AppvIsvSubsystems64.dll
Description: Client Virtualization Subsystems
Authors: Microsoft Corporation
Version: 16.0.19822.20012
Architecture: 64-bit
Operating System: Windows NT
SHA256: 88fd193f36bfb0bfb3f4c0dbf4ae72d2
File Size: 1.4 MB
Uploaded At: July 20, 2026, 8:30 a.m.
Views: 5
Exported Functions
- APIExportForDetours (Ordinal: 1, Address: 0x98a0)
- RequestUnhookedFunctionList (Ordinal: 2, Address: 0x87e0)
- VirtualizeCurrentThread (Ordinal: 3, Address: 0xa170)
- CurrentThreadIsVirtualized (Ordinal: 4, Address: 0xa150)
- VirtualizeCurrentProcess (Ordinal: 5, Address: 0xa210)
- GetPhysicalPath (Ordinal: 6, Address: 0xa380)
- IsProcessHooked (Ordinal: 7, Address: 0xa140)
Imported DLLs & Functions
api-ms-win-crt-convert-l1-1-0.dll
- _wtoi (Address: 0x1800dc7b0)
- wcstol (Address: 0x1800dc7a8)
api-ms-win-crt-filesystem-l1-1-0.dll
- _wsplitpath_s (Address: 0x1800dc7c0)
api-ms-win-crt-heap-l1-1-0.dll
- _get_heap_handle (Address: 0x1800dc7e8)
- calloc (Address: 0x1800dc7e0)
- free (Address: 0x1800dc7d8)
- malloc (Address: 0x1800dc7d0)
- realloc (Address: 0x1800dc7f0)
api-ms-win-crt-locale-l1-1-0.dll
- __initialize_lconv_for_unsigned_char (Address: 0x1800dc800)
api-ms-win-crt-math-l1-1-0.dll
- ceilf (Address: 0x1800dc810)
api-ms-win-crt-runtime-l1-1-0.dll
- _cexit (Address: 0x1800dc890)
- _configure_narrow_argv (Address: 0x1800dc848)
- _crt_atexit (Address: 0x1800dc880)
- _errno (Address: 0x1800dc878)
- _execute_onexit_table (Address: 0x1800dc888)
- _initialize_narrow_environment (Address: 0x1800dc820)
- _initialize_onexit_table (Address: 0x1800dc850)
- _initterm (Address: 0x1800dc840)
- _initterm_e (Address: 0x1800dc838)
- _invalid_parameter_noinfo (Address: 0x1800dc870)
- _invoke_watson (Address: 0x1800dc868)
- _register_onexit_function (Address: 0x1800dc828)
- _resetstkoflw (Address: 0x1800dc860)
- _seh_filter_dll (Address: 0x1800dc830)
- terminate (Address: 0x1800dc858)
api-ms-win-crt-stdio-l1-1-0.dll
- __stdio_common_vswprintf_s (Address: 0x1800dc8a0)
api-ms-win-crt-string-l1-1-0.dll
- _stricmp (Address: 0x1800dc8b8)
- _strnicmp (Address: 0x1800dc8f0)
- _wcsicmp (Address: 0x1800dc920)
- _wcslwr_s (Address: 0x1800dc8f8)
- _wcsnicmp (Address: 0x1800dc8c0)
- _wcsupr_s (Address: 0x1800dc900)
- iswalpha (Address: 0x1800dc908)
- iswctype (Address: 0x1800dc8e0)
- iswdigit (Address: 0x1800dc910)
- iswspace (Address: 0x1800dc918)
- strcpy_s (Address: 0x1800dc8e8)
- strnlen (Address: 0x1800dc928)
- wcscpy_s (Address: 0x1800dc8d0)
- wcsncmp (Address: 0x1800dc8b0)
- wcsncpy_s (Address: 0x1800dc930)
- wcsnlen (Address: 0x1800dc8d8)
- wmemcpy_s (Address: 0x1800dc8c8)
api-ms-win-crt-time-l1-1-0.dll
- _time64 (Address: 0x1800dc940)
api-ms-win-crt-utility-l1-1-0.dll
- rand (Address: 0x1800dc958)
- srand (Address: 0x1800dc950)
c2r64.dll
- (Address: 0x18016116e)
KERNEL32.dll
- AcquireSRWLockExclusive (Address: 0x1800dc1e0)
- AcquireSRWLockShared (Address: 0x1800dc1d0)
- ActivateActCtx (Address: 0x1800dc008)
- CheckRemoteDebuggerPresent (Address: 0x1800dc110)
- CloseHandle (Address: 0x1800dc058)
- CompareStringOrdinal (Address: 0x1800dc3d8)
- CompareStringW (Address: 0x1800dc178)
- CreateActCtxW (Address: 0x1800dc000)
- CreateEventW (Address: 0x1800dc190)
- CreateFileMappingW (Address: 0x1800dc268)
- CreateFileW (Address: 0x1800dc2a8)
- CreateMutexW (Address: 0x1800dc0e8)
- CreateProcessW (Address: 0x1800dc150)
- DeactivateActCtx (Address: 0x1800dc040)
- DebugBreak (Address: 0x1800dc0e0)
- DeleteCriticalSection (Address: 0x1800dc070)
- DeviceIoControl (Address: 0x1800dc170)
