termsrv.dll

api-ms-win-core-apiquery-l1-1-0.dll

ApiSetQueryApiSetPresence (Address: 0x1800d7cf0)

api-ms-win-core-debug-l1-1-0.dll

DebugBreak (Address: 0x1800d7d18)
IsDebuggerPresent (Address: 0x1800d7d00)
OutputDebugStringA (Address: 0x1800d7d08)
OutputDebugStringW (Address: 0x1800d7d10)

api-ms-win-core-delayload-l1-1-0.dll

DelayLoadFailureHook (Address: 0x1800d7d28)

api-ms-win-core-delayload-l1-1-1.dll

ResolveDelayLoadedAPI (Address: 0x1800d7d38)

api-ms-win-core-errorhandling-l1-1-0.dll

GetLastError (Address: 0x1800d7d50)
RaiseException (Address: 0x1800d7d58)
SetLastError (Address: 0x1800d7d60)
SetUnhandledExceptionFilter (Address: 0x1800d7d68)
UnhandledExceptionFilter (Address: 0x1800d7d48)

api-ms-win-core-file-l1-1-0.dll

CompareFileTime (Address: 0x1800d7d80)
CreateDirectoryW (Address: 0x1800d7d78)
CreateFileW (Address: 0x1800d7d88)
QueryDosDeviceW (Address: 0x1800d7d90)

api-ms-win-core-handle-l1-1-0.dll

CloseHandle (Address: 0x1800d7da0)
DuplicateHandle (Address: 0x1800d7da8)

api-ms-win-core-heap-l1-1-0.dll

GetProcessHeap (Address: 0x1800d7db8)
HeapAlloc (Address: 0x1800d7dc8)
HeapFree (Address: 0x1800d7dc0)

api-ms-win-core-heap-l2-1-0.dll

LocalAlloc (Address: 0x1800d7de0)
LocalFree (Address: 0x1800d7dd8)

api-ms-win-core-heap-obsolete-l1-1-0.dll

LocalSize (Address: 0x1800d7df0)

api-ms-win-core-io-l1-1-0.dll

DeviceIoControl (Address: 0x1800d7e00)

api-ms-win-core-kernel32-legacy-l1-1-0.dll

GetComputerNameW (Address: 0x1800d7e20)
RegisterWaitForSingleObject (Address: 0x1800d7e10)
UnregisterWait (Address: 0x1800d7e18)

api-ms-win-core-kernel32-legacy-l1-1-1.dll

VerifyVersionInfoW (Address: 0x1800d7e30)

api-ms-win-core-kernel32-private-l1-1-0.dll

CheckElevationEnabled (Address: 0x1800d7e40)

api-ms-win-core-libraryloader-l1-2-0.dll

DisableThreadLibraryCalls (Address: 0x1800d7e68)
FindResourceExW (Address: 0x1800d7e78)
FreeLibrary (Address: 0x1800d7e88)
GetModuleFileNameA (Address: 0x1800d7ea8)
GetModuleFileNameW (Address: 0x1800d7e90)
GetModuleHandleExA (Address: 0x1800d7e98)
GetModuleHandleExW (Address: 0x1800d7eb0)
GetModuleHandleW (Address: 0x1800d7ea0)
GetProcAddress (Address: 0x1800d7e58)
LoadLibraryExW (Address: 0x1800d7e50)
LoadResource (Address: 0x1800d7e60)
LoadStringW (Address: 0x1800d7e80)
SizeofResource (Address: 0x1800d7e70)

api-ms-win-core-libraryloader-l1-2-1.dll

LoadLibraryW (Address: 0x1800d7ec0)

api-ms-win-core-localization-l1-2-0.dll

FormatMessageW (Address: 0x1800d7ed0)

api-ms-win-core-processenvironment-l1-1-0.dll

ExpandEnvironmentStringsW (Address: 0x1800d7ee0)

