advapi32.dll
Description: Advanced Windows 32 Base API
Authors: © Microsoft Corporation. All rights reserved.
Version: 10.0.19041.1052
Architecture: 64-bit
Operating System: Windows NT
SHA256: e92f9f71ba5a405c5d1a51bd03d6f830
File Size: 673.4 KB
Uploaded At: June 19, 2026, 3:20 a.m.
Views: 140
Security Warning
This file has been flagged as potentially dangerous.
Reason: Detected potentially dangerous functions used for process injection: OpenProcess
Exported Functions
- (Ordinal: 1000, Address: 0x37b10)
- I_ScGetCurrentGroupStateW (Ordinal: 1001, Address: 0x2cfb0)
- A_SHAFinal (Ordinal: 1002, Address: 0x92b78)
- A_SHAInit (Ordinal: 1003, Address: 0x92b93)
- A_SHAUpdate (Ordinal: 1004, Address: 0x92baf)
- AbortSystemShutdownA (Ordinal: 1005, Address: 0x41f90)
- AbortSystemShutdownW (Ordinal: 1006, Address: 0x42030)
- AccessCheck (Ordinal: 1007, Address: 0x4350)
- AccessCheckAndAuditAlarmA (Ordinal: 1008, Address: 0x45930)
- AccessCheckAndAuditAlarmW (Ordinal: 1009, Address: 0x2d680)
- AccessCheckByType (Ordinal: 1010, Address: 0x2d9a0)
- AccessCheckByTypeAndAuditAlarmA (Ordinal: 1011, Address: 0x45ae0)
- AccessCheckByTypeAndAuditAlarmW (Ordinal: 1012, Address: 0x2d700)
- AccessCheckByTypeResultList (Ordinal: 1013, Address: 0x2d920)
- AccessCheckByTypeResultListAndAuditAlarmA (Ordinal: 1014, Address: 0x45cc0)
- AccessCheckByTypeResultListAndAuditAlarmByHandleA (Ordinal: 1015, Address: 0x45ea0)
- AccessCheckByTypeResultListAndAuditAlarmByHandleW (Ordinal: 1016, Address: 0x2d7b0)
- AccessCheckByTypeResultListAndAuditAlarmW (Ordinal: 1017, Address: 0x2d870)
- AddAccessAllowedAce (Ordinal: 1018, Address: 0x17120)
- AddAccessAllowedAceEx (Ordinal: 1019, Address: 0x17850)
- AddAccessAllowedObjectAce (Ordinal: 1020, Address: 0x2da20)
- AddAccessDeniedAce (Ordinal: 1021, Address: 0x2da60)
- AddAccessDeniedAceEx (Ordinal: 1022, Address: 0x2da40)
- AddAccessDeniedObjectAce (Ordinal: 1023, Address: 0x2da80)
- AddAce (Ordinal: 1024, Address: 0x1aef0)
- AddAuditAccessAce (Ordinal: 1025, Address: 0x2dac0)
- AddAuditAccessAceEx (Ordinal: 1026, Address: 0x2daa0)
- AddAuditAccessObjectAce (Ordinal: 1027, Address: 0x2dae0)
- AddConditionalAce (Ordinal: 1028, Address: 0x48740)
- AddMandatoryAce (Ordinal: 1029, Address: 0x92e3d)
- AddUsersToEncryptedFile (Ordinal: 1030, Address: 0x2c800)
- AddUsersToEncryptedFileEx (Ordinal: 1031, Address: 0x2c880)
- AdjustTokenGroups (Ordinal: 1032, Address: 0x2db00)
- AdjustTokenPrivileges (Ordinal: 1033, Address: 0x17900)
- AllocateAndInitializeSid (Ordinal: 1034, Address: 0x16300)
- AllocateLocallyUniqueId (Ordinal: 1035, Address: 0x2db20)
- AreAllAccessesGranted (Ordinal: 1036, Address: 0x2db40)
- AreAnyAccessesGranted (Ordinal: 1037, Address: 0x2db60)
- AuditComputeEffectivePolicyBySid (Ordinal: 1038, Address: 0x2db80)
- AuditComputeEffectivePolicyByToken (Ordinal: 1039, Address: 0x303c0)
- AuditEnumerateCategories (Ordinal: 1040, Address: 0x2dba0)
- AuditEnumeratePerUserPolicy (Ordinal: 1041, Address: 0x2dbc0)
- AuditEnumerateSubCategories (Ordinal: 1042, Address: 0x2dbe0)
- AuditFree (Ordinal: 1043, Address: 0x1d350)
- AuditLookupCategoryGuidFromCategoryId (Ordinal: 1044, Address: 0x30520)
- AuditLookupCategoryIdFromCategoryGuid (Ordinal: 1045, Address: 0x30560)
- AuditLookupCategoryNameA (Ordinal: 1046, Address: 0x305d0)
- AuditLookupCategoryNameW (Ordinal: 1047, Address: 0x2dc00)
- AuditLookupSubCategoryNameA (Ordinal: 1048, Address: 0x30680)
- AuditLookupSubCategoryNameW (Ordinal: 1049, Address: 0x2dc20)
- AuditQueryGlobalSaclA (Ordinal: 1050, Address: 0x30730)
- AuditQueryGlobalSaclW (Ordinal: 1051, Address: 0x2dc40)
- AuditQueryPerUserPolicy (Ordinal: 1052, Address: 0x1d440)
- AuditQuerySecurity (Ordinal: 1053, Address: 0x2dc60)
- AuditQuerySystemPolicy (Ordinal: 1054, Address: 0x1d330)
- AuditSetGlobalSaclA (Ordinal: 1055, Address: 0x307f0)
- AuditSetGlobalSaclW (Ordinal: 1056, Address: 0x2dc80)
- AuditSetPerUserPolicy (Ordinal: 1057, Address: 0x2dca0)
- AuditSetSecurity (Ordinal: 1058, Address: 0x2dcc0)
- AuditSetSystemPolicy (Ordinal: 1059, Address: 0x2dce0)
- BackupEventLogA (Ordinal: 1060, Address: 0x4fb80)
- BackupEventLogW (Ordinal: 1061, Address: 0x4fc20)
- BaseRegCloseKey (Ordinal: 1062, Address: 0x425b0)
- BaseRegCreateKey (Ordinal: 1063, Address: 0x425e0)
- BaseRegDeleteKeyEx (Ordinal: 1064, Address: 0x42650)
- BaseRegDeleteValue (Ordinal: 1065, Address: 0x42690)
- BaseRegFlushKey (Ordinal: 1066, Address: 0x426d0)
- BaseRegGetVersion (Ordinal: 1067, Address: 0x42700)
- BaseRegLoadKey (Ordinal: 1068, Address: 0x42740)
- BaseRegOpenKey (Ordinal: 1069, Address: 0x42780)
- BaseRegRestoreKey (Ordinal: 1070, Address: 0x427d0)
- BaseRegSaveKeyEx (Ordinal: 1071, Address: 0x42810)
- BaseRegSetKeySecurity (Ordinal: 1072, Address: 0x42850)
- BaseRegSetValue (Ordinal: 1073, Address: 0x42890)
- BaseRegUnLoadKey (Ordinal: 1074, Address: 0x428e0)
- BuildExplicitAccessWithNameA (Ordinal: 1075, Address: 0x1d460)
- BuildExplicitAccessWithNameW (Ordinal: 1076, Address: 0x1d460)
- BuildImpersonateExplicitAccessWithNameA (Ordinal: 1077, Address: 0x3cb80)
- BuildImpersonateExplicitAccessWithNameW (Ordinal: 1078, Address: 0x3cb80)
- BuildImpersonateTrusteeA (Ordinal: 1079, Address: 0x3da40)
- BuildImpersonateTrusteeW (Ordinal: 1080, Address: 0x3da40)
- BuildSecurityDescriptorA (Ordinal: 1081, Address: 0x3cbb0)
- BuildSecurityDescriptorW (Ordinal: 1082, Address: 0x1c9c0)
- BuildTrusteeWithNameA (Ordinal: 1083, Address: 0x3da60)
- BuildTrusteeWithNameW (Ordinal: 1084, Address: 0x3da60)
- BuildTrusteeWithObjectsAndNameA (Ordinal: 1085, Address: 0x3da80)
- BuildTrusteeWithObjectsAndNameW (Ordinal: 1086, Address: 0x3da80)
- BuildTrusteeWithObjectsAndSidA (Ordinal: 1087, Address: 0x3dae0)
- BuildTrusteeWithObjectsAndSidW (Ordinal: 1088, Address: 0x3dae0)
- BuildTrusteeWithSidA (Ordinal: 1089, Address: 0x17b20)
- BuildTrusteeWithSidW (Ordinal: 1090, Address: 0x17b20)
- CancelOverlappedAccess (Ordinal: 1091, Address: 0x3e1f0)
- ChangeServiceConfig2A (Ordinal: 1092, Address: 0x2dd00)
- ChangeServiceConfig2W (Ordinal: 1093, Address: 0x2dd20)
- ChangeServiceConfigA (Ordinal: 1094, Address: 0x2dd40)
- ChangeServiceConfigW (Ordinal: 1095, Address: 0x1d2b0)
- CheckForHiberboot (Ordinal: 1096, Address: 0x1bf70)
- CheckTokenMembership (Ordinal: 1097, Address: 0x175e0)
- ClearEventLogA (Ordinal: 1098, Address: 0x4feb0)
- ClearEventLogW (Ordinal: 1099, Address: 0x4ff50)
- CloseCodeAuthzLevel (Ordinal: 1100, Address: 0x15e60)
- CloseEncryptedFileRaw (Ordinal: 1101, Address: 0x2c920)
- CloseEventLog (Ordinal: 1102, Address: 0x1c4a0)
- CloseServiceHandle (Ordinal: 1103, Address: 0x17920)
- CloseThreadWaitChainSession (Ordinal: 1104, Address: 0x60fd0)
- CloseTrace (Ordinal: 1105, Address: 0x17cb0)
- CommandLineFromMsiDescriptor (Ordinal: 1106, Address: 0x3950)
- ComputeAccessTokenFromCodeAuthzLevel (Ordinal: 1107, Address: 0x139e0)
- ControlService (Ordinal: 1108, Address: 0x2de00)
- ControlServiceExA (Ordinal: 1109, Address: 0x2ddc0)
- ControlServiceExW (Ordinal: 1110, Address: 0x2dde0)
- ControlTraceA (Ordinal: 1111, Address: 0x1dd30)
- ControlTraceW (Ordinal: 1112, Address: 0x43a0)
- ConvertAccessToSecurityDescriptorA (Ordinal: 1113, Address: 0x3e260)
- ConvertAccessToSecurityDescriptorW (Ordinal: 1114, Address: 0x3e3e0)
- ConvertSDToStringSDDomainW (Ordinal: 1115, Address: 0x48ef0)
- ConvertSDToStringSDRootDomainA (Ordinal: 1116, Address: 0x48f80)
- ConvertSDToStringSDRootDomainW (Ordinal: 1117, Address: 0x49100)
- ConvertSecurityDescriptorToAccessA (Ordinal: 1118, Address: 0x3e470)
- ConvertSecurityDescriptorToAccessNamedA (Ordinal: 1119, Address: 0x3e470)
- ConvertSecurityDescriptorToAccessNamedW (Ordinal: 1120, Address: 0x3e4b0)
- ConvertSecurityDescriptorToAccessW (Ordinal: 1121, Address: 0x3e4b0)
- ConvertSecurityDescriptorToStringSecurityDescriptorA (Ordinal: 1122, Address: 0x49180)
- ConvertSecurityDescriptorToStringSecurityDescriptorW (Ordinal: 1123, Address: 0x492f0)
- ConvertSidToStringSidA (Ordinal: 1124, Address: 0x1bdc0)
- ConvertSidToStringSidW (Ordinal: 1125, Address: 0x15830)
- ConvertStringSDToSDDomainA (Ordinal: 1126, Address: 0x493c0)
- ConvertStringSDToSDDomainW (Ordinal: 1127, Address: 0x1b770)
- ConvertStringSDToSDRootDomainA (Ordinal: 1128, Address: 0x49500)
- ConvertStringSDToSDRootDomainW (Ordinal: 1129, Address: 0x495d0)
- ConvertStringSecurityDescriptorToSecurityDescriptorA (Ordinal: 1130, Address: 0x49640)
- ConvertStringSecurityDescriptorToSecurityDescriptorW (Ordinal: 1131, Address: 0x11d30)
- ConvertStringSidToSidA (Ordinal: 1132, Address: 0x49700)
- ConvertStringSidToSidW (Ordinal: 1133, Address: 0x11c80)
- ConvertToAutoInheritPrivateObjectSecurity (Ordinal: 1134, Address: 0x2de20)
- CopySid (Ordinal: 1135, Address: 0x16c10)
- CreateCodeAuthzLevel (Ordinal: 1136, Address: 0x360c0)
- CreatePrivateObjectSecurity (Ordinal: 1137, Address: 0x196d0)
- CreatePrivateObjectSecurityEx (Ordinal: 1138, Address: 0x2de40)
- CreatePrivateObjectSecurityWithMultipleInheritance (Ordinal: 1139, Address: 0x2de60)
- CreateProcessAsUserA (Ordinal: 1140, Address: 0x2de80)
- CreateProcessAsUserW (Ordinal: 1141, Address: 0x17bf0)
- CreateProcessWithLogonW (Ordinal: 1142, Address: 0x47dc0)
- CreateProcessWithTokenW (Ordinal: 1143, Address: 0x4480)
- CreateRestrictedToken (Ordinal: 1144, Address: 0x43e0)
- CreateServiceA (Ordinal: 1145, Address: 0x2df00)
- CreateServiceEx (Ordinal: 1146, Address: 0x1ded0)
- CreateServiceW (Ordinal: 1147, Address: 0x2df90)
- CreateTraceInstanceId (Ordinal: 1148, Address: 0x939ef)
- CreateWellKnownSid (Ordinal: 1149, Address: 0x17b00)
- CredBackupCredentials (Ordinal: 1150, Address: 0x2e020)
- CredDeleteA (Ordinal: 1151, Address: 0x2e040)
- CredDeleteW (Ordinal: 1152, Address: 0x2e060)
- CredEncryptAndMarshalBinaryBlob (Ordinal: 1153, Address: 0x2e080)
- CredEnumerateA (Ordinal: 1154, Address: 0x2e0a0)
- CredEnumerateW (Ordinal: 1155, Address: 0x2e0c0)
