werui.dll
Description: Windows Error Reporting UI DLL
Authors: © Microsoft Corporation. All rights reserved.
Version: 10.0.19041.5794
Architecture: 64-bit
Operating System: Windows NT
SHA256: eb5945abca19047b8963959ff31e4e46
File Size: 250.0 KB
Uploaded At: Dec. 1, 2025, 7:42 a.m.
Views: 4
Security Warning
This file has been flagged as potentially dangerous.
Reason: Detected potentially dangerous functions used for process injection: OpenProcess
Exported Functions
- WerUIReportSilentProcessExit (Ordinal: 1, Address: 0xb890)
- WerUICreate (Ordinal: 2, Address: 0x2310)
- WerUIDelete (Ordinal: 3, Address: 0x2430)
- WerUIGetUserSelection (Ordinal: 4, Address: 0x2500)
- WerUIPromptForSecondLevel (Ordinal: 5, Address: 0x2570)
- WerUIPromptUser (Ordinal: 6, Address: 0x2840)
- WerUIShowUpsell (Ordinal: 7, Address: 0x27e0)
- WerUIStart (Ordinal: 8, Address: 0x2490)
- WerUITerminate (Ordinal: 9, Address: 0x25e0)
- WerUIUpdateStateProgress (Ordinal: 10, Address: 0x2740)
- WerUIUpdateUIForState (Ordinal: 11, Address: 0x26a0)
- WerUIWaitForUserAction (Ordinal: 12, Address: 0x2640)
- WerUIpCheckWindow (Ordinal: 13, Address: 0x2050)
- WerUIpDefSubclassProc (Ordinal: 14, Address: 0x2270)
- WerUIpHeadlessOrImersive (Ordinal: 15, Address: 0x2220)
- WerUIpRemoveWindowSubclass (Ordinal: 16, Address: 0x22f0)
- WerUIpSetWindowSubclass (Ordinal: 17, Address: 0x2290)
- WerUIpTaskDialogIndirect (Ordinal: 18, Address: 0x22d0)
- WerUIpUIHandleWERWindowMsg (Ordinal: 19, Address: 0x2210)
Imported DLLs & Functions
api-ms-win-core-apiquery-l1-1-0.dll
- ApiSetQueryApiSetPresence (Address: 0x18001fae0)
api-ms-win-core-console-l1-2-0.dll
- AttachConsole (Address: 0x18001faf8)
- FreeConsole (Address: 0x18001faf0)
api-ms-win-core-console-l3-2-0.dll
- GetConsoleWindow (Address: 0x18001fb08)
api-ms-win-core-debug-l1-1-0.dll
- DebugBreak (Address: 0x18001fb18)
- IsDebuggerPresent (Address: 0x18001fb20)
- OutputDebugStringW (Address: 0x18001fb28)
api-ms-win-core-delayload-l1-1-0.dll
- DelayLoadFailureHook (Address: 0x18001fb38)
api-ms-win-core-delayload-l1-1-1.dll
- ResolveDelayLoadedAPI (Address: 0x18001fb48)
api-ms-win-core-errorhandling-l1-1-0.dll
- GetLastError (Address: 0x18001fb70)
- SetLastError (Address: 0x18001fb68)
- SetUnhandledExceptionFilter (Address: 0x18001fb58)
- UnhandledExceptionFilter (Address: 0x18001fb60)
api-ms-win-core-file-l1-1-0.dll
- CompareFileTime (Address: 0x18001fba8)
- CreateFileW (Address: 0x18001fba0)
- FindClose (Address: 0x18001fbb8)
- FindFirstFileExW (Address: 0x18001fbc0)
- FindFirstFileW (Address: 0x18001fbc8)
- FindNextFileW (Address: 0x18001fbb0)
- GetFileAttributesW (Address: 0x18001fb80)
- GetFinalPathNameByHandleW (Address: 0x18001fb90)
