werui.dll
Description: Windows Error Reporting UI DLL
Authors: © Microsoft Corporation. All rights reserved.
Version: 10.0.19041.5794
Architecture: 32-bit
Operating System: Windows NT
SHA256: 61c7be6099e38d8e5f92da0b313cdb47
File Size: 210.0 KB
Uploaded At: Dec. 1, 2025, 8:06 a.m.
Views: 14
Security Warning
This file has been flagged as potentially dangerous.
Reason: Detected potentially dangerous functions used for process injection: OpenProcess
Exported Functions
- WerUIReportSilentProcessExit (Ordinal: 1, Address: 0xbd00)
- WerUICreate (Ordinal: 2, Address: 0x4e80)
- WerUIDelete (Ordinal: 3, Address: 0x4f30)
- WerUIGetUserSelection (Ordinal: 4, Address: 0x5000)
- WerUIPromptForSecondLevel (Ordinal: 5, Address: 0x5070)
- WerUIPromptUser (Ordinal: 6, Address: 0x5330)
- WerUIShowUpsell (Ordinal: 7, Address: 0x52d0)
- WerUIStart (Ordinal: 8, Address: 0x4f90)
- WerUITerminate (Ordinal: 9, Address: 0x50e0)
- WerUIUpdateStateProgress (Ordinal: 10, Address: 0x5230)
- WerUIUpdateUIForState (Ordinal: 11, Address: 0x51a0)
- WerUIWaitForUserAction (Ordinal: 12, Address: 0x5140)
- WerUIpCheckWindow (Ordinal: 13, Address: 0x4c10)
- WerUIpDefSubclassProc (Ordinal: 14, Address: 0x4df0)
- WerUIpHeadlessOrImersive (Ordinal: 15, Address: 0x4da0)
- WerUIpRemoveWindowSubclass (Ordinal: 16, Address: 0x4e60)
- WerUIpSetWindowSubclass (Ordinal: 17, Address: 0x4e10)
- WerUIpTaskDialogIndirect (Ordinal: 18, Address: 0x4e40)
- WerUIpUIHandleWERWindowMsg (Ordinal: 19, Address: 0x4d80)
Imported DLLs & Functions
api-ms-win-core-apiquery-l1-1-0.dll
- ApiSetQueryApiSetPresence (Address: 0x1001d274)
api-ms-win-core-console-l1-2-0.dll
- AttachConsole (Address: 0x1001d27c)
- FreeConsole (Address: 0x1001d280)
api-ms-win-core-console-l3-2-0.dll
- GetConsoleWindow (Address: 0x1001d288)
api-ms-win-core-debug-l1-1-0.dll
- DebugBreak (Address: 0x1001d298)
- IsDebuggerPresent (Address: 0x1001d294)
- OutputDebugStringW (Address: 0x1001d290)
api-ms-win-core-delayload-l1-1-0.dll
- DelayLoadFailureHook (Address: 0x1001d2a0)
api-ms-win-core-delayload-l1-1-1.dll
- ResolveDelayLoadedAPI (Address: 0x1001d2a8)
api-ms-win-core-errorhandling-l1-1-0.dll
- GetLastError (Address: 0x1001d2b0)
- SetLastError (Address: 0x1001d2bc)
- SetUnhandledExceptionFilter (Address: 0x1001d2b8)
- UnhandledExceptionFilter (Address: 0x1001d2b4)
api-ms-win-core-file-l1-1-0.dll
- CompareFileTime (Address: 0x1001d2d4)
- CreateFileW (Address: 0x1001d2d8)
- FindClose (Address: 0x1001d2cc)
- FindFirstFileExW (Address: 0x1001d2c8)
- FindFirstFileW (Address: 0x1001d2e4)
- FindNextFileW (Address: 0x1001d2d0)