- CredFindBestCredentialA (Ordinal: 1156, Address: 0x2e0e0)
- CredFindBestCredentialW (Ordinal: 1157, Address: 0x2e100)
- CredFree (Ordinal: 1158, Address: 0x2e120)
- CredGetSessionTypes (Ordinal: 1159, Address: 0x2e140)
- CredGetTargetInfoA (Ordinal: 1160, Address: 0x2e160)
- CredGetTargetInfoW (Ordinal: 1161, Address: 0x2e180)
- CredIsMarshaledCredentialA (Ordinal: 1162, Address: 0x30ba0)
- CredIsMarshaledCredentialW (Ordinal: 1163, Address: 0x2e1a0)
- CredIsProtectedA (Ordinal: 1164, Address: 0x2e1c0)
- CredIsProtectedW (Ordinal: 1165, Address: 0x2e1e0)
- CredMarshalCredentialA (Ordinal: 1166, Address: 0x2e200)
- CredMarshalCredentialW (Ordinal: 1167, Address: 0x2e220)
- CredProfileLoaded (Ordinal: 1168, Address: 0x2e260)
- CredProfileLoadedEx (Ordinal: 1169, Address: 0x2e240)
- CredProfileUnloaded (Ordinal: 1170, Address: 0x2e280)
- CredProtectA (Ordinal: 1171, Address: 0x2e2a0)
- CredProtectW (Ordinal: 1172, Address: 0x2e2c0)
- CredReadA (Ordinal: 1173, Address: 0x2e2e0)
- CredReadByTokenHandle (Ordinal: 1174, Address: 0x2e300)
- CredReadDomainCredentialsA (Ordinal: 1175, Address: 0x2e320)
- CredReadDomainCredentialsW (Ordinal: 1176, Address: 0x2e340)
- CredReadW (Ordinal: 1177, Address: 0x2e360)
- CredRenameA (Ordinal: 1178, Address: 0x30be0)
- CredRenameW (Ordinal: 1179, Address: 0x30be0)
- CredRestoreCredentials (Ordinal: 1180, Address: 0x2e380)
- CredUnmarshalCredentialA (Ordinal: 1181, Address: 0x2e3a0)
- CredUnmarshalCredentialW (Ordinal: 1182, Address: 0x2e3c0)
- CredUnprotectA (Ordinal: 1183, Address: 0x2e3e0)
- CredUnprotectW (Ordinal: 1184, Address: 0x2e400)
- CredWriteA (Ordinal: 1185, Address: 0x2e420)
- CredWriteDomainCredentialsA (Ordinal: 1186, Address: 0x2e440)
- CredWriteDomainCredentialsW (Ordinal: 1187, Address: 0x2e460)
- CredWriteW (Ordinal: 1188, Address: 0x2e480)
- CredpConvertCredential (Ordinal: 1189, Address: 0x2e4a0)
- CredpConvertOneCredentialSize (Ordinal: 1190, Address: 0x2e4c0)
- CredpConvertTargetInfo (Ordinal: 1191, Address: 0x2e4e0)
- CredpDecodeCredential (Ordinal: 1192, Address: 0x2e500)
- CredpEncodeCredential (Ordinal: 1193, Address: 0x2e520)
- CredpEncodeSecret (Ordinal: 1194, Address: 0x2e540)
- CryptAcquireContextA (Ordinal: 1195, Address: 0x17090)
- CryptAcquireContextW (Ordinal: 1196, Address: 0x171d0)
- CryptContextAddRef (Ordinal: 1197, Address: 0x2e560)
- CryptCreateHash (Ordinal: 1198, Address: 0x16a40)
- CryptDecrypt (Ordinal: 1199, Address: 0x2e580)
- CryptDeriveKey (Ordinal: 1200, Address: 0x2e5a0)
- CryptDestroyHash (Ordinal: 1201, Address: 0x16d00)
- CryptDestroyKey (Ordinal: 1202, Address: 0x16f40)
- CryptDuplicateHash (Ordinal: 1203, Address: 0x2e5c0)
- CryptDuplicateKey (Ordinal: 1204, Address: 0x2e5e0)
- CryptEncrypt (Ordinal: 1205, Address: 0x2e600)
- CryptEnumProviderTypesA (Ordinal: 1206, Address: 0x2e620)
- CryptEnumProviderTypesW (Ordinal: 1207, Address: 0x2e640)
- CryptEnumProvidersA (Ordinal: 1208, Address: 0x2e660)
- CryptEnumProvidersW (Ordinal: 1209, Address: 0x2e680)
- CryptExportKey (Ordinal: 1210, Address: 0x16990)
- CryptGenKey (Ordinal: 1211, Address: 0x2e6a0)
- CryptGenRandom (Ordinal: 1212, Address: 0x17980)
- CryptGetDefaultProviderA (Ordinal: 1213, Address: 0x2e6c0)
- CryptGetDefaultProviderW (Ordinal: 1214, Address: 0x175a0)
- CryptGetHashParam (Ordinal: 1215, Address: 0x16470)
- CryptGetKeyParam (Ordinal: 1216, Address: 0x2e6e0)
- CryptGetProvParam (Ordinal: 1217, Address: 0x2e700)
- CryptGetUserKey (Ordinal: 1218, Address: 0x2e720)
- CryptHashData (Ordinal: 1219, Address: 0x16d20)
- CryptHashSessionKey (Ordinal: 1220, Address: 0x2e740)
- CryptImportKey (Ordinal: 1221, Address: 0x16970)
- CryptReleaseContext (Ordinal: 1222, Address: 0x175c0)
- CryptSetHashParam (Ordinal: 1223, Address: 0x17bb0)
- CryptSetKeyParam (Ordinal: 1224, Address: 0x2e760)
- CryptSetProvParam (Ordinal: 1225, Address: 0x2e780)
- CryptSetProviderA (Ordinal: 1226, Address: 0x2e7a0)
- CryptSetProviderExA (Ordinal: 1227, Address: 0x2e7c0)
- CryptSetProviderExW (Ordinal: 1228, Address: 0x2e7e0)
- CryptSetProviderW (Ordinal: 1229, Address: 0x2e800)
- CryptSignHashA (Ordinal: 1230, Address: 0x2e820)
- CryptSignHashW (Ordinal: 1231, Address: 0x2e840)
- CryptVerifySignatureA (Ordinal: 1232, Address: 0x2e860)
- CryptVerifySignatureW (Ordinal: 1233, Address: 0x17960)
- CveEventWrite (Ordinal: 1234, Address: 0x94064)
- DecryptFileA (Ordinal: 1235, Address: 0x2c940)
- DecryptFileW (Ordinal: 1236, Address: 0x2ca10)
- DeleteAce (Ordinal: 1237, Address: 0x17600)
- DeleteService (Ordinal: 1238, Address: 0x2e880)
- DeregisterEventSource (Ordinal: 1239, Address: 0x18840)
- DestroyPrivateObjectSecurity (Ordinal: 1240, Address: 0x2e8a0)
- DuplicateEncryptionInfoFile (Ordinal: 1241, Address: 0x2caa0)
- DuplicateToken (Ordinal: 1242, Address: 0x17100)
- DuplicateTokenEx (Ordinal: 1243, Address: 0x178b0)
- ElfBackupEventLogFileA (Ordinal: 1244, Address: 0x50900)
- ElfBackupEventLogFileW (Ordinal: 1245, Address: 0x50a00)
- ElfChangeNotify (Ordinal: 1246, Address: 0x50b00)
- ElfClearEventLogFileA (Ordinal: 1247, Address: 0x50c10)
- ElfClearEventLogFileW (Ordinal: 1248, Address: 0x50d00)
- ElfCloseEventLog (Ordinal: 1249, Address: 0x1c4d0)
- ElfDeregisterEventSource (Ordinal: 1250, Address: 0x18870)
- ElfFlushEventLog (Ordinal: 1251, Address: 0x50de0)
- ElfNumberOfRecords (Ordinal: 1252, Address: 0x50df0)
- ElfOldestRecord (Ordinal: 1253, Address: 0x50ee0)
- ElfOpenBackupEventLogA (Ordinal: 1254, Address: 0x50fd0)
- ElfOpenBackupEventLogW (Ordinal: 1255, Address: 0x51140)
- ElfOpenEventLogA (Ordinal: 1256, Address: 0x512b0)
- ElfOpenEventLogW (Ordinal: 1257, Address: 0x1c5a0)
- ElfReadEventLogA (Ordinal: 1258, Address: 0x51500)
- ElfReadEventLogW (Ordinal: 1259, Address: 0x51670)
- ElfRegisterEventSourceA (Ordinal: 1260, Address: 0x51a30)
- ElfRegisterEventSourceW (Ordinal: 1261, Address: 0x17e90)
- ElfReportEventA (Ordinal: 1262, Address: 0x51bd0)
- ElfReportEventAndSourceW (Ordinal: 1263, Address: 0x52030)
- ElfReportEventW (Ordinal: 1264, Address: 0x18410)
- EnableTrace (Ordinal: 1265, Address: 0x1cff0)
- EnableTraceEx (Ordinal: 1266, Address: 0x1d040)
- EnableTraceEx2 (Ordinal: 1267, Address: 0x4190)
- EncryptFileA (Ordinal: 1268, Address: 0x2cb40)
- EncryptFileW (Ordinal: 1269, Address: 0x2cc00)
- EncryptedFileKeyInfo (Ordinal: 1270, Address: 0x2cc80)
- EncryptionDisable (Ordinal: 1271, Address: 0x2cd00)
- EnumDependentServicesA (Ordinal: 1272, Address: 0x44c10)
- EnumDependentServicesW (Ordinal: 1273, Address: 0x2e8c0)
- EnumDynamicTimeZoneInformation (Ordinal: 1274, Address: 0x2e8e0)
- EnumServiceGroupW (Ordinal: 1275, Address: 0x44dc0)
- EnumServicesStatusA (Ordinal: 1276, Address: 0x45090)
- EnumServicesStatusExA (Ordinal: 1277, Address: 0x18a30)
- EnumServicesStatusExW (Ordinal: 1278, Address: 0x38e0)
- EnumServicesStatusW (Ordinal: 1279, Address: 0x452e0)
- EnumerateTraceGuids (Ordinal: 1280, Address: 0x194c0)
- EnumerateTraceGuidsEx (Ordinal: 1281, Address: 0x17c90)
- EqualDomainSid (Ordinal: 1282, Address: 0x2e900)
- EqualPrefixSid (Ordinal: 1283, Address: 0x2e920)
- EqualSid (Ordinal: 1284, Address: 0x17d30)
- EventAccessControl (Ordinal: 1285, Address: 0x2e940)
- EventAccessQuery (Ordinal: 1286, Address: 0x2e960)
- EventAccessRemove (Ordinal: 1287, Address: 0x2e980)
- EventActivityIdControl (Ordinal: 1288, Address: 0x9447c)
- EventEnabled (Ordinal: 1289, Address: 0x944a9)
- EventProviderEnabled (Ordinal: 1290, Address: 0x944d4)
- EventRegister (Ordinal: 1291, Address: 0x94500)
- EventSetInformation (Ordinal: 1292, Address: 0x9452b)
- EventUnregister (Ordinal: 1293, Address: 0x94558)
- EventWrite (Ordinal: 1294, Address: 0x9457c)
- EventWriteEndScenario (Ordinal: 1295, Address: 0x945a6)
- EventWriteEx (Ordinal: 1296, Address: 0x945d2)
- EventWriteStartScenario (Ordinal: 1297, Address: 0x94600)
- EventWriteString (Ordinal: 1298, Address: 0x94632)
- EventWriteTransfer (Ordinal: 1299, Address: 0x9465f)
- FileEncryptionStatusA (Ordinal: 1300, Address: 0x2cd50)
- FileEncryptionStatusW (Ordinal: 1301, Address: 0x2ce20)
- FindFirstFreeAce (Ordinal: 1302, Address: 0x2e9a0)
- FlushEfsCache (Ordinal: 1303, Address: 0x2ce80)
- FlushTraceA (Ordinal: 1304, Address: 0x41ce0)
- FlushTraceW (Ordinal: 1305, Address: 0x41d00)
- FreeEncryptedFileKeyInfo (Ordinal: 1306, Address: 0x2cf50)
- FreeEncryptedFileMetadata (Ordinal: 1307, Address: 0x194b0)
- FreeEncryptionCertificateHashList (Ordinal: 1308, Address: 0x2cf80)
- FreeInheritedFromArray (Ordinal: 1309, Address: 0x3cd40)
- FreeSid (Ordinal: 1310, Address: 0x17140)
- GetAccessPermissionsForObjectA (Ordinal: 1311, Address: 0x3e4f0)
- GetAccessPermissionsForObjectW (Ordinal: 1312, Address: 0x3e850)
- GetAce (Ordinal: 1313, Address: 0x1af10)
- GetAclInformation (Ordinal: 1314, Address: 0x1b2a0)
- GetAuditedPermissionsFromAclA (Ordinal: 1315, Address: 0x3cd90)
- GetAuditedPermissionsFromAclW (Ordinal: 1316, Address: 0x3ce10)
- GetCurrentHwProfileA (Ordinal: 1317, Address: 0x2c570)
- GetCurrentHwProfileW (Ordinal: 1318, Address: 0x17200)
- GetDynamicTimeZoneInformationEffectiveYears (Ordinal: 1319, Address: 0x2e9c0)
- GetEffectiveRightsFromAclA (Ordinal: 1320, Address: 0x3ceb0)
- GetEffectiveRightsFromAclW (Ordinal: 1321, Address: 0x3cf30)
- GetEncryptedFileMetadata (Ordinal: 1322, Address: 0x2cfb0)
- GetEventLogInformation (Ordinal: 1323, Address: 0x1c390)
- GetExplicitEntriesFromAclA (Ordinal: 1324, Address: 0x2e9e0)
- GetExplicitEntriesFromAclW (Ordinal: 1325, Address: 0x2e9e0)
- GetFileSecurityA (Ordinal: 1326, Address: 0x46090)
- GetFileSecurityW (Ordinal: 1327, Address: 0x43c0)
- GetInformationCodeAuthzLevelW (Ordinal: 1328, Address: 0x36790)
- GetInformationCodeAuthzPolicyW (Ordinal: 1329, Address: 0x5a10)
- GetInheritanceSourceA (Ordinal: 1330, Address: 0x3cfd0)
- GetInheritanceSourceW (Ordinal: 1331, Address: 0x3cfe0)
- GetKernelObjectSecurity (Ordinal: 1332, Address: 0x1b2e0)
