easwrt.dll
v10.0.19041.6328
32-bit
Windows NT
Analyzed
Security warning
This file has been flagged as potentially dangerous, and downloads are disabled.
Reason: Detected potentially dangerous functions used for process injection: OpenProcess
Exported functions 9
DllCanUnloadNow
#1 · 0xd170
DllGetActivationFactory
#2 · 0xd1c0
DllGetClassObject
#3 · 0xd1e0
EasClientSecurityPolicyApply
#4 · 0xc2f0
EasClientSecurityPolicyCheckCompliance
#5 · 0xc370
EasGetClientDeviceInformation
#6 · 0xc3f0
EasRegisterEncryptionProvider
#7 · 0x17830
EasShowConsentDialog
#8 · 0xc410
EasUnRegisterEncryptionProvider
#9 · 0x178b0
No function matches your filter.
Imported DLLs & functions 265
ADVAPI32.dll
12
AllocateAndInitializeSid
0x1001f000
CloseServiceHandle
0x1001f01c
FreeSid
0x1001f00c
OpenSCManagerW
0x1001f020
OpenServiceW
0x1001f004
QueryServiceStatus
0x1001f018
RegCloseKey
0x1001f02c
RegCreateKeyExW
0x1001f014
RegDeleteValueW
0x1001f010
RegOpenKeyExW
0x1001f028
RegSetValueExW
0x1001f024
StartServiceW
0x1001f008
ApiSetQueryApiSetPresence
0x1001f134
CoCreateFreeThreadedMarshaler
0x1001f150
CoCreateInstance
0x1001f15c
CoGetCallContext
0x1001f14c
CoGetCallerTID
0x1001f140
CoGetInterfaceAndReleaseStream
0x1001f13c
CoMarshalInterface
0x1001f144
CoMarshalInterThreadInterfaceInStream
0x1001f168
CoReleaseMarshalData
0x1001f154
CoTaskMemAlloc
0x1001f160
CoTaskMemFree
0x1001f164
CreateStreamOnHGlobal
0x1001f148
StringFromGUID2
0x1001f158
RoGetAgileReference
0x1001f170
CStdStubBuffer2_Connect
0x1001f1d0
CStdStubBuffer2_CountRefs
0x1001f18c
CStdStubBuffer2_Disconnect
0x1001f1b8
CStdStubBuffer2_QueryInterface
0x1001f1a4
NdrProxyForwardingFunction3
0x1001f1c4
NdrProxyForwardingFunction4
0x1001f1cc
NdrProxyForwardingFunction5
0x1001f178
ObjectStublessClient10
0x1001f1a0
ObjectStublessClient11
0x1001f184
ObjectStublessClient12
0x1001f17c
ObjectStublessClient13
0x1001f1a8
ObjectStublessClient14
0x1001f188
ObjectStublessClient15
0x1001f1d4
ObjectStublessClient16
0x1001f1b4
ObjectStublessClient17
0x1001f19c
ObjectStublessClient18
0x1001f1d8
ObjectStublessClient19
0x1001f198
ObjectStublessClient20
0x1001f1dc
ObjectStublessClient21
0x1001f1bc
ObjectStublessClient22
0x1001f1b0
ObjectStublessClient23
0x1001f1c8
ObjectStublessClient3
0x1001f1c0
ObjectStublessClient6
0x1001f180
ObjectStublessClient7
0x1001f1ac
ObjectStublessClient8
0x1001f190
ObjectStublessClient9
0x1001f194
DebugBreak
0x1001f1e4
IsDebuggerPresent
0x1001f1ec
OutputDebugStringW
0x1001f1e8
DelayLoadFailureHook
0x1001f1f4
ResolveDelayLoadedAPI
0x1001f1fc
GetLastError
0x1001f208
RaiseException
0x1001f204
SetLastError
0x1001f214
SetUnhandledExceptionFilter
0x1001f20c
UnhandledExceptionFilter
0x1001f210
CloseHandle
0x1001f21c
GetProcessHeap
0x1001f224
HeapAlloc
0x1001f228
