Microsoft.Uev.AppAgent.dll

ACTIVEDS.dll

(Address: 0x1017a000)

ADVAPI32.dll

EventRegister (Address: 0x1017a014)
EventSetInformation (Address: 0x1017a018)
EventUnregister (Address: 0x1017a008)
EventWriteTransfer (Address: 0x1017a010)
RegGetValueW (Address: 0x1017a01c)
SetSecurityInfo (Address: 0x1017a00c)

api-ms-win-core-file-l1-1-0.dll

CreateDirectoryW (Address: 0x1017a224)
CreateFileW (Address: 0x1017a220)
DeleteFileW (Address: 0x1017a208)
FindClose (Address: 0x1017a210)
FindFirstFileW (Address: 0x1017a21c)
FindNextFileW (Address: 0x1017a20c)
GetFileAttributesExW (Address: 0x1017a234)
GetFileAttributesW (Address: 0x1017a200)
GetFileSize (Address: 0x1017a1fc)
GetFileTime (Address: 0x1017a204)
GetLongPathNameW (Address: 0x1017a218)
ReadFile (Address: 0x1017a228)
RemoveDirectoryW (Address: 0x1017a22c)
SetFileAttributesW (Address: 0x1017a214)
SetFileTime (Address: 0x1017a230)
WriteFile (Address: 0x1017a238)

api-ms-win-core-file-l1-2-0.dll

GetTempPathW (Address: 0x1017a240)

api-ms-win-core-file-l1-2-2.dll

AreFileApisANSI (Address: 0x1017a248)

api-ms-win-core-file-l2-1-0.dll

CopyFileExW (Address: 0x1017a258)
CreateHardLinkW (Address: 0x1017a250)
MoveFileExW (Address: 0x1017a254)

api-ms-win-core-file-l2-1-2.dll

CopyFileW (Address: 0x1017a260)

api-ms-win-core-handle-l1-1-0.dll

DuplicateHandle (Address: 0x1017a268)

api-ms-win-core-heap-l2-1-0.dll

LocalAlloc (Address: 0x1017a270)

api-ms-win-core-io-l1-1-0.dll

DeviceIoControl (Address: 0x1017a278)

api-ms-win-core-libraryloader-l1-2-0.dll

GetModuleHandleA (Address: 0x1017a284)
LoadLibraryExA (Address: 0x1017a280)

api-ms-win-core-localization-l1-2-0.dll

FormatMessageA (Address: 0x1017a290)
GetUserDefaultLCID (Address: 0x1017a28c)

api-ms-win-core-memory-l1-1-0.dll

VirtualAlloc (Address: 0x1017a2a4)
VirtualFree (Address: 0x1017a2a0)
VirtualProtect (Address: 0x1017a29c)
VirtualQuery (Address: 0x1017a298)

api-ms-win-core-namedpipe-l1-1-0.dll

WaitNamedPipeW (Address: 0x1017a2ac)

api-ms-win-core-processenvironment-l1-1-0.dll

ExpandEnvironmentStringsW (Address: 0x1017a2b4)
GetCurrentDirectoryW (Address: 0x1017a2b8)

api-ms-win-core-processthreads-l1-1-0.dll

CreateProcessW (Address: 0x1017a2c0)
CreateThread (Address: 0x1017a2e4)
GetCurrentThread (Address: 0x1017a2e0)
GetExitCodeProcess (Address: 0x1017a2c4)
GetExitCodeThread (Address: 0x1017a2e8)
OpenProcessToken (Address: 0x1017a2ec)
ProcessIdToSessionId (Address: 0x1017a2d8)
ResumeThread (Address: 0x1017a2f4)
SetThreadPriority (Address: 0x1017a2f0)
SwitchToThread (Address: 0x1017a2d4)
TlsAlloc (Address: 0x1017a2dc)
TlsFree (Address: 0x1017a2d0)
TlsGetValue (Address: 0x1017a2c8)
TlsSetValue (Address: 0x1017a2cc)

api-ms-win-core-processthreads-l1-1-1.dll

FlushInstructionCache (Address: 0x1017a2fc)
GetProcessMitigationPolicy (Address: 0x1017a304)
GetThreadContext (Address: 0x1017a300)
SetThreadContext (Address: 0x1017a308)