- GetLengthSid (Ordinal: 1333, Address: 0x169b0)
- GetLocalManagedApplicationData (Ordinal: 1334, Address: 0x344e0)
- GetLocalManagedApplications (Ordinal: 1335, Address: 0x34750)
- GetManagedApplicationCategories (Ordinal: 1336, Address: 0x34a80)
- GetManagedApplications (Ordinal: 1337, Address: 0x34af0)
- GetMultipleTrusteeA (Ordinal: 1338, Address: 0x3db60)
- GetMultipleTrusteeOperationA (Ordinal: 1339, Address: 0x3db80)
- GetMultipleTrusteeOperationW (Ordinal: 1340, Address: 0x3db80)
- GetMultipleTrusteeW (Ordinal: 1341, Address: 0x3db60)
- GetNamedSecurityInfoA (Ordinal: 1342, Address: 0x3d0a0)
- GetNamedSecurityInfoExA (Ordinal: 1343, Address: 0x3e990)
- GetNamedSecurityInfoExW (Ordinal: 1344, Address: 0x3ec40)
- GetNamedSecurityInfoW (Ordinal: 1345, Address: 0x2ea00)
- GetNumberOfEventLogRecords (Ordinal: 1346, Address: 0x50020)
- GetOldestEventLogRecord (Ordinal: 1347, Address: 0x50070)
- GetOverlappedAccessResults (Ordinal: 1348, Address: 0x3ef70)
- GetPrivateObjectSecurity (Ordinal: 1349, Address: 0x2ea50)
- GetSecurityDescriptorControl (Ordinal: 1350, Address: 0x1bc80)
- GetSecurityDescriptorDacl (Ordinal: 1351, Address: 0x17830)
- GetSecurityDescriptorGroup (Ordinal: 1352, Address: 0x1bda0)
- GetSecurityDescriptorLength (Ordinal: 1353, Address: 0x1bcd0)
- GetSecurityDescriptorOwner (Ordinal: 1354, Address: 0x1d290)
- GetSecurityDescriptorRMControl (Ordinal: 1355, Address: 0x2ea70)
- GetSecurityDescriptorSacl (Ordinal: 1356, Address: 0x1bd80)
- GetSecurityInfo (Ordinal: 1357, Address: 0x17160)
- GetSecurityInfoExA (Ordinal: 1358, Address: 0x3f0a0)
- GetSecurityInfoExW (Ordinal: 1359, Address: 0x3f310)
- GetServiceDisplayNameA (Ordinal: 1360, Address: 0x45330)
- GetServiceDisplayNameW (Ordinal: 1361, Address: 0x2ea90)
- GetServiceKeyNameA (Ordinal: 1362, Address: 0x453e0)
- GetServiceKeyNameW (Ordinal: 1363, Address: 0x2eab0)
- GetSidIdentifierAuthority (Ordinal: 1364, Address: 0x1ba80)
- GetSidLengthRequired (Ordinal: 1365, Address: 0x1af30)
- GetSidSubAuthority (Ordinal: 1366, Address: 0x16fd0)
- GetSidSubAuthorityCount (Ordinal: 1367, Address: 0x16f60)
- GetStringConditionFromBinary (Ordinal: 1368, Address: 0x48a10)
- GetThreadWaitChain (Ordinal: 1369, Address: 0x61060)
- GetTokenInformation (Ordinal: 1370, Address: 0x15f90)
- GetTraceEnableFlags (Ordinal: 1371, Address: 0x94d1c)
- GetTraceEnableLevel (Ordinal: 1372, Address: 0x94d4d)
- GetTraceLoggerHandle (Ordinal: 1373, Address: 0x94d7f)
- GetTrusteeFormA (Ordinal: 1374, Address: 0x3dba0)
- GetTrusteeFormW (Ordinal: 1375, Address: 0x3dba0)
- GetTrusteeNameA (Ordinal: 1376, Address: 0x3dbc0)
- GetTrusteeNameW (Ordinal: 1377, Address: 0x3dbc0)
- GetTrusteeTypeA (Ordinal: 1378, Address: 0x3dbd0)
- GetTrusteeTypeW (Ordinal: 1379, Address: 0x3dbd0)
- GetUserNameA (Ordinal: 1380, Address: 0x47e40)
- GetUserNameW (Ordinal: 1381, Address: 0x16780)
- GetWindowsAccountDomainSid (Ordinal: 1382, Address: 0x2ead0)
- I_QueryTagInformation (Ordinal: 1383, Address: 0x94e48)
- I_ScIsSecurityProcess (Ordinal: 1384, Address: 0x94e96)
- I_ScPnPGetServiceName (Ordinal: 1385, Address: 0x94ee4)
- I_ScQueryServiceConfig (Ordinal: 1386, Address: 0x94f33)
- I_ScRegisterPreshutdownRestart (Ordinal: 1387, Address: 0x94f8b)
- I_ScReparseServiceDatabase (Ordinal: 1388, Address: 0x1dee0)
- I_ScSendPnPMessage (Ordinal: 1389, Address: 0x94ffa)
- I_ScSendTSMessage (Ordinal: 1390, Address: 0x95041)
- I_ScSetServiceBitsA (Ordinal: 1391, Address: 0x2eaf0)
- I_ScSetServiceBitsW (Ordinal: 1392, Address: 0x2eb10)
- I_ScValidatePnPService (Ordinal: 1393, Address: 0x950b4)
- IdentifyCodeAuthzLevelW (Ordinal: 1394, Address: 0xb790)
- ImpersonateAnonymousToken (Ordinal: 1395, Address: 0x2eb30)
- ImpersonateLoggedOnUser (Ordinal: 1396, Address: 0x17a60)
- ImpersonateNamedPipeClient (Ordinal: 1397, Address: 0x2eb50)
- ImpersonateSelf (Ordinal: 1398, Address: 0x17db0)
- InitializeAcl (Ordinal: 1399, Address: 0x171b0)
- InitializeSecurityDescriptor (Ordinal: 1400, Address: 0x17580)
- InitializeSid (Ordinal: 1401, Address: 0x1af50)
- InitiateShutdownA (Ordinal: 1402, Address: 0x420b0)
- InitiateShutdownW (Ordinal: 1403, Address: 0x19730)
- InitiateSystemShutdownA (Ordinal: 1404, Address: 0x421f0)
- InitiateSystemShutdownExA (Ordinal: 1405, Address: 0x42340)
- InitiateSystemShutdownExW (Ordinal: 1406, Address: 0x44790)
- InitiateSystemShutdownW (Ordinal: 1407, Address: 0x42490)
- InstallApplication (Ordinal: 1408, Address: 0x34b00)
- IsTextUnicode (Ordinal: 1409, Address: 0x16320)
- IsTokenRestricted (Ordinal: 1410, Address: 0x2eb70)
- IsTokenUntrusted (Ordinal: 1411, Address: 0x364b0)
- IsValidAcl (Ordinal: 1412, Address: 0x2eb90)
- IsValidRelativeSecurityDescriptor (Ordinal: 1413, Address: 0x95294)
- IsValidSecurityDescriptor (Ordinal: 1414, Address: 0x2ebb0)
- IsValidSid (Ordinal: 1415, Address: 0x16d40)
- IsWellKnownSid (Ordinal: 1416, Address: 0x1bf10)
- LockServiceDatabase (Ordinal: 1417, Address: 0x45490)
- LogonUserA (Ordinal: 1418, Address: 0x48320)
- LogonUserExA (Ordinal: 1419, Address: 0x48510)
- LogonUserExExW (Ordinal: 1420, Address: 0x2ebd0)
- LogonUserExW (Ordinal: 1421, Address: 0x48570)
- LogonUserW (Ordinal: 1422, Address: 0x1b850)
- LookupAccountNameA (Ordinal: 1423, Address: 0x46170)
- LookupAccountNameW (Ordinal: 1424, Address: 0x167b0)
- LookupAccountSidA (Ordinal: 1425, Address: 0x466c0)
- LookupAccountSidW (Ordinal: 1426, Address: 0x16830)
- LookupPrivilegeDisplayNameA (Ordinal: 1427, Address: 0x46dc0)
- LookupPrivilegeDisplayNameW (Ordinal: 1428, Address: 0x46fd0)
- LookupPrivilegeNameA (Ordinal: 1429, Address: 0x47170)
- LookupPrivilegeNameW (Ordinal: 1430, Address: 0x47320)
- LookupPrivilegeValueA (Ordinal: 1431, Address: 0x12920)
- LookupPrivilegeValueW (Ordinal: 1432, Address: 0xf9a0)
- LookupSecurityDescriptorPartsA (Ordinal: 1433, Address: 0x3d150)
- LookupSecurityDescriptorPartsW (Ordinal: 1434, Address: 0x3d420)
- LsaAddAccountRights (Ordinal: 1435, Address: 0x2ec50)
- LsaAddPrivilegesToAccount (Ordinal: 1436, Address: 0x30c10)
- LsaClearAuditLog (Ordinal: 1437, Address: 0x30ca0)
- LsaClose (Ordinal: 1438, Address: 0x1bca0)
- LsaCreateAccount (Ordinal: 1439, Address: 0x30d30)
- LsaCreateSecret (Ordinal: 1440, Address: 0x2ec60)
- LsaCreateTrustedDomain (Ordinal: 1441, Address: 0x30e40)
- LsaCreateTrustedDomainEx (Ordinal: 1442, Address: 0x32a80)
- LsaDelete (Ordinal: 1443, Address: 0x2ec70)
- LsaDeleteTrustedDomain (Ordinal: 1444, Address: 0x32bd0)
- LsaEnumerateAccountRights (Ordinal: 1445, Address: 0x2ec80)
- LsaEnumerateAccounts (Ordinal: 1446, Address: 0x30f50)
- LsaEnumerateAccountsWithUserRight (Ordinal: 1447, Address: 0x2ec90)
- LsaEnumeratePrivileges (Ordinal: 1448, Address: 0x31030)
- LsaEnumeratePrivilegesOfAccount (Ordinal: 1449, Address: 0x31110)
- LsaEnumerateTrustedDomains (Ordinal: 1450, Address: 0x311a0)
- LsaEnumerateTrustedDomainsEx (Ordinal: 1451, Address: 0x32c60)
- LsaFreeMemory (Ordinal: 1452, Address: 0x1bad0)
- LsaGetAppliedCAPIDs (Ordinal: 1453, Address: 0x31290)
- LsaGetQuotasForAccount (Ordinal: 1454, Address: 0x31410)
- LsaGetRemoteUserName (Ordinal: 1455, Address: 0x314a0)
- LsaGetSystemAccessAccount (Ordinal: 1456, Address: 0x316a0)
- LsaGetUserName (Ordinal: 1457, Address: 0x11b90)
- LsaICLookupNames (Ordinal: 1458, Address: 0x2eca0)
- LsaICLookupNamesWithCreds (Ordinal: 1459, Address: 0x2ed00)
- LsaICLookupSids (Ordinal: 1460, Address: 0x2ed80)
- LsaICLookupSidsWithCreds (Ordinal: 1461, Address: 0x2ed90)
- LsaLookupNames (Ordinal: 1462, Address: 0x31730)
- LsaLookupNames2 (Ordinal: 1463, Address: 0x2ee10)
- LsaLookupPrivilegeDisplayName (Ordinal: 1464, Address: 0x318c0)
- LsaLookupPrivilegeName (Ordinal: 1465, Address: 0x31bd0)
- LsaLookupPrivilegeValue (Ordinal: 1466, Address: 0xfab0)
- LsaLookupSids (Ordinal: 1467, Address: 0x1baa0)
- LsaLookupSids2 (Ordinal: 1468, Address: 0x2ee20)
- LsaManageSidNameMapping (Ordinal: 1469, Address: 0x32d50)
- LsaNtStatusToWinError (Ordinal: 1470, Address: 0x15fb0)
- LsaOpenAccount (Ordinal: 1471, Address: 0x31c90)
- LsaOpenPolicy (Ordinal: 1472, Address: 0x1bcb0)
- LsaOpenPolicySce (Ordinal: 1473, Address: 0x31da0)
- LsaOpenSecret (Ordinal: 1474, Address: 0x2ee30)
- LsaOpenTrustedDomain (Ordinal: 1475, Address: 0x31eb0)
- LsaOpenTrustedDomainByName (Ordinal: 1476, Address: 0x32eb0)
- LsaQueryCAPs (Ordinal: 1477, Address: 0x31fc0)
- LsaQueryDomainInformationPolicy (Ordinal: 1478, Address: 0x32fc0)
- LsaQueryForestTrustInformation (Ordinal: 1479, Address: 0x33070)
- LsaQueryInfoTrustedDomain (Ordinal: 1480, Address: 0x32140)
- LsaQueryInformationPolicy (Ordinal: 1481, Address: 0x1bcc0)
- LsaQuerySecret (Ordinal: 1482, Address: 0x2ee40)
- LsaQuerySecurityObject (Ordinal: 1483, Address: 0x32220)
- LsaQueryTrustedDomainInfo (Ordinal: 1484, Address: 0x33110)
- LsaQueryTrustedDomainInfoByName (Ordinal: 1485, Address: 0x33200)
- LsaRemoveAccountRights (Ordinal: 1486, Address: 0x2ee50)
- LsaRemovePrivilegesFromAccount (Ordinal: 1487, Address: 0x322f0)
- LsaRetrievePrivateData (Ordinal: 1488, Address: 0x2ee60)
- LsaSetCAPs (Ordinal: 1489, Address: 0x32390)
- LsaSetDomainInformationPolicy (Ordinal: 1490, Address: 0x332b0)
- LsaSetForestTrustInformation (Ordinal: 1491, Address: 0x33350)
- LsaSetInformationPolicy (Ordinal: 1492, Address: 0x2ee70)
- LsaSetInformationTrustedDomain (Ordinal: 1493, Address: 0x324e0)
- LsaSetQuotasForAccount (Ordinal: 1494, Address: 0x32740)
- LsaSetSecret (Ordinal: 1495, Address: 0x2ee80)
- LsaSetSecurityObject (Ordinal: 1496, Address: 0x327d0)
- LsaSetSystemAccessAccount (Ordinal: 1497, Address: 0x32930)
- LsaSetTrustedDomainInfoByName (Ordinal: 1498, Address: 0x33410)
- LsaSetTrustedDomainInformation (Ordinal: 1499, Address: 0x33690)
- LsaStorePrivateData (Ordinal: 1500, Address: 0x2eef0)
- MD4Final (Ordinal: 1501, Address: 0x95a1d)
- MD4Init (Ordinal: 1502, Address: 0x95a34)
- MD4Update (Ordinal: 1503, Address: 0x95a4c)