- GetLongPathNameW (Address: 0x18001fb88)
- SetFileInformationByHandle (Address: 0x18001fb98)
api-ms-win-core-handle-l1-1-0.dll
- CloseHandle (Address: 0x18001fbe0)
- DuplicateHandle (Address: 0x18001fbd8)
api-ms-win-core-heap-l1-1-0.dll
- GetProcessHeap (Address: 0x18001fc00)
- HeapAlloc (Address: 0x18001fbf0)
- HeapFree (Address: 0x18001fbf8)
api-ms-win-core-heap-l2-1-0.dll
- LocalAlloc (Address: 0x18001fc10)
api-ms-win-core-io-l1-1-0.dll
- DeviceIoControl (Address: 0x18001fc20)
api-ms-win-core-libraryloader-l1-2-0.dll
- DisableThreadLibraryCalls (Address: 0x18001fc58)
- FreeLibrary (Address: 0x18001fc38)
- FreeLibraryAndExitThread (Address: 0x18001fc40)
- GetModuleFileNameA (Address: 0x18001fc60)
- GetModuleHandleExW (Address: 0x18001fc30)
- GetModuleHandleW (Address: 0x18001fc50)
- GetProcAddress (Address: 0x18001fc68)
- LoadLibraryExW (Address: 0x18001fc48)
api-ms-win-core-libraryloader-l1-2-1.dll
- LoadLibraryW (Address: 0x18001fc78)
api-ms-win-core-localization-l1-2-0.dll
- FormatMessageW (Address: 0x18001fc90)
- GetThreadUILanguage (Address: 0x18001fc88)
api-ms-win-core-memory-l1-1-0.dll
- CreateFileMappingW (Address: 0x18001fca8)
- MapViewOfFile (Address: 0x18001fca0)
- UnmapViewOfFile (Address: 0x18001fcb0)
api-ms-win-core-processenvironment-l1-1-0.dll
- ExpandEnvironmentStringsW (Address: 0x18001fcc0)
api-ms-win-core-processthreads-l1-1-0.dll
- CreateProcessW (Address: 0x18001fcd0)
- CreateThread (Address: 0x18001fce0)
- GetCurrentProcess (Address: 0x18001fd18)
- GetCurrentProcessId (Address: 0x18001fd08)
- GetCurrentThreadId (Address: 0x18001fcf8)
- GetExitCodeThread (Address: 0x18001fcf0)
- GetProcessId (Address: 0x18001fd10)
- GetProcessTimes (Address: 0x18001fce8)
- OpenProcessToken (Address: 0x18001fcd8)
- OpenThread (Address: 0x18001fd20)
- TerminateProcess (Address: 0x18001fd00)
api-ms-win-core-processthreads-l1-1-1.dll
- GetThreadContext (Address: 0x18001fd38)
- OpenProcess (Address: 0x18001fd30)
api-ms-win-core-profile-l1-1-0.dll
- QueryPerformanceCounter (Address: 0x18001fd48)
api-ms-win-core-psapi-l1-1-0.dll
- QueryFullProcessImageNameW (Address: 0x18001fd58)
api-ms-win-core-registry-l1-1-0.dll
- RegCloseKey (Address: 0x18001fd80)
- RegCreateKeyExW (Address: 0x18001fd68)
- RegEnumKeyExW (Address: 0x18001fda0)
- RegGetValueW (Address: 0x18001fd90)
- RegOpenKeyExW (Address: 0x18001fd88)
- RegQueryInfoKeyW (Address: 0x18001fd98)
- RegQueryValueExW (Address: 0x18001fd70)
- RegSetValueExW (Address: 0x18001fd78)
api-ms-win-core-rtlsupport-l1-1-0.dll
- RtlCaptureContext (Address: 0x18001fdb0)
- RtlLookupFunctionEntry (Address: 0x18001fdc0)
- RtlVirtualUnwind (Address: 0x18001fdb8)
api-ms-win-core-sidebyside-l1-1-0.dll
