FWPUCLNT.DLL

Description: FWP/IPsec User-Mode API

Authors: © Microsoft Corporation. All rights reserved.

Version: 10.0.19041.6328

Architecture: 64-bit

Operating System: Windows NT

SHA256: 0e9567e63e8102e8910bd50f60010711

File Size: 491.5 KB

Uploaded At: Dec. 1, 2025, 7:28 a.m.

Views: 9

Security Warning

This file has been flagged as potentially dangerous.


Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

  • FwpiExpandCriteria0 (Ordinal: 1, Address: 0xa2d0)
  • FwpiFreeCriteria0 (Ordinal: 2, Address: 0xa380)
  • FwpiVpnTriggerAddAppSids (Ordinal: 3, Address: 0x33ab0)
  • FwpiVpnTriggerAddFilePaths (Ordinal: 4, Address: 0x33b30)
  • FwpiVpnTriggerAddSecurityDescriptor (Ordinal: 5, Address: 0x33bb0)
  • FwpiVpnTriggerConfigureParameters (Ordinal: 6, Address: 0x33c90)
  • FwpiVpnTriggerEventSubscribe0 (Ordinal: 7, Address: 0x33d00)
  • FwpiVpnTriggerEventUnsubscribe0 (Ordinal: 8, Address: 0x33e60)
  • FwpiVpnTriggerInitializeNrptTriggering (Ordinal: 9, Address: 0x33f20)
  • FwpiVpnTriggerRemoveAppSids (Ordinal: 10, Address: 0x33fa0)
  • FwpiVpnTriggerRemoveFilePaths (Ordinal: 11, Address: 0x34010)
  • FwpiVpnTriggerRemoveSecurityDescriptor (Ordinal: 12, Address: 0x34080)
  • FwpiVpnTriggerResetNrptTriggering (Ordinal: 13, Address: 0x340f0)
  • FwpiVpnTriggerSetStateDisconnected (Ordinal: 14, Address: 0x34160)
  • FwpiVpnTriggerUninitializeNrptTriggering (Ordinal: 15, Address: 0x341d0)
  • FwpmBitmapIndexFree0 (Ordinal: 16, Address: 0xa3a0)
  • FwpmBitmapIndexGet0 (Ordinal: 17, Address: 0xa460)
  • FwpmCalloutAdd0 (Ordinal: 18, Address: 0x5370)
  • FwpmCalloutCreateEnumHandle0 (Ordinal: 19, Address: 0xa520)
  • FwpmCalloutDeleteById0 (Ordinal: 20, Address: 0xa5a0)
  • FwpmCalloutDeleteByKey0 (Ordinal: 21, Address: 0xa640)
  • FwpmCalloutDestroyEnumHandle0 (Ordinal: 22, Address: 0xa6e0)
  • FwpmCalloutEnum0 (Ordinal: 23, Address: 0xa760)
  • FwpmCalloutGetById0 (Ordinal: 24, Address: 0xa800)
  • FwpmCalloutGetByKey0 (Ordinal: 25, Address: 0xa890)
  • FwpmCalloutGetSecurityInfoByKey0 (Ordinal: 26, Address: 0xa920)
  • FwpmCalloutSetSecurityInfoByKey0 (Ordinal: 27, Address: 0xaa30)
  • FwpmCalloutSubscribeChanges0 (Ordinal: 28, Address: 0xab50)
  • FwpmCalloutSubscriptionsGet0 (Ordinal: 29, Address: 0xacb0)
  • FwpmCalloutUnsubscribeChanges0 (Ordinal: 30, Address: 0xad40)
  • FwpmConnectionCreateEnumHandle0 (Ordinal: 31, Address: 0xadf0)
  • FwpmConnectionDestroyEnumHandle0 (Ordinal: 32, Address: 0xae70)
  • FwpmConnectionEnum0 (Ordinal: 33, Address: 0xaef0)
  • FwpmConnectionGetById0 (Ordinal: 34, Address: 0xaf90)
  • FwpmConnectionGetSecurityInfo0 (Ordinal: 35, Address: 0xb020)
  • FwpmConnectionSetSecurityInfo0 (Ordinal: 36, Address: 0xb130)
  • FwpmConnectionSubscribe0 (Ordinal: 37, Address: 0xb230)
  • FwpmConnectionUnsubscribe0 (Ordinal: 38, Address: 0xb390)
  • FwpmDiagnoseNetFailure0 (Ordinal: 39, Address: 0x148a0)
  • FwpmDynamicKeywordSubscribe0 (Ordinal: 40, Address: 0x66a0)
