ONBttnOL.dll
Description: Microsoft OneNote Outlook Add-in
Authors: Microsoft Corporation
Version: 16.0.19725.20152
Architecture: 64-bit
Operating System: Windows NT
SHA256: 039880051eb778bd9ea3e2ab91e4abe5
File Size: 886.8 KB
Uploaded At: March 11, 2026, 8:49 a.m.
Views: 13
Security Warning
This file has been flagged as potentially dangerous.
Reason: Detected potentially dangerous functions used for process injection: OpenProcess
Exported Functions
- DllMain (Ordinal: 1, Address: 0x17f20)
- DllCanUnloadNow (Ordinal: 2, Address: 0x18010)
- DllGetClassObject (Ordinal: 3, Address: 0x18030)
- DllRegisterServer (Ordinal: 4, Address: 0x181f0)
- DllUnregisterServer (Ordinal: 5, Address: 0x18570)
Imported DLLs & Functions
api-ms-win-crt-convert-l1-1-0.dll
- _i64tow_s (Address: 0x180089650)
- _wcstod_l (Address: 0x180089660)
- _wtoi (Address: 0x180089658)
api-ms-win-crt-filesystem-l1-1-0.dll
- _wsplitpath_s (Address: 0x180089670)
api-ms-win-crt-heap-l1-1-0.dll
- free (Address: 0x180089638)
- malloc (Address: 0x180089640)
- realloc (Address: 0x180089630)
api-ms-win-crt-locale-l1-1-0.dll
- __initialize_lconv_for_unsigned_char (Address: 0x1800897b8)
- _create_locale (Address: 0x1800897a8)
- _free_locale (Address: 0x1800897b0)
api-ms-win-crt-math-l1-1-0.dll
- ceilf (Address: 0x180089710)
- pow (Address: 0x180089718)
- round (Address: 0x180089708)
api-ms-win-crt-runtime-l1-1-0.dll
- _cexit (Address: 0x180089760)
- _configure_narrow_argv (Address: 0x180089730)
- _crt_atexit (Address: 0x180089758)
- _errno (Address: 0x180089778)
- _execute_onexit_table (Address: 0x180089750)
- _initialize_narrow_environment (Address: 0x180089798)
- _initialize_onexit_table (Address: 0x180089740)
- _initterm (Address: 0x180089738)
- _initterm_e (Address: 0x180089790)
- _invalid_parameter_noinfo (Address: 0x180089770)
- _invoke_watson (Address: 0x180089788)
- _register_onexit_function (Address: 0x180089748)
- _seh_filter_dll (Address: 0x180089728)
- abort (Address: 0x180089780)
- terminate (Address: 0x180089768)
api-ms-win-crt-stdio-l1-1-0.dll
- __stdio_common_vsnwprintf_s (Address: 0x180089690)
- __stdio_common_vswprintf (Address: 0x180089688)
- __stdio_common_vswprintf_s (Address: 0x180089680)
api-ms-win-crt-string-l1-1-0.dll
- _stricmp (Address: 0x1800896b0)
- _wcsicmp (Address: 0x1800896b8)
- isdigit (Address: 0x1800896e8)
- strcmp (Address: 0x1800896d8)
- strncpy_s (Address: 0x1800896a8)
- strnlen (Address: 0x1800896d0)
- wcscmp (Address: 0x1800896c8)
- wcscpy_s (Address: 0x1800896c0)
- wcsncat_s (Address: 0x1800896a0)
- wcsncpy_s (Address: 0x1800896f0)
- wcsnlen (Address: 0x1800896e0)
- wcstok_s (Address: 0x1800896f8)
KERNEL32.dll
- AcquireSRWLockExclusive (Address: 0x180089250)
- AcquireSRWLockShared (Address: 0x180089260)
- ActivateActCtx (Address: 0x180089080)
- CloseHandle (Address: 0x180089068)
- CompareStringEx (Address: 0x180089158)
- CreateActCtxW (Address: 0x1800890a0)
- CreateDirectoryW (Address: 0x180089018)
- CreateEventExW (Address: 0x180089168)
- CreateEventW (Address: 0x180089050)
- CreateFileW (Address: 0x180089240)
- CreateThread (Address: 0x180089058)
- CreateWaitableTimerW (Address: 0x180089268)
- DeactivateActCtx (Address: 0x180089088)
- DecodePointer (Address: 0x180089130)
- DeleteCriticalSection (Address: 0x180089298)
- DeleteFileW (Address: 0x180089028)
- DisableThreadLibraryCalls (Address: 0x180089040)
- EncodePointer (Address: 0x180089138)
- EnterCriticalSection (Address: 0x1800892a0)
- EnumSystemLocalesEx (Address: 0x1800891c8)
- FileTimeToSystemTime (Address: 0x180089128)
- FindActCtxSectionStringW (Address: 0x180089098)
- FindResourceW (Address: 0x1800890c8)
- FlsFree (Address: 0x180089148)
- FormatMessageW (Address: 0x180089278)
- FreeLibrary (Address: 0x1800891a8)
- GetACP (Address: 0x180089190)
- GetCurrentProcess (Address: 0x1800891e0)
- GetCurrentProcessId (Address: 0x180089030)
- GetCurrentThreadId (Address: 0x180089108)
- GetDateFormatW (Address: 0x1800892d0)
- GetFileType (Address: 0x180089238)
- GetLastError (Address: 0x180089020)
- GetLocaleInfoEx (Address: 0x180089160)
- GetLocaleInfoW (Address: 0x180089180)
- GetModuleFileNameA (Address: 0x1800891f8)
- GetModuleFileNameW (Address: 0x180089048)
- GetModuleHandleExW (Address: 0x1800890b0)
- GetModuleHandleW (Address: 0x180089000)
- GetProcAddress (Address: 0x180089008)