- ActivateActCtx (Address: 0x18001fdd8)
- CreateActCtxW (Address: 0x18001fdd0)
- DeactivateActCtx (Address: 0x18001fde8)
- ReleaseActCtx (Address: 0x18001fde0)
api-ms-win-core-string-l1-1-0.dll
- CompareStringW (Address: 0x18001fe00)
- MultiByteToWideChar (Address: 0x18001fdf8)
api-ms-win-core-synch-l1-1-0.dll
- AcquireSRWLockExclusive (Address: 0x18001fe40)
- AcquireSRWLockShared (Address: 0x18001fe60)
- CreateEventW (Address: 0x18001fe68)
- CreateMutexExW (Address: 0x18001fe28)
- CreateSemaphoreExW (Address: 0x18001fe88)
- DeleteCriticalSection (Address: 0x18001fe98)
- EnterCriticalSection (Address: 0x18001fe80)
- InitializeCriticalSectionAndSpinCount (Address: 0x18001fe70)
- InitializeCriticalSectionEx (Address: 0x18001fe90)
- LeaveCriticalSection (Address: 0x18001fe58)
- OpenSemaphoreW (Address: 0x18001fe20)
- ReleaseMutex (Address: 0x18001fea0)
- ReleaseSemaphore (Address: 0x18001fe78)
- ReleaseSRWLockExclusive (Address: 0x18001fe48)
- ReleaseSRWLockShared (Address: 0x18001fe10)
- ResetEvent (Address: 0x18001fea8)
- SetEvent (Address: 0x18001fe50)
- WaitForMultipleObjectsEx (Address: 0x18001fe38)
- WaitForSingleObject (Address: 0x18001fe30)
- WaitForSingleObjectEx (Address: 0x18001fe18)
api-ms-win-core-synch-l1-2-0.dll
- InitOnceBeginInitialize (Address: 0x18001feb8)
- InitOnceComplete (Address: 0x18001fec0)
- Sleep (Address: 0x18001fec8)
api-ms-win-core-synch-l1-2-1.dll
- WaitForMultipleObjects (Address: 0x18001fed8)
api-ms-win-core-sysinfo-l1-1-0.dll
- GetSystemDirectoryW (Address: 0x18001fee8)
- GetSystemTimeAsFileTime (Address: 0x18001fef8)
- GetTickCount (Address: 0x18001ff00)
- GetTickCount64 (Address: 0x18001fef0)
api-ms-win-core-threadpool-l1-2-0.dll
- CloseThreadpoolTimer (Address: 0x18001ff18)
- CreateThreadpoolTimer (Address: 0x18001ff20)
- SetThreadpoolTimer (Address: 0x18001ff28)
- WaitForThreadpoolTimerCallbacks (Address: 0x18001ff10)
api-ms-win-core-wow64-l1-1-0.dll
- IsWow64Process (Address: 0x18001ff38)
api-ms-win-eventing-provider-l1-1-0.dll
- EventProviderEnabled (Address: 0x18001ff50)
- EventRegister (Address: 0x18001ff48)
- EventSetInformation (Address: 0x18001ff68)
- EventUnregister (Address: 0x18001ff58)
- EventWriteTransfer (Address: 0x18001ff60)
api-ms-win-eventlog-legacy-l1-1-0.dll
- DeregisterEventSource (Address: 0x18001ff78)
- RegisterEventSourceW (Address: 0x18001ff88)
- ReportEventW (Address: 0x18001ff80)
api-ms-win-security-base-l1-1-0.dll
- CopySid (Address: 0x18001ffa0)
- GetLengthSid (Address: 0x18001ff98)
- GetSidSubAuthority (Address: 0x18001ffb0)
- GetSidSubAuthorityCount (Address: 0x18001ffb8)
- GetTokenInformation (Address: 0x18001ffc0)
- IsValidSid (Address: 0x18001ffa8)
COMCTL32.dll
- (Address: 0x18001f5e8)
