samsrv.dll
Description: SAM Server DLL
Authors: © Microsoft Corporation. All rights reserved.
Version: 10.0.19041.5794
Architecture: 64-bit
Operating System: Windows NT
SHA256: 2a5bcd3308ee5cf2c6b62f2ecfdeb393
File Size: 911.5 KB
Uploaded At: Dec. 1, 2025, 7:38 a.m.
Views: 8
Security Warning
This file has been flagged as potentially dangerous.
Reason: Detected potentially dangerous functions used for process injection: OpenProcess
Exported Functions
- RtlDeleteElementGenericTable2 (Ordinal: 1, Address: 0xeee0)
- RtlInitializeGenericTable2 (Ordinal: 2, Address: 0x23ef0)
- RtlInsertElementGenericTable2 (Ordinal: 3, Address: 0x36e0)
- RtlLookupElementGenericTable2 (Ordinal: 4, Address: 0x4910)
- SAM_MIDL_user_allocate (Ordinal: 5, Address: 0xb7d0)
- SAM_MIDL_user_free (Ordinal: 6, Address: 0x100f0)
- SamDsExtAlloc (Ordinal: 7, Address: 0xb7d0)
- SamDsExtFree (Ordinal: 8, Address: 0x100f0)
- SamIAccountRestrictions (Ordinal: 9, Address: 0x2edf0)
- SamIAddDSNameToAlias (Ordinal: 10, Address: 0x1a860)
- SamIChangePasswordForeignUser (Ordinal: 11, Address: 0x8d720)
- SamIClaimIsValid (Ordinal: 12, Address: 0x708f0)
- SamIConnect (Ordinal: 13, Address: 0x315f0)
- SamIConvertSecurityAttributesToClaimsBlob (Ordinal: 14, Address: 0x709b0)
- SamICopyCurrentDomainAccountSettings (Ordinal: 15, Address: 0x95b70)
- SamICreateKrbTgt (Ordinal: 16, Address: 0x77e60)
- SamIDecodeClaimsBlob (Ordinal: 17, Address: 0x70c20)
- SamIDecodeClaimsBlobIntoClaimsSet (Ordinal: 18, Address: 0x70c70)
- SamIDecodeClaimsBlobToAuthz (Ordinal: 19, Address: 0x60be0)
- SamIDemote (Ordinal: 20, Address: 0x7f9b0)
- SamIDemoteUndo (Ordinal: 21, Address: 0x7fa50)
- SamIDoFSMORoleChange (Ordinal: 22, Address: 0x74550)
- SamIFreeAuthzSecurityAttributesInfo (Ordinal: 23, Address: 0x60c30)
- SamIFreeClaimsBlob (Ordinal: 24, Address: 0x20ad0)
- SamIFreeDecodedClaimsSet (Ordinal: 25, Address: 0x70cf0)
- SamIFreeLookupNamesInfo (Ordinal: 26, Address: 0x86ab0)
- SamIFreeLookupSidsInfo (Ordinal: 27, Address: 0x86bf0)
- SamIFreeOidList (Ordinal: 28, Address: 0x95b90)
- SamIFreeRealmList (Ordinal: 29, Address: 0xff40)
- SamIFreeSecurityAttributesInfo (Ordinal: 30, Address: 0x70db0)
- SamIFreeSidAndAttributesList (Ordinal: 31, Address: 0xfc10)
- SamIFreeSidArray (Ordinal: 32, Address: 0xfc90)
- SamIFreeVoid (Ordinal: 33, Address: 0x100f0)
- SamIFree_SAMPR_DISPLAY_INFO_BUFFER (Ordinal: 34, Address: 0x86dc0)
- SamIFree_SAMPR_DOMAIN_INFO_BUFFER (Ordinal: 35, Address: 0x23f20)
- SamIFree_SAMPR_ENUMERATION_BUFFER (Ordinal: 36, Address: 0x29760)
- SamIFree_SAMPR_GET_GROUPS_BUFFER (Ordinal: 37, Address: 0x86e00)
- SamIFree_SAMPR_RETURNED_USTRING_ARRAY (Ordinal: 38, Address: 0xff90)
- SamIFree_SAMPR_ULONG_ARRAY (Ordinal: 39, Address: 0xfef0)
- SamIFree_SAMPR_USER_INFO_BUFFER (Ordinal: 40, Address: 0xfdd0)
- SamIFree_UserInternal6Information (Ordinal: 41, Address: 0x2fe20)
- SamIGetAliasMembership (Ordinal: 42, Address: 0x79c0)
- SamIGetConfigurationOidList (Ordinal: 43, Address: 0x95bd0)
- SamIGetDefaultAdministratorName (Ordinal: 44, Address: 0x96dc0)
- SamIGetResourceGroupMembershipsTransitive (Ordinal: 45, Address: 0xdd50)
- SamIGetResourceGroupMembershipsTransitive2 (Ordinal: 46, Address: 0x13fd0)
- SamIGetUserLogonInformation (Ordinal: 47, Address: 0x95cc0)
- SamIGetUserLogonInformation2 (Ordinal: 48, Address: 0x2f190)
- SamIGetUserLogonInformation3 (Ordinal: 49, Address: 0x20e40)
- SamIGetUserLogonInformationEx (Ordinal: 50, Address: 0x21870)
- SamIHandleObjectUpdate (Ordinal: 51, Address: 0x158f0)
- SamIImpersonateNullSession (Ordinal: 52, Address: 0x22ea0)
- SamIInitialize (Ordinal: 53, Address: 0x25db0)
- SamIIsDownlevelDcUpgrade (Ordinal: 54, Address: 0x8af40)
- SamIIsExtendedSidMode (Ordinal: 55, Address: 0x7a160)
- SamIIsRebootAfterPromotion (Ordinal: 56, Address: 0x8af50)
- SamIIsSetupInProgress (Ordinal: 57, Address: 0x25da0)
- SamILoadDownlevelDatabase (Ordinal: 58, Address: 0x7fa80)
- SamILookupNamesBySid (Ordinal: 59, Address: 0x74590)
- SamILookupNamesInDomain (Ordinal: 60, Address: 0x6fa0)
- SamILookupSidsByName (Ordinal: 61, Address: 0x74880)
- SamILoopbackConnect (Ordinal: 62, Address: 0x20600)
- SamILoopbackConnectEx (Ordinal: 63, Address: 0x38650)
- SamIMixedDomain (Ordinal: 64, Address: 0x235b0)
- SamIMixedDomain2 (Ordinal: 65, Address: 0x21720)
- SamINT4UpgradeInProgress (Ordinal: 66, Address: 0x24020)
- SamINetLogonPing (Ordinal: 67, Address: 0x13dd0)
- SamINotifyRoleChange (Ordinal: 68, Address: 0x74b60)
- SamIOpenUserByAlternateId (Ordinal: 69, Address: 0x8db30)
- SamIPromote (Ordinal: 70, Address: 0x10fd0)
- SamIPromoteUndo (Ordinal: 71, Address: 0x7fc80)
- SamIPurgeSecrets (Ordinal: 72, Address: 0x95d10)
- SamIQueryAccountSecretsCachability (Ordinal: 73, Address: 0x95df0)
- SamIQueryCapabilities (Ordinal: 74, Address: 0x14960)
- SamIQueryRealmList (Ordinal: 75, Address: 0x314b0)
- SamIQueryServerRole (Ordinal: 76, Address: 0x20ec0)
- SamIQueryServerRole2 (Ordinal: 77, Address: 0x237a0)
- SamIRandomizeStoredPassword (Ordinal: 78, Address: 0x7d160)
