SEMgrSvc.dll

Description: NFC SEManagement Service DLL

Authors: © Microsoft Corporation. All rights reserved.

Version: 10.0.19041.6033

Architecture: 64-bit

Operating System: Windows NT

SHA256: 71a98dd626d5ec2cf3d8447b063b53ae

File Size: 1.2 MB

Uploaded At: Dec. 1, 2025, 7:38 a.m.

Views: 3

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

  • SvchostPushServiceGlobals (Ordinal: 1, Address: 0xcac0)
  • DllCanUnloadNow (Ordinal: 2, Address: 0xd000)
  • DllGetClassObject (Ordinal: 3, Address: 0xcff0)
  • LaunchModernNfcEventSession (Ordinal: 4, Address: 0xce00)
  • ServiceMain (Ordinal: 5, Address: 0xcb30)

Imported DLLs & Functions

api-ms-win-appmodel-runtime-l1-1-0.dll
  • PackageFamilyNameFromFullName (Address: 0x18009b950)
api-ms-win-appmodel-runtime-l1-1-1.dll
  • GetPackageFullNameFromToken (Address: 0x18009b960)
api-ms-win-core-apiquery-l1-1-0.dll
  • ApiSetQueryApiSetPresence (Address: 0x18009b970)
api-ms-win-core-bicltapi-l1-1-5.dll
  • BiQuerySystemStateBroadcastChannels (Address: 0x18009b980)
api-ms-win-core-com-l1-1-0.dll
  • CLSIDFromString (Address: 0x18009b9c8)
  • CoCreateFreeThreadedMarshaler (Address: 0x18009b998)
  • CoCreateGuid (Address: 0x18009ba10)
  • CoCreateInstance (Address: 0x18009b9d0)
  • CoDisconnectContext (Address: 0x18009b9d8)
  • CoFreeUnusedLibrariesEx (Address: 0x18009b9f0)
  • CoGetInterfaceAndReleaseStream (Address: 0x18009ba20)
  • CoGetMalloc (Address: 0x18009ba00)
  • CoImpersonateClient (Address: 0x18009ba08)
  • CoInitializeEx (Address: 0x18009b9b8)
  • CoMarshalInterface (Address: 0x18009ba18)
  • CoRegisterClassObject (Address: 0x18009b990)
  • CoReleaseMarshalData (Address: 0x18009ba28)
  • CoResumeClassObjects (Address: 0x18009ba38)
  • CoRevertToSelf (Address: 0x18009b9b0)
  • CoRevokeClassObject (Address: 0x18009b9c0)
  • CoTaskMemAlloc (Address: 0x18009b9f8)
  • CoTaskMemFree (Address: 0x18009b9e0)
  • CoUninitialize (Address: 0x18009b9e8)
  • CoWaitForMultipleHandles (Address: 0x18009b9a0)
  • CreateStreamOnHGlobal (Address: 0x18009ba30)
  • StringFromGUID2 (Address: 0x18009b9a8)
api-ms-win-core-com-l1-1-1.dll
  • RoGetAgileReference (Address: 0x18009ba48)
api-ms-win-core-debug-l1-1-0.dll
  • DebugBreak (Address: 0x18009ba60)
  • IsDebuggerPresent (Address: 0x18009ba58)
  • OutputDebugStringW (Address: 0x18009ba68)
api-ms-win-core-delayload-l1-1-0.dll
  • DelayLoadFailureHook (Address: 0x18009ba78)
api-ms-win-core-delayload-l1-1-1.dll
  • ResolveDelayLoadedAPI (Address: 0x18009ba88)
api-ms-win-core-errorhandling-l1-1-0.dll
  • GetLastError (Address: 0x18009baa0)
  • RaiseException (Address: 0x18009baa8)
  • SetLastError (Address: 0x18009ba98)
  • SetUnhandledExceptionFilter (Address: 0x18009bab0)
  • UnhandledExceptionFilter (Address: 0x18009bab8)
api-ms-win-core-file-l1-1-0.dll