  • FwpmDynamicKeywordUnsubscribe0 (Ordinal: 41, Address: 0x6bf0)
  • FwpmEngineClose0 (Ordinal: 42, Address: 0x48c0)
  • FwpmEngineGetOption0 (Ordinal: 43, Address: 0xb450)
  • FwpmEngineGetSecurityInfo0 (Ordinal: 44, Address: 0xb4e0)
  • FwpmEngineOpen0 (Ordinal: 45, Address: 0x5610)
  • FwpmEngineSetOption0 (Ordinal: 46, Address: 0x3a70)
  • FwpmEngineSetSecurityInfo0 (Ordinal: 47, Address: 0xb5f0)
  • FwpmEventProviderCreate0 (Ordinal: 48, Address: 0x3890)
  • FwpmEventProviderDestroy0 (Ordinal: 49, Address: 0x14db0)
  • FwpmEventProviderFireNetEvent0 (Ordinal: 50, Address: 0x14de0)
  • FwpmEventProviderIsNetEventTypeEnabled0 (Ordinal: 51, Address: 0x1e50)
  • FwpmFilterAdd0 (Ordinal: 52, Address: 0x20a0)
  • FwpmFilterCreateEnumHandle0 (Ordinal: 53, Address: 0x4b90)
  • FwpmFilterDeleteById0 (Ordinal: 54, Address: 0x1010)
  • FwpmFilterDeleteByKey0 (Ordinal: 55, Address: 0x5480)
  • FwpmFilterDestroyEnumHandle0 (Ordinal: 56, Address: 0x4bf0)
  • FwpmFilterEnum0 (Ordinal: 57, Address: 0x4c60)
  • FwpmFilterGetById0 (Ordinal: 58, Address: 0xb6f0)
  • FwpmFilterGetByKey0 (Ordinal: 59, Address: 0x34a0)
  • FwpmFilterGetSecurityInfoByKey0 (Ordinal: 60, Address: 0xb780)
  • FwpmFilterSetSecurityInfoByKey0 (Ordinal: 61, Address: 0xb890)
  • FwpmFilterSubscribeChanges0 (Ordinal: 62, Address: 0x4790)
  • FwpmFilterSubscriptionsGet0 (Ordinal: 63, Address: 0xb9b0)
  • FwpmFilterUnsubscribeChanges0 (Ordinal: 64, Address: 0xba40)
  • FwpmFreeMemory0 (Ordinal: 65, Address: 0x1600)
  • FwpmGetAppIdFromFileName0 (Ordinal: 66, Address: 0xbaf0)
  • FwpmGetSidFromOnlineId0 (Ordinal: 67, Address: 0x38140)
  • FwpmIPsecS2STunnelAddConditions0 (Ordinal: 68, Address: 0xbc00)
  • FwpmIPsecS2STunnelAddInterfaceToCompartment0 (Ordinal: 69, Address: 0xbcf0)
  • FwpmIPsecS2STunnelGetInterfaceForCompartment0 (Ordinal: 70, Address: 0xbd70)
  • FwpmIPsecS2STunnelRemoveConditions0 (Ordinal: 71, Address: 0xbdf0)
  • FwpmIPsecS2STunnelRemoveInterfaceFromCompartment0 (Ordinal: 72, Address: 0xbee0)
  • FwpmIPsecTunnelAdd0 (Ordinal: 73, Address: 0xbf50)
  • FwpmIPsecTunnelAdd1 (Ordinal: 74, Address: 0xc0d0)
  • FwpmIPsecTunnelAdd2 (Ordinal: 75, Address: 0xc250)
  • FwpmIPsecTunnelAdd3 (Ordinal: 76, Address: 0xc3a0)
  • FwpmIPsecTunnelAddConditions0 (Ordinal: 77, Address: 0xc530)
  • FwpmIPsecTunnelDeleteByKey0 (Ordinal: 78, Address: 0xc600)
  • FwpmLayerCreateEnumHandle0 (Ordinal: 79, Address: 0xc680)
  • FwpmLayerDestroyEnumHandle0 (Ordinal: 80, Address: 0xc700)
  • FwpmLayerEnum0 (Ordinal: 81, Address: 0xc780)
  • FwpmLayerGetById0 (Ordinal: 82, Address: 0xc820)
  • FwpmLayerGetByKey0 (Ordinal: 83, Address: 0xc8b0)
  • FwpmLayerGetSecurityInfoByKey0 (Ordinal: 84, Address: 0xc940)
  • FwpmLayerSetSecurityInfoByKey0 (Ordinal: 85, Address: 0xca50)
  • FwpmNetEventCreateEnumHandle0 (Ordinal: 86, Address: 0xcb70)
  • FwpmNetEventDestroyEnumHandle0 (Ordinal: 87, Address: 0xcbf0)
  • FwpmNetEventEnum0 (Ordinal: 88, Address: 0xcc70)
