Windows.Internal.Shell.Broker.dll
Description: Windows Shell Broker
Authors: © Microsoft Corporation. All rights reserved.
Version: 10.0.19041.6216
Architecture: 64-bit
Operating System: Windows NT
SHA256: 7f70bdb1526c01447a5aa6720a029513
File Size: 893.4 KB
Uploaded At: Dec. 1, 2025, 7:43 a.m.
Views: 4
Security Warning
This file has been flagged as potentially dangerous.
Reason: Detected potentially dangerous functions used for process injection: OpenProcess
Exported Functions
- DllCanUnloadNow (Ordinal: 1, Address: 0x203b0)
- DllGetActivationFactory (Ordinal: 2, Address: 0x22ab0)
- DllGetClassObject (Ordinal: 3, Address: 0x44540)
Imported DLLs & Functions
api-ms-win-appmodel-runtime-l1-1-0.dll
- PackageFamilyNameFromFullName (Address: 0x1800abac8)
- PackageNameAndPublisherIdFromFamilyName (Address: 0x1800abac0)
api-ms-win-appmodel-runtime-l1-1-1.dll
- FindPackagesByPackageFamily (Address: 0x1800abad8)
api-ms-win-appmodel-runtime-l1-1-3.dll
- GetStagedPackagePathByFullName2 (Address: 0x1800abae8)
api-ms-win-core-apiquery-l1-1-0.dll
- ApiSetQueryApiSetPresence (Address: 0x1800abaf8)
api-ms-win-core-com-l1-1-0.dll
- CoCreateFreeThreadedMarshaler (Address: 0x1800abb38)
- CoCreateInstance (Address: 0x1800abb10)
- CoGetApartmentType (Address: 0x1800abb70)
- CoGetCallContext (Address: 0x1800abb80)
- CoGetInterfaceAndReleaseStream (Address: 0x1800abb58)
- CoGetMalloc (Address: 0x1800abb60)
- CoIncrementMTAUsage (Address: 0x1800abb08)
- CoMarshalInterface (Address: 0x1800abb50)
- CoMarshalInterThreadInterfaceInStream (Address: 0x1800abb78)
- CoReleaseMarshalData (Address: 0x1800abb40)
- CoRevertToSelf (Address: 0x1800abb28)
- CoTaskMemAlloc (Address: 0x1800abb20)
- CoTaskMemFree (Address: 0x1800abb18)
- CoTaskMemRealloc (Address: 0x1800abb30)
- CreateStreamOnHGlobal (Address: 0x1800abb48)
- PropVariantClear (Address: 0x1800abb68)
api-ms-win-core-com-l1-1-1.dll
- RoGetAgileReference (Address: 0x1800abb90)
api-ms-win-core-debug-l1-1-0.dll
- DebugBreak (Address: 0x1800abba8)
- IsDebuggerPresent (Address: 0x1800abbb0)
- OutputDebugStringW (Address: 0x1800abba0)
api-ms-win-core-delayload-l1-1-0.dll
- DelayLoadFailureHook (Address: 0x1800abbc0)
api-ms-win-core-delayload-l1-1-1.dll
- ResolveDelayLoadedAPI (Address: 0x1800abbd0)
api-ms-win-core-errorhandling-l1-1-0.dll
- GetLastError (Address: 0x1800abc00)
- RaiseException (Address: 0x1800abbf8)
- SetLastError (Address: 0x1800abbe0)
- SetUnhandledExceptionFilter (Address: 0x1800abbe8)
- UnhandledExceptionFilter (Address: 0x1800abbf0)
api-ms-win-core-handle-l1-1-0.dll
- CloseHandle (Address: 0x1800abc10)
api-ms-win-core-heap-l1-1-0.dll
- GetProcessHeap (Address: 0x1800abc20)
- HeapAlloc (Address: 0x1800abc30)
- HeapFree (Address: 0x1800abc28)
api-ms-win-core-heap-l2-1-0.dll
- LocalAlloc (Address: 0x1800abc48)
- LocalFree (Address: 0x1800abc40)
api-ms-win-core-interlocked-l1-1-0.dll
- InitializeSListHead (Address: 0x1800abc60)
