netlogon.dll

Description: Net Logon Services DLL

Version: 10.0.19041.6328

Architecture: 32-bit

Operating System: Windows NT

SHA256: af5da3ed274c1da49afb5b1ba28cd0b0

File Size: 702.5 KB

Uploaded At: Dec. 1, 2025, 8:02 a.m.

Views: 12

Exported Functions

DsrGetDcNameEx2 (Ordinal: 1, Address: 0x5e150)
I_NetLogonAddressToSiteName (Ordinal: 2, Address: 0x71ab0)
I_NetLogonAppendChangeLog (Ordinal: 3, Address: 0x52dd0)
I_NetLogonCloseChangeLog (Ordinal: 4, Address: 0x52e00)
I_NetLogonFree (Ordinal: 5, Address: 0x69720)
I_NetLogonGetAuthDataEx (Ordinal: 6, Address: 0x5e720)
I_NetLogonGetSerialNumber (Ordinal: 7, Address: 0x52210)
I_NetLogonLdapLookupEx (Ordinal: 8, Address: 0x8e720)
I_NetLogonMixedDomain (Ordinal: 9, Address: 0x869d0)
I_NetLogonNewChangeLog (Ordinal: 10, Address: 0x52e50)
I_NetLogonReadChangeLog (Ordinal: 11, Address: 0x52ea0)
I_NetLogonSendToSamOnDc (Ordinal: 12, Address: 0x5ea50)
I_NetLogonSetServiceBits (Ordinal: 13, Address: 0x52270)
I_NetNotifyDelta (Ordinal: 14, Address: 0x52300)
I_NetNotifyDsChange (Ordinal: 15, Address: 0x52320)
I_NetNotifyMachineAccount (Ordinal: 16, Address: 0x52400)
I_NetNotifyNetlogonDllHandle (Ordinal: 17, Address: 0x52500)
I_NetNotifyNtdsDsaDeletion (Ordinal: 18, Address: 0x52560)
I_NetNotifyRole (Ordinal: 19, Address: 0x525d0)
I_NetNotifyTrustedDomain (Ordinal: 20, Address: 0x52600)
InitSecurityInterfaceW (Ordinal: 21, Address: 0x48ed0)
NetIGetEncTypes (Ordinal: 22, Address: 0x62ce0)
NetILogonSamLogon (Ordinal: 23, Address: 0x5eee0)
NlNetlogonMain (Ordinal: 24, Address: 0x6cf00)

Imported DLLs & Functions

api-ms-win-core-apiquery-l1-1-0.dll

ApiSetQueryApiSetPresence (Address: 0x50226204)

api-ms-win-core-debug-l1-1-0.dll

IsDebuggerPresent (Address: 0x5022620c)

api-ms-win-core-delayload-l1-1-0.dll

DelayLoadFailureHook (Address: 0x50226214)

api-ms-win-core-delayload-l1-1-1.dll

ResolveDelayLoadedAPI (Address: 0x5022621c)

api-ms-win-core-errorhandling-l1-1-0.dll

GetLastError (Address: 0x50226228)
SetLastError (Address: 0x50226230)
SetUnhandledExceptionFilter (Address: 0x50226224)
UnhandledExceptionFilter (Address: 0x5022622c)

api-ms-win-core-errorhandling-l1-1-2.dll

RaiseFailFastException (Address: 0x50226238)

api-ms-win-core-file-l1-1-0.dll

CreateDirectoryW (Address: 0x50226254)
CreateFileW (Address: 0x50226258)
DeleteFileW (Address: 0x50226244)
GetFileAttributesW (Address: 0x50226240)
GetFileSize (Address: 0x5022625c)
ReadFile (Address: 0x5022624c)
SetFilePointer (Address: 0x50226248)
WriteFile (Address: 0x50226250)

api-ms-win-core-file-l2-1-0.dll

MoveFileExW (Address: 0x50226264)

api-ms-win-core-handle-l1-1-0.dll

CloseHandle (Address: 0x5022626c)
DuplicateHandle (Address: 0x50226270)

