout", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_handle,
+		{ "Handle", "winreg.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryInfoKey_max_valnamelen,
+		{ "Max Valnamelen", "winreg.winreg_QueryInfoKey.max_valnamelen", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_SecBuf_length,
+		{ "Length", "winreg.winreg_SecBuf.length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_InitiateSystemShutdown_do_reboot,
+		{ "Do Reboot", "winreg.winreg_InitiateSystemShutdown.do_reboot", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_DeleteKeyEx_handle,
+		{ "Handle", "winreg.winreg_DeleteKeyEx.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryMultipleValues_buffer_size,
+		{ "Buffer Size", "winreg.winreg_QueryMultipleValues.buffer_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_CreateKey_new_handle,
+		{ "New Handle", "winreg.winreg_CreateKey.new_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryMultipleValues2_needed,
+		{ "Needed", "winreg.winreg_QueryMultipleValues2.needed", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_QueryMultipleValue_ve_valuelen,
+		{ "Ve Valuelen", "winreg.QueryMultipleValue.ve_valuelen", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_KeySecurityAttribute_sec_data,
+		{ "Sec Data", "winreg.KeySecurityAttribute.sec_data", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_GetKeySecurity_sec_info,
+		{ "Sec Info", "winreg.winreg_GetKeySecurity.sec_info", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
 	{ &hf_winreg_winreg_SaveKeyEx_handle,
 		{ "Handle", "winreg.winreg_SaveKeyEx.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_DeleteKeyEx_reserved,
-		{ "Reserved", "winreg.winreg_DeleteKeyEx.reserved", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_UnLoadKey_handle,
-		{ "Handle", "winreg.winreg_UnLoadKey.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_KeyOptions_REG_OPTION_VOLATILE,
+		{ "Reg Option Volatile", "winreg.winreg_KeyOptions.REG_OPTION_VOLATILE", FT_BOOLEAN, 32, TFS(&winreg_KeyOptions_REG_OPTION_VOLATILE_tfs), ( 0x00000001 ), NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryMultipleValues2_num_values,
+		{ "Num Values", "winreg.winreg_QueryMultipleValues2.num_values", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_SetKeySecurity_sec_info,
+		{ "Sec Info", "winreg.winreg_SetKeySecurity.sec_info", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_StringBuf_size,
+		{ "Size", "winreg.winreg_StringBuf.size", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_SecBuf_sd,
+		{ "Sd", "winreg.winreg_SecBuf.sd", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_winreg_winreg_QueryInfoKey_secdescsize,
 		{ "Secdescsize", "winreg.winreg_QueryInfoKey.secdescsize", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryValue_data_length,
-		{ "Data Length", "winreg.winreg_QueryValue.data_length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_KeySecurityAttribute_inherit,
-		{ "Inherit", "winreg.KeySecurityAttribute.inherit", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_AccessMask_KEY_NOTIFY,
-		{ "Key Notify", "winreg.winreg_AccessMask.KEY_NOTIFY", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_NOTIFY_tfs), ( 0x00010 ), NULL, HFILL }},
-	{ &hf_winreg_winreg_ReplaceKey_handle,
-		{ "Handle", "winreg.winreg_ReplaceKey.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryInfoKey_max_valnamelen,
-		{ "Max Valnamelen", "winreg.winreg_QueryInfoKey.max_valnamelen", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_NotifyChangeKeyValue_string1,
-		{ "String1", "winreg.winreg_NotifyChangeKeyValue.string1", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_AccessMask_KEY_WOW64_64KEY,
-		{ "Key Wow64 64key", "winreg.winreg_AccessMask.KEY_WOW64_64KEY", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_WOW64_64KEY_tfs), ( 0x00100 ), NULL, HFILL }},
 	{ &hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_SECURITY,
 		{ "Reg Notify Change Security", "winreg.winreg_NotifyChangeType.REG_NOTIFY_CHANGE_SECURITY", FT_BOOLEAN, 32, TFS(&winreg_NotifyChangeType_REG_NOTIFY_CHANGE_SECURITY_tfs), ( 0x00000008 ), NULL, HFILL }},
-	{ &hf_winreg_handle,
-		{ "Handle", "winreg.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_AccessMask_KEY_CREATE_SUB_KEY,
-		{ "Key Create Sub Key", "winreg.winreg_AccessMask.KEY_CREATE_SUB_KEY", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_CREATE_SUB_KEY_tfs), ( 0x00004 ), NULL, HFILL }},
