vssapi.dll
Description: Microsoft® Volume Shadow Copy Requestor/Writer Services API DLL
Authors: © Microsoft Corporation. All rights reserved.
Version: 10.0.19041.4355
Architecture: 64-bit
Operating System: Windows NT
SHA256: 8ef41d7a63c3e835d3c987368b1b8594
File Size: 1.6 MB
Uploaded At: Dec. 1, 2025, 7:42 a.m.
Views: 6
Exported Functions
- IsVolumeSnapshotted (Ordinal: 5, Address: 0x29ff0)
- VssFreeSnapshotProperties (Ordinal: 6, Address: 0x2c7c0)
- ShouldBlockRevert (Ordinal: 7, Address: 0x2b720)
- ??0CVssJetWriter@@QEAA@XZ (Ordinal: 8, Address: 0x327e0)
- ??0CVssWriter@@QEAA@XZ (Ordinal: 9, Address: 0x2cd70)
- ??1CVssJetWriter@@UEAA@XZ (Ordinal: 10, Address: 0x32800)
- ??1CVssWriter@@UEAA@XZ (Ordinal: 11, Address: 0x2d220)
- ?AreComponentsSelected@CVssJetWriter@@IEBA_NXZ (Ordinal: 12, Address: 0x328a0)
- ?AreComponentsSelected@CVssWriter@@IEBA_NXZ (Ordinal: 13, Address: 0x2d7f0)
- ?CreateVssBackupComponents@@YAJPEAPEAVIVssBackupComponents@@@Z (Ordinal: 14, Address: 0x30ee0)
- ?CreateVssExamineWriterMetadata@@YAJPEAGPEAPEAVIVssExamineWriterMetadata@@@Z (Ordinal: 15, Address: 0x31240)
- ?GetBackupType@CVssJetWriter@@IEBA?AW4_VSS_BACKUP_TYPE@@XZ (Ordinal: 16, Address: 0x32970)
- ?GetBackupType@CVssWriter@@IEBA?AW4_VSS_BACKUP_TYPE@@XZ (Ordinal: 17, Address: 0x2de60)
- ?GetContext@CVssJetWriter@@IEBAJXZ (Ordinal: 18, Address: 0x32a40)
- ?GetContext@CVssWriter@@IEBAJXZ (Ordinal: 19, Address: 0x2de90)
- ?GetCurrentLevel@CVssJetWriter@@IEBA?AW4_VSS_APPLICATION_LEVEL@@XZ (Ordinal: 20, Address: 0x32b10)
- ?GetCurrentLevel@CVssWriter@@IEBA?AW4_VSS_APPLICATION_LEVEL@@XZ (Ordinal: 21, Address: 0x2e000)
- ?GetCurrentSnapshotSetId@CVssJetWriter@@IEBA?AU_GUID@@XZ (Ordinal: 22, Address: 0x32be0)
- ?GetCurrentSnapshotSetId@CVssWriter@@IEBA?AU_GUID@@XZ (Ordinal: 23, Address: 0x2e090)
- ?GetCurrentVolumeArray@CVssJetWriter@@IEBAPEAPEBGXZ (Ordinal: 24, Address: 0x32cd0)
- ?GetCurrentVolumeArray@CVssWriter@@IEBAPEAPEBGXZ (Ordinal: 25, Address: 0x2e0e0)
- ?GetCurrentVolumeCount@CVssJetWriter@@IEBAIXZ (Ordinal: 26, Address: 0x32da0)
- ?GetCurrentVolumeCount@CVssWriter@@IEBAIXZ (Ordinal: 27, Address: 0x2e110)
- ?GetRestoreType@CVssJetWriter@@IEBA?AW4_VSS_RESTORE_TYPE@@XZ (Ordinal: 28, Address: 0x32e70)
- ?GetRestoreType@CVssWriter@@IEBA?AW4_VSS_RESTORE_TYPE@@XZ (Ordinal: 29, Address: 0x2e790)
- ?GetSnapshotDeviceName@CVssJetWriter@@IEBAJPEBGPEAPEBG@Z (Ordinal: 30, Address: 0x32f40)
- ?GetSnapshotDeviceName@CVssWriter@@IEBAJPEBGPEAPEBG@Z (Ordinal: 31, Address: 0x2e800)
- ?Initialize@CVssJetWriter@@QEAAJU_GUID@@PEBG_N211K@Z (Ordinal: 32, Address: 0x33040)
- ?Initialize@CVssWriter@@QEAAJU_GUID@@PEBGW4VSS_USAGE_TYPE@@W4VSS_SOURCE_TYPE@@W4_VSS_APPLICATION_LEVEL@@KW4VSS_ALTERNATE_WRITER_STATE@@_N1@Z (Ordinal: 33, Address: 0x2eeb0)