- DisableThreadLibraryCalls (Address: 0x1800dc100)
- DuplicateHandle (Address: 0x1800dc180)
- EnterCriticalSection (Address: 0x1800dc088)
- ExpandEnvironmentStringsW (Address: 0x1800dc2c8)
- FindActCtxSectionStringW (Address: 0x1800dc030)
- FindClose (Address: 0x1800dc2b0)
- FindFirstFileNameW (Address: 0x1800dc240)
- FindFirstFileW (Address: 0x1800dc2d8)
- FindFirstVolumeW (Address: 0x1800dc140)
- FindNextFileNameW (Address: 0x1800dc218)
- FindNextFileW (Address: 0x1800dc238)
- FindNextVolumeW (Address: 0x1800dc300)
- FindVolumeClose (Address: 0x1800dc3f8)
- FlushFileBuffers (Address: 0x1800dc158)
- FlushInstructionCache (Address: 0x1800dc360)
- FlushViewOfFile (Address: 0x1800dc160)
- FreeEnvironmentStringsW (Address: 0x1800dc318)
- FreeLibrary (Address: 0x1800dc080)
- GetCurrentDirectoryW (Address: 0x1800dc288)
- GetCurrentProcess (Address: 0x1800dc0c0)
- GetCurrentProcessId (Address: 0x1800dc0b0)
- GetCurrentThread (Address: 0x1800dc290)
- GetCurrentThreadId (Address: 0x1800dc0a0)
- GetEnvironmentStringsW (Address: 0x1800dc328)
- GetEnvironmentVariableW (Address: 0x1800dc2b8)
- GetFileAttributesW (Address: 0x1800dc228)
- GetFinalPathNameByHandleW (Address: 0x1800dc230)
- GetLastError (Address: 0x1800dc050)
- GetLogicalDriveStringsW (Address: 0x1800dc220)
- GetModuleFileNameW (Address: 0x1800dc028)
- GetModuleHandleExW (Address: 0x1800dc018)
- GetModuleHandleW (Address: 0x1800dc078)
- GetNativeSystemInfo (Address: 0x1800dc250)
- GetProcAddress (Address: 0x1800dc068)
- GetProcessHeap (Address: 0x1800dc0d8)
- GetProcessId (Address: 0x1800dc3d0)
- GetShortPathNameW (Address: 0x1800dc2c0)
- GetSystemDirectoryW (Address: 0x1800dc2a0)
- GetSystemInfo (Address: 0x1800dc3c8)
- GetSystemTimeAsFileTime (Address: 0x1800dc210)
- GetThreadContext (Address: 0x1800dc358)
- GetVersion (Address: 0x1800dc3e0)
- GetVersionExW (Address: 0x1800dc258)
- GetVolumePathNamesForVolumeNameW (Address: 0x1800dc2f8)
- GetVolumePathNameW (Address: 0x1800dc308)
- GetWindowsDirectoryW (Address: 0x1800dc278)
- HeapAlloc (Address: 0x1800dc0d0)
- HeapCreate (Address: 0x1800dc118)
- HeapDestroy (Address: 0x1800dc280)
- HeapFree (Address: 0x1800dc0b8)
- HeapReAlloc (Address: 0x1800dc128)
- HeapSize (Address: 0x1800dc120)
- InitializeCriticalSection (Address: 0x1800dc098)
- InitializeCriticalSectionAndSpinCount (Address: 0x1800dc1a0)
- InitializeCriticalSectionEx (Address: 0x1800dc038)
- InitializeSListHead (Address: 0x1800dc3c0)
- InitializeSRWLock (Address: 0x1800dc1f0)
- IsDebuggerPresent (Address: 0x1800dc108)
- IsProcessorFeaturePresent (Address: 0x1800dc3a0)
- IsWow64Process (Address: 0x1800dc188)
- K32GetMappedFileNameW (Address: 0x1800dc208)
- K32GetModuleInformation (Address: 0x1800dc0c8)
- LeaveCriticalSection (Address: 0x1800dc090)
- LoadLibraryA (Address: 0x1800dc200)
- LoadLibraryExA (Address: 0x1800dc338)
- LoadLibraryExW (Address: 0x1800dc340)
- LoadLibraryW (Address: 0x1800dc060)
- LocalFree (Address: 0x1800dc270)
- MapViewOfFile (Address: 0x1800dc260)
- MultiByteToWideChar (Address: 0x1800dc2e0)
- OpenEventW (Address: 0x1800dc198)
- OpenFileMappingW (Address: 0x1800dc168)
- OutputDebugStringA (Address: 0x1800dc020)
- OutputDebugStringW (Address: 0x1800dc130)
- QueryActCtxW (Address: 0x1800dc048)
- QueryDosDeviceW (Address: 0x1800dc248)
- QueryPerformanceCounter (Address: 0x1800dc3b8)
- QueueUserWorkItem (Address: 0x1800dc3f0)
- RaiseException (Address: 0x1800dc138)
- RaiseFailFastException (Address: 0x1800dc2e8)
- ReleaseMutex (Address: 0x1800dc0f8)
- ReleaseSRWLockExclusive (Address: 0x1800dc1e8)