-	{ &hf_winreg_werror,
-		{ "Windows Error", "winreg.werror", FT_UINT32, BASE_HEX, VALS(WERR_errors), 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryInfoKey_classname,
-		{ "Classname", "winreg.winreg_QueryInfoKey.classname", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_InitiateSystemShutdownEx_hostname,
-		{ "Hostname", "winreg.winreg_InitiateSystemShutdownEx.hostname", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_EnumKey_last_changed_time,
-		{ "Last Changed Time", "winreg.winreg_EnumKey.last_changed_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_KeySecurityData_data,
-		{ "Data", "winreg.KeySecurityData.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_OpenHKCU_access_mask,
-		{ "Access Mask", "winreg.winreg_OpenHKCU.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryMultipleValues_buffer_size,
-		{ "Buffer Size", "winreg.winreg_QueryMultipleValues.buffer_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryInfoKey_num_values,
-		{ "Num Values", "winreg.winreg_QueryInfoKey.num_values", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_String_name_len,
-		{ "Name Len", "winreg.winreg_String.name_len", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_SetValue_name,
+		{ "Name", "winreg.winreg_SetValue.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_RestoreKey_flags,
+		{ "Flags", "winreg.winreg_RestoreKey.flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_QueryMultipleValue_ve_type,
+		{ "Ve Type", "winreg.QueryMultipleValue.ve_type", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_CreateKey_secdesc,
+		{ "Secdesc", "winreg.winreg_CreateKey.secdesc", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_DeleteKeyEx_reserved,
+		{ "Reserved", "winreg.winreg_DeleteKeyEx.reserved", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_InitiateSystemShutdownEx_force_apps,
+		{ "Force Apps", "winreg.winreg_InitiateSystemShutdownEx.force_apps", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_SetValue_type,
+		{ "Type", "winreg.winreg_SetValue.type", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_opnum,
+		{ "Operation", "winreg.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_EnumValue_name,
+		{ "Name", "winreg.winreg_EnumValue.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_LoadKey_filename,
+		{ "Filename", "winreg.winreg_LoadKey.filename", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_winreg_winreg_AccessMask_KEY_CREATE_LINK,
 		{ "Key Create Link", "winreg.winreg_AccessMask.KEY_CREATE_LINK", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_CREATE_LINK_tfs), ( 0x00020 ), NULL, HFILL }},
+	{ &hf_winreg_winreg_DeleteValue_value,
+		{ "Value", "winreg.winreg_DeleteValue.value", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryMultipleValues2_offered,
+		{ "Offered", "winreg.winreg_QueryMultipleValues2.offered", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryMultipleValues_values_in,
+		{ "Values In", "winreg.winreg_QueryMultipleValues.values_in", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_AccessMask_KEY_NOTIFY,
+		{ "Key Notify", "winreg.winreg_AccessMask.KEY_NOTIFY", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_NOTIFY_tfs), ( 0x00010 ), NULL, HFILL }},
+	{ &hf_winreg_winreg_OpenKey_parent_handle,
+		{ "Parent Handle", "winreg.winreg_OpenKey.parent_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryInfoKey_num_subkeys,
+		{ "Num Subkeys", "winreg.winreg_QueryInfoKey.num_subkeys", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_AccessMask_KEY_WOW64_32KEY,
+		{ "Key Wow64 32key", "winreg.winreg_AccessMask.KEY_WOW64_32KEY", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_WOW64_32KEY_tfs), ( 0x00200 ), NULL, HFILL }},
+	{ &hf_winreg_winreg_SaveKeyEx_sec_attrib,
+		{ "Sec Attrib", "winreg.winreg_SaveKeyEx.sec_attrib", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryInfoKey_last_changed_time,
+		{ "Last Changed Time", "winreg.winreg_QueryInfoKey.last_changed_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_KeyOptions_REG_OPTION_OPEN_LINK,
+		{ "Reg Option Open Link", "winreg.winreg_KeyOptions.REG_OPTION_OPEN_LINK", FT_BOOLEAN, 32, TFS(&winreg_KeyOptions_REG_OPTION_OPEN_LINK_tfs), ( 0x00000008 ), NULL, HFILL }},
+	{ &hf_winreg_winreg_OpenHKPD_access_mask,
+		{ "Access Mask", "winreg.winreg_OpenHKPD.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
 	{ &hf_winreg_winreg_AbortSystemShutdown_server,
