wimgapi.dll

Description: Windows Imaging Library

Version: 10.0.19041.5553

Architecture: 64-bit

Operating System: Windows NT

SHA256: 2ac1612d878f71ba90a63f8f0fe00d87

File Size: 747.9 KB

Uploaded At: Dec. 1, 2025, 7:42 a.m.

Views: 6

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

DllCanUnloadNow (Ordinal: 1, Address: 0x1050)
DllMain (Ordinal: 2, Address: 0x1010)
WIMAddImagePath (Ordinal: 3, Address: 0x1e20)
WIMAddImagePaths (Ordinal: 4, Address: 0x2530)
WIMAddWimbootEntry (Ordinal: 5, Address: 0x2ef0)
WIMApplyImage (Ordinal: 6, Address: 0x52f0)
WIMCaptureImage (Ordinal: 7, Address: 0x9ba0)
WIMCloseHandle (Ordinal: 8, Address: 0xaeb0)
WIMCommitImageHandle (Ordinal: 9, Address: 0xf7b0)
WIMCopyFile (Ordinal: 10, Address: 0x12290)
WIMCreateFile (Ordinal: 11, Address: 0xa220)
WIMCreateImageFile (Ordinal: 12, Address: 0x17250)
WIMCreateWofCompressedFile (Ordinal: 13, Address: 0x5560)
WIMDeleteImage (Ordinal: 14, Address: 0x17e60)
WIMDeleteImageMounts (Ordinal: 15, Address: 0xe410)
WIMEnumImageFiles (Ordinal: 16, Address: 0x17020)
WIMExportImage (Ordinal: 17, Address: 0x18ec0)
WIMExtractImageDirectory (Ordinal: 18, Address: 0x1a4b0)
WIMExtractImagePath (Ordinal: 19, Address: 0x19ca0)
WIMFindFirstImageFile (Ordinal: 20, Address: 0x16bf0)
WIMFindNextImageFile (Ordinal: 21, Address: 0x16ea0)
WIMGetAttributes (Ordinal: 22, Address: 0xb5f0)
WIMGetImageCount (Ordinal: 23, Address: 0xb5a0)
WIMGetImageInformation (Ordinal: 24, Address: 0x1c690)
WIMGetMessageCallbackCount (Ordinal: 25, Address: 0x1dda0)
WIMGetMountedImageHandle (Ordinal: 26, Address: 0x11cc0)
WIMGetMountedImageInfo (Ordinal: 27, Address: 0x116c0)
WIMGetMountedImageInfoFromHandle (Ordinal: 28, Address: 0x11940)
WIMGetMountedImages (Ordinal: 29, Address: 0x11c00)
WIMGetWIMBootEntries (Ordinal: 30, Address: 0x2d10)
WIMGetWIMBootWIMPath (Ordinal: 31, Address: 0x2950)
WIMInitFileIOCallbacks (Ordinal: 32, Address: 0x1f140)
WIMInitializeWofDriver (Ordinal: 33, Address: 0x3f20)
WIMIsCurrentSystemWimboot (Ordinal: 34, Address: 0x30a0)
WIMIsReferenceWim (Ordinal: 35, Address: 0x17870)
WIMLoadImage (Ordinal: 36, Address: 0x1f640)
WIMMountImage (Ordinal: 37, Address: 0x104b0)
WIMMountImageHandle (Ordinal: 38, Address: 0xe900)
WIMProcessCustomImage (Ordinal: 39, Address: 0x25ff0)
WIMReadFileEx (Ordinal: 40, Address: 0xba20)
WIMReadImageFile (Ordinal: 41, Address: 0x16070)
WIMRedirectFolderBeforeApply (Ordinal: 42, Address: 0x5220)
WIMRegisterLogFile (Ordinal: 43, Address: 0x28400)
WIMRegisterMessageCallback (Ordinal: 44, Address: 0x1de30)
WIMRemountImage (Ordinal: 45, Address: 0x10760)
WIMSetBootImage (Ordinal: 46, Address: 0xb070)
WIMSetFileIOCallbackTemporaryPath (Ordinal: 47, Address: 0x1f1a0)
WIMSetImageInformation (Ordinal: 48, Address: 0x1c9b0)
WIMSetImageUserSpecifiedCreationTime (Ordinal: 49, Address: 0x9e80)
WIMSetReferenceFile (Ordinal: 50, Address: 0xb330)
WIMSetTemporaryPath (Ordinal: 51, Address: 0xaf70)
WIMSetWimGuid (Ordinal: 52, Address: 0x9e30)
WIMSingleInstanceFile (Ordinal: 53, Address: 0x17420)
WIMSplitFile (Ordinal: 54, Address: 0x297e0)
WIMUnmountImage (Ordinal: 55, Address: 0x10c30)
WIMUnmountImageHandle (Ordinal: 56, Address: 0xffa0)
WIMUnregisterLogFile (Ordinal: 57, Address: 0x28650)
WIMUnregisterMessageCallback (Ordinal: 58, Address: 0x1dfb0)
WIMUpdateWIMBootEntry (Ordinal: 59, Address: 0x2b90)
WIMWriteFileWithIntegrity (Ordinal: 60, Address: 0x159b0)