- ReleaseSRWLockShared (Address: 0x1800dc1d8)
- ResetEvent (Address: 0x1800dc408)
- ResumeThread (Address: 0x1800dc320)
- RtlCaptureContext (Address: 0x1800dc370)
- RtlLookupFunctionEntry (Address: 0x1800dc378)
- RtlVirtualUnwind (Address: 0x1800dc380)
- SearchPathW (Address: 0x1800dc2d0)
- SetCurrentDirectoryW (Address: 0x1800dc148)
- SetEnvironmentVariableW (Address: 0x1800dc310)
- SetEvent (Address: 0x1800dc400)
- SetLastError (Address: 0x1800dc010)
- SetThreadContext (Address: 0x1800dc368)
- SetUnhandledExceptionFilter (Address: 0x1800dc390)
- Sleep (Address: 0x1800dc0a8)
- SleepConditionVariableSRW (Address: 0x1800dc3b0)
- SuspendThread (Address: 0x1800dc350)
- TerminateProcess (Address: 0x1800dc398)
- TlsAlloc (Address: 0x1800dc1c0)
- TlsFree (Address: 0x1800dc1b0)
- TlsGetValue (Address: 0x1800dc1b8)
- TlsSetValue (Address: 0x1800dc1c8)
- UnhandledExceptionFilter (Address: 0x1800dc388)
- UnmapViewOfFile (Address: 0x1800dc298)
- VirtualAlloc (Address: 0x1800dc348)
- VirtualFree (Address: 0x1800dc330)
- VirtualProtect (Address: 0x1800dc2f0)
- VirtualQuery (Address: 0x1800dc1a8)
- WaitForMultipleObjects (Address: 0x1800dc3e8)
- WaitForSingleObject (Address: 0x1800dc0f0)
- WakeAllConditionVariable (Address: 0x1800dc3a8)
- WideCharToMultiByte (Address: 0x1800dc1f8)
MSVCP140.dll
- _Wcscoll (Address: 0x1800dc530)
- _Wcsxfrm (Address: 0x1800dc4f0)
- ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ (Address: 0x1800dc440)
- ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z (Address: 0x1800dc4b0)
- ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ (Address: 0x1800dc450)
- ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ (Address: 0x1800dc518)
- ?_Id_cnt@id@locale@std@@0HA (Address: 0x1800dc500)
- ?_Incref@facet@locale@std@@UEAAXXZ (Address: 0x1800dc448)
- ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z (Address: 0x1800dc510)
- ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ (Address: 0x1800dc6c0)
- ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ (Address: 0x1800dc5a8)
- ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ (Address: 0x1800dc658)
- ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ (Address: 0x1800dc5f0)
- ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ (Address: 0x1800dc6b8)
- ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ (Address: 0x1800dc5a0)
- ?_Xbad_alloc@std@@YAXXZ (Address: 0x1800dc4b8)
- ?_Xbad_function_call@std@@YAXXZ (Address: 0x1800dc4a0)
- ?_Xlength_error@std@@YAXPEBD@Z (Address: 0x1800dc4c8)
- ?_Xout_of_range@std@@YAXPEBD@Z (Address: 0x1800dc4c0)
- ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z (Address: 0x1800dc4f8)
- ??0_Locinfo@std@@QEAA@PEBD@Z (Address: 0x1800dc460)
- ??0_Lockit@std@@QEAA@H@Z (Address: 0x1800dc520)
- ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ (Address: 0x1800dc588)
- ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ (Address: 0x1800dc5d8)
- ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z (Address: 0x1800dc6d8)
- ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z (Address: 0x1800dc5c0)
- ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z (Address: 0x1800dc4e8)
- ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z (Address: 0x1800dc618)
- ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ (Address: 0x1800dc580)
- ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ (Address: 0x1800dc5f8)
- ??0facet@locale@std@@IEAA@_K@Z (Address: 0x1800dc438)
- ??1_Locinfo@std@@QEAA@XZ (Address: 0x1800dc458)