 		{ "Server", "winreg.winreg_AbortSystemShutdown.server", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryValue_type,
+		{ "Type", "winreg.winreg_QueryValue.type", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_sd_actual_size,
+		{ "Actual Size", "winreg.sd.actual_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_RestoreKeyFlags_REG_FORCE_RESTORE,
+		{ "Reg Force Restore", "winreg.winreg_RestoreKeyFlags.REG_FORCE_RESTORE", FT_BOOLEAN, 32, TFS(&winreg_RestoreKeyFlags_REG_FORCE_RESTORE_tfs), ( 0x00000008 ), NULL, HFILL }},
+	{ &hf_winreg_winreg_SecBuf_inherit,
+		{ "Inherit", "winreg.winreg_SecBuf.inherit", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_SetValue_size,
+		{ "Size", "winreg.winreg_SetValue.size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_winreg_winreg_SaveKey_handle,
 		{ "Handle", "winreg.winreg_SaveKey.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_OpenKey_keyname,
-		{ "Keyname", "winreg.winreg_OpenKey.keyname", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_KeySecurityAttribute_sec_data,
-		{ "Sec Data", "winreg.KeySecurityAttribute.sec_data", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_opnum,
-		{ "Operation", "winreg.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_LAST_SET,
+		{ "Reg Notify Change Last Set", "winreg.winreg_NotifyChangeType.REG_NOTIFY_CHANGE_LAST_SET", FT_BOOLEAN, 32, TFS(&winreg_NotifyChangeType_REG_NOTIFY_CHANGE_LAST_SET_tfs), ( 0x00000004 ), NULL, HFILL }},
+	{ &hf_winreg_winreg_ReplaceKey_handle,
+		{ "Handle", "winreg.winreg_ReplaceKey.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_GetVersion_version,
+		{ "Version", "winreg.winreg_GetVersion.version", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_winreg_winreg_ReplaceKey_old_file,
 		{ "Old File", "winreg.winreg_ReplaceKey.old_file", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_SetValue_type,
-		{ "Type", "winreg.winreg_SetValue.type", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_ValNameBuf_length,
-		{ "Length", "winreg.winreg_ValNameBuf.length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_AccessMask_KEY_QUERY_VALUE,
+		{ "Key Query Value", "winreg.winreg_AccessMask.KEY_QUERY_VALUE", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_QUERY_VALUE_tfs), ( 0x00001 ), NULL, HFILL }},
+	{ &hf_winreg_winreg_CreateKey_action_taken,
+		{ "Action Taken", "winreg.winreg_CreateKey.action_taken", FT_UINT32, BASE_DEC, VALS(winreg_winreg_CreateAction_vals), 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryInfoKey_num_values,
+		{ "Num Values", "winreg.winreg_QueryInfoKey.num_values", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_RestoreKeyFlags_REG_WHOLE_HIVE_VOLATILE,
+		{ "Reg Whole Hive Volatile", "winreg.winreg_RestoreKeyFlags.REG_WHOLE_HIVE_VOLATILE", FT_BOOLEAN, 32, TFS(&winreg_RestoreKeyFlags_REG_WHOLE_HIVE_VOLATILE_tfs), ( 0x00000001 ), NULL, HFILL }},
+	{ &hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_NAME,
+		{ "Reg Notify Change Name", "winreg.winreg_NotifyChangeType.REG_NOTIFY_CHANGE_NAME", FT_BOOLEAN, 32, TFS(&winreg_NotifyChangeType_REG_NOTIFY_CHANGE_NAME_tfs), ( 0x00000001 ), NULL, HFILL }},
+	{ &hf_winreg_winreg_AccessMask_KEY_SET_VALUE,
+		{ "Key Set Value", "winreg.winreg_AccessMask.KEY_SET_VALUE", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_SET_VALUE_tfs), ( 0x00002 ), NULL, HFILL }},
+	{ &hf_winreg_winreg_EnumKey_enum_index,
+		{ "Enum Index", "winreg.winreg_EnumKey.enum_index", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_RestoreKey_handle,
+		{ "Handle", "winreg.winreg_RestoreKey.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_SetValue_data,
+		{ "Data", "winreg.winreg_SetValue.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_winreg_winreg_InitiateSystemShutdown_force_apps,
 		{ "Force Apps", "winreg.winreg_InitiateSystemShutdown.force_apps", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_StringBuf_name,
-		{ "Name", "winreg.winreg_StringBuf.name", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_SetValue_name,
-		{ "Name", "winreg.winreg_SetValue.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_DeleteKeyEx_access_mask,
-		{ "Access Mask", "winreg.winreg_DeleteKeyEx.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_String_name_size,
-		{ "Name Size", "winreg.winreg_String.name_size", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_KeySecurityData_size,
