shell32.dll

Description: Windows Shell Common Dll

Version: 6.1.7600.16385

Architecture: 64-bit

Operating System: Windows NT

SHA256: 21e1daec14e1ae657b7c66e29f84c67c

File Size: 13.5 MB

Uploaded At: Sept. 3, 2026, 8:13 p.m.

Views: 3

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

SHChangeNotifyRegister (Ordinal: 2, Address: 0x86260)
SHDefExtractIconA (Ordinal: 3, Address: 0x2547ec)
SHChangeNotifyDeregister (Ordinal: 4, Address: 0x88d80)
(Ordinal: 5, Address: 0x46c521)
SHDefExtractIconW (Ordinal: 6, Address: 0x67f80)
(Ordinal: 7, Address: 0x46c52e)
(Ordinal: 8, Address: 0x46c53c)
PifMgr_OpenProperties (Ordinal: 9, Address: 0x96498)
PifMgr_GetProperties (Ordinal: 10, Address: 0x96498)
PifMgr_SetProperties (Ordinal: 11, Address: 0x96498)
(Ordinal: 12, Address: 0x2594b4)
PifMgr_CloseProperties (Ordinal: 13, Address: 0x21d8ec)
SHStartNetConnectionDialogW (Ordinal: 14, Address: 0x2593d8)
(Ordinal: 15, Address: 0x256a30)
ILFindLastID (Ordinal: 16, Address: 0x99820)
ILRemoveLastID (Ordinal: 17, Address: 0x9b16c)
ILClone (Ordinal: 18, Address: 0x970bc)
ILCloneFirst (Ordinal: 19, Address: 0x99498)
(Ordinal: 20, Address: 0x970bc)
ILIsEqual (Ordinal: 21, Address: 0x9f4e0)
DAD_DragEnterEx2 (Ordinal: 22, Address: 0x249a04)
ILIsParent (Ordinal: 23, Address: 0x1a3ba4)
ILFindChild (Ordinal: 24, Address: 0x1816a0)
ILCombine (Ordinal: 25, Address: 0x95150)
(Ordinal: 26, Address: 0x46c54a)
ILSaveToStream (Ordinal: 27, Address: 0x4b5e8)
SHILCreateFromPath (Ordinal: 28, Address: 0x19a430)
(Ordinal: 29, Address: 0x23fed0)
(Ordinal: 30, Address: 0x46c557)
(Ordinal: 31, Address: 0x46c56e)
(Ordinal: 32, Address: 0x46c589)
(Ordinal: 33, Address: 0x46c5a3)
(Ordinal: 34, Address: 0x46c5bd)
(Ordinal: 35, Address: 0x23fe8c)
(Ordinal: 36, Address: 0x23ff44)
(Ordinal: 37, Address: 0x46c5d7)
(Ordinal: 38, Address: 0x46c5ec)
(Ordinal: 39, Address: 0x46c603)
(Ordinal: 40, Address: 0x46c616)
IsLFNDriveA (Ordinal: 41, Address: 0x23f898)
IsLFNDriveW (Ordinal: 42, Address: 0x22eb8)
PathIsExe (Ordinal: 43, Address: 0x23f9f0)
(Ordinal: 44, Address: 0x244678)
(Ordinal: 45, Address: 0x23ff08)
(Ordinal: 46, Address: 0x46c62e)
PathMakeUniqueName (Ordinal: 47, Address: 0x23faac)
(Ordinal: 48, Address: 0x46c645)
PathQualify (Ordinal: 49, Address: 0x23f9d8)
(Ordinal: 50, Address: 0x46c661)
PathResolve (Ordinal: 51, Address: 0x1c8ec)
(Ordinal: 52, Address: 0x46c67a)
(Ordinal: 53, Address: 0x46c68f)
(Ordinal: 54, Address: 0x24a8d8)
(Ordinal: 55, Address: 0x46c69d)
(Ordinal: 56, Address: 0x46c6b6)
(Ordinal: 57, Address: 0x46c6d1)
(Ordinal: 58, Address: 0x230678)
RestartDialog (Ordinal: 59, Address: 0x24a2dc)
(Ordinal: 60, Address: 0x24a88c)
(Ordinal: 61, Address: 0xcbc30)
PickIconDlg (Ordinal: 62, Address: 0x21d7dc)
GetFileNameFromBrowse (Ordinal: 63, Address: 0x25633c)
DriveType (Ordinal: 64, Address: 0x6d1f0)
(Ordinal: 65, Address: 0xa4480)
IsNetDrive (Ordinal: 66, Address: 0x904c8)
Shell_MergeMenus (Ordinal: 67, Address: 0x4dc20)
SHGetSetSettings (Ordinal: 68, Address: 0x695b0)
(Ordinal: 69, Address: 0x2590c0)
(Ordinal: 70, Address: 0x187328)
Shell_GetImageLists (Ordinal: 71, Address: 0x150330)
Shell_GetCachedImageIndex (Ordinal: 72, Address: 0xd8380)
SHShellFolderView_Message (Ordinal: 73, Address: 0x286a50)
SHCreateStdEnumFmtEtc (Ordinal: 74, Address: 0x213df0)
PathYetAnotherMakeUniqueName (Ordinal: 75, Address: 0xdfce0)
(Ordinal: 76, Address: 0x21e4b8)
SHMapPIDLToSystemImageListIndex (Ordinal: 77, Address: 0x150394)
(Ordinal: 78, Address: 0x46c6ed)
(Ordinal: 79, Address: 0x46c6fa)
SHOpenPropSheetW (Ordinal: 80, Address: 0x299a3c)
OpenAs_RunDLL (Ordinal: 81, Address: 0x222b6c)
(Ordinal: 82, Address: 0x46c707)
CIDLData_CreateFromIDArray (Ordinal: 83, Address: 0x23f258)
(Ordinal: 84, Address: 0x46c714)
OpenRegStream (Ordinal: 85, Address: 0x33230)
(Ordinal: 86, Address: 0x46c721)
(Ordinal: 87, Address: 0x46c72e)
SHDoDragDrop (Ordinal: 88, Address: 0x249d5c)
SHCloneSpecialIDList (Ordinal: 89, Address: 0x232b0)
SHFindFiles (Ordinal: 90, Address: 0x2343d0)
(Ordinal: 91, Address: 0x2341fc)
PathGetShortPath (Ordinal: 92, Address: 0x23fae0)
(Ordinal: 93, Address: 0xa5e14)
(Ordinal: 94, Address: 0xaf50)
(Ordinal: 95, Address: 0x8b7ec)
(Ordinal: 96, Address: 0x46c73b)
(Ordinal: 97, Address: 0x255250)
SHGetRealIDL (Ordinal: 98, Address: 0x231420)
(Ordinal: 99, Address: 0x148c30)
SHRestricted (Ordinal: 100, Address: 0x947a0)
(Ordinal: 101, Address: 0x46c748)
SHCoCreateInstance (Ordinal: 102, Address: 0x8ee64)
SignalFileOpen (Ordinal: 103, Address: 0x1533a8)
(Ordinal: 104, Address: 0x46c754)
(Ordinal: 105, Address: 0x46c760)
(Ordinal: 106, Address: 0x46c76c)
(Ordinal: 107, Address: 0x46c778)
(Ordinal: 108, Address: 0x46c784)
(Ordinal: 109, Address: 0x46c790)
(Ordinal: 110, Address: 0x46c79c)
(Ordinal: 111, Address: 0x46c7a8)
(Ordinal: 112, Address: 0x46c7b4)
(Ordinal: 113, Address: 0x46c7c1)
(Ordinal: 114, Address: 0x46c7ce)
(Ordinal: 115, Address: 0x46c7db)
(Ordinal: 116, Address: 0x46c7e8)
(Ordinal: 117, Address: 0x46c7f5)
(Ordinal: 118, Address: 0x46c802)
IsLFNDrive (Ordinal: 119, Address: 0x22eb8)
(Ordinal: 120, Address: 0x46c80f)
(Ordinal: 121, Address: 0x46c81c)
(Ordinal: 122, Address: 0x46c829)
(Ordinal: 123, Address: 0x46c836)
(Ordinal: 124, Address: 0x46c843)
OpenAs_RunDLLA (Ordinal: 125, Address: 0x222b6c)
(Ordinal: 126, Address: 0x46c850)
(Ordinal: 127, Address: 0x46c85d)
(Ordinal: 128, Address: 0xa4a8c)
DAD_AutoScroll (Ordinal: 129, Address: 0x96498)
(Ordinal: 130, Address: 0x46c86b)
DAD_DragEnterEx (Ordinal: 131, Address: 0xa6c64)
DAD_DragLeave (Ordinal: 132, Address: 0x249b60)
OpenAs_RunDLLW (Ordinal: 133, Address: 0x222c40)
DAD_DragMove (Ordinal: 134, Address: 0x249abc)
PrepareDiscForBurnRunDllW (Ordinal: 135, Address: 0x224140)
DAD_SetDragImage (Ordinal: 136, Address: 0xa6c64)
DAD_ShowDragImage (Ordinal: 137, Address: 0xa6c64)
PrintersGetCommand_RunDLL (Ordinal: 138, Address: 0x22eafc)
PrintersGetCommand_RunDLLA (Ordinal: 139, Address: 0x22eafc)
(Ordinal: 140, Address: 0x46c878)
(Ordinal: 141, Address: 0x46c885)
(Ordinal: 142, Address: 0x46c892)
(Ordinal: 143, Address: 0x46c89f)
(Ordinal: 144, Address: 0x46c8ac)
(Ordinal: 145, Address: 0x46c8b9)
(Ordinal: 146, Address: 0x46c8d1)
SHCLSIDFromString (Ordinal: 147, Address: 0x81620)
(Ordinal: 148, Address: 0x46c8de)
SHFind_InitMenuPopup (Ordinal: 149, Address: 0x28cd44)
PrintersGetCommand_RunDLLW (Ordinal: 150, Address: 0x22ebd8)
(Ordinal: 151, Address: 0x46c8eb)
ILGetSize (Ordinal: 152, Address: 0x97a00)
ILGetNext (Ordinal: 153, Address: 0x4a72c)
ILAppendID (Ordinal: 154, Address: 0x2566b0)
ILFree (Ordinal: 155, Address: 0xa448c)
(Ordinal: 156, Address: 0xa448c)
ILCreateFromPath (Ordinal: 157, Address: 0x2568ac)
(Ordinal: 158, Address: 0x46c8f8)
(Ordinal: 159, Address: 0x46c906)
(Ordinal: 160, Address: 0x259238)
(Ordinal: 161, Address: 0x46c91f)
SHSimpleIDListFromPath (Ordinal: 162, Address: 0x10fce0)
(Ordinal: 163, Address: 0x46c92d)
Win32DeleteFile (Ordinal: 164, Address: 0x21cd08)
SHCreateDirectory (Ordinal: 165, Address: 0xfccb8)
(Ordinal: 166, Address: 0x46c93a)
SHAddFromPropSheetExtArray (Ordinal: 167, Address: 0x25c868)
SHCreatePropSheetExtArray (Ordinal: 168, Address: 0xc93c0)
SHDestroyPropSheetExtArray (Ordinal: 169, Address: 0xc9480)
SHReplaceFromPropSheetExtArray (Ordinal: 170, Address: 0x25c8e8)
PathCleanupSpec (Ordinal: 171, Address: 0x10d8b0)
(Ordinal: 172, Address: 0x2583f8)
SHValidateUNC (Ordinal: 173, Address: 0xdd40)
SHCreateShellFolderViewEx (Ordinal: 174, Address: 0x286b18)
(Ordinal: 175, Address: 0x1bf90)
SHSetInstanceExplorer (Ordinal: 176, Address: 0x19db4)
(Ordinal: 177, Address: 0x46c947)
SHObjectProperties (Ordinal: 178, Address: 0x22f334)
SHGetNewLinkInfoA (Ordinal: 179, Address: 0x257ea0)
SHGetNewLinkInfoW (Ordinal: 180, Address: 0x257e70)
(Ordinal: 181, Address: 0x3920)
ShellMessageBoxW (Ordinal: 182, Address: 0x46c508)
ShellMessageBoxA (Ordinal: 183, Address: 0x46c4ef)
(Ordinal: 184, Address: 0x96498)
(Ordinal: 185, Address: 0x46c954)
(Ordinal: 186, Address: 0x25695c)
(Ordinal: 187, Address: 0x46c962)
(Ordinal: 188, Address: 0x15d4)
ILCreateFromPathA (Ordinal: 189, Address: 0x2568f8)
ILCreateFromPathW (Ordinal: 190, Address: 0x2568ac)
SHUpdateImageA (Ordinal: 191, Address: 0x264750)
SHUpdateImageW (Ordinal: 192, Address: 0x2647c0)
SHHandleUpdateImage (Ordinal: 193, Address: 0x26488c)
(Ordinal: 194, Address: 0xc93cc)
SHFree (Ordinal: 195, Address: 0xa448c)
SHAlloc (Ordinal: 196, Address: 0x10d878)
(Ordinal: 197, Address: 0x46c970)
(Ordinal: 198, Address: 0x46c97d)
SHHelpShortcuts_RunDLL (Ordinal: 199, Address: 0x22f284)
(Ordinal: 200, Address: 0x6b98)
(Ordinal: 201, Address: 0x7a98)
(Ordinal: 202, Address: 0x46c98a)
(Ordinal: 203, Address: 0x2303f8)
(Ordinal: 204, Address: 0x23040c)
(Ordinal: 205, Address: 0x22e70c)
SHHelpShortcuts_RunDLLA (Ordinal: 206, Address: 0x22f284)
SHHelpShortcuts_RunDLLW (Ordinal: 207, Address: 0x22f328)
AppCompat_RunDLLW (Ordinal: 208, Address: 0x23bcac)
(Ordinal: 209, Address: 0x230424)
(Ordinal: 210, Address: 0x23064c)
(Ordinal: 211, Address: 0x5c614)
(Ordinal: 212, Address: 0x22e8e8)
(Ordinal: 213, Address: 0x22e4a8)
(Ordinal: 214, Address: 0x22e5b0)
(Ordinal: 215, Address: 0x2593d8)
(Ordinal: 216, Address: 0x46c997)
(Ordinal: 217, Address: 0x46c9a4)
(Ordinal: 218, Address: 0x46c9b1)
(Ordinal: 219, Address: 0x46c9be)
(Ordinal: 220, Address: 0x46c9cb)
(Ordinal: 221, Address: 0x46c9d8)
(Ordinal: 222, Address: 0x46c9e5)
(Ordinal: 223, Address: 0x46c9f2)
(Ordinal: 224, Address: 0x46c9ff)
(Ordinal: 225, Address: 0x46ca0c)
