SettingsHandlers_Cortana.dll

Description: System Settings Cortana Handlers Implementation

Version: 10.0.19041.6328

Architecture: 64-bit

Operating System: Windows NT

SHA256: c148d70d6eeb125ee4f8629a020ef3be

File Size: 361.5 KB

Uploaded At: Dec. 1, 2025, 7:38 a.m.

Views: 6

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

DllCanUnloadNow (Ordinal: 1, Address: 0x5000)
DllGetClassObject (Ordinal: 2, Address: 0x4f00)
GetSetting (Ordinal: 3, Address: 0x5080)

Imported DLLs & Functions

api-ms-win-core-com-l1-1-0.dll

CoCreateFreeThreadedMarshaler (Address: 0x180046518)
CoCreateInstance (Address: 0x180046500)
CoDecrementMTAUsage (Address: 0x180046510)
CoGetApartmentType (Address: 0x1800464f8)
CoGetInterfaceAndReleaseStream (Address: 0x180046520)
CoGetMalloc (Address: 0x180046550)
CoIncrementMTAUsage (Address: 0x1800464f0)
CoInitializeEx (Address: 0x180046528)
CoMarshalInterface (Address: 0x180046530)
CoReleaseMarshalData (Address: 0x180046540)
CoTaskMemAlloc (Address: 0x180046558)
CoTaskMemFree (Address: 0x180046548)
CoTaskMemRealloc (Address: 0x180046568)
CoUninitialize (Address: 0x180046560)
CoWaitForMultipleHandles (Address: 0x180046508)
CreateStreamOnHGlobal (Address: 0x180046538)

api-ms-win-core-com-l1-1-1.dll

RoGetAgileReference (Address: 0x180046578)

api-ms-win-core-debug-l1-1-0.dll

DebugBreak (Address: 0x180046598)
IsDebuggerPresent (Address: 0x180046590)
OutputDebugStringW (Address: 0x180046588)

api-ms-win-core-delayload-l1-1-0.dll

DelayLoadFailureHook (Address: 0x1800465a8)

api-ms-win-core-delayload-l1-1-1.dll

ResolveDelayLoadedAPI (Address: 0x1800465b8)

api-ms-win-core-errorhandling-l1-1-0.dll

GetLastError (Address: 0x1800465d0)
RaiseException (Address: 0x1800465d8)
SetLastError (Address: 0x1800465e8)
SetUnhandledExceptionFilter (Address: 0x1800465c8)
UnhandledExceptionFilter (Address: 0x1800465e0)

api-ms-win-core-handle-l1-1-0.dll

CloseHandle (Address: 0x1800465f8)

api-ms-win-core-heap-l1-1-0.dll

GetProcessHeap (Address: 0x180046608)
HeapAlloc (Address: 0x180046618)
HeapFree (Address: 0x180046610)

api-ms-win-core-heap-l2-1-0.dll

LocalAlloc (Address: 0x180046628)
LocalFree (Address: 0x180046630)

api-ms-win-core-interlocked-l1-1-0.dll

InitializeSListHead (Address: 0x180046640)
InterlockedPushEntrySList (Address: 0x180046648)

api-ms-win-core-libraryloader-l1-2-0.dll

DisableThreadLibraryCalls (Address: 0x180046680)
FreeLibrary (Address: 0x180046678)
GetModuleFileNameA (Address: 0x180046668)
GetModuleHandleExW (Address: 0x180046660)
GetModuleHandleW (Address: 0x180046658)
GetProcAddress (Address: 0x180046670)

api-ms-win-core-localization-l1-2-0.dll

FormatMessageW (Address: 0x180046690)

api-ms-win-core-processenvironment-l1-1-0.dll

ExpandEnvironmentStringsW (Address: 0x1800466a0)

api-ms-win-core-processthreads-l1-1-0.dll

CreateThread (Address: 0x1800466d8)
GetCurrentProcess (Address: 0x1800466b8)
GetCurrentProcessId (Address: 0x1800466c0)
GetCurrentThread (Address: 0x1800466d0)
GetCurrentThreadId (Address: 0x1800466e0)
OpenProcessToken (Address: 0x1800466c8)
OpenThreadToken (Address: 0x1800466e8)
TerminateProcess (Address: 0x1800466b0)

api-ms-win-core-processthreads-l1-1-1.dll

IsProcessorFeaturePresent (Address: 0x1800466f8)
OpenProcess (Address: 0x180046700)