- (Address: 0x18001f5f0)
- (Address: 0x18001f5f8)
- (Address: 0x18001f600)
dbghelp.dll
- MiniDumpWriteDump (Address: 0x18001ffd0)
- StackWalk64 (Address: 0x18001ffd8)
- SymCleanup (Address: 0x180020000)
- SymFunctionTableAccess64 (Address: 0x18001fff8)
- SymGetModuleBase64 (Address: 0x18001ffe0)
- SymGetModuleInfoW64 (Address: 0x18001ffe8)
- SymInitialize (Address: 0x18001fff0)
DUI70.dll
- ?_SelfLayoutDoLayout@Element@DirectUI@@MEAAXHH@Z (Address: 0x18001f760)
- ?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MEAA?AUtagSIZE@@HHPEAVSurface@2@@Z (Address: 0x18001f768)
- ??0CCBase@DirectUI@@QEAA@KPEBG@Z (Address: 0x18001f678)
- ??0ClassInfoBase@DirectUI@@QEAA@XZ (Address: 0x18001f660)
- ??0CritSecLock@DirectUI@@QEAA@PEAU_RTL_CRITICAL_SECTION@@@Z (Address: 0x18001f640)
- ??1CCBase@DirectUI@@UEAA@XZ (Address: 0x18001f680)
- ??1ClassInfoBase@DirectUI@@UEAA@XZ (Address: 0x18001f820)
- ??1CritSecLock@DirectUI@@QEAA@XZ (Address: 0x18001f650)
- ?ActivateTooltip@Element@DirectUI@@MEAAXPEAV12@K@Z (Address: 0x18001f788)
- ?Add@Element@DirectUI@@UEAAJPEAPEAV12@I@Z (Address: 0x18001f708)
- ?AddBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z (Address: 0x18001f738)
- ?AddChild@ClassInfoBase@DirectUI@@UEAAXXZ (Address: 0x18001f850)
- ?AddRef@ClassInfoBase@DirectUI@@UEAAXXZ (Address: 0x18001f668)
- ?AssertPIZeroRef@ClassInfoBase@DirectUI@@UEBAXXZ (Address: 0x18001f838)
- ?ClassExist@ClassInfoBase@DirectUI@@SA_NPEAPEAUIClassInfo@2@PEBQEBUPropertyInfo@2@IPEAU32@PEAUHINSTANCE__@@PEBG_N@Z (Address: 0x18001f658)
- ?CreateAccNameLabel@HWNDHost@DirectUI@@IEAAPEAUHWND__@@PEAU3@@Z (Address: 0x18001f8e8)
- ?CreateHWND@CCBase@DirectUI@@UEAAPEAUHWND__@@PEAU3@@Z (Address: 0x18001f8e0)
- ?DefaultAction@CCBase@DirectUI@@UEAAJXZ (Address: 0x18001f7a8)
- ?Destroy@Element@DirectUI@@QEAAJ_N@Z (Address: 0x18001f8a8)
- ?DirectionProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ (Address: 0x18001f7c8)
- ?EndDefer@Element@DirectUI@@QEAAXK@Z (Address: 0x18001f618)
- ?EnsureVisible@Element@DirectUI@@UEAA_NHHHH@Z (Address: 0x18001f728)
- ?EnumPropertyInfo@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z (Address: 0x18001f8a0)
- ?EraseBkgnd@HWNDHost@DirectUI@@MEAA_NPEAUHDC__@@PEA_J@Z (Address: 0x18001f8d8)
- ?GetAccessibleImpl@HWNDHost@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z (Address: 0x18001f7a0)
- ?GetAdjacent@Element@DirectUI@@UEAAPEAV12@PEAV12@HPEBUNavReference@2@K@Z (Address: 0x18001f720)
- ?GetByClassIndex@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z (Address: 0x18001f898)
- ?GetChildren@ClassInfoBase@DirectUI@@UEBAHXZ (Address: 0x18001f840)
- ?GetClassInfoPtr@CCBase@DirectUI@@SAPEAUIClassInfo@2@XZ (Address: 0x18001f880)