  • FwpmNetEventEnum1 (Ordinal: 89, Address: 0xcd80)
  • FwpmNetEventEnum2 (Ordinal: 90, Address: 0xce90)
  • FwpmNetEventEnum3 (Ordinal: 91, Address: 0xcfa0)
  • FwpmNetEventEnum4 (Ordinal: 92, Address: 0xd0b0)
  • FwpmNetEventEnum5 (Ordinal: 93, Address: 0xd1c0)
  • FwpmNetEventSubscribe0 (Ordinal: 94, Address: 0xd260)
  • FwpmNetEventSubscribe1 (Ordinal: 95, Address: 0xd3c0)
  • FwpmNetEventSubscribe2 (Ordinal: 96, Address: 0xd520)
  • FwpmNetEventSubscribe3 (Ordinal: 97, Address: 0xd680)
  • FwpmNetEventSubscribe4 (Ordinal: 98, Address: 0x3de0)
  • FwpmNetEventSubscriptionsGet0 (Ordinal: 99, Address: 0xd7e0)
  • FwpmNetEventUnsubscribe0 (Ordinal: 100, Address: 0xd870)
  • FwpmNetEventsGetSecurityInfo0 (Ordinal: 101, Address: 0xd920)
  • FwpmNetEventsLost0 (Ordinal: 102, Address: 0xda30)
  • FwpmNetEventsSetSecurityInfo0 (Ordinal: 103, Address: 0xdab0)
  • FwpmProcessNameResolutionEvent0 (Ordinal: 104, Address: 0xdbb0)
  • FwpmProviderAdd0 (Ordinal: 105, Address: 0x49d0)
  • FwpmProviderContextAdd0 (Ordinal: 106, Address: 0x3f10)
  • FwpmProviderContextAdd1 (Ordinal: 107, Address: 0xde30)
  • FwpmProviderContextAdd2 (Ordinal: 108, Address: 0xdf00)
  • FwpmProviderContextAdd3 (Ordinal: 109, Address: 0x4550)
  • FwpmProviderContextCreateEnumHandle0 (Ordinal: 110, Address: 0xdfe0)
  • FwpmProviderContextDeleteById0 (Ordinal: 111, Address: 0xe060)
  • FwpmProviderContextDeleteByKey0 (Ordinal: 112, Address: 0xe100)
  • FwpmProviderContextDestroyEnumHandle0 (Ordinal: 113, Address: 0xe1a0)
  • FwpmProviderContextEnum0 (Ordinal: 114, Address: 0xe220)
  • FwpmProviderContextEnum1 (Ordinal: 115, Address: 0xe360)
  • FwpmProviderContextEnum2 (Ordinal: 116, Address: 0xe4a0)
  • FwpmProviderContextEnum3 (Ordinal: 117, Address: 0xe5b0)
  • FwpmProviderContextGetById0 (Ordinal: 118, Address: 0xe650)
  • FwpmProviderContextGetById1 (Ordinal: 119, Address: 0xe740)
  • FwpmProviderContextGetById2 (Ordinal: 120, Address: 0xe830)
  • FwpmProviderContextGetById3 (Ordinal: 121, Address: 0xe900)
  • FwpmProviderContextGetByKey0 (Ordinal: 122, Address: 0xe990)
  • FwpmProviderContextGetByKey1 (Ordinal: 123, Address: 0xea80)
  • FwpmProviderContextGetByKey2 (Ordinal: 124, Address: 0xeb70)
  • FwpmProviderContextGetByKey3 (Ordinal: 125, Address: 0xec40)
  • FwpmProviderContextGetSecurityInfoByKey0 (Ordinal: 126, Address: 0xecd0)
  • FwpmProviderContextSetSecurityInfoByKey0 (Ordinal: 127, Address: 0xede0)
  • FwpmProviderContextSubscribeChanges0 (Ordinal: 128, Address: 0xef00)
  • FwpmProviderContextSubscriptionsGet0 (Ordinal: 129, Address: 0xf060)
  • FwpmProviderContextUnsubscribeChanges0 (Ordinal: 130, Address: 0xf0f0)
  • FwpmProviderCreateEnumHandle0 (Ordinal: 131, Address: 0xf1a0)
  • FwpmProviderDeleteByKey0 (Ordinal: 132, Address: 0xf220)
  • FwpmProviderDestroyEnumHandle0 (Ordinal: 133, Address: 0xf2c0)
  • FwpmProviderEnum0 (Ordinal: 134, Address: 0xf340)
  • FwpmProviderGetByKey0 (Ordinal: 135, Address: 0xf3e0)
