sdrsvc.dll

Description: Microsoft® Windows Backup Service

Version: 10.0.19041.3636

Architecture: 64-bit

Operating System: Windows NT

SHA256: b7a90e20800f68a27a462a0575978832

File Size: 152.0 KB

Uploaded At: Dec. 1, 2025, 7:38 a.m.

Views: 4

Exported Functions

DllCanUnloadNow (Ordinal: 1, Address: 0x1560)
DllGetClassObject (Ordinal: 2, Address: 0x1580)
DllRegisterServer (Ordinal: 3, Address: 0x15a0)
DllUnregisterServer (Ordinal: 4, Address: 0x1630)
ServiceMain (Ordinal: 5, Address: 0x16a0)

Imported DLLs & Functions

api-ms-win-core-delayload-l1-1-0.dll

DelayLoadFailureHook (Address: 0x18001c788)

api-ms-win-core-delayload-l1-1-1.dll

ResolveDelayLoadedAPI (Address: 0x18001c798)

api-ms-win-core-errorhandling-l1-1-0.dll

GetLastError (Address: 0x18001c7a8)
SetLastError (Address: 0x18001c7b0)
SetUnhandledExceptionFilter (Address: 0x18001c7c0)
UnhandledExceptionFilter (Address: 0x18001c7b8)

api-ms-win-core-file-l1-1-0.dll

CreateDirectoryW (Address: 0x18001c7d8)
CreateFileW (Address: 0x18001c7e8)
DeleteFileW (Address: 0x18001c810)
FindClose (Address: 0x18001c7f8)
FindFirstFileW (Address: 0x18001c7f0)
FindNextFileW (Address: 0x18001c800)
GetFileAttributesW (Address: 0x18001c7e0)
RemoveDirectoryW (Address: 0x18001c808)
WriteFile (Address: 0x18001c7d0)

api-ms-win-core-file-l2-1-0.dll

MoveFileExW (Address: 0x18001c820)

api-ms-win-core-handle-l1-1-0.dll

CloseHandle (Address: 0x18001c830)

api-ms-win-core-heap-l1-1-0.dll

HeapDestroy (Address: 0x18001c840)

api-ms-win-core-heap-l2-1-0.dll

LocalAlloc (Address: 0x18001c850)
LocalFree (Address: 0x18001c858)

api-ms-win-core-interlocked-l1-1-0.dll

InitializeSListHead (Address: 0x18001c868)
InterlockedPopEntrySList (Address: 0x18001c878)
InterlockedPushEntrySList (Address: 0x18001c870)

api-ms-win-core-io-l1-1-0.dll

DeviceIoControl (Address: 0x18001c888)

api-ms-win-core-kernel32-legacy-l1-1-0.dll

GetComputerNameW (Address: 0x18001c898)

api-ms-win-core-libraryloader-l1-2-0.dll

FindResourceExW (Address: 0x18001c8b8)
FreeLibrary (Address: 0x18001c8c0)
GetModuleFileNameW (Address: 0x18001c8c8)
GetModuleHandleW (Address: 0x18001c8d0)
GetProcAddress (Address: 0x18001c8e8)
LoadLibraryExW (Address: 0x18001c8d8)
LoadResource (Address: 0x18001c8a8)
LoadStringW (Address: 0x18001c8b0)
SizeofResource (Address: 0x18001c8e0)

api-ms-win-core-localization-l1-2-0.dll

FormatMessageW (Address: 0x18001c8f8)

api-ms-win-core-memory-l1-1-0.dll

VirtualAlloc (Address: 0x18001c910)
VirtualProtect (Address: 0x18001c908)
VirtualQuery (Address: 0x18001c918)

api-ms-win-core-processenvironment-l1-1-0.dll

ExpandEnvironmentStringsW (Address: 0x18001c928)

api-ms-win-core-processthreads-l1-1-0.dll

GetCurrentProcess (Address: 0x18001c948)
GetCurrentProcessId (Address: 0x18001c938)
GetCurrentThread (Address: 0x18001c970)
GetCurrentThreadId (Address: 0x18001c968)
OpenProcessToken (Address: 0x18001c950)
OpenThreadToken (Address: 0x18001c960)
SetThreadToken (Address: 0x18001c958)
TerminateProcess (Address: 0x18001c940)

