umpnpmgr.dll

Description: User-mode Plug-and-Play Service

Version: 10.0.19041.3636

Architecture: 64-bit

Operating System: Windows NT

SHA256: 44ae9b80e19198bc23e39181170d04f8

File Size: 130.0 KB

Uploaded At: Dec. 1, 2025, 7:41 a.m.

Views: 3

Exported Functions

PlugPlayServiceMain (Ordinal: 1, Address: 0xf240)
ServiceMain (Ordinal: 2, Address: 0xaff0)
SvchostPushServiceGlobals (Ordinal: 3, Address: 0xb4c0)

Imported DLLs & Functions

api-ms-win-core-delayload-l1-1-0.dll

DelayLoadFailureHook (Address: 0x16d014950)

api-ms-win-core-delayload-l1-1-1.dll

ResolveDelayLoadedAPI (Address: 0x16d014960)

api-ms-win-core-errorhandling-l1-1-0.dll

GetLastError (Address: 0x16d014988)
RaiseException (Address: 0x16d014970)
SetLastError (Address: 0x16d014990)
SetUnhandledExceptionFilter (Address: 0x16d014978)
UnhandledExceptionFilter (Address: 0x16d014980)

api-ms-win-core-file-l1-1-0.dll

CreateDirectoryW (Address: 0x16d014a18)
CreateFileW (Address: 0x16d014a08)
DeleteFileW (Address: 0x16d0149e8)
FileTimeToLocalFileTime (Address: 0x16d0149b8)
FindClose (Address: 0x16d0149b0)
FindFirstFileW (Address: 0x16d0149a8)
FindNextFileW (Address: 0x16d0149f8)
FlushFileBuffers (Address: 0x16d0149d0)
GetFileAttributesW (Address: 0x16d014a10)
GetFileInformationByHandle (Address: 0x16d0149e0)
GetFileSize (Address: 0x16d0149c8)
GetFullPathNameW (Address: 0x16d0149a0)
SetEndOfFile (Address: 0x16d014a00)
SetFileAttributesW (Address: 0x16d0149f0)
SetFilePointer (Address: 0x16d0149d8)
WriteFile (Address: 0x16d0149c0)

api-ms-win-core-file-l2-1-0.dll

CreateHardLinkW (Address: 0x16d014a30)
MoveFileExW (Address: 0x16d014a28)

api-ms-win-core-handle-l1-1-0.dll

CloseHandle (Address: 0x16d014a48)
DuplicateHandle (Address: 0x16d014a40)

api-ms-win-core-heap-l1-1-0.dll

GetProcessHeap (Address: 0x16d014a58)
HeapAlloc (Address: 0x16d014a60)
HeapFree (Address: 0x16d014a70)
HeapReAlloc (Address: 0x16d014a68)

api-ms-win-core-io-l1-1-0.dll

DeviceIoControl (Address: 0x16d014a80)

api-ms-win-core-libraryloader-l1-2-0.dll

DisableThreadLibraryCalls (Address: 0x16d014a90)
FreeLibrary (Address: 0x16d014ab8)
GetModuleFileNameA (Address: 0x16d014ab0)
GetProcAddress (Address: 0x16d014aa0)
LoadLibraryExW (Address: 0x16d014a98)
LoadStringW (Address: 0x16d014aa8)

api-ms-win-core-localization-l1-2-0.dll

LCMapStringW (Address: 0x16d014ac8)

api-ms-win-core-memory-l1-1-0.dll

CreateFileMappingW (Address: 0x16d014ad8)
MapViewOfFile (Address: 0x16d014ae8)
UnmapViewOfFile (Address: 0x16d014ae0)

api-ms-win-core-processenvironment-l1-1-0.dll

ExpandEnvironmentStringsW (Address: 0x16d014b00)
GetCommandLineA (Address: 0x16d014af8)

api-ms-win-core-processthreads-l1-1-0.dll

CreateProcessW (Address: 0x16d014b40)
CreateThread (Address: 0x16d014b58)
GetCurrentProcess (Address: 0x16d014b50)
GetCurrentProcessId (Address: 0x16d014b60)
GetCurrentThread (Address: 0x16d014b48)
GetCurrentThreadId (Address: 0x16d014b38)
GetExitCodeProcess (Address: 0x16d014b30)
OpenThreadToken (Address: 0x16d014b10)
ProcessIdToSessionId (Address: 0x16d014b18)
QueueUserAPC (Address: 0x16d014b20)
TerminateProcess (Address: 0x16d014b28)