  • FwpmProviderGetSecurityInfoByKey0 (Ordinal: 136, Address: 0xf470)
  • FwpmProviderSetSecurityInfoByKey0 (Ordinal: 137, Address: 0xf580)
  • FwpmProviderSubscribeChanges0 (Ordinal: 138, Address: 0xf6a0)
  • FwpmProviderSubscriptionsGet0 (Ordinal: 139, Address: 0xf800)
  • FwpmProviderUnsubscribeChanges0 (Ordinal: 140, Address: 0xf890)
  • FwpmSessionCreateEnumHandle0 (Ordinal: 141, Address: 0xf940)
  • FwpmSessionDestroyEnumHandle0 (Ordinal: 142, Address: 0xf9c0)
  • FwpmSessionEnum0 (Ordinal: 143, Address: 0xfa40)
  • FwpmSubLayerAdd0 (Ordinal: 144, Address: 0x4aa0)
  • FwpmSubLayerCreateEnumHandle0 (Ordinal: 145, Address: 0xfae0)
  • FwpmSubLayerDeleteByKey0 (Ordinal: 146, Address: 0xfb60)
  • FwpmSubLayerDestroyEnumHandle0 (Ordinal: 147, Address: 0xfc00)
  • FwpmSubLayerEnum0 (Ordinal: 148, Address: 0xfc80)
  • FwpmSubLayerGetByKey0 (Ordinal: 149, Address: 0xfd20)
  • FwpmSubLayerGetSecurityInfoByKey0 (Ordinal: 150, Address: 0xfdb0)
  • FwpmSubLayerSetSecurityInfoByKey0 (Ordinal: 151, Address: 0xfec0)
  • FwpmSubLayerSubscribeChanges0 (Ordinal: 152, Address: 0xffe0)
  • FwpmSubLayerSubscriptionsGet0 (Ordinal: 153, Address: 0x10140)
  • FwpmSubLayerUnsubscribeChanges0 (Ordinal: 154, Address: 0x101d0)
  • FwpmSystemPortsGet0 (Ordinal: 155, Address: 0x14df0)
  • FwpmSystemPortsSubscribe0 (Ordinal: 156, Address: 0x14e30)
  • FwpmSystemPortsUnsubscribe0 (Ordinal: 157, Address: 0x14f20)
  • FwpmTraceRestoreDefaults0 (Ordinal: 158, Address: 0x15270)
  • FwpmTransactionAbort0 (Ordinal: 159, Address: 0x10280)
  • FwpmTransactionBegin0 (Ordinal: 160, Address: 0x3450)
  • FwpmTransactionCommit0 (Ordinal: 161, Address: 0x2270)
  • FwpmvSwitchEventSubscribe0 (Ordinal: 162, Address: 0x10320)
  • FwpmvSwitchEventUnsubscribe0 (Ordinal: 163, Address: 0x10480)
  • FwpmvSwitchEventsGetSecurityInfo0 (Ordinal: 164, Address: 0x10540)
  • FwpmvSwitchEventsSetSecurityInfo0 (Ordinal: 165, Address: 0x10650)
  • FwppConnectionGetByIPsecInfo (Ordinal: 166, Address: 0x10800)
  • FwppConnectionGetByS2STunnelId (Ordinal: 167, Address: 0x10890)
  • FwppConnectionGetS2STunnelId (Ordinal: 168, Address: 0x10920)
  • FwppGetMD5HashBytes (Ordinal: 169, Address: 0x10b70)
  • FwppIPsecSaContextCreate (Ordinal: 170, Address: 0x10b90)
  • FwpsAleEndpointCreateEnumHandle0 (Ordinal: 171, Address: 0x10f80)
  • FwpsAleEndpointDestroyEnumHandle0 (Ordinal: 172, Address: 0x11000)
  • FwpsAleEndpointEnum0 (Ordinal: 173, Address: 0x11080)
  • FwpsAleEndpointGetById0 (Ordinal: 174, Address: 0x11120)
  • FwpsAleEndpointGetSecurityInfo0 (Ordinal: 175, Address: 0x111b0)
  • FwpsAleEndpointSetSecurityInfo0 (Ordinal: 176, Address: 0x112c0)
  • FwpsAleExplicitCredentialsQuery0 (Ordinal: 177, Address: 0x113c0)
  • FwpsAleGetPortStatus0 (Ordinal: 178, Address: 0x11450)
  • FwpsClassifyUser0 (Ordinal: 179, Address: 0x114f0)
  • FwpsFreeMemory0 (Ordinal: 180, Address: 0x1600)
  • FwpsGetInProcReplicaOffset0 (Ordinal: 181, Address: 0x16370)
  • FwpsLayerCreateInProcReplica0 (Ordinal: 182, Address: 0x16400)