Imported DLLs & Functions

api-ms-win-core-apiquery-l1-1-0.dll

ApiSetQueryApiSetPresence (Address: 0x180095f90)

api-ms-win-core-delayload-l1-1-0.dll

DelayLoadFailureHook (Address: 0x180095fa0)

api-ms-win-core-delayload-l1-1-1.dll

ResolveDelayLoadedAPI (Address: 0x180095fb0)

api-ms-win-core-errorhandling-l1-1-0.dll

GetLastError (Address: 0x180095fd8)
SetLastError (Address: 0x180095fc0)
SetUnhandledExceptionFilter (Address: 0x180095fd0)
UnhandledExceptionFilter (Address: 0x180095fc8)

api-ms-win-core-file-l1-1-0.dll

CreateDirectoryW (Address: 0x1800960a8)
CreateFileW (Address: 0x180096000)
DeleteFileW (Address: 0x1800960d0)
FindClose (Address: 0x180096058)
FindFirstFileW (Address: 0x180096028)
FindNextFileW (Address: 0x180096048)
FlushFileBuffers (Address: 0x1800960a0)
GetDriveTypeW (Address: 0x180095fe8)
GetFileAttributesW (Address: 0x1800960c8)
GetFileInformationByHandle (Address: 0x180095ff8)
GetFileSize (Address: 0x180096068)
GetFileSizeEx (Address: 0x180096098)
GetFinalPathNameByHandleW (Address: 0x1800960c0)
GetFullPathNameW (Address: 0x1800960d8)
GetLogicalDriveStringsW (Address: 0x180096090)
GetLongPathNameW (Address: 0x180096020)
GetTempFileNameW (Address: 0x180096060)
GetVolumeInformationByHandleW (Address: 0x1800960b0)
GetVolumeInformationW (Address: 0x1800960e0)
GetVolumePathNameW (Address: 0x180096008)
LocalFileTimeToFileTime (Address: 0x180096040)
LockFileEx (Address: 0x180096088)
ReadFile (Address: 0x180096080)
RemoveDirectoryW (Address: 0x180096010)
SetEndOfFile (Address: 0x180096018)
SetFileAttributesW (Address: 0x1800960b8)
SetFileInformationByHandle (Address: 0x180096050)
SetFilePointer (Address: 0x180096070)
SetFilePointerEx (Address: 0x180096030)
SetFileTime (Address: 0x180096038)
UnlockFileEx (Address: 0x180095ff0)
WriteFile (Address: 0x180096078)

api-ms-win-core-file-l1-2-0.dll

GetTempPathW (Address: 0x1800960f8)
GetVolumeNameForVolumeMountPointW (Address: 0x1800960f0)
GetVolumePathNamesForVolumeNameW (Address: 0x180096100)

api-ms-win-core-file-l2-1-0.dll

CopyFileExW (Address: 0x180096118)
GetFileInformationByHandleEx (Address: 0x180096110)

api-ms-win-core-handle-l1-1-0.dll

CloseHandle (Address: 0x180096130)
DuplicateHandle (Address: 0x180096128)
GetHandleInformation (Address: 0x180096138)

api-ms-win-core-heap-l1-1-0.dll

GetProcessHeap (Address: 0x180096148)
HeapAlloc (Address: 0x180096150)
HeapFree (Address: 0x180096158)
HeapReAlloc (Address: 0x180096160)

