dbghelp.dll

Description: Windows Image Helper

Version: 10.0.25291.1000

Architecture: 64-bit

Operating System: Windows NT

SHA256: d65dff2ebe90bf79fba62f3bb1f105a7

File Size: 2.1 MB

Uploaded At: April 20, 2026, 8:49 p.m.

Views: 25

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

(Ordinal: 1101, Address: 0x2fec0)
(Ordinal: 1102, Address: 0x30000)
(Ordinal: 1103, Address: 0x30450)
(Ordinal: 1104, Address: 0x304d0)
(Ordinal: 1105, Address: 0x31030)
(Ordinal: 1106, Address: 0x31110)
(Ordinal: 1107, Address: 0x301f0)
(Ordinal: 1108, Address: 0x30bb0)
(Ordinal: 1109, Address: 0x30f90)
(Ordinal: 1110, Address: 0x31070)
SymAllocDiaString (Ordinal: 1111, Address: 0x35a80)
SymFreeDiaString (Ordinal: 1112, Address: 0x35a70)
SymGetDiaSession (Ordinal: 1113, Address: 0x358d0)
SymGetDiaSource (Ordinal: 1114, Address: 0x35980)
(Ordinal: 1115, Address: 0x300d0)
(Ordinal: 1116, Address: 0x30270)
(Ordinal: 1117, Address: 0x34560)
(Ordinal: 1118, Address: 0x34650)
(Ordinal: 1119, Address: 0x35b20)
(Ordinal: 1120, Address: 0x33cb0)
SymGetLineFromAddrEx (Ordinal: 1121, Address: 0x301f0)
SymGetLineFromNameEx (Ordinal: 1122, Address: 0x30bb0)
SymGetLineNextEx (Ordinal: 1123, Address: 0x30f90)
SymGetLinePrevEx (Ordinal: 1124, Address: 0x31070)
SymGetOmapBlockBase (Ordinal: 1125, Address: 0x33140)
SymRegisterGetSourcePathPartCallback (Ordinal: 1126, Address: 0x35850)
SymRegisterSourceFileUrlListCallback (Ordinal: 1127, Address: 0x35830)
SymSetDiaSession (Ordinal: 1128, Address: 0x35a30)
SymSetServiceManager (Ordinal: 1129, Address: 0x35aa0)
_EFN_DumpImage (Ordinal: 1130, Address: 0x1fe10)
DbgHelpCreateUserDump (Ordinal: 1131, Address: 0x47260)
DbgHelpCreateUserDumpW (Ordinal: 1132, Address: 0x47270)
EnumDirTree (Ordinal: 1133, Address: 0x38d70)
EnumDirTreeW (Ordinal: 1134, Address: 0x38ea0)
EnumerateLoadedModules (Ordinal: 1135, Address: 0x324a0)
EnumerateLoadedModules64 (Ordinal: 1136, Address: 0x324a0)
EnumerateLoadedModulesEx (Ordinal: 1137, Address: 0x32560)
EnumerateLoadedModulesExW (Ordinal: 1138, Address: 0x325c0)
EnumerateLoadedModulesW64 (Ordinal: 1139, Address: 0x32500)
ExtensionApiVersion (Ordinal: 1140, Address: 0x1b8b0)
FindDebugInfoFile (Ordinal: 1141, Address: 0x37900)
FindDebugInfoFileEx (Ordinal: 1142, Address: 0x386b0)
FindDebugInfoFileExW (Ordinal: 1143, Address: 0x38660)
FindExecutableImage (Ordinal: 1144, Address: 0x36950)
FindExecutableImageEx (Ordinal: 1145, Address: 0x375b0)
FindExecutableImageExW (Ordinal: 1146, Address: 0x376f0)
FindFileInPath (Ordinal: 1147, Address: 0x368b0)
FindFileInSearchPath (Ordinal: 1148, Address: 0x36910)
GetSymLoadError (Ordinal: 1149, Address: 0x35d50)
GetTimestampForLoadedLibrary (Ordinal: 1150, Address: 0x24f60)
ImageDirectoryEntryToData (Ordinal: 1151, Address: 0x24ad0)
ImageDirectoryEntryToDataEx (Ordinal: 1152, Address: 0x248f0)
ImageNtHeader (Ordinal: 1153, Address: 0x247b0)
ImageRvaToSection (Ordinal: 1154, Address: 0x24af0)
ImageRvaToVa (Ordinal: 1155, Address: 0x24b60)
ImagehlpApiVersion (Ordinal: 1156, Address: 0x391d0)
ImagehlpApiVersionEx (Ordinal: 1157, Address: 0x391f0)
MakeSureDirectoryPathExists (Ordinal: 1158, Address: 0x38ff0)
MiniDumpReadDumpStream (Ordinal: 1159, Address: 0x1f2a67)
MiniDumpWriteDump (Ordinal: 1160, Address: 0x1f2a98)
RangeMapAddPeImageSections (Ordinal: 1161, Address: 0x59810)
RangeMapCreate (Ordinal: 1162, Address: 0x59770)
RangeMapFree (Ordinal: 1163, Address: 0x597d0)
RangeMapRead (Ordinal: 1164, Address: 0x59960)
RangeMapRemove (Ordinal: 1165, Address: 0x598d0)