  • CompareFileTime (Address: 0x18009bb28)
  • CreateDirectoryW (Address: 0x18009bb08)
  • CreateFileW (Address: 0x18009baf8)
  • DeleteFileW (Address: 0x18009bad8)
  • FindClose (Address: 0x18009bae8)
  • FindFirstFileW (Address: 0x18009bb10)
  • FindNextFileW (Address: 0x18009bac8)
  • GetFileAttributesW (Address: 0x18009bb18)
  • GetFileSizeEx (Address: 0x18009bb00)
  • GetFileTime (Address: 0x18009bb20)
  • GetFullPathNameW (Address: 0x18009bae0)
  • ReadFile (Address: 0x18009bad0)
  • RemoveDirectoryW (Address: 0x18009baf0)
  • WriteFile (Address: 0x18009bb30)
api-ms-win-core-file-l2-1-0.dll
  • GetFileInformationByHandleEx (Address: 0x18009bb40)
api-ms-win-core-handle-l1-1-0.dll
  • CloseHandle (Address: 0x18009bb50)
api-ms-win-core-heap-l1-1-0.dll
  • GetProcessHeap (Address: 0x18009bb60)
  • HeapAlloc (Address: 0x18009bb70)
  • HeapFree (Address: 0x18009bb68)
api-ms-win-core-heap-l2-1-0.dll
  • LocalAlloc (Address: 0x18009bb80)
  • LocalFree (Address: 0x18009bb88)
api-ms-win-core-interlocked-l1-1-0.dll
  • InitializeSListHead (Address: 0x18009bb98)
api-ms-win-core-io-l1-1-0.dll
  • CancelIoEx (Address: 0x18009bbb0)
  • DeviceIoControl (Address: 0x18009bbb8)
  • GetOverlappedResult (Address: 0x18009bba8)
api-ms-win-core-kernel32-legacy-l1-1-5.dll
  • SetThreadExecutionState (Address: 0x18009bbc8)
api-ms-win-core-libraryloader-l1-2-0.dll
  • DisableThreadLibraryCalls (Address: 0x18009bbe8)
  • FindStringOrdinal (Address: 0x18009bbf8)
  • FreeLibrary (Address: 0x18009bc08)
  • GetModuleFileNameA (Address: 0x18009bc10)
  • GetModuleFileNameW (Address: 0x18009bbf0)
  • GetModuleHandleExW (Address: 0x18009bbd8)
  • GetModuleHandleW (Address: 0x18009bc18)
  • GetProcAddress (Address: 0x18009bbe0)
  • LoadLibraryExW (Address: 0x18009bc00)
api-ms-win-core-localization-l1-2-0.dll
  • FormatMessageW (Address: 0x18009bc28)
api-ms-win-core-path-l1-1-0.dll
  • PathAllocCombine (Address: 0x18009bc40)
  • PathCchSkipRoot (Address: 0x18009bc38)
api-ms-win-core-processthreads-l1-1-0.dll
  • GetCurrentProcess (Address: 0x18009bc58)
  • GetCurrentProcessId (Address: 0x18009bc60)
  • GetCurrentThread (Address: 0x18009bc78)
  • GetCurrentThreadId (Address: 0x18009bc80)
  • OpenProcessToken (Address: 0x18009bc50)
  • OpenThreadToken (Address: 0x18009bc70)
  • TerminateProcess (Address: 0x18009bc68)
api-ms-win-core-processthreads-l1-1-1.dll
  • IsProcessorFeaturePresent (Address: 0x18009bc98)
  • OpenProcess (Address: 0x18009bc90)
api-ms-win-core-profile-l1-1-0.dll
  • QueryPerformanceCounter (Address: 0x18009bca8)
api-ms-win-core-registry-l1-1-0.dll
  • RegCloseKey (Address: 0x18009bcc0)
  • RegCreateKeyExW (Address: 0x18009bcf0)
  • RegDeleteTreeW (Address: 0x18009bcf8)
  • RegEnumKeyExW (Address: 0x18009bcd8)
  • RegGetValueW (Address: 0x18009bcb8)
  • RegOpenKeyExW (Address: 0x18009bce8)