- MD5Final (Ordinal: 1504, Address: 0x95a65)
- MD5Init (Ordinal: 1505, Address: 0x95a7c)
- MD5Update (Ordinal: 1506, Address: 0x95a94)
- MIDL_user_free_Ext (Ordinal: 1507, Address: 0x16f00)
- MSChapSrvChangePassword (Ordinal: 1508, Address: 0x2f650)
- MSChapSrvChangePassword2 (Ordinal: 1509, Address: 0x2f910)
- MakeAbsoluteSD (Ordinal: 1510, Address: 0x1d110)
- MakeAbsoluteSD2 (Ordinal: 1511, Address: 0x2ef00)
- MakeSelfRelativeSD (Ordinal: 1512, Address: 0x2ef20)
- MapGenericMask (Ordinal: 1513, Address: 0x2ef40)
- NotifyBootConfigStatus (Ordinal: 1514, Address: 0x1c8c0)
- NotifyChangeEventLog (Ordinal: 1515, Address: 0x500c0)
- NotifyServiceStatusChange (Ordinal: 1516, Address: 0x1dec0)
- NotifyServiceStatusChangeA (Ordinal: 1517, Address: 0x2ef60)
- NotifyServiceStatusChangeW (Ordinal: 1518, Address: 0x1d400)
- NpGetUserName (Ordinal: 1519, Address: 0x485d0)
- ObjectCloseAuditAlarmA (Ordinal: 1520, Address: 0x474a0)
- ObjectCloseAuditAlarmW (Ordinal: 1521, Address: 0x2ef80)
- ObjectDeleteAuditAlarmA (Ordinal: 1522, Address: 0x47550)
- ObjectDeleteAuditAlarmW (Ordinal: 1523, Address: 0x2efa0)
- ObjectOpenAuditAlarmA (Ordinal: 1524, Address: 0x47600)
- ObjectOpenAuditAlarmW (Ordinal: 1525, Address: 0x2efc0)
- ObjectPrivilegeAuditAlarmA (Ordinal: 1526, Address: 0x477c0)
- ObjectPrivilegeAuditAlarmW (Ordinal: 1527, Address: 0x2f040)
- OpenBackupEventLogA (Ordinal: 1528, Address: 0x50100)
- OpenBackupEventLogW (Ordinal: 1529, Address: 0x50220)
- OpenEncryptedFileRawA (Ordinal: 1530, Address: 0x2d0f0)
- OpenEncryptedFileRawW (Ordinal: 1531, Address: 0x2d1b0)
- OpenEventLogA (Ordinal: 1532, Address: 0x50300)
- OpenEventLogW (Ordinal: 1533, Address: 0x1c320)
- OpenProcessToken (Ordinal: 1534, Address: 0x16a80)
- OpenSCManagerA (Ordinal: 1535, Address: 0x17df0)
- OpenSCManagerW (Ordinal: 1536, Address: 0x17940)
- OpenServiceA (Ordinal: 1537, Address: 0x2f060)
- OpenServiceW (Ordinal: 1538, Address: 0x17b60)
- OpenThreadToken (Ordinal: 1539, Address: 0x16a60)
- OpenThreadWaitChainSession (Ordinal: 1540, Address: 0x61260)
- OpenTraceA (Ordinal: 1541, Address: 0x41ea0)
- OpenTraceW (Ordinal: 1542, Address: 0x17cd0)
- OperationEnd (Ordinal: 1543, Address: 0x2fc70)
- OperationStart (Ordinal: 1544, Address: 0x2fd70)
- PerfAddCounters (Ordinal: 1545, Address: 0x11a0)
- PerfCloseQueryHandle (Ordinal: 1546, Address: 0x1430)
- PerfCreateInstance (Ordinal: 1547, Address: 0x95dc1)
- PerfDecrementULongCounterValue (Ordinal: 1548, Address: 0x95e17)
- PerfDecrementULongLongCounterValue (Ordinal: 1549, Address: 0x95e7d)
- PerfDeleteCounters (Ordinal: 1550, Address: 0x42960)
- PerfDeleteInstance (Ordinal: 1551, Address: 0x95eea)
- PerfEnumerateCounterSet (Ordinal: 1552, Address: 0x5f30)
- PerfEnumerateCounterSetInstances (Ordinal: 1553, Address: 0x2cd0)
- PerfIncrementULongCounterValue (Ordinal: 1554, Address: 0x95f79)
- PerfIncrementULongLongCounterValue (Ordinal: 1555, Address: 0x95fdf)
- PerfOpenQueryHandle (Ordinal: 1556, Address: 0x3ef0)
- PerfQueryCounterData (Ordinal: 1557, Address: 0x1ca0)
- PerfQueryCounterInfo (Ordinal: 1558, Address: 0x1270)
- PerfQueryCounterSetRegistrationInfo (Ordinal: 1559, Address: 0x5d10)
- PerfQueryInstance (Ordinal: 1560, Address: 0x9609a)
- PerfRegCloseKey (Ordinal: 1561, Address: 0x120d0)
- PerfRegEnumKey (Ordinal: 1562, Address: 0x52430)
- PerfRegEnumValue (Ordinal: 1563, Address: 0x52490)
- PerfRegQueryInfoKey (Ordinal: 1564, Address: 0x1af70)
- PerfRegQueryValue (Ordinal: 1565, Address: 0x9560)
- PerfRegSetValue (Ordinal: 1566, Address: 0x52630)
- PerfSetCounterRefValue (Ordinal: 1567, Address: 0x9614d)
- PerfSetCounterSetInfo (Ordinal: 1568, Address: 0x9619e)
- PerfSetULongCounterValue (Ordinal: 1569, Address: 0x961f1)
- PerfSetULongLongCounterValue (Ordinal: 1570, Address: 0x9624b)
- PerfStartProvider (Ordinal: 1571, Address: 0x9629e)
- PerfStartProviderEx (Ordinal: 1572, Address: 0x962e8)
- PerfStopProvider (Ordinal: 1573, Address: 0x96331)
- PrivilegeCheck (Ordinal: 1574, Address: 0x2f080)
- PrivilegedServiceAuditAlarmA (Ordinal: 1575, Address: 0x47890)
- PrivilegedServiceAuditAlarmW (Ordinal: 1576, Address: 0x2f0a0)
- ProcessIdleTasks (Ordinal: 1577, Address: 0x30280)
- ProcessIdleTasksW (Ordinal: 1578, Address: 0x30310)
- ProcessTrace (Ordinal: 1579, Address: 0x17d10)
- QueryAllTracesA (Ordinal: 1580, Address: 0x1dd40)
- QueryAllTracesW (Ordinal: 1581, Address: 0x4440)
- QueryLocalUserServiceName (Ordinal: 1582, Address: 0x1def0)
- QueryRecoveryAgentsOnEncryptedFile (Ordinal: 1583, Address: 0x2d220)
- QuerySecurityAccessMask (Ordinal: 1584, Address: 0x2f0c0)
- QueryServiceConfig2A (Ordinal: 1585, Address: 0x2f0e0)
- QueryServiceConfig2W (Ordinal: 1586, Address: 0x1d370)
- QueryServiceConfigA (Ordinal: 1587, Address: 0x2f100)
- QueryServiceConfigW (Ordinal: 1588, Address: 0x17bd0)
- QueryServiceDynamicInformation (Ordinal: 1589, Address: 0x2f120)
- QueryServiceLockStatusA (Ordinal: 1590, Address: 0x45520)
- QueryServiceLockStatusW (Ordinal: 1591, Address: 0x456b0)
- QueryServiceObjectSecurity (Ordinal: 1592, Address: 0x2f140)
- QueryServiceStatus (Ordinal: 1593, Address: 0x1d3c0)
- QueryServiceStatusEx (Ordinal: 1594, Address: 0x17c70)
- QueryTraceA (Ordinal: 1595, Address: 0x41d20)
- QueryTraceProcessingHandle (Ordinal: 1596, Address: 0x2f160)
- QueryTraceW (Ordinal: 1597, Address: 0x1d390)
- QueryUserServiceName (Ordinal: 1598, Address: 0x1df00)
- QueryUserServiceNameForContext (Ordinal: 1599, Address: 0x1df10)
- QueryUsersOnEncryptedFile (Ordinal: 1600, Address: 0x2d2a0)
- ReadEncryptedFileRaw (Ordinal: 1601, Address: 0x2d320)
- ReadEventLogA (Ordinal: 1602, Address: 0x50390)
- ReadEventLogW (Ordinal: 1603, Address: 0x50430)
- RegCloseKey (Ordinal: 1604, Address: 0x16a20)
- RegConnectRegistryA (Ordinal: 1605, Address: 0x42de0)
- RegConnectRegistryExA (Ordinal: 1606, Address: 0x42e00)
- RegConnectRegistryExW (Ordinal: 1607, Address: 0x1b990)
- RegConnectRegistryW (Ordinal: 1608, Address: 0x1b970)
- RegCopyTreeA (Ordinal: 1609, Address: 0x431a0)
- RegCopyTreeW (Ordinal: 1610, Address: 0x2f180)
- RegCreateKeyA (Ordinal: 1611, Address: 0x43220)
- RegCreateKeyExA (Ordinal: 1612, Address: 0x179a0)
- RegCreateKeyExW (Ordinal: 1613, Address: 0x16d60)
- RegCreateKeyTransactedA (Ordinal: 1614, Address: 0x432b0)
- RegCreateKeyTransactedW (Ordinal: 1615, Address: 0x1c920)
- RegCreateKeyW (Ordinal: 1616, Address: 0x17030)
- RegDeleteKeyA (Ordinal: 1617, Address: 0x40c0)
- RegDeleteKeyExA (Ordinal: 1618, Address: 0x2f1a0)
- RegDeleteKeyExW (Ordinal: 1619, Address: 0x2f1c0)
- RegDeleteKeyTransactedA (Ordinal: 1620, Address: 0x434a0)
- RegDeleteKeyTransactedW (Ordinal: 1621, Address: 0x448d0)
- RegDeleteKeyValueA (Ordinal: 1622, Address: 0x2f1e0)
- RegDeleteKeyValueW (Ordinal: 1623, Address: 0x1d490)
- RegDeleteKeyW (Ordinal: 1624, Address: 0x16d80)
- RegDeleteTreeA (Ordinal: 1625, Address: 0x2f200)
- RegDeleteTreeW (Ordinal: 1626, Address: 0x2f220)
- RegDeleteValueA (Ordinal: 1627, Address: 0x4460)
- RegDeleteValueW (Ordinal: 1628, Address: 0x19710)
- RegDisablePredefinedCache (Ordinal: 1629, Address: 0x17b80)
- RegDisablePredefinedCacheEx (Ordinal: 1630, Address: 0x2f240)
- RegDisableReflectionKey (Ordinal: 1631, Address: 0x19490)
- RegEnableReflectionKey (Ordinal: 1632, Address: 0x19490)
- RegEnumKeyA (Ordinal: 1633, Address: 0x1bcf0)
- RegEnumKeyExA (Ordinal: 1634, Address: 0x4120)
- RegEnumKeyExW (Ordinal: 1635, Address: 0x15950)
- RegEnumKeyW (Ordinal: 1636, Address: 0x16730)
- RegEnumValueA (Ordinal: 1637, Address: 0x2f260)
- RegEnumValueW (Ordinal: 1638, Address: 0x169d0)
- RegFlushKey (Ordinal: 1639, Address: 0x1b300)
- RegGetKeySecurity (Ordinal: 1640, Address: 0x1d270)
- RegGetValueA (Ordinal: 1641, Address: 0x2f2b0)
- RegGetValueW (Ordinal: 1642, Address: 0x1b2c0)
- RegLoadAppKeyA (Ordinal: 1643, Address: 0x2f2d0)
- RegLoadAppKeyW (Ordinal: 1644, Address: 0x2f2f0)
- RegLoadKeyA (Ordinal: 1645, Address: 0x2f310)
- RegLoadKeyW (Ordinal: 1646, Address: 0x2f330)
- RegLoadMUIStringA (Ordinal: 1647, Address: 0x2f350)
- RegLoadMUIStringW (Ordinal: 1648, Address: 0x2f370)
- RegNotifyChangeKeyValue (Ordinal: 1649, Address: 0x17ae0)
- RegOpenCurrentUser (Ordinal: 1650, Address: 0x17cf0)
- RegOpenKeyA (Ordinal: 1651, Address: 0x19680)
- RegOpenKeyExA (Ordinal: 1652, Address: 0x16ee0)
- RegOpenKeyExW (Ordinal: 1653, Address: 0x15f40)
- RegOpenKeyTransactedA (Ordinal: 1654, Address: 0x43350)
- RegOpenKeyTransactedW (Ordinal: 1655, Address: 0x17870)
- RegOpenKeyW (Ordinal: 1656, Address: 0x16c50)
- RegOpenUserClassesRoot (Ordinal: 1657, Address: 0x2f390)
- RegOverridePredefKey (Ordinal: 1658, Address: 0x43390)
- RegQueryInfoKeyA (Ordinal: 1659, Address: 0x42d0)
- RegQueryInfoKeyW (Ordinal: 1660, Address: 0x16490)
- RegQueryMultipleValuesA (Ordinal: 1661, Address: 0x2f3b0)
- RegQueryMultipleValuesW (Ordinal: 1662, Address: 0x2f3d0)
- RegQueryReflectionKey (Ordinal: 1663, Address: 0x2fc60)
- RegQueryValueA (Ordinal: 1664, Address: 0x438a0)
- RegQueryValueExA (Ordinal: 1665, Address: 0x17010)
- RegQueryValueExW (Ordinal: 1666, Address: 0x15f20)
- RegQueryValueW (Ordinal: 1667, Address: 0x16aa0)
- RegRenameKey (Ordinal: 1668, Address: 0x43400)
- RegReplaceKeyA (Ordinal: 1669, Address: 0x43bc0)
- RegReplaceKeyW (Ordinal: 1670, Address: 0x44910)
- RegRestoreKeyA (Ordinal: 1671, Address: 0x2f3f0)
- RegRestoreKeyW (Ordinal: 1672, Address: 0x2f410)
- RegSaveKeyA (Ordinal: 1673, Address: 0x43e30)
- RegSaveKeyExA (Ordinal: 1674, Address: 0x2f430)
- RegSaveKeyExW (Ordinal: 1675, Address: 0x2f450)
- RegSaveKeyW (Ordinal: 1676, Address: 0x44010)
- RegSetKeySecurity (Ordinal: 1677, Address: 0x1bd40)
- RegSetKeyValueA (Ordinal: 1678, Address: 0x2f470)
- RegSetKeyValueW (Ordinal: 1679, Address: 0x4400)
- RegSetValueA (Ordinal: 1680, Address: 0x441b0)
- RegSetValueExA (Ordinal: 1681, Address: 0x4170)
- RegSetValueExW (Ordinal: 1682, Address: 0x170e0)
- RegSetValueW (Ordinal: 1683, Address: 0x44320)