AssocCreateForClasses (Ordinal: 226, Address: 0x2d4e0)
(Ordinal: 227, Address: 0x46ca19)
AssocGetDetailsOfPropKey (Ordinal: 228, Address: 0x808a0)
CheckEscapesW (Ordinal: 229, Address: 0x23ff8c)
(Ordinal: 230, Address: 0x46ca26)
SHSetFolderPathA (Ordinal: 231, Address: 0x264b74)
SHSetFolderPathW (Ordinal: 232, Address: 0x264a30)
(Ordinal: 233, Address: 0x46ca34)
(Ordinal: 234, Address: 0x46ca41)
(Ordinal: 235, Address: 0x46ca4e)
(Ordinal: 236, Address: 0x258eb0)
(Ordinal: 237, Address: 0xb7384)
CommandLineToArgvW (Ordinal: 238, Address: 0x22ae0)
PathIsSlowW (Ordinal: 239, Address: 0x130518)
PathIsSlowA (Ordinal: 240, Address: 0x23fc5c)
(Ordinal: 241, Address: 0x698f8)
(Ordinal: 242, Address: 0x46ca5c)
(Ordinal: 243, Address: 0x46ca6a)
(Ordinal: 244, Address: 0x22594)
SHTestTokenMembership (Ordinal: 245, Address: 0x57c00)
(Ordinal: 246, Address: 0x46ca78)
(Ordinal: 247, Address: 0x46ca86)
(Ordinal: 248, Address: 0x46ca94)
(Ordinal: 249, Address: 0x46caa2)
(Ordinal: 250, Address: 0x46cac1)
(Ordinal: 251, Address: 0x46cade)
(Ordinal: 252, Address: 0x46caf6)
(Ordinal: 253, Address: 0x46cb09)
(Ordinal: 254, Address: 0x24a8ec)
Control_RunDLL (Ordinal: 255, Address: 0x244604)
SHCreateShellFolderView (Ordinal: 256, Address: 0x378c0)
(Ordinal: 257, Address: 0x96498)
(Ordinal: 258, Address: 0x19feec)
(Ordinal: 259, Address: 0xa6c64)
(Ordinal: 260, Address: 0x244f84)
(Ordinal: 261, Address: 0x28f158)
(Ordinal: 262, Address: 0x28f348)
Control_RunDLLA (Ordinal: 263, Address: 0x244604)
(Ordinal: 264, Address: 0x244fb0)
(Ordinal: 265, Address: 0xcc304)
(Ordinal: 266, Address: 0x255568)
Control_RunDLLAsUserW (Ordinal: 267, Address: 0x244694)
Control_RunDLLW (Ordinal: 268, Address: 0xc9794)
DllCanUnloadNow (Ordinal: 269, Address: 0xa6c64)
(Ordinal: 270, Address: 0x28dd48)
DllGetClassObject (Ordinal: 271, Address: 0xa4a8c)
DllGetVersion (Ordinal: 272, Address: 0x3fc4d0)
DllInstall (Ordinal: 273, Address: 0x24c5ec)
DllRegisterServer (Ordinal: 274, Address: 0x96498)
DllUnregisterServer (Ordinal: 275, Address: 0x96498)
DoEnvironmentSubstA (Ordinal: 276, Address: 0x215230)
DoEnvironmentSubstW (Ordinal: 277, Address: 0x18bc4)
DragAcceptFiles (Ordinal: 278, Address: 0xf95fc)
DragFinish (Ordinal: 279, Address: 0x21e9c8)
DragQueryFile (Ordinal: 280, Address: 0x21e9a4)
DragQueryFileA (Ordinal: 281, Address: 0x21e9a4)
DragQueryFileAorW (Ordinal: 282, Address: 0x21e6bc)
DragQueryFileW (Ordinal: 283, Address: 0x21e984)
DragQueryPoint (Ordinal: 284, Address: 0x21e644)
DuplicateIcon (Ordinal: 285, Address: 0x214c04)
ExtractAssociatedIconA (Ordinal: 286, Address: 0x215070)
ExtractAssociatedIconExA (Ordinal: 287, Address: 0x214f80)
ExtractAssociatedIconExW (Ordinal: 288, Address: 0x214cec)
ExtractAssociatedIconW (Ordinal: 289, Address: 0x214ad0)
ExtractIconA (Ordinal: 290, Address: 0x214c70)
ExtractIconEx (Ordinal: 291, Address: 0x214b40)
ExtractIconExA (Ordinal: 292, Address: 0x214b40)
ExtractIconExW (Ordinal: 293, Address: 0x111218)
ExtractIconW (Ordinal: 294, Address: 0xfc79c)
FindExecutableA (Ordinal: 295, Address: 0x255188)
FindExecutableW (Ordinal: 296, Address: 0x1010)
FreeIconList (Ordinal: 297, Address: 0xa4480)
GetCurrentProcessExplicitAppUserModelID (Ordinal: 298, Address: 0x243c0c)
InitNetworkAddressControl (Ordinal: 299, Address: 0x256e1c)
InternalExtractIconListA (Ordinal: 300, Address: 0x96498)
InternalExtractIconListW (Ordinal: 301, Address: 0x96498)
LaunchMSHelp_RunDLLW (Ordinal: 302, Address: 0x21f210)
Options_RunDLL (Ordinal: 303, Address: 0x3987a4)
Options_RunDLLA (Ordinal: 304, Address: 0x3987a4)
Options_RunDLLW (Ordinal: 305, Address: 0xb9e70)
RealShellExecuteA (Ordinal: 306, Address: 0x25a7bc)
RealShellExecuteExA (Ordinal: 307, Address: 0x25a7bc)
RealShellExecuteExW (Ordinal: 308, Address: 0x25a7bc)
RealShellExecuteW (Ordinal: 309, Address: 0x25a7bc)
RegenerateUserEnvironment (Ordinal: 310, Address: 0xa7e74)
RunAsNewUser_RunDLLW (Ordinal: 311, Address: 0x21f350)
SHAddDefaultPropertiesByExt (Ordinal: 312, Address: 0xe20e0)
SHAddToRecentDocs (Ordinal: 313, Address: 0xcffa0)
SHAppBarMessage (Ordinal: 314, Address: 0x19ddc)
SHAssocEnumHandlers (Ordinal: 315, Address: 0x10f134)
SHAssocEnumHandlersForProtocolByApplication (Ordinal: 316, Address: 0xd91c0)
SHBindToFolderIDListParent (Ordinal: 317, Address: 0x9e8a8)
SHBindToFolderIDListParentEx (Ordinal: 318, Address: 0x9b200)
SHBindToObject (Ordinal: 319, Address: 0x98b50)
SHBindToParent (Ordinal: 320, Address: 0x83d90)
SHBrowseForFolder (Ordinal: 321, Address: 0x25ef80)
SHBrowseForFolderA (Ordinal: 322, Address: 0x25ef80)
SHBrowseForFolderW (Ordinal: 323, Address: 0x25ed80)
SHChangeNotify (Ordinal: 324, Address: 0x5c830)
SHChangeNotifyRegisterThread (Ordinal: 325, Address: 0x4a824)
SHChangeNotifySuspendResume (Ordinal: 326, Address: 0x5ce2c)
SHCreateAssociationRegistration (Ordinal: 327, Address: 0xdfb0)
SHCreateDataObject (Ordinal: 328, Address: 0x185314)
SHCreateDefaultContextMenu (Ordinal: 329, Address: 0x50830)
SHCreateDefaultExtractIcon (Ordinal: 330, Address: 0x6c2c8)
SHCreateDefaultPropertiesOp (Ordinal: 331, Address: 0x25c574)
SHCreateDirectoryExA (Ordinal: 332, Address: 0x268854)
SHCreateDirectoryExW (Ordinal: 333, Address: 0xa6058)
SHCreateItemFromIDList (Ordinal: 334, Address: 0x9d9d0)
SHCreateItemFromParsingName (Ordinal: 335, Address: 0x59080)
SHCreateItemFromRelativeName (Ordinal: 336, Address: 0x192840)
SHCreateItemInKnownFolder (Ordinal: 337, Address: 0x11d51c)
SHCreateItemWithParent (Ordinal: 338, Address: 0x9ba70)
SHCreateLocalServerRunDll (Ordinal: 339, Address: 0xa7b50)
SHCreateProcessAsUserW (Ordinal: 340, Address: 0x259e30)
SHCreateQueryCancelAutoPlayMoniker (Ordinal: 341, Address: 0x274444)
SHCreateShellItem (Ordinal: 342, Address: 0x10063c)
SHCreateShellItemArray (Ordinal: 343, Address: 0x314e8)
SHCreateShellItemArrayFromDataObject (Ordinal: 344, Address: 0x4ec58)
SHCreateShellItemArrayFromIDLists (Ordinal: 345, Address: 0x66ab0)
SHCreateShellItemArrayFromShellItem (Ordinal: 346, Address: 0x315a8)
SHEmptyRecycleBinA (Ordinal: 347, Address: 0x28bed8)
SHEmptyRecycleBinW (Ordinal: 348, Address: 0x28be74)
SHEnableServiceObject (Ordinal: 349, Address: 0x114bc)
SHEnumerateUnreadMailAccountsW (Ordinal: 350, Address: 0x231e38)
SHEvaluateSystemCommandTemplate (Ordinal: 351, Address: 0x661d0)
SHExtractIconsW (Ordinal: 352, Address: 0x214bb8)
SHFileOperation (Ordinal: 353, Address: 0x26cd60)
SHFileOperationA (Ordinal: 354, Address: 0x26cd60)
SHFileOperationW (Ordinal: 355, Address: 0x59870)
SHFormatDrive (Ordinal: 356, Address: 0x23a248)
SHFreeNameMappings (Ordinal: 357, Address: 0x2687b8)
SHGetDataFromIDListA (Ordinal: 358, Address: 0x257408)
SHGetDataFromIDListW (Ordinal: 359, Address: 0x3be90)
SHGetDesktopFolder (Ordinal: 360, Address: 0x2c0e0)
SHGetDiskFreeSpaceA (Ordinal: 361, Address: 0x258c10)
SHGetDiskFreeSpaceExA (Ordinal: 362, Address: 0x258c10)
SHGetDiskFreeSpaceExW (Ordinal: 363, Address: 0x258c00)
SHGetDriveMedia (Ordinal: 364, Address: 0x24d72c)
SHGetFileInfo (Ordinal: 365, Address: 0x19fcb0)
SHGetFileInfoA (Ordinal: 366, Address: 0x19fcb0)
SHGetFileInfoW (Ordinal: 367, Address: 0x19fbc0)
SHGetFolderLocation (Ordinal: 368, Address: 0x82d70)
SHGetFolderPathA (Ordinal: 369, Address: 0xd8000)
SHGetFolderPathAndSubDirA (Ordinal: 370, Address: 0x264c28)
SHGetFolderPathAndSubDirW (Ordinal: 371, Address: 0x48650)
SHGetFolderPathEx (Ordinal: 372, Address: 0x96780)
SHGetFolderPathW (Ordinal: 373, Address: 0x7e84c)
SHGetIDListFromObject (Ordinal: 374, Address: 0x99124)
SHGetIconOverlayIndexA (Ordinal: 375, Address: 0x2935a4)
SHGetIconOverlayIndexW (Ordinal: 376, Address: 0x2934d0)
SHGetInstanceExplorer (Ordinal: 377, Address: 0x4a5c8)
SHGetItemFromDataObject (Ordinal: 378, Address: 0x52a18)
SHGetItemFromObject (Ordinal: 379, Address: 0x52ac4)
SHGetKnownFolderIDList (Ordinal: 380, Address: 0x6d1c4)
SHGetKnownFolderItem (Ordinal: 381, Address: 0x850f0)
SHGetKnownFolderPath (Ordinal: 382, Address: 0xa5d50)
SHGetLocalizedName (Ordinal: 383, Address: 0x25875c)
SHGetMalloc (Ordinal: 384, Address: 0x1bfd0)
SHGetNameFromIDList (Ordinal: 385, Address: 0x2d6e0)
SHGetNewLinkInfo (Ordinal: 386, Address: 0x257ea0)
SHGetPathFromIDList (Ordinal: 387, Address: 0x230ff4)
SHGetPathFromIDListA (Ordinal: 388, Address: 0x230ff4)
SHGetPathFromIDListEx (Ordinal: 389, Address: 0x83e24)
SHGetPathFromIDListW (Ordinal: 390, Address: 0x8b834)
SHGetPropertyStoreForWindow (Ordinal: 391, Address: 0x91d3c)
SHGetPropertyStoreFromIDList (Ordinal: 392, Address: 0x258660)
SHGetPropertyStoreFromParsingName (Ordinal: 393, Address: 0x2586dc)
SHGetSettings (Ordinal: 394, Address: 0x293be4)
SHGetSpecialFolderLocation (Ordinal: 395, Address: 0x2436c)
SHGetSpecialFolderPathA (Ordinal: 396, Address: 0x264bec)
SHGetSpecialFolderPathW (Ordinal: 397, Address: 0x1bf90)
SHGetStockIconInfo (Ordinal: 398, Address: 0x19abe0)
SHGetTemporaryPropertyForItem (Ordinal: 399, Address: 0x1815c8)
SHGetUnreadMailCountW (Ordinal: 400, Address: 0x231f1c)
SHInvokePrinterCommandA (Ordinal: 401, Address: 0x22f058)
SHInvokePrinterCommandW (Ordinal: 402, Address: 0x22ee70)
SHIsFileAvailableOffline (Ordinal: 403, Address: 0x233cf0)
SHLoadInProc (Ordinal: 404, Address: 0x743a0)
SHLoadNonloadedIconOverlayIdentifiers (Ordinal: 405, Address: 0x297cd0)
SHOpenFolderAndSelectItems (Ordinal: 406, Address: 0x258528)
SHOpenWithDialog (Ordinal: 407, Address: 0x222ab4)
SHParseDisplayName (Ordinal: 408, Address: 0x7f02c)
SHPathPrepareForWriteA (Ordinal: 409, Address: 0x29b1b4)
SHPathPrepareForWriteW (Ordinal: 410, Address: 0x5b060)