- GetFileAttributesW (Address: 0x1001d2c4)
- GetFinalPathNameByHandleW (Address: 0x1001d2dc)
- GetLongPathNameW (Address: 0x1001d2e8)
- SetFileInformationByHandle (Address: 0x1001d2e0)
api-ms-win-core-handle-l1-1-0.dll
- CloseHandle (Address: 0x1001d2f0)
- DuplicateHandle (Address: 0x1001d2f4)
api-ms-win-core-heap-l1-1-0.dll
- GetProcessHeap (Address: 0x1001d304)
- HeapAlloc (Address: 0x1001d300)
- HeapFree (Address: 0x1001d2fc)
api-ms-win-core-heap-l2-1-0.dll
- LocalAlloc (Address: 0x1001d30c)
api-ms-win-core-io-l1-1-0.dll
- DeviceIoControl (Address: 0x1001d314)
api-ms-win-core-libraryloader-l1-2-0.dll
- DisableThreadLibraryCalls (Address: 0x1001d324)
- FreeLibrary (Address: 0x1001d334)
- FreeLibraryAndExitThread (Address: 0x1001d320)
- GetModuleFileNameA (Address: 0x1001d328)
- GetModuleHandleExW (Address: 0x1001d31c)
- GetModuleHandleW (Address: 0x1001d32c)
- GetProcAddress (Address: 0x1001d338)
- LoadLibraryExW (Address: 0x1001d330)
api-ms-win-core-libraryloader-l1-2-1.dll
- LoadLibraryW (Address: 0x1001d340)
api-ms-win-core-localization-l1-2-0.dll
- FormatMessageW (Address: 0x1001d348)
- GetThreadUILanguage (Address: 0x1001d34c)
api-ms-win-core-memory-l1-1-0.dll
- CreateFileMappingW (Address: 0x1001d354)
- MapViewOfFile (Address: 0x1001d35c)
- UnmapViewOfFile (Address: 0x1001d358)
api-ms-win-core-processenvironment-l1-1-0.dll
- ExpandEnvironmentStringsW (Address: 0x1001d364)
api-ms-win-core-processthreads-l1-1-0.dll
- CreateProcessW (Address: 0x1001d384)
- CreateThread (Address: 0x1001d378)
- GetCurrentProcess (Address: 0x1001d38c)
- GetCurrentProcessId (Address: 0x1001d37c)
- GetCurrentThreadId (Address: 0x1001d370)
- GetExitCodeThread (Address: 0x1001d388)
- GetProcessId (Address: 0x1001d394)
- GetProcessTimes (Address: 0x1001d36c)
- OpenProcessToken (Address: 0x1001d374)
- OpenThread (Address: 0x1001d390)
- TerminateProcess (Address: 0x1001d380)
api-ms-win-core-processthreads-l1-1-1.dll
- GetThreadContext (Address: 0x1001d39c)
- OpenProcess (Address: 0x1001d3a0)
api-ms-win-core-profile-l1-1-0.dll
- QueryPerformanceCounter (Address: 0x1001d3a8)
api-ms-win-core-psapi-l1-1-0.dll
- QueryFullProcessImageNameW (Address: 0x1001d3b0)
api-ms-win-core-registry-l1-1-0.dll
- RegCloseKey (Address: 0x1001d3c4)
- RegCreateKeyExW (Address: 0x1001d3d0)
- RegEnumKeyExW (Address: 0x1001d3c0)
- RegGetValueW (Address: 0x1001d3d4)
- RegOpenKeyExW (Address: 0x1001d3cc)
- RegQueryInfoKeyW (Address: 0x1001d3bc)
- RegQueryValueExW (Address: 0x1001d3b8)
- RegSetValueExW (Address: 0x1001d3c8)
api-ms-win-core-sidebyside-l1-1-0.dll