api-ms-win-core-heap-l1-1-0.dll

GetProcessHeap (Address: 0x50226278)
HeapAlloc (Address: 0x50226280)
HeapFree (Address: 0x5022627c)

api-ms-win-core-heap-l2-1-0.dll

GlobalFree (Address: 0x50226288)
LocalAlloc (Address: 0x50226290)
LocalFree (Address: 0x5022628c)
LocalReAlloc (Address: 0x50226294)

api-ms-win-core-interlocked-l1-1-0.dll

InitializeSListHead (Address: 0x5022629c)

api-ms-win-core-io-l1-1-0.dll

DeviceIoControl (Address: 0x502262a8)
GetOverlappedResult (Address: 0x502262a4)

api-ms-win-core-kernel32-legacy-l1-1-0.dll

CreateMailslotA (Address: 0x502262b4)
SetMailslotInfo (Address: 0x502262b0)

api-ms-win-core-libraryloader-l1-2-0.dll

DisableThreadLibraryCalls (Address: 0x502262bc)
FreeLibrary (Address: 0x502262cc)
GetModuleFileNameW (Address: 0x502262d0)
GetModuleHandleW (Address: 0x502262d4)
GetProcAddress (Address: 0x502262c4)
LoadLibraryExW (Address: 0x502262c0)
LoadStringW (Address: 0x502262c8)

api-ms-win-core-localization-l1-2-0.dll

FormatMessageW (Address: 0x502262dc)

api-ms-win-core-memory-l1-1-0.dll

VirtualAlloc (Address: 0x502262ec)
VirtualProtect (Address: 0x502262e8)
VirtualQuery (Address: 0x502262e4)

api-ms-win-core-perfcounters-l1-1-0.dll

PerfCreateInstance (Address: 0x50226300)
PerfDecrementULongCounterValue (Address: 0x502262fc)
PerfDeleteInstance (Address: 0x5022630c)
PerfIncrementULongCounterValue (Address: 0x50226308)
PerfIncrementULongLongCounterValue (Address: 0x50226304)
PerfSetCounterSetInfo (Address: 0x50226310)
PerfStartProviderEx (Address: 0x502262f4)
PerfStopProvider (Address: 0x502262f8)

api-ms-win-core-processenvironment-l1-1-0.dll

ExpandEnvironmentStringsW (Address: 0x50226318)

api-ms-win-core-processthreads-l1-1-0.dll

CreateThread (Address: 0x5022632c)
GetCurrentProcess (Address: 0x50226324)
GetCurrentProcessId (Address: 0x50226320)
GetCurrentThread (Address: 0x50226334)
GetCurrentThreadId (Address: 0x50226330)
OpenThreadToken (Address: 0x5022633c)
SetThreadStackGuarantee (Address: 0x50226338)
TerminateProcess (Address: 0x50226328)

api-ms-win-core-processthreads-l1-1-1.dll

IsProcessorFeaturePresent (Address: 0x50226344)

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter (Address: 0x5022634c)
QueryPerformanceFrequency (Address: 0x50226350)

api-ms-win-core-registry-l1-1-0.dll

RegCloseKey (Address: 0x50226368)
RegCreateKeyExA (Address: 0x50226378)
RegDeleteKeyExW (Address: 0x50226360)
RegDeleteValueW (Address: 0x50226374)
RegNotifyChangeKeyValue (Address: 0x50226370)
RegOpenKeyExA (Address: 0x5022637c)
RegOpenKeyExW (Address: 0x5022636c)
RegQueryInfoKeyW (Address: 0x50226358)
RegQueryValueExA (Address: 0x50226364)
RegQueryValueExW (Address: 0x50226380)
RegSetValueExW (Address: 0x5022635c)

api-ms-win-core-string-l1-1-0.dll

CompareStringOrdinal (Address: 0x50226390)
MultiByteToWideChar (Address: 0x50226388)
WideCharToMultiByte (Address: 0x5022638c)

api-ms-win-core-string-obsolete-l1-1-0.dll

lstrcmpA (Address: 0x5022639c)
lstrcmpW (Address: 0x50226398)