api-ms-win-core-heap-l2-1-0.dll

LocalAlloc (Address: 0x180096178)
LocalFree (Address: 0x180096170)

api-ms-win-core-io-l1-1-0.dll

DeviceIoControl (Address: 0x180096190)
GetOverlappedResult (Address: 0x180096188)

api-ms-win-core-kernel32-legacy-l1-1-0.dll

DosDateTimeToFileTime (Address: 0x1800961a0)

api-ms-win-core-libraryloader-l1-2-0.dll

DisableThreadLibraryCalls (Address: 0x1800961b8)
FreeLibrary (Address: 0x1800961c8)
GetModuleFileNameW (Address: 0x1800961c0)
GetModuleHandleExW (Address: 0x1800961b0)
GetModuleHandleW (Address: 0x1800961d0)
GetProcAddress (Address: 0x1800961d8)
LoadLibraryExW (Address: 0x1800961e0)

api-ms-win-core-libraryloader-l1-2-1.dll

LoadLibraryW (Address: 0x1800961f0)

api-ms-win-core-localization-l1-2-0.dll

FormatMessageW (Address: 0x180096200)

api-ms-win-core-memory-l1-1-0.dll

CreateFileMappingW (Address: 0x180096210)
MapViewOfFile (Address: 0x180096220)
UnmapViewOfFile (Address: 0x180096218)

api-ms-win-core-privateprofile-l1-1-0.dll

GetPrivateProfileSectionW (Address: 0x180096230)

api-ms-win-core-processenvironment-l1-1-0.dll

ExpandEnvironmentStringsW (Address: 0x180096248)
GetCurrentDirectoryW (Address: 0x180096240)
GetEnvironmentVariableW (Address: 0x180096250)

api-ms-win-core-processthreads-l1-1-0.dll

CreateProcessW (Address: 0x180096260)
CreateThread (Address: 0x1800962c0)
GetCurrentProcess (Address: 0x1800962a8)
GetCurrentProcessId (Address: 0x180096278)
GetCurrentThread (Address: 0x1800962c8)
GetCurrentThreadId (Address: 0x1800962b8)
GetExitCodeProcess (Address: 0x180096268)
OpenProcessToken (Address: 0x1800962a0)
OpenThreadToken (Address: 0x180096298)
SetThreadToken (Address: 0x180096270)
TerminateProcess (Address: 0x1800962d0)
TlsAlloc (Address: 0x1800962b0)
TlsFree (Address: 0x180096290)
TlsGetValue (Address: 0x180096288)
TlsSetValue (Address: 0x180096280)

api-ms-win-core-processthreads-l1-1-1.dll

OpenProcess (Address: 0x1800962e0)

api-ms-win-core-processthreads-l1-1-3.dll

SetThreadIdealProcessor (Address: 0x1800962f0)

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter (Address: 0x180096300)

api-ms-win-core-registry-l1-1-0.dll

RegCloseKey (Address: 0x180096328)
RegCreateKeyExW (Address: 0x180096360)
RegDeleteKeyExW (Address: 0x180096310)
RegDeleteValueW (Address: 0x180096368)
RegEnumKeyExW (Address: 0x180096350)
RegEnumValueW (Address: 0x180096338)
RegFlushKey (Address: 0x180096348)
RegLoadKeyW (Address: 0x180096358)
RegOpenKeyExW (Address: 0x180096320)
RegQueryInfoKeyW (Address: 0x180096340)
RegQueryValueExW (Address: 0x180096330)
RegSetValueExW (Address: 0x180096370)
RegUnLoadKeyW (Address: 0x180096318)

api-ms-win-core-string-l1-1-0.dll

CompareStringW (Address: 0x180096388)
MultiByteToWideChar (Address: 0x180096390)
WideCharToMultiByte (Address: 0x180096380)

api-ms-win-core-string-l2-1-0.dll

CharUpperW (Address: 0x1800963a0)