RangeMapWrite (Ordinal: 1166, Address: 0x599d0)
RemoveInvalidModuleList (Ordinal: 1167, Address: 0x9b10)
ReportSymbolLoadSummary (Ordinal: 1168, Address: 0xb710)
SearchTreeForFile (Ordinal: 1169, Address: 0x38f00)
SearchTreeForFileW (Ordinal: 1170, Address: 0x38f30)
SetCheckUserInterruptShared (Ordinal: 1171, Address: 0x35d40)
SetSymLoadError (Ordinal: 1172, Address: 0x35d60)
StackWalk (Ordinal: 1173, Address: 0x4c280)
StackWalk2 (Ordinal: 1174, Address: 0x4bf30)
StackWalk64 (Ordinal: 1175, Address: 0x4c280)
StackWalkEx (Ordinal: 1176, Address: 0x4c410)
SymAddSourceStream (Ordinal: 1177, Address: 0x2f640)
SymAddSourceStreamA (Ordinal: 1178, Address: 0x2f5d0)
SymAddSourceStreamW (Ordinal: 1179, Address: 0x2f430)
SymAddSymbol (Ordinal: 1180, Address: 0x32a60)
SymAddSymbolW (Ordinal: 1181, Address: 0x32950)
SymAddrIncludeInlineTrace (Ordinal: 1182, Address: 0x346c0)
SymCleanup (Ordinal: 1183, Address: 0x2d240)
SymCompareInlineTrace (Ordinal: 1184, Address: 0x34cc0)
SymDeleteSymbol (Ordinal: 1185, Address: 0x32c30)
SymDeleteSymbolW (Ordinal: 1186, Address: 0x32ae0)
SymEnumLines (Ordinal: 1187, Address: 0x2fd30)
SymEnumLinesW (Ordinal: 1188, Address: 0x2fe00)
SymEnumProcesses (Ordinal: 1189, Address: 0x2e240)
SymEnumSourceFileTokens (Ordinal: 1190, Address: 0x2f9a0)
SymEnumSourceFiles (Ordinal: 1191, Address: 0x34530)
SymEnumSourceFilesW (Ordinal: 1192, Address: 0x34620)
SymEnumSourceLines (Ordinal: 1193, Address: 0x2fe70)
SymEnumSourceLinesW (Ordinal: 1194, Address: 0x2ffb0)
SymEnumSym (Ordinal: 1195, Address: 0x33df0)
SymEnumSymbols (Ordinal: 1196, Address: 0x332d0)
SymEnumSymbolsEx (Ordinal: 1197, Address: 0x33230)
SymEnumSymbolsExW (Ordinal: 1198, Address: 0x33300)
SymEnumSymbolsForAddr (Ordinal: 1199, Address: 0x33a10)
SymEnumSymbolsForAddrW (Ordinal: 1200, Address: 0x33b60)
SymEnumSymbolsW (Ordinal: 1201, Address: 0x33370)
SymEnumTypes (Ordinal: 1202, Address: 0x33fc0)
SymEnumTypesByName (Ordinal: 1203, Address: 0x34070)
SymEnumTypesByNameW (Ordinal: 1204, Address: 0x34140)
SymEnumTypesW (Ordinal: 1205, Address: 0x34010)
SymEnumerateModules (Ordinal: 1206, Address: 0x2e400)
SymEnumerateModules64 (Ordinal: 1207, Address: 0x2e400)
SymEnumerateModulesW64 (Ordinal: 1208, Address: 0x2e440)
SymEnumerateSymbols (Ordinal: 1209, Address: 0x2e5c0)
SymEnumerateSymbols64 (Ordinal: 1210, Address: 0x2e5c0)
SymEnumerateSymbolsW (Ordinal: 1211, Address: 0x2e610)
SymEnumerateSymbolsW64 (Ordinal: 1212, Address: 0x2e610)
SymFindDebugInfoFile (Ordinal: 1213, Address: 0x38790)
SymFindDebugInfoFileW (Ordinal: 1214, Address: 0x38880)
SymFindExecutableImage (Ordinal: 1215, Address: 0x37740)
SymFindExecutableImageW (Ordinal: 1216, Address: 0x37870)
SymFindFileInPath (Ordinal: 1217, Address: 0x36700)
SymFindFileInPathW (Ordinal: 1218, Address: 0x36840)
SymFromAddr (Ordinal: 1219, Address: 0x32d00)
SymFromAddrW (Ordinal: 1220, Address: 0x32d90)
SymFromIndex (Ordinal: 1221, Address: 0x33800)
SymFromIndexW (Ordinal: 1222, Address: 0x33870)
SymFromInlineContext (Ordinal: 1223, Address: 0x32ca0)
SymFromInlineContextW (Ordinal: 1224, Address: 0x32d30)
SymFromName (Ordinal: 1225, Address: 0x32f80)
SymFromNameW (Ordinal: 1226, Address: 0x33010)
SymFromToken (Ordinal: 1227, Address: 0x32dc0)
SymFromTokenW (Ordinal: 1228, Address: 0x32e70)
SymFunctionTableAccess (Ordinal: 1229, Address: 0x313a0)
SymFunctionTableAccess64 (Ordinal: 1230, Address: 0x313a0)
SymFunctionTableAccess64AccessRoutines (Ordinal: 1231, Address: 0x313c0)
SymGetExtendedOption (Ordinal: 1232, Address: 0x2d290)