api-ms-win-core-synch-l1-1-0.dll

AcquireSRWLockExclusive (Address: 0x502263c0)
AcquireSRWLockShared (Address: 0x502263dc)
CreateEventW (Address: 0x502263d8)
CreateSemaphoreExW (Address: 0x502263c8)
DeleteCriticalSection (Address: 0x502263e4)
EnterCriticalSection (Address: 0x502263a8)
InitializeCriticalSection (Address: 0x502263e0)
InitializeSRWLock (Address: 0x502263cc)
LeaveCriticalSection (Address: 0x502263e8)
OpenEventW (Address: 0x502263b4)
ReleaseSemaphore (Address: 0x502263c4)
ReleaseSRWLockExclusive (Address: 0x502263d0)
ReleaseSRWLockShared (Address: 0x502263b0)
ResetEvent (Address: 0x502263d4)
SetEvent (Address: 0x502263a4)
WaitForMultipleObjectsEx (Address: 0x502263bc)
WaitForSingleObject (Address: 0x502263ac)
WaitForSingleObjectEx (Address: 0x502263b8)

api-ms-win-core-synch-l1-2-0.dll

InitOnceExecuteOnce (Address: 0x502263f4)
Sleep (Address: 0x502263f0)

api-ms-win-core-sysinfo-l1-1-0.dll

GetComputerNameExW (Address: 0x50226408)
GetLocalTime (Address: 0x50226414)
GetSystemInfo (Address: 0x50226410)
GetSystemTimeAsFileTime (Address: 0x50226400)
GetSystemWindowsDirectoryW (Address: 0x502263fc)
GetTickCount (Address: 0x50226404)
GetTickCount64 (Address: 0x50226418)
GetVersionExW (Address: 0x5022640c)

api-ms-win-core-sysinfo-l1-2-0.dll

SetComputerNameExW (Address: 0x50226420)

api-ms-win-core-threadpool-l1-2-0.dll

CloseThreadpoolCleanupGroup (Address: 0x50226438)
CloseThreadpoolCleanupGroupMembers (Address: 0x5022644c)
CloseThreadpoolTimer (Address: 0x50226434)
CloseThreadpoolWork (Address: 0x5022642c)
CreateThreadpoolCleanupGroup (Address: 0x50226440)
CreateThreadpoolTimer (Address: 0x50226428)
CreateThreadpoolWork (Address: 0x50226444)
SetThreadpoolTimer (Address: 0x5022643c)
SubmitThreadpoolWork (Address: 0x50226448)
WaitForThreadpoolTimerCallbacks (Address: 0x50226430)

api-ms-win-core-threadpool-legacy-l1-1-0.dll

QueueUserWorkItem (Address: 0x50226458)
UnregisterWaitEx (Address: 0x50226454)

api-ms-win-core-threadpool-private-l1-1-0.dll

RegisterWaitForSingleObjectEx (Address: 0x50226460)

api-ms-win-core-timezone-l1-1-0.dll

FileTimeToSystemTime (Address: 0x50226468)