- ActivateActCtx (Address: 0x1001d3e4)
- CreateActCtxW (Address: 0x1001d3e8)
- DeactivateActCtx (Address: 0x1001d3dc)
- ReleaseActCtx (Address: 0x1001d3e0)
api-ms-win-core-string-l1-1-0.dll
- CompareStringW (Address: 0x1001d3f0)
- MultiByteToWideChar (Address: 0x1001d3f4)
api-ms-win-core-synch-l1-1-0.dll
- AcquireSRWLockExclusive (Address: 0x1001d3fc)
- AcquireSRWLockShared (Address: 0x1001d420)
- CreateEventW (Address: 0x1001d440)
- CreateMutexExW (Address: 0x1001d404)
- CreateSemaphoreExW (Address: 0x1001d43c)
- DeleteCriticalSection (Address: 0x1001d40c)
- EnterCriticalSection (Address: 0x1001d414)
- InitializeCriticalSectionAndSpinCount (Address: 0x1001d42c)
- InitializeCriticalSectionEx (Address: 0x1001d434)
- LeaveCriticalSection (Address: 0x1001d410)
- OpenSemaphoreW (Address: 0x1001d408)
- ReleaseMutex (Address: 0x1001d430)
- ReleaseSemaphore (Address: 0x1001d438)
- ReleaseSRWLockExclusive (Address: 0x1001d424)
- ReleaseSRWLockShared (Address: 0x1001d418)
- ResetEvent (Address: 0x1001d448)
- SetEvent (Address: 0x1001d428)
- WaitForMultipleObjectsEx (Address: 0x1001d400)
- WaitForSingleObject (Address: 0x1001d444)
- WaitForSingleObjectEx (Address: 0x1001d41c)
api-ms-win-core-synch-l1-2-0.dll
- InitOnceBeginInitialize (Address: 0x1001d458)
- InitOnceComplete (Address: 0x1001d450)
- Sleep (Address: 0x1001d454)
api-ms-win-core-synch-l1-2-1.dll
- WaitForMultipleObjects (Address: 0x1001d460)
api-ms-win-core-sysinfo-l1-1-0.dll
- GetSystemDirectoryW (Address: 0x1001d470)
- GetSystemTimeAsFileTime (Address: 0x1001d46c)
- GetTickCount (Address: 0x1001d474)
- GetTickCount64 (Address: 0x1001d468)
api-ms-win-core-threadpool-l1-2-0.dll
- CloseThreadpoolTimer (Address: 0x1001d480)
- CreateThreadpoolTimer (Address: 0x1001d484)
- SetThreadpoolTimer (Address: 0x1001d47c)
- WaitForThreadpoolTimerCallbacks (Address: 0x1001d488)
api-ms-win-eventing-provider-l1-1-0.dll
- EventProviderEnabled (Address: 0x1001d490)
- EventRegister (Address: 0x1001d494)
- EventSetInformation (Address: 0x1001d4a0)
- EventUnregister (Address: 0x1001d498)
- EventWriteTransfer (Address: 0x1001d49c)
api-ms-win-eventlog-legacy-l1-1-0.dll
- DeregisterEventSource (Address: 0x1001d4a8)
- RegisterEventSourceW (Address: 0x1001d4b0)
- ReportEventW (Address: 0x1001d4ac)
api-ms-win-security-base-l1-1-0.dll
- CopySid (Address: 0x1001d4c8)
- GetLengthSid (Address: 0x1001d4c4)
- GetSidSubAuthority (Address: 0x1001d4b8)
- GetSidSubAuthorityCount (Address: 0x1001d4cc)
- GetTokenInformation (Address: 0x1001d4bc)
- IsValidSid (Address: 0x1001d4c0)
COMCTL32.dll
- (Address: 0x1001d000)