- ?InstallAlternateWriter@CVssWriter@@QEAAJU_GUID@@0@Z (Ordinal: 34, Address: 0x2ef20)
- ?IsBootableSystemStateBackedUp@CVssJetWriter@@IEBA_NXZ (Ordinal: 35, Address: 0x33830)
- ?IsBootableSystemStateBackedUp@CVssWriter@@IEBA_NXZ (Ordinal: 36, Address: 0x2f040)
- ?IsPartialFileSupportEnabled@CVssJetWriter@@IEBA_NXZ (Ordinal: 37, Address: 0x33900)
- ?IsPartialFileSupportEnabled@CVssWriter@@IEBA_NXZ (Ordinal: 38, Address: 0x2f070)
- ?IsPathAffected@CVssJetWriter@@IEBA_NPEBG@Z (Ordinal: 39, Address: 0x339d0)
- ?IsPathAffected@CVssWriter@@IEBA_NPEBG@Z (Ordinal: 40, Address: 0x2f080)
- ?OnAbortBegin@CVssJetWriter@@UEAAXXZ (Ordinal: 41, Address: 0x33ac0)
- ?OnAbortEnd@CVssJetWriter@@UEAAXXZ (Ordinal: 42, Address: 0x33b50)
- ?OnBackOffIOOnVolume@CVssWriter@@UEAA_NPEAGU_GUID@@1@Z (Ordinal: 43, Address: 0x141f0)
- ?OnBackupComplete@CVssWriter@@UEAA_NPEAVIVssWriterComponents@@@Z (Ordinal: 44, Address: 0x141f0)
- ?OnBackupCompleteBegin@CVssJetWriter@@UEAA_NPEAVIVssWriterComponents@@@Z (Ordinal: 45, Address: 0x33be0)
- ?OnBackupCompleteEnd@CVssJetWriter@@UEAA_NPEAVIVssWriterComponents@@_N@Z (Ordinal: 46, Address: 0x33c70)
- ?OnBackupShutdown@CVssWriter@@UEAA_NU_GUID@@@Z (Ordinal: 47, Address: 0x141f0)
- ?OnContinueIOOnVolume@CVssWriter@@UEAA_NPEAGU_GUID@@1@Z (Ordinal: 48, Address: 0x141f0)
- ?OnFreezeBegin@CVssJetWriter@@UEAA_NXZ (Ordinal: 49, Address: 0x33d00)
- ?OnFreezeEnd@CVssJetWriter@@UEAA_N_N@Z (Ordinal: 50, Address: 0x33d90)
- ?OnIdentify@CVssJetWriter@@UEAA_NPEAVIVssCreateWriterMetadata@@@Z (Ordinal: 51, Address: 0x33e30)
- ?OnIdentify@CVssWriter@@UEAA_NPEAVIVssCreateWriterMetadata@@@Z (Ordinal: 52, Address: 0x141f0)
- ?OnPostRestore@CVssWriter@@UEAA_NPEAVIVssWriterComponents@@@Z (Ordinal: 53, Address: 0x141f0)
- ?OnPostRestoreBegin@CVssJetWriter@@UEAA_NPEAVIVssWriterComponents@@@Z (Ordinal: 54, Address: 0x33ec0)
- ?OnPostRestoreEnd@CVssJetWriter@@UEAA_NPEAVIVssWriterComponents@@_N@Z (Ordinal: 55, Address: 0x33f50)
- ?OnPostSnapshot@CVssJetWriter@@UEAA_NPEAVIVssWriterComponents@@@Z (Ordinal: 56, Address: 0x33fe0)
- ?OnPostSnapshot@CVssWriter@@UEAA_NPEAVIVssWriterComponents@@@Z (Ordinal: 57, Address: 0x141f0)
- ?OnPreRestore@CVssWriter@@UEAA_NPEAVIVssWriterComponents@@@Z (Ordinal: 58, Address: 0x141f0)
- ?OnPreRestoreBegin@CVssJetWriter@@UEAA_NPEAVIVssWriterComponents@@@Z (Ordinal: 59, Address: 0x34070)
- ?OnPreRestoreEnd@CVssJetWriter@@UEAA_NPEAVIVssWriterComponents@@_N@Z (Ordinal: 60, Address: 0x34100)
- ?OnPrepareBackup@CVssWriter@@UEAA_NPEAVIVssWriterComponents@@@Z (Ordinal: 61, Address: 0x141f0)
- ?OnPrepareBackupBegin@CVssJetWriter@@UEAA_NPEAVIVssWriterComponents@@@Z (Ordinal: 62, Address: 0x34190)