api-ms-win-crt-private-l1-1-0.dll

_except_handler4_common (Address: 0x502264d8)
_local_unwind4 (Address: 0x50226514)
_o___std_type_info_destroy_list (Address: 0x50226504)
_o___stdio_common_vsnwprintf_s (Address: 0x50226500)
_o___stdio_common_vsprintf (Address: 0x502264fc)
_o___stdio_common_vsprintf_s (Address: 0x502264f8)
_o___stdio_common_vswprintf (Address: 0x502264f4)
_o___stdio_common_vswprintf_s (Address: 0x502264f0)
_o__callnewh (Address: 0x502264ec)
_o__cexit (Address: 0x502264e8)
_o__configure_narrow_argv (Address: 0x502264e4)
_o__execute_onexit_table (Address: 0x502264e0)
_o__initialize_narrow_environment (Address: 0x50226470)
_o__initialize_onexit_table (Address: 0x50226474)
_o__itoa_s (Address: 0x50226478)
_o__ltoa (Address: 0x5022647c)
_o__seh_filter_dll (Address: 0x50226480)
_o__stricmp (Address: 0x50226484)
_o__strnicmp (Address: 0x50226488)
_o__ultoa_s (Address: 0x5022648c)
_o__ultow (Address: 0x50226490)
_o__ultow_s (Address: 0x50226494)
_o__wcsicmp (Address: 0x50226498)
_o__wcslwr (Address: 0x5022649c)
_o__wcsnicmp (Address: 0x502264a0)
_o_free (Address: 0x502264a8)
_o_isprint (Address: 0x502264ac)
_o_malloc (Address: 0x502264b0)
_o_qsort (Address: 0x502264b4)
_o_rand_s (Address: 0x502264b8)
_o_strcat_s (Address: 0x502264bc)
_o_strcpy_s (Address: 0x502264c0)
_o_towupper (Address: 0x502264c4)
_o_wcscat_s (Address: 0x502264c8)
_o_wcscpy_s (Address: 0x502264cc)
_o_wcsncpy_s (Address: 0x502264d0)
_o_wcstoul (Address: 0x502264d4)
memcmp (Address: 0x50226518)
memcpy (Address: 0x5022651c)
memmove (Address: 0x502264a4)
strchr (Address: 0x502264dc)
wcschr (Address: 0x50226510)
wcsrchr (Address: 0x5022650c)
wcsstr (Address: 0x50226508)

api-ms-win-crt-runtime-l1-1-0.dll

_initterm (Address: 0x50226528)
_initterm_e (Address: 0x50226524)

api-ms-win-crt-string-l1-1-0.dll

memset (Address: 0x50226534)
wcsspn (Address: 0x50226530)

api-ms-win-eventlog-legacy-l1-1-0.dll

DeregisterEventSource (Address: 0x5022653c)
RegisterEventSourceW (Address: 0x50226544)
ReportEventW (Address: 0x50226540)

api-ms-win-power-setting-l1-1-0.dll

PowerSettingRegisterNotification (Address: 0x5022654c)
PowerSettingUnregisterNotification (Address: 0x50226550)

api-ms-win-security-activedirectoryclient-l1-1-0.dll

DsBindWithSpnExW (Address: 0x50226568)
DsCrackNamesW (Address: 0x50226558)
DsFreeDomainControllerInfoW (Address: 0x50226564)
DsFreeNameResultW (Address: 0x5022655c)
DsGetDomainControllerInfoW (Address: 0x50226560)
DsUnBindW (Address: 0x5022656c)

api-ms-win-security-activedirectoryclient-l1-1-1.dll

DsFreeNgcKey (Address: 0x50226574)

api-ms-win-security-base-l1-1-0.dll

AccessCheck (Address: 0x5022657c)
AllocateAndInitializeSid (Address: 0x50226584)
FreeSid (Address: 0x50226580)

api-ms-win-security-lsalookup-l2-1-0.dll

LookupAccountSidW (Address: 0x5022658c)
LsaEnumerateTrustedDomains (Address: 0x50226590)

api-ms-win-service-core-l1-1-0.dll

SetServiceStatus (Address: 0x50226598)

api-ms-win-service-management-l1-1-0.dll

CloseServiceHandle (Address: 0x502265a0)
OpenSCManagerW (Address: 0x502265a4)
OpenServiceW (Address: 0x502265a8)

api-ms-win-service-management-l2-1-0.dll

QueryServiceConfigW (Address: 0x502265b0)

api-ms-win-service-winsvc-l1-1-0.dll

QueryServiceStatus (Address: 0x502265bc)
RegisterServiceCtrlHandlerW (Address: 0x502265b8)

cryptdll.dll

CDGetIntegrityVect (Address: 0x502265cc)
CDLocateCheckSum (Address: 0x502265c4)
CDLocateCSystem (Address: 0x502265c8)