  • FwpsLayerReleaseInProcReplica0 (Ordinal: 183, Address: 0x16480)
  • FwpsOpenToken0 (Ordinal: 184, Address: 0x11650)
  • FwpsQueryIPsecDosFWUsed0 (Ordinal: 185, Address: 0x117f0)
  • FwpsQueryIPsecOffloadDone0 (Ordinal: 186, Address: 0x11870)
  • GetUnifiedTraceHandle (Ordinal: 187, Address: 0x118f0)
  • IPsecDospGetSecurityInfo0 (Ordinal: 188, Address: 0x11910)
  • IPsecDospGetStatistics0 (Ordinal: 189, Address: 0x11a20)
  • IPsecDospSetSecurityInfo0 (Ordinal: 190, Address: 0x11ab0)
  • IPsecDospStateCreateEnumHandle0 (Ordinal: 191, Address: 0x11bb0)
  • IPsecDospStateDestroyEnumHandle0 (Ordinal: 192, Address: 0x11c30)
  • IPsecDospStateEnum0 (Ordinal: 193, Address: 0x11cb0)
  • IPsecGetKeyFromDictator0 (Ordinal: 194, Address: 0x121b0)
  • IPsecGetStatistics0 (Ordinal: 195, Address: 0x122c0)
  • IPsecGetStatistics1 (Ordinal: 196, Address: 0x123a0)
  • IPsecKeyDictationCheck0 (Ordinal: 197, Address: 0x12430)
  • IPsecKeyManagerAddAndRegister0 (Ordinal: 198, Address: 0x124c0)
  • IPsecKeyManagerGetSecurityInfoByKey0 (Ordinal: 199, Address: 0x126c0)
  • IPsecKeyManagerSetSecurityInfoByKey0 (Ordinal: 200, Address: 0x127d0)
  • IPsecKeyManagerUnregisterAndDelete0 (Ordinal: 201, Address: 0x128f0)
  • IPsecKeyManagersGet0 (Ordinal: 202, Address: 0x129c0)
  • IPsecKeyModuleAdd0 (Ordinal: 203, Address: 0x12a60)
  • IPsecKeyModuleDelete0 (Ordinal: 204, Address: 0x12be0)
  • IPsecKeyModuleUpdateAcquire0 (Ordinal: 205, Address: 0x12c90)
  • IPsecKeyNotification0 (Ordinal: 206, Address: 0x12d10)
  • IPsecSaContextAddInbound0 (Ordinal: 207, Address: 0x12d90)
  • IPsecSaContextAddInbound1 (Ordinal: 208, Address: 0x12e50)
  • IPsecSaContextAddInboundAndTrackConnection (Ordinal: 209, Address: 0x12ee0)
  • IPsecSaContextAddOutbound0 (Ordinal: 210, Address: 0x12f80)
  • IPsecSaContextAddOutbound1 (Ordinal: 211, Address: 0x13040)
  • IPsecSaContextAddOutboundAndTrackConnection (Ordinal: 212, Address: 0x130d0)
  • IPsecSaContextCreate0 (Ordinal: 213, Address: 0x13170)
  • IPsecSaContextCreate1 (Ordinal: 214, Address: 0x13230)
  • IPsecSaContextCreateEnumHandle0 (Ordinal: 215, Address: 0x132e0)
  • IPsecSaContextDeleteById0 (Ordinal: 216, Address: 0x13360)
  • IPsecSaContextDestroyEnumHandle0 (Ordinal: 217, Address: 0x133d0)
  • IPsecSaContextEnum0 (Ordinal: 218, Address: 0x13450)
  • IPsecSaContextEnum1 (Ordinal: 219, Address: 0x13560)
  • IPsecSaContextExpire0 (Ordinal: 220, Address: 0x13600)
  • IPsecSaContextGetById0 (Ordinal: 221, Address: 0x13670)
  • IPsecSaContextGetById1 (Ordinal: 222, Address: 0x13740)
  • IPsecSaContextGetSpi0 (Ordinal: 223, Address: 0x137d0)
  • IPsecSaContextGetSpi1 (Ordinal: 224, Address: 0x13890)
  • IPsecSaContextSetSpi0 (Ordinal: 225, Address: 0x13920)
  • IPsecSaContextSubscribe0 (Ordinal: 226, Address: 0x139c0)
  • IPsecSaContextSubscriptionsGet0 (Ordinal: 227, Address: 0x13b20)
  • IPsecSaContextUnsubscribe0 (Ordinal: 228, Address: 0x13bb0)
  • IPsecSaContextUpdate0 (Ordinal: 229, Address: 0x13c60)