SymGetFileLineOffsets64 (Ordinal: 1233, Address: 0x26ec0)
SymGetHomeDirectory (Ordinal: 1234, Address: 0x2dc20)
SymGetHomeDirectoryW (Ordinal: 1235, Address: 0x2db60)
SymGetLineFromAddr (Ordinal: 1236, Address: 0x301c0)
SymGetLineFromAddr64 (Ordinal: 1237, Address: 0x301c0)
SymGetLineFromAddrW64 (Ordinal: 1238, Address: 0x30420)
SymGetLineFromInlineContext (Ordinal: 1239, Address: 0x30090)
SymGetLineFromInlineContextW (Ordinal: 1240, Address: 0x30230)
SymGetLineFromName (Ordinal: 1241, Address: 0x30b70)
SymGetLineFromName64 (Ordinal: 1242, Address: 0x30b70)
SymGetLineFromNameW64 (Ordinal: 1243, Address: 0x30490)
SymGetLineNext (Ordinal: 1244, Address: 0x30f70)
SymGetLineNext64 (Ordinal: 1245, Address: 0x30f70)
SymGetLineNextW64 (Ordinal: 1246, Address: 0x31010)
SymGetLinePrev (Ordinal: 1247, Address: 0x31050)
SymGetLinePrev64 (Ordinal: 1248, Address: 0x31050)
SymGetLinePrevW64 (Ordinal: 1249, Address: 0x310f0)
SymGetModuleBase (Ordinal: 1250, Address: 0x31c80)
SymGetModuleBase64 (Ordinal: 1251, Address: 0x31c80)
SymGetModuleInfo (Ordinal: 1252, Address: 0x317e0)
SymGetModuleInfo64 (Ordinal: 1253, Address: 0x317e0)
SymGetModuleInfoW (Ordinal: 1254, Address: 0x318a0)
SymGetModuleInfoW64 (Ordinal: 1255, Address: 0x318a0)
SymGetOmaps (Ordinal: 1256, Address: 0x33050)
SymGetOptions (Ordinal: 1257, Address: 0x2de70)
SymGetParentWindow (Ordinal: 1258, Address: 0x2d330)
SymGetScope (Ordinal: 1259, Address: 0x33650)
SymGetScopeW (Ordinal: 1260, Address: 0x336d0)
SymGetSearchPath (Ordinal: 1261, Address: 0x31fb0)
SymGetSearchPathW (Ordinal: 1262, Address: 0x32040)
SymGetSourceFile (Ordinal: 1263, Address: 0x2ef10)
SymGetSourceFileChecksum (Ordinal: 1264, Address: 0x2f270)
SymGetSourceFileChecksumW (Ordinal: 1265, Address: 0x2f300)
SymGetSourceFileFromToken (Ordinal: 1266, Address: 0x2f650)
SymGetSourceFileFromTokenByTokenName (Ordinal: 1267, Address: 0x2f680)
SymGetSourceFileFromTokenByTokenNameW (Ordinal: 1268, Address: 0x2f750)
SymGetSourceFileFromTokenW (Ordinal: 1269, Address: 0x2f7e0)
SymGetSourceFileToken (Ordinal: 1270, Address: 0x2f110)
SymGetSourceFileTokenByTokenName (Ordinal: 1271, Address: 0x2f050)
SymGetSourceFileTokenByTokenNameW (Ordinal: 1272, Address: 0x2f150)
SymGetSourceFileTokenW (Ordinal: 1273, Address: 0x2f230)
SymGetSourceFileW (Ordinal: 1274, Address: 0x2efb0)
SymGetSourceVarFromToken (Ordinal: 1275, Address: 0x2f810)
SymGetSourceVarFromTokenW (Ordinal: 1276, Address: 0x2f8f0)
SymGetSymFromAddr (Ordinal: 1277, Address: 0x2e770)
SymGetSymFromAddr64 (Ordinal: 1278, Address: 0x2e770)
SymGetSymFromName (Ordinal: 1279, Address: 0x2e980)
SymGetSymFromName64 (Ordinal: 1280, Address: 0x2e980)
SymGetSymNext (Ordinal: 1281, Address: 0x2ec70)
SymGetSymNext64 (Ordinal: 1282, Address: 0x2ec70)
SymGetSymPrev (Ordinal: 1283, Address: 0x2ec90)
SymGetSymPrev64 (Ordinal: 1284, Address: 0x2ec90)
SymGetSymbolFile (Ordinal: 1285, Address: 0x46e20)
SymGetSymbolFileW (Ordinal: 1286, Address: 0x46940)
SymGetTypeFromName (Ordinal: 1287, Address: 0x341a0)
SymGetTypeFromNameW (Ordinal: 1288, Address: 0x34270)
SymGetTypeInfo (Ordinal: 1289, Address: 0x355f0)
SymGetTypeInfoEx (Ordinal: 1290, Address: 0x35b90)
SymGetUnwindInfo (Ordinal: 1291, Address: 0x31620)
SymInitialize (Ordinal: 1292, Address: 0x2cf70)
SymInitializeW (Ordinal: 1293, Address: 0x2cca0)
SymLoadModule (Ordinal: 1294, Address: 0x31f10)
SymLoadModule64 (Ordinal: 1295, Address: 0x31f10)
SymLoadModuleEx (Ordinal: 1296, Address: 0x31dd0)
SymLoadModuleExW (Ordinal: 1297, Address: 0x31eb0)
