offreg.dll

Description: Offline registry DLL

Authors: © Microsoft Corporation. All rights reserved.

Version: 6.1.7600.16385

Architecture: 32-bit

Operating System: Windows NT

SHA256: a8e3149c77c235818cbbf2686cecd666

File Size: 54.9 KB

Uploaded At: June 28, 2026, 11:46 a.m.

Views: 21

Exported Functions

  • ORCloseHive (Ordinal: 1, Address: 0x1fb2)
  • ORCloseKey (Ordinal: 2, Address: 0x32fb)
  • ORCreateHive (Ordinal: 3, Address: 0x238a)
  • ORCreateKey (Ordinal: 4, Address: 0x2cb0)
  • ORDeleteKey (Ordinal: 5, Address: 0x31a4)
  • ORDeleteValue (Ordinal: 6, Address: 0x3df1)
  • OREnumKey (Ordinal: 7, Address: 0x27a7)
  • OREnumValue (Ordinal: 8, Address: 0x3cff)
  • ORGetKeySecurity (Ordinal: 9, Address: 0x3e83)
  • ORGetValue (Ordinal: 10, Address: 0x385b)
  • ORGetVersion (Ordinal: 11, Address: 0x4059)
  • ORGetVirtualFlags (Ordinal: 12, Address: 0x2a51)
  • OROpenHive (Ordinal: 13, Address: 0x2483)
  • OROpenKey (Ordinal: 14, Address: 0x2bf0)
  • ORQueryInfoKey (Ordinal: 15, Address: 0x2635)
  • ORSaveHive (Ordinal: 16, Address: 0x1fe4)
  • ORSetKeySecurity (Ordinal: 17, Address: 0x3f16)
  • ORSetValue (Ordinal: 18, Address: 0x39e2)
  • ORSetVirtualFlags (Ordinal: 19, Address: 0x2ab2)

Imported DLLs & Functions

ADVAPI32.dll
  • AddAccessAllowedAce (Address: 0x10001030)
  • CreatePrivateObjectSecurityWithMultipleInheritance (Address: 0x10001028)
  • DestroyPrivateObjectSecurity (Address: 0x10001004)
  • GetAce (Address: 0x1000102c)
  • GetLengthSid (Address: 0x10001038)
  • GetSecurityDescriptorControl (Address: 0x1000100c)
  • GetSecurityDescriptorLength (Address: 0x10001044)
  • GetSidLengthRequired (Address: 0x10001040)
  • GetSidSubAuthority (Address: 0x10001048)
  • InitializeAcl (Address: 0x10001034)
  • InitializeSecurityDescriptor (Address: 0x10001020)
  • InitializeSid (Address: 0x10001000)
  • IsValidSecurityDescriptor (Address: 0x10001008)
  • IsValidSid (Address: 0x1000103c)
  • MakeSelfRelativeSD (Address: 0x10001010)
  • SetPrivateObjectSecurityEx (Address: 0x10001024)
  • SetSecurityDescriptorDacl (Address: 0x1000101c)
  • SetSecurityDescriptorGroup (Address: 0x10001014)
  • SetSecurityDescriptorOwner (Address: 0x10001018)
KERNEL32.dll
  • CloseHandle (Address: 0x1000108c)
  • CreateFileW (Address: 0x10001088)
  • DeleteCriticalSection (Address: 0x10001050)
  • EnterCriticalSection (Address: 0x10001058)
  • FlushFileBuffers (Address: 0x1000109c)
  • FreeLibrary (Address: 0x1000105c)
  • GetCurrentProcess (Address: 0x100010ac)
  • GetCurrentProcessId (Address: 0x100010a0)
  • GetCurrentThreadId (Address: 0x100010c8)
  • GetFileSizeEx (Address: 0x10001098)
  • GetLastError (Address: 0x10001064)
  • GetProcAddress (Address: 0x10001060)
  • GetProcessHeap (Address: 0x10001084)
  • GetSystemTimeAsFileTime (Address: 0x100010d0)
  • GetTickCount (Address: 0x100010c4)
  • HeapAlloc (Address: 0x10001080)
  • HeapFree (Address: 0x1000107c)
  • InitializeCriticalSectionAndSpinCount (Address: 0x10001078)
  • InterlockedCompareExchange (Address: 0x100010b8)
  • InterlockedExchange (Address: 0x100010b0)
  • LeaveCriticalSection (Address: 0x10001054)
  • LoadLibraryA (Address: 0x10001068)
  • QueryPerformanceCounter (Address: 0x100010c0)
  • ReadFile (Address: 0x10001090)
  • RtlUnwind (Address: 0x100010bc)
  • SetUnhandledExceptionFilter (Address: 0x100010a4)
  • Sleep (Address: 0x100010b4)
  • TerminateProcess (Address: 0x100010d4)
  • TlsAlloc (Address: 0x10001070)
  • TlsFree (Address: 0x1000106c)
  • TlsGetValue (Address: 0x10001074)
  • TlsSetValue (Address: 0x100010cc)
  • UnhandledExceptionFilter (Address: 0x100010a8)
  • WriteFile (Address: 0x10001094)
msvcrt.dll
  • _aligned_free (Address: 0x100010e4)
  • _aligned_malloc (Address: 0x100010e0)
  • _amsg_exit (Address: 0x100010fc)
  • _initterm (Address: 0x10001100)
  • _wcsicmp (Address: 0x100010dc)
  • _wcsnicmp (Address: 0x100010ec)
  • _XcptFilter (Address: 0x1000110c)
  • free (Address: 0x10001104)
  • malloc (Address: 0x10001108)
  • memcpy (Address: 0x100010f4)
  • memmove (Address: 0x100010f0)
  • memset (Address: 0x100010f8)
  • towupper (Address: 0x100010e8)