- ?OnPrepareBackupEnd@CVssJetWriter@@UEAA_NPEAVIVssWriterComponents@@_N@Z (Ordinal: 63, Address: 0x34220)
- ?OnPrepareSnapshotBegin@CVssJetWriter@@UEAA_NXZ (Ordinal: 64, Address: 0x342c0)
- ?OnPrepareSnapshotEnd@CVssJetWriter@@UEAA_N_N@Z (Ordinal: 65, Address: 0x34350)
- ?OnThawBegin@CVssJetWriter@@UEAA_NXZ (Ordinal: 66, Address: 0x343f0)
- ?OnThawEnd@CVssJetWriter@@UEAA_N_N@Z (Ordinal: 67, Address: 0x34480)
- ?OnVSSApplicationStartup@CVssWriter@@UEAA_NXZ (Ordinal: 68, Address: 0x141f0)
- ?OnVSSShutdown@CVssWriter@@UEAA_NXZ (Ordinal: 69, Address: 0x141f0)
- ?SetWriterFailure@CVssJetWriter@@IEAAJJ@Z (Ordinal: 70, Address: 0x34520)
- ?SetWriterFailure@CVssWriter@@IEAAJJ@Z (Ordinal: 71, Address: 0x303e0)
- ?Subscribe@CVssWriter@@QEAAJK@Z (Ordinal: 72, Address: 0x306a0)
- ?Uninitialize@CVssJetWriter@@QEAAXXZ (Ordinal: 73, Address: 0x34620)
- ?Unsubscribe@CVssWriter@@QEAAJXZ (Ordinal: 74, Address: 0x30a00)
- CreateVssBackupComponentsInternal (Ordinal: 75, Address: 0x30ee0)
- CreateVssExamineWriterMetadataInternal (Ordinal: 76, Address: 0x31240)
- CreateVssExpressWriterInternal (Ordinal: 77, Address: 0x317f0)
- CreateVssSnapshotSetDescription (Ordinal: 78, Address: 0x31c90)
- CreateWriter (Ordinal: 79, Address: 0x12f70)
- CreateWriterEx (Ordinal: 80, Address: 0x14f70)
- DllCanUnloadNow (Ordinal: 81, Address: 0x293c0)
- DllGetClassObject (Ordinal: 82, Address: 0x293e0)
- GetProviderMgmtInterface (Ordinal: 83, Address: 0x29400)
- GetProviderMgmtInterfaceInternal (Ordinal: 84, Address: 0x29400)
- IsVolumeSnapshottedInternal (Ordinal: 85, Address: 0x29ff0)
- LoadVssSnapshotSetDescription (Ordinal: 86, Address: 0x32470)
- ShouldBlockRevertInternal (Ordinal: 87, Address: 0x2b720)
- VssFreeSnapshotPropertiesInternal (Ordinal: 88, Address: 0x2c7c0)
Imported DLLs & Functions
api-ms-win-core-debug-l1-1-0.dll
- DebugBreak (Address: 0x18010aca0)
- IsDebuggerPresent (Address: 0x18010acb8)
- OutputDebugStringA (Address: 0x18010aca8)
- OutputDebugStringW (Address: 0x18010acb0)
api-ms-win-core-delayload-l1-1-0.dll
- DelayLoadFailureHook (Address: 0x18010acc8)
api-ms-win-core-delayload-l1-1-1.dll
- ResolveDelayLoadedAPI (Address: 0x18010acd8)
api-ms-win-core-errorhandling-l1-1-0.dll
- GetLastError (Address: 0x18010ad10)
- RaiseException (Address: 0x18010acf8)
- SetErrorMode (Address: 0x18010ad08)
- SetLastError (Address: 0x18010acf0)
- SetUnhandledExceptionFilter (Address: 0x18010ace8)
- UnhandledExceptionFilter (Address: 0x18010ad00)
api-ms-win-core-file-l1-1-0.dll
- CreateDirectoryW (Address: 0x18010ad80)
- CreateFileW (Address: 0x18010ad58)
- DeleteFileW (Address: 0x18010ad68)
- FindClose (Address: 0x18010ad40)
- FindFirstFileW (Address: 0x18010ad30)
