nddeapi.dll
Description:
Authors:
Version:
Architecture: 64-bit
Operating System:
SHA256: e25e8f66d7c219e5b3b24b34dce091c8
File Size: 117.0 KB
Uploaded At: July 6, 2026, 12:34 a.m.
Views: 30
Security Warning
This file has been flagged as potentially dangerous.
Reason: Detected potentially dangerous functions used for process injection: OpenProcess, VirtualAllocEx
Exported Functions
- Run (Ordinal: 1, Address: 0x12c0)
Imported DLLs & Functions
ADVAPI32.dll
- AdjustTokenPrivileges (Address: 0x180014010)
- LookupPrivilegeValueW (Address: 0x180014018)
- OpenProcessToken (Address: 0x180014000)
- RegCloseKey (Address: 0x180014020)
- RegCreateKeyExW (Address: 0x180014028)
- RegGetValueW (Address: 0x180014040)
- RegOpenKeyExW (Address: 0x180014030)
- RegQueryValueExW (Address: 0x180014038)
- RegSetValueExW (Address: 0x180014008)
api-ms-win-crt-convert-l1-1-0.dll
- strtol (Address: 0x180014480)
api-ms-win-crt-heap-l1-1-0.dll
- _callnewh (Address: 0x1800144a0)
- free (Address: 0x180014490)
- malloc (Address: 0x180014498)
api-ms-win-crt-runtime-l1-1-0.dll
- _beginthreadex (Address: 0x1800144b8)
- _cexit (Address: 0x1800144e8)
- _configure_narrow_argv (Address: 0x1800144f8)
- _crt_atexit (Address: 0x1800144d0)
- _errno (Address: 0x1800144c0)
- _execute_onexit_table (Address: 0x180014518)
- _initialize_narrow_environment (Address: 0x180014500)
- _initialize_onexit_table (Address: 0x180014508)
- _initterm (Address: 0x1800144d8)
- _initterm_e (Address: 0x1800144b0)
- _invoke_watson (Address: 0x1800144e0)
- _register_onexit_function (Address: 0x180014510)
- _seh_filter_dll (Address: 0x1800144f0)
- terminate (Address: 0x1800144c8)
api-ms-win-crt-stdio-l1-1-0.dll
- __acrt_iob_func (Address: 0x180014530)
- __stdio_common_vfprintf (Address: 0x180014548)
- __stdio_common_vsscanf (Address: 0x180014540)
- fflush (Address: 0x180014538)
- freopen_s (Address: 0x180014528)
api-ms-win-crt-string-l1-1-0.dll
- _wcsicmp (Address: 0x180014558)
- _wcsnicmp (Address: 0x180014560)
- isspace (Address: 0x180014578)
- strlen (Address: 0x180014568)
- toupper (Address: 0x180014570)
- wcslen (Address: 0x180014580)
bcrypt.dll
- BCryptCloseAlgorithmProvider (Address: 0x1800145a0)
- BCryptCreateHash (Address: 0x1800145b8)
- BCryptDestroyHash (Address: 0x1800145c0)
- BCryptFinishHash (Address: 0x180014598)
- BCryptGetProperty (Address: 0x1800145b0)
- BCryptHashData (Address: 0x180014590)
- BCryptOpenAlgorithmProvider (Address: 0x1800145a8)
KERNEL32.dll
- AcquireSRWLockExclusive (Address: 0x180014058)
- AllocConsole (Address: 0x180014180)
- CheckRemoteDebuggerPresent (Address: 0x180014158)
- CloseHandle (Address: 0x180014090)
- CreateProcessW (Address: 0x1800140e0)
- CreateToolhelp32Snapshot (Address: 0x180014120)
- DisableThreadLibraryCalls (Address: 0x1800140a0)
- ExpandEnvironmentStringsW (Address: 0x1800140a8)
- FreeConsole (Address: 0x180014188)
- GetConsoleMode (Address: 0x180014190)
- GetConsoleWindow (Address: 0x1800141a8)
- GetCurrentProcess (Address: 0x1800140c0)
- GetCurrentProcessId (Address: 0x1800140c8)
- GetCurrentThread (Address: 0x180014160)
- GetCurrentThreadId (Address: 0x180014088)
- GetFileAttributesW (Address: 0x1800140b0)
- GetLastError (Address: 0x1800140b8)
- GetModuleHandleW (Address: 0x180014108)
- GetProcAddress (Address: 0x180014110)
- GetStdHandle (Address: 0x180014178)
- GetSystemTimeAsFileTime (Address: 0x1800140d8)
- GetThreadContext (Address: 0x1800140e8)
- GetTickCount64 (Address: 0x180014138)
- InitializeSListHead (Address: 0x1800141b8)
- IsDebuggerPresent (Address: 0x180014150)
- IsProcessorFeaturePresent (Address: 0x180014078)
- MultiByteToWideChar (Address: 0x180014140)
- OpenProcess (Address: 0x1800140f8)
- Process32FirstW (Address: 0x180014128)
- Process32NextW (Address: 0x180014130)
- QueryFullProcessImageNameW (Address: 0x180014118)
- QueryPerformanceCounter (Address: 0x180014080)
- ReleaseSRWLockExclusive (Address: 0x180014050)
- ResumeThread (Address: 0x1800141b0)
- SetConsoleMode (Address: 0x180014198)
- SetConsoleTitleW (Address: 0x1800141a0)
- SetThreadContext (Address: 0x1800140f0)
- SetUnhandledExceptionFilter (Address: 0x180014098)
- Sleep (Address: 0x180014168)
- SleepConditionVariableSRW (Address: 0x180014068)
- TerminateProcess (Address: 0x1800140d0)
- UnhandledExceptionFilter (Address: 0x180014070)
- VirtualAllocEx (Address: 0x180014100)
- VirtualQuery (Address: 0x180014170)
- WakeAllConditionVariable (Address: 0x180014060)
- WideCharToMultiByte (Address: 0x180014148)
MSVCP140.dll
- _Cnd_do_broadcast_at_thread_exit (Address: 0x180014210)
- _Mtx_lock (Address: 0x180014240)
- _Mtx_unlock (Address: 0x180014248)
- _Thrd_detach (Address: 0x180014208)
- ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z (Address: 0x180014370)
- ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ (Address: 0x1800141f0)
- ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ (Address: 0x180014358)
- ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ (Address: 0x180014308)
- ?_Throw_Cpp_error@std@@YAXH@Z (Address: 0x180014250)
- ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ (Address: 0x1800141e8)
- ?_Xinvalid_argument@std@@YAXPEBD@Z (Address: 0x180014228)
- ?_Xlength_error@std@@YAXPEBD@Z (Address: 0x180014220)
- ?_Xout_of_range@std@@YAXPEBD@Z (Address: 0x180014230)
- ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ (Address: 0x180014340)
- ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z (Address: 0x180014348)
- ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ (Address: 0x180014280)
- ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ (Address: 0x180014310)
- ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ (Address: 0x180014350)
- ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ (Address: 0x180014288)
- ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z (Address: 0x180014360)
- ??7ios_base@std@@QEBA_NXZ (Address: 0x180014258)
- ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A (Address: 0x1800141f8)
- ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A (Address: 0x180014200)
- ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ (Address: 0x1800142b8)
- ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ (Address: 0x1800142d8)
- ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ (Address: 0x1800142f0)
- ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ (Address: 0x180014330)
- ?flags@ios_base@std@@QEBAHXZ (Address: 0x180014268)
- ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ (Address: 0x180014368)
- ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z (Address: 0x1800142e0)
- ?good@ios_base@std@@QEBA_NXZ (Address: 0x180014260)
- ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ (Address: 0x1800142c0)
- ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z (Address: 0x180014378)
- ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ (Address: 0x1800142c8)
- ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ (Address: 0x1800142d0)
- ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ (Address: 0x180014328)
- ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ (Address: 0x180014290)
- ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z (Address: 0x1800141c8)
- ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z (Address: 0x1800142e8)
- ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z (Address: 0x1800142f8)
- ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z (Address: 0x180014300)
- ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z (Address: 0x180014318)
- ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ (Address: 0x180014298)
- ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ (Address: 0x1800141e0)
- ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ (Address: 0x1800142a0)
- ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z (Address: 0x1800142a8)
- ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z (Address: 0x1800142b0)
- ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ (Address: 0x180014380)
- ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ (Address: 0x180014320)
- ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ (Address: 0x1800141d8)
- ?uncaught_exceptions@std@@YAHXZ (Address: 0x180014238)
- ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z (Address: 0x180014338)
- ?width@ios_base@std@@QEAA_J_J@Z (Address: 0x180014278)
- ?width@ios_base@std@@QEBA_JXZ (Address: 0x180014270)
- ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z (Address: 0x180014218)
- ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z (Address: 0x1800141d0)
ntdll.dll
- RtlCaptureContext (Address: 0x1800145d0)
- RtlLookupFunctionEntry (Address: 0x1800145d8)
- RtlVirtualUnwind (Address: 0x1800145e0)
USER32.dll
- GetWindowLongW (Address: 0x180014390)
- SetWindowLongW (Address: 0x180014398)
VCRUNTIME140_1.dll
- __CxxFrameHandler4 (Address: 0x180014418)
VCRUNTIME140.dll
- __C_specific_handler (Address: 0x1800143d0)
- __current_exception (Address: 0x1800143a8)
- __current_exception_context (Address: 0x1800143d8)
- __std_exception_copy (Address: 0x1800143e8)
- __std_exception_destroy (Address: 0x1800143f0)
- __std_terminate (Address: 0x1800143c8)
- __std_type_info_destroy_list (Address: 0x1800143b0)
- _CxxThrowException (Address: 0x1800143f8)
- memcmp (Address: 0x1800143c0)
- memcpy (Address: 0x180014408)
- memmove (Address: 0x180014400)
- memset (Address: 0x1800143e0)
- wcsrchr (Address: 0x1800143b8)
WINHTTP.dll
- WinHttpCloseHandle (Address: 0x180014448)
- WinHttpConnect (Address: 0x180014440)
- WinHttpOpen (Address: 0x180014470)
- WinHttpOpenRequest (Address: 0x180014460)
- WinHttpQueryDataAvailable (Address: 0x180014458)
- WinHttpQueryHeaders (Address: 0x180014468)
- WinHttpReadData (Address: 0x180014438)
- WinHttpReceiveResponse (Address: 0x180014450)
- WinHttpSendRequest (Address: 0x180014430)
- WinHttpSetTimeouts (Address: 0x180014428)