wimgapi.dll
v10.0.19041.5553
64-bit
Windows NT
Analyzed
Security warning
This file has been flagged as potentially dangerous, and downloads are disabled.
Reason: Detected potentially dangerous functions used for process injection: OpenProcess
Exported functions 60
DllCanUnloadNow
#1 · 0x1050
DllMain
#2 · 0x1010
WIMAddImagePath
#3 · 0x1e20
WIMAddImagePaths
#4 · 0x2530
WIMAddWimbootEntry
#5 · 0x2ef0
WIMApplyImage
#6 · 0x52f0
WIMCaptureImage
#7 · 0x9ba0
WIMCloseHandle
#8 · 0xaeb0
WIMCommitImageHandle
#9 · 0xf7b0
WIMCopyFile
#10 · 0x12290
WIMCreateFile
#11 · 0xa220
WIMCreateImageFile
#12 · 0x17250
WIMCreateWofCompressedFile
#13 · 0x5560
WIMDeleteImage
#14 · 0x17e60
WIMDeleteImageMounts
#15 · 0xe410
WIMEnumImageFiles
#16 · 0x17020
WIMExportImage
#17 · 0x18ec0
WIMExtractImageDirectory
#18 · 0x1a4b0
WIMExtractImagePath
#19 · 0x19ca0
WIMFindFirstImageFile
#20 · 0x16bf0
WIMFindNextImageFile
#21 · 0x16ea0
WIMGetAttributes
#22 · 0xb5f0
WIMGetImageCount
#23 · 0xb5a0
WIMGetImageInformation
#24 · 0x1c690
WIMGetMessageCallbackCount
#25 · 0x1dda0
WIMGetMountedImageHandle
#26 · 0x11cc0
WIMGetMountedImageInfo
#27 · 0x116c0
WIMGetMountedImageInfoFromHandle
#28 · 0x11940
WIMGetMountedImages
#29 · 0x11c00
WIMGetWIMBootEntries
#30 · 0x2d10
WIMGetWIMBootWIMPath
#31 · 0x2950
WIMInitFileIOCallbacks
#32 · 0x1f140
WIMInitializeWofDriver
#33 · 0x3f20
WIMIsCurrentSystemWimboot
#34 · 0x30a0
WIMIsReferenceWim
#35 · 0x17870
WIMLoadImage
#36 · 0x1f640
WIMMountImage
#37 · 0x104b0
WIMMountImageHandle
#38 · 0xe900
WIMProcessCustomImage
#39 · 0x25ff0
WIMReadFileEx
#40 · 0xba20
WIMReadImageFile
#41 · 0x16070
WIMRedirectFolderBeforeApply
#42 · 0x5220
WIMRegisterLogFile
#43 · 0x28400
WIMRegisterMessageCallback
#44 · 0x1de30
WIMRemountImage
#45 · 0x10760
WIMSetBootImage
#46 · 0xb070
WIMSetFileIOCallbackTemporaryPath
#47 · 0x1f1a0
WIMSetImageInformation
#48 · 0x1c9b0
WIMSetImageUserSpecifiedCreationTime
#49 · 0x9e80
WIMSetReferenceFile
#50 · 0xb330
WIMSetTemporaryPath
#51 · 0xaf70
WIMSetWimGuid
#52 · 0x9e30
WIMSingleInstanceFile
#53 · 0x17420
WIMSplitFile
#54 · 0x297e0
WIMUnmountImage
#55 · 0x10c30
WIMUnmountImageHandle
#56 · 0xffa0
WIMUnregisterLogFile
#57 · 0x28650
WIMUnregisterMessageCallback
#58 · 0x1dfb0
WIMUpdateWIMBootEntry
#59 · 0x2b90
WIMWriteFileWithIntegrity
#60 · 0x159b0
No function matches your filter.