- SamIRandomizeStoredPasswordWithoutExpirationCheck (Ordinal: 79, Address: 0x7d860)
- SamIRemoveDSNameFromAlias (Ordinal: 80, Address: 0x5d190)
- SamIReplaceDownlevelDatabase (Ordinal: 81, Address: 0x7fca0)
- SamIReplicateAccountData (Ordinal: 82, Address: 0x96eb0)
- SamIResetBadPwdCountOnPdc (Ordinal: 83, Address: 0x7d8a0)
- SamIRetrieveMultiplePrimaryCredentials (Ordinal: 84, Address: 0x148b0)
- SamIRetrieveNGCKeyCredential (Ordinal: 85, Address: 0x727c0)
- SamIRetrievePrimaryCredentials (Ordinal: 86, Address: 0x72860)
- SamIRevertNullSession (Ordinal: 87, Address: 0x228e0)
- SamIScorePassword (Ordinal: 88, Address: 0x14400)
- SamISetAuditingInformation (Ordinal: 89, Address: 0x96ff0)
- SamISetMachinePassword (Ordinal: 90, Address: 0x8dc10)
- SamISetPasswordForeignUser2 (Ordinal: 91, Address: 0x8dc90)
- SamISetPasswordForeignUser3 (Ordinal: 92, Address: 0x8dcd0)
- SamISetPasswordInfoOnDc (Ordinal: 93, Address: 0x7d8f0)
- SamIStorePrimaryCredentials (Ordinal: 94, Address: 0x728c0)
- SamITransformClaims (Ordinal: 95, Address: 0x70e00)
- SamIUPNFromUserHandle (Ordinal: 96, Address: 0x141a0)
- SamIUnLoadDownlevelDatabase (Ordinal: 97, Address: 0x80050)
- SamIUninitialize (Ordinal: 98, Address: 0x86e40)
- SamIUpdateLogonStatistics (Ordinal: 99, Address: 0x2c1c0)
- SamIValidateAccountName (Ordinal: 100, Address: 0x97060)
- SamIValidateNewAccountName (Ordinal: 101, Address: 0x12a70)
- SampAccountControlToFlags (Ordinal: 102, Address: 0x20240)
- SampAcquireReadLock (Ordinal: 103, Address: 0xb8c0)
- SampAcquireSamLockExclusive (Ordinal: 104, Address: 0x11e70)
- SampAcquireWriteLock (Ordinal: 105, Address: 0x2c080)
- SampAddAccountToGroupMembers (Ordinal: 106, Address: 0x1b890)
- SampAddAccountsAndApplyMemberships (Ordinal: 107, Address: 0x800e0)
- SampAddDeltaTime (Ordinal: 108, Address: 0x4e70)
- SampAddNonLocalDomainRelativeMemberships (Ordinal: 109, Address: 0x80370)
- SampAddSameDomainMemberToGlobalOrUniversalGroup (Ordinal: 110, Address: 0x1b030)
- SampAddUserToGroup (Ordinal: 111, Address: 0x7a330)
- SampAlInvalidateAliasInformation (Ordinal: 112, Address: 0x22ec0)
- SampAllocateNextCurrentRidFromIndex (Ordinal: 113, Address: 0x971f0)
- SampApplyDomainUpdatesForAllDomains (Ordinal: 114, Address: 0x24430)
- SampAssignPrimaryGroup (Ordinal: 115, Address: 0x8e2b0)
- SampAuditAccountEnableDisableChange (Ordinal: 116, Address: 0x20150)
- SampAuditAccountNameChange (Ordinal: 117, Address: 0x84080)
- SampAuditAnyEvent (Ordinal: 118, Address: 0x24f0)
- SampAuditGroupTypeChange (Ordinal: 119, Address: 0x84790)
- SampAuditSidHistory (Ordinal: 120, Address: 0x84ae0)
- SampBuildDsNameFromSid (Ordinal: 121, Address: 0x1e980)
- SampBuildSamProtection (Ordinal: 122, Address: 0x2a4d0)
- SampCalculateLmAndNtOwfPasswords (Ordinal: 123, Address: 0x14ce0)
- SampChangeAliasAccountName (Ordinal: 124, Address: 0x5d340)
- SampChangeGroupAccountName (Ordinal: 125, Address: 0x7a3f0)
- SampChangeUserAccountName (Ordinal: 126, Address: 0x8edc0)
- SampCheckForAccountLockout (Ordinal: 127, Address: 0x8f1b0)
- SampCheckGroupTypeBits (Ordinal: 128, Address: 0x227f0)
- SampCheckSidType (Ordinal: 129, Address: 0x1e670)
- SampCommitBufferedWrites (Ordinal: 130, Address: 0x20440)
- SampCompareDisplayStrings (Ordinal: 131, Address: 0x1ec70)
- SampComputePasswordExpired (Ordinal: 132, Address: 0x152b0)
- SampConnect (Ordinal: 133, Address: 0x7af0)
- SampConvertUiListToApiList (Ordinal: 134, Address: 0x979f0)
- SampCopyUserSupplementalCredentialsForDCPromo (Ordinal: 135, Address: 0x1e010)
- SampCreateAccountContext2 (Ordinal: 136, Address: 0x5b30)
- SampCreateAliasInDomain (Ordinal: 137, Address: 0x138b0)
- SampCreateContextEx (Ordinal: 138, Address: 0x5f90)
- SampCreateDefaultUPN (Ordinal: 139, Address: 0x12150)
- SampCreateFullSid (Ordinal: 140, Address: 0xdf90)
- SampCreateGroupInDomain (Ordinal: 141, Address: 0x12530)
- SampCreateUserInDomain (Ordinal: 142, Address: 0x18a60)
- SampCurrentThreadOwnsLock (Ordinal: 143, Address: 0x4830)
- SampDeReferenceContext (Ordinal: 144, Address: 0xa7c0)
- SampDecrementActiveThreads (Ordinal: 145, Address: 0x14990)
- SampDecryptCredentialData (Ordinal: 146, Address: 0x20d10)
- SampDeleteContext (Ordinal: 147, Address: 0xbfa0)
- SampDeleteDsDirsToDeleteKey (Ordinal: 148, Address: 0x81d00)
- SampDeleteKeyForPostBootPromote (Ordinal: 149, Address: 0x81dc0)
- SampDeltaChangeNotify (Ordinal: 150, Address: 0x1f990)
- SampDsChangePasswordUser (Ordinal: 151, Address: 0x8fe60)
- SampDsConvertReadAttrBlock (Ordinal: 152, Address: 0x1ca40)
- SampDsGetPrimaryDomainStart (Ordinal: 153, Address: 0xf710)
- SampDsInitializeSingleDomain (Ordinal: 154, Address: 0x1dbd0)
- SampDsIsRunning (Ordinal: 155, Address: 0x26710)
- SampDsMakeAttrBlock (Ordinal: 156, Address: 0x1c840)
- SampDsSetBuiltinDomainPolicy (Ordinal: 157, Address: 0x1e550)
- SampDsSetDomainPolicy (Ordinal: 158, Address: 0x1e4a0)
- SampDsSetPasswordUser (Ordinal: 159, Address: 0x14e50)
- SampDsUpdateContextAttributes (Ordinal: 160, Address: 0x1bef0)