HeapFree
0x1001f22c
DisableThreadLibraryCalls
0x1001f250
FreeLibrary
0x1001f244
GetModuleFileNameA
0x1001f254
GetModuleHandleExW
0x1001f24c
GetModuleHandleW
0x1001f248
GetProcAddress
0x1001f240
LoadLibraryExW
0x1001f258
FormatMessageW
0x1001f260
GetCurrentProcess
0x1001f280
GetCurrentProcessId
0x1001f270
GetCurrentThread
0x1001f284
GetCurrentThreadId
0x1001f26c
GetProcessId
0x1001f278
OpenProcessToken
0x1001f268
OpenThreadToken
0x1001f27c
TerminateProcess
0x1001f274
OpenProcess
0x1001f28c
QueryPerformanceCounter
0x1001f294
RegDeleteTreeW
0x1001f2a0
RegEnumValueW
0x1001f2a4
RegGetValueW
0x1001f29c
RegQueryInfoKeyW
0x1001f2a8
CompareStringOrdinal
0x1001f2b0
AcquireSRWLockExclusive
0x1001f2e8
AcquireSRWLockShared
0x1001f2bc
CreateMutexExW
0x1001f2e0
CreateSemaphoreExW
0x1001f2d4
DeleteCriticalSection
0x1001f2b8
InitializeCriticalSection
0x1001f2d0
OpenSemaphoreW
0x1001f2dc
ReleaseMutex
0x1001f2e4
ReleaseSemaphore
0x1001f2d8
ReleaseSRWLockExclusive
0x1001f2cc
ReleaseSRWLockShared
0x1001f2c8
WaitForSingleObject
0x1001f2c0
WaitForSingleObjectEx
0x1001f2c4
GetSystemTimeAsFileTime
0x1001f304
GetTickCount
0x1001f2fc
GetVersionExW
0x1001f300
GetRestrictedErrorInfo
0x1001f328
RoOriginateError
0x1001f320
RoOriginateErrorW
0x1001f31c
RoTransformError
0x1001f324
SetRestrictedErrorInfo
0x1001f318
IsErrorPropagationEnabled
0x1001f338
RoGetMatchingRestrictedErrorInfo
0x1001f334
RoReportFailedDelegate
0x1001f330
RoGetActivationFactory
0x1001f340
WindowsCreateString
0x1001f354
WindowsCreateStringReference
0x1001f350
WindowsGetStringRawBuffer
0x1001f34c
WindowsIsStringEmpty
0x1001f348
WindowsStringHasEmbeddedNull
0x1001f358
GetTraceEnableFlags
0x1001f364
GetTraceEnableLevel
0x1001f374
GetTraceLoggerHandle
0x1001f368
RegisterTraceGuidsW
0x1001f360
TraceMessage
0x1001f36c
UnregisterTraceGuids
0x1001f370
EventProviderEnabled
0x1001f384
EventRegister
0x1001f380
EventSetInformation
0x1001f37c
EventUnregister
0x1001f388
EventWriteTransfer
0x1001f38c
CheckTokenMembership
0x1001f39c
CopySid
0x1001f3a0
CreateWellKnownSid
0x1001f394
DuplicateToken
0x1001f3b4
EqualSid
0x1001f3a4
GetLengthSid
0x1001f3a8
GetSecurityDescriptorDacl
0x1001f3ac
GetTokenInformation
0x1001f398
PrivilegeCheck
0x1001f3b0
LsaClose
0x1001f3bc
LsaFreeMemory
0x1001f3c0
LsaLookupSids
0x1001f3cc
LsaOpenPolicy
0x1001f3c8
LsaQueryInformationPolicy
0x1001f3c4
ConvertSidToStringSidW
0x1001f3d4
SHTaskPoolAllowThreadReuse
0x1001f3e0
SHTaskPoolQueueTask
0x1001f3dc
AuthzAccessCheck
0x1001f03c
AuthzAddSidsToContext
0x1001f038
AuthzFreeContext
0x1001f040
AuthzFreeResourceManager
0x1001f044
AuthzInitializeContextFromSid
0x1001f034
AuthzInitializeResourceManager
0x1001f048
msvcrt.dll
21
__CxxFrameHandler3
0x1001f400
__dllonexit
0x1001f408
_amsg_exit
0x1001f428