- ?GetContentStringAsDisplayed@Element@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z (Address: 0x18001f698)
- ?GetElementProviderImpl@Element@DirectUI@@UEAAJPEAVInvokeHelper@2@PEAPEAVElementProvider@2@@Z (Address: 0x18001f7e0)
- ?GetFactoryLock@Element@DirectUI@@SAPEAU_RTL_CRITICAL_SECTION@@XZ (Address: 0x18001f648)
- ?GetGlobalIndex@ClassInfoBase@DirectUI@@UEBAIXZ (Address: 0x18001f888)
- ?GetHWND@HWNDHost@DirectUI@@UEAAPEAUHWND__@@XZ (Address: 0x18001f918)
- ?GetImmersiveFocusRectOffsets@Element@DirectUI@@UEAAXPEAUtagRECT@@@Z (Address: 0x18001f758)
- ?GetKeyFocused@HWNDHost@DirectUI@@UEAA_NXZ (Address: 0x18001f798)
- ?GetModule@ClassInfoBase@DirectUI@@UEBAPEAUHINSTANCE__@@XZ (Address: 0x18001f860)
- ?GetName@ClassInfoBase@DirectUI@@UEBAPEBGXZ (Address: 0x18001f878)
- ?GetPICount@ClassInfoBase@DirectUI@@UEBAIXZ (Address: 0x18001f890)
- ?GetUIAElementProvider@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z (Address: 0x18001f7d8)
- ?GetUiaFocusDelegate@Element@DirectUI@@UEAAPEAV12@XZ (Address: 0x18001f808)
- ?HandleUiaDestroyListener@Element@DirectUI@@UEAAXXZ (Address: 0x18001f7e8)
- ?HandleUiaEventListener@Element@DirectUI@@UEAAXPEAUEvent@2@@Z (Address: 0x18001f800)
- ?HandleUiaPropertyChangingListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@@Z (Address: 0x18001f7f8)
- ?HandleUiaPropertyListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z (Address: 0x18001f7f0)
- ?Initialize@CCBase@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z (Address: 0x18001f7d0)
- ?Initialize@ClassInfoBase@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG_NPEBQEBUPropertyInfo@2@I@Z (Address: 0x18001f830)
- ?Insert@Element@DirectUI@@UEAAJPEAPEAV12@II@Z (Address: 0x18001f710)
- ?IsContentProtected@Element@DirectUI@@UEAA_NXZ (Address: 0x18001f690)
- ?IsGlobal@ClassInfoBase@DirectUI@@UEBA_NXZ (Address: 0x18001f858)
- ?IsRTLReading@Element@DirectUI@@UEAA_NXZ (Address: 0x18001f688)
- ?IsSubclassOf@ClassInfoBase@DirectUI@@UEBA_NPEAUIClassInfo@2@@Z (Address: 0x18001f868)
- ?IsValidProperty@ClassInfoBase@DirectUI@@UEBA_NPEBUPropertyInfo@2@@Z (Address: 0x18001f870)
- ?MessageCallback@HWNDHost@DirectUI@@UEAAIPEAUtagGMSG@@@Z (Address: 0x18001f748)
- ?OnAdjustWindowSize@HWNDHost@DirectUI@@UEAAHHHI@Z (Address: 0x18001f8f8)
- ?OnCtrlThemeChanged@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z (Address: 0x18001f908)
- ?OnCustomDraw@CCBase@DirectUI@@UEAA_NPEAUtagNMCUSTOMDRAWINFO@@PEA_J@Z (Address: 0x18001f8d0)
- ?OnDestroy@HWNDHost@DirectUI@@UEAAXXZ (Address: 0x18001f6f0)
- ?OnEvent@HWNDHost@DirectUI@@UEAAXPEAUEvent@2@@Z (Address: 0x18001f6f8)
- ?OnGroupChanged@Element@DirectUI@@UEAAXH_N@Z (Address: 0x18001f6c8)
- ?OnHosted@HWNDHost@DirectUI@@MEAAXPEAVElement@2@@Z (Address: 0x18001f770)