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter (Address: 0x16d014b70)

api-ms-win-core-registry-l1-1-0.dll

RegCloseKey (Address: 0x16d014b98)
RegCreateKeyExW (Address: 0x16d014ba8)
RegDeleteTreeW (Address: 0x16d014ba0)
RegDeleteValueW (Address: 0x16d014b80)
RegNotifyChangeKeyValue (Address: 0x16d014bb8)
RegOpenKeyExW (Address: 0x16d014b88)
RegQueryValueExW (Address: 0x16d014b90)
RegSetValueExW (Address: 0x16d014bb0)

api-ms-win-core-string-l1-1-0.dll

CompareStringOrdinal (Address: 0x16d014bc8)
CompareStringW (Address: 0x16d014bd0)
WideCharToMultiByte (Address: 0x16d014bd8)

api-ms-win-core-synch-l1-1-0.dll

CreateEventW (Address: 0x16d014be8)
CreateMutexW (Address: 0x16d014c40)
DeleteCriticalSection (Address: 0x16d014bf8)
EnterCriticalSection (Address: 0x16d014c10)
InitializeCriticalSection (Address: 0x16d014bf0)
LeaveCriticalSection (Address: 0x16d014c48)
OpenEventW (Address: 0x16d014c38)
ReleaseMutex (Address: 0x16d014c08)
ResetEvent (Address: 0x16d014c30)
SetEvent (Address: 0x16d014c20)
SleepEx (Address: 0x16d014c28)
WaitForMultipleObjectsEx (Address: 0x16d014c00)
WaitForSingleObjectEx (Address: 0x16d014c18)

api-ms-win-core-synch-l1-2-0.dll

Sleep (Address: 0x16d014c58)

api-ms-win-core-sysinfo-l1-1-0.dll

GetLocalTime (Address: 0x16d014c90)
GetSystemDirectoryW (Address: 0x16d014c68)
GetSystemInfo (Address: 0x16d014c78)
GetSystemTime (Address: 0x16d014c70)
GetSystemTimeAsFileTime (Address: 0x16d014c80)
GetSystemWindowsDirectoryW (Address: 0x16d014ca0)
GetTickCount (Address: 0x16d014c98)
GetTickCount64 (Address: 0x16d014c88)

api-ms-win-core-threadpool-l1-2-0.dll

CloseThreadpoolTimer (Address: 0x16d014cb0)
CreateThreadpoolTimer (Address: 0x16d014cb8)
SetThreadpoolTimer (Address: 0x16d014cc8)
WaitForThreadpoolTimerCallbacks (Address: 0x16d014cc0)

api-ms-win-core-threadpool-legacy-l1-1-0.dll

QueueUserWorkItem (Address: 0x16d014ce0)
UnregisterWaitEx (Address: 0x16d014cd8)

api-ms-win-core-threadpool-private-l1-1-0.dll

RegisterWaitForSingleObjectEx (Address: 0x16d014cf0)

api-ms-win-core-timezone-l1-1-0.dll

FileTimeToSystemTime (Address: 0x16d014d08)
SystemTimeToFileTime (Address: 0x16d014d00)

api-ms-win-security-base-l1-1-0.dll

AccessCheckAndAuditAlarmW (Address: 0x16d014d40)
AddAccessAllowedAceEx (Address: 0x16d014d20)
DuplicateTokenEx (Address: 0x16d014d50)
GetLengthSid (Address: 0x16d014d58)
GetTokenInformation (Address: 0x16d014d48)
InitializeAcl (Address: 0x16d014d18)
InitializeSecurityDescriptor (Address: 0x16d014d28)
MapGenericMask (Address: 0x16d014d38)
SetSecurityDescriptorDacl (Address: 0x16d014d30)

api-ms-win-service-core-l1-1-0.dll

RegisterServiceCtrlHandlerExW (Address: 0x16d014d68)
SetServiceStatus (Address: 0x16d014d70)

api-ms-win-service-private-l1-1-1.dll

I_ScRegisterPreshutdownRestart (Address: 0x16d014d80)