SHQueryRecycleBinA (Ordinal: 411, Address: 0x28bde0)
SHQueryRecycleBinW (Ordinal: 412, Address: 0x28bcd0)
SHQueryUserNotificationState (Ordinal: 413, Address: 0xdeb4)
SHRemoveLocalizedName (Ordinal: 414, Address: 0x25884c)
SHResolveLibrary (Ordinal: 415, Address: 0x137e24)
SHSetDefaultProperties (Ordinal: 416, Address: 0x25c690)
SHSetKnownFolderPath (Ordinal: 417, Address: 0x3adecc)
SHSetLocalizedName (Ordinal: 418, Address: 0xfc058)
SHSetTemporaryPropertyForItem (Ordinal: 419, Address: 0x19cb10)
SHSetUnreadMailCountW (Ordinal: 420, Address: 0x232160)
SHShowManageLibraryUI (Ordinal: 421, Address: 0x3bc890)
SHUpdateRecycleBinIcon (Ordinal: 422, Address: 0x108dc)
SetCurrentProcessExplicitAppUserModelID (Ordinal: 423, Address: 0xdff84)
SheChangeDirA (Ordinal: 424, Address: 0x21de3c)
SheChangeDirExW (Ordinal: 425, Address: 0x21deb0)
SheGetDirA (Ordinal: 426, Address: 0x21da80)
SheSetCurDrive (Ordinal: 427, Address: 0x21e364)
ShellAboutA (Ordinal: 428, Address: 0x29c89c)
ShellAboutW (Ordinal: 429, Address: 0xb91b8)
ShellExec_RunDLL (Ordinal: 430, Address: 0x25a15c)
ShellExec_RunDLLA (Ordinal: 431, Address: 0x25a15c)
ShellExec_RunDLLW (Ordinal: 432, Address: 0x25a014)
ShellExecuteA (Ordinal: 433, Address: 0x25a7d0)
ShellExecuteEx (Ordinal: 434, Address: 0x25a6cc)
ShellExecuteExA (Ordinal: 435, Address: 0x25a6cc)
ShellExecuteExW (Ordinal: 436, Address: 0x25528)
ShellExecuteW (Ordinal: 437, Address: 0x1bea8)
ShellHookProc (Ordinal: 438, Address: 0x96498)
Shell_GetCachedImageIndexA (Ordinal: 439, Address: 0x25487c)
Shell_GetCachedImageIndexW (Ordinal: 440, Address: 0x749a4)
Shell_NotifyIcon (Ordinal: 441, Address: 0x25c974)
Shell_NotifyIconA (Ordinal: 442, Address: 0x25c974)
Shell_NotifyIconGetRect (Ordinal: 443, Address: 0xb4120)
Shell_NotifyIconW (Ordinal: 444, Address: 0x20080)
StrChrA (Ordinal: 445, Address: 0x41fd04)
StrChrIA (Ordinal: 446, Address: 0x41fd10)
StrChrIW (Ordinal: 447, Address: 0x41fd1c)
StrChrW (Ordinal: 448, Address: 0x13d9f8)
StrCmpNA (Ordinal: 449, Address: 0x41fd28)
StrCmpNIA (Ordinal: 450, Address: 0x41fd40)
StrCmpNIW (Ordinal: 451, Address: 0xab59c)
StrCmpNW (Ordinal: 452, Address: 0x41fd4c)
StrNCmpA (Ordinal: 453, Address: 0x21c8c4)
StrNCmpIA (Ordinal: 454, Address: 0x21ca28)
StrNCmpIW (Ordinal: 455, Address: 0x21c968)
StrNCmpW (Ordinal: 456, Address: 0x21c7e4)
StrRChrA (Ordinal: 457, Address: 0x41fd58)
StrRChrIA (Ordinal: 458, Address: 0x41fd70)
StrRChrIW (Ordinal: 459, Address: 0x41fd7c)
StrRChrW (Ordinal: 460, Address: 0x41fd88)
StrRStrA (Ordinal: 461, Address: 0x21cba8)
StrRStrIA (Ordinal: 462, Address: 0x41fd94)
StrRStrIW (Ordinal: 463, Address: 0x41fda0)
StrRStrW (Ordinal: 464, Address: 0x21cacc)
StrStrA (Ordinal: 465, Address: 0x41fdac)
StrStrIA (Ordinal: 466, Address: 0x41fdb8)
StrStrIW (Ordinal: 467, Address: 0x10e584)
StrStrW (Ordinal: 468, Address: 0x41fdd0)
WOWShellExecute (Ordinal: 469, Address: 0x259e4c)
WaitForExplorerRestartW (Ordinal: 470, Address: 0x24ca24)
(Ordinal: 520, Address: 0x46cb17)
(Ordinal: 521, Address: 0x46cb24)
(Ordinal: 522, Address: 0x46cb31)
(Ordinal: 523, Address: 0x46cb3e)
RealDriveType (Ordinal: 524, Address: 0x8f098)
(Ordinal: 525, Address: 0x46cb4b)
SHFlushSFCache (Ordinal: 526, Address: 0x28cdf0)
(Ordinal: 640, Address: 0x46cb59)
(Ordinal: 641, Address: 0x46cb66)
(Ordinal: 643, Address: 0x46cb73)
SHChangeNotification_Lock (Ordinal: 644, Address: 0xa2a28)
SHChangeNotification_Unlock (Ordinal: 645, Address: 0xa2aa8)
(Ordinal: 646, Address: 0x46cb80)
(Ordinal: 648, Address: 0x46cb8d)
(Ordinal: 650, Address: 0x46cb9b)
(Ordinal: 651, Address: 0x2141b0)
WriteCabinetState (Ordinal: 652, Address: 0xb2830)
(Ordinal: 653, Address: 0x46cbb3)
ReadCabinetState (Ordinal: 654, Address: 0x1247c4)
(Ordinal: 660, Address: 0x26b80)
IsUserAnAdmin (Ordinal: 680, Address: 0x258df0)
(Ordinal: 681, Address: 0x1a48e8)
StgMakeUniqueName (Ordinal: 682, Address: 0x29d980)
(Ordinal: 683, Address: 0x3065b8)
(Ordinal: 684, Address: 0x3065b8)
SHPropStgCreate (Ordinal: 685, Address: 0xd8600)
SHPropStgReadMultiple (Ordinal: 688, Address: 0xd848c)
SHPropStgWriteMultiple (Ordinal: 689, Address: 0xd8200)
(Ordinal: 690, Address: 0x3fc880)
(Ordinal: 691, Address: 0x46cbc0)
(Ordinal: 700, Address: 0x46cbce)
CDefFolderMenu_Create2 (Ordinal: 701, Address: 0x23e81c)
(Ordinal: 702, Address: 0x50dc8)
(Ordinal: 703, Address: 0x46cbdc)
(Ordinal: 704, Address: 0x46cbe9)
(Ordinal: 707, Address: 0x46cbf6)
(Ordinal: 708, Address: 0x46cc03)
SHGetSetFolderCustomSettings (Ordinal: 709, Address: 0xdc8f0)
(Ordinal: 711, Address: 0x104f14)
(Ordinal: 712, Address: 0x46cc10)
(Ordinal: 713, Address: 0x23f8f4)
(Ordinal: 714, Address: 0x109b14)
(Ordinal: 715, Address: 0x46cc1d)
SHMultiFileProperties (Ordinal: 716, Address: 0x299fb4)
(Ordinal: 719, Address: 0x8b0fc)
(Ordinal: 720, Address: 0x46cc2b)
(Ordinal: 721, Address: 0x46cc38)
(Ordinal: 722, Address: 0x46cc45)
(Ordinal: 723, Address: 0x7e730)
(Ordinal: 724, Address: 0x46cc53)
(Ordinal: 725, Address: 0x46cc61)
(Ordinal: 726, Address: 0x46cc6e)
SHGetImageList (Ordinal: 727, Address: 0x90210)
RestartDialogEx (Ordinal: 730, Address: 0x24a2e8)
(Ordinal: 731, Address: 0x4a00)
(Ordinal: 732, Address: 0x8b9a0)
(Ordinal: 733, Address: 0x1a4eb0)
(Ordinal: 740, Address: 0x2823c)
SHCreateFileExtractIconW (Ordinal: 743, Address: 0x258a34)
(Ordinal: 744, Address: 0x245d70)
(Ordinal: 745, Address: 0x46cc7b)
SHLimitInputEdit (Ordinal: 747, Address: 0x294d0c)
(Ordinal: 748, Address: 0x294eb0)
(Ordinal: 749, Address: 0x46cc89)
SHGetAttributesFromDataObject (Ordinal: 750, Address: 0x186690)
(Ordinal: 751, Address: 0x232830)
(Ordinal: 752, Address: 0x259600)
(Ordinal: 753, Address: 0xe878)
(Ordinal: 754, Address: 0x294ad0)
(Ordinal: 755, Address: 0x230938)
(Ordinal: 756, Address: 0x46cc96)
(Ordinal: 757, Address: 0x9d840)
(Ordinal: 758, Address: 0x28ac2c)
(Ordinal: 759, Address: 0x28ab40)
(Ordinal: 760, Address: 0x266960)
(Ordinal: 761, Address: 0x264544)
(Ordinal: 762, Address: 0x46cca3)
(Ordinal: 763, Address: 0xb9d24)
(Ordinal: 764, Address: 0x8e924)
(Ordinal: 766, Address: 0x46ccb1)
(Ordinal: 767, Address: 0x8f670)
(Ordinal: 777, Address: 0x4e0a8)
(Ordinal: 778, Address: 0xe1e00)
(Ordinal: 781, Address: 0x25dbac)
(Ordinal: 786, Address: 0x46ccbf)
(Ordinal: 787, Address: 0x90c04)
(Ordinal: 788, Address: 0x276274)
(Ordinal: 789, Address: 0x145a50)
(Ordinal: 790, Address: 0x257110)
(Ordinal: 791, Address: 0x132030)
(Ordinal: 810, Address: 0x28eea0)
(Ordinal: 811, Address: 0x28e8a8)
(Ordinal: 812, Address: 0x3fe200)
(Ordinal: 813, Address: 0x3fe28c)
(Ordinal: 814, Address: 0x12b964)
(Ordinal: 815, Address: 0x1147b0)
(Ordinal: 816, Address: 0x41ed68)
(Ordinal: 817, Address: 0x41ec90)
(Ordinal: 818, Address: 0x111c74)
(Ordinal: 819, Address: 0xbfe18)
(Ordinal: 820, Address: 0x46cccd)
(Ordinal: 821, Address: 0x46ccdb)
(Ordinal: 822, Address: 0x46cce9)
(Ordinal: 823, Address: 0x178440)
(Ordinal: 824, Address: 0x124324)
(Ordinal: 825, Address: 0x11cc00)
(Ordinal: 826, Address: 0x46ccf7)
(Ordinal: 827, Address: 0x46cd05)
(Ordinal: 828, Address: 0x23ec00)
(Ordinal: 829, Address: 0x23ee4c)
(Ordinal: 830, Address: 0x12d1e0)
(Ordinal: 831, Address: 0x234b44)
(Ordinal: 832, Address: 0x46cd13)
(Ordinal: 833, Address: 0x7e7d8)
(Ordinal: 834, Address: 0x46cd21)
(Ordinal: 835, Address: 0x46cd2f)
(Ordinal: 836, Address: 0x46cd3d)
(Ordinal: 837, Address: 0x46cd4b)
(Ordinal: 838, Address: 0x46cd59)
(Ordinal: 839, Address: 0x46cd67)
(Ordinal: 840, Address: 0x259960)
(Ordinal: 841, Address: 0x46cd75)
(Ordinal: 842, Address: 0x46cd83)
(Ordinal: 843, Address: 0x46cd91)
(Ordinal: 844, Address: 0x41edf0)
(Ordinal: 845, Address: 0x41ee70)
ILLoadFromStreamEx (Ordinal: 846, Address: 0x63748)
(Ordinal: 847, Address: 0x11ccb0)
(Ordinal: 848, Address: 0x25ec64)
(Ordinal: 849, Address: 0x129d90)
(Ordinal: 850, Address: 0x898d8)
(Ordinal: 851, Address: 0x141cc0)
(Ordinal: 852, Address: 0x46cd9f)
(Ordinal: 854, Address: 0x46cdad)
(Ordinal: 856, Address: 0x46cdbb)
(Ordinal: 857, Address: 0x46cdc9)
(Ordinal: 858, Address: 0x46cdd7)
(Ordinal: 859, Address: 0xee07c)
(Ordinal: 860, Address: 0x47090)
(Ordinal: 861, Address: 0x46cde5)
(Ordinal: 862, Address: 0x9c9c8)
(Ordinal: 863, Address: 0x46cdf3)
(Ordinal: 864, Address: 0xcf3e8)
(Ordinal: 865, Address: 0x19b420)
(Ordinal: 866, Address: 0x67ca8)
(Ordinal: 867, Address: 0x46ce01)
(Ordinal: 868, Address: 0x46ce0f)
(Ordinal: 869, Address: 0x46ce1d)
(Ordinal: 870, Address: 0x153560)
(Ordinal: 871, Address: 0x17fe80)
(Ordinal: 872, Address: 0x46ce2b)
(Ordinal: 873, Address: 0x19acb0)
(Ordinal: 874, Address: 0x1761d0)
(Ordinal: 875, Address: 0x176174)
(Ordinal: 876, Address: 0x13a370)
(Ordinal: 877, Address: 0x252db4)
(Ordinal: 878, Address: 0x125388)
(Ordinal: 880, Address: 0x11d5f0)
(Ordinal: 881, Address: 0xb6444)
(Ordinal: 882, Address: 0xb6db0)
(Ordinal: 883, Address: 0x3fb910)
(Ordinal: 884, Address: 0x249fec)
(Ordinal: 885, Address: 0x2254)
(Ordinal: 886, Address: 0x2348d0)
(Ordinal: 887, Address: 0x2634f0)
(Ordinal: 888, Address: 0x294db8)
(Ordinal: 889, Address: 0x242c1c)
(Ordinal: 890, Address: 0x8dda0)
(Ordinal: 891, Address: 0xb010)
(Ordinal: 892, Address: 0x3a00)
(Ordinal: 893, Address: 0x153d10)
(Ordinal: 894, Address: 0x109ff4)
(Ordinal: 895, Address: 0x1f320)
(Ordinal: 896, Address: 0x242820)
(Ordinal: 897, Address: 0x144560)
(Ordinal: 898, Address: 0x258234)
(Ordinal: 899, Address: 0x1224)
(Ordinal: 900, Address: 0x17c574)
(Ordinal: 901, Address: 0x1051a4)
(Ordinal: 902, Address: 0x68130)
(Ordinal: 903, Address: 0xe78c4)