  • RegQueryInfoKeyW (Address: 0x18009bce0)
  • RegQueryValueExW (Address: 0x18009bcc8)
  • RegSetValueExW (Address: 0x18009bcd0)
api-ms-win-core-registry-l2-1-0.dll
  • RegDeleteKeyW (Address: 0x18009bd08)
api-ms-win-core-rtlsupport-l1-1-0.dll
  • RtlCaptureContext (Address: 0x18009bd20)
  • RtlLookupFunctionEntry (Address: 0x18009bd28)
  • RtlVirtualUnwind (Address: 0x18009bd18)
api-ms-win-core-shlwapi-legacy-l1-1-0.dll
  • PathFileExistsW (Address: 0x18009bd38)
api-ms-win-core-shlwapi-obsolete-l1-1-0.dll
  • StrCmpCW (Address: 0x18009bd48)
api-ms-win-core-string-l1-1-0.dll
  • CompareStringOrdinal (Address: 0x18009bd58)
  • WideCharToMultiByte (Address: 0x18009bd60)
api-ms-win-core-synch-l1-1-0.dll
  • AcquireSRWLockExclusive (Address: 0x18009bdb0)
  • AcquireSRWLockShared (Address: 0x18009bde8)
  • CreateEventExW (Address: 0x18009be10)
  • CreateEventW (Address: 0x18009bdc8)
  • CreateMutexExW (Address: 0x18009be18)
  • CreateSemaphoreExW (Address: 0x18009bde0)
  • DeleteCriticalSection (Address: 0x18009be08)
  • EnterCriticalSection (Address: 0x18009bdf0)
  • InitializeCriticalSection (Address: 0x18009be00)
  • InitializeCriticalSectionAndSpinCount (Address: 0x18009bd98)
  • InitializeCriticalSectionEx (Address: 0x18009bd78)
  • LeaveCriticalSection (Address: 0x18009bdf8)
  • OpenSemaphoreW (Address: 0x18009bdc0)
  • ReleaseMutex (Address: 0x18009bd88)
  • ReleaseSemaphore (Address: 0x18009bdd8)
  • ReleaseSRWLockExclusive (Address: 0x18009bda8)
  • ReleaseSRWLockShared (Address: 0x18009bdd0)
  • ResetEvent (Address: 0x18009bd80)
  • SetEvent (Address: 0x18009bda0)
  • TryEnterCriticalSection (Address: 0x18009bd90)
  • WaitForSingleObject (Address: 0x18009bd70)
  • WaitForSingleObjectEx (Address: 0x18009bdb8)
api-ms-win-core-synch-l1-2-0.dll
  • InitOnceBeginInitialize (Address: 0x18009be58)
  • InitOnceComplete (Address: 0x18009be28)
  • InitOnceExecuteOnce (Address: 0x18009be48)
  • Sleep (Address: 0x18009be60)
  • SleepConditionVariableSRW (Address: 0x18009be30)
  • WaitOnAddress (Address: 0x18009be40)
  • WakeAllConditionVariable (Address: 0x18009be50)
  • WakeByAddressAll (Address: 0x18009be38)
api-ms-win-core-sysinfo-l1-1-0.dll
  • GetLocalTime (Address: 0x18009be80)
  • GetSystemDirectoryW (Address: 0x18009be90)
  • GetSystemTimeAsFileTime (Address: 0x18009be88)
  • GetTickCount (Address: 0x18009be78)
  • GetTickCount64 (Address: 0x18009be70)
api-ms-win-core-threadpool-l1-2-0.dll
  • CancelThreadpoolIo (Address: 0x18009bed0)
  • CloseThreadpoolIo (Address: 0x18009bf28)
  • CloseThreadpoolTimer (Address: 0x18009bf20)
  • CloseThreadpoolWait (Address: 0x18009bf00)
  • CloseThreadpoolWork (Address: 0x18009bec8)
  • CreateThreadpoolIo (Address: 0x18009bf08)
  • CreateThreadpoolTimer (Address: 0x18009bec0)
  • CreateThreadpoolWait (Address: 0x18009bee8)