api-ms-win-core-processthreads-l1-1-0.dll

CreateProcessAsUserW (Address: 0x1800d7f68)
CreateProcessW (Address: 0x1800d7f40)
CreateThread (Address: 0x1800d7ef8)
ExitThread (Address: 0x1800d7f30)
GetCurrentProcess (Address: 0x1800d7f50)
GetCurrentProcessId (Address: 0x1800d7f58)
GetCurrentThread (Address: 0x1800d7f00)
GetCurrentThreadId (Address: 0x1800d7f70)
GetExitCodeThread (Address: 0x1800d7f28)
OpenProcessToken (Address: 0x1800d7f48)
OpenThreadToken (Address: 0x1800d7f38)
ProcessIdToSessionId (Address: 0x1800d7ef0)
TerminateProcess (Address: 0x1800d7f60)
TlsAlloc (Address: 0x1800d7f18)
TlsFree (Address: 0x1800d7f08)
TlsGetValue (Address: 0x1800d7f10)
TlsSetValue (Address: 0x1800d7f20)

api-ms-win-core-processthreads-l1-1-1.dll

OpenProcess (Address: 0x1800d7f80)

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter (Address: 0x1800d7f90)

api-ms-win-core-psapi-l1-1-0.dll

K32EnumProcessModules (Address: 0x1800d7fa0)

api-ms-win-core-registry-l1-1-0.dll

RegCloseKey (Address: 0x1800d7fd0)
RegCreateKeyExW (Address: 0x1800d7fe0)
RegDeleteValueW (Address: 0x1800d7fb0)
RegEnumKeyExW (Address: 0x1800d7fb8)
RegGetValueW (Address: 0x1800d7fe8)
RegOpenKeyExW (Address: 0x1800d7ff0)
RegQueryInfoKeyW (Address: 0x1800d7fc0)
RegQueryValueExW (Address: 0x1800d7fc8)
RegSetValueExW (Address: 0x1800d7fd8)

api-ms-win-core-string-l1-1-0.dll

MultiByteToWideChar (Address: 0x1800d8000)

api-ms-win-core-string-l2-1-0.dll

CharNextW (Address: 0x1800d8010)

api-ms-win-core-string-obsolete-l1-1-0.dll

lstrcmpiW (Address: 0x1800d8028)
lstrcmpW (Address: 0x1800d8020)

api-ms-win-core-synch-l1-1-0.dll

AcquireSRWLockExclusive (Address: 0x1800d8068)
AcquireSRWLockShared (Address: 0x1800d80c0)
CreateEventW (Address: 0x1800d8088)
CreateMutexExW (Address: 0x1800d8098)
CreateSemaphoreExW (Address: 0x1800d80b8)
DeleteCriticalSection (Address: 0x1800d8070)
EnterCriticalSection (Address: 0x1800d8048)
InitializeCriticalSection (Address: 0x1800d8038)
InitializeCriticalSectionAndSpinCount (Address: 0x1800d8078)
InitializeCriticalSectionEx (Address: 0x1800d8058)
InitializeSRWLock (Address: 0x1800d8060)
LeaveCriticalSection (Address: 0x1800d8040)
OpenEventW (Address: 0x1800d8080)
OpenSemaphoreW (Address: 0x1800d8050)
ReleaseMutex (Address: 0x1800d80d8)
ReleaseSemaphore (Address: 0x1800d80e8)
ReleaseSRWLockExclusive (Address: 0x1800d80a8)
ReleaseSRWLockShared (Address: 0x1800d80c8)
ResetEvent (Address: 0x1800d80e0)
SetEvent (Address: 0x1800d80b0)
WaitForMultipleObjectsEx (Address: 0x1800d8090)
WaitForSingleObject (Address: 0x1800d80a0)
WaitForSingleObjectEx (Address: 0x1800d80d0)

api-ms-win-core-synch-l1-2-0.dll

Sleep (Address: 0x1800d80f8)

api-ms-win-core-synch-l1-2-1.dll

CreateSemaphoreW (Address: 0x1800d8108)
WaitForMultipleObjects (Address: 0x1800d8110)

api-ms-win-core-sysinfo-l1-1-0.dll

GetSystemDirectoryW (Address: 0x1800d8128)
GetSystemTime (Address: 0x1800d8138)
GetSystemTimeAsFileTime (Address: 0x1800d8148)
GetTickCount (Address: 0x1800d8130)
GetTickCount64 (Address: 0x1800d8120)
GetVersionExW (Address: 0x1800d8140)