Imported DLLs & Functions

API-MS-Win-Core-Debug-L1-1-0.dll

OutputDebugStringA (Address: 0x7ff78cec228)
OutputDebugStringW (Address: 0x7ff78cec220)

API-MS-Win-Core-ErrorHandling-L1-1-0.dll

GetLastError (Address: 0x7ff78cec260)
RaiseException (Address: 0x7ff78cec248)
SetErrorMode (Address: 0x7ff78cec240)
SetLastError (Address: 0x7ff78cec238)
SetUnhandledExceptionFilter (Address: 0x7ff78cec258)
UnhandledExceptionFilter (Address: 0x7ff78cec250)

API-MS-Win-Core-File-L1-1-0.dll

CompareFileTime (Address: 0x7ff78cec280)
CreateDirectoryW (Address: 0x7ff78cec2d0)
CreateFileW (Address: 0x7ff78cec300)
DeleteFileW (Address: 0x7ff78cec2e0)
FileTimeToSystemTime (Address: 0x7ff78cec388)
FindClose (Address: 0x7ff78cec318)
FindCloseChangeNotification (Address: 0x7ff78cec338)
FindFirstChangeNotificationW (Address: 0x7ff78cec340)
FindFirstFileExW (Address: 0x7ff78cec380)
FindFirstFileW (Address: 0x7ff78cec308)
FindFirstVolumeW (Address: 0x7ff78cec368)
FindNextChangeNotification (Address: 0x7ff78cec330)
FindNextFileW (Address: 0x7ff78cec310)
FindNextVolumeW (Address: 0x7ff78cec370)
FindVolumeClose (Address: 0x7ff78cec378)
FlushFileBuffers (Address: 0x7ff78cec3a0)
GetDiskFreeSpaceExW (Address: 0x7ff78cec328)
GetDiskFreeSpaceW (Address: 0x7ff78cec350)
GetDriveTypeW (Address: 0x7ff78cec270)
GetFileAttributesExW (Address: 0x7ff78cec288)
GetFileAttributesW (Address: 0x7ff78cec2e8)
GetFileInformationByHandle (Address: 0x7ff78cec360)
GetFileSize (Address: 0x7ff78cec2a8)
GetFileSizeEx (Address: 0x7ff78cec2f8)
GetFullPathNameW (Address: 0x7ff78cec348)
GetLogicalDrives (Address: 0x7ff78cec298)
GetLongPathNameW (Address: 0x7ff78cec2b8)
GetShortPathNameW (Address: 0x7ff78cec2b0)
GetTempFileNameW (Address: 0x7ff78cec390)
GetVolumeInformationW (Address: 0x7ff78cec290)
GetVolumePathNameW (Address: 0x7ff78cec358)
QueryDosDeviceW (Address: 0x7ff78cec2f0)
ReadFile (Address: 0x7ff78cec2a0)
RemoveDirectoryW (Address: 0x7ff78cec2c8)
SetEndOfFile (Address: 0x7ff78cec398)
SetFileAttributesW (Address: 0x7ff78cec2d8)
SetFilePointer (Address: 0x7ff78cec320)
SetFileTime (Address: 0x7ff78cec278)
WriteFile (Address: 0x7ff78cec2c0)

API-MS-Win-Core-Handle-L1-1-0.dll

CloseHandle (Address: 0x7ff78cec3b8)
DuplicateHandle (Address: 0x7ff78cec3b0)

API-MS-Win-Core-Heap-L1-1-0.dll

GetProcessHeap (Address: 0x7ff78cec3d0)
HeapAlloc (Address: 0x7ff78cec3e8)
HeapDestroy (Address: 0x7ff78cec3d8)
HeapFree (Address: 0x7ff78cec3c8)
HeapReAlloc (Address: 0x7ff78cec3e0)

API-MS-Win-Core-Interlocked-L1-1-0.dll

InterlockedPopEntrySList (Address: 0x7ff78cec3f8)
InterlockedPushEntrySList (Address: 0x7ff78cec400)

API-MS-Win-Core-IO-L1-1-0.dll

CancelIoEx (Address: 0x7ff78cec410)
DeviceIoControl (Address: 0x7ff78cec418)
GetOverlappedResult (Address: 0x7ff78cec420)

API-MS-Win-Core-LibraryLoader-L1-1-0.dll

DisableThreadLibraryCalls (Address: 0x7ff78cec478)
FreeLibrary (Address: 0x7ff78cec450)
FreeLibraryAndExitThread (Address: 0x7ff78cec468)
FreeResource (Address: 0x7ff78cec440)
GetModuleFileNameW (Address: 0x7ff78cec438)
GetModuleHandleExW (Address: 0x7ff78cec498)
GetModuleHandleW (Address: 0x7ff78cec4a0)
GetProcAddress (Address: 0x7ff78cec458)
LoadLibraryExA (Address: 0x7ff78cec460)
LoadLibraryExW (Address: 0x7ff78cec480)
LoadResource (Address: 0x7ff78cec430)
LoadStringA (Address: 0x7ff78cec488)
LoadStringW (Address: 0x7ff78cec448)
LockResource (Address: 0x7ff78cec470)
SizeofResource (Address: 0x7ff78cec490)

API-MS-Win-Core-Localization-L1-1-0.dll

FindNLSString (Address: 0x7ff78cec4f0)
GetACP (Address: 0x7ff78cec4d8)
GetCPInfo (Address: 0x7ff78cec4c8)
GetCPInfoExW (Address: 0x7ff78cec4c0)
GetLocaleInfoEx (Address: 0x7ff78cec4b8)
GetLocaleInfoW (Address: 0x7ff78cec4d0)
GetOEMCP (Address: 0x7ff78cec500)
GetSystemDefaultLCID (Address: 0x7ff78cec4b0)
GetThreadLocale (Address: 0x7ff78cec4e8)
GetThreadUILanguage (Address: 0x7ff78cec4f8)
GetUserDefaultLCID (Address: 0x7ff78cec510)
LCMapStringW (Address: 0x7ff78cec4e0)
VerLanguageNameW (Address: 0x7ff78cec508)

API-MS-Win-Core-LocalRegistry-L1-1-0.dll

RegCloseKey (Address: 0x7ff78cec520)
RegCreateKeyExW (Address: 0x7ff78cec528)
RegDeleteKeyExW (Address: 0x7ff78cec540)
RegDeleteTreeW (Address: 0x7ff78cec578)
RegDeleteValueW (Address: 0x7ff78cec558)
RegEnumKeyExW (Address: 0x7ff78cec570)
RegEnumValueW (Address: 0x7ff78cec538)
RegGetValueW (Address: 0x7ff78cec550)
RegOpenCurrentUser (Address: 0x7ff78cec580)
RegOpenKeyExA (Address: 0x7ff78cec588)
RegOpenKeyExW (Address: 0x7ff78cec598)
RegQueryInfoKeyA (Address: 0x7ff78cec548)
RegQueryInfoKeyW (Address: 0x7ff78cec560)
RegQueryValueExA (Address: 0x7ff78cec590)
RegQueryValueExW (Address: 0x7ff78cec568)
RegSetValueExW (Address: 0x7ff78cec530)

API-MS-Win-Core-Memory-L1-1-0.dll

CreateFileMappingW (Address: 0x7ff78cec5b8)
MapViewOfFile (Address: 0x7ff78cec5b0)
OpenFileMappingW (Address: 0x7ff78cec5e8)
ReadProcessMemory (Address: 0x7ff78cec5e0)
UnmapViewOfFile (Address: 0x7ff78cec5a8)
VirtualAlloc (Address: 0x7ff78cec5c8)
VirtualFree (Address: 0x7ff78cec5d8)
VirtualProtect (Address: 0x7ff78cec5d0)
VirtualQuery (Address: 0x7ff78cec5c0)

API-MS-Win-Core-Misc-L1-1-0.dll

FormatMessageW (Address: 0x7ff78cec658)
GlobalAlloc (Address: 0x7ff78cec600)
GlobalFree (Address: 0x7ff78cec670)
IsWow64Process (Address: 0x7ff78cec618)
LocalAlloc (Address: 0x7ff78cec630)
LocalFree (Address: 0x7ff78cec638)
LocalReAlloc (Address: 0x7ff78cec660)
lstrcmpA (Address: 0x7ff78cec668)
lstrcmpiA (Address: 0x7ff78cec5f8)
lstrcmpiW (Address: 0x7ff78cec648)
lstrcmpW (Address: 0x7ff78cec650)
lstrlenA (Address: 0x7ff78cec628)
lstrlenW (Address: 0x7ff78cec640)
Sleep (Address: 0x7ff78cec620)
Wow64DisableWow64FsRedirection (Address: 0x7ff78cec608)
Wow64RevertWow64FsRedirection (Address: 0x7ff78cec610)

API-MS-Win-Core-ProcessEnvironment-L1-1-0.dll

ExpandEnvironmentStringsW (Address: 0x7ff78cec690)
FreeEnvironmentStringsW (Address: 0x7ff78cec698)
GetCurrentDirectoryW (Address: 0x7ff78cec6b0)
GetEnvironmentStringsW (Address: 0x7ff78cec6a0)
GetEnvironmentVariableW (Address: 0x7ff78cec680)
SearchPathW (Address: 0x7ff78cec688)
SetCurrentDirectoryW (Address: 0x7ff78cec6a8)
SetEnvironmentVariableW (Address: 0x7ff78cec6b8)

API-MS-Win-Core-ProcessThreads-L1-1-0.dll

CreateProcessAsUserW (Address: 0x7ff78cec760)
CreateProcessW (Address: 0x7ff78cec700)
CreateThread (Address: 0x7ff78cec6f8)
DeleteProcThreadAttributeList (Address: 0x7ff78cec768)
ExitProcess (Address: 0x7ff78cec708)
GetCurrentProcess (Address: 0x7ff78cec788)
GetCurrentProcessId (Address: 0x7ff78cec6e0)
GetCurrentThread (Address: 0x7ff78cec720)
GetCurrentThreadId (Address: 0x7ff78cec798)
GetExitCodeProcess (Address: 0x7ff78cec710)
GetExitCodeThread (Address: 0x7ff78cec740)
GetProcessTimes (Address: 0x7ff78cec730)
GetStartupInfoW (Address: 0x7ff78cec6c8)
GetThreadId (Address: 0x7ff78cec748)
GetThreadPriority (Address: 0x7ff78cec778)
InitializeProcThreadAttributeList (Address: 0x7ff78cec758)
OpenProcessToken (Address: 0x7ff78cec790)
OpenThread (Address: 0x7ff78cec750)
OpenThreadToken (Address: 0x7ff78cec738)
ProcessIdToSessionId (Address: 0x7ff78cec7a0)
ResumeThread (Address: 0x7ff78cec770)
SetThreadPriority (Address: 0x7ff78cec780)
SetThreadToken (Address: 0x7ff78cec728)
TerminateProcess (Address: 0x7ff78cec718)
TlsAlloc (Address: 0x7ff78cec6d8)
TlsFree (Address: 0x7ff78cec6d0)
TlsGetValue (Address: 0x7ff78cec6f0)
TlsSetValue (Address: 0x7ff78cec6e8)

API-MS-Win-Core-Profile-L1-1-0.dll

QueryPerformanceCounter (Address: 0x7ff78cec7b8)
QueryPerformanceFrequency (Address: 0x7ff78cec7b0)

API-MS-Win-Core-String-L1-1-0.dll

CompareStringEx (Address: 0x7ff78cec7e8)
CompareStringOrdinal (Address: 0x7ff78cec7d8)
CompareStringW (Address: 0x7ff78cec7d0)
GetStringTypeExW (Address: 0x7ff78cec7e0)
GetStringTypeW (Address: 0x7ff78cec7f0)
MultiByteToWideChar (Address: 0x7ff78cec7c8)
WideCharToMultiByte (Address: 0x7ff78cec7f8)

API-MS-Win-Core-Synch-L1-1-0.dll

AcquireSRWLockExclusive (Address: 0x7ff78cec820)
AcquireSRWLockShared (Address: 0x7ff78cec858)
CreateEventW (Address: 0x7ff78cec810)
CreateMutexW (Address: 0x7ff78cec8a8)
DeleteCriticalSection (Address: 0x7ff78cec898)
EnterCriticalSection (Address: 0x7ff78cec840)
InitializeCriticalSection (Address: 0x7ff78cec830)
InitializeSRWLock (Address: 0x7ff78cec880)
LeaveCriticalSection (Address: 0x7ff78cec838)
OpenEventW (Address: 0x7ff78cec808)
OpenMutexW (Address: 0x7ff78cec870)
OpenProcess (Address: 0x7ff78cec868)
ReleaseMutex (Address: 0x7ff78cec850)
ReleaseSemaphore (Address: 0x7ff78cec8a0)
ReleaseSRWLockExclusive (Address: 0x7ff78cec848)
ReleaseSRWLockShared (Address: 0x7ff78cec860)
ResetEvent (Address: 0x7ff78cec818)
SetEvent (Address: 0x7ff78cec890)
SetWaitableTimer (Address: 0x7ff78cec878)
TryEnterCriticalSection (Address: 0x7ff78cec888)
WaitForSingleObject (Address: 0x7ff78cec828)

