EtwRundown.dll

v10.0.19041.1 32-bit Windows NT Analyzed
Description
Etw Rundown Helper Library
Authors
© Microsoft Corporation. All rights reserved.
File size
39.5 KB
Uploaded
2025-12-01 07:56
Views
43
SHA-256
7614e95cdb37e74d181603ab09b12f4d

Exported functions 2

EtwLogHeapRundown #1 · 0x3e10
EtwLogSysConfigRundown #2 · 0x2570

Imported DLLs & functions 96

api-ms-win-core-apiquery-l1-1-0.dll 1
ApiSetQueryApiSetPresence 0x1000a054
api-ms-win-core-delayload-l1-1-0.dll 1
DelayLoadFailureHook 0x1000a05c
api-ms-win-core-delayload-l1-1-1.dll 1
ResolveDelayLoadedAPI 0x1000a064
api-ms-win-core-errorhandling-l1-1-0.dll 3
GetLastError 0x1000a074
SetUnhandledExceptionFilter 0x1000a070
UnhandledExceptionFilter 0x1000a06c
api-ms-win-core-file-l1-1-0.dll 5
CreateFileW 0x1000a08c
GetDriveTypeW 0x1000a07c
GetLogicalDriveStringsW 0x1000a080
GetVolumeInformationW 0x1000a088
LocalFileTimeToFileTime 0x1000a084
api-ms-win-core-file-l1-2-0.dll 1
GetVolumePathNamesForVolumeNameW 0x1000a094
api-ms-win-core-handle-l1-1-0.dll 1
CloseHandle 0x1000a09c
api-ms-win-core-heap-l2-1-0.dll 1
LocalFree 0x1000a0a4
api-ms-win-core-io-l1-1-0.dll 2
DeviceIoControl 0x1000a0b0
GetOverlappedResult 0x1000a0ac
api-ms-win-core-libraryloader-l1-2-0.dll 1
DisableThreadLibraryCalls 0x1000a0b8
api-ms-win-core-processthreads-l1-1-0.dll 4
GetCurrentProcess 0x1000a0cc
GetCurrentProcessId 0x1000a0c4
GetCurrentThreadId 0x1000a0c0
TerminateProcess 0x1000a0c8
api-ms-win-core-processthreads-l1-1-1.dll 2
IsProcessorFeaturePresent 0x1000a0d4
OpenProcess 0x1000a0d8
api-ms-win-core-profile-l1-1-0.dll 1
QueryPerformanceCounter 0x1000a0e0
api-ms-win-core-registry-l1-1-0.dll 6
RegCloseKey 0x1000a0fc
RegEnumKeyExW 0x1000a0e8
RegEnumValueW 0x1000a0f4
RegOpenKeyExW 0x1000a0ec
RegQueryInfoKeyW 0x1000a0f8
RegQueryValueExW 0x1000a0f0
api-ms-win-core-synch-l1-1-0.dll 1
CreateEventW 0x1000a104
api-ms-win-core-sysinfo-l1-1-0.dll 5
GetComputerNameExW 0x1000a110
GetSystemTimeAsFileTime 0x1000a118
GetSystemWindowsDirectoryW 0x1000a10c
GetTickCount 0x1000a114
GlobalMemoryStatusEx 0x1000a11c
api-ms-win-core-sysinfo-l1-2-0.dll 2
GetNativeSystemInfo 0x1000a128
GetSystemFirmwareTable 0x1000a124
api-ms-win-core-timezone-l1-1-0.dll 1
SystemTimeToFileTime 0x1000a130
api-ms-win-service-core-l1-1-1.dll 1
EnumServicesStatusExW 0x1000a138
api-ms-win-service-management-l1-1-0.dll 2
CloseServiceHandle 0x1000a140
OpenSCManagerW 0x1000a144
api-ms-win-service-private-l1-1-0.dll 1
I_QueryTagInformation 0x1000a14c
CFGMGR32.dll 7
CM_Free_Log_Conf_Handle 0x1000a010
CM_Free_Res_Des_Handle 0x1000a000
CM_Get_DevNode_Status_Ex 0x1000a018
CM_Get_First_Log_Conf_Ex 0x1000a008
CM_Get_Next_Res_Des_Ex 0x1000a014
CM_Get_Res_Des_Data_Ex 0x1000a004
CM_Get_Res_Des_Data_Size_Ex 0x1000a00c
DEVOBJ.dll 10
DevObjCreateDeviceInfoList 0x1000a044
DevObjDestroyDeviceInfoList 0x1000a030
DevObjEnumDeviceInfo 0x1000a03c
DevObjEnumDeviceInterfaces 0x1000a024
DevObjGetClassDevs 0x1000a028
DevObjGetDeviceInfoListDetail 0x1000a034
DevObjGetDeviceInstanceId 0x1000a020
DevObjGetDeviceInterfaceDetail 0x1000a02c
DevObjGetDeviceRegistryProperty 0x1000a038
DevObjOpenDevRegKey 0x1000a040
IPHLPAPI.DLL 1
GetAdaptersAddresses 0x1000a04c
ntdll.dll 35
_vsnwprintf 0x1000a19c
_wcsicmp 0x1000a1b4
EtwpGetCpuSpeed 0x1000a160
memcpy 0x1000a194
memset 0x1000a1dc
NtClose 0x1000a1a4
NtEnumerateKey 0x1000a15c
NtOpenFile 0x1000a164
NtOpenKey 0x1000a198
NtPowerInformation 0x1000a1b8
NtQueryInformationProcess 0x1000a158
NtQuerySystemInformation 0x1000a1a0
NtQueryValueKey 0x1000a1c8
NtQueryVolumeInformationFile 0x1000a1ac
NtSetInformationThread 0x1000a188
NtTraceEvent 0x1000a1c4
RtlAdjustPrivilege 0x1000a184
RtlAllocateHeap 0x1000a1d0
RtlCreateQueryDebugBuffer 0x1000a180
RtlDestroyQueryDebugBuffer 0x1000a190
RtlFreeHeap 0x1000a1cc
RtlGetDeviceFamilyInfoEnum 0x1000a1d8
RtlGetNativeSystemInformation 0x1000a170
RtlGUIDFromString 0x1000a168
RtlImpersonateSelf 0x1000a178
RtlInitUnicodeString 0x1000a1d4
RtlIpv4AddressToStringW 0x1000a174
RtlIpv6AddressToStringW 0x1000a16c
RtlNtStatusToDosError 0x1000a1b0
RtlQueryHeapInformation 0x1000a17c
RtlQueryProcessDebugInformation 0x1000a18c
RtlReAllocateHeap 0x1000a1c0
wcsncmp 0x1000a1a8
wcsrchr 0x1000a154
wcsstr 0x1000a1bc