- RegUnLoadKeyA (Ordinal: 1684, Address: 0x2f490)
- RegUnLoadKeyW (Ordinal: 1685, Address: 0x2f4b0)
- RegisterEventSourceA (Ordinal: 1686, Address: 0x504c0)
- RegisterEventSourceW (Ordinal: 1687, Address: 0x17e10)
- RegisterIdleTask (Ordinal: 1688, Address: 0x30320)
- RegisterServiceCtrlHandlerA (Ordinal: 1689, Address: 0x1bf50)
- RegisterServiceCtrlHandlerExA (Ordinal: 1690, Address: 0x2f4d0)
- RegisterServiceCtrlHandlerExW (Ordinal: 1691, Address: 0x1b340)
- RegisterServiceCtrlHandlerW (Ordinal: 1692, Address: 0x17d90)
- RegisterTraceGuidsA (Ordinal: 1693, Address: 0x96c0c)
- RegisterTraceGuidsW (Ordinal: 1694, Address: 0x96c3d)
- RegisterWaitChainCOMCallback (Ordinal: 1695, Address: 0x61380)
- RemoteRegEnumKeyWrapper (Ordinal: 1696, Address: 0x434e0)
- RemoteRegEnumValueWrapper (Ordinal: 1697, Address: 0x43650)
- RemoteRegQueryInfoKeyWrapper (Ordinal: 1698, Address: 0x43780)
- RemoteRegQueryMultipleValues2Wrapper (Ordinal: 1699, Address: 0x444a0)
- RemoteRegQueryMultipleValuesWrapper (Ordinal: 1700, Address: 0x44620)
- RemoteRegQueryValueWrapper (Ordinal: 1701, Address: 0x43b20)
- RemoveTraceCallback (Ordinal: 1702, Address: 0x96d3e)
- RemoveUsersFromEncryptedFile (Ordinal: 1703, Address: 0x2d340)
- ReportEventA (Ordinal: 1704, Address: 0x50540)
- ReportEventW (Ordinal: 1705, Address: 0x181a0)
- RevertToSelf (Ordinal: 1706, Address: 0x16c30)
- SafeBaseRegGetKeySecurity (Ordinal: 1707, Address: 0x42920)
- SaferCloseLevel (Ordinal: 1708, Address: 0x15e60)
- SaferComputeTokenFromLevel (Ordinal: 1709, Address: 0x139e0)
- SaferCreateLevel (Ordinal: 1710, Address: 0x360c0)
- SaferGetLevelInformation (Ordinal: 1711, Address: 0x36790)
- SaferGetPolicyInformation (Ordinal: 1712, Address: 0x5a10)
- SaferIdentifyLevel (Ordinal: 1713, Address: 0xb790)
- SaferRecordEventLogEntry (Ordinal: 1714, Address: 0x38400)
- SaferSetLevelInformation (Ordinal: 1715, Address: 0x38b10)
- SaferSetPolicyInformation (Ordinal: 1716, Address: 0x372d0)
- SaferiChangeRegistryScope (Ordinal: 1717, Address: 0x39e70)
- SaferiCompareTokenLevels (Ordinal: 1718, Address: 0x13320)
- SaferiIsDllAllowed (Ordinal: 1719, Address: 0x37990)
- SaferiIsExecutableFileType (Ordinal: 1720, Address: 0x3a630)
- SaferiPopulateDefaultsInRegistry (Ordinal: 1721, Address: 0x39eb0)
- SaferiRecordEventLogEntry (Ordinal: 1722, Address: 0x38400)
- SaferiSearchMatchingHashRules (Ordinal: 1723, Address: 0x16e40)
- SetAclInformation (Ordinal: 1724, Address: 0x2f4f0)
- SetEncryptedFileMetadata (Ordinal: 1725, Address: 0x2cfb0)
- SetEntriesInAccessListA (Ordinal: 1726, Address: 0x3f640)
- SetEntriesInAccessListW (Ordinal: 1727, Address: 0x3f690)
- SetEntriesInAclA (Ordinal: 1728, Address: 0x3d6b0)
- SetEntriesInAclW (Ordinal: 1729, Address: 0x17dd0)
- SetEntriesInAuditListA (Ordinal: 1730, Address: 0x3f6e0)
- SetEntriesInAuditListW (Ordinal: 1731, Address: 0x3f720)
- SetFileSecurityA (Ordinal: 1732, Address: 0x47990)
- SetFileSecurityW (Ordinal: 1733, Address: 0x1d420)
- SetInformationCodeAuthzLevelW (Ordinal: 1734, Address: 0x38b10)
- SetInformationCodeAuthzPolicyW (Ordinal: 1735, Address: 0x372d0)
- SetKernelObjectSecurity (Ordinal: 1736, Address: 0x17d70)
- SetNamedSecurityInfoA (Ordinal: 1737, Address: 0x1baf0)
- SetNamedSecurityInfoExA (Ordinal: 1738, Address: 0x3f760)
- SetNamedSecurityInfoExW (Ordinal: 1739, Address: 0x3fbe0)
- SetNamedSecurityInfoW (Ordinal: 1740, Address: 0x1bef0)
- SetPrivateObjectSecurity (Ordinal: 1741, Address: 0x2f530)
- SetPrivateObjectSecurityEx (Ordinal: 1742, Address: 0x2f510)
- SetSecurityAccessMask (Ordinal: 1743, Address: 0x2f550)
- SetSecurityDescriptorControl (Ordinal: 1744, Address: 0x1bd60)
- SetSecurityDescriptorDacl (Ordinal: 1745, Address: 0x17530)
- SetSecurityDescriptorGroup (Ordinal: 1746, Address: 0x1b320)
- SetSecurityDescriptorOwner (Ordinal: 1747, Address: 0x178e0)
- SetSecurityDescriptorRMControl (Ordinal: 1748, Address: 0x2f570)
- SetSecurityDescriptorSacl (Ordinal: 1749, Address: 0x196f0)
- SetSecurityInfo (Ordinal: 1750, Address: 0x16f20)
- SetSecurityInfoExA (Ordinal: 1751, Address: 0x3fee0)
- SetSecurityInfoExW (Ordinal: 1752, Address: 0x40320)
- SetServiceBits (Ordinal: 1753, Address: 0x45860)
- SetServiceObjectSecurity (Ordinal: 1754, Address: 0x2f590)
- SetServiceStatus (Ordinal: 1755, Address: 0x17b40)
- SetThreadToken (Ordinal: 1756, Address: 0x16ff0)
- SetTokenInformation (Ordinal: 1757, Address: 0x2f5b0)
- SetTraceCallback (Ordinal: 1758, Address: 0x97251)
- SetUserFileEncryptionKey (Ordinal: 1759, Address: 0x2d3c0)
- SetUserFileEncryptionKeyEx (Ordinal: 1760, Address: 0x2d420)
- StartServiceA (Ordinal: 1761, Address: 0x2f5d0)
- StartServiceCtrlDispatcherA (Ordinal: 1762, Address: 0x1bf30)
- StartServiceCtrlDispatcherW (Ordinal: 1763, Address: 0x17d50)
- StartServiceW (Ordinal: 1764, Address: 0x1d3a0)
- StartTraceA (Ordinal: 1765, Address: 0x1dd50)
- StartTraceW (Ordinal: 1766, Address: 0x4420)
- StopTraceA (Ordinal: 1767, Address: 0x41d40)
- StopTraceW (Ordinal: 1768, Address: 0x2f5f0)
- SystemFunction001 (Ordinal: 1769, Address: 0x97332)
- SystemFunction002 (Ordinal: 1770, Address: 0x97360)
- SystemFunction003 (Ordinal: 1771, Address: 0x9738e)
- SystemFunction004 (Ordinal: 1772, Address: 0x973bc)
- SystemFunction005 (Ordinal: 1773, Address: 0x973ea)
- SystemFunction006 (Ordinal: 1774, Address: 0x97418)
- SystemFunction007 (Ordinal: 1775, Address: 0x97444)
- SystemFunction008 (Ordinal: 1776, Address: 0x97470)
- SystemFunction009 (Ordinal: 1777, Address: 0x9749c)
- SystemFunction010 (Ordinal: 1778, Address: 0x974c8)
- SystemFunction011 (Ordinal: 1779, Address: 0x974f4)
- SystemFunction012 (Ordinal: 1780, Address: 0x97520)
- SystemFunction013 (Ordinal: 1781, Address: 0x9754c)
- SystemFunction014 (Ordinal: 1782, Address: 0x97578)
- SystemFunction015 (Ordinal: 1783, Address: 0x975a4)
- SystemFunction016 (Ordinal: 1784, Address: 0x975d0)
- SystemFunction017 (Ordinal: 1785, Address: 0x30350)
- SystemFunction018 (Ordinal: 1786, Address: 0x9760e)
- SystemFunction019 (Ordinal: 1787, Address: 0x303b0)
- SystemFunction020 (Ordinal: 1788, Address: 0x9764c)
- SystemFunction021 (Ordinal: 1789, Address: 0x97678)
- SystemFunction022 (Ordinal: 1790, Address: 0x976a4)
- SystemFunction023 (Ordinal: 1791, Address: 0x976d0)
- SystemFunction024 (Ordinal: 1792, Address: 0x976fc)
- SystemFunction025 (Ordinal: 1793, Address: 0x97728)
- SystemFunction026 (Ordinal: 1794, Address: 0x97754)
- SystemFunction027 (Ordinal: 1795, Address: 0x97780)
- SystemFunction028 (Ordinal: 1796, Address: 0x977ac)
- SystemFunction029 (Ordinal: 1797, Address: 0x977da)
- SystemFunction030 (Ordinal: 1798, Address: 0x97808)
- SystemFunction031 (Ordinal: 1799, Address: 0x97834)
- SystemFunction032 (Ordinal: 1800, Address: 0x97860)
- SystemFunction033 (Ordinal: 1801, Address: 0x9788c)
- SystemFunction034 (Ordinal: 1802, Address: 0x978b8)
- SystemFunction035 (Ordinal: 1803, Address: 0x978e6)
- SystemFunction036 (Ordinal: 1804, Address: 0x97915)
- SystemFunction040 (Ordinal: 1805, Address: 0x97943)
- SystemFunction041 (Ordinal: 1806, Address: 0x97971)
- TraceEvent (Ordinal: 1807, Address: 0x97998)
- TraceEventInstance (Ordinal: 1808, Address: 0x979c2)
- TraceMessage (Ordinal: 1809, Address: 0x979eb)
- TraceMessageVa (Ordinal: 1810, Address: 0x97a10)
- TraceQueryInformation (Ordinal: 1811, Address: 0x97a3e)
- TraceSetInformation (Ordinal: 1812, Address: 0x2f610)
- TreeResetNamedSecurityInfoA (Ordinal: 1813, Address: 0x3cfd0)
- TreeResetNamedSecurityInfoW (Ordinal: 1814, Address: 0x41b0)
- TreeSetNamedSecurityInfoA (Ordinal: 1815, Address: 0x3cfd0)
- TreeSetNamedSecurityInfoW (Ordinal: 1816, Address: 0x3d930)
- TrusteeAccessToObjectA (Ordinal: 1817, Address: 0x40630)
- TrusteeAccessToObjectW (Ordinal: 1818, Address: 0x40890)
- UninstallApplication (Ordinal: 1819, Address: 0x34b10)
- UnlockServiceDatabase (Ordinal: 1820, Address: 0x458a0)
- UnregisterIdleTask (Ordinal: 1821, Address: 0x30330)
- UnregisterTraceGuids (Ordinal: 1822, Address: 0x97b7b)
- UpdateTraceA (Ordinal: 1823, Address: 0x41d60)
- UpdateTraceW (Ordinal: 1824, Address: 0x41d80)
- UsePinForEncryptedFilesA (Ordinal: 1825, Address: 0x2d530)
- UsePinForEncryptedFilesW (Ordinal: 1826, Address: 0x2d5c0)
- WaitServiceState (Ordinal: 1827, Address: 0x2f630)
- WmiCloseBlock (Ordinal: 1828, Address: 0x58430)
- WmiDevInstToInstanceNameA (Ordinal: 1829, Address: 0x584b0)
- WmiDevInstToInstanceNameW (Ordinal: 1830, Address: 0x585a0)
- WmiEnumerateGuids (Ordinal: 1831, Address: 0x58690)
- WmiExecuteMethodA (Ordinal: 1832, Address: 0x58860)
- WmiExecuteMethodW (Ordinal: 1833, Address: 0x58960)
- WmiFileHandleToInstanceNameA (Ordinal: 1834, Address: 0x58ce0)
- WmiFileHandleToInstanceNameW (Ordinal: 1835, Address: 0x58f50)
- WmiFreeBuffer (Ordinal: 1836, Address: 0x59150)
- WmiMofEnumerateResourcesA (Ordinal: 1837, Address: 0x5ab20)
- WmiMofEnumerateResourcesW (Ordinal: 1838, Address: 0x5ad60)
- WmiNotificationRegistrationA (Ordinal: 1839, Address: 0x591a0)
- WmiNotificationRegistrationW (Ordinal: 1840, Address: 0x59230)
- WmiOpenBlock (Ordinal: 1841, Address: 0x592c0)
- WmiQueryAllDataA (Ordinal: 1842, Address: 0x593c0)
- WmiQueryAllDataMultipleA (Ordinal: 1843, Address: 0x59430)
- WmiQueryAllDataMultipleW (Ordinal: 1844, Address: 0x594c0)
- WmiQueryAllDataW (Ordinal: 1845, Address: 0x596f0)
- WmiQueryGuidInformation (Ordinal: 1846, Address: 0x59960)
- WmiQuerySingleInstanceA (Ordinal: 1847, Address: 0x59a20)
- WmiQuerySingleInstanceMultipleA (Ordinal: 1848, Address: 0x59b10)
- WmiQuerySingleInstanceMultipleW (Ordinal: 1849, Address: 0x59cc0)
- WmiQuerySingleInstanceW (Ordinal: 1850, Address: 0x59f20)
- WmiReceiveNotificationsA (Ordinal: 1851, Address: 0x5a1b0)
- WmiReceiveNotificationsW (Ordinal: 1852, Address: 0x5a230)
- WmiSetSingleInstanceA (Ordinal: 1853, Address: 0x5a2b0)
- WmiSetSingleInstanceW (Ordinal: 1854, Address: 0x5a380)
- WmiSetSingleItemA (Ordinal: 1855, Address: 0x5a570)