API-MS-Win-Core-SysInfo-L1-1-0.dll

GetComputerNameExW (Address: 0x7ff78cec900)
GetLocalTime (Address: 0x7ff78cec918)
GetSystemDirectoryW (Address: 0x7ff78cec8e0)
GetSystemInfo (Address: 0x7ff78cec910)
GetSystemTime (Address: 0x7ff78cec8c8)
GetSystemTimeAsFileTime (Address: 0x7ff78cec8d8)
GetSystemWindowsDirectoryW (Address: 0x7ff78cec8b8)
GetTickCount (Address: 0x7ff78cec8f0)
GetTickCount64 (Address: 0x7ff78cec8f8)
GetVersionExW (Address: 0x7ff78cec8c0)
GetWindowsDirectoryW (Address: 0x7ff78cec8e8)
GlobalMemoryStatusEx (Address: 0x7ff78cec908)
SystemTimeToFileTime (Address: 0x7ff78cec8d0)

API-MS-Win-Security-Base-L1-1-0.dll

AccessCheck (Address: 0x7ff78cec958)
AddAccessAllowedAce (Address: 0x7ff78ceca20)
AddAccessAllowedAceEx (Address: 0x7ff78ceca60)
AddAccessDeniedAceEx (Address: 0x7ff78ceca68)
AddAce (Address: 0x7ff78ceca10)
AdjustTokenPrivileges (Address: 0x7ff78ceca28)
AllocateAndInitializeSid (Address: 0x7ff78cec960)
CheckTokenMembership (Address: 0x7ff78cec948)
CopySid (Address: 0x7ff78ceca48)
CreateWellKnownSid (Address: 0x7ff78cec940)
DeleteAce (Address: 0x7ff78cec9f8)
DuplicateToken (Address: 0x7ff78ceca58)
DuplicateTokenEx (Address: 0x7ff78ceca40)
EqualSid (Address: 0x7ff78cec930)
FreeSid (Address: 0x7ff78cec968)
GetAce (Address: 0x7ff78cec9f0)
GetAclInformation (Address: 0x7ff78cec9e8)
GetFileSecurityW (Address: 0x7ff78cec950)
GetKernelObjectSecurity (Address: 0x7ff78cec9e0)
GetLengthSid (Address: 0x7ff78ceca00)
GetSecurityDescriptorControl (Address: 0x7ff78ceca18)
GetSecurityDescriptorDacl (Address: 0x7ff78cec978)
GetSecurityDescriptorGroup (Address: 0x7ff78cec9a0)
GetSecurityDescriptorOwner (Address: 0x7ff78cec998)
GetSecurityDescriptorSacl (Address: 0x7ff78cec988)
GetSidIdentifierAuthority (Address: 0x7ff78cec990)
GetSidLengthRequired (Address: 0x7ff78cec9b0)
GetSidSubAuthority (Address: 0x7ff78cec9c0)
GetSidSubAuthorityCount (Address: 0x7ff78cec9a8)
GetTokenInformation (Address: 0x7ff78cec928)
ImpersonateSelf (Address: 0x7ff78ceca70)
InitializeAcl (Address: 0x7ff78ceca08)
InitializeSecurityDescriptor (Address: 0x7ff78cec9c8)
InitializeSid (Address: 0x7ff78cec9b8)
IsValidSid (Address: 0x7ff78ceca50)
IsWellKnownSid (Address: 0x7ff78cec980)
QuerySecurityAccessMask (Address: 0x7ff78cec9d8)
RevertToSelf (Address: 0x7ff78cec970)
SetFileSecurityW (Address: 0x7ff78ceca30)
SetSecurityDescriptorDacl (Address: 0x7ff78cec9d0)
SetSecurityDescriptorOwner (Address: 0x7ff78ceca38)
SetTokenInformation (Address: 0x7ff78cec938)

GDI32.dll

BitBlt (Address: 0x7ff78cee210)
CreateBitmap (Address: 0x7ff78cee140)
CreateCompatibleBitmap (Address: 0x7ff78cee258)
CreateCompatibleDC (Address: 0x7ff78cee208)
CreateDCW (Address: 0x7ff78cee238)
CreateDIBSection (Address: 0x7ff78cee148)
CreateFontIndirectW (Address: 0x7ff78cee228)
CreateFontW (Address: 0x7ff78cee170)
CreatePen (Address: 0x7ff78cee120)
CreatePolygonRgn (Address: 0x7ff78cee080)
CreateRectRgn (Address: 0x7ff78cee108)
CreateRectRgnIndirect (Address: 0x7ff78cee198)
CreateSolidBrush (Address: 0x7ff78cee1d0)
DeleteDC (Address: 0x7ff78cee218)
DeleteMetaFile (Address: 0x7ff78cee0a8)
DeleteObject (Address: 0x7ff78cee1c0)
EnumFontFamiliesExW (Address: 0x7ff78cee240)
ExtTextOutW (Address: 0x7ff78cee178)
GdiAlphaBlend (Address: 0x7ff78cee298)
GdiFlush (Address: 0x7ff78cee158)
GdiTransparentBlt (Address: 0x7ff78cee138)
GetClipBox (Address: 0x7ff78cee1b8)
GetClipRgn (Address: 0x7ff78cee100)
GetCurrentObject (Address: 0x7ff78cee128)
GetDeviceCaps (Address: 0x7ff78cee290)
GetDIBColorTable (Address: 0x7ff78cee180)
GetLayout (Address: 0x7ff78cee260)
GetNearestColor (Address: 0x7ff78cee1c8)
GetObjectType (Address: 0x7ff78cee1a8)
GetObjectW (Address: 0x7ff78cee1f8)
GetPixel (Address: 0x7ff78cee150)
GetStockObject (Address: 0x7ff78cee1d8)
GetTextAlign (Address: 0x7ff78cee078)
GetTextColor (Address: 0x7ff78cee130)
GetTextExtentPoint32A (Address: 0x7ff78cee168)
GetTextExtentPoint32W (Address: 0x7ff78cee230)
GetTextExtentPointW (Address: 0x7ff78cee288)
GetTextFaceW (Address: 0x7ff78cee250)
GetTextMetricsW (Address: 0x7ff78cee200)
GetViewportOrgEx (Address: 0x7ff78cee2a8)
GetWindowOrgEx (Address: 0x7ff78cee1a0)
IntersectClipRect (Address: 0x7ff78cee0f8)
LineTo (Address: 0x7ff78cee088)
LPtoDP (Address: 0x7ff78cee0c8)
MoveToEx (Address: 0x7ff78cee090)
OffsetWindowOrgEx (Address: 0x7ff78cee278)
PatBlt (Address: 0x7ff78cee220)
PlayMetaFile (Address: 0x7ff78cee0b0)
PlgBlt (Address: 0x7ff78cee1b0)
Rectangle (Address: 0x7ff78cee118)
RestoreDC (Address: 0x7ff78cee190)
SaveDC (Address: 0x7ff78cee188)
SelectClipRgn (Address: 0x7ff78cee0f0)
SelectObject (Address: 0x7ff78cee1f0)
SetBkColor (Address: 0x7ff78cee1e8)
SetBkMode (Address: 0x7ff78cee270)
SetFontEnumeration (Address: 0x7ff78cee248)
SetLayout (Address: 0x7ff78cee268)
SetMapMode (Address: 0x7ff78cee0e8)
SetMetaFileBitsEx (Address: 0x7ff78cee0c0)
SetStretchBltMode (Address: 0x7ff78cee0a0)
SetTextAlign (Address: 0x7ff78cee110)
SetTextColor (Address: 0x7ff78cee1e0)
SetViewportExtEx (Address: 0x7ff78cee0d0)
SetViewportOrgEx (Address: 0x7ff78cee0b8)
SetWindowExtEx (Address: 0x7ff78cee0e0)
SetWindowOrgEx (Address: 0x7ff78cee280)
StretchBlt (Address: 0x7ff78cee098)
TextOutA (Address: 0x7ff78cee160)
TextOutW (Address: 0x7ff78cee2a0)
TranslateCharsetInfo (Address: 0x7ff78cee0d8)

KERNEL32.dll

ActivateActCtx (Address: 0x7ff78cee3a0)
CancelSynchronousIo (Address: 0x7ff78cee3f0)
CheckElevation (Address: 0x7ff78cee518)
CheckElevationEnabled (Address: 0x7ff78cee330)
CloseThreadpoolTimer (Address: 0x7ff78cee450)
CopyFileW (Address: 0x7ff78cee538)
CreateActCtxW (Address: 0x7ff78cee508)
CreateHardLinkW (Address: 0x7ff78cee438)
CreateJobObjectW (Address: 0x7ff78cee4b8)
CreateSemaphoreW (Address: 0x7ff78cee410)
CreateThreadpoolTimer (Address: 0x7ff78cee458)
CreateTimerQueueTimer (Address: 0x7ff78cee428)
CreateWaitableTimerW (Address: 0x7ff78cee2b8)
DeactivateActCtx (Address: 0x7ff78cee3a8)
DelayLoadFailureHook (Address: 0x7ff78cee310)
DeleteTimerQueueTimer (Address: 0x7ff78cee430)
DosDateTimeToFileTime (Address: 0x7ff78cee398)
EnumResourceNamesW (Address: 0x7ff78cee2e8)
ExpandEnvironmentStringsA (Address: 0x7ff78cee4a8)
FileTimeToDosDateTime (Address: 0x7ff78cee390)
FileTimeToLocalFileTime (Address: 0x7ff78cee478)
FindAtomW (Address: 0x7ff78cee3e8)
FindResourceExW (Address: 0x7ff78cee498)
FindResourceW (Address: 0x7ff78cee2c8)
FlushInstructionCache (Address: 0x7ff78cee468)
GetAtomNameW (Address: 0x7ff78cee4a0)
GetBinaryTypeW (Address: 0x7ff78cee530)
GetCompressedFileSizeW (Address: 0x7ff78cee540)
GetComputerNameW (Address: 0x7ff78cee2d0)
GetDateFormatW (Address: 0x7ff78cee320)
GetFileInformationByHandleEx (Address: 0x7ff78cee2c0)
GetPhysicallyInstalledSystemMemory (Address: 0x7ff78cee470)
GetPrivateProfileSectionNamesW (Address: 0x7ff78cee3d8)
GetPrivateProfileSectionW (Address: 0x7ff78cee370)
GetPrivateProfileStringW (Address: 0x7ff78cee520)
GetProcessId (Address: 0x7ff78cee4c8)
GetProductInfo (Address: 0x7ff78cee3b0)
GetProfileSectionW (Address: 0x7ff78cee328)
GetShortPathNameA (Address: 0x7ff78cee300)
GetSystemPreferredUILanguages (Address: 0x7ff78cee4e0)
GetSystemWow64DirectoryW (Address: 0x7ff78cee500)
GetTempPathW (Address: 0x7ff78cee318)
GetVolumeNameForVolumeMountPointW (Address: 0x7ff78cee338)
GetVolumePathNamesForVolumeNameW (Address: 0x7ff78cee378)
GlobalAddAtomW (Address: 0x7ff78cee4f0)
GlobalDeleteAtom (Address: 0x7ff78cee4f8)
GlobalFlags (Address: 0x7ff78cee3f8)
GlobalGetAtomNameW (Address: 0x7ff78cee388)
GlobalLock (Address: 0x7ff78cee2f0)
GlobalReAlloc (Address: 0x7ff78cee308)
GlobalSize (Address: 0x7ff78cee340)
GlobalUnlock (Address: 0x7ff78cee2f8)
InitOnceExecuteOnce (Address: 0x7ff78cee380)
IsProcessInJob (Address: 0x7ff78cee4c0)
LoadLibraryA (Address: 0x7ff78cee4b0)
LoadLibraryW (Address: 0x7ff78cee2e0)
LocaleNameToLCID (Address: 0x7ff78cee4d8)
LocalFileTimeToFileTime (Address: 0x7ff78cee480)
LocalSize (Address: 0x7ff78cee400)
MoveFileExW (Address: 0x7ff78cee2d8)
MoveFileW (Address: 0x7ff78cee348)
MulDiv (Address: 0x7ff78cee528)
PowerClearRequest (Address: 0x7ff78cee360)
PowerCreateRequest (Address: 0x7ff78cee550)
PowerSetRequest (Address: 0x7ff78cee358)
QueryActCtxW (Address: 0x7ff78cee4e8)
QueryFullProcessImageNameW (Address: 0x7ff78cee3e0)
QueueUserWorkItem (Address: 0x7ff78cee460)
ReadDirectoryChangesW (Address: 0x7ff78cee448)
RegisterWaitForSingleObject (Address: 0x7ff78cee3c0)
ReleaseActCtx (Address: 0x7ff78cee510)
ReplaceFileW (Address: 0x7ff78cee350)
ResolveLocaleName (Address: 0x7ff78cee4d0)
SetThreadpoolTimer (Address: 0x7ff78cee440)
SetVolumeLabelW (Address: 0x7ff78cee408)
SystemTimeToTzSpecificLocalTime (Address: 0x7ff78cee490)
TzSpecificLocalTimeToSystemTime (Address: 0x7ff78cee488)
UnregisterWait (Address: 0x7ff78cee3b8)
UnregisterWaitEx (Address: 0x7ff78cee420)
WaitForMultipleObjects (Address: 0x7ff78cee418)
WerpNotifyUseStringResource (Address: 0x7ff78cee548)
WritePrivateProfileSectionW (Address: 0x7ff78cee3c8)
WritePrivateProfileStringW (Address: 0x7ff78cee3d0)
WTSGetActiveConsoleSessionId (Address: 0x7ff78cee368)