- FindNextFileW (Address: 0x18010ad38)
- GetDriveTypeW (Address: 0x18010ad98)
- GetFileAttributesW (Address: 0x18010ad78)
- GetFullPathNameW (Address: 0x18010ad90)
- GetLogicalDrives (Address: 0x18010ad88)
- GetVolumeInformationW (Address: 0x18010ad20)
- GetVolumePathNameW (Address: 0x18010ad50)
- ReadFile (Address: 0x18010ad28)
- SetFilePointer (Address: 0x18010ad48)
- SetFilePointerEx (Address: 0x18010ad60)
- WriteFile (Address: 0x18010ad70)
api-ms-win-core-file-l1-2-0.dll
- GetVolumeNameForVolumeMountPointW (Address: 0x18010ada8)
- GetVolumePathNamesForVolumeNameW (Address: 0x18010adb0)
api-ms-win-core-file-l2-1-0.dll
- CopyFileExW (Address: 0x18010adc0)
api-ms-win-core-handle-l1-1-0.dll
- CloseHandle (Address: 0x18010add0)
api-ms-win-core-heap-l1-1-0.dll
- GetProcessHeap (Address: 0x18010adf0)
- HeapAlloc (Address: 0x18010adf8)
- HeapDestroy (Address: 0x18010ade8)
- HeapFree (Address: 0x18010ade0)
api-ms-win-core-heap-l2-1-0.dll
- GlobalAlloc (Address: 0x18010ae08)
- GlobalFree (Address: 0x18010ae18)
- LocalAlloc (Address: 0x18010ae10)
- LocalFree (Address: 0x18010ae20)
api-ms-win-core-heap-obsolete-l1-1-0.dll
- GlobalLock (Address: 0x18010ae38)
- GlobalUnlock (Address: 0x18010ae30)
api-ms-win-core-io-l1-1-0.dll
- DeviceIoControl (Address: 0x18010ae48)
api-ms-win-core-kernel32-legacy-l1-1-1.dll
- SetVolumeMountPointW (Address: 0x18010ae58)
api-ms-win-core-libraryloader-l1-2-0.dll
- FindResourceExW (Address: 0x18010aec8)
- FreeLibrary (Address: 0x18010ae90)
- FreeResource (Address: 0x18010aea0)
- GetModuleFileNameA (Address: 0x18010aea8)
- GetModuleFileNameW (Address: 0x18010ae70)
- GetModuleHandleExW (Address: 0x18010ae80)
- GetModuleHandleW (Address: 0x18010ae68)
- GetProcAddress (Address: 0x18010ae88)
- LoadLibraryExW (Address: 0x18010aeb0)
- LoadResource (Address: 0x18010ae78)
- LoadStringW (Address: 0x18010aec0)
- LockResource (Address: 0x18010ae98)
- SizeofResource (Address: 0x18010aeb8)
api-ms-win-core-localization-l1-2-0.dll
- FormatMessageW (Address: 0x18010aed8)
api-ms-win-core-memory-l1-1-0.dll
- VirtualAlloc (Address: 0x18010aef0)
- VirtualProtect (Address: 0x18010aef8)
- VirtualQuery (Address: 0x18010aee8)
api-ms-win-core-processenvironment-l1-1-0.dll
- ExpandEnvironmentStringsW (Address: 0x18010af10)
- GetCommandLineW (Address: 0x18010af08)
api-ms-win-core-processthreads-l1-1-0.dll
- CreateThread (Address: 0x18010af60)
- GetCurrentProcess (Address: 0x18010af50)
- GetCurrentProcessId (Address: 0x18010af78)
- GetCurrentThread (Address: 0x18010af38)
- GetCurrentThreadId (Address: 0x18010af68)
- OpenProcessToken (Address: 0x18010af70)
- OpenThreadToken (Address: 0x18010af80)
- ResumeThread (Address: 0x18010af28)
- SetThreadToken (Address: 0x18010af30)