- InterlockedPushEntrySList (Address: 0x1800abc58)
api-ms-win-core-kernel32-legacy-l1-1-0.dll
- GetComputerNameW (Address: 0x1800abc70)
api-ms-win-core-largeinteger-l1-1-0.dll
- MulDiv (Address: 0x1800abc80)
api-ms-win-core-libraryloader-l1-2-0.dll
- DisableThreadLibraryCalls (Address: 0x1800abcb0)
- FindResourceExW (Address: 0x1800abca0)
- FindStringOrdinal (Address: 0x1800abcc0)
- FreeLibrary (Address: 0x1800abcd0)
- GetModuleFileNameA (Address: 0x1800abce0)
- GetModuleFileNameW (Address: 0x1800abcc8)
- GetModuleHandleExW (Address: 0x1800abcd8)
- GetModuleHandleW (Address: 0x1800abc98)
- GetProcAddress (Address: 0x1800abcb8)
- LoadResource (Address: 0x1800abc90)
- LockResource (Address: 0x1800abca8)
api-ms-win-core-localization-l1-2-0.dll
- FormatMessageW (Address: 0x1800abcf0)
api-ms-win-core-path-l1-1-0.dll
- PathAllocCombine (Address: 0x1800abd08)
- PathCchRemoveExtension (Address: 0x1800abd10)
- PathCchRemoveFileSpec (Address: 0x1800abd00)
api-ms-win-core-processenvironment-l1-1-0.dll
- ExpandEnvironmentStringsW (Address: 0x1800abd20)
api-ms-win-core-processthreads-l1-1-0.dll
- GetCurrentProcess (Address: 0x1800abd30)
- GetCurrentProcessId (Address: 0x1800abd48)
- GetCurrentThread (Address: 0x1800abd58)
- GetCurrentThreadId (Address: 0x1800abd40)
- GetProcessId (Address: 0x1800abd68)
- OpenProcessToken (Address: 0x1800abd50)
- OpenThreadToken (Address: 0x1800abd60)
- TerminateProcess (Address: 0x1800abd38)
api-ms-win-core-processthreads-l1-1-1.dll
- GetProcessMitigationPolicy (Address: 0x1800abd80)
- IsProcessorFeaturePresent (Address: 0x1800abd88)
- OpenProcess (Address: 0x1800abd78)
api-ms-win-core-profile-l1-1-0.dll
- QueryPerformanceCounter (Address: 0x1800abd98)
api-ms-win-core-psapi-l1-1-0.dll
- QueryFullProcessImageNameW (Address: 0x1800abda8)
api-ms-win-core-registry-l1-1-0.dll
- RegCloseKey (Address: 0x1800abdd0)
- RegGetValueW (Address: 0x1800abdc8)
- RegOpenKeyExW (Address: 0x1800abdb8)
- RegSetValueExW (Address: 0x1800abdc0)
api-ms-win-core-rtlsupport-l1-1-0.dll
- RtlCaptureContext (Address: 0x1800abdf0)
- RtlLookupFunctionEntry (Address: 0x1800abde8)
- RtlVirtualUnwind (Address: 0x1800abde0)
api-ms-win-core-shlwapi-legacy-l1-1-0.dll
- PathFileExistsW (Address: 0x1800abe00)
- PathFindExtensionW (Address: 0x1800abe10)
- PathFindFileNameW (Address: 0x1800abe18)
- PathIsFileSpecW (Address: 0x1800abe08)
- PathIsRelativeW (Address: 0x1800abe20)
- SHExpandEnvironmentStringsW (Address: 0x1800abe28)
api-ms-win-core-shlwapi-obsolete-l1-1-0.dll
- StrCmpW (Address: 0x1800abe38)
- StrStrIW (Address: 0x1800abe40)
api-ms-win-core-string-l1-1-0.dll
- CompareStringOrdinal (Address: 0x1800abe58)
- MultiByteToWideChar (Address: 0x1800abe60)
- WideCharToMultiByte (Address: 0x1800abe50)
api-ms-win-core-string-l2-1-1.dll
- SHLoadIndirectString (Address: 0x1800abe70)
api-ms-win-core-string-obsolete-l1-1-0.dll
- lstrlenW (Address: 0x1800abe80)
api-ms-win-core-synch-l1-1-0.dll