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter (Address: 0x18001c980)

api-ms-win-core-registry-l1-1-0.dll

RegCloseKey (Address: 0x18001c9c8)
RegCreateKeyExW (Address: 0x18001c9d8)
RegDeleteValueW (Address: 0x18001c9e0)
RegEnumKeyExW (Address: 0x18001c9b8)
RegEnumValueW (Address: 0x18001c9b0)
RegLoadKeyW (Address: 0x18001c9a8)
RegOpenKeyExW (Address: 0x18001c990)
RegQueryInfoKeyW (Address: 0x18001c9c0)
RegQueryValueExW (Address: 0x18001c998)
RegSetValueExW (Address: 0x18001c9d0)
RegUnLoadKeyW (Address: 0x18001c9a0)

api-ms-win-core-registry-l2-1-0.dll

RegDeleteKeyW (Address: 0x18001c9f0)

api-ms-win-core-rtlsupport-l1-1-0.dll

RtlCaptureContext (Address: 0x18001ca00)
RtlCaptureStackBackTrace (Address: 0x18001ca08)
RtlLookupFunctionEntry (Address: 0x18001ca18)
RtlVirtualUnwind (Address: 0x18001ca10)

api-ms-win-core-string-l1-1-0.dll

MultiByteToWideChar (Address: 0x18001ca28)

api-ms-win-core-string-l2-1-0.dll

CharNextW (Address: 0x18001ca40)
CharPrevW (Address: 0x18001ca38)

api-ms-win-core-string-obsolete-l1-1-0.dll

lstrcmpiW (Address: 0x18001ca50)
lstrcpynW (Address: 0x18001ca58)

api-ms-win-core-synch-l1-1-0.dll

AcquireSRWLockExclusive (Address: 0x18001ca78)
DeleteCriticalSection (Address: 0x18001ca90)
EnterCriticalSection (Address: 0x18001caa8)
InitializeCriticalSection (Address: 0x18001ca80)
InitializeCriticalSectionAndSpinCount (Address: 0x18001ca98)
InitializeSRWLock (Address: 0x18001ca70)
LeaveCriticalSection (Address: 0x18001caa0)
ReleaseSRWLockExclusive (Address: 0x18001ca88)
SetWaitableTimer (Address: 0x18001cab0)
WaitForSingleObject (Address: 0x18001ca68)

api-ms-win-core-synch-l1-2-0.dll

InitializeConditionVariable (Address: 0x18001cad8)
Sleep (Address: 0x18001cac8)
SleepConditionVariableCS (Address: 0x18001cac0)
WakeAllConditionVariable (Address: 0x18001cad0)

api-ms-win-core-synch-l1-2-1.dll

CreateWaitableTimerW (Address: 0x18001cae8)

api-ms-win-core-sysinfo-l1-1-0.dll

GetSystemDirectoryW (Address: 0x18001caf8)
GetSystemInfo (Address: 0x18001cb08)
GetSystemTimeAsFileTime (Address: 0x18001cb00)
GetTickCount (Address: 0x18001cb10)

api-ms-win-eventing-classicprovider-l1-1-0.dll

GetTraceEnableFlags (Address: 0x18001cb48)
GetTraceEnableLevel (Address: 0x18001cb38)
GetTraceLoggerHandle (Address: 0x18001cb40)
RegisterTraceGuidsW (Address: 0x18001cb30)
TraceMessage (Address: 0x18001cb20)
UnregisterTraceGuids (Address: 0x18001cb28)

api-ms-win-eventing-controller-l1-1-0.dll

ControlTraceW (Address: 0x18001cb60)
EnableTraceEx2 (Address: 0x18001cb68)
StartTraceW (Address: 0x18001cb58)

api-ms-win-eventlog-legacy-l1-1-0.dll

DeregisterEventSource (Address: 0x18001cb88)
RegisterEventSourceW (Address: 0x18001cb80)
ReportEventW (Address: 0x18001cb78)