api-ms-win-core-sysinfo-l1-2-0.dll

GetProductInfo (Address: 0x1800d8158)

api-ms-win-core-threadpool-l1-2-0.dll

CloseThreadpool (Address: 0x1800d8190)
CloseThreadpoolCleanupGroup (Address: 0x1800d8188)
CloseThreadpoolCleanupGroupMembers (Address: 0x1800d8178)
CloseThreadpoolTimer (Address: 0x1800d81a8)
CreateThreadpool (Address: 0x1800d8180)
CreateThreadpoolCleanupGroup (Address: 0x1800d8168)
CreateThreadpoolTimer (Address: 0x1800d81c0)
SetThreadpoolThreadMaximum (Address: 0x1800d81b8)
SetThreadpoolThreadMinimum (Address: 0x1800d81a0)
SetThreadpoolTimer (Address: 0x1800d81b0)
TrySubmitThreadpoolCallback (Address: 0x1800d8170)
WaitForThreadpoolTimerCallbacks (Address: 0x1800d8198)

api-ms-win-core-threadpool-legacy-l1-1-0.dll

CreateTimerQueue (Address: 0x1800d81e0)
CreateTimerQueueTimer (Address: 0x1800d81d8)
DeleteTimerQueueEx (Address: 0x1800d81e8)
DeleteTimerQueueTimer (Address: 0x1800d81f0)
QueueUserWorkItem (Address: 0x1800d81d0)
UnregisterWaitEx (Address: 0x1800d81f8)

api-ms-win-core-timezone-l1-1-0.dll

SystemTimeToFileTime (Address: 0x1800d8208)

api-ms-win-devices-query-l1-1-0.dll

DevCloseObjectQuery (Address: 0x1800d8218)
DevCreateObjectQuery (Address: 0x1800d8220)
DevFreeObjectProperties (Address: 0x1800d8230)
DevGetObjectProperties (Address: 0x1800d8228)

api-ms-win-eventing-classicprovider-l1-1-0.dll

TraceMessage (Address: 0x1800d8240)

api-ms-win-eventing-controller-l1-1-0.dll

ControlTraceW (Address: 0x1800d8250)
EnableTraceEx2 (Address: 0x1800d8258)
StartTraceW (Address: 0x1800d8260)

api-ms-win-eventing-provider-l1-1-0.dll

EventActivityIdControl (Address: 0x1800d8290)
EventRegister (Address: 0x1800d8270)
EventSetInformation (Address: 0x1800d8288)
EventUnregister (Address: 0x1800d8280)
EventWriteTransfer (Address: 0x1800d8278)

api-ms-win-security-base-l1-1-0.dll

AccessCheckAndAuditAlarmW (Address: 0x1800d8308)
AddAce (Address: 0x1800d82b0)
AllocateAndInitializeSid (Address: 0x1800d82c0)
AllocateLocallyUniqueId (Address: 0x1800d82a0)
CheckTokenMembership (Address: 0x1800d82e0)
CopySid (Address: 0x1800d8360)
CreateWellKnownSid (Address: 0x1800d8300)
DuplicateToken (Address: 0x1800d8378)
DuplicateTokenEx (Address: 0x1800d82f0)
EqualSid (Address: 0x1800d8318)
FreeSid (Address: 0x1800d8350)
GetAce (Address: 0x1800d8348)
GetAclInformation (Address: 0x1800d82a8)
GetFileSecurityW (Address: 0x1800d8320)
GetLengthSid (Address: 0x1800d8338)
GetSecurityDescriptorControl (Address: 0x1800d8370)
GetSecurityDescriptorDacl (Address: 0x1800d8310)
GetSecurityDescriptorLength (Address: 0x1800d82b8)
GetTokenInformation (Address: 0x1800d82e8)
ImpersonateLoggedOnUser (Address: 0x1800d8368)
InitializeAcl (Address: 0x1800d82d8)
InitializeSecurityDescriptor (Address: 0x1800d82c8)
IsValidSecurityDescriptor (Address: 0x1800d8358)
IsValidSid (Address: 0x1800d8330)
MakeAbsoluteSD (Address: 0x1800d8340)
MakeSelfRelativeSD (Address: 0x1800d8328)
RevertToSelf (Address: 0x1800d82f8)
SetSecurityDescriptorDacl (Address: 0x1800d82d0)