KERNELBASE.dll

EnumSystemLocalesEx (Address: 0x7ff78cec1e0)
EnumUILanguagesW (Address: 0x7ff78cec1f0)
GetNumberFormatW (Address: 0x7ff78cec1e8)
GetUserDefaultUILanguage (Address: 0x7ff78cec1f8)
IsDBCSLeadByte (Address: 0x7ff78cec210)
LCIDToLocaleName (Address: 0x7ff78cec200)
NotifyRedirectedStringChange (Address: 0x7ff78cec208)

msvcrt.dll

__C_specific_handler (Address: 0x7ff78cec0b8)
__CxxFrameHandler3 (Address: 0x7ff78cec078)
__dllonexit (Address: 0x7ff78cec050)
_amsg_exit (Address: 0x7ff78cec060)
_CxxThrowException (Address: 0x7ff78cec080)
_initterm (Address: 0x7ff78cec068)
_itow (Address: 0x7ff78cec130)
_lock (Address: 0x7ff78cec048)
_ltow_s (Address: 0x7ff78cec168)
_onexit (Address: 0x7ff78cec040)
_resetstkoflw (Address: 0x7ff78cec0b0)
_strnicmp (Address: 0x7ff78cec1a0)
_ui64tow_s (Address: 0x7ff78cec128)
_unlock (Address: 0x7ff78cec058)
_vsnprintf (Address: 0x7ff78cec138)
_vsnwprintf (Address: 0x7ff78cec030)
_wcsicmp (Address: 0x7ff78cec1a8)
_wcsnicmp (Address: 0x7ff78cec180)
_wtoi (Address: 0x7ff78cec1c8)
_XcptFilter (Address: 0x7ff78cec070)
??0exception@@QEAA@AEBQEBD@Z (Address: 0x7ff78cec110)
??0exception@@QEAA@AEBQEBDH@Z (Address: 0x7ff78cec0f8)
??0exception@@QEAA@AEBV0@@Z (Address: 0x7ff78cec100)
??0exception@@QEAA@XZ (Address: 0x7ff78cec0e0)
??1exception@@UEAA@XZ (Address: 0x7ff78cec108)
??1type_info@@UEAA@XZ (Address: 0x7ff78cec038)
?what@exception@@UEBAPEBDXZ (Address: 0x7ff78cec0d8)
ceilf (Address: 0x7ff78cec020)
expf (Address: 0x7ff78cec010)
floor (Address: 0x7ff78cec1d0)
floorf (Address: 0x7ff78cec008)
free (Address: 0x7ff78cec150)
isalpha (Address: 0x7ff78cec178)
isdigit (Address: 0x7ff78cec088)
iswalnum (Address: 0x7ff78cec090)
iswalpha (Address: 0x7ff78cec188)
iswcntrl (Address: 0x7ff78cec098)
iswprint (Address: 0x7ff78cec0a8)
iswspace (Address: 0x7ff78cec0a0)
log (Address: 0x7ff78cec028)
logf (Address: 0x7ff78cec000)
malloc (Address: 0x7ff78cec118)
memcmp (Address: 0x7ff78cec0c8)
memcpy (Address: 0x7ff78cec0c0)
memcpy_s (Address: 0x7ff78cec0f0)
memmove (Address: 0x7ff78cec1b0)
memmove_s (Address: 0x7ff78cec0e8)
memset (Address: 0x7ff78cec0d0)
pow (Address: 0x7ff78cec018)
qsort (Address: 0x7ff78cec120)
realloc (Address: 0x7ff78cec158)
swscanf_s (Address: 0x7ff78cec140)
wcschr (Address: 0x7ff78cec1b8)
wcsncmp (Address: 0x7ff78cec190)
wcspbrk (Address: 0x7ff78cec170)
wcsrchr (Address: 0x7ff78cec198)
wcsstr (Address: 0x7ff78cec1c0)
wcstok_s (Address: 0x7ff78cec148)
wcstol (Address: 0x7ff78cec160)

ntdll.dll

(Address: 0x7ff78ced538)
EtwEventEnabled (Address: 0x7ff78ced6a0)
EtwEventRegister (Address: 0x7ff78ced630)
EtwEventUnregister (Address: 0x7ff78ced638)
EtwEventWrite (Address: 0x7ff78ced758)
EtwGetTraceEnableFlags (Address: 0x7ff78ced650)
EtwGetTraceEnableLevel (Address: 0x7ff78ced658)
EtwGetTraceLoggerHandle (Address: 0x7ff78ced660)
EtwLogTraceEvent (Address: 0x7ff78ced548)
EtwRegisterTraceGuidsW (Address: 0x7ff78ced648)
EtwTraceMessage (Address: 0x7ff78ced698)
EtwUnregisterTraceGuids (Address: 0x7ff78ced640)
NtClose (Address: 0x7ff78ced728)
NtCreateFile (Address: 0x7ff78ced730)
NtFsControlFile (Address: 0x7ff78ced720)
NtOpenFile (Address: 0x7ff78ced708)
NtOpenProcessToken (Address: 0x7ff78ced670)
NtOpenThreadToken (Address: 0x7ff78ced540)
NtQueryDirectoryFile (Address: 0x7ff78ced5d8)
NtQueryEaFile (Address: 0x7ff78ced5a8)
NtQueryInformationFile (Address: 0x7ff78ced740)
NtQueryInformationProcess (Address: 0x7ff78ced680)
NtQueryInformationThread (Address: 0x7ff78ced608)
NtQueryInformationToken (Address: 0x7ff78ced678)
NtQueryLicenseValue (Address: 0x7ff78ced6a8)
NtQueryObject (Address: 0x7ff78ced568)
NtQuerySecurityObject (Address: 0x7ff78ced5b0)
NtQuerySystemInformation (Address: 0x7ff78ced628)
NtQueryVolumeInformationFile (Address: 0x7ff78ced610)
NtSetEaFile (Address: 0x7ff78ced5b8)
NtSetInformationFile (Address: 0x7ff78ced710)
NtSetInformationThread (Address: 0x7ff78ced600)
NtSetInformationToken (Address: 0x7ff78ced668)
NtSetSecurityObject (Address: 0x7ff78ced5c0)
RtlCaptureContext (Address: 0x7ff78ced550)
RtlCreateEnvironment (Address: 0x7ff78ced6c8)
RtlCreateUnicodeString (Address: 0x7ff78ced5f0)
RtlDestroyEnvironment (Address: 0x7ff78ced6b8)
RtlDosPathNameToNtPathName_U (Address: 0x7ff78ced590)
RtlDosPathNameToNtPathName_U_WithStatus (Address: 0x7ff78ced700)
RtlDosPathNameToRelativeNtPathName_U (Address: 0x7ff78ced5a0)
RtlDowncaseUnicodeString (Address: 0x7ff78ced578)
RtlExpandEnvironmentStrings_U (Address: 0x7ff78ced6d0)
RtlFreeAnsiString (Address: 0x7ff78ced5c8)
RtlFreeHeap (Address: 0x7ff78ced6f8)
RtlFreeUnicodeString (Address: 0x7ff78ced5e8)
RtlGetLastNtStatus (Address: 0x7ff78ced6f0)
RtlGetNtProductType (Address: 0x7ff78ced620)
RtlInitString (Address: 0x7ff78ced588)
RtlInitUnicodeString (Address: 0x7ff78ced750)
RtlInitUnicodeStringEx (Address: 0x7ff78ced6e8)
RtlLookupFunctionEntry (Address: 0x7ff78ced558)
RtlMapGenericMask (Address: 0x7ff78ced690)
RtlNtStatusToDosError (Address: 0x7ff78ced738)
RtlOemStringToUnicodeString (Address: 0x7ff78ced580)
RtlPrefixString (Address: 0x7ff78ced748)
RtlQueryEnvironmentVariable_U (Address: 0x7ff78ced6e0)
RtlRandomEx (Address: 0x7ff78ced5e0)
RtlReleaseRelativeName (Address: 0x7ff78ced598)
RtlSetCurrentEnvironment (Address: 0x7ff78ced6c0)
RtlSetEnvironmentVariable (Address: 0x7ff78ced6d8)
RtlUnicodeStringToAnsiString (Address: 0x7ff78ced5d0)
RtlUnicodeStringToOemString (Address: 0x7ff78ced718)
RtlVirtualUnwind (Address: 0x7ff78ced560)
ShipAssert (Address: 0x7ff78ced570)
wcscat_s (Address: 0x7ff78ced530)
wcsncpy_s (Address: 0x7ff78ced528)
WinSqmAddToStream (Address: 0x7ff78ced688)
WinSqmIncrementDWORD (Address: 0x7ff78ced6b0)
WinSqmIsOptedIn (Address: 0x7ff78ced618)
WinSqmSetDWORD (Address: 0x7ff78ced5f8)