  • IPsecSaCreateEnumHandle0 (Ordinal: 230, Address: 0x13ce0)
  • IPsecSaDbGetSecurityInfo0 (Ordinal: 231, Address: 0x13d60)
  • IPsecSaDbSetSecurityInfo0 (Ordinal: 232, Address: 0x13e70)
  • IPsecSaDestroyEnumHandle0 (Ordinal: 233, Address: 0x13f70)
  • IPsecSaEnum0 (Ordinal: 234, Address: 0x13ff0)
  • IPsecSaEnum1 (Ordinal: 235, Address: 0x14100)
  • IPsecSaInitiateAsync0 (Ordinal: 236, Address: 0x141a0)
  • IkeextGetConfigParameters0 (Ordinal: 237, Address: 0x16550)
  • IkeextGetStatistics0 (Ordinal: 238, Address: 0x16720)
  • IkeextGetStatistics1 (Ordinal: 239, Address: 0x167b0)
  • IkeextSaCreateEnumHandle0 (Ordinal: 240, Address: 0x168d0)
  • IkeextSaDbGetSecurityInfo0 (Ordinal: 241, Address: 0x16970)
  • IkeextSaDbSetSecurityInfo0 (Ordinal: 242, Address: 0x16a90)
  • IkeextSaDeleteById0 (Ordinal: 243, Address: 0x16bb0)
  • IkeextSaDestroyEnumHandle0 (Ordinal: 244, Address: 0x16c40)
  • IkeextSaEnum0 (Ordinal: 245, Address: 0x16cd0)
  • IkeextSaEnum1 (Ordinal: 246, Address: 0x16de0)
  • IkeextSaEnum2 (Ordinal: 247, Address: 0x16ef0)
  • IkeextSaGetById0 (Ordinal: 248, Address: 0x16fc0)
  • IkeextSaGetById1 (Ordinal: 249, Address: 0x17090)
  • IkeextSaGetById2 (Ordinal: 250, Address: 0x17160)
  • IkeextSaUpdateAdditionalAddressesByTunnelId0 (Ordinal: 251, Address: 0x17220)
  • IkeextSaUpdatePreferredAddressesByTunnelId0 (Ordinal: 252, Address: 0x17350)
  • IkeextSetConfigParameters0 (Ordinal: 253, Address: 0x17480)
  • NamespaceCallout (Ordinal: 254, Address: 0x2900)
  • WFPRIODequeueCompletion (Ordinal: 255, Address: 0x34240)
  • WSADeleteSocketPeerTargetName (Ordinal: 256, Address: 0x175e0)
  • WSAImpersonateSocketPeer (Ordinal: 257, Address: 0x17630)
  • WSAQuerySocketSecurity (Ordinal: 258, Address: 0x17820)
  • WSARevertImpersonation (Ordinal: 259, Address: 0x178a0)
  • WSASetSocketPeerTargetName (Ordinal: 260, Address: 0x178e0)
  • WSASetSocketSecurity (Ordinal: 261, Address: 0x17930)
  • WfpCloseDPConfigureHandle (Ordinal: 262, Address: 0x343b0)
  • WfpConfigureDPSecurityDescriptor (Ordinal: 263, Address: 0x343d0)
  • WfpCreateDPConfigureHandle (Ordinal: 264, Address: 0x34430)
  • WfpRIOChannelClose (Ordinal: 265, Address: 0x343b0)
  • WfpRIOCleanupRequestQueue (Ordinal: 266, Address: 0x34790)
  • WfpRIOCloseCompletionQueue (Ordinal: 267, Address: 0x34840)
  • WfpRIOCreateChannel (Ordinal: 268, Address: 0x348e0)
  • WfpRIOCreateCompletionQueue (Ordinal: 269, Address: 0x34900)
  • WfpRIOCreateRequestQueue (Ordinal: 270, Address: 0x34ad0)
  • WfpRIODeregisterBuffer (Ordinal: 271, Address: 0x34ca0)
  • WfpRIOIndicateActivityThreshold (Ordinal: 272, Address: 0x34d20)
  • WfpRIONotify (Ordinal: 273, Address: 0x34d90)
  • WfpRIOReceive (Ordinal: 274, Address: 0x34e10)
  • WfpRIORegisterBuffer (Ordinal: 275, Address: 0x34ef0)
  • WfpRIOResume (Ordinal: 276, Address: 0x34fc0)
  • WfpRIOSend (Ordinal: 277, Address: 0x35030)
  • WfpRIOSuspend (Ordinal: 278, Address: 0x35110)