KERNEL32.dll

OOBEComplete (Address: 0x1800d7bb8)

KERNELBASE.dll

WTSIsServerContainer (Address: 0x1800d7bc8)

msvcrt.dll

__C_specific_handler (Address: 0x1800d8490)
__CxxFrameHandler3 (Address: 0x1800d8438)
__CxxFrameHandler4 (Address: 0x1800d84c8)
__dllonexit (Address: 0x1800d84a8)
_amsg_exit (Address: 0x1800d8468)
_callnewh (Address: 0x1800d8428)
_CxxThrowException (Address: 0x1800d8430)
_errno (Address: 0x1800d84c0)
_initterm (Address: 0x1800d8470)
_lock (Address: 0x1800d8480)
_onexit (Address: 0x1800d84b0)
_purecall (Address: 0x1800d8488)
_resetstkoflw (Address: 0x1800d8420)
_stricmp (Address: 0x1800d83f8)
_unlock (Address: 0x1800d84a0)
_vsnprintf (Address: 0x1800d84e8)
_vsnprintf_s (Address: 0x1800d83c0)
_vsnwprintf (Address: 0x1800d83d8)
_wcsicmp (Address: 0x1800d83e8)
_wcsnicmp (Address: 0x1800d83b0)
_XcptFilter (Address: 0x1800d8460)
??_V@YAXPEAX@Z (Address: 0x1800d8498)
??0exception@@QEAA@AEBQEBD@Z (Address: 0x1800d84f8)
??0exception@@QEAA@AEBQEBDH@Z (Address: 0x1800d8450)
??0exception@@QEAA@AEBV0@@Z (Address: 0x1800d8390)
??0exception@@QEAA@XZ (Address: 0x1800d8388)
??1exception@@UEAA@XZ (Address: 0x1800d84e0)
??1type_info@@UEAA@XZ (Address: 0x1800d84b8)
??3@YAXPEAX@Z (Address: 0x1800d84f0)
?terminate@@YAXXZ (Address: 0x1800d8478)
?what@exception@@UEBAPEBDXZ (Address: 0x1800d8458)
free (Address: 0x1800d83a0)
iswspace (Address: 0x1800d8408)
malloc (Address: 0x1800d83d0)
memcmp (Address: 0x1800d84d8)
memcpy (Address: 0x1800d8440)
memcpy_s (Address: 0x1800d83c8)
memmove (Address: 0x1800d8448)
memmove_s (Address: 0x1800d8398)
memset (Address: 0x1800d8500)
qsort (Address: 0x1800d83e0)
realloc (Address: 0x1800d84d0)
swprintf_s (Address: 0x1800d8418)
wcschr (Address: 0x1800d8400)
wcscpy_s (Address: 0x1800d8410)
wcsncpy_s (Address: 0x1800d83b8)
wcsrchr (Address: 0x1800d83f0)
wcstok_s (Address: 0x1800d83a8)