- SampDuplicateGroupInfo (Ordinal: 161, Address: 0x72fa0)
- SampDuplicateMachineInfo (Ordinal: 162, Address: 0x72fa0)
- SampDuplicateOemGroupInfo (Ordinal: 163, Address: 0x73050)
- SampDuplicateOemUserInfo (Ordinal: 164, Address: 0x73050)
- SampDuplicateUnicodeString (Ordinal: 165, Address: 0x15370)
- SampDuplicateUserInfo (Ordinal: 166, Address: 0x730b0)
- SampEncryptCredentialData (Ordinal: 167, Address: 0x17f00)
- SampExamineSid (Ordinal: 168, Address: 0x2ce30)
- SampExtendDefinedDomains (Ordinal: 169, Address: 0x23fe0)
- SampFlagsToAccountControl (Ordinal: 170, Address: 0x15920)
- SampFlagsToAccountControlEx (Ordinal: 171, Address: 0x3b380)
- SampFreeGroupInfo (Ordinal: 172, Address: 0x73220)
- SampFreeMachineInfo (Ordinal: 173, Address: 0x73220)
- SampFreeOemGroupInfo (Ordinal: 174, Address: 0x73250)
- SampFreeOemUserInfo (Ordinal: 175, Address: 0x73250)
- SampFreeUnicodeString (Ordinal: 176, Address: 0x4000)
- SampFreeUserInfo (Ordinal: 177, Address: 0x73280)
- SampGenerateRandomPassword (Ordinal: 178, Address: 0x825d0)
- SampGetAccessAttribute (Ordinal: 179, Address: 0x60970)
- SampGetAccountDomainInfo (Ordinal: 180, Address: 0x2b2a0)
- SampGetBehaviorVersion (Ordinal: 181, Address: 0x226f0)
- SampGetCurrentOwnerAndPrimaryGroup (Ordinal: 182, Address: 0x23050)
- SampGetDisableOutboundRSO (Ordinal: 183, Address: 0x980c0)
- SampGetDisableRSOOnPDCForward (Ordinal: 184, Address: 0x980d0)
- SampGetDisableResetBadPwdCountForward (Ordinal: 185, Address: 0x980e0)
- SampGetDisableSingleObjectRepl (Ordinal: 186, Address: 0x980f0)
- SampGetDnsDomainNameFromIndex (Ordinal: 187, Address: 0x216c0)
- SampGetDomainContextFromIndex (Ordinal: 188, Address: 0x20f70)
- SampGetDomainObjectFromAccountContext (Ordinal: 189, Address: 0x98100)
- SampGetDomainObjectFromIndex (Ordinal: 190, Address: 0x23e40)
- SampGetDomainServerRoleFromIndex (Ordinal: 191, Address: 0x98130)
- SampGetDomainSidFromAccountContext (Ordinal: 192, Address: 0x20120)
- SampGetDomainSidFromIndex (Ordinal: 193, Address: 0x23560)
- SampGetDomainSidListForSam (Ordinal: 194, Address: 0x114b0)
- SampGetDomainUpgradeTasks (Ordinal: 195, Address: 0x23ff0)
- SampGetDownLevelDomainControllersPresent (Ordinal: 196, Address: 0x216f0)
- SampGetExtendedAttribute (Ordinal: 197, Address: 0xe480)
- SampGetExternalNameFromIndex (Ordinal: 198, Address: 0x98150)
- SampGetFixedAttributes (Ordinal: 199, Address: 0x2a9b0)
- SampGetHasNeverTime (Ordinal: 200, Address: 0x98170)
- SampGetIgnoreGCFailures (Ordinal: 201, Address: 0x98180)
- SampGetLogLevel (Ordinal: 202, Address: 0x20eb0)
- SampGetNT4UpgradeInProgress (Ordinal: 203, Address: 0x24020)
- SampGetNewAccountSecurityNt4 (Ordinal: 204, Address: 0x887b0)
- SampGetNextUnmodifiedRidFromIndex (Ordinal: 205, Address: 0x98190)
- SampGetNoGcLogonEnforceKerberosIpCheck (Ordinal: 206, Address: 0x981b0)
- SampGetNoGcLogonEnforceNTLMCheck (Ordinal: 207, Address: 0x981c0)
- SampGetObjectSD (Ordinal: 208, Address: 0x30640)
- SampGetObjectTypeNameFromIndex (Ordinal: 209, Address: 0x20f50)
- SampGetPasswordMustChangeWithUF_UAC (Ordinal: 210, Address: 0x905e0)
- SampGetReverseMembershipTransitive (Ordinal: 211, Address: 0x6850)
- SampGetSamSubsystemName (Ordinal: 212, Address: 0x21710)
- SampGetSerialNumberDomain2 (Ordinal: 213, Address: 0x75020)
- SampGetServerObjectName (Ordinal: 214, Address: 0x24010)
- SampGetSidArrayAttribute (Ordinal: 215, Address: 0xf100)
- SampGetSidAttribute (Ordinal: 216, Address: 0x2a8f0)
- SampGetSuccessAccountAuditingEnabled (Ordinal: 217, Address: 0x22780)
- SampGetUlongArrayAttribute (Ordinal: 218, Address: 0x239f0)
- SampGetUnicodeStringAttribute (Ordinal: 219, Address: 0x9ab0)
- SampGetUserAccountControlComputed (Ordinal: 220, Address: 0x90710)
- SampGetUserAccountSettings (Ordinal: 221, Address: 0x67c0)
- SampGetWillNeverTime (Ordinal: 222, Address: 0x981d0)
- SampImpersonateClient (Ordinal: 223, Address: 0xd2e0)
- SampIncreaseBadPwdCountLoopback (Ordinal: 224, Address: 0x7da90)
- SampIncrementActiveThreads (Ordinal: 225, Address: 0xccb0)
- SampIncrementNetlogonChangeLogSerialNumber (Ordinal: 226, Address: 0x981e0)
- SampInvalidateDomainCache (Ordinal: 227, Address: 0x235e0)
- SampIsAccountBuiltIn (Ordinal: 228, Address: 0x21850)
- SampIsAuditingEnabled (Ordinal: 229, Address: 0x20e10)
- SampIsBuiltinDomain (Ordinal: 230, Address: 0x20df0)
- SampIsDomainHosted (Ordinal: 231, Address: 0x1f120)
- SampIsInternetAccount (Ordinal: 232, Address: 0xe3d0)
- SampIsServiceRunning (Ordinal: 233, Address: 0x982a0)
- SampIsSetupInProgress (Ordinal: 234, Address: 0x287f0)
- SampLogPrint (Ordinal: 235, Address: 0x7cbf0)
- SampLookupContext (Ordinal: 236, Address: 0x7e40)
- SampMarkPerAttributeInvalidFromWhichFields (Ordinal: 237, Address: 0x1ce80)
- SampNeedUserAccountSettingsDuringQuery (Ordinal: 238, Address: 0xb7f0)
- SampNetLogonNotificationRequired (Ordinal: 239, Address: 0x1ea00)
- SampNotifyAuditChange (Ordinal: 240, Address: 0x1f4c0)
- SampNotifyReplicatedInChange (Ordinal: 241, Address: 0x11d10)