Imported DLLs & Functions

api-ms-win-core-delayload-l1-1-0.dll
  • DelayLoadFailureHook (Address: 0x180058218)
api-ms-win-core-delayload-l1-1-1.dll
  • ResolveDelayLoadedAPI (Address: 0x180058228)
api-ms-win-core-errorhandling-l1-1-0.dll
  • GetLastError (Address: 0x180058238)
  • SetUnhandledExceptionFilter (Address: 0x180058240)
  • UnhandledExceptionFilter (Address: 0x180058248)
api-ms-win-core-file-l1-1-0.dll
  • CreateFileW (Address: 0x180058258)
api-ms-win-core-handle-l1-1-0.dll
  • CloseHandle (Address: 0x180058268)
  • DuplicateHandle (Address: 0x180058270)
api-ms-win-core-heap-l1-1-0.dll
  • GetProcessHeap (Address: 0x180058290)
  • HeapAlloc (Address: 0x180058288)
  • HeapFree (Address: 0x180058280)
  • HeapReAlloc (Address: 0x180058298)
  • HeapSize (Address: 0x1800582a0)
api-ms-win-core-libraryloader-l1-2-0.dll
  • DisableThreadLibraryCalls (Address: 0x1800582d0)
  • FreeLibrary (Address: 0x1800582c8)
  • FreeLibraryAndExitThread (Address: 0x1800582b8)
  • GetModuleHandleA (Address: 0x1800582e0)
  • GetModuleHandleExA (Address: 0x1800582b0)
  • GetModuleHandleExW (Address: 0x1800582c0)
  • GetProcAddress (Address: 0x1800582d8)
api-ms-win-core-processenvironment-l1-1-0.dll
  • ExpandEnvironmentStringsW (Address: 0x1800582f0)
api-ms-win-core-processthreads-l1-1-0.dll
  • CreateThread (Address: 0x180058320)
  • GetCurrentProcess (Address: 0x180058338)
  • GetCurrentProcessId (Address: 0x180058308)
  • GetCurrentThread (Address: 0x180058318)
  • GetCurrentThreadId (Address: 0x180058328)
  • GetThreadId (Address: 0x180058348)
  • OpenProcessToken (Address: 0x180058310)
  • OpenThreadToken (Address: 0x180058330)
  • SetThreadToken (Address: 0x180058300)
  • TerminateProcess (Address: 0x180058340)
api-ms-win-core-processthreads-l1-1-1.dll
  • OpenProcess (Address: 0x180058358)
api-ms-win-core-profile-l1-1-0.dll
  • QueryPerformanceCounter (Address: 0x180058368)
api-ms-win-core-registry-l1-1-0.dll
  • RegCloseKey (Address: 0x1800583c0)
  • RegCreateKeyExW (Address: 0x180058380)
  • RegDeleteKeyExW (Address: 0x180058388)
  • RegDeleteValueW (Address: 0x1800583a0)
  • RegEnumKeyExW (Address: 0x1800583b0)
  • RegEnumValueW (Address: 0x1800583b8)
  • RegNotifyChangeKeyValue (Address: 0x1800583a8)
  • RegOpenKeyExW (Address: 0x180058378)
  • RegQueryValueExW (Address: 0x180058390)
  • RegSetValueExW (Address: 0x180058398)
api-ms-win-core-rtlsupport-l1-1-0.dll
  • RtlCaptureContext (Address: 0x1800583d0)
  • RtlLookupFunctionEntry (Address: 0x1800583e0)
  • RtlVirtualUnwind (Address: 0x1800583d8)
api-ms-win-core-string-l1-1-0.dll
  • CompareStringW (Address: 0x1800583f0)
api-ms-win-core-synch-l1-1-0.dll
  • AcquireSRWLockExclusive (Address: 0x180058448)
  • CreateEventW (Address: 0x180058470)
  • CreateSemaphoreExW (Address: 0x180058458)
  • DeleteCriticalSection (Address: 0x180058428)
  • EnterCriticalSection (Address: 0x180058430)
  • InitializeCriticalSectionAndSpinCount (Address: 0x180058420)
  • InitializeSRWLock (Address: 0x180058460)
  • LeaveCriticalSection (Address: 0x180058440)
  • OpenEventW (Address: 0x180058468)
  • ReleaseSemaphore (Address: 0x180058418)
  • ReleaseSRWLockExclusive (Address: 0x180058400)
  • SetEvent (Address: 0x180058450)
  • TryAcquireSRWLockExclusive (Address: 0x180058410)
  • TryEnterCriticalSection (Address: 0x180058438)
  • WaitForSingleObject (Address: 0x180058408)
api-ms-win-core-synch-l1-2-0.dll
  • Sleep (Address: 0x180058480)
api-ms-win-core-sysinfo-l1-1-0.dll
  • GetSystemTimeAsFileTime (Address: 0x180058498)
  • GetTickCount (Address: 0x180058490)
api-ms-win-core-threadpool-l1-2-0.dll
  • CloseThreadpoolTimer (Address: 0x1800584b0)
  • CreateThreadpoolTimer (Address: 0x1800584a8)
  • SetThreadpoolTimer (Address: 0x1800584b8)
  • WaitForThreadpoolTimerCallbacks (Address: 0x1800584c0)
api-ms-win-core-threadpool-legacy-l1-1-0.dll
  • QueueUserWorkItem (Address: 0x1800584d0)
  • UnregisterWaitEx (Address: 0x1800584d8)
api-ms-win-core-threadpool-private-l1-1-0.dll
  • RegisterWaitForSingleObjectEx (Address: 0x1800584e8)
api-ms-win-eventing-provider-l1-1-0.dll
  • EventRegister (Address: 0x1800584f8)
  • EventSetInformation (Address: 0x180058500)
  • EventUnregister (Address: 0x180058508)
  • EventWriteTransfer (Address: 0x180058510)
api-ms-win-security-base-l1-1-0.dll