ntdll.dll

DbgPrint (Address: 0x1800d8578)
EtwEventActivityIdControl (Address: 0x1800d8610)
EtwEventRegister (Address: 0x1800d8670)
EtwEventUnregister (Address: 0x1800d8678)
EtwEventWriteFull (Address: 0x1800d8660)
EtwEventWriteTransfer (Address: 0x1800d8620)
NtCreateFile (Address: 0x1800d85e8)
NtDuplicateToken (Address: 0x1800d8550)
NtOpenProcess (Address: 0x1800d8510)
NtOpenProcessToken (Address: 0x1800d8518)
NtQueryInformationProcess (Address: 0x1800d8540)
NtQueryInformationToken (Address: 0x1800d8560)
NtQuerySystemInformation (Address: 0x1800d8598)
NtQuerySystemTime (Address: 0x1800d8618)
NtQueryVirtualMemory (Address: 0x1800d85a0)
RtlAcquireResourceExclusive (Address: 0x1800d8558)
RtlAcquireResourceShared (Address: 0x1800d8568)
RtlAdjustPrivilege (Address: 0x1800d85f8)
RtlAllocateAndInitializeSid (Address: 0x1800d8668)
RtlCaptureContext (Address: 0x1800d85c8)
RtlCaptureStackBackTrace (Address: 0x1800d8590)
RtlCompareMemory (Address: 0x1800d85d8)
RtlCopySecurityDescriptor (Address: 0x1800d8528)
RtlCopySid (Address: 0x1800d8680)
RtlCreateUserSecurityObject (Address: 0x1800d8538)
RtlDeleteElementGenericTable (Address: 0x1800d8638)
RtlDeleteResource (Address: 0x1800d8658)
RtlDeleteSecurityObject (Address: 0x1800d8520)
RtlEnumerateGenericTable (Address: 0x1800d8628)
RtlEqualSid (Address: 0x1800d8580)
RtlFreeSid (Address: 0x1800d85a8)
RtlGetControlSecurityDescriptor (Address: 0x1800d8530)
RtlGetCurrentServiceSessionId (Address: 0x1800d8608)
RtlInitializeGenericTable (Address: 0x1800d8648)
RtlInitializeResource (Address: 0x1800d8650)
RtlInitString (Address: 0x1800d85e0)
RtlInitUnicodeString (Address: 0x1800d85f0)
RtlInsertElementGenericTable (Address: 0x1800d8640)
RtlLengthSid (Address: 0x1800d8548)
RtlLookupElementGenericTable (Address: 0x1800d8630)
RtlLookupFunctionEntry (Address: 0x1800d85c0)
RtlNtStatusToDosError (Address: 0x1800d8570)
RtlNumberGenericTableElements (Address: 0x1800d8600)
RtlReleaseResource (Address: 0x1800d85b0)
RtlVerifyVersionInfo (Address: 0x1800d8588)
RtlVirtualUnwind (Address: 0x1800d85b8)
VerSetConditionMask (Address: 0x1800d85d0)

RPCRT4.dll

I_RpcBindingInqLocalClientPID (Address: 0x1800d7c30)
I_RpcBindingIsClientLocal (Address: 0x1800d7c18)
NdrServerCall2 (Address: 0x1800d7c58)
NdrServerCallAll (Address: 0x1800d7c08)
RpcBindingToStringBindingW (Address: 0x1800d7c00)
RpcImpersonateClient (Address: 0x1800d7c40)
RpcRevertToSelf (Address: 0x1800d7c38)
RpcServerInqCallAttributesW (Address: 0x1800d7c48)
RpcServerInqDefaultPrincNameW (Address: 0x1800d7c60)
RpcServerListen (Address: 0x1800d7bf0)
RpcServerRegisterAuthInfoW (Address: 0x1800d7c28)
RpcServerRegisterIf3 (Address: 0x1800d7c20)
RpcServerRegisterIfEx (Address: 0x1800d7be8)
RpcServerUnregisterIfEx (Address: 0x1800d7bf8)
RpcServerUseProtseqEpW (Address: 0x1800d7be0)
RpcStringBindingParseW (Address: 0x1800d7c10)
RpcStringFreeW (Address: 0x1800d7c50)
UuidFromStringW (Address: 0x1800d7bd8)
UuidToStringW (Address: 0x1800d7c68)

UMPDC.dll

PdcTaskClientRegister (Address: 0x1800d7c88)
PdcTaskClientRequest (Address: 0x1800d7ca0)
PdcTaskClientUnregister (Address: 0x1800d7c78)
Pdcv2ActivationClientActivate (Address: 0x1800d7c90)
Pdcv2ActivationClientDeactivate (Address: 0x1800d7c98)
Pdcv2ActivationClientRegister (Address: 0x1800d7c80)
Pdcv2ActivationClientUnregister (Address: 0x1800d7ca8)

USER32.dll

UnregisterDeviceNotification (Address: 0x1800d7cb8)

WS2_32.dll

GetNameInfoW (Address: 0x1800d7cd0)
WSACleanup (Address: 0x1800d7ce0)
WSAGetLastError (Address: 0x1800d7cc8)
WSAStartup (Address: 0x1800d7cd8)

Security Warning

Exported Functions

Imported DLLs & Functions