- ??1_Lockit@std@@QEAA@XZ (Address: 0x1800dc528)
- ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ (Address: 0x1800dc6d0)
- ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ (Address: 0x1800dc5b8)
- ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ (Address: 0x1800dc670)
- ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ (Address: 0x1800dc540)
- ??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ (Address: 0x1800dc4e0)
- ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ (Address: 0x1800dc610)
- ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ (Address: 0x1800dc6c8)
- ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ (Address: 0x1800dc5b0)
- ??1facet@locale@std@@MEAA@XZ (Address: 0x1800dc430)
- ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAH@Z (Address: 0x1800dc4d8)
- ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z (Address: 0x1800dc4a8)
- ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_N@Z (Address: 0x1800dc480)
- ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z (Address: 0x1800dc628)
- ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z (Address: 0x1800dc668)
- ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z (Address: 0x1800dc538)
- ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z (Address: 0x1800dc678)
- ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z (Address: 0x1800dc498)
- ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z (Address: 0x1800dc608)
- ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z (Address: 0x1800dc600)
- ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z (Address: 0x1800dc550)
- ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z (Address: 0x1800dc548)
- ?exceptions@ios_base@std@@QEAAXH@Z (Address: 0x1800dc4d0)
- ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ (Address: 0x1800dc650)
- ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ (Address: 0x1800dc5e8)
- ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ (Address: 0x1800dc468)
- ?good@ios_base@std@@QEBA_NXZ (Address: 0x1800dc630)
- ?id@?$collate@_W@std@@2V0locale@2@A (Address: 0x1800dc6e0)
- ?id@?$ctype@_W@std@@2V0locale@2@A (Address: 0x1800dc508)
- ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z (Address: 0x1800dc680)
- ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z (Address: 0x1800dc558)
- ?is@?$ctype@_W@std@@QEBA_NF_W@Z (Address: 0x1800dc428)
- ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z (Address: 0x1800dc490)
- ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z (Address: 0x1800dc690)
- ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z (Address: 0x1800dc568)
- ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z (Address: 0x1800dc648)
- ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z (Address: 0x1800dc5e0)
- ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z (Address: 0x1800dc620)
- ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ (Address: 0x1800dc6b0)
- ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ (Address: 0x1800dc598)
- ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z (Address: 0x1800dc640)
- ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z (Address: 0x1800dc5d0)
- ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z (Address: 0x1800dc638)
- ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z (Address: 0x1800dc5c8)
- ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ (Address: 0x1800dc688)
- ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ (Address: 0x1800dc560)