gmsaclient.dll

GMSAAdd (Address: 0x502265dc)
GMSACheckIfExistsInAD (Address: 0x502265e4)
GMSACleanup (Address: 0x502265e8)
GMSADelete (Address: 0x502265ec)
GMSAGetPassword (Address: 0x502265e0)
GMSAInit (Address: 0x502265d8)
GMSARefreshPasswords (Address: 0x502265d4)

logoncli.dll

I_DsUpdateReadOnlyServerDnsRecords (Address: 0x502265f4)
I_NetChainSetClientAttributes (Address: 0x50226608)
I_NetChainSetClientAttributes2 (Address: 0x5022660c)
I_NetGetForestTrustInformation (Address: 0x50226624)
I_NetLogonGetCapabilities (Address: 0x50226604)
I_NetLogonGetDomainInfo (Address: 0x5022662c)
I_NetLogonSamLogoff (Address: 0x50226620)
I_NetLogonSamLogon (Address: 0x50226630)
I_NetLogonSamLogonEx (Address: 0x50226638)
I_NetLogonSamLogonWithFlags (Address: 0x50226634)
I_NetLogonSendToSam (Address: 0x502265f8)
I_NetServerAuthenticate (Address: 0x50226644)
I_NetServerAuthenticate2 (Address: 0x50226610)
I_NetServerAuthenticate3 (Address: 0x50226614)
I_NetServerGetTrustInfo (Address: 0x50226648)
I_NetServerPasswordSet (Address: 0x50226640)
I_NetServerPasswordSet2 (Address: 0x5022663c)
I_NetServerReqChallenge (Address: 0x50226618)
NetGetDCName (Address: 0x50226600)
NlBindingAddServerToCache (Address: 0x502265fc)
NlBindingRemoveServerFromCache (Address: 0x50226628)
NlBindingSetAuthInfo (Address: 0x5022661c)

LSASRV.dll

LsaICallPackage (Address: 0x502260cc)
LsaICallPackagePassthrough (Address: 0x502260a4)
LsaIExtractTargetInfo (Address: 0x50226058)
LsaIFilterInboundNamespace (Address: 0x50226054)
LsaIFilterNamespace (Address: 0x50226040)
LsaIFilterSids (Address: 0x502260d4)
LsaIForestTrustFindMatch (Address: 0x502260a0)
LsaIFree_LSAP_SITE_INFO (Address: 0x5022603c)
LsaIFree_LSAP_SITENAME_INFO (Address: 0x5022606c)
LsaIFree_LSAP_SUBNET_INFO (Address: 0x50226078)
LsaIFree_LSAPR_CR_CIPHER_VALUE (Address: 0x50226098)
LsaIFree_LSAPR_POLICY_INFORMATION (Address: 0x50226070)
LsaIFree_LSAPR_TRUSTED_DOMAIN_INFO (Address: 0x50226000)
LsaIFree_LSAPR_TRUSTED_ENUM_BUFFER_EX (Address: 0x50226024)
LsaIFree_LSAPR_UNICODE_STRING_BUFFER (Address: 0x5022602c)
LsaIFreeFilterInboundNamespaceResult (Address: 0x502260ac)
LsaIFreeForestTrustInfo (Address: 0x50226068)
LsaIFreeHeap (Address: 0x50226018)
LsaIFreeReturnBuffer (Address: 0x502260d0)
LsaIGetCcgClient (Address: 0x502260c8)
LsaIGetClientOsInfo (Address: 0x50226048)
LsaIGetForestTrustInformation (Address: 0x5022608c)
LsaIGetNbAndDnsDomainNames (Address: 0x50226020)
LsaIGetSiteName (Address: 0x5022609c)
LsaIInitializeNetlogonFuncPtrs (Address: 0x502260a8)
LsaIIsContainerized (Address: 0x502260c0)
LsaIIsDsPaused (Address: 0x502260d8)
LsaIIsInEmulatedDomainJoinMode (Address: 0x50226080)
LsaINoMoreWin2KDomain (Address: 0x50226064)
LsaINotifyNetlogonParametersChangeW (Address: 0x502260b4)
LsaIOpenPolicyTrusted (Address: 0x5022605c)
LsaIQueryForestTrustInfo (Address: 0x5022600c)
LsaIQuerySiteInfo (Address: 0x50226038)
LsaIQuerySubnetInfo (Address: 0x5022607c)
LsaIRegisterPolicyChangeNotificationCallback (Address: 0x50226034)
LsaIReplicateClientObject (Address: 0x5022604c)
LsaISafeMode (Address: 0x502260bc)
LsaISetClientDnsHostName (Address: 0x50226008)
LsaITransformAuthorizationData (Address: 0x5022601c)
LsaIUnregisterAllPolicyChangeNotificationCallback (Address: 0x50226028)
LsaIUpdateForestTrustInformation (Address: 0x50226088)
LsaIValidateTargetInfo (Address: 0x50226044)
LsaIVerifyCachability (Address: 0x50226014)
LsarClose (Address: 0x50226074)
LsarCreateSecret (Address: 0x502260b8)
LsarDeleteObject (Address: 0x502260c4)
LsarEnumerateTrustedDomainsEx (Address: 0x50226010)
LsarOpenPolicy (Address: 0x50226084)
LsarOpenSecret (Address: 0x50226090)
LsarQueryInformationPolicy (Address: 0x50226060)
LsarQuerySecret (Address: 0x50226094)
LsarQueryTrustedDomainInfoByName (Address: 0x50226004)
LsarSetInformationPolicy (Address: 0x50226050)
LsarSetSecret (Address: 0x502260b0)
LsarSetTrustedDomainInfoByName (Address: 0x50226030)