  • CreateThreadpoolWork (Address: 0x18009beb8)
  • SetEventWhenCallbackReturns (Address: 0x18009bef0)
  • SetThreadpoolTimer (Address: 0x18009bf18)
  • SetThreadpoolWait (Address: 0x18009bef8)
  • StartThreadpoolIo (Address: 0x18009bed8)
  • SubmitThreadpoolWork (Address: 0x18009bea0)
  • WaitForThreadpoolIoCallbacks (Address: 0x18009bee0)
  • WaitForThreadpoolTimerCallbacks (Address: 0x18009bf10)
  • WaitForThreadpoolWaitCallbacks (Address: 0x18009bea8)
  • WaitForThreadpoolWorkCallbacks (Address: 0x18009beb0)
api-ms-win-core-threadpool-legacy-l1-1-0.dll
  • UnregisterWaitEx (Address: 0x18009bf38)
api-ms-win-core-timezone-l1-1-0.dll
  • SystemTimeToFileTime (Address: 0x18009bf48)
api-ms-win-core-util-l1-1-0.dll
  • DecodePointer (Address: 0x18009bf60)
  • EncodePointer (Address: 0x18009bf58)
api-ms-win-core-winrt-error-l1-1-0.dll
  • GetRestrictedErrorInfo (Address: 0x18009bf70)
  • RoOriginateError (Address: 0x18009bf78)
  • RoOriginateErrorW (Address: 0x18009bf80)
  • RoTransformError (Address: 0x18009bf88)
  • SetRestrictedErrorInfo (Address: 0x18009bf90)
api-ms-win-core-winrt-error-l1-1-1.dll
  • IsErrorPropagationEnabled (Address: 0x18009bfb0)
  • RoGetMatchingRestrictedErrorInfo (Address: 0x18009bfa8)
  • RoReportFailedDelegate (Address: 0x18009bfa0)
api-ms-win-core-winrt-l1-1-0.dll
  • RoActivateInstance (Address: 0x18009bfd0)
  • RoGetActivationFactory (Address: 0x18009bfd8)
  • RoRegisterActivationFactories (Address: 0x18009bfc8)
  • RoRevokeActivationFactories (Address: 0x18009bfc0)
api-ms-win-core-winrt-propertysetprivate-l1-1-1.dll
  • RoCreatePropertySetSerializer (Address: 0x18009bfe8)
api-ms-win-core-winrt-string-l1-1-0.dll
  • WindowsCompareStringOrdinal (Address: 0x18009c028)
  • WindowsCreateString (Address: 0x18009c038)
  • WindowsCreateStringReference (Address: 0x18009c018)
  • WindowsDeleteString (Address: 0x18009bff8)
  • WindowsDuplicateString (Address: 0x18009c008)
  • WindowsGetStringLen (Address: 0x18009c010)
  • WindowsGetStringRawBuffer (Address: 0x18009c000)
  • WindowsIsStringEmpty (Address: 0x18009c020)
  • WindowsStringHasEmbeddedNull (Address: 0x18009c030)
api-ms-win-crt-math-l1-1-0.dll
  • ceilf (Address: 0x18009c048)
api-ms-win-crt-private-l1-1-0.dll
  • __C_specific_handler (Address: 0x18009c1a8)
  • __CxxFrameHandler3 (Address: 0x18009c100)
  • __CxxFrameHandler4 (Address: 0x18009c1b8)
  • __std_terminate (Address: 0x18009c1b0)
  • __std_type_info_compare (Address: 0x18009c160)
  • _CxxThrowException (Address: 0x18009c108)
  • _o___std_exception_copy (Address: 0x18009c1a0)
  • _o___std_exception_destroy (Address: 0x18009c198)
  • _o___std_type_info_destroy_list (Address: 0x18009c190)
  • _o___stdio_common_vsnprintf_s (Address: 0x18009c188)
  • _o___stdio_common_vswprintf (Address: 0x18009c180)
  • _o__callnewh (Address: 0x18009c158)