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceFrequency (Address: 0x1017a310)

api-ms-win-core-registry-l1-1-0.dll

RegCloseKey (Address: 0x1017a33c)
RegCreateKeyExW (Address: 0x1017a324)
RegDeleteKeyExW (Address: 0x1017a334)
RegDeleteTreeW (Address: 0x1017a31c)
RegDeleteValueW (Address: 0x1017a340)
RegEnumKeyExW (Address: 0x1017a320)
RegEnumValueW (Address: 0x1017a338)
RegOpenKeyExW (Address: 0x1017a318)
RegQueryInfoKeyW (Address: 0x1017a328)
RegQueryValueExW (Address: 0x1017a32c)
RegSetValueExW (Address: 0x1017a330)

api-ms-win-core-registry-l1-1-1.dll

RegSetKeyValueW (Address: 0x1017a348)

api-ms-win-core-string-obsolete-l1-1-0.dll

lstrcmpiW (Address: 0x1017a350)
lstrlenA (Address: 0x1017a354)

api-ms-win-core-synch-ansi-l1-1-0.dll

CreateSemaphoreA (Address: 0x1017a35c)

api-ms-win-core-synch-l1-1-0.dll

CreateEventExW (Address: 0x1017a374)
CreateMutexW (Address: 0x1017a370)
OpenEventA (Address: 0x1017a368)
SetWaitableTimer (Address: 0x1017a364)
WaitForMultipleObjectsEx (Address: 0x1017a36c)

api-ms-win-core-synch-l1-2-1.dll

CreateWaitableTimerW (Address: 0x1017a37c)

api-ms-win-core-sysinfo-l1-1-0.dll

GetComputerNameExW (Address: 0x1017a384)

api-ms-win-core-threadpool-l1-2-0.dll

CloseThreadpoolWork (Address: 0x1017a390)
CreateThreadpoolWork (Address: 0x1017a38c)
SubmitThreadpoolWork (Address: 0x1017a394)

api-ms-win-core-version-l1-1-0.dll

VerQueryValueW (Address: 0x1017a39c)

api-ms-win-core-version-l1-1-1.dll

GetFileVersionInfoSizeW (Address: 0x1017a3a4)
GetFileVersionInfoW (Address: 0x1017a3a8)

api-ms-win-core-wow64-l1-1-0.dll

Wow64DisableWow64FsRedirection (Address: 0x1017a3b4)
Wow64RevertWow64FsRedirection (Address: 0x1017a3b0)

api-ms-win-eventing-provider-l1-1-0.dll

EventActivityIdControl (Address: 0x1017a3bc)

api-ms-win-ntuser-sysparams-l1-1-0.dll

GetSystemMetrics (Address: 0x1017a3c8)
SystemParametersInfoW (Address: 0x1017a3c4)

api-ms-win-security-base-l1-1-0.dll

CheckTokenMembership (Address: 0x1017a3d0)
CreateWellKnownSid (Address: 0x1017a3e4)
EqualSid (Address: 0x1017a3d4)
GetSidSubAuthority (Address: 0x1017a3e0)
GetSidSubAuthorityCount (Address: 0x1017a3dc)
GetTokenInformation (Address: 0x1017a3d8)

GDI32.dll

GetStockObject (Address: 0x1017a024)