SHLWAPI.dll

(Address: 0x7ff78ced3d0)
(Address: 0x7ff78ced3d8)
(Address: 0x7ff78ced3f8)
(Address: 0x7ff78ced410)
(Address: 0x7ff78ced420)
(Address: 0x7ff78ced428)
(Address: 0x7ff78ced4c8)
(Address: 0x7ff78ced4e8)
(Address: 0x7ff78ced4f0)
(Address: 0x7ff78ced4f8)
(Address: 0x7ff78ced500)
(Address: 0x7ff78ced510)
(Address: 0x7ff78cecc20)
(Address: 0x7ff78cecc28)
(Address: 0x7ff78cecc30)
(Address: 0x7ff78cecc38)
(Address: 0x7ff78cecc48)
(Address: 0x7ff78cecc50)
(Address: 0x7ff78cecc58)
(Address: 0x7ff78cecc60)
(Address: 0x7ff78cecc68)
(Address: 0x7ff78cecc70)
(Address: 0x7ff78cecc78)
(Address: 0x7ff78cecc80)
(Address: 0x7ff78cecc88)
(Address: 0x7ff78cecc90)
(Address: 0x7ff78ceccb8)
(Address: 0x7ff78ceccc0)
(Address: 0x7ff78ceccd0)
(Address: 0x7ff78ceccd8)
(Address: 0x7ff78cecce0)
(Address: 0x7ff78cecce8)
(Address: 0x7ff78ceccf0)
(Address: 0x7ff78ceccf8)
(Address: 0x7ff78cecd00)
(Address: 0x7ff78cecd08)
(Address: 0x7ff78cecd10)
(Address: 0x7ff78cecd18)
(Address: 0x7ff78cecd20)
(Address: 0x7ff78cecd30)
(Address: 0x7ff78cecd38)
(Address: 0x7ff78cecd40)
(Address: 0x7ff78cecd48)
(Address: 0x7ff78cecd60)
(Address: 0x7ff78cecd68)
(Address: 0x7ff78cecd70)
(Address: 0x7ff78cecd78)
(Address: 0x7ff78cecd80)
(Address: 0x7ff78cecd88)
(Address: 0x7ff78cecd90)
(Address: 0x7ff78cecd98)
(Address: 0x7ff78cecda0)
(Address: 0x7ff78cecdb0)
(Address: 0x7ff78cecdc0)
(Address: 0x7ff78cecdc8)
(Address: 0x7ff78cecdd0)
(Address: 0x7ff78cecde0)
(Address: 0x7ff78cecdf8)
(Address: 0x7ff78cece08)
(Address: 0x7ff78cece18)
(Address: 0x7ff78cece20)
(Address: 0x7ff78cece28)
(Address: 0x7ff78cece30)
(Address: 0x7ff78cece38)
(Address: 0x7ff78cece40)
(Address: 0x7ff78cece48)
(Address: 0x7ff78cece50)
(Address: 0x7ff78cece58)
(Address: 0x7ff78cece68)
(Address: 0x7ff78cece70)
(Address: 0x7ff78cece78)
(Address: 0x7ff78cece80)
(Address: 0x7ff78cece88)
(Address: 0x7ff78ceceb0)
(Address: 0x7ff78ceceb8)
(Address: 0x7ff78cecec0)
(Address: 0x7ff78cecec8)
(Address: 0x7ff78ceced0)
(Address: 0x7ff78ceced8)
(Address: 0x7ff78cecee0)
(Address: 0x7ff78cecee8)
(Address: 0x7ff78cecef0)
(Address: 0x7ff78cecef8)
(Address: 0x7ff78cecf10)
(Address: 0x7ff78cecf18)
(Address: 0x7ff78cecf20)
(Address: 0x7ff78cecf28)
(Address: 0x7ff78cecf30)
(Address: 0x7ff78cecf38)
(Address: 0x7ff78cecf58)
(Address: 0x7ff78cecf60)
(Address: 0x7ff78cecf68)
(Address: 0x7ff78cecf70)
(Address: 0x7ff78cecf78)
(Address: 0x7ff78cecf80)
(Address: 0x7ff78cecfb0)
(Address: 0x7ff78cecfd0)
(Address: 0x7ff78cecfd8)
(Address: 0x7ff78cecfe0)
(Address: 0x7ff78ceca80)
(Address: 0x7ff78ceca88)
(Address: 0x7ff78ceca98)
(Address: 0x7ff78cecaa0)
(Address: 0x7ff78cecab0)
(Address: 0x7ff78cecab8)
(Address: 0x7ff78cecac8)
(Address: 0x7ff78cecae0)
(Address: 0x7ff78cecae8)
(Address: 0x7ff78cecb00)
(Address: 0x7ff78cecb30)
(Address: 0x7ff78cecb40)
(Address: 0x7ff78cecb48)
(Address: 0x7ff78cecb58)
(Address: 0x7ff78cecb60)
(Address: 0x7ff78cecb70)
(Address: 0x7ff78cecb78)
(Address: 0x7ff78cecb80)
(Address: 0x7ff78cecb88)
(Address: 0x7ff78cecb90)
(Address: 0x7ff78cecb98)
(Address: 0x7ff78cecba0)
(Address: 0x7ff78cecba8)
(Address: 0x7ff78cecbc0)
(Address: 0x7ff78cecbc8)
(Address: 0x7ff78cecbd0)
(Address: 0x7ff78cecbd8)
(Address: 0x7ff78cecbe0)
(Address: 0x7ff78cecbe8)
(Address: 0x7ff78cecbf8)
(Address: 0x7ff78cecc00)
(Address: 0x7ff78cecfe8)
(Address: 0x7ff78cecff8)
(Address: 0x7ff78ced000)
(Address: 0x7ff78ced008)
(Address: 0x7ff78ced010)
(Address: 0x7ff78ced018)
(Address: 0x7ff78ced020)
(Address: 0x7ff78ced028)
(Address: 0x7ff78ced048)
(Address: 0x7ff78ced058)
(Address: 0x7ff78ced060)
(Address: 0x7ff78ced080)
(Address: 0x7ff78ced088)
(Address: 0x7ff78ced090)
(Address: 0x7ff78ced098)
(Address: 0x7ff78ced0a8)
(Address: 0x7ff78ced0b0)
(Address: 0x7ff78ced0c0)
(Address: 0x7ff78ced0d8)
(Address: 0x7ff78ced0e0)
(Address: 0x7ff78ced0e8)
(Address: 0x7ff78ced0f0)
(Address: 0x7ff78ced108)
(Address: 0x7ff78ced110)
(Address: 0x7ff78ced118)
(Address: 0x7ff78ced120)
(Address: 0x7ff78ced128)
(Address: 0x7ff78ced130)
(Address: 0x7ff78ced138)
(Address: 0x7ff78ced140)
(Address: 0x7ff78ced168)
(Address: 0x7ff78ced170)
(Address: 0x7ff78ced178)
(Address: 0x7ff78ced188)
(Address: 0x7ff78ced190)
(Address: 0x7ff78ced198)
(Address: 0x7ff78ced1b0)
(Address: 0x7ff78ced1b8)
(Address: 0x7ff78ced1c0)
(Address: 0x7ff78ced1d0)
(Address: 0x7ff78ced1e0)
(Address: 0x7ff78ced1f0)
(Address: 0x7ff78ced1f8)
(Address: 0x7ff78ced200)
(Address: 0x7ff78ced208)
(Address: 0x7ff78ced210)
(Address: 0x7ff78ced218)
(Address: 0x7ff78ced220)
(Address: 0x7ff78ced228)
(Address: 0x7ff78ced230)
(Address: 0x7ff78ced258)
(Address: 0x7ff78ced270)
(Address: 0x7ff78ced278)
(Address: 0x7ff78ced280)
(Address: 0x7ff78ced288)
(Address: 0x7ff78ced2a0)
(Address: 0x7ff78ced2a8)
(Address: 0x7ff78ced2b0)
(Address: 0x7ff78ced2b8)
(Address: 0x7ff78ced2c8)
(Address: 0x7ff78ced2d0)
(Address: 0x7ff78ced2d8)
(Address: 0x7ff78ced318)
(Address: 0x7ff78ced348)
(Address: 0x7ff78ced350)
(Address: 0x7ff78ced358)
(Address: 0x7ff78ced360)
(Address: 0x7ff78ced388)
(Address: 0x7ff78ced390)
(Address: 0x7ff78ced3a8)
(Address: 0x7ff78ced3b8)
AssocCreate (Address: 0x7ff78ced328)
AssocGetPerceivedType (Address: 0x7ff78ced4d0)
AssocIsDangerous (Address: 0x7ff78cecf40)
AssocQueryKeyW (Address: 0x7ff78ced158)
AssocQueryStringByKeyW (Address: 0x7ff78cecc40)
AssocQueryStringW (Address: 0x7ff78ced340)
ColorHLSToRGB (Address: 0x7ff78ced100)
ColorRGBToHLS (Address: 0x7ff78ced0f8)
GetMenuPosFromID (Address: 0x7ff78cecaa8)
HashData (Address: 0x7ff78cecdd8)
IntlStrEqWorkerW (Address: 0x7ff78ced038)
PathAddBackslashW (Address: 0x7ff78cecfa8)
PathAddExtensionW (Address: 0x7ff78cecfb8)
PathAppendA (Address: 0x7ff78cecb38)
PathAppendW (Address: 0x7ff78ced368)
PathBuildRootA (Address: 0x7ff78cecdf0)
PathBuildRootW (Address: 0x7ff78ced2e0)
PathCanonicalizeW (Address: 0x7ff78ced070)
PathCombineW (Address: 0x7ff78cecbb8)
PathCommonPrefixW (Address: 0x7ff78ced040)
PathCompactPathExW (Address: 0x7ff78cecc98)
PathCompactPathW (Address: 0x7ff78ced330)
PathCreateFromUrlW (Address: 0x7ff78cecd58)
PathFileExistsW (Address: 0x7ff78ced2f0)
PathFindExtensionW (Address: 0x7ff78ced400)
PathFindFileNameW (Address: 0x7ff78ced3a0)
PathFindNextComponentW (Address: 0x7ff78cecb10)
PathFindOnPathW (Address: 0x7ff78cecaf0)
PathFindSuffixArrayW (Address: 0x7ff78cecca8)
PathGetArgsW (Address: 0x7ff78ced240)
PathGetCharTypeW (Address: 0x7ff78cecad8)
PathGetDriveNumberA (Address: 0x7ff78cecde8)
PathGetDriveNumberW (Address: 0x7ff78ced310)
PathIsContentTypeW (Address: 0x7ff78cecfc0)
PathIsDirectoryA (Address: 0x7ff78cece98)
PathIsDirectoryEmptyW (Address: 0x7ff78cecea8)
PathIsDirectoryW (Address: 0x7ff78cecc08)
PathIsFileSpecW (Address: 0x7ff78ceca90)
PathIsNetworkPathW (Address: 0x7ff78ced1a8)
PathIsPrefixW (Address: 0x7ff78cecff0)
PathIsRelativeW (Address: 0x7ff78ced238)
PathIsRootA (Address: 0x7ff78cecb28)
PathIsRootW (Address: 0x7ff78ced1c8)
PathIsSameRootW (Address: 0x7ff78ceccb0)
PathIsUNCServerShareW (Address: 0x7ff78ced3e8)
PathIsUNCServerW (Address: 0x7ff78ced3f0)
PathIsUNCW (Address: 0x7ff78ced370)
PathIsURLW (Address: 0x7ff78cecaf8)
PathMakePrettyW (Address: 0x7ff78cecb18)
PathMakeSystemFolderW (Address: 0x7ff78ced3b0)
PathMatchSpecExW (Address: 0x7ff78cecca0)
PathMatchSpecW (Address: 0x7ff78ced260)
PathParseIconLocationW (Address: 0x7ff78ced3c0)
PathQuoteSpacesW (Address: 0x7ff78ced378)
PathRelativePathToW (Address: 0x7ff78cece10)
PathRemoveArgsW (Address: 0x7ff78ced508)
PathRemoveBackslashW (Address: 0x7ff78cecb08)
PathRemoveBlanksW (Address: 0x7ff78ced248)
PathRemoveExtensionW (Address: 0x7ff78ced398)
PathRemoveFileSpecA (Address: 0x7ff78cecb20)
PathRemoveFileSpecW (Address: 0x7ff78ced2e8)
PathRenameExtensionW (Address: 0x7ff78cece90)
PathSetDlgItemPathW (Address: 0x7ff78cece60)
PathSkipRootW (Address: 0x7ff78cecda8)
PathStripPathW (Address: 0x7ff78ced4d8)
PathStripToRootW (Address: 0x7ff78cecad0)
PathUnExpandEnvStringsW (Address: 0x7ff78ced3c8)
PathUnquoteSpacesW (Address: 0x7ff78ced3e0)
SHAutoComplete (Address: 0x7ff78ced380)
SHCreateStreamOnFileEx (Address: 0x7ff78cecdb8)
SHCreateStreamOnFileW (Address: 0x7ff78cecb50)
SHDeleteKeyA (Address: 0x7ff78cecbb0)
SHDeleteKeyW (Address: 0x7ff78ced298)
SHDeleteValueW (Address: 0x7ff78ced300)
SHEnumKeyExW (Address: 0x7ff78ced268)
SHEnumValueW (Address: 0x7ff78ced290)
SHGetThreadRef (Address: 0x7ff78cecac0)
SHGetValueW (Address: 0x7ff78ced308)
SHOpenRegStream2W (Address: 0x7ff78cecb68)
SHQueryValueExW (Address: 0x7ff78ced430)
SHRegCloseUSKey (Address: 0x7ff78cecf90)
SHRegEnumUSKeyW (Address: 0x7ff78ced518)
SHRegGetBoolUSValueW (Address: 0x7ff78ced1a0)
SHRegGetPathW (Address: 0x7ff78ced030)
SHRegGetUSValueW (Address: 0x7ff78ced0b8)
SHRegGetValueW (Address: 0x7ff78ced418)
SHRegOpenUSKeyA (Address: 0x7ff78cecf88)
SHRegOpenUSKeyW (Address: 0x7ff78cecfa0)
SHRegQueryUSValueW (Address: 0x7ff78cecf98)
SHRegSetPathW (Address: 0x7ff78ced078)
SHSetValueW (Address: 0x7ff78ced2f8)
SHSkipJunction (Address: 0x7ff78cece00)
SHStrDupA (Address: 0x7ff78cecea0)
SHStrDupW (Address: 0x7ff78ced1d8)
StrChrA (Address: 0x7ff78ced4c0)
StrChrIA (Address: 0x7ff78ced4b8)
StrChrIW (Address: 0x7ff78ced4b0)
StrChrW (Address: 0x7ff78ced4a8)
StrCmpIW (Address: 0x7ff78ced338)
StrCmpLogicalW (Address: 0x7ff78ced180)
StrCmpNA (Address: 0x7ff78ced4a0)
StrCmpNIA (Address: 0x7ff78ced498)
StrCmpNIW (Address: 0x7ff78ced490)
StrCmpNW (Address: 0x7ff78ced488)
StrCmpW (Address: 0x7ff78ced320)
StrCSpnW (Address: 0x7ff78ced4e0)
StrDupA (Address: 0x7ff78ceccc8)
StrDupW (Address: 0x7ff78ced250)
StrFormatByteSizeEx (Address: 0x7ff78ced0c8)
StrFormatByteSizeW (Address: 0x7ff78ced2c0)
StrPBrkW (Address: 0x7ff78cecf00)
StrRChrA (Address: 0x7ff78ced480)
StrRChrIA (Address: 0x7ff78ced478)
StrRChrIW (Address: 0x7ff78ced470)
StrRChrW (Address: 0x7ff78ced468)
StrRetToBSTR (Address: 0x7ff78ced0a0)
StrRetToBufW (Address: 0x7ff78ced1e8)
StrRetToStrW (Address: 0x7ff78cecd28)
StrRStrIA (Address: 0x7ff78ced460)
StrRStrIW (Address: 0x7ff78ced458)
StrSpnW (Address: 0x7ff78cecf08)
StrStrA (Address: 0x7ff78ced450)
StrStrIA (Address: 0x7ff78ced448)
StrStrIW (Address: 0x7ff78ced440)
StrStrNIW (Address: 0x7ff78ced0d0)
StrStrW (Address: 0x7ff78ced438)
StrToIntA (Address: 0x7ff78ced068)
StrToIntExW (Address: 0x7ff78cecc18)
StrToIntW (Address: 0x7ff78ced408)
StrTrimW (Address: 0x7ff78cecfc8)
UrlApplySchemeW (Address: 0x7ff78cecc10)
UrlCanonicalizeW (Address: 0x7ff78cecf50)
UrlCompareW (Address: 0x7ff78ced050)
UrlCreateFromPathW (Address: 0x7ff78ced160)
UrlGetLocationW (Address: 0x7ff78cecd50)
UrlGetPartW (Address: 0x7ff78cecbf0)
UrlIsW (Address: 0x7ff78ced150)
UrlUnescapeA (Address: 0x7ff78cecf48)
UrlUnescapeW (Address: 0x7ff78ced148)