lsass.exe

LsaGetInterface (Address: 0x50226650)

ntdll.dll

DbgPrint (Address: 0x502266cc)
EtwEventRegister (Address: 0x50226690)
EtwEventSetInformation (Address: 0x50226694)
EtwEventUnregister (Address: 0x5022668c)
EtwEventWriteTransfer (Address: 0x50226684)
EtwGetTraceEnableFlags (Address: 0x502266a4)
EtwGetTraceEnableLevel (Address: 0x502266a0)
EtwGetTraceLoggerHandle (Address: 0x5022669c)
EtwLogTraceEvent (Address: 0x502266dc)
EtwRegisterTraceGuidsW (Address: 0x502266a8)
EtwTraceMessage (Address: 0x502267d4)
EtwUnregisterTraceGuids (Address: 0x50226784)
NtCancelIoFile (Address: 0x5022667c)
NtClose (Address: 0x50226660)
NtCreateEvent (Address: 0x502266ac)
NtCreateFile (Address: 0x50226680)
NtDeviceIoControlFile (Address: 0x502267d8)
NtImpersonateAnonymousToken (Address: 0x502266f4)
NtOpenEvent (Address: 0x502266b0)
NtOpenFile (Address: 0x50226674)
NtOpenProcessToken (Address: 0x5022675c)
NtOpenThreadToken (Address: 0x50226720)
NtQueryInformationToken (Address: 0x502267c4)
NtQuerySystemTime (Address: 0x50226730)
NtSetEvent (Address: 0x502267d0)
NtSetInformationThread (Address: 0x502266f8)
RtlAcquireResourceExclusive (Address: 0x50226790)
RtlAcquireResourceShared (Address: 0x50226698)
RtlAddAce (Address: 0x50226744)
RtlAllocateHeap (Address: 0x50226770)
RtlAnsiStringToUnicodeString (Address: 0x5022672c)
RtlCompareMemoryUlong (Address: 0x50226710)
RtlCompareUnicodeString (Address: 0x502266d8)
RtlCompareUnicodeStrings (Address: 0x50226668)
RtlConvertSidToUnicodeString (Address: 0x502266c8)
RtlCopySid (Address: 0x502266e4)
RtlCopyUnicodeString (Address: 0x502266bc)
RtlCreateAcl (Address: 0x50226740)
RtlCreateSecurityDescriptor (Address: 0x50226748)
RtlCreateUnicodeString (Address: 0x502267a4)
RtlDeleteCriticalSection (Address: 0x50226778)
RtlDeleteElementGenericTableAvl (Address: 0x50226700)
RtlDeleteResource (Address: 0x50226788)
RtlDeleteSecurityObject (Address: 0x50226764)
RtlDowncaseUnicodeString (Address: 0x502266e8)
RtlDuplicateUnicodeString (Address: 0x502267cc)
RtlEnterCriticalSection (Address: 0x502267a0)
RtlEqualComputerName (Address: 0x50226794)
RtlEqualDomainName (Address: 0x50226798)