SymMatchFileName (Ordinal: 1298, Address: 0x31130)
SymMatchFileNameW (Ordinal: 1299, Address: 0x31240)
SymMatchString (Ordinal: 1300, Address: 0x343b0)
SymMatchStringA (Ordinal: 1301, Address: 0x34400)
SymMatchStringW (Ordinal: 1302, Address: 0x34410)
SymNext (Ordinal: 1303, Address: 0x2ea00)
SymNextW (Ordinal: 1304, Address: 0x2eaa0)
SymPrev (Ordinal: 1305, Address: 0x2eac0)
SymPrevW (Ordinal: 1306, Address: 0x2eb60)
SymQueryInlineTrace (Ordinal: 1307, Address: 0x34900)
SymRefreshModuleList (Ordinal: 1308, Address: 0x2cba0)
SymRegisterCallback (Ordinal: 1309, Address: 0x32620)
SymRegisterCallback64 (Ordinal: 1310, Address: 0x32620)
SymRegisterCallbackW64 (Ordinal: 1311, Address: 0x326b0)
SymRegisterFunctionEntryCallback (Ordinal: 1312, Address: 0x31320)
SymRegisterFunctionEntryCallback64 (Ordinal: 1313, Address: 0x31320)
SymSearch (Ordinal: 1314, Address: 0x33510)
SymSearchW (Ordinal: 1315, Address: 0x335d0)
SymSetContext (Ordinal: 1316, Address: 0x2de80)
SymSetExtendedOption (Ordinal: 1317, Address: 0x2d2b0)
SymSetHomeDirectory (Ordinal: 1318, Address: 0x2dac0)
SymSetHomeDirectoryW (Ordinal: 1319, Address: 0x2da40)
SymSetOptions (Ordinal: 1320, Address: 0x2dca0)
SymSetParentWindow (Ordinal: 1321, Address: 0x2d2e0)
SymSetScopeFromAddr (Ordinal: 1322, Address: 0x2e010)
SymSetScopeFromIndex (Ordinal: 1323, Address: 0x2e030)
SymSetScopeFromInlineContext (Ordinal: 1324, Address: 0x2df40)
SymSetSearchPath (Ordinal: 1325, Address: 0x320b0)
SymSetSearchPathW (Ordinal: 1326, Address: 0x32100)
SymSrvDeltaName (Ordinal: 1327, Address: 0x45c80)
SymSrvDeltaNameW (Ordinal: 1328, Address: 0x45a70)
SymSrvGetFileIndexInfo (Ordinal: 1329, Address: 0x47040)
SymSrvGetFileIndexInfoW (Ordinal: 1330, Address: 0x47120)
SymSrvGetFileIndexString (Ordinal: 1331, Address: 0x46460)
SymSrvGetFileIndexStringW (Ordinal: 1332, Address: 0x46320)
SymSrvGetFileIndexes (Ordinal: 1333, Address: 0x462b0)
SymSrvGetFileIndexesW (Ordinal: 1334, Address: 0x461e0)
SymSrvGetSupplement (Ordinal: 1335, Address: 0x45e90)
SymSrvGetSupplementW (Ordinal: 1336, Address: 0x45d70)
SymSrvIsStore (Ordinal: 1337, Address: 0x45a20)
SymSrvIsStoreW (Ordinal: 1338, Address: 0x45920)
SymSrvStoreFile (Ordinal: 1339, Address: 0x46600)
SymSrvStoreFileW (Ordinal: 1340, Address: 0x46530)
SymSrvStoreSupplement (Ordinal: 1341, Address: 0x46100)
SymSrvStoreSupplementW (Ordinal: 1342, Address: 0x45f60)
SymUnDName (Ordinal: 1343, Address: 0x31f50)
SymUnDName64 (Ordinal: 1344, Address: 0x31f50)
SymUnloadModule (Ordinal: 1345, Address: 0x31cf0)
SymUnloadModule64 (Ordinal: 1346, Address: 0x31cf0)
UnDecorateSymbolName (Ordinal: 1347, Address: 0x35bf0)
UnDecorateSymbolNameW (Ordinal: 1348, Address: 0x35c90)
WinDbgExtensionDllInit (Ordinal: 1349, Address: 0x1b8d0)
block (Ordinal: 1350, Address: 0x1dee0)
chksym (Ordinal: 1351, Address: 0x1dcd0)
dbghelp (Ordinal: 1352, Address: 0x2e1a0)
dh (Ordinal: 1353, Address: 0x1fdf0)
fptr (Ordinal: 1354, Address: 0x1bad0)
homedir (Ordinal: 1355, Address: 0x1e3c0)
inlinedbg (Ordinal: 1356, Address: 0x1da30)
itoldyouso (Ordinal: 1357, Address: 0x1dac0)
lmi (Ordinal: 1358, Address: 0x1c630)
lminfo (Ordinal: 1359, Address: 0x1c2a0)
omap (Ordinal: 1360, Address: 0x1e140)
optdbgdump (Ordinal: 1361, Address: 0x22bf0)
optdbgdumpaddr (Ordinal: 1362, Address: 0x22d80)
srcfiles (Ordinal: 1363, Address: 0x1e600)
stack_force_ebp (Ordinal: 1364, Address: 0x1bdc0)
stackdbg (Ordinal: 1365, Address: 0x1bbb0)
sym (Ordinal: 1366, Address: 0x1c090)
vc7fpo (Ordinal: 1367, Address: 0x1bb60)