USER32.dll

(Address: 0x7ff78cedb60)
ActivateKeyboardLayout (Address: 0x7ff78cedc78)
AdjustWindowRect (Address: 0x7ff78ced790)
AdjustWindowRectEx (Address: 0x7ff78cedc60)
AllowSetForegroundWindow (Address: 0x7ff78cedad8)
AnimateWindow (Address: 0x7ff78cede98)
AppendMenuW (Address: 0x7ff78cedb70)
AttachThreadInput (Address: 0x7ff78cedc50)
BeginDeferWindowPos (Address: 0x7ff78cedaf0)
BeginPaint (Address: 0x7ff78cedfa8)
BringWindowToTop (Address: 0x7ff78cedcd8)
BroadcastSystemMessageW (Address: 0x7ff78ceda78)
CallNextHookEx (Address: 0x7ff78cedd48)
CallWindowProcW (Address: 0x7ff78cedd40)
ChangeClipboardChain (Address: 0x7ff78cedb88)
ChangeWindowMessageFilterEx (Address: 0x7ff78ced8b8)
CharLowerBuffW (Address: 0x7ff78cedc20)
CharLowerW (Address: 0x7ff78ced890)
CharNextA (Address: 0x7ff78ced7b0)
CharNextW (Address: 0x7ff78ced7a8)
CharPrevA (Address: 0x7ff78ced850)
CharPrevW (Address: 0x7ff78ced998)
CharUpperBuffW (Address: 0x7ff78ced9a0)
CharUpperW (Address: 0x7ff78ced7c8)
CheckDlgButton (Address: 0x7ff78cedf38)
CheckMenuItem (Address: 0x7ff78cedb80)
CheckMenuRadioItem (Address: 0x7ff78cedb78)
CheckRadioButton (Address: 0x7ff78cedf70)
ChildWindowFromPoint (Address: 0x7ff78cedea8)
ClientToScreen (Address: 0x7ff78cedd78)
CloseClipboard (Address: 0x7ff78cedc00)
CloseDesktop (Address: 0x7ff78cedb50)
CloseGestureInfoHandle (Address: 0x7ff78cedba0)
CopyAcceleratorTableW (Address: 0x7ff78cedc58)
CopyIcon (Address: 0x7ff78ced9c8)
CopyImage (Address: 0x7ff78cedc18)
CopyRect (Address: 0x7ff78ced8e0)
CountClipboardFormats (Address: 0x7ff78ced938)
CreateAcceleratorTableW (Address: 0x7ff78cedd90)
CreateDialogParamW (Address: 0x7ff78cedeb0)
CreateIconIndirect (Address: 0x7ff78cee028)
CreateMenu (Address: 0x7ff78cedbc8)
CreatePopupMenu (Address: 0x7ff78ced840)
CreateWindowExW (Address: 0x7ff78cedce8)
DdeCreateDataHandle (Address: 0x7ff78ceddf0)
DdeCreateStringHandleW (Address: 0x7ff78ceddf8)
DdeDisconnect (Address: 0x7ff78cede10)
DdeFreeStringHandle (Address: 0x7ff78cede00)
DdeGetData (Address: 0x7ff78cedde0)
DdeGetLastError (Address: 0x7ff78cedde8)
DdeInitializeW (Address: 0x7ff78cede28)
DdeNameService (Address: 0x7ff78cede18)
DdeQueryConvInfo (Address: 0x7ff78ceddd8)
DdeQueryStringW (Address: 0x7ff78cede08)
DdeUninitialize (Address: 0x7ff78cede20)
DeferWindowPos (Address: 0x7ff78cedae8)
DefWindowProcW (Address: 0x7ff78cedfb0)
DeleteMenu (Address: 0x7ff78ced810)
DeregisterShellHookWindow (Address: 0x7ff78cedab8)
DestroyAcceleratorTable (Address: 0x7ff78cedbb8)
DestroyIcon (Address: 0x7ff78cee038)
DestroyMenu (Address: 0x7ff78ced818)
DestroyWindow (Address: 0x7ff78ced848)
DialogBoxParamW (Address: 0x7ff78cedc10)
DispatchMessageW (Address: 0x7ff78cedb20)
DrawEdge (Address: 0x7ff78cedb90)
DrawFocusRect (Address: 0x7ff78cedfd0)
DrawIcon (Address: 0x7ff78ced7c0)
DrawIconEx (Address: 0x7ff78ceda70)
DrawTextW (Address: 0x7ff78cedf78)
EmptyClipboard (Address: 0x7ff78cede48)
EnableMenuItem (Address: 0x7ff78ced920)
EnableWindow (Address: 0x7ff78cedf18)
EndDeferWindowPos (Address: 0x7ff78cedaf8)
EndDialog (Address: 0x7ff78cedf30)
EndMenu (Address: 0x7ff78cedbc0)
EndPaint (Address: 0x7ff78cedf80)
EnumChildWindows (Address: 0x7ff78cedc08)
EnumDisplayDevicesW (Address: 0x7ff78ced9f0)
EnumDisplayMonitors (Address: 0x7ff78cedd98)
EnumDisplaySettingsW (Address: 0x7ff78cedf48)
EnumPropsExW (Address: 0x7ff78cedbe0)
EnumWindows (Address: 0x7ff78ced9c0)
EqualRect (Address: 0x7ff78ceda48)
ExitWindowsEx (Address: 0x7ff78ceda28)
FillRect (Address: 0x7ff78cedf88)
FindWindowA (Address: 0x7ff78cede70)
FindWindowExW (Address: 0x7ff78cedc30)
FindWindowW (Address: 0x7ff78ced7e8)
FrameRect (Address: 0x7ff78cedf90)
FreeDDElParam (Address: 0x7ff78cedcc8)
GetAncestor (Address: 0x7ff78ced7e0)
GetAsyncKeyState (Address: 0x7ff78ceda30)
GetCapture (Address: 0x7ff78cedc90)
GetClassInfoExW (Address: 0x7ff78cedd60)
GetClassInfoW (Address: 0x7ff78ceda98)
GetClassLongPtrW (Address: 0x7ff78ceddc8)
GetClassNameW (Address: 0x7ff78ced8e8)
GetClassWord (Address: 0x7ff78cedcf0)
GetClientRect (Address: 0x7ff78cedfa0)
GetClipboardData (Address: 0x7ff78cedbf0)
GetClipboardOwner (Address: 0x7ff78ced928)
GetCursor (Address: 0x7ff78cede78)
GetCursorPos (Address: 0x7ff78ceda18)
GetDC (Address: 0x7ff78cedff0)
GetDesktopWindow (Address: 0x7ff78ceda08)
GetDialogBaseUnits (Address: 0x7ff78cedd00)
GetDisplayConfigBufferSizes (Address: 0x7ff78cedec0)
GetDlgCtrlID (Address: 0x7ff78cedf50)
GetDlgItem (Address: 0x7ff78cee050)
GetDlgItemInt (Address: 0x7ff78cedf60)
GetDlgItemTextW (Address: 0x7ff78ceded0)
GetDoubleClickTime (Address: 0x7ff78ceda10)
GetFocus (Address: 0x7ff78cedf20)
GetForegroundWindow (Address: 0x7ff78ced898)
GetGestureInfo (Address: 0x7ff78cedb98)
GetIconInfo (Address: 0x7ff78cee030)
GetKeyboardLayout (Address: 0x7ff78cedc70)
GetKeyState (Address: 0x7ff78cedfb8)
GetLastActivePopup (Address: 0x7ff78ced9d0)
GetLastInputInfo (Address: 0x7ff78cedc40)
GetMenuDefaultItem (Address: 0x7ff78ced958)
GetMenuInfo (Address: 0x7ff78cede50)
GetMenuItemCount (Address: 0x7ff78ced870)
GetMenuItemID (Address: 0x7ff78ced960)
GetMenuItemInfoW (Address: 0x7ff78ced880)
GetMenuState (Address: 0x7ff78ced940)
GetMenuStringW (Address: 0x7ff78ced970)
GetMessagePos (Address: 0x7ff78ced860)
GetMessageTime (Address: 0x7ff78cedd88)
GetMessageW (Address: 0x7ff78cedc38)
GetMonitorInfoW (Address: 0x7ff78ced780)
GetNextDlgTabItem (Address: 0x7ff78cedfc0)
GetParent (Address: 0x7ff78cee008)
GetProcessDefaultLayout (Address: 0x7ff78cede60)
GetProcessWindowStation (Address: 0x7ff78ced8c0)
GetPropW (Address: 0x7ff78ced9b8)
GetScrollInfo (Address: 0x7ff78ced9e0)
GetShellWindow (Address: 0x7ff78ced918)
GetSubMenu (Address: 0x7ff78ced8f8)
GetSysColor (Address: 0x7ff78cedee8)
GetSysColorBrush (Address: 0x7ff78ced988)
GetSystemMenu (Address: 0x7ff78cedcb8)
GetSystemMetrics (Address: 0x7ff78cee060)
GetTaskmanWindow (Address: 0x7ff78cedaa8)
GetThreadDesktop (Address: 0x7ff78ced8c8)
GetUpdateRect (Address: 0x7ff78cedc88)
GetUserObjectInformationW (Address: 0x7ff78ced8d0)
GetWindow (Address: 0x7ff78ced868)
GetWindowDC (Address: 0x7ff78cedc68)
GetWindowLongPtrW (Address: 0x7ff78cee018)
GetWindowLongW (Address: 0x7ff78cee010)
GetWindowPlacement (Address: 0x7ff78cedaa0)
GetWindowRect (Address: 0x7ff78cedfe8)
GetWindowTextLengthW (Address: 0x7ff78ceda90)
GetWindowTextW (Address: 0x7ff78cee068)
GetWindowThreadProcessId (Address: 0x7ff78ced858)
HideCaret (Address: 0x7ff78cede80)
InflateRect (Address: 0x7ff78cedfd8)
InsertMenuItemW (Address: 0x7ff78ced888)
InsertMenuW (Address: 0x7ff78ced878)
IntersectRect (Address: 0x7ff78ceda40)
InvalidateRect (Address: 0x7ff78cedf68)
IsCharAlphaW (Address: 0x7ff78ced7d0)
IsChild (Address: 0x7ff78cedf00)
IsDialogMessageW (Address: 0x7ff78cedca8)
IsDlgButtonChecked (Address: 0x7ff78cedf28)
IsIconic (Address: 0x7ff78ced9d8)
IsMenu (Address: 0x7ff78ced978)
IsProcessDPIAware (Address: 0x7ff78ceda68)
IsRectEmpty (Address: 0x7ff78cedd70)
IsSETEnabled (Address: 0x7ff78ceda50)
IsWindow (Address: 0x7ff78cedee0)
IsWindowEnabled (Address: 0x7ff78ced800)
IsWindowUnicode (Address: 0x7ff78cedce0)
IsWindowVisible (Address: 0x7ff78cedef8)
IsWinEventHookInstalled (Address: 0x7ff78cede68)
KillTimer (Address: 0x7ff78ced838)
LoadAcceleratorsW (Address: 0x7ff78cedb68)
LoadBitmapW (Address: 0x7ff78cedef0)
LoadCursorW (Address: 0x7ff78cedf10)
LoadIconW (Address: 0x7ff78cee048)
LoadImageW (Address: 0x7ff78ced910)
LoadMenuW (Address: 0x7ff78ced8f0)
LockSetForegroundWindow (Address: 0x7ff78cede90)
LockWindowUpdate (Address: 0x7ff78ceddb0)
LookupIconIdFromDirectory (Address: 0x7ff78cee020)
MapDialogRect (Address: 0x7ff78ceda88)
MapWindowPoints (Address: 0x7ff78cedec8)
MessageBeep (Address: 0x7ff78ced968)
MessageBoxIndirectW (Address: 0x7ff78cedeb8)
MessageBoxW (Address: 0x7ff78cedad0)
ModifyMenuW (Address: 0x7ff78ced948)
MonitorFromPoint (Address: 0x7ff78ced8d8)
MonitorFromRect (Address: 0x7ff78ced778)
MonitorFromWindow (Address: 0x7ff78ceda38)
MoveWindow (Address: 0x7ff78ced798)
MsgWaitForMultipleObjects (Address: 0x7ff78cedb38)
MsgWaitForMultipleObjectsEx (Address: 0x7ff78cede58)
NotifyWinEvent (Address: 0x7ff78cedb58)
OffsetRect (Address: 0x7ff78ced9f8)
OpenClipboard (Address: 0x7ff78cedbe8)
OpenInputDesktop (Address: 0x7ff78cedb48)
PackDDElParam (Address: 0x7ff78cedcd0)
PaintDesktop (Address: 0x7ff78ceddb8)
PaintMonitor (Address: 0x7ff78ceddc0)
PeekMessageW (Address: 0x7ff78cedb10)
PostMessageW (Address: 0x7ff78ced7f8)
PostQuitMessage (Address: 0x7ff78cedb40)
PostThreadMessageW (Address: 0x7ff78cedcb0)
PrivateExtractIconsW (Address: 0x7ff78cee040)
PtInRect (Address: 0x7ff78ced990)
RedrawWindow (Address: 0x7ff78ceda60)
RegisterClassExW (Address: 0x7ff78ced9e8)
RegisterClassW (Address: 0x7ff78cedf08)
RegisterClipboardFormatW (Address: 0x7ff78ced8a8)
RegisterDeviceNotificationW (Address: 0x7ff78cedb30)
RegisterShellHookWindow (Address: 0x7ff78cedac0)
RegisterWindowMessageA (Address: 0x7ff78cedd08)
RegisterWindowMessageW (Address: 0x7ff78ced8b0)
ReleaseCapture (Address: 0x7ff78cedc98)
ReleaseDC (Address: 0x7ff78cedfc8)
RemoveMenu (Address: 0x7ff78ced900)
RemovePropW (Address: 0x7ff78ced9b0)
ScreenToClient (Address: 0x7ff78cedfe0)
SendDlgItemMessageW (Address: 0x7ff78cedf98)
SendMessageCallbackW (Address: 0x7ff78cedb08)
SendMessageTimeoutW (Address: 0x7ff78ced930)
SendMessageW (Address: 0x7ff78cee058)
SendNotifyMessageW (Address: 0x7ff78cedb00)
SetActiveWindow (Address: 0x7ff78ceda80)
SetCapture (Address: 0x7ff78cedca0)
SetClipboardData (Address: 0x7ff78cedbf8)
SetClipboardViewer (Address: 0x7ff78cedbd8)
SetCursor (Address: 0x7ff78ced7b8)
SetDlgItemInt (Address: 0x7ff78cedf58)
SetDlgItemTextA (Address: 0x7ff78cedae0)
SetDlgItemTextW (Address: 0x7ff78ced768)
SetFocus (Address: 0x7ff78cedff8)
SetForegroundWindow (Address: 0x7ff78ced7f0)
SetGestureConfig (Address: 0x7ff78cedba8)
SetMenu (Address: 0x7ff78cedea0)
SetMenuDefaultItem (Address: 0x7ff78ced950)
SetMenuInfo (Address: 0x7ff78cedc28)
SetMenuItemInfoW (Address: 0x7ff78ced980)
SetParent (Address: 0x7ff78cedd68)
SetProcessDPIAware (Address: 0x7ff78ced808)
SetPropW (Address: 0x7ff78ced9a8)
SetRect (Address: 0x7ff78ced788)
SetRectEmpty (Address: 0x7ff78cedc48)
SetScrollInfo (Address: 0x7ff78cedd28)
SetScrollPos (Address: 0x7ff78cedd38)
SetShellWindowEx (Address: 0x7ff78cedda0)
SetTaskmanWindow (Address: 0x7ff78cedab0)
SetTimer (Address: 0x7ff78ced830)
SetWindowLongPtrW (Address: 0x7ff78cee000)
SetWindowLongW (Address: 0x7ff78ced7d8)
SetWindowPos (Address: 0x7ff78ced7a0)
SetWindowRgn (Address: 0x7ff78cedd20)
SetWindowsHookExW (Address: 0x7ff78cedd18)
SetWindowTextW (Address: 0x7ff78ced770)
SetWinEventHook (Address: 0x7ff78cede38)
ShowCaret (Address: 0x7ff78cede88)
ShowScrollBar (Address: 0x7ff78cedd30)
ShowWindow (Address: 0x7ff78cedf40)
ShutdownBlockReasonCreate (Address: 0x7ff78ced820)
ShutdownBlockReasonDestroy (Address: 0x7ff78ced828)
SubtractRect (Address: 0x7ff78cedda8)
SwitchToThisWindow (Address: 0x7ff78cedd58)
SystemParametersInfoA (Address: 0x7ff78ced908)
SystemParametersInfoW (Address: 0x7ff78ceda58)
TabbedTextOutW (Address: 0x7ff78ceded8)
TrackMouseEvent (Address: 0x7ff78cedc80)
TrackPopupMenu (Address: 0x7ff78ced8a0)
TrackPopupMenuEx (Address: 0x7ff78cedd50)
TranslateAcceleratorW (Address: 0x7ff78cedbd0)
TranslateMessage (Address: 0x7ff78cedb18)
UnhookWindowsHookEx (Address: 0x7ff78cedd10)
UnhookWinEvent (Address: 0x7ff78cede40)
UnionRect (Address: 0x7ff78ceda00)
UnpackDDElParam (Address: 0x7ff78cedcc0)
UnregisterDeviceNotification (Address: 0x7ff78cedb28)
UpdateLayeredWindow (Address: 0x7ff78ceda20)
UpdateWindow (Address: 0x7ff78cedbb0)
WaitForInputIdle (Address: 0x7ff78cedac8)
WaitMessage (Address: 0x7ff78ceddd0)
WindowFromPoint (Address: 0x7ff78cedd80)
WinHelpW (Address: 0x7ff78cedcf8)
wsprintfW (Address: 0x7ff78cede30)