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter (Address: 0x180046710)

api-ms-win-core-registry-l1-1-0.dll

RegCloseKey (Address: 0x180046728)
RegGetValueW (Address: 0x180046730)
RegOpenCurrentUser (Address: 0x180046720)

api-ms-win-core-registry-l1-1-1.dll

RegSetKeyValueW (Address: 0x180046740)

api-ms-win-core-rtlsupport-l1-1-0.dll

RtlCaptureContext (Address: 0x180046758)
RtlLookupFunctionEntry (Address: 0x180046760)
RtlVirtualUnwind (Address: 0x180046750)

api-ms-win-core-string-l1-1-0.dll

CompareStringOrdinal (Address: 0x180046778)
MultiByteToWideChar (Address: 0x180046770)

api-ms-win-core-synch-l1-1-0.dll

AcquireSRWLockExclusive (Address: 0x1800467c8)
AcquireSRWLockShared (Address: 0x180046788)
CreateEventExW (Address: 0x1800467a0)
CreateEventW (Address: 0x180046800)
CreateMutexExW (Address: 0x180046790)
CreateSemaphoreExW (Address: 0x180046798)
DeleteCriticalSection (Address: 0x1800467d0)
EnterCriticalSection (Address: 0x1800467e8)
InitializeCriticalSectionEx (Address: 0x180046810)
InitializeSRWLock (Address: 0x1800467f0)
LeaveCriticalSection (Address: 0x1800467d8)
OpenSemaphoreW (Address: 0x1800467b8)
ReleaseMutex (Address: 0x1800467f8)
ReleaseSemaphore (Address: 0x1800467b0)
ReleaseSRWLockExclusive (Address: 0x1800467e0)
ReleaseSRWLockShared (Address: 0x1800467a8)
ResetEvent (Address: 0x180046818)
SetEvent (Address: 0x180046820)
WaitForSingleObject (Address: 0x180046808)
WaitForSingleObjectEx (Address: 0x1800467c0)

api-ms-win-core-synch-l1-2-0.dll

InitOnceBeginInitialize (Address: 0x180046830)
InitOnceComplete (Address: 0x180046848)
InitOnceExecuteOnce (Address: 0x180046840)
Sleep (Address: 0x180046838)

api-ms-win-core-sysinfo-l1-1-0.dll

GetSystemTimeAsFileTime (Address: 0x180046858)
GetTickCount (Address: 0x180046860)

api-ms-win-core-threadpool-l1-2-0.dll

CloseThreadpoolTimer (Address: 0x180046878)
CreateThreadpoolTimer (Address: 0x180046870)
SetThreadpoolTimer (Address: 0x180046888)
WaitForThreadpoolTimerCallbacks (Address: 0x180046880)

api-ms-win-core-threadpool-legacy-l1-1-0.dll

QueueUserWorkItem (Address: 0x180046898)

api-ms-win-core-util-l1-1-0.dll

DecodePointer (Address: 0x1800468a8)
EncodePointer (Address: 0x1800468b0)

api-ms-win-core-winrt-error-l1-1-0.dll

GetRestrictedErrorInfo (Address: 0x1800468d0)
RoOriginateError (Address: 0x1800468c0)
RoOriginateErrorW (Address: 0x1800468d8)
RoTransformError (Address: 0x1800468e0)
SetRestrictedErrorInfo (Address: 0x1800468c8)

api-ms-win-core-winrt-error-l1-1-1.dll

IsErrorPropagationEnabled (Address: 0x1800468f0)
RoGetMatchingRestrictedErrorInfo (Address: 0x180046908)
RoOriginateLanguageException (Address: 0x1800468f8)
RoReportFailedDelegate (Address: 0x180046900)

api-ms-win-core-winrt-l1-1-0.dll

RoActivateInstance (Address: 0x180046920)
RoGetActivationFactory (Address: 0x180046928)
RoInitialize (Address: 0x180046918)
RoUninitialize (Address: 0x180046930)

api-ms-win-core-winrt-string-l1-1-0.dll

WindowsCompareStringOrdinal (Address: 0x180046980)
WindowsCreateString (Address: 0x180046950)
WindowsCreateStringReference (Address: 0x180046960)
WindowsDeleteString (Address: 0x180046958)
WindowsDeleteStringBuffer (Address: 0x180046970)
WindowsDuplicateString (Address: 0x180046940)
WindowsGetStringRawBuffer (Address: 0x180046948)
WindowsPreallocateStringBuffer (Address: 0x180046978)
WindowsPromoteStringBuffer (Address: 0x180046968)