Imported DLLs & Functions

api-ms-win-core-com-l1-1-0.dll

CoTaskMemAlloc (Address: 0x1801ab8a8)
CoTaskMemFree (Address: 0x1801ab8a0)

api-ms-win-core-debug-l1-1-0.dll

DebugBreak (Address: 0x1801ab8b8)
IsDebuggerPresent (Address: 0x1801ab8c8)
OutputDebugStringA (Address: 0x1801ab8d0)
OutputDebugStringW (Address: 0x1801ab8c0)

api-ms-win-core-errorhandling-l1-1-0.dll

GetLastError (Address: 0x1801ab8f0)
RaiseException (Address: 0x1801ab900)
SetErrorMode (Address: 0x1801ab8e8)
SetLastError (Address: 0x1801ab8f8)
SetUnhandledExceptionFilter (Address: 0x1801ab8e0)
UnhandledExceptionFilter (Address: 0x1801ab908)

api-ms-win-core-file-l1-1-0.dll

CreateDirectoryA (Address: 0x1801ab980)
CreateDirectoryW (Address: 0x1801ab938)
CreateFileA (Address: 0x1801ab920)
CreateFileW (Address: 0x1801ab970)
DeleteFileW (Address: 0x1801ab940)
FindClose (Address: 0x1801ab928)
FindFirstFileW (Address: 0x1801ab9b0)
FindNextFileW (Address: 0x1801ab998)
GetFileAttributesA (Address: 0x1801ab9b8)
GetFileAttributesW (Address: 0x1801ab968)
GetFileInformationByHandle (Address: 0x1801ab9c8)
GetFileSize (Address: 0x1801ab960)
GetFileSizeEx (Address: 0x1801ab9d0)
GetFileType (Address: 0x1801ab988)
GetFinalPathNameByHandleW (Address: 0x1801ab9c0)
GetFullPathNameW (Address: 0x1801ab958)
ReadFile (Address: 0x1801ab918)
RemoveDirectoryW (Address: 0x1801ab930)
SetEndOfFile (Address: 0x1801ab948)
SetFileAttributesW (Address: 0x1801ab9a0)
SetFilePointer (Address: 0x1801ab950)
SetFilePointerEx (Address: 0x1801ab978)
SetFileTime (Address: 0x1801ab9a8)
WriteFile (Address: 0x1801ab990)