- (Address: 0x1001d004)
- (Address: 0x1001d008)
- (Address: 0x1001d00c)
dbghelp.dll
- MiniDumpWriteDump (Address: 0x1001d4dc)
- StackWalk64 (Address: 0x1001d4e4)
- SymCleanup (Address: 0x1001d4d4)
- SymFunctionTableAccess64 (Address: 0x1001d4d8)
- SymGetModuleBase64 (Address: 0x1001d4ec)
- SymGetModuleInfoW64 (Address: 0x1001d4e0)
- SymInitialize (Address: 0x1001d4e8)
DUI70.dll
- ?_SelfLayoutDoLayout@Element@DirectUI@@MAEXHH@Z (Address: 0x1001d0b4)
- ?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MAE?AUtagSIZE@@HHPAVSurface@2@@Z (Address: 0x1001d0b8)
- ??0CCBase@DirectUI@@QAE@KPBG@Z (Address: 0x1001d028)
- ??0ClassInfoBase@DirectUI@@QAE@XZ (Address: 0x1001d01c)
- ??0CritSecLock@DirectUI@@QAE@PAU_RTL_CRITICAL_SECTION@@@Z (Address: 0x1001d044)
- ??1CCBase@DirectUI@@UAE@XZ (Address: 0x1001d0e4)
- ??1ClassInfoBase@DirectUI@@UAE@XZ (Address: 0x1001d10c)
- ??1CritSecLock@DirectUI@@QAE@XZ (Address: 0x1001d014)
- ?ActivateTooltip@Element@DirectUI@@MAEXPAV12@K@Z (Address: 0x1001d0c8)
- ?Add@Element@DirectUI@@UAEJPAPAV12@I@Z (Address: 0x1001d06c)
- ?AddBehavior@Element@DirectUI@@UAEJPAUIDuiBehavior@@@Z (Address: 0x1001d0a0)
- ?AddChild@ClassInfoBase@DirectUI@@UAEXXZ (Address: 0x1001d124)
- ?AddRef@ClassInfoBase@DirectUI@@UAEXXZ (Address: 0x1001d020)
- ?AssertPIZeroRef@ClassInfoBase@DirectUI@@UBEXXZ (Address: 0x1001d118)
- ?ClassExist@ClassInfoBase@DirectUI@@SG_NPAPAUIClassInfo@2@PBQBUPropertyInfo@2@IPAU32@PAUHINSTANCE__@@PBG_N@Z (Address: 0x1001d018)
- ?CreateAccNameLabel@HWNDHost@DirectUI@@IAEPAUHWND__@@PAU3@@Z (Address: 0x1001d170)
- ?CreateHWND@CCBase@DirectUI@@UAEPAUHWND__@@PAU3@@Z (Address: 0x1001d16c)
- ?DefaultAction@CCBase@DirectUI@@UAEJXZ (Address: 0x1001d0e8)
- ?Destroy@Element@DirectUI@@QAEJ_N@Z (Address: 0x1001d150)
- ?DirectionProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ (Address: 0x1001d040)
- ?EndDefer@Element@DirectUI@@QAEXK@Z (Address: 0x1001d09c)
- ?EnsureVisible@Element@DirectUI@@UAE_NHHHH@Z (Address: 0x1001d090)
- ?EnumPropertyInfo@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z (Address: 0x1001d14c)
- ?EraseBkgnd@HWNDHost@DirectUI@@MAE_NPAUHDC__@@PAJ@Z (Address: 0x1001d168)
- ?GetAccessibleImpl@HWNDHost@DirectUI@@UAEJPAPAUIAccessible@@@Z (Address: 0x1001d0d4)
- ?GetAdjacent@Element@DirectUI@@UAEPAV12@PAV12@HPBUNavReference@2@K@Z (Address: 0x1001d07c)
- ?GetByClassIndex@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z (Address: 0x1001d148)
- ?GetChildren@ClassInfoBase@DirectUI@@UBEHXZ (Address: 0x1001d11c)
- ?GetClassInfoPtr@CCBase@DirectUI@@SGPAUIClassInfo@2@XZ (Address: 0x1001d13c)