RtlEqualSid (Address: 0x502267b0)
RtlEqualUnicodeString (Address: 0x502266d0)
RtlExtendedMagicDivide (Address: 0x50226670)
RtlFreeHeap (Address: 0x50226774)
RtlFreeUnicodeString (Address: 0x502267ac)
RtlGetNtProductType (Address: 0x502267b4)
RtlImageNtHeader (Address: 0x50226780)
RtlInitAnsiString (Address: 0x5022676c)
RtlInitializeCriticalSection (Address: 0x5022677c)
RtlInitializeGenericTableAvl (Address: 0x502266fc)
RtlInitializeResource (Address: 0x502266b8)
RtlInitializeSid (Address: 0x5022673c)
RtlInitString (Address: 0x5022671c)
RtlInitUnicodeString (Address: 0x502267b8)
RtlInitUnicodeStringEx (Address: 0x5022666c)
RtlInsertElementGenericTableAvl (Address: 0x50226708)
RtlIntegerToUnicodeString (Address: 0x502266d4)
RtlIpv4AddressToStringExW (Address: 0x502266ec)
RtlIpv6AddressToStringExW (Address: 0x502266f0)
RtlLeaveCriticalSection (Address: 0x5022679c)
RtlLengthRequiredSid (Address: 0x50226738)
RtlLengthSid (Address: 0x502267bc)
RtlLookupElementGenericTableAvl (Address: 0x50226704)
RtlNewSecurityObject (Address: 0x50226760)
RtlNtStatusToDosError (Address: 0x50226714)
RtlNumberGenericTableElementsAvl (Address: 0x5022670c)
RtlOemStringToUnicodeString (Address: 0x50226724)
RtlOemToUnicodeN (Address: 0x50226678)
RtlReleaseResource (Address: 0x5022678c)
RtlSetDaclSecurityDescriptor (Address: 0x50226754)
RtlSetGroupSecurityDescriptor (Address: 0x50226750)
RtlSetOwnerSecurityDescriptor (Address: 0x5022674c)
RtlSetSaclSecurityDescriptor (Address: 0x50226758)
RtlSubAuthorityCountSid (Address: 0x5022665c)
RtlSubAuthoritySid (Address: 0x50226658)
RtlSystemTimeToLocalTime (Address: 0x502266c0)
RtlTimeToSecondsSince1970 (Address: 0x50226664)
RtlTimeToSecondsSince1980 (Address: 0x50226768)
RtlTimeToTimeFields (Address: 0x502266c4)
RtlUniform (Address: 0x50226734)
RtlUpcaseUnicodeString (Address: 0x502266b4)
RtlUpcaseUnicodeStringToOemString (Address: 0x50226688)
RtlUpcaseUnicodeToOemN (Address: 0x502267a8)
RtlValidSid (Address: 0x502267c0)
RtlxAnsiStringToUnicodeSize (Address: 0x50226728)
RtlxOemStringToUnicodeSize (Address: 0x502267c8)
RtlxUnicodeStringToOemSize (Address: 0x50226718)
WinSqmSetDWORD (Address: 0x502266e0)