- WmiSetSingleItemW (Ordinal: 1856, Address: 0x5a650)
- WriteEncryptedFileRaw (Ordinal: 1857, Address: 0x2d660)
Imported DLLs & Functions
api-ms-win-core-apiquery-l1-1-0.dll
- ApiSetQueryApiSetPresence (Address: 0x1800777a0)
api-ms-win-core-namedpipe-l1-1-0.dll
- ImpersonateNamedPipeClient (Address: 0x1800777b0)
api-ms-win-core-pcw-l1-1-0.dll
- PcwAddQueryItem (Address: 0x1800777f0)
- PcwCollectData (Address: 0x1800777d0)
- PcwCreateNotifier (Address: 0x1800777e8)
- PcwCreateQuery (Address: 0x1800777f8)
- PcwEnumerateInstances (Address: 0x1800777c8)
- PcwRemoveQueryItem (Address: 0x1800777c0)
- PcwSendNotification (Address: 0x1800777e0)
- PcwSendStatelessNotification (Address: 0x180077800)
- PcwSetQueryItemUserData (Address: 0x1800777d8)
api-ms-win-core-processthreads-l1-1-0.dll
- CreateThread (Address: 0x180077858)
- GetCurrentProcess (Address: 0x180077828)
- GetCurrentProcessId (Address: 0x180077838)
- GetCurrentThread (Address: 0x180077848)
- GetCurrentThreadId (Address: 0x180077840)
- GetPriorityClass (Address: 0x180077850)
- GetProcessId (Address: 0x180077860)
- OpenProcessToken (Address: 0x180077810)
- OpenThread (Address: 0x180077868)
- OpenThreadToken (Address: 0x180077820)
- SetThreadToken (Address: 0x180077818)
- TerminateProcess (Address: 0x180077830)
api-ms-win-core-processthreads-l1-1-1.dll
- OpenProcess (Address: 0x180077878)
api-ms-win-core-registry-l1-1-0.dll
- RegCloseKey (Address: 0x1800779c8)
- RegCopyTreeW (Address: 0x180077958)
- RegCreateKeyExA (Address: 0x1800778e8)
- RegCreateKeyExW (Address: 0x1800778f8)
- RegDeleteKeyExA (Address: 0x180077910)
- RegDeleteKeyExW (Address: 0x1800778b0)
- RegDeleteTreeA (Address: 0x180077888)
- RegDeleteTreeW (Address: 0x180077930)
- RegDeleteValueA (Address: 0x1800779b0)
- RegDeleteValueW (Address: 0x1800779a0)
- RegDisablePredefinedCacheEx (Address: 0x180077890)
- RegEnumKeyExA (Address: 0x1800779c0)
- RegEnumKeyExW (Address: 0x180077918)
- RegEnumValueA (Address: 0x180077998)
- RegEnumValueW (Address: 0x1800779b8)
- RegFlushKey (Address: 0x1800778f0)
- RegGetKeySecurity (Address: 0x1800778a0)
- RegGetValueA (Address: 0x1800778c8)
- RegGetValueW (Address: 0x180077988)
- RegLoadAppKeyA (Address: 0x180077948)
- RegLoadAppKeyW (Address: 0x1800778a8)
- RegLoadKeyA (Address: 0x180077960)
- RegLoadKeyW (Address: 0x180077978)
- RegLoadMUIStringA (Address: 0x1800778d8)
- RegLoadMUIStringW (Address: 0x180077938)
- RegNotifyChangeKeyValue (Address: 0x180077898)
- RegOpenCurrentUser (Address: 0x1800778b8)
- RegOpenKeyExA (Address: 0x180077980)
- RegOpenKeyExW (Address: 0x1800779d0)
- RegOpenUserClassesRoot (Address: 0x180077908)
- RegQueryInfoKeyA (Address: 0x180077970)
- RegQueryInfoKeyW (Address: 0x1800778c0)
- RegQueryValueExA (Address: 0x1800778e0)
- RegQueryValueExW (Address: 0x1800779d8)
- RegRestoreKeyA (Address: 0x1800779a8)
- RegRestoreKeyW (Address: 0x180077990)
- RegSaveKeyExA (Address: 0x1800778d0)
- RegSaveKeyExW (Address: 0x180077928)
- RegSetKeySecurity (Address: 0x180077920)
- RegSetValueExA (Address: 0x180077950)
- RegSetValueExW (Address: 0x180077940)
- RegUnLoadKeyA (Address: 0x180077900)
- RegUnLoadKeyW (Address: 0x180077968)
api-ms-win-core-registry-l1-1-1.dll
- RegDeleteKeyValueA (Address: 0x1800779e8)
- RegDeleteKeyValueW (Address: 0x180077a00)
- RegSetKeyValueA (Address: 0x1800779f0)
- RegSetKeyValueW (Address: 0x1800779f8)
api-ms-win-core-registry-l1-1-2.dll
- RegQueryMultipleValuesA (Address: 0x180077a10)
- RegQueryMultipleValuesW (Address: 0x180077a18)
api-ms-win-core-sysinfo-l1-1-0.dll
- GetComputerNameExA (Address: 0x180077a30)
- GetComputerNameExW (Address: 0x180077a38)
- GetLocalTime (Address: 0x180077a50)
- GetSystemDirectoryW (Address: 0x180077a60)
- GetSystemTime (Address: 0x180077a28)
- GetSystemTimeAsFileTime (Address: 0x180077a40)
- GetSystemWindowsDirectoryW (Address: 0x180077a58)
- GetTickCount (Address: 0x180077a48)
api-ms-win-core-timezone-l1-1-0.dll
- EnumDynamicTimeZoneInformation (Address: 0x180077a70)
- GetDynamicTimeZoneInformationEffectiveYears (Address: 0x180077a78)
api-ms-win-eventing-consumer-l1-1-0.dll
- CloseTrace (Address: 0x180077a88)
- OpenTraceW (Address: 0x180077a98)
- ProcessTrace (Address: 0x180077a90)
api-ms-win-eventing-consumer-l1-1-1.dll
- QueryTraceProcessingHandle (Address: 0x180077aa8)
api-ms-win-eventing-controller-l1-1-0.dll
- ControlTraceW (Address: 0x180077af0)
- EnableTraceEx2 (Address: 0x180077ac0)
- EnumerateTraceGuidsEx (Address: 0x180077ac8)
- EventAccessControl (Address: 0x180077af8)
- EventAccessQuery (Address: 0x180077ae0)
- EventAccessRemove (Address: 0x180077ad8)
- QueryAllTracesW (Address: 0x180077b00)
- StartTraceW (Address: 0x180077ae8)
- StopTraceW (Address: 0x180077ab8)
- TraceSetInformation (Address: 0x180077ad0)
api-ms-win-eventing-provider-l1-1-0.dll
- EventRegister (Address: 0x180077b18)
- EventSetInformation (Address: 0x180077b28)
- EventUnregister (Address: 0x180077b20)
- EventWriteTransfer (Address: 0x180077b10)
api-ms-win-security-audit-l1-1-0.dll
- AuditComputeEffectivePolicyBySid (Address: 0x180077b38)
- AuditFree (Address: 0x180077b40)
- AuditQuerySystemPolicy (Address: 0x180077b48)
- AuditSetSystemPolicy (Address: 0x180077b50)
api-ms-win-security-audit-l1-1-1.dll
- AuditEnumerateCategories (Address: 0x180077b90)
- AuditEnumeratePerUserPolicy (Address: 0x180077b70)
- AuditEnumerateSubCategories (Address: 0x180077b80)
- AuditLookupCategoryNameW (Address: 0x180077ba0)
- AuditLookupSubCategoryNameW (Address: 0x180077b60)
- AuditQueryGlobalSaclW (Address: 0x180077b88)
- AuditQueryPerUserPolicy (Address: 0x180077b98)
- AuditQuerySecurity (Address: 0x180077b68)
- AuditSetGlobalSaclW (Address: 0x180077ba8)
- AuditSetPerUserPolicy (Address: 0x180077b78)
- AuditSetSecurity (Address: 0x180077bb0)
api-ms-win-security-base-l1-1-0.dll
- AccessCheck (Address: 0x180077d90)
- AccessCheckAndAuditAlarmW (Address: 0x180077e20)
- AccessCheckByType (Address: 0x180077d48)
- AccessCheckByTypeAndAuditAlarmW (Address: 0x180077e80)
- AccessCheckByTypeResultList (Address: 0x180077d78)
- AccessCheckByTypeResultListAndAuditAlarmByHandleW (Address: 0x180077bd8)
- AccessCheckByTypeResultListAndAuditAlarmW (Address: 0x180077c70)
- AddAccessAllowedAce (Address: 0x180077d30)
- AddAccessAllowedAceEx (Address: 0x180077d00)
- AddAccessAllowedObjectAce (Address: 0x180077ce0)
- AddAccessDeniedAce (Address: 0x180077c88)
- AddAccessDeniedAceEx (Address: 0x180077de0)
- AddAccessDeniedObjectAce (Address: 0x180077d38)
- AddAce (Address: 0x180077c60)
- AddAuditAccessAce (Address: 0x180077c68)
- AddAuditAccessAceEx (Address: 0x180077d50)
- AddAuditAccessObjectAce (Address: 0x180077e48)
- AdjustTokenGroups (Address: 0x180077e28)
- AdjustTokenPrivileges (Address: 0x180077e90)
- AllocateAndInitializeSid (Address: 0x180077bd0)
- AllocateLocallyUniqueId (Address: 0x180077e50)
- AreAllAccessesGranted (Address: 0x180077e10)
- AreAnyAccessesGranted (Address: 0x180077bf8)
- CheckTokenMembership (Address: 0x180077cb8)
- ConvertToAutoInheritPrivateObjectSecurity (Address: 0x180077e00)
- CopySid (Address: 0x180077dc0)
- CreatePrivateObjectSecurity (Address: 0x180077de8)
- CreatePrivateObjectSecurityEx (Address: 0x180077e30)
- CreatePrivateObjectSecurityWithMultipleInheritance (Address: 0x180077e18)
- CreateRestrictedToken (Address: 0x180077c90)
- CreateWellKnownSid (Address: 0x180077df0)
- DeleteAce (Address: 0x180077d98)
- DestroyPrivateObjectSecurity (Address: 0x180077da8)
- DuplicateToken (Address: 0x180077cd0)
- DuplicateTokenEx (Address: 0x180077d18)
- EqualDomainSid (Address: 0x180077c48)
- EqualPrefixSid (Address: 0x180077ca0)
- EqualSid (Address: 0x180077c08)
- FindFirstFreeAce (Address: 0x180077e78)
- FreeSid (Address: 0x180077c98)
- GetAce (Address: 0x180077c10)
- GetAclInformation (Address: 0x180077e38)
- GetFileSecurityW (Address: 0x180077ca8)
- GetKernelObjectSecurity (Address: 0x180077ce8)
- GetLengthSid (Address: 0x180077d08)
- GetPrivateObjectSecurity (Address: 0x180077df8)
- GetSecurityDescriptorControl (Address: 0x180077dc8)
- GetSecurityDescriptorDacl (Address: 0x180077e58)
- GetSecurityDescriptorGroup (Address: 0x180077bc8)
- GetSecurityDescriptorLength (Address: 0x180077d28)
- GetSecurityDescriptorOwner (Address: 0x180077c30)
- GetSecurityDescriptorRMControl (Address: 0x180077c18)
- GetSecurityDescriptorSacl (Address: 0x180077e70)
- GetSidIdentifierAuthority (Address: 0x180077d68)
- GetSidLengthRequired (Address: 0x180077e60)
- GetSidSubAuthority (Address: 0x180077bc0)
- GetSidSubAuthorityCount (Address: 0x180077be8)
- GetTokenInformation (Address: 0x180077d70)
- GetWindowsAccountDomainSid (Address: 0x180077e08)
- ImpersonateAnonymousToken (Address: 0x180077c38)
- ImpersonateLoggedOnUser (Address: 0x180077ea8)
- ImpersonateSelf (Address: 0x180077c40)
- InitializeAcl (Address: 0x180077cc8)
- InitializeSecurityDescriptor (Address: 0x180077cc0)
- InitializeSid (Address: 0x180077da0)
- IsTokenRestricted (Address: 0x180077c28)
- IsValidAcl (Address: 0x180077d20)
- IsValidSecurityDescriptor (Address: 0x180077c80)
- IsValidSid (Address: 0x180077c58)
- IsWellKnownSid (Address: 0x180077db0)
- MakeAbsoluteSD (Address: 0x180077d58)
- MakeSelfRelativeSD (Address: 0x180077d40)
- MapGenericMask (Address: 0x180077cf0)
- ObjectCloseAuditAlarmW (Address: 0x180077d88)
- ObjectDeleteAuditAlarmW (Address: 0x180077be0)
- ObjectOpenAuditAlarmW (Address: 0x180077e68)
- ObjectPrivilegeAuditAlarmW (Address: 0x180077db8)
- PrivilegeCheck (Address: 0x180077d80)
- PrivilegedServiceAuditAlarmW (Address: 0x180077cb0)
- QuerySecurityAccessMask (Address: 0x180077ea0)
- RevertToSelf (Address: 0x180077dd0)
- SetAclInformation (Address: 0x180077c78)
- SetFileSecurityW (Address: 0x180077e40)
- SetKernelObjectSecurity (Address: 0x180077cf8)
- SetPrivateObjectSecurity (Address: 0x180077e98)
- SetPrivateObjectSecurityEx (Address: 0x180077cd8)
- SetSecurityAccessMask (Address: 0x180077dd8)