  • CopySid (Address: 0x180058530)
  • GetLengthSid (Address: 0x180058520)
  • GetTokenInformation (Address: 0x180058528)
  • RevertToSelf (Address: 0x180058538)
bcrypt.dll
  • BCryptCreateHash (Address: 0x180058548)
  • BCryptDestroyHash (Address: 0x180058560)
  • BCryptFinishHash (Address: 0x180058558)
  • BCryptGetProperty (Address: 0x180058550)
  • BCryptHashData (Address: 0x180058568)
  • BCryptOpenAlgorithmProvider (Address: 0x180058570)
msvcrt.dll
  • __C_specific_handler (Address: 0x1800585d0)
  • _amsg_exit (Address: 0x1800585d8)
  • _initterm (Address: 0x180058588)
  • _wcsicmp (Address: 0x1800585a0)
  • _wcslwr (Address: 0x180058580)
  • _wcslwr_s (Address: 0x1800585b0)
  • _XcptFilter (Address: 0x1800585e8)
  • free (Address: 0x180058598)
  • malloc (Address: 0x180058590)
  • memcmp (Address: 0x1800585b8)
  • memcpy (Address: 0x1800585c0)
  • memset (Address: 0x1800585c8)
  • qsort (Address: 0x1800585e0)
  • strcmp (Address: 0x1800585f0)
  • wcschr (Address: 0x1800585a8)
ntdll.dll
  • EtwEventActivityIdControl (Address: 0x180058760)
  • EtwEventEnabled (Address: 0x180058688)
  • EtwEventRegister (Address: 0x1800586b0)
  • EtwEventUnregister (Address: 0x1800586a8)
  • EtwEventWrite (Address: 0x180058698)
  • EtwEventWriteTransfer (Address: 0x180058690)
  • EtwGetTraceEnableFlags (Address: 0x180058770)
  • EtwGetTraceEnableLevel (Address: 0x180058780)
  • EtwGetTraceLoggerHandle (Address: 0x180058778)
  • EtwRegisterTraceGuidsW (Address: 0x180058788)
  • EtwTraceMessage (Address: 0x180058758)
  • EtwUnregisterTraceGuids (Address: 0x180058768)
  • NtClose (Address: 0x1800586c0)
  • NtCreateFile (Address: 0x1800586d0)
  • NtDeviceIoControlFile (Address: 0x1800586c8)
  • NtQueryInformationToken (Address: 0x1800586e8)
  • NtQueryObject (Address: 0x180058628)
  • RtlAbsoluteToSelfRelativeSD (Address: 0x180058610)
  • RtlAllocateHeap (Address: 0x1800586a0)
  • RtlContractHashTable (Address: 0x180058620)
  • RtlCopySid (Address: 0x1800586f8)
  • RtlCreateHashTable (Address: 0x180058680)
  • RtlCreateSecurityDescriptor (Address: 0x180058730)
  • RtlDeleteHashTable (Address: 0x180058678)
  • RtlEndEnumerationHashTable (Address: 0x180058640)
  • RtlEnumerateEntryHashTable (Address: 0x180058648)
  • RtlEqualSid (Address: 0x1800586f0)
  • RtlExpandHashTable (Address: 0x180058630)
  • RtlFreeHeap (Address: 0x180058790)
  • RtlGetControlSecurityDescriptor (Address: 0x180058608)
  • RtlGetDaclSecurityDescriptor (Address: 0x180058740)
  • RtlGetGroupSecurityDescriptor (Address: 0x180058748)
  • RtlGetNextEntryHashTable (Address: 0x180058658)
  • RtlGetOwnerSecurityDescriptor (Address: 0x180058750)
  • RtlGetSaclSecurityDescriptor (Address: 0x180058738)
  • RtlGetThreadPreferredUILanguages (Address: 0x180058638)
  • RtlInitEnumerationHashTable (Address: 0x180058650)
  • RtlInitUnicodeString (Address: 0x1800586d8)
  • RtlInsertEntryHashTable (Address: 0x180058670)
  • RtlLengthSecurityDescriptor (Address: 0x180058600)
  • RtlLengthSid (Address: 0x180058700)
  • RtlLookupEntryHashTable (Address: 0x180058660)
  • RtlNtStatusToDosError (Address: 0x1800586b8)
  • RtlRemoveEntryHashTable (Address: 0x180058668)
  • RtlSetDaclSecurityDescriptor (Address: 0x180058718)
  • RtlSetGroupSecurityDescriptor (Address: 0x180058720)
  • RtlSetOwnerSecurityDescriptor (Address: 0x180058728)
  • RtlSetSaclSecurityDescriptor (Address: 0x180058710)
  • RtlSubAuthorityCountSid (Address: 0x180058618)
  • RtlValidSecurityDescriptor (Address: 0x1800586e0)
  • RtlValidSid (Address: 0x180058708)
RPCRT4.dll
  • I_RpcExceptionFilter (Address: 0x1800581f0)
  • MesDecodeBufferHandleCreate (Address: 0x1800581c8)
  • MesEncodeDynBufferHandleCreate (Address: 0x1800581e8)
  • MesHandleFree (Address: 0x1800581e0)
  • Ndr64AsyncClientCall (Address: 0x1800581d8)
  • NdrClientCall3 (Address: 0x1800581d0)
  • NdrMesTypeDecode3 (Address: 0x1800581c0)
  • NdrMesTypeEncode3 (Address: 0x1800581b8)
  • RpcAsyncCompleteCall (Address: 0x1800581a0)
  • RpcAsyncInitializeHandle (Address: 0x1800581a8)
  • RpcBindingBind (Address: 0x180058200)
  • RpcBindingCreateW (Address: 0x180058208)
  • RpcBindingFree (Address: 0x180058198)
  • RpcBindingSetOption (Address: 0x180058190)
  • RpcSsDestroyClientContext (Address: 0x1800581f8)
  • UuidCreate (Address: 0x1800581b0)