-		{ "Size", "winreg.KeySecurityData.size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_InitiateSystemShutdownEx_do_reboot,
-		{ "Do Reboot", "winreg.winreg_InitiateSystemShutdownEx.do_reboot", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_OpenHKPD_access_mask,
-		{ "Access Mask", "winreg.winreg_OpenHKPD.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_EnumValue_value,
-		{ "Value", "winreg.winreg_EnumValue.value", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_QueryMultipleValue_ve_valuelen,
-		{ "Ve Valuelen", "winreg.QueryMultipleValue.ve_valuelen", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_EnumValue_enum_index,
-		{ "Enum Index", "winreg.winreg_EnumValue.enum_index", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_InitiateSystemShutdownEx_force_apps,
-		{ "Force Apps", "winreg.winreg_InitiateSystemShutdownEx.force_apps", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryMultipleValues2_key_handle,
-		{ "Key Handle", "winreg.winreg_QueryMultipleValues2.key_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_SaveKeyEx_sec_attrib,
-		{ "Sec Attrib", "winreg.winreg_SaveKeyEx.sec_attrib", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_NotifyChangeKeyValue_string2,
-		{ "String2", "winreg.winreg_NotifyChangeKeyValue.string2", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_CreateKey_name,
-		{ "Name", "winreg.winreg_CreateKey.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryMultipleValues2_needed,
-		{ "Needed", "winreg.winreg_QueryMultipleValues2.needed", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_NotifyChangeKeyValue_string1,
+		{ "String1", "winreg.winreg_NotifyChangeKeyValue.string1", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_SaveKeyEx_flags,
+		{ "Flags", "winreg.winreg_SaveKeyEx.flags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryMultipleValues_buffer,
+		{ "Buffer", "winreg.winreg_QueryMultipleValues.buffer", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryInfoKey_classname,
+		{ "Classname", "winreg.winreg_QueryInfoKey.classname", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_AccessMask_KEY_WOW64_64KEY,
+		{ "Key Wow64 64key", "winreg.winreg_AccessMask.KEY_WOW64_64KEY", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_WOW64_64KEY_tfs), ( 0x00100 ), NULL, HFILL }},
+	{ &hf_winreg_winreg_ReplaceKey_subkey,
+		{ "Subkey", "winreg.winreg_ReplaceKey.subkey", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_sd_max_size,
+		{ "Max Size", "winreg.sd.max_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryInfoKey_max_classlen,
+		{ "Max Classlen", "winreg.winreg_QueryInfoKey.max_classlen", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_ValNameBuf_length,
+		{ "Length", "winreg.winreg_ValNameBuf.length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_NotifyChangeKeyValue_notify_filter,
+		{ "Notify Filter", "winreg.winreg_NotifyChangeKeyValue.notify_filter", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_UnLoadKey_subkey,
+		{ "Subkey", "winreg.winreg_UnLoadKey.subkey", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_winreg_winreg_ReplaceKey_new_file,
 		{ "New File", "winreg.winreg_ReplaceKey.new_file", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_RestoreKeyFlags_REG_REFRESH_HIVE,
-		{ "Reg Refresh Hive", "winreg.winreg_RestoreKeyFlags.REG_REFRESH_HIVE", FT_BOOLEAN, 32, TFS(&winreg_RestoreKeyFlags_REG_REFRESH_HIVE_tfs), ( 0x00000002 ), NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryInfoKey_num_subkeys,
-		{ "Num Subkeys", "winreg.winreg_QueryInfoKey.num_subkeys", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_DeleteValue_value,
-		{ "Value", "winreg.winreg_DeleteValue.value", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_EnumKey_enum_index,
-		{ "Enum Index", "winreg.winreg_EnumKey.enum_index", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_SecBuf_inherit,
-		{ "Inherit", "winreg.winreg_SecBuf.inherit", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_OpenKey_options,
-		{ "Options", "winreg.winreg_OpenKey.options", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_DeleteKeyEx_key,
-		{ "Key", "winreg.winreg_DeleteKeyEx.key", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryMultipleValues2_values_in,
-		{ "Values In", "winreg.winreg_QueryMultipleValues2.values_in", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_SaveKeyEx_filename,
+		{ "Filename", "winreg.winreg_SaveKeyEx.filename", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_winreg_QueryMultipleValue_ve_valuename,