Imported DLLs & functions 257
ApiSetQueryApiSetPresence
0x180095f90
DelayLoadFailureHook
0x180095fa0
ResolveDelayLoadedAPI
0x180095fb0
GetLastError
0x180095fd8
SetLastError
0x180095fc0
SetUnhandledExceptionFilter
0x180095fd0
UnhandledExceptionFilter
0x180095fc8
CreateDirectoryW
0x1800960a8
CreateFileW
0x180096000
DeleteFileW
0x1800960d0
FindClose
0x180096058
FindFirstFileW
0x180096028
FindNextFileW
0x180096048
FlushFileBuffers
0x1800960a0
GetDriveTypeW
0x180095fe8
GetFileAttributesW
0x1800960c8
GetFileInformationByHandle
0x180095ff8
GetFileSize
0x180096068
GetFileSizeEx
0x180096098
GetFinalPathNameByHandleW
0x1800960c0
GetFullPathNameW
0x1800960d8
GetLogicalDriveStringsW
0x180096090
GetLongPathNameW
0x180096020
GetTempFileNameW
0x180096060
GetVolumeInformationByHandleW
0x1800960b0
GetVolumeInformationW
0x1800960e0
GetVolumePathNameW
0x180096008
LocalFileTimeToFileTime
0x180096040
LockFileEx
0x180096088
ReadFile
0x180096080
RemoveDirectoryW
0x180096010
SetEndOfFile
0x180096018
SetFileAttributesW
0x1800960b8
SetFileInformationByHandle
0x180096050
SetFilePointer
0x180096070
SetFilePointerEx
0x180096030
SetFileTime
0x180096038
UnlockFileEx
0x180095ff0
WriteFile
0x180096078
GetTempPathW
0x1800960f8
GetVolumeNameForVolumeMountPointW
0x1800960f0
GetVolumePathNamesForVolumeNameW
0x180096100
CloseHandle
0x180096130
DuplicateHandle
0x180096128
GetHandleInformation
0x180096138
GetProcessHeap
0x180096148
HeapAlloc
0x180096150
HeapFree
0x180096158
HeapReAlloc
0x180096160
DosDateTimeToFileTime
0x1800961a0
DisableThreadLibraryCalls
0x1800961b8
FreeLibrary
0x1800961c8
GetModuleFileNameW
0x1800961c0
GetModuleHandleExW
0x1800961b0
GetModuleHandleW
0x1800961d0
GetProcAddress
0x1800961d8
LoadLibraryExW
0x1800961e0
LoadLibraryW
0x1800961f0
FormatMessageW
0x180096200
CreateFileMappingW
0x180096210
MapViewOfFile
0x180096220
UnmapViewOfFile
0x180096218
GetPrivateProfileSectionW
0x180096230
ExpandEnvironmentStringsW
0x180096248
GetCurrentDirectoryW
0x180096240
GetEnvironmentVariableW
0x180096250
CreateProcessW
0x180096260
CreateThread
0x1800962c0
GetCurrentProcess
0x1800962a8
GetCurrentProcessId
0x180096278
GetCurrentThread
0x1800962c8
GetCurrentThreadId
0x1800962b8
GetExitCodeProcess
0x180096268
OpenProcessToken
0x1800962a0
OpenThreadToken
0x180096298
SetThreadToken
0x180096270
TerminateProcess
0x1800962d0
TlsAlloc
0x1800962b0
TlsFree
0x180096290
TlsGetValue
0x180096288
TlsSetValue
0x180096280
OpenProcess
0x1800962e0
SetThreadIdealProcessor
0x1800962f0
QueryPerformanceCounter
0x180096300
RegCloseKey
0x180096328
RegCreateKeyExW
0x180096360
RegDeleteKeyExW
0x180096310
RegDeleteValueW
0x180096368
RegEnumKeyExW
0x180096350
RegEnumValueW
0x180096338
RegFlushKey
0x180096348
RegLoadKeyW
0x180096358
RegOpenKeyExW
0x180096320
RegQueryInfoKeyW
0x180096340
RegQueryValueExW
0x180096330
RegSetValueExW
0x180096370
RegUnLoadKeyW
0x180096318
CompareStringW
0x180096388
MultiByteToWideChar
0x180096390
WideCharToMultiByte
0x180096380
CharUpperW
0x1800963a0
CreateEventW
0x180096410
CreateMutexW
0x1800963b0
CreateSemaphoreExW
0x1800963d0
DeleteCriticalSection
0x1800963c8
EnterCriticalSection
0x1800963f0
InitializeCriticalSection
0x1800963e0
InitializeCriticalSectionAndSpinCount
0x180096420
LeaveCriticalSection
0x180096418
OpenEventW
0x1800963f8
ReleaseMutex
0x1800963e8
ReleaseSemaphore
0x180096400
ResetEvent
0x1800963b8
SetEvent
0x180096408
WaitForMultipleObjectsEx
0x1800963c0
WaitForSingleObject
0x1800963d8
Sleep
0x180096430
GetSystemDirectoryW
0x180096468
GetSystemInfo
0x180096478
GetSystemTimeAsFileTime
0x180096458
GetTickCount
0x180096470
GlobalMemoryStatusEx
0x180096460
GetFileVersionInfoExW
0x180096490
GetFileVersionInfoSizeExW