KERNELBASE.dll

WTSGetServiceSessionId (Address: 0x16d0148b0)

msvcrt.dll

__C_specific_handler (Address: 0x16d014e00)
_amsg_exit (Address: 0x16d014dd8)
_initterm (Address: 0x16d014dc0)
_resetstkoflw (Address: 0x16d014df0)
_vsnprintf (Address: 0x16d014da0)
_vsnwprintf (Address: 0x16d014d90)
_XcptFilter (Address: 0x16d014de8)
free (Address: 0x16d014dd0)
malloc (Address: 0x16d014dc8)
memcpy (Address: 0x16d014db0)
memmove (Address: 0x16d014d98)
memset (Address: 0x16d014e08)
toupper (Address: 0x16d014da8)
wcschr (Address: 0x16d014de0)
wcsrchr (Address: 0x16d014df8)
wcsstr (Address: 0x16d014db8)

ntdll.dll

EtwEventRegister (Address: 0x16d014f68)
EtwEventSetInformation (Address: 0x16d014e80)
EtwEventUnregister (Address: 0x16d014e88)
EtwEventWriteTransfer (Address: 0x16d014f18)
EtwGetTraceEnableFlags (Address: 0x16d014f48)
EtwGetTraceEnableLevel (Address: 0x16d014f50)
EtwGetTraceLoggerHandle (Address: 0x16d014f58)
EtwRegisterTraceGuidsW (Address: 0x16d014f40)
EtwTraceMessage (Address: 0x16d014f60)
EtwUnregisterTraceGuids (Address: 0x16d014f38)
NtClose (Address: 0x16d014eb8)
NtCreateKey (Address: 0x16d014e50)
NtDeleteValueKey (Address: 0x16d014e38)
NtOpenKey (Address: 0x16d014e58)
NtOpenThreadToken (Address: 0x16d014ed0)
NtQueryInformationFile (Address: 0x16d014e30)
NtQuerySystemInformation (Address: 0x16d014e70)
NtQueryValueKey (Address: 0x16d014e48)
NtSetInformationFile (Address: 0x16d014e28)
NtSetInformationThread (Address: 0x16d014eb0)
NtSetValueKey (Address: 0x16d014e40)
RtlAdjustPrivilege (Address: 0x16d014ee0)
RtlAllocateHeap (Address: 0x16d014ef8)
RtlCaptureContext (Address: 0x16d014e20)
RtlCreateAndSetSD (Address: 0x16d014ec8)
RtlDeleteSecurityObject (Address: 0x16d014ea0)
RtlDestroyHeap (Address: 0x16d014f00)
RtlFormatCurrentUserKeyPath (Address: 0x16d014e68)
RtlFreeHeap (Address: 0x16d014ee8)
RtlFreeUnicodeString (Address: 0x16d014e60)
RtlGetVersion (Address: 0x16d014e78)
RtlImpersonateSelf (Address: 0x16d014ed8)
RtlInitUnicodeString (Address: 0x16d014e98)
RtlLookupFunctionEntry (Address: 0x16d014e18)
RtlNewSecurityObject (Address: 0x16d014ec0)
RtlNtStatusToDosError (Address: 0x16d014ea8)
RtlNtStatusToDosErrorNoTeb (Address: 0x16d014f10)
RtlPublishWnfStateData (Address: 0x16d014f08)
RtlQueryWnfStateData (Address: 0x16d014f30)
RtlReAllocateHeap (Address: 0x16d014ef0)
RtlSubscribeWnfStateChangeNotification (Address: 0x16d014f28)
RtlUnsubscribeWnfNotificationWaitForCompletion (Address: 0x16d014f20)
RtlVirtualUnwind (Address: 0x16d014e90)

RPCRT4.dll

I_RpcBindingInqLocalClientPID (Address: 0x16d014918)
I_RpcBindingIsClientLocal (Address: 0x16d0148e0)
I_RpcMapWin32Status (Address: 0x16d0148f8)
Ndr64AsyncServerCallAll (Address: 0x16d0148c8)
NdrAsyncServerCall (Address: 0x16d0148d0)
NdrServerCall2 (Address: 0x16d0148d8)
NdrServerCallAll (Address: 0x16d0148c0)
RpcAsyncCompleteCall (Address: 0x16d0148f0)
RpcBindingToStringBindingW (Address: 0x16d014928)
RpcImpersonateClient (Address: 0x16d014900)
RpcRevertToSelf (Address: 0x16d014908)
RpcServerInterfaceGroupActivate (Address: 0x16d0148e8)
RpcServerInterfaceGroupClose (Address: 0x16d014940)
RpcServerInterfaceGroupCreateW (Address: 0x16d014910)
RpcServerInterfaceGroupDeactivate (Address: 0x16d014920)
RpcStringBindingParseW (Address: 0x16d014930)
RpcStringFreeW (Address: 0x16d014938)