api-ms-win-core-synch-l1-1-0.dll

CreateEventW (Address: 0x180096410)
CreateMutexW (Address: 0x1800963b0)
CreateSemaphoreExW (Address: 0x1800963d0)
DeleteCriticalSection (Address: 0x1800963c8)
EnterCriticalSection (Address: 0x1800963f0)
InitializeCriticalSection (Address: 0x1800963e0)
InitializeCriticalSectionAndSpinCount (Address: 0x180096420)
LeaveCriticalSection (Address: 0x180096418)
OpenEventW (Address: 0x1800963f8)
ReleaseMutex (Address: 0x1800963e8)
ReleaseSemaphore (Address: 0x180096400)
ResetEvent (Address: 0x1800963b8)
SetEvent (Address: 0x180096408)
WaitForMultipleObjectsEx (Address: 0x1800963c0)
WaitForSingleObject (Address: 0x1800963d8)

api-ms-win-core-synch-l1-2-0.dll

Sleep (Address: 0x180096430)

api-ms-win-core-synch-l1-2-1.dll

CreateSemaphoreW (Address: 0x180096448)
WaitForMultipleObjects (Address: 0x180096440)

api-ms-win-core-sysinfo-l1-1-0.dll

GetSystemDirectoryW (Address: 0x180096468)
GetSystemInfo (Address: 0x180096478)
GetSystemTimeAsFileTime (Address: 0x180096458)
GetTickCount (Address: 0x180096470)
GlobalMemoryStatusEx (Address: 0x180096460)

api-ms-win-core-version-l1-1-0.dll

GetFileVersionInfoExW (Address: 0x180096490)
GetFileVersionInfoSizeExW (Address: 0x180096498)
VerQueryValueW (Address: 0x180096488)

api-ms-win-core-wow64-l1-1-0.dll

Wow64DisableWow64FsRedirection (Address: 0x1800964a8)
Wow64RevertWow64FsRedirection (Address: 0x1800964b0)

api-ms-win-security-base-l1-1-0.dll

AddAccessAllowedAce (Address: 0x1800964e0)
AddAccessAllowedAceEx (Address: 0x180096530)
AdjustTokenPrivileges (Address: 0x180096548)
AllocateAndInitializeSid (Address: 0x1800964d8)
EqualSid (Address: 0x1800964e8)
FreeSid (Address: 0x1800964f8)
GetAclInformation (Address: 0x1800964c0)
GetLengthSid (Address: 0x1800964d0)
GetSecurityDescriptorControl (Address: 0x180096510)
GetSecurityDescriptorDacl (Address: 0x180096520)
GetSecurityDescriptorGroup (Address: 0x180096528)
GetSecurityDescriptorLength (Address: 0x180096500)
GetSecurityDescriptorOwner (Address: 0x180096540)
GetSecurityDescriptorSacl (Address: 0x180096518)
GetTokenInformation (Address: 0x1800964c8)
InitializeAcl (Address: 0x180096508)
InitializeSecurityDescriptor (Address: 0x1800964f0)
RevertToSelf (Address: 0x180096538)
SetSecurityDescriptorDacl (Address: 0x180096550)

bcrypt.dll

BCryptCloseAlgorithmProvider (Address: 0x180096590)
BCryptCreateHash (Address: 0x180096570)
BCryptDestroyHash (Address: 0x180096588)
BCryptFinishHash (Address: 0x180096580)
BCryptGetProperty (Address: 0x180096568)
BCryptHashData (Address: 0x180096578)
BCryptOpenAlgorithmProvider (Address: 0x180096560)