api-ms-win-crt-private-l1-1-0.dll

__C_specific_handler (Address: 0x180046a18)
__CxxFrameHandler3 (Address: 0x180046a48)
__CxxFrameHandler4 (Address: 0x180046a98)
__std_terminate (Address: 0x180046a90)
_CxxThrowException (Address: 0x180046a50)
_o___std_exception_copy (Address: 0x180046a88)
_o___std_exception_destroy (Address: 0x180046a80)
_o___std_type_info_destroy_list (Address: 0x180046a78)
_o___stdio_common_vsnprintf_s (Address: 0x180046a68)
_o___stdio_common_vswprintf (Address: 0x180046a58)
_o__callnewh (Address: 0x180046a38)
_o__cexit (Address: 0x180046a30)
_o__configure_narrow_argv (Address: 0x180046a28)
_o__crt_atexit (Address: 0x180046a20)
_o__errno (Address: 0x180046a70)
_o__execute_onexit_table (Address: 0x180046a60)
_o__get_errno (Address: 0x180046990)
_o__initialize_narrow_environment (Address: 0x180046998)
_o__initialize_onexit_table (Address: 0x1800469a0)
_o__invalid_parameter_noinfo (Address: 0x1800469a8)
_o__invalid_parameter_noinfo_noreturn (Address: 0x1800469b0)
_o__purecall (Address: 0x1800469b8)
_o__register_onexit_function (Address: 0x1800469c0)
_o__seh_filter_dll (Address: 0x1800469c8)
_o__set_errno (Address: 0x1800469d0)
_o_bsearch_s (Address: 0x1800469e0)
_o_free (Address: 0x1800469e8)
_o_iswspace (Address: 0x1800469f0)
_o_malloc (Address: 0x1800469f8)
_o_realloc (Address: 0x180046a00)
_o_terminate (Address: 0x180046a08)
_o_toupper (Address: 0x180046a10)
memcmp (Address: 0x180046aa0)
memcpy (Address: 0x180046aa8)
memmove (Address: 0x1800469d8)
wcsstr (Address: 0x180046a40)

api-ms-win-crt-runtime-l1-1-0.dll

_initterm (Address: 0x180046ac0)
_initterm_e (Address: 0x180046ab8)

api-ms-win-crt-string-l1-1-0.dll

memset (Address: 0x180046ad0)

api-ms-win-eventing-provider-l1-1-0.dll

EventProviderEnabled (Address: 0x180046b00)
EventRegister (Address: 0x180046ae8)
EventSetInformation (Address: 0x180046af8)
EventUnregister (Address: 0x180046ae0)
EventWriteTransfer (Address: 0x180046af0)

api-ms-win-power-setting-l1-1-0.dll

PowerGetActiveScheme (Address: 0x180046b10)

api-ms-win-security-base-l1-1-0.dll

CheckTokenMembership (Address: 0x180046b48)
CreateWellKnownSid (Address: 0x180046b30)
DuplicateToken (Address: 0x180046b38)
GetTokenInformation (Address: 0x180046b20)
ImpersonateLoggedOnUser (Address: 0x180046b28)
RevertToSelf (Address: 0x180046b40)

api-ms-win-security-sddl-l1-1-0.dll

ConvertSidToStringSidW (Address: 0x180046b58)

api-ms-win-shcore-obsolete-l1-1-0.dll

SHStrDupW (Address: 0x180046b68)

api-ms-win-shcore-registry-l1-1-0.dll

SHGetValueW (Address: 0x180046b78)
SHSetValueW (Address: 0x180046b80)

api-ms-win-shcore-taskpool-l1-1-0.dll

SHTaskPoolAllowThreadReuse (Address: 0x180046b90)
SHTaskPoolQueueTask (Address: 0x180046b98)

msvcp_win.dll

?_Xlength_error@std@@YAXPEBD@Z (Address: 0x180046ba8)
?_Xout_of_range@std@@YAXPEBD@Z (Address: 0x180046bb0)

ntdll.dll

NtQueryInformationToken (Address: 0x180046bd8)
NtQueryWnfStateData (Address: 0x180046bc8)
RtlGetDeviceFamilyInfoEnum (Address: 0x180046be0)
RtlSubscribeWnfStateChangeNotification (Address: 0x180046bc0)
RtlUnsubscribeWnfNotificationWaitForCompletion (Address: 0x180046bd0)

OLEAUT32.dll

SysAllocString (Address: 0x1800464b8)
SysFreeString (Address: 0x1800464c8)
SysStringLen (Address: 0x1800464c0)
VariantClear (Address: 0x1800464b0)
VariantInit (Address: 0x1800464d0)

policymanager.dll

PolicyManager_FreeGetPolicyData (Address: 0x180046bf0)
PolicyManager_GetPolicy (Address: 0x180046c00)
PolicyManager_GetPolicyInt (Address: 0x180046bf8)
PolicyManager_IsPolicySetByMobileDeviceManager (Address: 0x180046c08)

POWRPROF.dll

PowerReadACValueIndex (Address: 0x1800464e0)