_callnewh
0x1001f430
_except_handler4_common
0x1001f3f4
_initterm
0x1001f41c
_lock
0x1001f414
_onexit
0x1001f404
_purecall
0x1001f424
_unlock
0x1001f410
_vsnwprintf
0x1001f3f8
_wtoi
0x1001f43c
_XcptFilter
0x1001f42c
free
0x1001f438
malloc
0x1001f434
memcmp
0x1001f420
memcpy
0x1001f418
memcpy_s
0x1001f3fc
memmove
0x1001f40c
memset
0x1001f444
toupper
0x1001f440
NetApiBufferFree
0x1001f44c
ntdll.dll
24
NtClose
0x1001f464
NtDuplicateToken
0x1001f468
NtGetCachedSigningLevel
0x1001f474
NtOpenProcessToken
0x1001f46c
NtOpenThreadToken
0x1001f460
NtQueryInformationToken
0x1001f480
NtQuerySystemInformation
0x1001f47c
NtSetCachedSigningLevel
0x1001f478
RtlAcquireResourceExclusive
0x1001f458
RtlCopySid
0x1001f498
RtlDeleteResource
0x1001f4b0
RtlEqualSid
0x1001f4ac
RtlGetDeviceFamilyInfoEnum
0x1001f4a4
RtlGetNtProductType
0x1001f490
RtlInitializeResource
0x1001f454
RtlInitializeSid
0x1001f488
RtlInitUnicodeString
0x1001f484
RtlIsMultiSessionSku
0x1001f49c
RtlLengthSid
0x1001f494
RtlNtStatusToDosError
0x1001f4a8
RtlReleaseResource
0x1001f45c
RtlSubAuthorityCountSid
0x1001f4a0
RtlSubAuthoritySid
0x1001f48c
WinSqmSetString
0x1001f470
CoGetObject
0x1001f4b8
RPCRT4.dll
30
CStdStubBuffer_AddRef
0x1001f0d8
CStdStubBuffer_Connect
0x1001f0b4
CStdStubBuffer_CountRefs
0x1001f0d4
CStdStubBuffer_DebugServerQueryInterface
0x1001f0a4
CStdStubBuffer_DebugServerRelease
0x1001f0c4
CStdStubBuffer_Disconnect
0x1001f0c0
CStdStubBuffer_Invoke
0x1001f084
CStdStubBuffer_IsIIDSupported
0x1001f0b8
CStdStubBuffer_QueryInterface
0x1001f0d0
I_RpcExceptionFilter
0x1001f09c
I_RpcMapWin32Status
0x1001f0ac
IUnknown_AddRef_Proxy
0x1001f0a0
IUnknown_QueryInterface_Proxy
0x1001f0bc
IUnknown_Release_Proxy
0x1001f0dc
NdrClientCall4
0x1001f070
NdrCStdStubBuffer_Release
0x1001f0b0
NdrCStdStubBuffer2_Release
0x1001f078
NdrDllCanUnloadNow
0x1001f080
NdrDllGetClassObject
0x1001f07c
NdrOleAllocate
0x1001f0c8
NdrOleFree
0x1001f0cc
NdrStubCall2
0x1001f08c
NdrStubForwardingFunction
0x1001f088
RpcBindingBind
0x1001f068
RpcBindingCreateW
0x1001f06c
RpcBindingFree
0x1001f074
RpcBindingFromStringBindingW
0x1001f094
RpcBindingSetAuthInfoExW
0x1001f0a8
RpcStringBindingComposeW
0x1001f098
RpcStringFreeW
0x1001f090
NetUserGetInfo
0x1001f4c0
SamCloseHandle
0x1001f0e8
SamConnect
0x1001f0fc
SamFreeMemory
0x1001f100
SamOpenDomain
0x1001f0ec
SamOpenUser
0x1001f0f8
SamQueryInformationDomain
0x1001f0e4
SamQueryInformationUser
0x1001f0f0
SamQuerySecurityObject
0x1001f0f4
USER32.dll
10
0x1001f108
0x1001f120
EnableWindow
0x1001f118
GetAncestor
0x1001f11c
GetClassNameW
0x1001f110
GetWindow
0x1001f128
GetWindowThreadProcessId
0x1001f12c
IsWindow
0x1001f114
SystemParametersInfoW
0x1001f10c
UpdatePerUserSystemParameters
0x1001f124
No function matches your filter.