KERNEL32.dll

AcquireSRWLockExclusive (Address: 0x1017a0f4)
AcquireSRWLockShared (Address: 0x1017a138)
CloseHandle (Address: 0x1017a128)
CloseThreadpoolTimer (Address: 0x1017a0f0)
CreateEventA (Address: 0x1017a064)
CreateEventW (Address: 0x1017a090)
CreateMutexExW (Address: 0x1017a0dc)
CreateSemaphoreExW (Address: 0x1017a060)
CreateThreadpoolTimer (Address: 0x1017a100)
DebugBreak (Address: 0x1017a0b8)
DecodePointer (Address: 0x1017a02c)
DeleteCriticalSection (Address: 0x1017a0d0)
DisableThreadLibraryCalls (Address: 0x1017a134)
EncodePointer (Address: 0x1017a030)
EnterCriticalSection (Address: 0x1017a054)
ExitProcess (Address: 0x1017a048)
FormatMessageW (Address: 0x1017a0a8)
FreeLibrary (Address: 0x1017a0bc)
GetCurrentProcess (Address: 0x1017a098)
GetCurrentProcessId (Address: 0x1017a0cc)
GetCurrentThreadId (Address: 0x1017a088)
GetLastError (Address: 0x1017a0ac)
GetLocaleInfoW (Address: 0x1017a034)
GetLocalTime (Address: 0x1017a0f8)
GetModuleFileNameA (Address: 0x1017a070)
GetModuleFileNameW (Address: 0x1017a084)
GetModuleHandleExW (Address: 0x1017a130)
GetModuleHandleW (Address: 0x1017a0c0)
GetProcAddress (Address: 0x1017a0e0)
GetProcessHeap (Address: 0x1017a0c8)
GetProcessId (Address: 0x1017a080)
GetStringTypeW (Address: 0x1017a03c)
GetSystemInfo (Address: 0x1017a068)
GetSystemTimeAsFileTime (Address: 0x1017a11c)
GetTickCount (Address: 0x1017a120)
HeapAlloc (Address: 0x1017a0fc)
HeapFree (Address: 0x1017a05c)
InitializeCriticalSectionEx (Address: 0x1017a074)
IsDebuggerPresent (Address: 0x1017a0a4)
LeaveCriticalSection (Address: 0x1017a0d4)
LoadLibraryExW (Address: 0x1017a0b0)
LocalFree (Address: 0x1017a0d8)
LocalLock (Address: 0x1017a06c)
LocalUnlock (Address: 0x1017a0b4)
MultiByteToWideChar (Address: 0x1017a040)
OpenEventW (Address: 0x1017a050)
OpenSemaphoreW (Address: 0x1017a13c)
OutputDebugStringW (Address: 0x1017a0e8)
QueryFullProcessImageNameW (Address: 0x1017a044)
QueryPerformanceCounter (Address: 0x1017a118)
RaiseException (Address: 0x1017a124)
ReleaseMutex (Address: 0x1017a08c)
ReleaseSemaphore (Address: 0x1017a12c)
ReleaseSRWLockExclusive (Address: 0x1017a0e4)
ReleaseSRWLockShared (Address: 0x1017a104)
ResetEvent (Address: 0x1017a0a0)
SetEvent (Address: 0x1017a0ec)
SetLastError (Address: 0x1017a058)
SetThreadpoolTimer (Address: 0x1017a108)
SetUnhandledExceptionFilter (Address: 0x1017a114)
Sleep (Address: 0x1017a04c)
SleepConditionVariableSRW (Address: 0x1017a10c)
SystemTimeToFileTime (Address: 0x1017a0c4)
TerminateProcess (Address: 0x1017a094)
UnhandledExceptionFilter (Address: 0x1017a110)
WaitForSingleObject (Address: 0x1017a07c)
WaitForSingleObjectEx (Address: 0x1017a140)
WaitForThreadpoolTimerCallbacks (Address: 0x1017a078)
WakeAllConditionVariable (Address: 0x1017a09c)
WideCharToMultiByte (Address: 0x1017a038)