api-ms-win-core-handle-l1-1-0.dll

CloseHandle (Address: 0x1801ab9e0)
DuplicateHandle (Address: 0x1801ab9e8)

api-ms-win-core-heap-l1-1-0.dll

GetProcessHeap (Address: 0x1801aba08)
HeapAlloc (Address: 0x1801ab9f8)
HeapFree (Address: 0x1801aba00)
HeapReAlloc (Address: 0x1801aba10)

api-ms-win-core-interlocked-l1-1-0.dll

InitializeSListHead (Address: 0x1801aba20)

api-ms-win-core-io-l1-1-0.dll

DeviceIoControl (Address: 0x1801aba30)

api-ms-win-core-libraryloader-l1-1-0.dll

FreeLibrary (Address: 0x1801aba50)
GetModuleFileNameW (Address: 0x1801aba40)
GetModuleHandleA (Address: 0x1801aba58)
GetModuleHandleExW (Address: 0x1801aba78)
GetModuleHandleW (Address: 0x1801aba68)
GetProcAddress (Address: 0x1801aba60)
LoadLibraryExA (Address: 0x1801aba70)
LoadLibraryExW (Address: 0x1801aba48)

api-ms-win-core-localization-l1-1-0.dll

LCMapStringEx (Address: 0x1801aba90)
LCMapStringW (Address: 0x1801aba88)

api-ms-win-core-localregistry-l1-1-0.dll

RegCloseKey (Address: 0x1801abaa8)
RegOpenKeyExW (Address: 0x1801abab0)
RegQueryValueExW (Address: 0x1801abaa0)

api-ms-win-core-memory-l1-1-0.dll

CreateFileMappingW (Address: 0x1801abad8)
MapViewOfFile (Address: 0x1801abad0)
MapViewOfFileEx (Address: 0x1801abaf8)
ReadProcessMemory (Address: 0x1801abb00)
UnmapViewOfFile (Address: 0x1801abae0)
VirtualAlloc (Address: 0x1801abae8)
VirtualFree (Address: 0x1801abac0)
VirtualProtect (Address: 0x1801abaf0)
VirtualQuery (Address: 0x1801abac8)

api-ms-win-core-misc-l1-1-0.dll

FormatMessageW (Address: 0x1801abb18)
LocalAlloc (Address: 0x1801abb20)
LocalFree (Address: 0x1801abb10)
Sleep (Address: 0x1801abb28)

api-ms-win-core-processenvironment-l1-1-0.dll

ExpandEnvironmentStringsW (Address: 0x1801abb48)
GetEnvironmentVariableW (Address: 0x1801abb40)
SetEnvironmentVariableA (Address: 0x1801abb38)

api-ms-win-core-processthreads-l1-1-0.dll

GetCurrentProcess (Address: 0x1801abb58)
GetCurrentProcessId (Address: 0x1801abb98)
GetCurrentThread (Address: 0x1801abb80)
GetCurrentThreadId (Address: 0x1801abb60)
OpenThreadToken (Address: 0x1801abb88)
TerminateProcess (Address: 0x1801abb78)
TlsAlloc (Address: 0x1801abb70)
TlsFree (Address: 0x1801abba0)
TlsGetValue (Address: 0x1801abb90)
TlsSetValue (Address: 0x1801abb68)

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter (Address: 0x1801abbb0)

api-ms-win-core-rtlsupport-l1-1-0.dll

RtlCaptureContext (Address: 0x1801abbd0)
RtlLookupFunctionEntry (Address: 0x1801abbc8)
RtlVirtualUnwind (Address: 0x1801abbc0)

api-ms-win-core-string-l1-1-0.dll

GetStringTypeW (Address: 0x1801abbe8)
MultiByteToWideChar (Address: 0x1801abbe0)
WideCharToMultiByte (Address: 0x1801abbf0)

api-ms-win-core-synch-l1-1-0.dll

AcquireSRWLockExclusive (Address: 0x1801abc50)
AcquireSRWLockShared (Address: 0x1801abc60)
DeleteCriticalSection (Address: 0x1801abc58)
EnterCriticalSection (Address: 0x1801abc18)
InitializeCriticalSection (Address: 0x1801abc28)
InitializeCriticalSectionAndSpinCount (Address: 0x1801abc38)
InitializeCriticalSectionEx (Address: 0x1801abc00)
InitializeSRWLock (Address: 0x1801abc40)
LeaveCriticalSection (Address: 0x1801abc10)
OpenProcess (Address: 0x1801abc08)
ReleaseSRWLockExclusive (Address: 0x1801abc30)
ReleaseSRWLockShared (Address: 0x1801abc48)
TryAcquireSRWLockExclusive (Address: 0x1801abc20)