- ?GetContentStringAsDisplayed@Element@DirectUI@@UAEPBGPAPAVValue@2@@Z (Address: 0x1001d034)
- ?GetElementProviderImpl@Element@DirectUI@@UAEJPAVInvokeHelper@2@PAPAVElementProvider@2@@Z (Address: 0x1001d0f0)
- ?GetFactoryLock@Element@DirectUI@@SGPAU_RTL_CRITICAL_SECTION@@XZ (Address: 0x1001d078)
- ?GetGlobalIndex@ClassInfoBase@DirectUI@@UBEIXZ (Address: 0x1001d140)
- ?GetHWND@HWNDHost@DirectUI@@UAEPAUHWND__@@XZ (Address: 0x1001d194)
- ?GetImmersiveFocusRectOffsets@Element@DirectUI@@UAEXPAUtagRECT@@@Z (Address: 0x1001d0b0)
- ?GetKeyFocused@HWNDHost@DirectUI@@UAE_NXZ (Address: 0x1001d0d0)
- ?GetModule@ClassInfoBase@DirectUI@@UBEPAUHINSTANCE__@@XZ (Address: 0x1001d12c)
- ?GetName@ClassInfoBase@DirectUI@@UBEPBGXZ (Address: 0x1001d138)
- ?GetPICount@ClassInfoBase@DirectUI@@UBEIXZ (Address: 0x1001d144)
- ?GetUIAElementProvider@Element@DirectUI@@UAEJABU_GUID@@PAPAX@Z (Address: 0x1001d0ec)
- ?GetUiaFocusDelegate@Element@DirectUI@@UAEPAV12@XZ (Address: 0x1001d198)
- ?HandleUiaDestroyListener@Element@DirectUI@@UAEXXZ (Address: 0x1001d0f4)
- ?HandleUiaEventListener@Element@DirectUI@@UAEXPAUEvent@2@@Z (Address: 0x1001d100)
- ?HandleUiaPropertyChangingListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@@Z (Address: 0x1001d0fc)
- ?HandleUiaPropertyListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z (Address: 0x1001d0f8)
- ?Initialize@CCBase@DirectUI@@QAEJIPAVElement@2@PAK@Z (Address: 0x1001d154)
- ?Initialize@ClassInfoBase@DirectUI@@QAEJPAUHINSTANCE__@@PBG_NPBQBUPropertyInfo@2@I@Z (Address: 0x1001d114)
- ?Insert@Element@DirectUI@@UAEJPAPAV12@II@Z (Address: 0x1001d070)
- ?IsContentProtected@Element@DirectUI@@UAE_NXZ (Address: 0x1001d030)
- ?IsGlobal@ClassInfoBase@DirectUI@@UBE_NXZ (Address: 0x1001d128)
- ?IsRTLReading@Element@DirectUI@@UAE_NXZ (Address: 0x1001d02c)
- ?IsSubclassOf@ClassInfoBase@DirectUI@@UBE_NPAUIClassInfo@2@@Z (Address: 0x1001d130)
- ?IsValidProperty@ClassInfoBase@DirectUI@@UBE_NPBUPropertyInfo@2@@Z (Address: 0x1001d134)
- ?MessageCallback@HWNDHost@DirectUI@@UAEIPAUtagGMSG@@@Z (Address: 0x1001d0a8)
- ?OnAdjustWindowSize@HWNDHost@DirectUI@@UAEHHHI@Z (Address: 0x1001d178)
- ?OnCtrlThemeChanged@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z (Address: 0x1001d180)
- ?OnCustomDraw@CCBase@DirectUI@@UAE_NPAUtagNMCUSTOMDRAWINFO@@PAJ@Z (Address: 0x1001d164)
- ?OnDestroy@HWNDHost@DirectUI@@UAEXXZ (Address: 0x1001d0e0)
- ?OnEvent@HWNDHost@DirectUI@@UAEXPAUEvent@2@@Z (Address: 0x1001d064)
- ?OnGroupChanged@Element@DirectUI@@UAEXH_N@Z (Address: 0x1001d04c)
- ?OnHosted@HWNDHost@DirectUI@@MAEXPAVElement@2@@Z (Address: 0x1001d0bc)