msvcrt.dll

___lc_codepage_func (Address: 0x1017a468)
___lc_collate_cp_func (Address: 0x1017a4b4)
___lc_handle_func (Address: 0x1017a4ac)
___mb_cur_max_func (Address: 0x1017a3ec)
__crtCompareStringA (Address: 0x1017a40c)
__crtCompareStringW (Address: 0x1017a408)
__crtLCMapStringA (Address: 0x1017a428)
__crtLCMapStringW (Address: 0x1017a41c)
__CxxFrameHandler3 (Address: 0x1017a5c8)
__dllonexit (Address: 0x1017a4f0)
__ExceptionPtrCopy (Address: 0x1017a57c)
__ExceptionPtrCreate (Address: 0x1017a578)
__ExceptionPtrCurrentException (Address: 0x1017a584)
__ExceptionPtrDestroy (Address: 0x1017a580)
__ExceptionPtrRethrow (Address: 0x1017a588)
__mb_cur_max (Address: 0x1017a47c)
__pctype_func (Address: 0x1017a4d4)
__RTDynamicCast (Address: 0x1017a5cc)
__RTtypeid (Address: 0x1017a5a0)
__uncaught_exception (Address: 0x1017a4dc)
_amsg_exit (Address: 0x1017a4e4)
_beginthreadex (Address: 0x1017a5a8)
_callnewh (Address: 0x1017a478)
_CxxThrowException (Address: 0x1017a4a0)
_errno (Address: 0x1017a414)
_except_handler4_common (Address: 0x1017a504)
_fseeki64 (Address: 0x1017a534)
_ftol2 (Address: 0x1017a5d0)
_Getdays (Address: 0x1017a45c)
_Getmonths (Address: 0x1017a460)
_Gettnames (Address: 0x1017a484)
_gmtime64 (Address: 0x1017a53c)
_initterm (Address: 0x1017a4e8)
_ismbblead (Address: 0x1017a3f0)
_lock (Address: 0x1017a480)
_mkgmtime (Address: 0x1017a538)
_onexit (Address: 0x1017a4f8)
_purecall (Address: 0x1017a494)
_putws (Address: 0x1017a594)
_Strftime (Address: 0x1017a490)
_stricmp (Address: 0x1017a554)
_unlock (Address: 0x1017a48c)
_vsnprintf_s (Address: 0x1017a42c)
_vsnwprintf (Address: 0x1017a5c0)
_W_Getdays (Address: 0x1017a464)
_W_Getmonths (Address: 0x1017a46c)
_W_Gettnames (Address: 0x1017a470)
_wcsdup (Address: 0x1017a3fc)
_Wcsftime (Address: 0x1017a474)
_wcsicmp (Address: 0x1017a4c0)
_wcsnicmp (Address: 0x1017a550)
_wfopen_s (Address: 0x1017a560)
_wfsopen (Address: 0x1017a5b0)
_wsetlocale (Address: 0x1017a434)
_wtoi (Address: 0x1017a540)
_XcptFilter (Address: 0x1017a4e0)
??_V@YAXPAX@Z (Address: 0x1017a5c4)
??0bad_cast@@QAE@ABV0@@Z (Address: 0x1017a5b4)
??0bad_cast@@QAE@PBD@Z (Address: 0x1017a5b8)
??0bad_typeid@@QAE@ABV0@@Z (Address: 0x1017a59c)
??0exception@@QAE@ABQBD@Z (Address: 0x1017a440)
??0exception@@QAE@ABQBDH@Z (Address: 0x1017a43c)
??0exception@@QAE@ABV0@@Z (Address: 0x1017a4f4)
??0exception@@QAE@XZ (Address: 0x1017a454)
??1bad_cast@@UAE@XZ (Address: 0x1017a5bc)
??1bad_typeid@@UAE@XZ (Address: 0x1017a598)
??1exception@@UAE@XZ (Address: 0x1017a458)
??1type_info@@UAE@XZ (Address: 0x1017a500)
??3@YAXPAX@Z (Address: 0x1017a444)
??8type_info@@QBEHABV0@@Z (Address: 0x1017a400)
??9type_info@@QBEHABV0@@Z (Address: 0x1017a404)
?before@type_info@@QBEHABV1@@Z (Address: 0x1017a5ac)
?name@type_info@@QBEPBDXZ (Address: 0x1017a510)
?terminate@@YAXXZ (Address: 0x1017a4ec)
?what@exception@@UBEPBDXZ (Address: 0x1017a488)
abort (Address: 0x1017a448)
calloc (Address: 0x1017a438)
fclose (Address: 0x1017a508)
feof (Address: 0x1017a574)
ferror (Address: 0x1017a570)
fflush (Address: 0x1017a51c)
fgetc (Address: 0x1017a520)
fgetpos (Address: 0x1017a524)
fputc (Address: 0x1017a518)
fread (Address: 0x1017a568)
free (Address: 0x1017a424)
fseek (Address: 0x1017a564)
fsetpos (Address: 0x1017a530)
ftell (Address: 0x1017a55c)
fwrite (Address: 0x1017a50c)
isalnum (Address: 0x1017a4c8)
isdigit (Address: 0x1017a4cc)
islower (Address: 0x1017a3f8)
isspace (Address: 0x1017a49c)
isupper (Address: 0x1017a4d0)
ldexp (Address: 0x1017a450)
ldiv (Address: 0x1017a548)
localeconv (Address: 0x1017a430)
malloc (Address: 0x1017a418)
mbstowcs_s (Address: 0x1017a558)
memchr (Address: 0x1017a4b0)
memcmp (Address: 0x1017a4bc)
memcpy (Address: 0x1017a4a8)
memcpy_s (Address: 0x1017a4fc)
memmove (Address: 0x1017a4c4)
memmove_s (Address: 0x1017a420)
memset (Address: 0x1017a3f4)
realloc (Address: 0x1017a44c)
setlocale (Address: 0x1017a498)
setvbuf (Address: 0x1017a528)
sprintf_s (Address: 0x1017a4d8)
strchr (Address: 0x1017a544)
strcspn (Address: 0x1017a4b8)
strerror (Address: 0x1017a5a4)
swprintf_s (Address: 0x1017a514)
time (Address: 0x1017a54c)
tolower (Address: 0x1017a4a4)
towlower (Address: 0x1017a56c)
ungetc (Address: 0x1017a52c)
wcscpy_s (Address: 0x1017a410)
wcsncpy_s (Address: 0x1017a58c)
wprintf (Address: 0x1017a590)