api-ms-win-core-sysinfo-l1-1-0.dll

GetSystemDirectoryW (Address: 0x1801abc80)
GetSystemInfo (Address: 0x1801abc78)
GetSystemTime (Address: 0x1801abc88)
GetSystemTimeAsFileTime (Address: 0x1801abc90)
GetTickCount (Address: 0x1801abc98)
GetVersionExA (Address: 0x1801abc70)
SystemTimeToFileTime (Address: 0x1801abca0)

api-ms-win-core-sysinfo-l1-2-0.dll

GetNativeSystemInfo (Address: 0x1801abcb0)

api-ms-win-core-threadpool-l1-1-0.dll

CloseThreadpoolWork (Address: 0x1801abcc8)
CreateThreadpoolWork (Address: 0x1801abcc0)
SubmitThreadpoolWork (Address: 0x1801abcd8)
WaitForThreadpoolWorkCallbacks (Address: 0x1801abcd0)

api-ms-win-core-util-l1-1-0.dll

DecodePointer (Address: 0x1801abcf0)
EncodePointer (Address: 0x1801abce8)

api-ms-win-crt-locale-l1-1-0.dll

_lock_locales (Address: 0x1801abd08)
_unlock_locales (Address: 0x1801abd00)

api-ms-win-crt-private-l1-1-0.dll

__C_specific_handler (Address: 0x1801ac038)
__CxxFrameHandler3 (Address: 0x1801ac040)
__uncaught_exception (Address: 0x1801abf48)
__unDName (Address: 0x1801ac068)
__unDNameEx (Address: 0x1801ac078)
_CxxThrowException (Address: 0x1801abf58)
_o____lc_codepage_func (Address: 0x1801ac010)
_o____lc_locale_name_func (Address: 0x1801ac008)
_o____mb_cur_max_func (Address: 0x1801ac000)
_o___pctype_func (Address: 0x1801abfc8)
_o___std_exception_copy (Address: 0x1801abfc0)
_o___std_exception_destroy (Address: 0x1801abfb8)
_o___std_type_info_destroy_list (Address: 0x1801abfb0)
_o___stdio_common_vfprintf (Address: 0x1801abfa0)
_o___stdio_common_vsnprintf_s (Address: 0x1801abf90)
_o___stdio_common_vsnwprintf_s (Address: 0x1801abf88)
_o___stdio_common_vsprintf (Address: 0x1801abf80)
_o___stdio_common_vsprintf_s (Address: 0x1801abf78)
_o___stdio_common_vsscanf (Address: 0x1801abf70)
_o___stdio_common_vswprintf (Address: 0x1801abf68)
_o___stdio_common_vswprintf_s (Address: 0x1801abf60)
_o__aligned_free (Address: 0x1801abf50)
_o__aligned_malloc (Address: 0x1801abdc8)
_o__callnewh (Address: 0x1801abff8)
_o__calloc_base (Address: 0x1801abff0)
_o__cexit (Address: 0x1801abfe8)
_o__close (Address: 0x1801abfe0)
_o__configure_narrow_argv (Address: 0x1801abfd8)
_o__crt_atexit (Address: 0x1801abfd0)
_o__errno (Address: 0x1801abfa8)
_o__execute_onexit_table (Address: 0x1801abf98)
_o__filelengthi64 (Address: 0x1801abd18)
_o__free_base (Address: 0x1801abd20)
_o__fullpath (Address: 0x1801abd28)
_o__initialize_narrow_environment (Address: 0x1801abd30)
_o__initialize_onexit_table (Address: 0x1801abd38)
_o__invalid_parameter_noinfo (Address: 0x1801abd40)
_o__invalid_parameter_noinfo_noreturn (Address: 0x1801abd48)
_o__itoa_s (Address: 0x1801abd50)
_o__lseeki64 (Address: 0x1801abd58)
_o__ltoa (Address: 0x1801abd60)
_o__malloc_base (Address: 0x1801abd68)
_o__mbscmp (Address: 0x1801abd70)
_o__memicmp (Address: 0x1801abd78)
_o__open_osfhandle (Address: 0x1801abd80)
_o__purecall (Address: 0x1801abd88)
_o__read (Address: 0x1801abd90)
_o__register_onexit_function (Address: 0x1801abd98)
_o__seh_filter_dll (Address: 0x1801abda0)