- SetSecurityDescriptorControl (Address: 0x180077d10)
- SetSecurityDescriptorDacl (Address: 0x180077e88)
- SetSecurityDescriptorGroup (Address: 0x180077d60)
- SetSecurityDescriptorOwner (Address: 0x180077c20)
- SetSecurityDescriptorRMControl (Address: 0x180077c00)
- SetSecurityDescriptorSacl (Address: 0x180077c50)
- SetTokenInformation (Address: 0x180077bf0)
api-ms-win-security-base-private-l1-1-0.dll
- MakeAbsoluteSD2 (Address: 0x180077eb8)
api-ms-win-service-core-l1-1-0.dll
- RegisterServiceCtrlHandlerExW (Address: 0x180077ed8)
- SetServiceStatus (Address: 0x180077ed0)
- StartServiceCtrlDispatcherW (Address: 0x180077ec8)
api-ms-win-service-core-l1-1-1.dll
- EnumDependentServicesW (Address: 0x180077ef8)
- EnumServicesStatusExW (Address: 0x180077ef0)
- QueryServiceDynamicInformation (Address: 0x180077ee8)
api-ms-win-service-core-l1-1-2.dll
- GetServiceDisplayNameW (Address: 0x180077f10)
- GetServiceKeyNameW (Address: 0x180077f08)
api-ms-win-service-management-l1-1-0.dll
- CloseServiceHandle (Address: 0x180077f50)
- ControlServiceExW (Address: 0x180077f38)
- CreateServiceW (Address: 0x180077f20)
- DeleteService (Address: 0x180077f40)
- OpenSCManagerW (Address: 0x180077f48)
- OpenServiceW (Address: 0x180077f28)
- StartServiceW (Address: 0x180077f30)
api-ms-win-service-management-l2-1-0.dll
- ChangeServiceConfig2W (Address: 0x180077f70)
- ChangeServiceConfigW (Address: 0x180077f90)
- NotifyServiceStatusChangeW (Address: 0x180077f78)
- QueryServiceConfig2W (Address: 0x180077f88)
- QueryServiceConfigW (Address: 0x180077f60)
- QueryServiceObjectSecurity (Address: 0x180077f80)
- QueryServiceStatusEx (Address: 0x180077f98)
- SetServiceObjectSecurity (Address: 0x180077f68)
api-ms-win-service-private-l1-1-0.dll
- I_ScRpcBindA (Address: 0x180077fc0)
- I_ScRpcBindW (Address: 0x180077fc8)
- I_ScSetServiceBitsA (Address: 0x180077fb0)
- I_ScSetServiceBitsW (Address: 0x180077fa8)
- WaitServiceState (Address: 0x180077fb8)
api-ms-win-service-private-l1-1-2.dll
- I_ScReparseServiceDatabase (Address: 0x180077fe8)
- QueryLocalUserServiceName (Address: 0x180077fd8)
- QueryUserServiceName (Address: 0x180077fe0)
api-ms-win-service-private-l1-1-3.dll
- QueryUserServiceNameForContext (Address: 0x180077ff8)
api-ms-win-service-private-l1-1-4.dll
- CreateServiceEx (Address: 0x180078008)
api-ms-win-service-winsvc-l1-1-0.dll
- ChangeServiceConfig2A (Address: 0x180078078)
- ChangeServiceConfigA (Address: 0x180078020)
- ControlService (Address: 0x180078088)
- ControlServiceExA (Address: 0x180078050)
- CreateServiceA (Address: 0x180078068)
- NotifyServiceStatusChangeA (Address: 0x180078040)
- OpenSCManagerA (Address: 0x180078048)
- OpenServiceA (Address: 0x180078030)
- QueryServiceConfig2A (Address: 0x180078070)
- QueryServiceConfigA (Address: 0x180078038)
- QueryServiceStatus (Address: 0x180078058)
- RegisterServiceCtrlHandlerA (Address: 0x180078080)
- RegisterServiceCtrlHandlerExA (Address: 0x180078090)
- RegisterServiceCtrlHandlerW (Address: 0x180078018)
- StartServiceA (Address: 0x180078028)
- StartServiceCtrlDispatcherA (Address: 0x180078060)
KERNEL32.dll
- AreFileApisANSI (Address: 0x1800774b8)
- CancelIoEx (Address: 0x1800775b0)
- CancelThreadpoolIo (Address: 0x1800775b8)
- CloseHandle (Address: 0x1800773a8)
- CloseThreadpoolIo (Address: 0x1800775a8)
- CompareFileTime (Address: 0x180077458)
- CompareStringOrdinal (Address: 0x180077490)
- CopyFileExW (Address: 0x180077558)
- CreateEventW (Address: 0x1800773a0)
- CreateFileMappingW (Address: 0x180077420)
- CreateFileW (Address: 0x1800773e0)
- CreateMutexW (Address: 0x1800774f0)
- CreateThreadpoolIo (Address: 0x1800775c0)
- DecodePointer (Address: 0x180077578)
- DelayLoadFailureHook (Address: 0x180077370)
- DeleteCriticalSection (Address: 0x180077478)
- DeleteFileW (Address: 0x180077400)
- DeviceIoControl (Address: 0x1800775c8)
- DosDateTimeToFileTime (Address: 0x180077530)
- DuplicateHandle (Address: 0x180077588)
- EncodePointer (Address: 0x180077598)
- EnterCriticalSection (Address: 0x180077348)
- EnumUILanguagesW (Address: 0x1800775e0)
- ExpandEnvironmentStringsA (Address: 0x180077328)
- ExpandEnvironmentStringsW (Address: 0x1800773d0)
- FileTimeToDosDateTime (Address: 0x180077528)
- FindClose (Address: 0x180077550)
- FindFirstFileExW (Address: 0x180077540)
- FindNextFileW (Address: 0x180077548)
- FindResourceExW (Address: 0x180077460)
- FormatMessageW (Address: 0x1800773e8)
- FreeLibrary (Address: 0x180077368)
- FreeLibraryAndExitThread (Address: 0x180077590)
- FreeLibraryWhenCallbackReturns (Address: 0x1800775a0)
- GetCommandLineW (Address: 0x1800773b8)
- GetComputerNameW (Address: 0x1800774a8)
- GetFileAttributesExW (Address: 0x1800773f0)
- GetFileAttributesW (Address: 0x1800774d0)
- GetFileMUIPath (Address: 0x1800775d8)
- GetFileSize (Address: 0x180077538)
- GetFileSizeEx (Address: 0x180077418)
- GetFileTime (Address: 0x180077520)
- GetFullPathNameW (Address: 0x1800774c8)
- GetLastError (Address: 0x180077358)
- GetLongPathNameW (Address: 0x180077450)
- GetModuleFileNameW (Address: 0x1800774b0)
- GetModuleHandleExW (Address: 0x1800773c0)
- GetModuleHandleW (Address: 0x180077410)
- GetProcAddress (Address: 0x180077360)
- GetProcessHeap (Address: 0x180077430)
- GetThreadUILanguage (Address: 0x1800773b0)
- GetVolumePathNameW (Address: 0x180077470)
- HeapAlloc (Address: 0x180077428)
- HeapFree (Address: 0x180077448)
- InitializeCriticalSection (Address: 0x1800774f8)
- InitOnceBeginInitialize (Address: 0x180077488)
- InitOnceComplete (Address: 0x1800774a0)
- LeaveCriticalSection (Address: 0x180077350)
- LoadLibraryA (Address: 0x1800774e8)
- LoadLibraryExA (Address: 0x1800774e0)
- LoadLibraryExW (Address: 0x180077380)
- LoadLibraryW (Address: 0x180077580)
- LoadResource (Address: 0x180077468)
- LocalFree (Address: 0x180077338)
- LockResource (Address: 0x180077508)
- MapViewOfFile (Address: 0x180077438)
- MoveFileW (Address: 0x180077408)
- MultiByteToWideChar (Address: 0x180077330)
- OutputDebugStringW (Address: 0x1800773f8)
- QueryPerformanceCounter (Address: 0x180077398)
- RaiseException (Address: 0x1800775f0)
- ReadProcessMemory (Address: 0x180077570)
- ReleaseMutex (Address: 0x180077498)
- ResetEvent (Address: 0x180077518)
- ResolveDelayLoadedAPI (Address: 0x180077378)
- SearchPathW (Address: 0x1800774c0)
- SetErrorMode (Address: 0x1800775e8)
- SetEvent (Address: 0x180077510)
- SetFileInformationByHandle (Address: 0x1800775f8)
- SetFilePointer (Address: 0x1800773d8)
- SetLastError (Address: 0x180077600)
- SetUnhandledExceptionFilter (Address: 0x180077390)
- SizeofResource (Address: 0x180077500)
- SleepEx (Address: 0x1800774d8)
- StartThreadpoolIo (Address: 0x1800775d0)
- TermsrvDeleteKey (Address: 0x180077560)
- TermsrvOpenUserClasses (Address: 0x180077568)
- UnhandledExceptionFilter (Address: 0x180077388)
- UnmapViewOfFile (Address: 0x180077440)
- WaitForSingleObject (Address: 0x180077480)
- WideCharToMultiByte (Address: 0x180077340)
- WriteFile (Address: 0x1800773c8)
KERNELBASE.dll
- CLOSE_LOCAL_HANDLE_INTERNAL (Address: 0x180077670)
- CreateProcessAsUserA (Address: 0x180077630)
- CreateProcessAsUserW (Address: 0x180077628)
- DisablePredefinedHandleTableInternal (Address: 0x180077698)
- GetStagedPackagePathByFullName (Address: 0x1800776a8)
- GetSystemDefaultUILanguage (Address: 0x180077638)
- GetUserDefaultUILanguage (Address: 0x180077640)
- LocalAlloc (Address: 0x180077618)
- LocalReAlloc (Address: 0x180077620)
- lstrcmpiW (Address: 0x180077610)
- lstrcmpW (Address: 0x1800776c0)
- lstrlenW (Address: 0x1800776d0)
- MapPredefinedHandleInternal (Address: 0x180077678)
- PackageIdFromFullName (Address: 0x1800776b0)
- RegCreateKeyExInternalA (Address: 0x180077690)
- RegCreateKeyExInternalW (Address: 0x180077660)
- RegDeleteKeyExInternalA (Address: 0x180077680)
- RegDeleteKeyExInternalW (Address: 0x180077658)
- RegKrnGetClassesEnumTableAddressInternal (Address: 0x180077650)
- RegKrnGetHKEY_ClassesRootAddress (Address: 0x1800776c8)
- RegKrnGetTermsrvRegistryExtensionFlags (Address: 0x180077648)
- RegOpenKeyExInternalA (Address: 0x1800776a0)
- RegOpenKeyExInternalW (Address: 0x180077668)
- RemapPredefinedHandleInternal (Address: 0x180077688)
- Sleep (Address: 0x1800776b8)
msvcrt.dll
- __C_specific_handler (Address: 0x1800781b0)
- __CxxFrameHandler3 (Address: 0x180078160)
- _errno (Address: 0x180078118)
- _i64tow_s (Address: 0x180078128)
- _resetstkoflw (Address: 0x180078140)
- _stricmp (Address: 0x180078130)
- _ui64tow_s (Address: 0x180078120)
- _ultow (Address: 0x180078108)
- _ultow_s (Address: 0x1800780e0)
- _vsnprintf (Address: 0x180078158)
- _vsnwprintf (Address: 0x180078190)
- _wcsicmp (Address: 0x1800780b8)
- _wcsnicmp (Address: 0x1800780c0)
- _wcstoi64 (Address: 0x180078168)
- _wcstoui64 (Address: 0x1800780f8)
- iswalpha (Address: 0x180078148)
- iswctype (Address: 0x1800780e8)
- memcmp (Address: 0x180078170)
- memcpy (Address: 0x180078178)
- memmove (Address: 0x180078180)
- memset (Address: 0x180078188)
- strchr (Address: 0x1800780d8)
- strstr (Address: 0x1800780d0)
- swprintf_s (Address: 0x1800780b0)
- swscanf_s (Address: 0x1800781a8)
- tolower (Address: 0x1800780c8)
- wcscat_s (Address: 0x1800780a8)
- wcschr (Address: 0x1800781a0)
- wcscmp (Address: 0x1800781c0)
- wcscpy_s (Address: 0x1800780a0)
- wcsncmp (Address: 0x180078150)
- wcsncpy_s (Address: 0x1800781b8)
- wcsnlen (Address: 0x180078138)
- wcsrchr (Address: 0x180078198)
- wcsstr (Address: 0x180078100)
- wcstok_s (Address: 0x180078110)
- wcstoul (Address: 0x1800780f0)
ntdll.dll
- DbgPrint (Address: 0x180078790)
- EtwEventRegister (Address: 0x1800782d0)
- EtwEventSetInformation (Address: 0x1800784e8)
- EtwEventUnregister (Address: 0x180078328)
- EtwEventWrite (Address: 0x1800782d8)
- EtwEventWriteTransfer (Address: 0x1800784e0)
- EtwGetTraceEnableFlags (Address: 0x180078530)
- EtwGetTraceEnableLevel (Address: 0x180078528)
- EtwGetTraceLoggerHandle (Address: 0x180078520)