msvcrt.dll

__C_specific_handler (Address: 0x180096688)
__dllonexit (Address: 0x180096670)
_amsg_exit (Address: 0x1800966e0)
_callnewh (Address: 0x1800966c0)
_initterm (Address: 0x180096698)
_lock (Address: 0x180096680)
_onexit (Address: 0x180096668)
_purecall (Address: 0x1800966a0)
_strnicmp (Address: 0x180096608)
_unlock (Address: 0x180096678)
_vscwprintf (Address: 0x180096648)
_vsnwprintf (Address: 0x1800965c8)
_wcsicmp (Address: 0x1800965f0)
_wcslwr (Address: 0x1800966d0)
_wcsnicmp (Address: 0x1800965a8)
_wcsrev (Address: 0x180096630)
_wcstoi64 (Address: 0x180096638)
_wcsupr (Address: 0x180096620)
_wtoi (Address: 0x1800965d0)
_XcptFilter (Address: 0x1800966e8)
bsearch (Address: 0x1800966b0)
free (Address: 0x1800966c8)
iswspace (Address: 0x180096690)
malloc (Address: 0x1800966b8)
memcmp (Address: 0x180096650)
memcpy (Address: 0x180096658)
memcpy_s (Address: 0x180096600)
memmove (Address: 0x180096660)
memmove_s (Address: 0x1800966a8)
memset (Address: 0x1800966f0)
qsort (Address: 0x1800966d8)
strcpy_s (Address: 0x180096640)
strncpy_s (Address: 0x1800965f8)
swscanf_s (Address: 0x1800965e0)
towlower (Address: 0x180096618)
towupper (Address: 0x180096610)
wcschr (Address: 0x180096628)
wcsncmp (Address: 0x1800965a0)
wcsnlen (Address: 0x1800965b0)
wcsrchr (Address: 0x1800965e8)
wcsstr (Address: 0x1800965b8)
wcstok_s (Address: 0x1800965d8)
wcstoul (Address: 0x1800965c0)

ntdll.dll

DbgPrintEx (Address: 0x180096700)
NtClose (Address: 0x180096800)
NtCreateFile (Address: 0x1800967a8)
NtOpenFile (Address: 0x180096818)
NtQueryDirectoryFile (Address: 0x180096808)
NtQueryEaFile (Address: 0x1800967b0)
NtQueryInformationFile (Address: 0x1800967e0)
NtQueryInformationProcess (Address: 0x1800967b8)
NtQuerySecurityObject (Address: 0x180096788)
NtQueryVolumeInformationFile (Address: 0x1800967a0)
NtSetEaFile (Address: 0x180096760)
NtSetInformationFile (Address: 0x1800967e8)
NtSetSecurityObject (Address: 0x1800967c0)
NtUnloadKey2 (Address: 0x180096780)
NtYieldExecution (Address: 0x180096708)
RtlAcquireResourceExclusive (Address: 0x180096750)
RtlAcquireResourceShared (Address: 0x180096748)
RtlAdjustPrivilege (Address: 0x180096828)
RtlAllocateHeap (Address: 0x180096810)
RtlCaptureContext (Address: 0x180096850)
RtlCompressBuffer (Address: 0x180096778)
RtlDeleteResource (Address: 0x180096738)
RtlDosPathNameToNtPathName_U (Address: 0x180096820)
RtlDosPathNameToNtPathName_U_WithStatus (Address: 0x180096730)
RtlDowncaseUnicodeChar (Address: 0x180096770)
RtlFindAceByType (Address: 0x1800967c8)
RtlFreeHeap (Address: 0x1800967f8)
RtlGetCompressionWorkSpaceSize (Address: 0x180096838)
RtlGetLastNtStatus (Address: 0x1800967d8)
RtlGetPersistedStateLocation (Address: 0x180096768)
RtlGetVersion (Address: 0x180096728)
RtlImpersonateSelf (Address: 0x180096798)
RtlInitializeCriticalSection (Address: 0x180096718)
RtlInitializeResource (Address: 0x180096758)
RtlInitUnicodeString (Address: 0x180096790)
RtlLookupFunctionEntry (Address: 0x180096848)
RtlNtStatusToDosError (Address: 0x180096830)
RtlRaiseStatus (Address: 0x180096710)
RtlReAllocateHeap (Address: 0x180096720)
RtlReleaseResource (Address: 0x180096740)
RtlSetControlSecurityDescriptor (Address: 0x1800967d0)
RtlSetIoCompletionCallback (Address: 0x1800967f0)
RtlVirtualUnwind (Address: 0x180096840)

RPCRT4.dll

I_RpcMapWin32Status (Address: 0x180095f38)
NdrClientCall3 (Address: 0x180095f50)
RpcBindingFree (Address: 0x180095f78)
RpcBindingFromStringBindingW (Address: 0x180095f68)
RpcBindingSetAuthInfoW (Address: 0x180095f70)
RpcStringBindingComposeW (Address: 0x180095f60)
RpcStringFreeW (Address: 0x180095f40)
UuidCreate (Address: 0x180095f80)
UuidFromStringW (Address: 0x180095f48)
UuidToStringW (Address: 0x180095f58)