0x180096498
VerQueryValueW
0x180096488
Wow64DisableWow64FsRedirection
0x1800964a8
Wow64RevertWow64FsRedirection
0x1800964b0
AddAccessAllowedAce
0x1800964e0
AddAccessAllowedAceEx
0x180096530
AdjustTokenPrivileges
0x180096548
AllocateAndInitializeSid
0x1800964d8
EqualSid
0x1800964e8
FreeSid
0x1800964f8
GetAclInformation
0x1800964c0
GetLengthSid
0x1800964d0
GetSecurityDescriptorControl
0x180096510
GetSecurityDescriptorDacl
0x180096520
GetSecurityDescriptorGroup
0x180096528
GetSecurityDescriptorLength
0x180096500
GetSecurityDescriptorOwner
0x180096540
GetSecurityDescriptorSacl
0x180096518
GetTokenInformation
0x1800964c8
InitializeAcl
0x180096508
InitializeSecurityDescriptor
0x1800964f0
RevertToSelf
0x180096538
SetSecurityDescriptorDacl
0x180096550
BCryptCloseAlgorithmProvider
0x180096590
BCryptCreateHash
0x180096570
BCryptDestroyHash
0x180096588
BCryptFinishHash
0x180096580
BCryptGetProperty
0x180096568
BCryptHashData
0x180096578
BCryptOpenAlgorithmProvider
0x180096560
msvcrt.dll
43
__C_specific_handler
0x180096688
__dllonexit
0x180096670
_amsg_exit
0x1800966e0
_callnewh
0x1800966c0
_initterm
0x180096698
_lock
0x180096680
_onexit
0x180096668
_purecall
0x1800966a0
_strnicmp
0x180096608
_unlock
0x180096678
_vscwprintf
0x180096648
_vsnwprintf
0x1800965c8
_wcsicmp
0x1800965f0
_wcslwr
0x1800966d0
_wcsnicmp
0x1800965a8
_wcsrev
0x180096630
_wcstoi64
0x180096638
_wcsupr
0x180096620
_wtoi
0x1800965d0
_XcptFilter
0x1800966e8
bsearch
0x1800966b0
free
0x1800966c8
iswspace
0x180096690
malloc
0x1800966b8
memcmp
0x180096650
memcpy
0x180096658
memcpy_s
0x180096600
memmove
0x180096660
memmove_s
0x1800966a8
memset
0x1800966f0
qsort
0x1800966d8
strcpy_s
0x180096640
strncpy_s
0x1800965f8
swscanf_s
0x1800965e0
towlower
0x180096618
towupper
0x180096610
wcschr
0x180096628
wcsncmp
0x1800965a0
wcsnlen
0x1800965b0
wcsrchr
0x1800965e8
wcsstr
0x1800965b8
wcstok_s
0x1800965d8
wcstoul
0x1800965c0
ntdll.dll
43
DbgPrintEx
0x180096700
NtClose
0x180096800
NtCreateFile
0x1800967a8
NtOpenFile
0x180096818
NtQueryDirectoryFile
0x180096808
NtQueryEaFile
0x1800967b0
NtQueryInformationFile
0x1800967e0
NtQueryInformationProcess
0x1800967b8
NtQuerySecurityObject
0x180096788
NtQueryVolumeInformationFile
0x1800967a0
NtSetEaFile
0x180096760
NtSetInformationFile
0x1800967e8
NtSetSecurityObject
0x1800967c0
NtUnloadKey2
0x180096780
NtYieldExecution
0x180096708
RtlAcquireResourceExclusive
0x180096750
RtlAcquireResourceShared
0x180096748
RtlAdjustPrivilege
0x180096828
RtlAllocateHeap
0x180096810
RtlCaptureContext
0x180096850
RtlCompressBuffer
0x180096778
RtlDeleteResource
0x180096738
RtlDosPathNameToNtPathName_U
0x180096820
RtlDosPathNameToNtPathName_U_WithStatus
0x180096730
RtlDowncaseUnicodeChar
0x180096770
RtlFindAceByType
0x1800967c8
RtlFreeHeap
0x1800967f8
RtlGetCompressionWorkSpaceSize
0x180096838
RtlGetLastNtStatus
0x1800967d8
RtlGetPersistedStateLocation
0x180096768
RtlGetVersion
0x180096728
RtlImpersonateSelf
0x180096798
RtlInitializeCriticalSection
0x180096718
RtlInitializeResource
0x180096758
RtlInitUnicodeString
0x180096790
RtlLookupFunctionEntry
0x180096848
RtlNtStatusToDosError
0x180096830
RtlRaiseStatus
0x180096710
RtlReAllocateHeap
0x180096720
RtlReleaseResource
0x180096740
RtlSetControlSecurityDescriptor
0x1800967d0
RtlSetIoCompletionCallback
0x1800967f0
RtlVirtualUnwind
0x180096840
RPCRT4.dll
10
I_RpcMapWin32Status
0x180095f38
NdrClientCall3
0x180095f50
RpcBindingFree
0x180095f78
RpcBindingFromStringBindingW
0x180095f68
RpcBindingSetAuthInfoW
0x180095f70
RpcStringBindingComposeW
0x180095f60
RpcStringFreeW
0x180095f40
UuidCreate
0x180095f80
UuidFromStringW
0x180095f48
UuidToStringW
0x180095f58
No function matches your filter.