- GetProcessHeap (Address: 0x180089230)
- GetShortPathNameA (Address: 0x180089200)
- GetStringTypeExW (Address: 0x1800890f8)
- GetSystemDefaultLocaleName (Address: 0x1800891d0)
- GetSystemDirectoryW (Address: 0x1800891a0)
- GetSystemInfo (Address: 0x1800892f0)
- GetSystemTimeAsFileTime (Address: 0x180089100)
- GetTempFileNameW (Address: 0x1800890e8)
- GetTempPathW (Address: 0x180089010)
- GetTickCount (Address: 0x180089078)
- GetTimeFormatW (Address: 0x1800892c8)
- GetUserDefaultLCID (Address: 0x180089198)
- GetUserDefaultLocaleName (Address: 0x180089118)
- GetUserPreferredUILanguages (Address: 0x180089188)
- GetVersionExW (Address: 0x180089270)
- HeapAlloc (Address: 0x180089228)
- HeapFree (Address: 0x180089220)
- InitializeCriticalSectionEx (Address: 0x180089290)
- InitializeSListHead (Address: 0x1800892b0)
- InitOnceBeginInitialize (Address: 0x180089300)
- InitOnceComplete (Address: 0x1800892f8)
- InterlockedPopEntrySList (Address: 0x1800892c0)
- InterlockedPushEntrySList (Address: 0x1800892b8)
- IsDebuggerPresent (Address: 0x180089350)
- IsProcessorFeaturePresent (Address: 0x180089320)
- IsWow64Process (Address: 0x180089218)
- LCIDToLocaleName (Address: 0x180089170)
- LeaveCriticalSection (Address: 0x1800892a8)
- LoadLibraryExA (Address: 0x1800891d8)
- LoadLibraryExW (Address: 0x1800891b0)
- LoadLibraryW (Address: 0x180089090)
- LoadResource (Address: 0x1800890d8)
- LocaleNameToLCID (Address: 0x180089178)
- LocalFree (Address: 0x180089280)
- LockResource (Address: 0x1800890e0)
- lstrlenW (Address: 0x180089038)
- MultiByteToWideChar (Address: 0x180089110)
- OpenProcess (Address: 0x1800891e8)
- OutputDebugStringA (Address: 0x1800890c0)
- OutputDebugStringW (Address: 0x1800892d8)
- QueryActCtxW (Address: 0x1800890b8)
- QueryDepthSList (Address: 0x180089288)
- QueryPerformanceCounter (Address: 0x180089308)
- RaiseException (Address: 0x1800891b8)
- ReleaseSRWLockExclusive (Address: 0x180089248)
- ReleaseSRWLockShared (Address: 0x180089258)
- RtlCaptureContext (Address: 0x180089348)
- RtlLookupFunctionEntry (Address: 0x180089340)
- RtlVirtualUnwind (Address: 0x180089338)
- SetEvent (Address: 0x180089070)
- SetLastError (Address: 0x1800890a8)
- SetUnhandledExceptionFilter (Address: 0x180089328)
- SizeofResource (Address: 0x1800890d0)
- SleepConditionVariableSRW (Address: 0x180089310)
- TerminateProcess (Address: 0x1800891f0)
- TlsAlloc (Address: 0x180089140)
- TlsFree (Address: 0x180089150)
- UnhandledExceptionFilter (Address: 0x180089330)
- UnmapViewOfFile (Address: 0x1800891c0)
- VerifyVersionInfoW (Address: 0x180089210)
- VerSetConditionMask (Address: 0x180089208)
- VirtualProtect (Address: 0x1800892e8)
- VirtualQuery (Address: 0x1800892e0)
- WaitForSingleObject (Address: 0x180089060)
- WakeAllConditionVariable (Address: 0x180089318)
- WideCharToMultiByte (Address: 0x180089120)
- WriteFile (Address: 0x1800890f0)
MSVCP140.dll
- _Mtx_init_in_situ (Address: 0x180089400)
- _Mtx_lock (Address: 0x180089418)
- _Mtx_unlock (Address: 0x180089408)
- _Query_perf_counter (Address: 0x180089500)
- _Query_perf_frequency (Address: 0x180089620)
- _Thrd_id (Address: 0x180089510)
- ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z (Address: 0x180089610)
- ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ (Address: 0x1800894f0)
- ?_Id_cnt@id@locale@std@@0HA (Address: 0x1800894f8)
- ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ (Address: 0x180089488)
- ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ (Address: 0x180089578)
- ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ (Address: 0x180089430)
- ?_Throw_Cpp_error@std@@YAXH@Z (Address: 0x180089410)
- ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ (Address: 0x180089480)
- ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ (Address: 0x180089570)
- ?_Xbad_alloc@std@@YAXXZ (Address: 0x180089508)
- ?_Xbad_function_call@std@@YAXXZ (Address: 0x180089520)
- ?_Xlength_error@std@@YAXPEBD@Z (Address: 0x180089420)
- ?_Xout_of_range@std@@YAXPEBD@Z (Address: 0x180089460)
- ??0_Lockit@std@@QEAA@H@Z (Address: 0x1800894e8)
- ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ (Address: 0x1800894d0)
- ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ (Address: 0x180089590)
- ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z (Address: 0x1800894d8)
- ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z (Address: 0x180089598)
- ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ (Address: 0x1800894c8)
- ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ (Address: 0x180089588)
- ??1_Lockit@std@@QEAA@XZ (Address: 0x1800894e0)
- ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ (Address: 0x180089468)
- ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ (Address: 0x180089528)
- ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ (Address: 0x180089470)
- ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ (Address: 0x180089580)
- ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ (Address: 0x180089478)
- ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ (Address: 0x180089530)
- ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_J@Z (Address: 0x1800895d0)
- ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z (Address: 0x1800895d8)
- ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@F@Z (Address: 0x1800895b8)
- ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@G@Z (Address: 0x1800895c0)
- ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z (Address: 0x1800895c8)
- ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z (Address: 0x180089518)
- ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z (Address: 0x1800895f8)
- ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@M@Z (Address: 0x1800895e0)
- ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@N@Z (Address: 0x1800895e8)
- ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z (Address: 0x1800895f0)
- ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z (Address: 0x180089600)
- ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z (Address: 0x1800895a0)
- ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ (Address: 0x180089438)
- ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ (Address: 0x180089608)
- ?good@ios_base@std@@QEBA_NXZ (Address: 0x180089458)
- ?id@?$ctype@_W@std@@2V0locale@2@A (Address: 0x1800895a8)
- ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z (Address: 0x1800894c0)
- ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z (Address: 0x180089538)
- ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z (Address: 0x1800894b8)
- ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z (Address: 0x180089548)
- ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z (Address: 0x180089440)
- ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z (Address: 0x1800895b0)
- ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ (Address: 0x180089498)
- ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ (Address: 0x180089568)
- ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z (Address: 0x180089448)
- ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z (Address: 0x180089450)
- ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ (Address: 0x180089490)
- ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ (Address: 0x180089540)
- ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ (Address: 0x1800894a0)
- ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ (Address: 0x180089560)
- ?uncaught_exceptions@std@@YAHXZ (Address: 0x180089428)
- ?widen@?$ctype@_W@std@@QEBA_WD@Z (Address: 0x180089618)
- ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z (Address: 0x1800894a8)
- ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z (Address: 0x180089558)
- ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z (Address: 0x1800894b0)
- ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z (Address: 0x180089550)
VCRUNTIME140_1.dll
- __CxxFrameHandler4 (Address: 0x180089360)
VCRUNTIME140.dll
- __C_specific_handler (Address: 0x1800893d8)
- __C_specific_handler_noexcept (Address: 0x180089380)
- __current_exception (Address: 0x180089378)
- __current_exception_context (Address: 0x180089370)
- __std_exception_copy (Address: 0x1800893e8)
- __std_exception_destroy (Address: 0x1800893e0)
- __std_terminate (Address: 0x1800893c0)
- __std_type_info_destroy_list (Address: 0x1800893f0)
- _CxxThrowException (Address: 0x180089398)
- _purecall (Address: 0x1800893d0)
- memcmp (Address: 0x180089390)
- memcpy (Address: 0x180089388)
- memmove (Address: 0x1800893b0)
- memset (Address: 0x1800893a8)
- wcschr (Address: 0x1800893c8)
- wcsrchr (Address: 0x1800893a0)
- wcsstr (Address: 0x1800893b8)