- ?tolower@?$ctype@_W@std@@QEBA_W_W@Z (Address: 0x1800dc420)
- ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z (Address: 0x1800dc418)
- ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ (Address: 0x1800dc6a8)
- ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ (Address: 0x1800dc590)
- ?uncaught_exceptions@std@@YAHXZ (Address: 0x1800dc660)
- ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A (Address: 0x1800dc478)
- ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z (Address: 0x1800dc488)
- ?widen@?$ctype@_W@std@@QEBA_WD@Z (Address: 0x1800dc470)
- ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z (Address: 0x1800dc6a0)
- ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z (Address: 0x1800dc578)
- ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z (Address: 0x1800dc698)
- ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z (Address: 0x1800dc570)
ntdll.dll
- NtClose (Address: 0x1800dca58)
- NtCreateKey (Address: 0x1800dca60)
- NtDeleteKey (Address: 0x1800dca20)
- NtDeleteValueKey (Address: 0x1800dca50)
- NtDuplicateObject (Address: 0x1800dc970)
- NtEnumerateKey (Address: 0x1800dca28)
- NtEnumerateValueKey (Address: 0x1800dca30)
- NtFlushKey (Address: 0x1800dca48)
- NtNotifyChangeMultipleKeys (Address: 0x1800dca40)
- NtOpenKey (Address: 0x1800dca38)
- NtQueryInformationProcess (Address: 0x1800dc9d8)
- NtQueryKey (Address: 0x1800dca18)
- NtQueryObject (Address: 0x1800dc9b0)
- NtQuerySecurityObject (Address: 0x1800dca88)
- NtQueryValueKey (Address: 0x1800dca78)
- NtReadFile (Address: 0x1800dca98)
- NtRenameKey (Address: 0x1800dca68)
- NtSetEvent (Address: 0x1800dca90)
- NtSetInformationThread (Address: 0x1800dc9f8)
- NtSetSecurityObject (Address: 0x1800dca00)
- NtSetValueKey (Address: 0x1800dca70)
- NtWriteFile (Address: 0x1800dc980)
- RtlAllocateHeap (Address: 0x1800dc9e8)
- RtlCompareUnicodeString (Address: 0x1800dca80)
- RtlCopyUnicodeString (Address: 0x1800dc9a0)
- RtlDeleteElementGenericTableAvl (Address: 0x1800dc990)
- RtlEnumerateGenericTableAvl (Address: 0x1800dca10)
- RtlEnumerateGenericTableWithoutSplayingAvl (Address: 0x1800dc9c0)
- RtlEqualUnicodeString (Address: 0x1800dca08)
- RtlFreeHeap (Address: 0x1800dc9f0)
- RtlInitializeGenericTableAvl (Address: 0x1800dc988)
- RtlInitUnicodeString (Address: 0x1800dc978)
- RtlInsertElementGenericTableAvl (Address: 0x1800dc9a8)
- RtlIntegerToUnicodeString (Address: 0x1800dc9e0)
- RtlIsGenericTableEmptyAvl (Address: 0x1800dc9b8)
- RtlIsNameInExpression (Address: 0x1800dc9c8)
- RtlLookupElementGenericTableAvl (Address: 0x1800dc998)
- RtlNtStatusToDosError (Address: 0x1800dc968)
- RtlPrefixUnicodeString (Address: 0x1800dc9d0)
VCRUNTIME140_1.dll
- __CxxFrameHandler4 (Address: 0x1800dc798)
VCRUNTIME140.dll
- __C_specific_handler (Address: 0x1800dc6f8)
- __C_specific_handler_noexcept (Address: 0x1800dc728)
- __current_exception (Address: 0x1800dc738)
- __current_exception_context (Address: 0x1800dc750)
- __RTDynamicCast (Address: 0x1800dc730)
- __std_exception_copy (Address: 0x1800dc710)
- __std_exception_destroy (Address: 0x1800dc700)
- __std_terminate (Address: 0x1800dc740)
- __std_type_info_compare (Address: 0x1800dc760)
- __std_type_info_destroy_list (Address: 0x1800dc758)
- _CxxThrowException (Address: 0x1800dc720)
- _purecall (Address: 0x1800dc788)
- memcmp (Address: 0x1800dc6f0)
- memcpy (Address: 0x1800dc708)
- memmove (Address: 0x1800dc780)
- memset (Address: 0x1800dc778)
- strchr (Address: 0x1800dc770)
- strrchr (Address: 0x1800dc748)
- wcsrchr (Address: 0x1800dc768)
- wcsstr (Address: 0x1800dc718)