 		{ "Ve Valuename", "winreg.QueryMultipleValue.ve_valuename", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_ValNameBuf_name,
-		{ "Name", "winreg.winreg_ValNameBuf.name", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_UnLoadKey_subkey,
-		{ "Subkey", "winreg.winreg_UnLoadKey.subkey", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_SaveKey_filename,
-		{ "Filename", "winreg.winreg_SaveKey.filename", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryMultipleValues2_offered,
-		{ "Offered", "winreg.winreg_QueryMultipleValues2.offered", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_QueryMultipleValue_ve_type,
-		{ "Ve Type", "winreg.QueryMultipleValue.ve_type", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryInfoKey_max_subkeylen,
-		{ "Max Subkeylen", "winreg.winreg_QueryInfoKey.max_subkeylen", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_DeleteKeyEx_handle,
-		{ "Handle", "winreg.winreg_DeleteKeyEx.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_KeyOptions_REG_OPTION_CREATE_LINK,
-		{ "Reg Option Create Link", "winreg.winreg_KeyOptions.REG_OPTION_CREATE_LINK", FT_BOOLEAN, 32, TFS(&winreg_KeyOptions_REG_OPTION_CREATE_LINK_tfs), ( 0x00000002 ), NULL, HFILL }},
-	{ &hf_winreg_winreg_InitiateSystemShutdownEx_timeout,
-		{ "Timeout", "winreg.winreg_InitiateSystemShutdownEx.timeout", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_CreateKey_action_taken,
-		{ "Action Taken", "winreg.winreg_CreateKey.action_taken", FT_UINT32, BASE_DEC, VALS(winreg_winreg_CreateAction_vals), 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_StringBuf_size,
-		{ "Size", "winreg.winreg_StringBuf.size", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryMultipleValues_buffer,
-		{ "Buffer", "winreg.winreg_QueryMultipleValues.buffer", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_GetVersion_version,
-		{ "Version", "winreg.winreg_GetVersion.version", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_DeleteKey_key,
-		{ "Key", "winreg.winreg_DeleteKey.key", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_AccessMask_KEY_QUERY_VALUE,
-		{ "Key Query Value", "winreg.winreg_AccessMask.KEY_QUERY_VALUE", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_QUERY_VALUE_tfs), ( 0x00001 ), NULL, HFILL }},
-	{ &hf_winreg_winreg_NotifyChangeKeyValue_unknown,
-		{ "Unknown", "winreg.winreg_NotifyChangeKeyValue.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_RestoreKeyFlags_REG_NO_LAZY_FLUSH,
-		{ "Reg No Lazy Flush", "winreg.winreg_RestoreKeyFlags.REG_NO_LAZY_FLUSH", FT_BOOLEAN, 32, TFS(&winreg_RestoreKeyFlags_REG_NO_LAZY_FLUSH_tfs), ( 0x00000004 ), NULL, HFILL }},
-	{ &hf_winreg_winreg_GetKeySecurity_sec_info,
-		{ "Sec Info", "winreg.winreg_GetKeySecurity.sec_info", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryMultipleValues2_key_handle,
+		{ "Key Handle", "winreg.winreg_QueryMultipleValues2.key_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_KeySecurityData_size,
+		{ "Size", "winreg.KeySecurityData.size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_winreg_winreg_KeyOptions_REG_OPTION_BACKUP_RESTORE,
 		{ "Reg Option Backup Restore", "winreg.winreg_KeyOptions.REG_OPTION_BACKUP_RESTORE", FT_BOOLEAN, 32, TFS(&winreg_KeyOptions_REG_OPTION_BACKUP_RESTORE_tfs), ( 0x00000004 ), NULL, HFILL }},
-	{ &hf_winreg_winreg_AccessMask_KEY_ENUMERATE_SUB_KEYS,
-		{ "Key Enumerate Sub Keys", "winreg.winreg_AccessMask.KEY_ENUMERATE_SUB_KEYS", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_ENUMERATE_SUB_KEYS_tfs), ( 0x00008 ), NULL, HFILL }},
-	{ &hf_winreg_winreg_CreateKey_keyclass,
-		{ "Keyclass", "winreg.winreg_CreateKey.keyclass", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_SetKeySecurity_sec_info,
-		{ "Sec Info", "winreg.winreg_SetKeySecurity.sec_info", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_EnumValue_name,
-		{ "Name", "winreg.winreg_EnumValue.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryMultipleValues2_num_values,
-		{ "Num Values", "winreg.winreg_QueryMultipleValues2.num_values", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_InitiateSystemShutdown_hostname,
-		{ "Hostname", "winreg.winreg_InitiateSystemShutdown.hostname", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_EnumKey_name,
+		{ "Name", "winreg.winreg_EnumKey.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_LoadKey_keyname,