- SampPasswordChangeNotify (Ordinal: 242, Address: 0x20a30)
- SampPasswordChangeNotifyWorker (Ordinal: 243, Address: 0x1f1f0)
- SampPositionOfHighestBit (Ordinal: 244, Address: 0x984f0)
- SampQueryCapabilities (Ordinal: 245, Address: 0x149b0)
- SampQueryDSRMAccountName (Ordinal: 246, Address: 0x35150)
- SampQueryInformationUserInternal (Ordinal: 247, Address: 0x7ee0)
- SampQueryUserSupplementalCredentialsRegistry (Ordinal: 248, Address: 0x20ba0)
- SampReadExtendedAttributes (Ordinal: 249, Address: 0xe7b0)
- SampRecordSystemSchemaVerisonInRegistry (Ordinal: 250, Address: 0x8cc80)
- SampReferenceContext (Ordinal: 251, Address: 0x203b0)
- SampRegObjToDsObj (Ordinal: 252, Address: 0x1d4a0)
- SampReleaseReadLock (Ordinal: 253, Address: 0xc940)
- SampReleaseSamLockExclusive (Ordinal: 254, Address: 0x11cd0)
- SampReleaseWriteLock (Ordinal: 255, Address: 0x2d5f0)
- SampRemoveAccountFromGroupMembers (Ordinal: 256, Address: 0x7a8d0)
- SampRemoveSameDomainMemberFromGlobalOrUniversalGroup (Ordinal: 257, Address: 0x7ab00)
- SampRemoveUserFromGroup (Ordinal: 258, Address: 0x7abc0)
- SampRenameKrbtgtAccount (Ordinal: 259, Address: 0x10d90)
- SampReplaceUserLogonHours (Ordinal: 260, Address: 0x911b0)
- SampReplaceUserV1aFixed (Ordinal: 261, Address: 0x2dd30)
- SampRetrieveGroupV1Fixed (Ordinal: 262, Address: 0x21570)
- SampRetrieveMultipleCredentials (Ordinal: 263, Address: 0x15e50)
- SampRetrieveUserPasswords (Ordinal: 264, Address: 0x7100)
- SampRetrieveUserV1aFixed (Ordinal: 265, Address: 0x7a70)
- SampRevertToSelf (Ordinal: 266, Address: 0x2bc0)
- SampRtlWellKnownPrivilegeCheck (Ordinal: 267, Address: 0x2ca0)
- SampSetAccessAttribute (Ordinal: 268, Address: 0x1d8c0)
- SampSetAdminPassword (Ordinal: 269, Address: 0x83730)
- SampSetAttributeAccess (Ordinal: 270, Address: 0x1e930)
- SampSetComputerObjectDsName (Ordinal: 271, Address: 0x23e70)
- SampSetDSRMPasswordWorker (Ordinal: 272, Address: 0x780f0)
- SampSetExtendedAttributeAccess (Ordinal: 273, Address: 0x10b20)
- SampSetFixedAttributes (Ordinal: 274, Address: 0x2ddb0)
- SampSetGlobalDsSids (Ordinal: 275, Address: 0x23170)
- SampSetPassword (Ordinal: 276, Address: 0x83860)
- SampSetPasswordInfoOnPdcByHandle (Ordinal: 277, Address: 0x7e730)
- SampSetPasswordInfoOnPdcByIndex (Ordinal: 278, Address: 0x7e7c0)
- SampSetSerialNumberDomain2 (Ordinal: 279, Address: 0x76570)
- SampSetTransactionDomain (Ordinal: 280, Address: 0x4740)
- SampSetTransactionWithinDomain (Ordinal: 281, Address: 0x98c40)
- SampSetUnicodeStringAttribute (Ordinal: 282, Address: 0x19990)
- SampSetUserAccountControl (Ordinal: 283, Address: 0x12f80)
- SampSplitSid (Ordinal: 284, Address: 0x293c0)
- SampStoreObjectAttributes (Ordinal: 285, Address: 0x2e000)
- SampStringFromGuid (Ordinal: 286, Address: 0x98e90)
- SampTraceEvent (Ordinal: 287, Address: 0xad70)
- SampUpdateAccountDisabledFlag (Ordinal: 288, Address: 0xb830)
- SampUpdateComputedUserAccountControlBits (Ordinal: 289, Address: 0x6d30)
- SampUpdateMixedModeAndFindDomain (Ordinal: 290, Address: 0x203c0)
- SampUpdatePerformanceCounters (Ordinal: 291, Address: 0xfa30)
- SampUpgradeUserParmsActual (Ordinal: 292, Address: 0x22840)
- SampUsingDsData (Ordinal: 293, Address: 0x24f90)
- SampValidateDomainCacheCallback (Ordinal: 294, Address: 0x11430)
- SampValidateDomainControllerCreation (Ordinal: 295, Address: 0x8a560)
- SampValidatePwdSettingAttempt (Ordinal: 296, Address: 0x15160)
- SampValidateRegAttributes (Ordinal: 297, Address: 0xcd70)
- SampWriteEventLog (Ordinal: 298, Address: 0x30750)
- SampWriteGroupType (Ordinal: 299, Address: 0x13ee0)
- SamrAddMemberToAlias (Ordinal: 300, Address: 0x2b750)
- SamrAddMemberToGroup (Ordinal: 301, Address: 0x7ae80)
- SamrCloseHandle (Ordinal: 302, Address: 0xa090)
- SamrCreateUser2InDomain (Ordinal: 303, Address: 0x769a0)
- SamrCreateUserInDomain (Ordinal: 304, Address: 0x76b40)
- SamrDeleteAlias (Ordinal: 305, Address: 0x5e4b0)
- SamrDeleteGroup (Ordinal: 306, Address: 0x7b010)
- SamrDeleteUser (Ordinal: 307, Address: 0x92430)
- SamrEnumerateDomainsInSamServer (Ordinal: 308, Address: 0xf3f0)
- SamrEnumerateUsersInDomain (Ordinal: 309, Address: 0xfb20)
- SamrEnumerateUsersInDomain2 (Ordinal: 310, Address: 0x21d0)
- SamrGetAliasMembership (Ordinal: 311, Address: 0x31ac0)
- SamrGetGroupsForUser (Ordinal: 312, Address: 0x31990)
- SamrGetMembersInAlias (Ordinal: 313, Address: 0x2680)
- SamrLookupDomainInSamServer (Ordinal: 314, Address: 0xf730)
- SamrLookupIdsInDomain (Ordinal: 315, Address: 0xe060)
- SamrLookupNamesInDomain (Ordinal: 316, Address: 0x102f0)
- SamrLookupNamesInDomain2 (Ordinal: 317, Address: 0x4be0)
- SamrOpenAlias (Ordinal: 318, Address: 0xece0)
- SamrOpenDomain (Ordinal: 319, Address: 0x7d70)
- SamrOpenGroup (Ordinal: 320, Address: 0x215f0)
- SamrOpenUser (Ordinal: 321, Address: 0xd7d0)
- SamrQueryDisplayInformation (Ordinal: 322, Address: 0x73a50)
- SamrQueryInformationDomain (Ordinal: 323, Address: 0x233d0)
- SamrQueryInformationUser (Ordinal: 324, Address: 0x4b30)
- SamrQueryInformationUser2 (Ordinal: 325, Address: 0x4b40)