- TerminateProcess (Address: 0x18010af40)
- TlsAlloc (Address: 0x18010af20)
- TlsGetValue (Address: 0x18010af48)
- TlsSetValue (Address: 0x18010af58)
api-ms-win-core-profile-l1-1-0.dll
- QueryPerformanceCounter (Address: 0x18010af90)
api-ms-win-core-registry-l1-1-0.dll
- RegCloseKey (Address: 0x18010afc0)
- RegCreateKeyExW (Address: 0x18010afa0)
- RegDeleteValueW (Address: 0x18010afd8)
- RegEnumKeyExW (Address: 0x18010afa8)
- RegEnumValueW (Address: 0x18010afe8)
- RegLoadKeyW (Address: 0x18010aff0)
- RegOpenKeyExW (Address: 0x18010afc8)
- RegQueryInfoKeyW (Address: 0x18010afd0)
- RegQueryValueExW (Address: 0x18010afb0)
- RegSetValueExW (Address: 0x18010afb8)
- RegUnLoadKeyW (Address: 0x18010afe0)
api-ms-win-core-rtlsupport-l1-1-0.dll
- RtlCaptureContext (Address: 0x18010b008)
- RtlLookupFunctionEntry (Address: 0x18010b010)
- RtlVirtualUnwind (Address: 0x18010b000)
api-ms-win-core-string-l1-1-0.dll
- MultiByteToWideChar (Address: 0x18010b020)
- WideCharToMultiByte (Address: 0x18010b028)
api-ms-win-core-string-l2-1-0.dll
- CharNextW (Address: 0x18010b038)
- CharPrevW (Address: 0x18010b040)
api-ms-win-core-string-obsolete-l1-1-0.dll
- lstrcmpiW (Address: 0x18010b050)
- lstrcpynW (Address: 0x18010b058)
api-ms-win-core-synch-l1-1-0.dll
- AcquireSRWLockExclusive (Address: 0x18010b070)
- CreateEventW (Address: 0x18010b088)
- CreateMutexExW (Address: 0x18010b0f0)
- CreateMutexW (Address: 0x18010b090)
- CreateSemaphoreExW (Address: 0x18010b0e0)
- DeleteCriticalSection (Address: 0x18010b098)
- EnterCriticalSection (Address: 0x18010b0a8)
- InitializeCriticalSection (Address: 0x18010b0c0)
- InitializeCriticalSectionAndSpinCount (Address: 0x18010b080)
- LeaveCriticalSection (Address: 0x18010b0d0)
- OpenSemaphoreW (Address: 0x18010b0b0)
- ReleaseMutex (Address: 0x18010b068)
- ReleaseSemaphore (Address: 0x18010b0a0)
- ReleaseSRWLockExclusive (Address: 0x18010b0d8)
- ResetEvent (Address: 0x18010b0c8)
- SetEvent (Address: 0x18010b0e8)
- WaitForSingleObject (Address: 0x18010b078)
- WaitForSingleObjectEx (Address: 0x18010b0b8)
api-ms-win-core-synch-l1-2-0.dll
- InitOnceBeginInitialize (Address: 0x18010b108)
- InitOnceComplete (Address: 0x18010b110)
- Sleep (Address: 0x18010b100)
api-ms-win-core-sysinfo-l1-1-0.dll
- GetComputerNameExW (Address: 0x18010b120)
- GetSystemInfo (Address: 0x18010b148)
- GetSystemTime (Address: 0x18010b140)
- GetSystemTimeAsFileTime (Address: 0x18010b130)
- GetSystemWindowsDirectoryW (Address: 0x18010b128)
- GetTickCount (Address: 0x18010b138)
- GetTickCount64 (Address: 0x18010b150)
- GetVersionExW (Address: 0x18010b158)
- GetWindowsDirectoryW (Address: 0x18010b160)
api-ms-win-core-util-l1-1-0.dll
- DecodePointer (Address: 0x18010b170)