+		{ "Keyname", "winreg.winreg_LoadKey.keyname", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryMultipleValues_key_handle,
+		{ "Key Handle", "winreg.winreg_QueryMultipleValues.key_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_EnumValue_type,
+		{ "Type", "winreg.winreg_EnumValue.type", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_EnumKey_last_changed_time,
+		{ "Last Changed Time", "winreg.winreg_EnumKey.last_changed_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_EnumValue_size,
+		{ "Size", "winreg.winreg_EnumValue.size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_SaveKey_sec_attrib,
+		{ "Sec Attrib", "winreg.winreg_SaveKey.sec_attrib", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_sd,
+		{ "KeySecurityData", "winreg.sd", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_KeyOptions_REG_OPTION_CREATE_LINK,
+		{ "Reg Option Create Link", "winreg.winreg_KeyOptions.REG_OPTION_CREATE_LINK", FT_BOOLEAN, 32, TFS(&winreg_KeyOptions_REG_OPTION_CREATE_LINK_tfs), ( 0x00000002 ), NULL, HFILL }},
+	{ &hf_winreg_winreg_OpenKey_options,
+		{ "Options", "winreg.winreg_OpenKey.options", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_SaveKey_filename,
+		{ "Filename", "winreg.winreg_SaveKey.filename", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_winreg_winreg_QueryValue_data,
 		{ "Data", "winreg.winreg_QueryValue.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_winreg_winreg_QueryMultipleValues2_buffer,
 		{ "Buffer", "winreg.winreg_QueryMultipleValues2.buffer", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_QueryMultipleValue_ve_valueptr,
-		{ "Ve Valueptr", "winreg.QueryMultipleValue.ve_valueptr", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_AccessMask_KEY_WOW64_32KEY,
-		{ "Key Wow64 32key", "winreg.winreg_AccessMask.KEY_WOW64_32KEY", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_WOW64_32KEY_tfs), ( 0x00200 ), NULL, HFILL }},
-	{ &hf_winreg_winreg_EnumValue_length,
-		{ "Length", "winreg.winreg_EnumValue.length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_RestoreKeyFlags_REG_WHOLE_HIVE_VOLATILE,
-		{ "Reg Whole Hive Volatile", "winreg.winreg_RestoreKeyFlags.REG_WHOLE_HIVE_VOLATILE", FT_BOOLEAN, 32, TFS(&winreg_RestoreKeyFlags_REG_WHOLE_HIVE_VOLATILE_tfs), ( 0x00000001 ), NULL, HFILL }},
-	{ &hf_winreg_winreg_KeyOptions_REG_OPTION_VOLATILE,
-		{ "Reg Option Volatile", "winreg.winreg_KeyOptions.REG_OPTION_VOLATILE", FT_BOOLEAN, 32, TFS(&winreg_KeyOptions_REG_OPTION_VOLATILE_tfs), ( 0x00000001 ), NULL, HFILL }},
+	{ &hf_winreg_winreg_InitiateSystemShutdown_hostname,
+		{ "Hostname", "winreg.winreg_InitiateSystemShutdown.hostname", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_UnLoadKey_handle,
+		{ "Handle", "winreg.winreg_UnLoadKey.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryMultipleValues_values_out,
+		{ "Values Out", "winreg.winreg_QueryMultipleValues.values_out", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_KeySecurityData_data,
+		{ "Data", "winreg.KeySecurityData.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_winreg_winreg_OpenKey_access_mask,
 		{ "Access Mask", "winreg.winreg_OpenKey.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_OpenKey_keyname,
+		{ "Keyname", "winreg.winreg_OpenKey.keyname", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_InitiateSystemShutdownEx_do_reboot,
+		{ "Do Reboot", "winreg.winreg_InitiateSystemShutdownEx.do_reboot", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_NotifyChangeKeyValue_watch_subtree,
+		{ "Watch Subtree", "winreg.winreg_NotifyChangeKeyValue.watch_subtree", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_DeleteKeyEx_access_mask,
+		{ "Access Mask", "winreg.winreg_DeleteKeyEx.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_DeleteKeyEx_key,
+		{ "Key", "winreg.winreg_DeleteKeyEx.key", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryValue_data_length,
+		{ "Data Length", "winreg.winreg_QueryValue.data_length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_KeySecurityData_len,
+		{ "Len", "winreg.KeySecurityData.len", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_ValNameBuf_size,
+		{ "Size", "winreg.winreg_ValNameBuf.size", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_CreateKey_name,
+		{ "Name", "winreg.winreg_CreateKey.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
 	{ &hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_ATTRIBUTES,