- ?OnInput@CCBase@DirectUI@@UEAAXPEAUInputEvent@2@@Z (Address: 0x18001f6d8)
- ?OnInput@Element@DirectUI@@UEAAXPEAUInputEvent@2@@Z (Address: 0x18001f6d0)
- ?OnKeyFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z (Address: 0x18001f6e0)
- ?OnLostDialogFocus@CCBase@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z (Address: 0x18001f8c8)
- ?OnMessage@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z (Address: 0x18001f7b8)
- ?OnMouseFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z (Address: 0x18001f6e8)
- ?OnNotify@CCBase@DirectUI@@UEAA_NI_K_JPEA_J@Z (Address: 0x18001f7c0)
- ?OnPropertyChanged@CCBase@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z (Address: 0x18001f6b8)
- ?OnPropertyChanged@Element@DirectUI@@UEAAXPEAUPropertyInfo@2@HPEAVValue@2@1@Z (Address: 0x18001f6c0)
- ?OnPropertyChanging@Element@DirectUI@@UEAA_NPEAUPropertyInfo@2@HPEAVValue@2@1@Z (Address: 0x18001f6a8)
- ?OnPropertyChanging@Element@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z (Address: 0x18001f6a0)
- ?OnReceivedDialogFocus@CCBase@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z (Address: 0x18001f8c0)
- ?OnSinkThemeChanged@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z (Address: 0x18001f910)
- ?OnSysChar@HWNDHost@DirectUI@@UEAA_NG@Z (Address: 0x18001f8b0)
- ?OnUnHosted@HWNDHost@DirectUI@@MEAAXPEAVElement@2@@Z (Address: 0x18001f778)
- ?OnWindowStyleChanged@HWNDHost@DirectUI@@UEAAX_KPEBUtagSTYLESTRUCT@@@Z (Address: 0x18001f900)
- ?Paint@HWNDHost@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z (Address: 0x18001f700)
- ?PostCreate@CCBase@DirectUI@@MEAAXPEAUHWND__@@@Z (Address: 0x18001f8b8)
- ?QueryInterface@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z (Address: 0x18001f750)
- ?Register@CCBase@DirectUI@@SAJXZ (Address: 0x18001f638)
- ?Register@ClassInfoBase@DirectUI@@QEAAJXZ (Address: 0x18001f828)
- ?Release@ClassInfoBase@DirectUI@@UEAAHXZ (Address: 0x18001f670)
- ?Remove@Element@DirectUI@@UEAAJPEAPEAV12@I@Z (Address: 0x18001f718)
- ?RemoveBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z (Address: 0x18001f740)
- ?RemoveChild@ClassInfoBase@DirectUI@@UEAAXXZ (Address: 0x18001f848)
- ?RemoveTooltip@Element@DirectUI@@MEAAXPEAV12@@Z (Address: 0x18001f790)
- ?SetFontSize@Element@DirectUI@@QEAAJH@Z (Address: 0x18001f630)
- ?SetHeight@Element@DirectUI@@QEAAJH@Z (Address: 0x18001f620)
- ?SetKeyFocus@HWNDHost@DirectUI@@UEAAXXZ (Address: 0x18001f730)
- ?SetWidth@Element@DirectUI@@QEAAJH@Z (Address: 0x18001f628)
- ?SetWindowDirection@HWNDHost@DirectUI@@UEAAXPEAUHWND__@@@Z (Address: 0x18001f8f0)
- ?UpdateTooltip@Element@DirectUI@@MEAAXPEAV12@@Z (Address: 0x18001f780)