  • _o__cexit (Address: 0x18009c150)
  • _o__configure_narrow_argv (Address: 0x18009c148)
  • _o__crt_atexit (Address: 0x18009c140)
  • _o__errno (Address: 0x18009c138)
  • _o__execute_onexit_table (Address: 0x18009c130)
  • _o__initialize_narrow_environment (Address: 0x18009c128)
  • _o__initialize_onexit_table (Address: 0x18009c120)
  • _o__invalid_parameter_noinfo (Address: 0x18009c118)
  • _o__invalid_parameter_noinfo_noreturn (Address: 0x18009c110)
  • _o__purecall (Address: 0x18009c058)
  • _o__recalloc (Address: 0x18009c060)
  • _o__register_onexit_function (Address: 0x18009c068)
  • _o__seh_filter_dll (Address: 0x18009c070)
  • _o__wcsicmp (Address: 0x18009c078)
  • _o__wcstoi64 (Address: 0x18009c080)
  • _o__wtof (Address: 0x18009c090)
  • _o_free (Address: 0x18009c098)
  • _o_isalpha (Address: 0x18009c0a0)
  • _o_isdigit (Address: 0x18009c0a8)
  • _o_islower (Address: 0x18009c0b0)
  • _o_isxdigit (Address: 0x18009c0b8)
  • _o_malloc (Address: 0x18009c0c0)
  • _o_rand (Address: 0x18009c0c8)
  • _o_realloc (Address: 0x18009c0d0)
  • _o_srand (Address: 0x18009c0d8)
  • _o_strtol (Address: 0x18009c0e0)
  • _o_terminate (Address: 0x18009c0e8)
  • _o_toupper (Address: 0x18009c0f0)
  • _o_wcscpy_s (Address: 0x18009c0f8)
  • memcmp (Address: 0x18009c1c0)
  • memcpy (Address: 0x18009c1c8)
  • memmove (Address: 0x18009c088)
  • strchr (Address: 0x18009c170)
  • wcschr (Address: 0x18009c168)
  • wcsrchr (Address: 0x18009c178)
api-ms-win-crt-runtime-l1-1-0.dll
  • _initterm (Address: 0x18009c1d8)
  • _initterm_e (Address: 0x18009c1e0)
api-ms-win-crt-string-l1-1-0.dll
  • memmove_s (Address: 0x18009c1f8)
  • memset (Address: 0x18009c200)
  • wcscmp (Address: 0x18009c208)
  • wcsncmp (Address: 0x18009c210)
  • wcsnlen (Address: 0x18009c1f0)
api-ms-win-devices-config-l1-1-1.dll
  • CM_Get_Device_Interface_List_SizeW (Address: 0x18009c240)
  • CM_Get_Device_Interface_ListW (Address: 0x18009c248)
  • CM_Get_Device_Interface_PropertyW (Address: 0x18009c258)
  • CM_Get_DevNode_PropertyW (Address: 0x18009c220)
  • CM_Locate_DevNodeW (Address: 0x18009c238)
  • CM_MapCrToWin32Err (Address: 0x18009c230)
  • CM_Register_Notification (Address: 0x18009c250)
  • CM_Unregister_Notification (Address: 0x18009c228)
api-ms-win-devices-swdevice-l1-1-0.dll
  • SwDeviceClose (Address: 0x18009c268)
  • SwDeviceCreate (Address: 0x18009c270)
  • SwDeviceInterfaceRegister (Address: 0x18009c278)
api-ms-win-devices-swdevice-l1-1-1.dll
  • SwDeviceSetLifetime (Address: 0x18009c288)
api-ms-win-eventing-classicprovider-l1-1-0.dll
  • TraceMessage (Address: 0x18009c298)
api-ms-win-eventing-provider-l1-1-0.dll
  • EventActivityIdControl (Address: 0x18009c2b8)
  • EventProviderEnabled (Address: 0x18009c2a8)
  • EventRegister (Address: 0x18009c2c0)
  • EventSetInformation (Address: 0x18009c2c8)