- EncodePointer (Address: 0x18010b178)
api-ms-win-eventing-provider-l1-1-0.dll
- EventActivityIdControl (Address: 0x18010b1a0)
- EventRegister (Address: 0x18010b1a8)
- EventSetInformation (Address: 0x18010b198)
- EventUnregister (Address: 0x18010b188)
- EventWriteTransfer (Address: 0x18010b190)
api-ms-win-eventlog-legacy-l1-1-0.dll
- DeregisterEventSource (Address: 0x18010b1c8)
- RegisterEventSourceW (Address: 0x18010b1c0)
- ReportEventW (Address: 0x18010b1b8)
api-ms-win-security-base-l1-1-0.dll
- AddAccessAllowedAceEx (Address: 0x18010b1e0)
- AddAccessDeniedAceEx (Address: 0x18010b1e8)
- AddAce (Address: 0x18010b1f8)
- AllocateAndInitializeSid (Address: 0x18010b260)
- CheckTokenMembership (Address: 0x18010b258)
- CopySid (Address: 0x18010b220)
- CreateWellKnownSid (Address: 0x18010b240)
- DuplicateToken (Address: 0x18010b270)
- EqualDomainSid (Address: 0x18010b268)
- EqualSid (Address: 0x18010b288)
- FreeSid (Address: 0x18010b250)
- GetAce (Address: 0x18010b200)
- GetAclInformation (Address: 0x18010b208)
- GetLengthSid (Address: 0x18010b228)
- GetSidSubAuthorityCount (Address: 0x18010b1d8)
- GetTokenInformation (Address: 0x18010b290)
- InitializeAcl (Address: 0x18010b1f0)
- InitializeSecurityDescriptor (Address: 0x18010b238)
- IsValidSid (Address: 0x18010b280)
- PrivilegeCheck (Address: 0x18010b248)
- RevertToSelf (Address: 0x18010b278)
- SetSecurityDescriptorDacl (Address: 0x18010b210)
- SetSecurityDescriptorGroup (Address: 0x18010b218)
- SetSecurityDescriptorOwner (Address: 0x18010b230)
msvcrt.dll
- __C_specific_handler (Address: 0x18010b440)
- __CxxFrameHandler3 (Address: 0x18010b3d8)
- __dllonexit (Address: 0x18010b368)
- _amsg_exit (Address: 0x18010b390)
- _beginthreadex (Address: 0x18010b2d8)
- _callnewh (Address: 0x18010b3b8)
- _CxxThrowException (Address: 0x18010b3a0)
- _errno (Address: 0x18010b2d0)
- _initterm (Address: 0x18010b388)
- _lock (Address: 0x18010b378)
- _onexit (Address: 0x18010b360)
- _purecall (Address: 0x18010b418)
- _resetstkoflw (Address: 0x18010b410)
- _unlock (Address: 0x18010b370)
- _vsnprintf (Address: 0x18010b318)
- _vsnprintf_s (Address: 0x18010b3c0)
- _vsnwprintf (Address: 0x18010b438)
- _wcsdup (Address: 0x18010b2b0)
- _wcsicmp (Address: 0x18010b430)
- _wcsnicmp (Address: 0x18010b400)
- _wtoi (Address: 0x18010b2f0)
- _wtoi64 (Address: 0x18010b2e8)
- _XcptFilter (Address: 0x18010b398)
- ??0exception@@QEAA@AEBQEBD@Z (Address: 0x18010b448)
- ??0exception@@QEAA@AEBQEBDH@Z (Address: 0x18010b3b0)
- ??0exception@@QEAA@AEBV0@@Z (Address: 0x18010b3c8)
- ??0exception@@QEAA@XZ (Address: 0x18010b3d0)
- ??1exception@@UEAA@XZ (Address: 0x18010b3e0)
- ??1type_info@@UEAA@XZ (Address: 0x18010b358)
- ?terminate@@YAXXZ (Address: 0x18010b380)