RPCRT4.dll

I_RpcExceptionFilter (Address: 0x502260f0)
I_RpcMapWin32Status (Address: 0x50226104)
I_RpcServerInqRemoteConnAddress (Address: 0x502260f8)
NdrClientCall2 (Address: 0x502260e0)
NdrClientCall4 (Address: 0x502260ec)
NdrServerCall2 (Address: 0x5022614c)
RpcBindingFree (Address: 0x50226144)
RpcBindingFromStringBindingA (Address: 0x50226108)
RpcBindingFromStringBindingW (Address: 0x50226134)
RpcBindingInqAuthClientW (Address: 0x50226160)
RpcBindingInqMaxCalls (Address: 0x50226100)
RpcBindingServerFromClient (Address: 0x50226180)
RpcBindingSetAuthInfoExW (Address: 0x502260e8)
RpcBindingSetAuthInfoW (Address: 0x50226174)
RpcBindingToStringBindingW (Address: 0x5022613c)
RpcBindingVectorFree (Address: 0x50226150)
RpcCancelThread (Address: 0x502260fc)
RpcEpRegisterW (Address: 0x50226154)
RpcErrorEndEnumeration (Address: 0x50226114)
RpcErrorGetNextRecord (Address: 0x50226118)
RpcErrorStartEnumeration (Address: 0x5022611c)
RpcExceptionFilter (Address: 0x502260e4)
RpcImpersonateClient (Address: 0x5022616c)
RpcMgmtSetCancelTimeout (Address: 0x5022617c)
RpcRevertToSelf (Address: 0x50226178)
RpcServerInqBindings (Address: 0x50226138)
RpcServerInqCallAttributesW (Address: 0x5022610c)
RpcServerRegisterAuthInfoW (Address: 0x50226168)
RpcServerRegisterIf3 (Address: 0x5022612c)
RpcServerUnregisterIf (Address: 0x50226110)
RpcServerUseProtseqEpExA (Address: 0x50226158)
RpcServerUseProtseqEpW (Address: 0x50226170)
RpcServerUseProtseqExW (Address: 0x50226164)
RpcStringBindingComposeA (Address: 0x502260f4)
RpcStringBindingComposeW (Address: 0x5022615c)
RpcStringBindingParseW (Address: 0x50226140)
RpcStringFreeA (Address: 0x50226128)
RpcStringFreeW (Address: 0x50226148)
UuidCreate (Address: 0x50226120)
UuidEqual (Address: 0x50226124)
UuidToStringA (Address: 0x50226130)

SAMSRV.dll

SamIConnect (Address: 0x502261b0)
SamIDecodeClaimsBlobToAuthz (Address: 0x502261a4)
SamIFree_SAMPR_DOMAIN_INFO_BUFFER (Address: 0x502261c8)
SamIFree_SAMPR_ULONG_ARRAY (Address: 0x502261bc)
SamIFree_SAMPR_USER_INFO_BUFFER (Address: 0x5022618c)
SamIFree_UserInternal6Information (Address: 0x502261d8)
SamIFreeAuthzSecurityAttributesInfo (Address: 0x50226194)
SamIFreeClaimsBlob (Address: 0x50226188)
SamIFreeSidAndAttributesList (Address: 0x502261e0)
SamIFreeSidArray (Address: 0x50226198)
SamIGetResourceGroupMembershipsTransitive (Address: 0x502261a8)
SamIGetUserLogonInformation2 (Address: 0x502261d0)
SamIGetUserLogonInformationEx (Address: 0x50226190)
SamIMixedDomain (Address: 0x502261c0)
SamINetLogonPing (Address: 0x502261ac)
SamIQueryAccountSecretsCachability (Address: 0x502261e4)
SamIQueryCapabilities (Address: 0x502261a0)
SamIResetBadPwdCountOnPdc (Address: 0x502261cc)
SamISetMachinePassword (Address: 0x502261ec)
SamISetPasswordInfoOnDc (Address: 0x502261e8)
SamIUpdateLogonStatistics (Address: 0x502261d4)
SampDsIsRunning (Address: 0x5022619c)
SamrCloseHandle (Address: 0x502261b8)
SamrGetAliasMembership (Address: 0x502261dc)
SamrOpenDomain (Address: 0x502261b4)
SamrQueryInformationDomain (Address: 0x502261c4)
SamrSetInformationUser (Address: 0x502261f0)

USERENV.dll

RegisterGPNotification (Address: 0x502261fc)
UnregisterGPNotification (Address: 0x502261f8)