  • EventUnregister (Address: 0x18009c2b0)
  • EventWriteTransfer (Address: 0x18009c2d0)
api-ms-win-security-accesshlpr-l1-1-0.dll
  • BuildSecurityDescriptorForSharingAccess (Address: 0x18009c2e0)
  • FreeTransientObjectSecurityDescriptor (Address: 0x18009c2e8)
api-ms-win-security-base-l1-1-0.dll
  • AccessCheck (Address: 0x18009c328)
  • CopySid (Address: 0x18009c308)
  • DestroyPrivateObjectSecurity (Address: 0x18009c318)
  • EqualSid (Address: 0x18009c300)
  • GetLengthSid (Address: 0x18009c310)
  • GetTokenInformation (Address: 0x18009c330)
  • IsValidSid (Address: 0x18009c320)
  • MapGenericMask (Address: 0x18009c2f8)
api-ms-win-security-capability-l1-1-0.dll
  • CapabilityCheck (Address: 0x18009c340)
  • RpcClientCapabilityCheck (Address: 0x18009c348)
api-ms-win-security-lsalookup-l2-1-0.dll
  • LookupAccountSidW (Address: 0x18009c358)
api-ms-win-security-sddl-l1-1-0.dll
  • ConvertSidToStringSidW (Address: 0x18009c370)
  • ConvertStringSecurityDescriptorToSecurityDescriptorW (Address: 0x18009c368)
api-ms-win-service-core-l1-1-0.dll
  • RegisterServiceCtrlHandlerExW (Address: 0x18009c388)
  • SetServiceStatus (Address: 0x18009c380)
api-ms-win-service-core-l1-1-4.dll
  • GetServiceDirectory (Address: 0x18009c398)
api-ms-win-shcore-stream-l1-1-0.dll
  • SHCreateMemStream (Address: 0x18009c3a8)
api-ms-win-shcore-taskpool-l1-1-0.dll
  • SHTaskPoolAllowThreadReuse (Address: 0x18009c3b8)
  • SHTaskPoolQueueTask (Address: 0x18009c3c0)
api-ms-win-shell-shellfolders-l1-1-0.dll
  • SHGetKnownFolderPath (Address: 0x18009c3d0)
bcrypt.dll
  • BCryptCloseAlgorithmProvider (Address: 0x18009c3e8)
  • BCryptCreateHash (Address: 0x18009c428)
  • BCryptDecrypt (Address: 0x18009c458)
  • BCryptDestroyHash (Address: 0x18009c3e0)
  • BCryptDestroyKey (Address: 0x18009c420)
  • BCryptEncrypt (Address: 0x18009c448)
  • BCryptExportKey (Address: 0x18009c410)
  • BCryptFinishHash (Address: 0x18009c440)
  • BCryptGenerateSymmetricKey (Address: 0x18009c3f0)
  • BCryptGenRandom (Address: 0x18009c418)
  • BCryptGetProperty (Address: 0x18009c430)
  • BCryptHashData (Address: 0x18009c438)
  • BCryptImportKey (Address: 0x18009c460)
  • BCryptImportKeyPair (Address: 0x18009c3f8)
  • BCryptOpenAlgorithmProvider (Address: 0x18009c450)
  • BCryptSetProperty (Address: 0x18009c408)
  • BCryptSignHash (Address: 0x18009c400)
BrokerLib.dll
  • BrCreateBrokerInstance2 (Address: 0x18009b868)
  • BrDeleteBrokerInstance (Address: 0x18009b858)
  • BrInitializeBrokerInstance2 (Address: 0x18009b860)
  • BrSignalBrokerEvent2 (Address: 0x18009b850)
combase.dll
  • (Address: 0x18009c470)
  • (Address: 0x18009c478)
  • (Address: 0x18009c480)
  • (Address: 0x18009c488)
  • (Address: 0x18009c490)
CRYPT32.dll
  • CryptBinaryToStringW (Address: 0x18009b880)
  • CryptProtectData (Address: 0x18009b888)