api-ms-win-security-base-l1-1-0.dll

AdjustTokenPrivileges (Address: 0x18001cbf0)
CheckTokenMembership (Address: 0x18001cbc0)
CreateWellKnownSid (Address: 0x18001cba0)
DuplicateToken (Address: 0x18001cbc8)
DuplicateTokenEx (Address: 0x18001cbb0)
EqualSid (Address: 0x18001cbb8)
GetTokenInformation (Address: 0x18001cbf8)
ImpersonateLoggedOnUser (Address: 0x18001cb98)
InitializeSecurityDescriptor (Address: 0x18001cbd8)
RevertToSelf (Address: 0x18001cbd0)
SetSecurityDescriptorDacl (Address: 0x18001cbe8)
SetSecurityDescriptorGroup (Address: 0x18001cbe0)
SetSecurityDescriptorOwner (Address: 0x18001cba8)

api-ms-win-security-logon-l1-1-0.dll

LogonUserExW (Address: 0x18001cc08)

api-ms-win-security-lsalookup-l2-1-0.dll

LookupAccountSidW (Address: 0x18001cc20)
LookupPrivilegeValueW (Address: 0x18001cc18)

api-ms-win-security-provider-l1-1-0.dll

SetEntriesInAclW (Address: 0x18001cc30)

api-ms-win-security-sddl-l1-1-0.dll

ConvertStringSecurityDescriptorToSecurityDescriptorW (Address: 0x18001cc40)

api-ms-win-service-core-l1-1-0.dll

RegisterServiceCtrlHandlerExW (Address: 0x18001cc58)
SetServiceStatus (Address: 0x18001cc50)

api-ms-win-service-management-l1-1-0.dll

CloseServiceHandle (Address: 0x18001cc70)
CreateServiceW (Address: 0x18001cc88)
DeleteService (Address: 0x18001cc80)
OpenSCManagerW (Address: 0x18001cc68)
OpenServiceW (Address: 0x18001cc78)

api-ms-win-service-management-l2-1-0.dll

ChangeServiceConfig2W (Address: 0x18001cc98)

api-ms-win-shell-shellcom-l1-1-0.dll

SHCoCreateInstance (Address: 0x18001cca8)

msvcrt.dll

__C_specific_handler (Address: 0x18001cd18)
__dllonexit (Address: 0x18001ccd0)
_amsg_exit (Address: 0x18001ccc8)
_callnewh (Address: 0x18001ccf8)
_initterm (Address: 0x18001cd10)
_lock (Address: 0x18001cce0)
_onexit (Address: 0x18001ccd8)
_purecall (Address: 0x18001cd08)
_unlock (Address: 0x18001ccb8)
_vscwprintf (Address: 0x18001cd30)
_vsnwprintf (Address: 0x18001cd58)
_wcsicmp (Address: 0x18001cd00)
_wcsupr (Address: 0x18001cd40)
_XcptFilter (Address: 0x18001ccf0)
free (Address: 0x18001cd78)
iswspace (Address: 0x18001cd28)
malloc (Address: 0x18001cd70)
memcmp (Address: 0x18001cce8)
memcpy (Address: 0x18001ccc0)
memmove (Address: 0x18001cd80)
memset (Address: 0x18001cd88)
realloc (Address: 0x18001cd20)
strchr (Address: 0x18001cd38)
wcscat_s (Address: 0x18001cd68)
wcschr (Address: 0x18001cd60)
wcsncmp (Address: 0x18001cd50)
wcsrchr (Address: 0x18001cd48)

ntdll.dll

EtwTraceMessage (Address: 0x18001cdd8)
NtQueryInformationFile (Address: 0x18001cdd0)
NtQueryKey (Address: 0x18001cdc0)
NtQueryVolumeInformationFile (Address: 0x18001cdc8)
NtSetInformationFile (Address: 0x18001cd98)
NtSetInformationKey (Address: 0x18001cdb8)
NtSetInformationProcess (Address: 0x18001cda8)
NtSetThreadExecutionState (Address: 0x18001cde8)
RtlAllocateHeap (Address: 0x18001cdf8)
RtlFreeHeap (Address: 0x18001cdf0)
RtlGetLastNtStatus (Address: 0x18001cda0)
RtlNtStatusToDosError (Address: 0x18001cdb0)
WinSqmAddToStream (Address: 0x18001cde0)

SXSHARED.dll

SxTracerDebuggerBreak (Address: 0x18001c778)
SxTracerGetThreadContextRetail (Address: 0x18001c768)
SxTracerShouldTrackFailure (Address: 0x18001c770)