- ?OnInput@CCBase@DirectUI@@UAEXPAUInputEvent@2@@Z (Address: 0x1001d054)
- ?OnInput@Element@DirectUI@@UAEXPAUInputEvent@2@@Z (Address: 0x1001d050)
- ?OnKeyFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z (Address: 0x1001d058)
- ?OnLostDialogFocus@CCBase@DirectUI@@UAE_NPAUIDialogElement@2@@Z (Address: 0x1001d160)
- ?OnMessage@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z (Address: 0x1001d18c)
- ?OnMouseFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z (Address: 0x1001d05c)
- ?OnNotify@CCBase@DirectUI@@UAE_NIIJPAJ@Z (Address: 0x1001d190)
- ?OnPropertyChanged@CCBase@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z (Address: 0x1001d094)
- ?OnPropertyChanged@Element@DirectUI@@UAEXPAUPropertyInfo@2@HPAVValue@2@1@Z (Address: 0x1001d048)
- ?OnPropertyChanging@Element@DirectUI@@UAE_NPAUPropertyInfo@2@HPAVValue@2@1@Z (Address: 0x1001d03c)
- ?OnPropertyChanging@Element@DirectUI@@UAE_NPBUPropertyInfo@2@HPAVValue@2@1@Z (Address: 0x1001d038)
- ?OnReceivedDialogFocus@CCBase@DirectUI@@UAE_NPAUIDialogElement@2@@Z (Address: 0x1001d15c)
- ?OnSinkThemeChanged@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z (Address: 0x1001d184)
- ?OnSysChar@HWNDHost@DirectUI@@UAE_NG@Z (Address: 0x1001d188)
- ?OnUnHosted@HWNDHost@DirectUI@@MAEXPAVElement@2@@Z (Address: 0x1001d0c0)
- ?OnWindowStyleChanged@HWNDHost@DirectUI@@UAEXIPBUtagSTYLESTRUCT@@@Z (Address: 0x1001d17c)
- ?Paint@HWNDHost@DirectUI@@UAEXPAUHDC__@@PBUtagRECT@@1PAU4@2@Z (Address: 0x1001d068)
- ?PostCreate@CCBase@DirectUI@@MAEXPAUHWND__@@@Z (Address: 0x1001d158)
- ?QueryInterface@Element@DirectUI@@UAGJABU_GUID@@PAPAX@Z (Address: 0x1001d0ac)
- ?Register@CCBase@DirectUI@@SGJXZ (Address: 0x1001d080)
- ?Register@ClassInfoBase@DirectUI@@QAEJXZ (Address: 0x1001d110)
- ?Release@ClassInfoBase@DirectUI@@UAEHXZ (Address: 0x1001d024)
- ?Remove@Element@DirectUI@@UAEJPAPAV12@I@Z (Address: 0x1001d074)
- ?RemoveBehavior@Element@DirectUI@@UAEJPAUIDuiBehavior@@@Z (Address: 0x1001d0a4)
- ?RemoveChild@ClassInfoBase@DirectUI@@UAEXXZ (Address: 0x1001d120)
- ?RemoveTooltip@Element@DirectUI@@MAEXPAV12@@Z (Address: 0x1001d0cc)
- ?SetFontSize@Element@DirectUI@@QAEJH@Z (Address: 0x1001d084)
- ?SetHeight@Element@DirectUI@@QAEJH@Z (Address: 0x1001d08c)
- ?SetKeyFocus@HWNDHost@DirectUI@@UAEXXZ (Address: 0x1001d098)
- ?SetWidth@Element@DirectUI@@QAEJH@Z (Address: 0x1001d088)
- ?SetWindowDirection@HWNDHost@DirectUI@@UAEXPAUHWND__@@@Z (Address: 0x1001d174)
- ?UpdateTooltip@Element@DirectUI@@MAEXPAV12@@Z (Address: 0x1001d0c4)
- CreateDUIWrapper (Address: 0x1001d060)