- SamrQuerySecurityObject (Ordinal: 326, Address: 0x10560)
- SamrRemoveMemberFromAlias (Ordinal: 327, Address: 0x5eb70)
- SamrRemoveMemberFromGroup (Ordinal: 328, Address: 0x7b9c0)
- SamrRidToSid (Ordinal: 329, Address: 0xdeb0)
- SamrSetInformationAlias (Ordinal: 330, Address: 0x5ef10)
- SamrSetInformationGroup (Ordinal: 331, Address: 0x7bb50)
- SamrSetInformationUser (Ordinal: 332, Address: 0x92e90)
- SamrSetSecurityObject (Ordinal: 333, Address: 0x89770)
- SamrValidatePassword (Ordinal: 334, Address: 0x11890)
Imported DLLs & Functions
api-ms-win-core-apiquery-l1-1-0.dll
- ApiSetQueryApiSetPresence (Address: 0x1800abd50)
api-ms-win-core-console-l1-1-0.dll
- SetConsoleCtrlHandler (Address: 0x1800abd60)
api-ms-win-core-debug-l1-1-0.dll
- DebugBreak (Address: 0x1800abd78)
- IsDebuggerPresent (Address: 0x1800abd80)
- OutputDebugStringW (Address: 0x1800abd70)
api-ms-win-core-delayload-l1-1-0.dll
- DelayLoadFailureHook (Address: 0x1800abd90)
api-ms-win-core-delayload-l1-1-1.dll
- ResolveDelayLoadedAPI (Address: 0x1800abda0)
api-ms-win-core-errorhandling-l1-1-0.dll
- GetLastError (Address: 0x1800abdb8)
- SetErrorMode (Address: 0x1800abdb0)
- SetLastError (Address: 0x1800abdc8)
- SetUnhandledExceptionFilter (Address: 0x1800abdd0)
- UnhandledExceptionFilter (Address: 0x1800abdc0)
api-ms-win-core-file-l1-1-0.dll
- CompareFileTime (Address: 0x1800abdf0)
- CreateDirectoryW (Address: 0x1800abe00)
- CreateFileW (Address: 0x1800abe30)
- DeleteFileW (Address: 0x1800abe18)
- FindClose (Address: 0x1800abe20)
- FindFirstFileExW (Address: 0x1800abe10)
- FindFirstFileW (Address: 0x1800abe38)
- FindNextFileW (Address: 0x1800abe40)
- FlushFileBuffers (Address: 0x1800abde0)
- GetFileSize (Address: 0x1800abe08)
- RemoveDirectoryW (Address: 0x1800abdf8)
- SetFileInformationByHandle (Address: 0x1800abe48)
- SetFilePointer (Address: 0x1800abde8)
- WriteFile (Address: 0x1800abe28)
api-ms-win-core-handle-l1-1-0.dll
- CloseHandle (Address: 0x1800abe58)
api-ms-win-core-heap-l1-1-0.dll
- GetProcessHeap (Address: 0x1800abe68)
- HeapAlloc (Address: 0x1800abe78)
- HeapFree (Address: 0x1800abe70)
api-ms-win-core-heap-l2-1-0.dll
- LocalAlloc (Address: 0x1800abe88)
- LocalFree (Address: 0x1800abe90)
api-ms-win-core-interlocked-l1-1-0.dll
- InitializeSListHead (Address: 0x1800abea0)
api-ms-win-core-kernel32-legacy-l1-1-0.dll
- GetComputerNameW (Address: 0x1800abeb0)
- MoveFileW (Address: 0x1800abeb8)
api-ms-win-core-libraryloader-l1-2-0.dll
- FreeLibrary (Address: 0x1800abed0)
- GetModuleFileNameA (Address: 0x1800abee0)
- GetModuleFileNameW (Address: 0x1800abed8)
- GetModuleHandleExW (Address: 0x1800abee8)
- GetModuleHandleW (Address: 0x1800abec8)
- GetProcAddress (Address: 0x1800abef8)
- LoadLibraryExW (Address: 0x1800abef0)
api-ms-win-core-localization-l1-2-0.dll
- FormatMessageW (Address: 0x1800abf08)
api-ms-win-core-memory-l1-1-0.dll
- VirtualAlloc (Address: 0x1800abf28)
- VirtualProtect (Address: 0x1800abf18)
- VirtualQuery (Address: 0x1800abf20)
api-ms-win-core-privateprofile-l1-1-0.dll
- GetPrivateProfileStringW (Address: 0x1800abf38)
api-ms-win-core-processenvironment-l1-1-0.dll
- ExpandEnvironmentStringsW (Address: 0x1800abf50)
- GetEnvironmentVariableW (Address: 0x1800abf48)
api-ms-win-core-processthreads-l1-1-0.dll
- CreateThread (Address: 0x1800abf88)
- GetCurrentProcess (Address: 0x1800abfa8)
- GetCurrentProcessId (Address: 0x1800abf68)
- GetCurrentThreadId (Address: 0x1800abfb0)
- SetProcessShutdownParameters (Address: 0x1800abf98)
- SetThreadStackGuarantee (Address: 0x1800abf60)
- TerminateProcess (Address: 0x1800abf78)
- TlsAlloc (Address: 0x1800abf90)
- TlsFree (Address: 0x1800abfa0)
- TlsGetValue (Address: 0x1800abf80)
- TlsSetValue (Address: 0x1800abf70)
api-ms-win-core-processthreads-l1-1-1.dll
- GetProcessMitigationPolicy (Address: 0x1800abfd0)
- IsProcessorFeaturePresent (Address: 0x1800abfc8)
- OpenProcess (Address: 0x1800abfc0)
api-ms-win-core-profile-l1-1-0.dll
- QueryPerformanceCounter (Address: 0x1800abfe0)
api-ms-win-core-psapi-l1-1-0.dll
- QueryFullProcessImageNameW (Address: 0x1800abff0)
api-ms-win-core-registry-l1-1-0.dll
- RegCloseKey (Address: 0x1800ac010)
- RegCreateKeyExA (Address: 0x1800ac060)
- RegCreateKeyExW (Address: 0x1800ac000)
- RegDeleteKeyExA (Address: 0x1800ac058)
- RegEnumValueW (Address: 0x1800ac030)
- RegGetValueW (Address: 0x1800ac028)
- RegLoadKeyW (Address: 0x1800ac040)
- RegNotifyChangeKeyValue (Address: 0x1800ac018)
- RegOpenKeyExA (Address: 0x1800ac048)
- RegOpenKeyExW (Address: 0x1800ac078)
- RegQueryInfoKeyA (Address: 0x1800ac050)
- RegQueryInfoKeyW (Address: 0x1800ac070)
- RegQueryValueExA (Address: 0x1800ac080)
- RegQueryValueExW (Address: 0x1800ac038)
- RegSetValueExA (Address: 0x1800ac020)
- RegSetValueExW (Address: 0x1800ac068)
- RegUnLoadKeyW (Address: 0x1800ac008)
api-ms-win-core-rtlsupport-l1-1-0.dll
- RtlCaptureContext (Address: 0x1800ac090)
- RtlCompareMemory (Address: 0x1800ac098)
- RtlLookupFunctionEntry (Address: 0x1800ac0a8)