- CreateDUIWrapper (Address: 0x18001f610)
- InitProcessPriv (Address: 0x18001f810)
- InitThread (Address: 0x18001f818)
- UnInitProcessPriv (Address: 0x18001f7b0)
- UnInitThread (Address: 0x18001f6b0)
msvcrt.dll
- __C_specific_handler (Address: 0x1800200c0)
- __CxxFrameHandler3 (Address: 0x180020098)
- __dllonexit (Address: 0x180020058)
- _amsg_exit (Address: 0x180020028)
- _callnewh (Address: 0x180020078)
- _CxxThrowException (Address: 0x1800200b0)
- _initterm (Address: 0x1800200c8)
- _lock (Address: 0x1800200b8)
- _onexit (Address: 0x180020050)
- _purecall (Address: 0x180020090)
- _unlock (Address: 0x180020060)
- _XcptFilter (Address: 0x180020068)
- ??0exception@@QEAA@AEBV0@@Z (Address: 0x180020030)
- ??0exception@@QEAA@XZ (Address: 0x180020020)
- ??1exception@@UEAA@XZ (Address: 0x180020038)
- ??1type_info@@UEAA@XZ (Address: 0x180020040)
- ?terminate@@YAXXZ (Address: 0x180020070)
- free (Address: 0x180020018)
- malloc (Address: 0x180020010)
- memcmp (Address: 0x1800200a8)
- memcpy (Address: 0x1800200a0)
- memcpy_s (Address: 0x180020088)
- memmove (Address: 0x180020048)
- memset (Address: 0x1800200d0)
- toupper (Address: 0x180020080)
ntdll.dll
- _vscwprintf (Address: 0x180020150)
- _vsnprintf_s (Address: 0x180020148)
- _vsnwprintf (Address: 0x180020178)
- _wcsicmp (Address: 0x180020188)
- _wcsnicmp (Address: 0x180020170)
- _wtoi (Address: 0x180020180)
- EtwEventWriteNoRegistration (Address: 0x1800200f0)
- EtwGetTraceEnableFlags (Address: 0x1800201b8)
- EtwGetTraceEnableLevel (Address: 0x1800201b0)
- EtwGetTraceLoggerHandle (Address: 0x1800201a8)
- EtwRegisterTraceGuidsW (Address: 0x1800201c0)
- EtwTraceMessage (Address: 0x1800201a0)
- EtwUnregisterTraceGuids (Address: 0x1800201c8)
- memmove_s (Address: 0x180020140)
- NtAlpcConnectPort (Address: 0x180020108)
- NtAlpcSendWaitReceivePort (Address: 0x180020110)
- NtClose (Address: 0x180020128)
- NtOpenEvent (Address: 0x180020138)
- NtQueryInformationToken (Address: 0x180020160)
- NtQueryLicenseValue (Address: 0x180020158)
- NtQuerySystemInformation (Address: 0x180020120)
- NtResumeProcess (Address: 0x180020198)
- NtSuspendProcess (Address: 0x180020190)
- NtWaitForSingleObject (Address: 0x1800200f8)
- RtlAllocateAndInitializeSid (Address: 0x180020100)
- RtlFreeSid (Address: 0x180020118)
- RtlInitUnicodeString (Address: 0x180020168)
- RtlNtStatusToDosError (Address: 0x180020130)
- ZwQueryWnfStateNameInformation (Address: 0x1800200e0)
- ZwUpdateWnfStateData (Address: 0x1800200e8)
SHELL32.dll
- ExtractIconExW (Address: 0x18001f938)
- SHCreateDirectoryExW (Address: 0x18001f940)
- Shell_NotifyIconW (Address: 0x18001f930)
- ShellExecuteExW (Address: 0x18001f928)
USER32.dll
- ChangeDisplaySettingsW (Address: 0x18001fa70)