- InitProcessPriv (Address: 0x1001d104)
- InitThread (Address: 0x1001d108)
- UnInitProcessPriv (Address: 0x1001d0dc)
- UnInitThread (Address: 0x1001d0d8)
msvcrt.dll
- __CxxFrameHandler3 (Address: 0x1001d534)
- __dllonexit (Address: 0x1001d4f8)
- _amsg_exit (Address: 0x1001d54c)
- _callnewh (Address: 0x1001d530)
- _CxxThrowException (Address: 0x1001d518)
- _except_handler4_common (Address: 0x1001d53c)
- _ftol2 (Address: 0x1001d52c)
- _initterm (Address: 0x1001d540)
- _lock (Address: 0x1001d538)
- _onexit (Address: 0x1001d4f4)
- _purecall (Address: 0x1001d550)
- _unlock (Address: 0x1001d500)
- _XcptFilter (Address: 0x1001d514)
- ??0exception@@QAE@ABV0@@Z (Address: 0x1001d508)
- ??0exception@@QAE@XZ (Address: 0x1001d50c)
- ??1exception@@UAE@XZ (Address: 0x1001d504)
- ??1type_info@@UAE@XZ (Address: 0x1001d510)
- ?terminate@@YAXXZ (Address: 0x1001d51c)
- free (Address: 0x1001d548)
- malloc (Address: 0x1001d544)
- memcmp (Address: 0x1001d528)
- memcpy_s (Address: 0x1001d524)
- memmove (Address: 0x1001d4fc)
- memset (Address: 0x1001d554)
- toupper (Address: 0x1001d520)
ntdll.dll
- _vscwprintf (Address: 0x1001d594)
- _vsnprintf_s (Address: 0x1001d590)
- _vsnwprintf (Address: 0x1001d5a8)
- _wcsicmp (Address: 0x1001d5b0)
- _wcsnicmp (Address: 0x1001d5a4)
- _wtoi (Address: 0x1001d5ac)
- EtwEventWriteNoRegistration (Address: 0x1001d564)
- EtwGetTraceEnableFlags (Address: 0x1001d5c8)
- EtwGetTraceEnableLevel (Address: 0x1001d5c4)
- EtwGetTraceLoggerHandle (Address: 0x1001d5c0)
- EtwRegisterTraceGuidsW (Address: 0x1001d5cc)
- EtwTraceMessage (Address: 0x1001d5bc)
- EtwUnregisterTraceGuids (Address: 0x1001d5d0)
- memmove_s (Address: 0x1001d58c)
- NtAlpcConnectPort (Address: 0x1001d570)
- NtAlpcSendWaitReceivePort (Address: 0x1001d574)
- NtClose (Address: 0x1001d580)
- NtOpenEvent (Address: 0x1001d588)
- NtQueryInformationToken (Address: 0x1001d59c)
- NtQueryLicenseValue (Address: 0x1001d598)
- NtQuerySystemInformation (Address: 0x1001d57c)
- NtResumeProcess (Address: 0x1001d5b8)
- NtSuspendProcess (Address: 0x1001d5b4)
- NtWaitForSingleObject (Address: 0x1001d568)
- RtlAllocateAndInitializeSid (Address: 0x1001d56c)
- RtlFreeSid (Address: 0x1001d578)
- RtlInitUnicodeString (Address: 0x1001d5a0)
- RtlNtStatusToDosError (Address: 0x1001d584)
- ZwQueryWnfStateNameInformation (Address: 0x1001d55c)
- ZwUpdateWnfStateData (Address: 0x1001d560)
SHELL32.dll
- ExtractIconExW (Address: 0x1001d1a8)
- SHCreateDirectoryExW (Address: 0x1001d1a4)
- Shell_NotifyIconW (Address: 0x1001d1ac)
- ShellExecuteExW (Address: 0x1001d1a0)
USER32.dll
- ChangeDisplaySettingsW (Address: 0x1001d1b8)