ole32.dll

CoCreateInstance (Address: 0x1017a5d8)
CoInitializeEx (Address: 0x1017a5e0)
CoUninitialize (Address: 0x1017a5dc)
OleRun (Address: 0x1017a5e4)

OLEAUT32.dll

GetRecordInfoFromTypeInfo (Address: 0x1017a178)
LoadRegTypeLib (Address: 0x1017a174)
SafeArrayAccessData (Address: 0x1017a180)
SafeArrayCreate (Address: 0x1017a184)
SafeArrayCreateEx (Address: 0x1017a168)
SafeArrayDestroy (Address: 0x1017a18c)
SafeArrayGetLBound (Address: 0x1017a16c)
SafeArrayGetUBound (Address: 0x1017a170)
SafeArrayPutElement (Address: 0x1017a164)
SafeArrayRedim (Address: 0x1017a17c)
SafeArrayUnaccessData (Address: 0x1017a188)
SysAllocString (Address: 0x1017a148)
SysAllocStringByteLen (Address: 0x1017a158)
SysAllocStringLen (Address: 0x1017a15c)
SysFreeString (Address: 0x1017a14c)
SysStringLen (Address: 0x1017a154)
VariantClear (Address: 0x1017a190)
VariantCopy (Address: 0x1017a160)
VariantInit (Address: 0x1017a150)

SHELL32.dll

DoEnvironmentSubstW (Address: 0x1017a198)
SHChangeNotify (Address: 0x1017a19c)

USER32.dll

CreateWindowExW (Address: 0x1017a1c8)
DefWindowProcW (Address: 0x1017a1cc)
DispatchMessageW (Address: 0x1017a1ac)
GetDoubleClickTime (Address: 0x1017a1d8)
GetMessageW (Address: 0x1017a1e0)
GetSysColor (Address: 0x1017a1dc)
GetWindowLongW (Address: 0x1017a1b8)
LoadCursorW (Address: 0x1017a1bc)
LoadIconW (Address: 0x1017a1e8)
LoadStringW (Address: 0x1017a1a8)
RegisterClassExW (Address: 0x1017a1a4)
SendNotifyMessageW (Address: 0x1017a1d0)
SetSysColors (Address: 0x1017a1d4)
SetWindowLongW (Address: 0x1017a1c0)
ShutdownBlockReasonCreate (Address: 0x1017a1b0)
ShutdownBlockReasonDestroy (Address: 0x1017a1c4)
TranslateMessage (Address: 0x1017a1e4)
WaitForInputIdle (Address: 0x1017a1b4)

WTSAPI32.dll

WTSRegisterSessionNotification (Address: 0x1017a1f4)
WTSUnRegisterSessionNotification (Address: 0x1017a1f0)

Exported Functions

Imported DLLs & Functions