- EtwRegisterTraceGuidsW (Address: 0x180078538)
- EtwTraceMessage (Address: 0x180078518)
- EtwUnregisterTraceGuids (Address: 0x180078540)
- LdrGetDllHandle (Address: 0x1800787d0)
- LdrGetProcedureAddress (Address: 0x1800787c8)
- LdrLoadDll (Address: 0x1800782a8)
- LdrUnloadDll (Address: 0x1800782b8)
- NtAlpcQueryInformation (Address: 0x180078688)
- NtClose (Address: 0x1800781e8)
- NtCompareTokens (Address: 0x180078238)
- NtCreateFile (Address: 0x1800785d8)
- NtCreateKey (Address: 0x1800782e0)
- NtCreateMutant (Address: 0x180078598)
- NtCreatePrivateNamespace (Address: 0x1800785a8)
- NtDeleteKey (Address: 0x180078300)
- NtDeviceIoControlFile (Address: 0x1800782c0)
- NtDuplicateToken (Address: 0x180078230)
- NtEnumerateKey (Address: 0x180078330)
- NtOpenFile (Address: 0x180078278)
- NtOpenKey (Address: 0x1800781d8)
- NtOpenKeyEx (Address: 0x1800787b8)
- NtOpenPrivateNamespace (Address: 0x1800785a0)
- NtOpenProcessToken (Address: 0x1800781f8)
- NtOpenSymbolicLinkObject (Address: 0x180078390)
- NtOpenThreadToken (Address: 0x1800781f0)
- NtQueryInformationFile (Address: 0x1800783b0)
- NtQueryInformationProcess (Address: 0x180078288)
- NtQueryInformationThread (Address: 0x180078558)
- NtQueryInformationToken (Address: 0x180078730)
- NtQueryKey (Address: 0x180078298)
- NtQueryMutant (Address: 0x1800786a0)
- NtQueryObject (Address: 0x180078698)
- NtQueryPerformanceCounter (Address: 0x180078588)
- NtQuerySecurityObject (Address: 0x180078560)
- NtQuerySymbolicLinkObject (Address: 0x180078398)
- NtQuerySystemInformation (Address: 0x1800782c8)
- NtQuerySystemTime (Address: 0x180078508)
- NtQueryValueKey (Address: 0x1800781e0)
- NtQueryVolumeInformationFile (Address: 0x180078388)
- NtReadFile (Address: 0x1800785e8)
- NtRenameKey (Address: 0x180078410)
- NtReplaceKey (Address: 0x1800786c0)
- NtSaveKey (Address: 0x1800786c8)
- NtSaveMergedKeys (Address: 0x1800786d0)
- NtSetInformationKey (Address: 0x1800787c0)
- NtSetInformationThread (Address: 0x180078430)
- NtSetInformationToken (Address: 0x180078218)
- NtSetSystemInformation (Address: 0x180078778)
- NtSetValueKey (Address: 0x1800782e8)
- NtTraceControl (Address: 0x1800783e8)
- NtWaitForMultipleObjects (Address: 0x1800785c0)
- NtWaitForSingleObject (Address: 0x180078548)
- NtWriteFile (Address: 0x1800785e0)
- RtlAbsoluteToSelfRelativeSD (Address: 0x1800784a0)
- RtlAcquireSRWLockExclusive (Address: 0x180078608)
- RtlAcquireSRWLockShared (Address: 0x180078620)
- RtlAddAccessAllowedAce (Address: 0x1800786b0)
- RtlAddAccessAllowedAceEx (Address: 0x180078210)
- RtlAddAccessAllowedObjectAce (Address: 0x1800784b0)
- RtlAddAccessDeniedAceEx (Address: 0x1800784a8)
- RtlAddAccessDeniedObjectAce (Address: 0x180078748)
- RtlAddAce (Address: 0x180078438)
- RtlAddAuditAccessAceEx (Address: 0x180078480)
- RtlAddAuditAccessObjectAce (Address: 0x180078460)
- RtlAddSIDToBoundaryDescriptor (Address: 0x1800785b0)
- RtlAdjustPrivilege (Address: 0x1800784f8)
- RtlAllocateAndInitializeSid (Address: 0x180078240)
- RtlAllocateHandle (Address: 0x1800787f0)
- RtlAllocateHeap (Address: 0x180078740)
- RtlAnsiCharToUnicodeChar (Address: 0x1800783d8)
- RtlAnsiStringToUnicodeString (Address: 0x1800787e0)
- RtlAppendUnicodeStringToString (Address: 0x180078348)
- RtlAppendUnicodeToString (Address: 0x1800782f8)
- RtlCaptureContext (Address: 0x180078760)
- RtlConvertSidToUnicodeString (Address: 0x1800786f8)
- RtlCopySid (Address: 0x180078310)
- RtlCopyString (Address: 0x180078500)
- RtlCopyUnicodeString (Address: 0x180078260)
- RtlCreateAcl (Address: 0x1800785c8)
- RtlCreateBoundaryDescriptor (Address: 0x1800785b8)
- RtlCreateQueryDebugBuffer (Address: 0x180078690)
- RtlCreateSecurityDescriptor (Address: 0x180078220)
- RtlCreateUnicodeString (Address: 0x180078280)
- RtlCreateUnicodeStringFromAsciiz (Address: 0x180078408)
- RtlDeleteBoundaryDescriptor (Address: 0x180078590)
- RtlDeleteCriticalSection (Address: 0x180078770)
- RtlDeleteElementGenericTable (Address: 0x1800782f0)
- RtlDeleteElementGenericTableAvl (Address: 0x180078640)
- RtlDestroyHandleTable (Address: 0x180078320)
- RtlDestroyQueryDebugBuffer (Address: 0x180078678)
- RtlDetermineDosPathNameType_U (Address: 0x1800783a8)
- RtlDllShutdownInProgress (Address: 0x180078578)
- RtlDosPathNameToNtPathName_U (Address: 0x1800784d8)
- RtlDosPathNameToRelativeNtPathName_U (Address: 0x180078658)
- RtlDuplicateUnicodeString (Address: 0x180078268)
- RtlEnterCriticalSection (Address: 0x180078788)
- RtlEnumerateGenericTableAvl (Address: 0x180078638)
- RtlEnumerateGenericTableWithoutSplaying (Address: 0x180078258)
- RtlEqualSid (Address: 0x180078200)
- RtlEqualUnicodeString (Address: 0x180078670)
- RtlExpandEnvironmentStrings_U (Address: 0x180078270)
- RtlFirstFreeAce (Address: 0x1800784c0)
- RtlFormatCurrentUserKeyPath (Address: 0x180078350)
- RtlFreeAnsiString (Address: 0x1800787e8)
- RtlFreeHandle (Address: 0x1800781d0)
- RtlFreeHeap (Address: 0x180078720)
- RtlFreeSid (Address: 0x180078248)
- RtlFreeUnicodeString (Address: 0x180078738)
- RtlGetAce (Address: 0x180078478)
- RtlGetControlSecurityDescriptor (Address: 0x180078458)
- RtlGetCurrentTransaction (Address: 0x1800787b0)
- RtlGetDaclSecurityDescriptor (Address: 0x1800784d0)
- RtlGetFullPathName_U (Address: 0x1800783b8)
- RtlGetGroupSecurityDescriptor (Address: 0x180078498)
- RtlGetLastNtStatus (Address: 0x180078290)
- RtlGetNtProductType (Address: 0x1800786e8)
- RtlGetOwnerSecurityDescriptor (Address: 0x180078490)
- RtlGetSaclSecurityDescriptor (Address: 0x180078470)
- RtlGetThreadPreferredUILanguages (Address: 0x180078710)
- RtlGetVersion (Address: 0x180078550)
- RtlGUIDFromString (Address: 0x180078378)
- RtlImageNtHeader (Address: 0x1800782b0)
- RtlImpersonateSelf (Address: 0x1800784f0)
- RtlInitAnsiString (Address: 0x1800787a0)
- RtlInitAnsiStringEx (Address: 0x1800783f8)
- RtlInitializeCriticalSection (Address: 0x180078768)
- RtlInitializeGenericTable (Address: 0x180078358)
- RtlInitializeGenericTableAvl (Address: 0x180078648)
- RtlInitializeHandleTable (Address: 0x180078318)
- RtlInitializeSid (Address: 0x180078450)
- RtlInitializeSRWLock (Address: 0x180078668)
- RtlInitString (Address: 0x1800786a8)
- RtlInitUnicodeString (Address: 0x1800787d8)
- RtlInitUnicodeStringEx (Address: 0x180078400)
- RtlInsertElementGenericTable (Address: 0x180078308)
- RtlInsertElementGenericTableAvl (Address: 0x180078610)
- RtlIntegerToUnicodeString (Address: 0x180078338)
- RtlIsGenericTableEmpty (Address: 0x180078250)
- RtlIsTextUnicode (Address: 0x180078428)
- RtlIsValidIndexHandle (Address: 0x1800784b8)
- RtlLeaveCriticalSection (Address: 0x180078780)
- RtlLengthSecurityDescriptor (Address: 0x1800786d8)
- RtlLengthSid (Address: 0x180078208)
- RtlLookupElementGenericTable (Address: 0x180078368)
- RtlLookupElementGenericTableAvl (Address: 0x180078628)
- RtlLookupFunctionEntry (Address: 0x180078758)
- RtlMakeSelfRelativeSD (Address: 0x180078718)
- RtlMultiByteToUnicodeN (Address: 0x1800783e0)
- RtlNtStatusToDosError (Address: 0x180078798)
- RtlNtStatusToDosErrorNoTeb (Address: 0x1800783c8)
- RtlNumberGenericTableElements (Address: 0x180078370)
- RtlOemStringToUnicodeString (Address: 0x180078420)
- RtlOpenCurrentUser (Address: 0x1800786b8)
- RtlPrefixUnicodeString (Address: 0x1800783a0)
- RtlQueryPackageIdentity (Address: 0x180078418)
- RtlQueryPerformanceCounter (Address: 0x180078600)
- RtlQueryProcessDebugInformation (Address: 0x180078680)
- RtlQueryRegistryValuesEx (Address: 0x180078360)
- RtlReleaseRelativeName (Address: 0x180078660)
- RtlReleaseSRWLockExclusive (Address: 0x180078618)
- RtlReleaseSRWLockShared (Address: 0x180078630)
- RtlRunOnceBeginInitialize (Address: 0x180078570)
- RtlRunOnceExecuteOnce (Address: 0x180078568)
- RtlRunOnceInitialize (Address: 0x180078580)
- RtlSetDaclSecurityDescriptor (Address: 0x180078468)
- RtlSetGroupSecurityDescriptor (Address: 0x1800784c8)
- RtlSetLastWin32Error (Address: 0x1800783f0)
- RtlSetOwnerSecurityDescriptor (Address: 0x180078228)
- RtlSetSaclSecurityDescriptor (Address: 0x180078448)
- RtlStringFromGUID (Address: 0x180078340)
- RtlSubAuthorityCountSid (Address: 0x180078700)
- RtlSubAuthoritySid (Address: 0x180078708)
- RtlTimeToSecondsSince1970 (Address: 0x180078510)
- RtlUnicodeStringToAnsiString (Address: 0x1800787a8)
- RtlUnicodeStringToInteger (Address: 0x1800786f0)
- RtlUnicodeToMultiByteN (Address: 0x1800783c0)
- RtlUnicodeToMultiByteSize (Address: 0x1800783d0)
- RtlUpcaseUnicodeChar (Address: 0x180078380)
- RtlValidAcl (Address: 0x180078440)
- RtlValidRelativeSecurityDescriptor (Address: 0x1800785d0)
- RtlValidSecurityDescriptor (Address: 0x1800786e0)
- RtlValidSid (Address: 0x1800782a0)
- RtlVirtualUnwind (Address: 0x180078750)
- RtlWaitOnAddress (Address: 0x1800785f0)
- RtlWakeAddressAll (Address: 0x1800785f8)
- RtlWakeAddressSingle (Address: 0x180078650)
- RtlxAnsiStringToUnicodeSize (Address: 0x180078488)
- RtlxUnicodeStringToAnsiSize (Address: 0x180078728)
RPCRT4.dll
- I_RpcExceptionFilter (Address: 0x180077748)
- I_RpcMapWin32Status (Address: 0x180077720)
- I_RpcSNCHOption (Address: 0x180077700)
- NdrClientCall2 (Address: 0x1800776f8)
- NdrClientCall3 (Address: 0x180077750)
- RpcBindingBind (Address: 0x180077740)
- RpcBindingCreateW (Address: 0x180077738)
- RpcBindingFree (Address: 0x180077758)
- RpcBindingFromStringBindingW (Address: 0x180077728)
- RpcBindingSetAuthInfoA (Address: 0x180077708)
- RpcBindingSetAuthInfoExW (Address: 0x180077768)
- RpcBindingSetAuthInfoW (Address: 0x180077770)
- RpcEpResolveBinding (Address: 0x180077710)
- RpcExceptionFilter (Address: 0x1800776e0)
- RpcSsDestroyClientContext (Address: 0x180077718)
- RpcStringBindingComposeW (Address: 0x180077730)
- RpcStringFreeW (Address: 0x180077760)
- UuidFromStringW (Address: 0x1800776f0)
- UuidToStringW (Address: 0x1800776e8)
SECHOST.dll
- ControlTraceA (Address: 0x180077790)
- QueryAllTracesA (Address: 0x180077780)
- StartTraceA (Address: 0x180077788)