- RtlVirtualUnwind (Address: 0x1800ac0a0)
api-ms-win-core-string-l1-1-0.dll
- CompareStringEx (Address: 0x1800ac0b8)
- CompareStringW (Address: 0x1800ac0c0)
- GetStringTypeW (Address: 0x1800ac0c8)
api-ms-win-core-string-obsolete-l1-1-0.dll
- lstrcmpiW (Address: 0x1800ac0d8)
api-ms-win-core-synch-l1-1-0.dll
- AcquireSRWLockExclusive (Address: 0x1800ac100)
- AcquireSRWLockShared (Address: 0x1800ac120)
- CreateEventW (Address: 0x1800ac160)
- CreateMutexExW (Address: 0x1800ac0f8)
- CreateSemaphoreExW (Address: 0x1800ac110)
- DeleteCriticalSection (Address: 0x1800ac128)
- EnterCriticalSection (Address: 0x1800ac170)
- InitializeCriticalSection (Address: 0x1800ac130)
- InitializeCriticalSectionEx (Address: 0x1800ac0f0)
- InitializeSRWLock (Address: 0x1800ac148)
- LeaveCriticalSection (Address: 0x1800ac150)
- OpenSemaphoreW (Address: 0x1800ac108)
- ReleaseMutex (Address: 0x1800ac158)
- ReleaseSemaphore (Address: 0x1800ac118)
- ReleaseSRWLockExclusive (Address: 0x1800ac168)
- ReleaseSRWLockShared (Address: 0x1800ac140)
- SleepEx (Address: 0x1800ac178)
- WaitForSingleObject (Address: 0x1800ac0e8)
- WaitForSingleObjectEx (Address: 0x1800ac138)
api-ms-win-core-synch-l1-2-0.dll
- InitOnceExecuteOnce (Address: 0x1800ac190)
- Sleep (Address: 0x1800ac188)
api-ms-win-core-sysinfo-l1-1-0.dll
- GetComputerNameExW (Address: 0x1800ac1a8)
- GetLocalTime (Address: 0x1800ac1c8)
- GetSystemDirectoryW (Address: 0x1800ac1c0)
- GetSystemInfo (Address: 0x1800ac1e0)
- GetSystemTimeAsFileTime (Address: 0x1800ac1d8)
- GetTickCount (Address: 0x1800ac1b8)
- GetTickCount64 (Address: 0x1800ac1a0)
- GetVersionExW (Address: 0x1800ac1b0)
- GetWindowsDirectoryW (Address: 0x1800ac1d0)
api-ms-win-core-sysinfo-l1-2-0.dll
- VerSetConditionMask (Address: 0x1800ac1f0)
api-ms-win-core-threadpool-l1-2-0.dll
- CloseThreadpoolTimer (Address: 0x1800ac200)
- CloseThreadpoolWork (Address: 0x1800ac228)
- CreateThreadpoolTimer (Address: 0x1800ac210)
- CreateThreadpoolWork (Address: 0x1800ac218)
- SetThreadpoolTimer (Address: 0x1800ac208)
- SubmitThreadpoolWork (Address: 0x1800ac220)
- WaitForThreadpoolTimerCallbacks (Address: 0x1800ac230)
api-ms-win-core-timezone-l1-1-0.dll
- FileTimeToSystemTime (Address: 0x1800ac240)
- GetTimeZoneInformation (Address: 0x1800ac248)
api-ms-win-crt-private-l1-1-0.dll
- __C_specific_handler (Address: 0x1800ac370)
- __CxxFrameHandler3 (Address: 0x1800ac300)
- _CxxThrowException (Address: 0x1800ac2f8)
- _o___std_exception_copy (Address: 0x1800ac360)
- _o___std_exception_destroy (Address: 0x1800ac358)
- _o___std_type_info_destroy_list (Address: 0x1800ac350)
- _o___stdio_common_vsprintf (Address: 0x1800ac348)
- _o___stdio_common_vswprintf (Address: 0x1800ac340)
- _o___stdio_common_vswprintf_s (Address: 0x1800ac338)
- _o__callnewh (Address: 0x1800ac330)
- _o__cexit (Address: 0x1800ac328)
- _o__configure_narrow_argv (Address: 0x1800ac320)
- _o__crt_atexit (Address: 0x1800ac318)
- _o__errno (Address: 0x1800ac310)
- _o__execute_onexit_table (Address: 0x1800ac308)
- _o__initialize_narrow_environment (Address: 0x1800ac258)
- _o__initialize_onexit_table (Address: 0x1800ac260)
- _o__invalid_parameter_noinfo (Address: 0x1800ac268)
- _o__purecall (Address: 0x1800ac270)
- _o__register_onexit_function (Address: 0x1800ac278)
- _o__seh_filter_dll (Address: 0x1800ac280)
- _o__ultow (Address: 0x1800ac288)
- _o__wcsicmp (Address: 0x1800ac290)
- _o__wcsnicmp (Address: 0x1800ac298)
- _o__wcsupr (Address: 0x1800ac2a0)
- _o__wtoi (Address: 0x1800ac2b0)
- _o_bsearch_s (Address: 0x1800ac2b8)
- _o_free (Address: 0x1800ac2c0)
- _o_malloc (Address: 0x1800ac2c8)
- _o_qsort_s (Address: 0x1800ac2d0)
- _o_wcscpy_s (Address: 0x1800ac2d8)
- _o_wcsncpy_s (Address: 0x1800ac2e0)
- _o_wcstok (Address: 0x1800ac2e8)
- _o_wcstoul (Address: 0x1800ac2f0)
- memcmp (Address: 0x1800ac378)
- memcpy (Address: 0x1800ac380)
- memmove (Address: 0x1800ac2a8)
- wcsstr (Address: 0x1800ac368)
api-ms-win-crt-runtime-l1-1-0.dll
- _initterm (Address: 0x1800ac398)
- _initterm_e (Address: 0x1800ac390)
api-ms-win-crt-string-l1-1-0.dll
- memset (Address: 0x1800ac3b8)
- wcscmp (Address: 0x1800ac3b0)
- wcscspn (Address: 0x1800ac3a8)
api-ms-win-eventing-classicprovider-l1-1-0.dll
- GetTraceEnableFlags (Address: 0x1800ac3f0)
- GetTraceEnableLevel (Address: 0x1800ac3d8)
- GetTraceLoggerHandle (Address: 0x1800ac3e8)
- RegisterTraceGuidsW (Address: 0x1800ac3d0)
- TraceMessage (Address: 0x1800ac3e0)
- UnregisterTraceGuids (Address: 0x1800ac3c8)
api-ms-win-eventing-controller-l1-1-0.dll
- ControlTraceW (Address: 0x1800ac400)
- EnableTraceEx2 (Address: 0x1800ac408)
- StartTraceW (Address: 0x1800ac410)
api-ms-win-eventing-provider-l1-1-0.dll
- EventWriteTransfer (Address: 0x1800ac420)
api-ms-win-security-base-l1-1-0.dll
- CheckTokenMembership (Address: 0x1800ac468)
- EqualSid (Address: 0x1800ac430)
- GetLengthSid (Address: 0x1800ac458)
- GetSecurityDescriptorDacl (Address: 0x1800ac460)
- GetSecurityDescriptorLength (Address: 0x1800ac440)
- ImpersonateLoggedOnUser (Address: 0x1800ac450)
- IsValidSid (Address: 0x1800ac438)