- ChangeWindowMessageFilter (Address: 0x18001f978)
- CheckWindowThreadDesktop (Address: 0x18001fab8)
- CreateWindowExW (Address: 0x18001fa28)
- DefWindowProcW (Address: 0x18001fa18)
- DestroyIcon (Address: 0x18001f9e0)
- DestroyMenu (Address: 0x18001f9b0)
- DispatchMessageW (Address: 0x18001fa40)
- DrawAnimatedRects (Address: 0x18001fa50)
- EnableMenuItem (Address: 0x18001f9e8)
- EndDialog (Address: 0x18001f9c0)
- EnumWindows (Address: 0x18001fa78)
- FindWindowExW (Address: 0x18001fa58)
- FindWindowW (Address: 0x18001fa68)
- FlashWindowEx (Address: 0x18001f9c8)
- GetClassNameW (Address: 0x18001fac8)
- GetCursorPos (Address: 0x18001f988)
- GetMessageW (Address: 0x18001fa30)
- GetMonitorInfoW (Address: 0x18001f968)
- GetSubMenu (Address: 0x18001f998)
- GetSysColor (Address: 0x18001fad0)
- GetWindow (Address: 0x18001fa60)
- GetWindowBand (Address: 0x18001fab0)
- GetWindowInfo (Address: 0x18001fa88)
- GetWindowLongPtrW (Address: 0x18001fa10)
- GetWindowLongW (Address: 0x18001f9f8)
- GetWindowRect (Address: 0x18001fa98)
- GetWindowTextLengthW (Address: 0x18001f9f0)
- GetWindowThreadProcessId (Address: 0x18001fa90)
- IsHungAppWindow (Address: 0x18001fac0)
- IsWindow (Address: 0x18001faa8)
- IsWindowVisible (Address: 0x18001fa80)
- LoadIconW (Address: 0x18001f9b8)
- LoadMenuW (Address: 0x18001f990)
- LoadStringW (Address: 0x18001fa00)
- MonitorFromRect (Address: 0x18001f960)
- PostMessageW (Address: 0x18001f9d8)
- RegisterClassExW (Address: 0x18001fa20)
- RegisterWindowMessageW (Address: 0x18001f970)
- SendMessageW (Address: 0x18001f950)
- SetForegroundWindow (Address: 0x18001fa48)
- SetMenuDefaultItem (Address: 0x18001f9a0)
- SetParent (Address: 0x18001f958)
- SetWindowLongPtrW (Address: 0x18001fa08)
- SetWindowLongW (Address: 0x18001f9d0)
- SetWindowPos (Address: 0x18001f980)
- ShowWindow (Address: 0x18001faa0)
- TrackPopupMenuEx (Address: 0x18001f9a8)
- TranslateMessage (Address: 0x18001fa38)
wer.dll
- WerpGetDynamicParameter (Address: 0x180020250)
- WerpGetEventType (Address: 0x180020240)
- WerpGetFileByIndex (Address: 0x180020210)
- WerpGetNumFiles (Address: 0x180020218)
- WerpGetNumSigParams (Address: 0x180020238)
- WerpGetReportFlags (Address: 0x180020220)
- WerpGetReportInformation (Address: 0x1800201f8)
- WerpGetReportSettings (Address: 0x1800201d8)
- WerpGetReportType (Address: 0x180020258)
- WerpGetSigParamByIndex (Address: 0x180020248)
- WerpGetUIParamByIndex (Address: 0x180020228)
- WerpIsDisabled (Address: 0x180020230)
- WerpIsTransportAvailable (Address: 0x180020200)
- WerpSetReportFlags (Address: 0x180020208)
- WerReportCloseHandle (Address: 0x1800201e0)
- WerReportCreate (Address: 0x1800201e8)
- WerReportSetUIOption (Address: 0x1800201f0)