- ?what@exception@@UEBAPEBDXZ (Address: 0x18010b3a8)
- free (Address: 0x18010b408)
- iswdigit (Address: 0x18010b310)
- malloc (Address: 0x18010b3f0)
- memcmp (Address: 0x18010b320)
- memcpy (Address: 0x18010b340)
- memcpy_s (Address: 0x18010b3e8)
- memmove (Address: 0x18010b348)
- memmove_s (Address: 0x18010b300)
- memset (Address: 0x18010b350)
- qsort (Address: 0x18010b330)
- realloc (Address: 0x18010b428)
- swscanf (Address: 0x18010b328)
- tolower (Address: 0x18010b308)
- towlower (Address: 0x18010b2e0)
- towupper (Address: 0x18010b3f8)
- wcscat_s (Address: 0x18010b420)
- wcschr (Address: 0x18010b2c8)
- wcscmp (Address: 0x18010b450)
- wcsncmp (Address: 0x18010b2a0)
- wcspbrk (Address: 0x18010b2c0)
- wcsrchr (Address: 0x18010b2b8)
- wcsstr (Address: 0x18010b338)
- wcstok (Address: 0x18010b2a8)
- wcstoul (Address: 0x18010b2f8)
ntdll.dll
- EtwGetTraceEnableFlags (Address: 0x18010b4e0)
- EtwGetTraceEnableLevel (Address: 0x18010b4d0)
- EtwGetTraceLoggerHandle (Address: 0x18010b4d8)
- EtwRegisterTraceGuidsW (Address: 0x18010b4b8)
- EtwTraceMessage (Address: 0x18010b528)
- EtwUnregisterTraceGuids (Address: 0x18010b4e8)
- NtClose (Address: 0x18010b518)
- NtCreateFile (Address: 0x18010b4f8)
- NtFsControlFile (Address: 0x18010b510)
- NtOpenDirectoryObject (Address: 0x18010b468)
- NtOpenKey (Address: 0x18010b4a8)
- NtOpenSymbolicLinkObject (Address: 0x18010b478)
- NtQueryDirectoryObject (Address: 0x18010b460)
- NtQueryInformationFile (Address: 0x18010b508)
- NtQuerySymbolicLinkObject (Address: 0x18010b470)
- NtQuerySystemInformation (Address: 0x18010b490)
- NtQueryValueKey (Address: 0x18010b4b0)
- NtQueryVolumeInformationFile (Address: 0x18010b4f0)
- RtlAdjustPrivilege (Address: 0x18010b480)
- RtlFormatCurrentUserKeyPath (Address: 0x18010b498)
- RtlFreeUnicodeString (Address: 0x18010b4a0)
- RtlGetSetBootStatusData (Address: 0x18010b530)
- RtlInitUnicodeString (Address: 0x18010b520)
- RtlIpv4StringToAddressW (Address: 0x18010b4c0)
- RtlIpv6StringToAddressW (Address: 0x18010b4c8)
- RtlNtStatusToDosError (Address: 0x18010b500)
- RtlUnlockBootStatusData (Address: 0x18010b488)
RPCRT4.dll
- RpcStringFreeW (Address: 0x18010ac10)
- UuidCreate (Address: 0x18010ac08)
- UuidFromStringW (Address: 0x18010abf8)
- UuidToStringW (Address: 0x18010ac00)
VssTrace.DLL
- (Address: 0x18010ac20)
- (Address: 0x18010ac28)
- (Address: 0x18010ac30)
- (Address: 0x18010ac38)
- (Address: 0x18010ac40)
- (Address: 0x18010ac48)
- (Address: 0x18010ac50)
- (Address: 0x18010ac58)
- (Address: 0x18010ac60)
- (Address: 0x18010ac68)
- (Address: 0x18010ac70)
WS2_32.dll
- GetNameInfoW (Address: 0x18010ac80)
- InetPtonW (Address: 0x18010ac88)
- WSAStartup (Address: 0x18010ac90)