- RevertToSelf (Address: 0x1800ac448)
api-ms-win-security-lsalookup-l1-1-1.dll
- EnumerateIdentityProviders (Address: 0x1800ac490)
- GetIdentityProviderInfoByGUID (Address: 0x1800ac488)
- GetIdentityProviderInfoByName (Address: 0x1800ac478)
- ReleaseIdentityProviderEnumContext (Address: 0x1800ac480)
api-ms-win-service-management-l2-1-0.dll
- NotifyServiceStatusChangeW (Address: 0x1800ac4a0)
bcrypt.dll
- BCryptCloseAlgorithmProvider (Address: 0x1800ac4e0)
- BCryptCreateHash (Address: 0x1800ac500)
- BCryptDecrypt (Address: 0x1800ac4c0)
- BCryptDeriveKeyPBKDF2 (Address: 0x1800ac510)
- BCryptDestroyHash (Address: 0x1800ac4e8)
- BCryptDestroyKey (Address: 0x1800ac518)
- BCryptEncrypt (Address: 0x1800ac4b0)
- BCryptFinishHash (Address: 0x1800ac4d8)
- BCryptGenerateSymmetricKey (Address: 0x1800ac508)
- BCryptGenRandom (Address: 0x1800ac4d0)
- BCryptGetProperty (Address: 0x1800ac4b8)
- BCryptHashData (Address: 0x1800ac4f0)
- BCryptOpenAlgorithmProvider (Address: 0x1800ac4c8)
- BCryptSetProperty (Address: 0x1800ac4f8)
CRYPT32.dll
- CertCloseStore (Address: 0x1800abc70)
- CertDuplicateCertificateContext (Address: 0x1800abc90)
- CertFindCertificateInStore (Address: 0x1800abc68)
- CertFindExtension (Address: 0x1800abc88)
- CertFreeCertificateContext (Address: 0x1800abc50)
- CertGetCertificateContextProperty (Address: 0x1800abc58)
- CertOpenStore (Address: 0x1800abc60)
- CryptBinaryToStringW (Address: 0x1800abc80)
- CryptDecodeObjectEx (Address: 0x1800abc78)
LSASRV.dll
- LsaIAdtAuditingEnabledByCategory (Address: 0x1800abce8)
- LsaIAuditNotifyPackageLoad (Address: 0x1800abcc0)
- LsaIAuditSamEvent (Address: 0x1800abcd8)
- LsaIChangeSecretCipherKey (Address: 0x1800abd10)
- LsaIFree_LSAPR_POLICY_INFORMATION (Address: 0x1800abcd0)
- LsaIHealthCheck (Address: 0x1800abd18)
- LsaILookupWellKnownName (Address: 0x1800abd38)
- LsaINoConnectedUserPolicy (Address: 0x1800abcb8)
- LsaINotifyChangeNotification (Address: 0x1800abcb0)
- LsaIOpenPolicyTrusted (Address: 0x1800abcf0)
- LsaIQueryInformationPolicyTrusted (Address: 0x1800abca0)
- LsaIRegisterNotification (Address: 0x1800abd08)
- LsaIRegisterPolicyChangeNotificationCallback (Address: 0x1800abce0)
- LsaIRetrieveCurrentUserSid (Address: 0x1800abcf8)
- LsaISafeMode (Address: 0x1800abcc8)
- LsaISamIndicatedDsStarted (Address: 0x1800abca8)
- LsaISetNewSyskey (Address: 0x1800abd00)
- LsarClose (Address: 0x1800abd28)
- LsarQueryDomainInformationPolicy (Address: 0x1800abd30)
- LsarQueryInformationPolicy (Address: 0x1800abd40)
- LsarSetInformationPolicy (Address: 0x1800abd20)
ntdll.dll
- DbgPrint (Address: 0x1800ac798)
- EtwEventRegister (Address: 0x1800aca10)
- EtwEventUnregister (Address: 0x1800aca20)
- EtwEventWrite (Address: 0x1800aca18)
- EtwGetTraceEnableFlags (Address: 0x1800ac658)
- EtwGetTraceEnableLevel (Address: 0x1800ac540)
- EtwGetTraceLoggerHandle (Address: 0x1800ac528)
- EtwLogTraceEvent (Address: 0x1800ac608)
- EtwRegisterTraceGuidsW (Address: 0x1800ac548)
- EtwTraceMessage (Address: 0x1800ac9c8)
- EtwUnregisterTraceGuids (Address: 0x1800ac5f8)
- LdrGetProcedureAddress (Address: 0x1800ac6d0)
- LdrUnloadDll (Address: 0x1800ac6c0)
- NtAccessCheck (Address: 0x1800ac618)
- NtAccessCheckAndAuditAlarm (Address: 0x1800ac728)
- NtAdjustPrivilegesToken (Address: 0x1800ac550)
- NtAllocateLocallyUniqueId (Address: 0x1800ac530)
- NtClose (Address: 0x1800ac958)
- NtCloseObjectAuditAlarm (Address: 0x1800ac770)
- NtCreateEvent (Address: 0x1800ac9e8)
- NtCreateToken (Address: 0x1800ac7f8)
- NtDelayExecution (Address: 0x1800ac978)
- NtDeleteKey (Address: 0x1800ac5e0)
- NtDeleteObjectAuditAlarm (Address: 0x1800ac570)
- NtDeleteValueKey (Address: 0x1800ac648)
- NtDuplicateObject (Address: 0x1800ac690)
- NtEnumerateKey (Address: 0x1800ac5c8)
- NtFlushKey (Address: 0x1800ac838)
- NtImpersonateAnonymousToken (Address: 0x1800ac750)
- NtOpenKey (Address: 0x1800ac5c0)
- NtOpenProcess (Address: 0x1800ac6b8)
- NtOpenProcessToken (Address: 0x1800ac538)
- NtOpenThread (Address: 0x1800ac808)
- NtOpenThreadToken (Address: 0x1800ac5d8)
- NtPrivilegeCheck (Address: 0x1800ac5d0)
- NtPrivilegedServiceAuditAlarm (Address: 0x1800ac968)
- NtQueryInformationToken (Address: 0x1800ac708)
- NtQueryKey (Address: 0x1800ac5e8)
- NtQueryObject (Address: 0x1800ac9f0)
- NtQuerySystemTime (Address: 0x1800ac8f8)
- NtQueryValueKey (Address: 0x1800ac8c0)
- NtRaiseHardError (Address: 0x1800ac588)
- NtRestoreKey (Address: 0x1800ac9f8)
- NtSetEvent (Address: 0x1800ac670)
- NtSetInformationThread (Address: 0x1800ac830)
- NtSetValueKey (Address: 0x1800ac590)
- RtlAbortRXact (Address: 0x1800ac6f8)
- RtlAbsoluteToSelfRelativeSD (Address: 0x1800ac818)
- RtlAcquireResourceExclusive (Address: 0x1800ac680)
- RtlAcquireResourceShared (Address: 0x1800ac6a8)
- RtlAddAccessAllowedAce (Address: 0x1800ac820)
- RtlAddAccessDeniedAce (Address: 0x1800ac598)
- RtlAddAce (Address: 0x1800ac5b0)
- RtlAddActionToRXact (Address: 0x1800ac9b0)
- RtlAddAttributeActionToRXact (Address: 0x1800ac8c8)
- RtlAddAuditAccessAce (Address: 0x1800ac7d8)