 		{ "Reg Notify Change Attributes", "winreg.winreg_NotifyChangeType.REG_NOTIFY_CHANGE_ATTRIBUTES", FT_BOOLEAN, 32, TFS(&winreg_NotifyChangeType_REG_NOTIFY_CHANGE_ATTRIBUTES_tfs), ( 0x00000002 ), NULL, HFILL }},
+	{ &hf_winreg_winreg_String_name_len,
+		{ "Name Len", "winreg.winreg_String.name_len", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_DeleteKey_key,
+		{ "Key", "winreg.winreg_DeleteKey.key", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryValue_data_size,
+		{ "Data Size", "winreg.winreg_QueryValue.data_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_system_name,
+		{ "System Name", "winreg.system_name", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_QueryMultipleValue_ve_valueptr,
+		{ "Ve Valueptr", "winreg.QueryMultipleValue.ve_valueptr", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_KeySecurityAttribute_data_size,
+		{ "Data Size", "winreg.KeySecurityAttribute.data_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_winreg_winreg_QueryMultipleValues_num_values,
 		{ "Num Values", "winreg.winreg_QueryMultipleValues.num_values", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_RestoreKey_handle,
-		{ "Handle", "winreg.winreg_RestoreKey.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_StringBuf_name,
+		{ "Name", "winreg.winreg_StringBuf.name", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_winreg_winreg_NotifyChangeKeyValue_unknown2,
 		{ "Unknown2", "winreg.winreg_NotifyChangeKeyValue.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryValue_data_size,
-		{ "Data Size", "winreg.winreg_QueryValue.data_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryMultipleValues2_values_out,
-		{ "Values Out", "winreg.winreg_QueryMultipleValues2.values_out", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryInfoKey_max_classlen,
-		{ "Max Classlen", "winreg.winreg_QueryInfoKey.max_classlen", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_CreateKey_new_handle,
-		{ "New Handle", "winreg.winreg_CreateKey.new_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_access_mask,
-		{ "Access Mask", "winreg.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_SecBuf_length,
-		{ "Length", "winreg.winreg_SecBuf.length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_NotifyChangeKeyValue_notify_filter,
-		{ "Notify Filter", "winreg.winreg_NotifyChangeKeyValue.notify_filter", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_SaveKeyEx_flags,
-		{ "Flags", "winreg.winreg_SaveKeyEx.flags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_ReplaceKey_subkey,
-		{ "Subkey", "winreg.winreg_ReplaceKey.subkey", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_InitiateSystemShutdownEx_reason,
-		{ "Reason", "winreg.winreg_InitiateSystemShutdownEx.reason", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryMultipleValues_values_in,
-		{ "Values In", "winreg.winreg_QueryMultipleValues.values_in", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_SetValue_data,
-		{ "Data", "winreg.winreg_SetValue.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_EnumValue_size,
-		{ "Size", "winreg.winreg_EnumValue.size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_SaveKeyEx_filename,
-		{ "Filename", "winreg.winreg_SaveKeyEx.filename", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_sd_offset,
+		{ "Offset", "winreg.sd.offset", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_ValNameBuf_name,
+		{ "Name", "winreg.winreg_ValNameBuf.name", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_winreg_winreg_StringBuf_length,
 		{ "Length", "winreg.winreg_StringBuf.length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_OpenKey_parent_handle,
-		{ "Parent Handle", "winreg.winreg_OpenKey.parent_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_sd_actual_size,
-		{ "Actual Size", "winreg.sd.actual_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_EnumKey_name,
-		{ "Name", "winreg.winreg_EnumKey.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryMultipleValues2_values_in,
+		{ "Values In", "winreg.winreg_QueryMultipleValues2.values_in", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_String_name_size,
+		{ "Name Size", "winreg.winreg_String.name_size", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_NotifyChangeKeyValue_unknown,
+		{ "Unknown", "winreg.winreg_NotifyChangeKeyValue.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_AccessMask_KEY_CREATE_SUB_KEY,