  • CryptStringToBinaryW (Address: 0x18009b878)
  • CryptUnprotectData (Address: 0x18009b890)
cryptngc.dll
  • NgcGetKeyAttestationForUserIdKey (Address: 0x18009c4a0)
msvcp_win.dll
  • ?_Xbad_function_call@std@@YAXXZ (Address: 0x18009c4b8)
  • ?_Xlength_error@std@@YAXPEBD@Z (Address: 0x18009c4c0)
  • ?_Xout_of_range@std@@YAXPEBD@Z (Address: 0x18009c4b0)
ncrypt.dll
  • NCryptCreatePersistedKey (Address: 0x18009c4d8)
  • NCryptDecrypt (Address: 0x18009c500)
  • NCryptDeleteKey (Address: 0x18009c4f8)
  • NCryptExportKey (Address: 0x18009c4e8)
  • NCryptFinalizeKey (Address: 0x18009c4f0)
  • NCryptFreeObject (Address: 0x18009c4d0)
  • NCryptGetProperty (Address: 0x18009c510)
  • NCryptOpenKey (Address: 0x18009c508)
  • NCryptOpenStorageProvider (Address: 0x18009c518)
  • NCryptSetProperty (Address: 0x18009c4e0)
ntdll.dll
  • NtPowerInformation (Address: 0x18009c538)
  • NtQueryWnfStateData (Address: 0x18009c5b0)
  • RtlAcquireSRWLockExclusive (Address: 0x18009c578)
  • RtlAllocateHeap (Address: 0x18009c550)
  • RtlAllocateWnfSerializationGroup (Address: 0x18009c560)
  • RtlConvertSidToUnicodeString (Address: 0x18009c588)
  • RtlDeriveCapabilitySidsFromName (Address: 0x18009c548)
  • RtlFreeHeap (Address: 0x18009c580)
  • RtlGetDeviceFamilyInfoEnum (Address: 0x18009c528)
  • RtlGetPersistedStateLocation (Address: 0x18009c530)
  • RtlInitializeSRWLock (Address: 0x18009c558)
  • RtlIsMultiUsersInSessionSku (Address: 0x18009c5a0)
  • RtlNtStatusToDosError (Address: 0x18009c540)
  • RtlPublishWnfStateData (Address: 0x18009c598)
  • RtlQueryPackageIdentity (Address: 0x18009c568)
  • RtlReleaseSRWLockExclusive (Address: 0x18009c570)
  • RtlSubscribeWnfStateChangeNotification (Address: 0x18009c5a8)
  • RtlUnsubscribeWnfNotificationWaitForCompletion (Address: 0x18009c5b8)
  • RtlUnsubscribeWnfStateChangeNotification (Address: 0x18009c590)
OLEAUT32.dll
  • SysAllocString (Address: 0x18009b8a0)
RMCLIENT.dll
  • RmAccessCheck (Address: 0x18009b8c8)
  • RmAcquireResources (Address: 0x18009b8b0)
  • RmGetNotification (Address: 0x18009b8d0)
  • RmRegisterResource (Address: 0x18009b8c0)
  • RmReleaseResources (Address: 0x18009b8b8)
RPCRT4.dll
  • I_RpcBindingInqLocalClientPID (Address: 0x18009b920)
  • NdrClientCall3 (Address: 0x18009b8e8)
  • RpcBindingFromStringBindingW (Address: 0x18009b8e0)
  • RpcImpersonateClient (Address: 0x18009b918)
  • RpcImpersonateClient2 (Address: 0x18009b8f0)
  • RpcRevertToSelf (Address: 0x18009b910)
  • RpcRevertToSelfEx (Address: 0x18009b908)
  • RpcServerInqBindingHandle (Address: 0x18009b940)
  • RpcServerSubscribeForNotification (Address: 0x18009b938)
  • RpcServerUnsubscribeForNotification (Address: 0x18009b930)
  • RpcStringBindingComposeW (Address: 0x18009b900)
  • RpcStringFreeW (Address: 0x18009b8f8)
  • UuidToStringW (Address: 0x18009b928)