- RtlAdjustPrivilege (Address: 0x1800ac5a8)
- RtlAllocateAndInitializeSid (Address: 0x1800ac5b8)
- RtlAllocateHeap (Address: 0x1800ac8e0)
- RtlAnsiStringToUnicodeString (Address: 0x1800ac6c8)
- RtlAppendUnicodeStringToString (Address: 0x1800ac890)
- RtlAppendUnicodeToString (Address: 0x1800ac870)
- RtlApplyRXactNoFlush (Address: 0x1800ac790)
- RtlAreAllAccessesGranted (Address: 0x1800ac760)
- RtlCheckTokenCapability (Address: 0x1800ac7b0)
- RtlCheckTokenMembershipEx (Address: 0x1800ac9d8)
- RtlClearAllBits (Address: 0x1800ac8b8)
- RtlCompareString (Address: 0x1800ac678)
- RtlCompareUnicodeString (Address: 0x1800ac9d0)
- RtlCompareUnicodeStrings (Address: 0x1800ac910)
- RtlConvertSidToUnicodeString (Address: 0x1800ac858)
- RtlCopySecurityDescriptor (Address: 0x1800ac638)
- RtlCopySid (Address: 0x1800ac940)
- RtlCopyUnicodeString (Address: 0x1800ac928)
- RtlCreateAcl (Address: 0x1800ac7d0)
- RtlCreateAndSetSD (Address: 0x1800ac730)
- RtlCreateSecurityDescriptor (Address: 0x1800ac7c0)
- RtlCreateUnicodeString (Address: 0x1800ac710)
- RtlCreateUnicodeStringFromAsciiz (Address: 0x1800aca00)
- RtlDecompressBufferEx (Address: 0x1800ac778)
- RtlDeleteResource (Address: 0x1800ac6b0)
- RtlDeleteSecurityObject (Address: 0x1800ac720)
- RtlDnsHostNameToComputerName (Address: 0x1800ac578)
- RtlDuplicateUnicodeString (Address: 0x1800ac718)
- RtlEnterCriticalSection (Address: 0x1800ac918)
- RtlEqualComputerName (Address: 0x1800ac7b8)
- RtlEqualDomainName (Address: 0x1800ac908)
- RtlEqualSid (Address: 0x1800ac938)
- RtlEqualUnicodeString (Address: 0x1800ac758)
- RtlFindMessage (Address: 0x1800ac810)
- RtlFreeAnsiString (Address: 0x1800ac580)
- RtlFreeHeap (Address: 0x1800ac8d8)
- RtlFreeSid (Address: 0x1800ac5f0)
- RtlFreeUnicodeString (Address: 0x1800ac848)
- RtlGetAce (Address: 0x1800ac850)
- RtlGetCompressionWorkSpaceSize (Address: 0x1800ac780)
- RtlGetDaclSecurityDescriptor (Address: 0x1800ac788)
- RtlGetGroupSecurityDescriptor (Address: 0x1800ac9a0)
- RtlGetNtProductType (Address: 0x1800ac840)
- RtlGetOwnerSecurityDescriptor (Address: 0x1800ac660)
- RtlGetProductInfo (Address: 0x1800ac600)
- RtlGetSaclSecurityDescriptor (Address: 0x1800ac640)
- RtlGetSuiteMask (Address: 0x1800ac950)
- RtlIdentifierAuthoritySid (Address: 0x1800ac700)
- RtlImageNtHeader (Address: 0x1800ac7a8)
- RtlInitializeBitMap (Address: 0x1800ac768)
- RtlInitializeCriticalSection (Address: 0x1800ac6f0)
- RtlInitializeCriticalSectionAndSpinCount (Address: 0x1800ac930)
- RtlInitializeGenericTableAvl (Address: 0x1800ac988)
- RtlInitializeResource (Address: 0x1800ac688)
- RtlInitializeRXact (Address: 0x1800ac8a8)
- RtlInitializeSid (Address: 0x1800ac898)
- RtlInitString (Address: 0x1800ac748)
- RtlInitUnicodeString (Address: 0x1800ac9c0)
- RtlInitUnicodeStringEx (Address: 0x1800ac698)
- RtlInsertElementGenericTableAvl (Address: 0x1800ac990)
- RtlIntegerToUnicodeString (Address: 0x1800ac8e8)
- RtlIsMultiSessionSku (Address: 0x1800ac740)
- RtlLeaveCriticalSection (Address: 0x1800ac900)
- RtlLengthRequiredSid (Address: 0x1800ac920)
- RtlLengthSecurityDescriptor (Address: 0x1800ac620)
- RtlLengthSid (Address: 0x1800ac960)
- RtlLookupElementGenericTableAvl (Address: 0x1800ac998)
- RtlMakeSelfRelativeSD (Address: 0x1800ac628)
- RtlMapGenericMask (Address: 0x1800ac880)
- RtlNtStatusToDosError (Address: 0x1800ac6e0)
- RtlNtStatusToDosErrorNoTeb (Address: 0x1800ac568)
- RtlOemStringToUnicodeString (Address: 0x1800ac800)
- RtlpNtCreateKey (Address: 0x1800ac888)
- RtlpNtEnumerateSubKey (Address: 0x1800ac738)
- RtlpNtOpenKey (Address: 0x1800ac980)
- RtlpNtQueryValueKey (Address: 0x1800ac948)
- RtlpNtSetValueKey (Address: 0x1800ac860)
- RtlQueryInformationAcl (Address: 0x1800ac650)
- RtlQueryRegistryValuesEx (Address: 0x1800ac6d8)
- RtlReleaseResource (Address: 0x1800ac6a0)
- RtlSetAllBits (Address: 0x1800ac8f0)
- RtlSetBits (Address: 0x1800ac8d0)
- RtlSetDaclSecurityDescriptor (Address: 0x1800ac868)
- RtlSetGroupSecurityDescriptor (Address: 0x1800ac7c8)
- RtlSetOwnerSecurityDescriptor (Address: 0x1800ac8a0)
- RtlSetSaclSecurityDescriptor (Address: 0x1800ac8b0)
- RtlSetSecurityObject (Address: 0x1800ac5a0)
- RtlStartRXact (Address: 0x1800ac7e0)
- RtlStringFromGUID (Address: 0x1800ac9a8)
- RtlSubAuthorityCountSid (Address: 0x1800ac828)
- RtlSubAuthoritySid (Address: 0x1800ac878)
- RtlSubscribeWnfStateChangeNotification (Address: 0x1800ac560)
- RtlTimeToTimeFields (Address: 0x1800ac6e8)
- RtlUnicodeStringToAnsiString (Address: 0x1800ac7e8)
- RtlUnicodeStringToInteger (Address: 0x1800ac9b8)
- RtlUnicodeToOemN (Address: 0x1800aca08)
- RtlUnsubscribeWnfNotificationWaitForCompletion (Address: 0x1800ac558)
- RtlUpcaseUnicodeStringToOemString (Address: 0x1800ac7f0)
- RtlValidAcl (Address: 0x1800ac610)
- RtlValidateUnicodeString (Address: 0x1800ac668)
- RtlValidRelativeSecurityDescriptor (Address: 0x1800ac630)
- RtlValidSid (Address: 0x1800ac9e0)
- RtlVerifyVersionInfo (Address: 0x1800ac970)
- RtlxUnicodeStringToOemSize (Address: 0x1800aca28)
- wcsncmp (Address: 0x1800ac7a0)