_o__splitpath_s (Address: 0x1801abda8)
_o__stricmp (Address: 0x1801abdb0)
_o__strlwr (Address: 0x1801abdb8)
_o__strnicmp (Address: 0x1801abdc0)
_o__wcsdup (Address: 0x1801abdd0)
_o__wcsicmp (Address: 0x1801abdd8)
_o__wcslwr (Address: 0x1801abde0)
_o__wcsnicmp (Address: 0x1801abde8)
_o__wctime64 (Address: 0x1801abdf0)
_o__wdupenv_s (Address: 0x1801abdf8)
_o__wfsopen (Address: 0x1801abe00)
_o__wfullpath (Address: 0x1801abe08)
_o__wgetenv (Address: 0x1801abe10)
_o__wmakepath_s (Address: 0x1801abe18)
_o__wsplitpath_s (Address: 0x1801abe20)
_o__wtoi (Address: 0x1801abe28)
_o_abort (Address: 0x1801abe30)
_o_atoi (Address: 0x1801abe38)
_o_atol (Address: 0x1801abe40)
_o_bsearch (Address: 0x1801abe48)
_o_calloc (Address: 0x1801abe50)
_o_ceilf (Address: 0x1801abe58)
_o_fclose (Address: 0x1801abe60)
_o_fflush (Address: 0x1801abe68)
_o_fread (Address: 0x1801abe70)
_o_free (Address: 0x1801abe78)
_o_frexp (Address: 0x1801abe80)
_o_fseek (Address: 0x1801abe88)
_o_ftell (Address: 0x1801abe90)
_o_isspace (Address: 0x1801abe98)
_o_iswprint (Address: 0x1801abea0)
_o_iswspace (Address: 0x1801abea8)
_o_iswxdigit (Address: 0x1801abeb0)
_o_localeconv (Address: 0x1801abeb8)
_o_malloc (Address: 0x1801abec0)
_o_qsort (Address: 0x1801abec8)
_o_realloc (Address: 0x1801abed0)
_o_setlocale (Address: 0x1801abed8)
_o_strcat_s (Address: 0x1801abee0)
_o_strcpy_s (Address: 0x1801abee8)
_o_strncat_s (Address: 0x1801abef0)
_o_strncpy_s (Address: 0x1801abef8)
_o_terminate (Address: 0x1801abf00)
_o_tolower (Address: 0x1801abf08)
_o_towlower (Address: 0x1801abf10)
_o_wcscat_s (Address: 0x1801abf18)
_o_wcscpy_s (Address: 0x1801abf20)
_o_wcsncat_s (Address: 0x1801abf28)
_o_wcsncpy_s (Address: 0x1801abf30)
_o_wcstoul (Address: 0x1801abf38)
_o_wmemcpy_s (Address: 0x1801abf40)
memcmp (Address: 0x1801ac060)
memcpy (Address: 0x1801ac050)
memmove (Address: 0x1801ac058)
strchr (Address: 0x1801ac048)
strrchr (Address: 0x1801ac070)
strstr (Address: 0x1801ac020)
wcschr (Address: 0x1801ac030)
wcsrchr (Address: 0x1801ac018)
wcsstr (Address: 0x1801ac028)

api-ms-win-crt-runtime-l1-1-0.dll

__doserrno (Address: 0x1801ac088)
_initterm (Address: 0x1801ac090)
_initterm_e (Address: 0x1801ac098)

api-ms-win-crt-string-l1-1-0.dll

memset (Address: 0x1801ac0a8)
strcmp (Address: 0x1801ac0d8)
strcspn (Address: 0x1801ac0b0)
strlen (Address: 0x1801ac0d0)
strncmp (Address: 0x1801ac0b8)
strnlen (Address: 0x1801ac0c8)
wcscmp (Address: 0x1801ac0e0)
wcsncmp (Address: 0x1801ac0c0)
wcsnlen (Address: 0x1801ac0e8)

api-ms-win-crt-time-l1-1-0.dll

_ctime64 (Address: 0x1801ac0f8)
_time64 (Address: 0x1801ac100)

api-ms-win-downlevel-kernel32-l2-1-0.dll

CreateFileMappingA (Address: 0x1801ac110)

api-ms-win-security-base-l1-1-0.dll

AccessCheck (Address: 0x1801ac138)
GetFileSecurityW (Address: 0x1801ac128)
ImpersonateSelf (Address: 0x1801ac120)
RevertToSelf (Address: 0x1801ac130)

ntdll.dll

RtlRunOnceExecuteOnce (Address: 0x1801ac150)
RtlUTF8ToUnicodeN (Address: 0x1801ac148)

OLEAUT32.dll

SysFreeString (Address: 0x1801ab890)