+		{ "Key Create Sub Key", "winreg.winreg_AccessMask.KEY_CREATE_SUB_KEY", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_CREATE_SUB_KEY_tfs), ( 0x00004 ), NULL, HFILL }},
+	{ &hf_winreg_winreg_RestoreKey_filename,
+		{ "Filename", "winreg.winreg_RestoreKey.filename", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_RestoreKeyFlags_REG_REFRESH_HIVE,
+		{ "Reg Refresh Hive", "winreg.winreg_RestoreKeyFlags.REG_REFRESH_HIVE", FT_BOOLEAN, 32, TFS(&winreg_RestoreKeyFlags_REG_REFRESH_HIVE_tfs), ( 0x00000002 ), NULL, HFILL }},
 	{ &hf_winreg_winreg_QueryInfoKey_max_valbufsize,
 		{ "Max Valbufsize", "winreg.winreg_QueryInfoKey.max_valbufsize", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_RestoreKey_flags,
-		{ "Flags", "winreg.winreg_RestoreKey.flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_EnumKey_keyclass,
-		{ "Keyclass", "winreg.winreg_EnumKey.keyclass", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_RestoreKeyFlags_REG_FORCE_RESTORE,
-		{ "Reg Force Restore", "winreg.winreg_RestoreKeyFlags.REG_FORCE_RESTORE", FT_BOOLEAN, 32, TFS(&winreg_RestoreKeyFlags_REG_FORCE_RESTORE_tfs), ( 0x00000008 ), NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryValue_type,
-		{ "Type", "winreg.winreg_QueryValue.type", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_KeySecurityData_len,
-		{ "Len", "winreg.KeySecurityData.len", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_String_name,
-		{ "Name", "winreg.winreg_String.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_sd,
-		{ "KeySecurityData", "winreg.sd", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_QueryInfoKey_last_changed_time,
-		{ "Last Changed Time", "winreg.winreg_QueryInfoKey.last_changed_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }},
-	{ &hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_LAST_SET,
-		{ "Reg Notify Change Last Set", "winreg.winreg_NotifyChangeType.REG_NOTIFY_CHANGE_LAST_SET", FT_BOOLEAN, 32, TFS(&winreg_NotifyChangeType_REG_NOTIFY_CHANGE_LAST_SET_tfs), ( 0x00000004 ), NULL, HFILL }},
-	{ &hf_winreg_winreg_AccessMask_KEY_SET_VALUE,
-		{ "Key Set Value", "winreg.winreg_AccessMask.KEY_SET_VALUE", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_SET_VALUE_tfs), ( 0x00002 ), NULL, HFILL }},
-	{ &hf_winreg_winreg_ValNameBuf_size,
-		{ "Size", "winreg.winreg_ValNameBuf.size", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_InitiateSystemShutdownEx_reason,
+		{ "Reason", "winreg.winreg_InitiateSystemShutdownEx.reason", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_EnumValue_length,
+		{ "Length", "winreg.winreg_EnumValue.length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryInfoKey_max_subkeylen,
+		{ "Max Subkeylen", "winreg.winreg_QueryInfoKey.max_subkeylen", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 	{ &hf_winreg_winreg_InitiateSystemShutdown_timeout,
 		{ "Timeout", "winreg.winreg_InitiateSystemShutdown.timeout", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_InitiateSystemShutdownEx_hostname,
+		{ "Hostname", "winreg.winreg_InitiateSystemShutdownEx.hostname", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_KeySecurityAttribute_inherit,
+		{ "Inherit", "winreg.KeySecurityAttribute.inherit", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_werror,
+		{ "Windows Error", "winreg.werror", FT_UINT32, BASE_HEX, VALS(WERR_errors), 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryMultipleValues2_values_out,
+		{ "Values Out", "winreg.winreg_QueryMultipleValues2.values_out", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_EnumKey_keyclass,
+		{ "Keyclass", "winreg.winreg_EnumKey.keyclass", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_CreateKey_keyclass,
+		{ "Keyclass", "winreg.winreg_CreateKey.keyclass", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_EnumValue_value,
+		{ "Value", "winreg.winreg_EnumValue.value", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_OpenHKCU_access_mask,
+		{ "Access Mask", "winreg.winreg_OpenHKCU.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_QueryValue_value_name,
+		{ "Value Name", "winreg.winreg_QueryValue.value_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+	{ &hf_winreg_winreg_RestoreKeyFlags_REG_NO_LAZY_FLUSH,
+		{ "Reg No Lazy Flush", "winreg.winreg_RestoreKeyFlags.REG_NO_LAZY_FLUSH", FT_BOOLEAN, 32, TFS(&winreg_RestoreKeyFlags_REG_NO_LAZY_FLUSH_tfs), ( 0x00000004 ), NULL, HFILL }},
 	};