- ChangeWindowMessageFilter (Address: 0x1001d200)
- CheckWindowThreadDesktop (Address: 0x1001d1e4)
- CreateWindowExW (Address: 0x1001d250)
- DefWindowProcW (Address: 0x1001d248)
- DestroyIcon (Address: 0x1001d230)
- DestroyMenu (Address: 0x1001d218)
- DispatchMessageW (Address: 0x1001d25c)
- DrawAnimatedRects (Address: 0x1001d1c8)
- EnableMenuItem (Address: 0x1001d234)
- EndDialog (Address: 0x1001d220)
- EnumWindows (Address: 0x1001d1b4)
- FindWindowExW (Address: 0x1001d1c4)
- FindWindowW (Address: 0x1001d1c0)
- FlashWindowEx (Address: 0x1001d224)
- GetClassNameW (Address: 0x1001d23c)
- GetCursorPos (Address: 0x1001d204)
- GetMessageW (Address: 0x1001d254)
- GetMonitorInfoW (Address: 0x1001d268)
- GetSubMenu (Address: 0x1001d20c)
- GetSysColor (Address: 0x1001d240)
- GetWindow (Address: 0x1001d1d0)
- GetWindowBand (Address: 0x1001d1d4)
- GetWindowInfo (Address: 0x1001d1d8)
- GetWindowLongW (Address: 0x1001d1dc)
- GetWindowRect (Address: 0x1001d260)
- GetWindowTextLengthW (Address: 0x1001d238)
- GetWindowThreadProcessId (Address: 0x1001d1f8)
- IsHungAppWindow (Address: 0x1001d1e8)
- IsWindow (Address: 0x1001d26c)
- IsWindowVisible (Address: 0x1001d1bc)
- LoadIconW (Address: 0x1001d21c)
- LoadMenuW (Address: 0x1001d208)
- LoadStringW (Address: 0x1001d244)
- MonitorFromRect (Address: 0x1001d1f4)
- PostMessageW (Address: 0x1001d22c)
- RegisterClassExW (Address: 0x1001d24c)
- RegisterWindowMessageW (Address: 0x1001d1fc)
- SendMessageW (Address: 0x1001d1ec)
- SetForegroundWindow (Address: 0x1001d1cc)
- SetMenuDefaultItem (Address: 0x1001d210)
- SetParent (Address: 0x1001d1f0)
- SetWindowLongW (Address: 0x1001d228)
- SetWindowPos (Address: 0x1001d1e0)
- ShowWindow (Address: 0x1001d264)
- TrackPopupMenuEx (Address: 0x1001d214)
- TranslateMessage (Address: 0x1001d258)
wer.dll
- WerpGetDynamicParameter (Address: 0x1001d614)
- WerpGetEventType (Address: 0x1001d60c)
- WerpGetFileByIndex (Address: 0x1001d5f4)
- WerpGetNumFiles (Address: 0x1001d5f8)
- WerpGetNumSigParams (Address: 0x1001d608)
- WerpGetReportFlags (Address: 0x1001d5fc)
- WerpGetReportInformation (Address: 0x1001d5e8)
- WerpGetReportSettings (Address: 0x1001d5d8)
- WerpGetReportType (Address: 0x1001d618)
- WerpGetSigParamByIndex (Address: 0x1001d610)
- WerpGetUIParamByIndex (Address: 0x1001d600)
- WerpIsDisabled (Address: 0x1001d604)
- WerpIsTransportAvailable (Address: 0x1001d5ec)
- WerpSetReportFlags (Address: 0x1001d5f0)
- WerReportCloseHandle (Address: 0x1001d5dc)
- WerReportCreate (Address: 0x1001d5e0)
- WerReportSetUIOption (Address: 0x1001d5e4)