- AcquireSRWLockExclusive (Address: 0x1800abed0)
- AcquireSRWLockShared (Address: 0x1800abef0)
- CreateEventW (Address: 0x1800abee0)
- CreateMutexExW (Address: 0x1800abec0)
- CreateSemaphoreExW (Address: 0x1800abf10)
- DeleteCriticalSection (Address: 0x1800abe90)
- EnterCriticalSection (Address: 0x1800abf08)
- InitializeCriticalSectionEx (Address: 0x1800abf18)
- InitializeSRWLock (Address: 0x1800abef8)
- LeaveCriticalSection (Address: 0x1800abf00)
- OpenSemaphoreW (Address: 0x1800abeb8)
- ReleaseMutex (Address: 0x1800abea8)
- ReleaseSemaphore (Address: 0x1800abe98)
- ReleaseSRWLockExclusive (Address: 0x1800abec8)
- ReleaseSRWLockShared (Address: 0x1800abed8)
- SetEvent (Address: 0x1800abee8)
- WaitForSingleObject (Address: 0x1800abea0)
- WaitForSingleObjectEx (Address: 0x1800abeb0)
api-ms-win-core-synch-l1-2-0.dll
- InitOnceBeginInitialize (Address: 0x1800abf30)
- InitOnceComplete (Address: 0x1800abf28)
- InitOnceExecuteOnce (Address: 0x1800abf40)
- Sleep (Address: 0x1800abf38)
api-ms-win-core-sysinfo-l1-1-0.dll
- GetSystemTimeAsFileTime (Address: 0x1800abf50)
- GetTickCount (Address: 0x1800abf58)
- GetVersionExW (Address: 0x1800abf60)
api-ms-win-core-threadpool-l1-2-0.dll
- CloseThreadpoolTimer (Address: 0x1800abf70)
- CreateThreadpoolTimer (Address: 0x1800abf88)
- SetThreadpoolTimer (Address: 0x1800abf80)
- WaitForThreadpoolTimerCallbacks (Address: 0x1800abf78)
api-ms-win-core-url-l1-1-0.dll
- PathIsURLW (Address: 0x1800abf98)
- UrlUnescapeW (Address: 0x1800abfa0)
api-ms-win-core-util-l1-1-0.dll
- DecodePointer (Address: 0x1800abfb0)
- EncodePointer (Address: 0x1800abfb8)
api-ms-win-core-winrt-error-l1-1-0.dll
- GetRestrictedErrorInfo (Address: 0x1800abfd8)
- RoOriginateError (Address: 0x1800abfc8)
- RoOriginateErrorW (Address: 0x1800abfe8)
- RoTransformError (Address: 0x1800abfe0)
- SetRestrictedErrorInfo (Address: 0x1800abfd0)
api-ms-win-core-winrt-error-l1-1-1.dll
- IsErrorPropagationEnabled (Address: 0x1800ac008)
- RoGetMatchingRestrictedErrorInfo (Address: 0x1800ac010)
- RoOriginateLanguageException (Address: 0x1800abff8)
- RoReportFailedDelegate (Address: 0x1800ac000)
api-ms-win-core-winrt-l1-1-0.dll
- RoActivateInstance (Address: 0x1800ac028)
- RoGetActivationFactory (Address: 0x1800ac020)
api-ms-win-core-winrt-string-l1-1-0.dll
- WindowsCompareStringOrdinal (Address: 0x1800ac038)
- WindowsConcatString (Address: 0x1800ac040)
- WindowsCreateString (Address: 0x1800ac060)
- WindowsCreateStringReference (Address: 0x1800ac050)
- WindowsDeleteString (Address: 0x1800ac068)
- WindowsDeleteStringBuffer (Address: 0x1800ac090)
- WindowsDuplicateString (Address: 0x1800ac058)
- WindowsGetStringRawBuffer (Address: 0x1800ac070)
- WindowsIsStringEmpty (Address: 0x1800ac080)
- WindowsPreallocateStringBuffer (Address: 0x1800ac098)
- WindowsPromoteStringBuffer (Address: 0x1800ac088)
- WindowsStringHasEmbeddedNull (Address: 0x1800ac078)
- WindowsSubstringWithSpecifiedLength (Address: 0x1800ac048)
api-ms-win-crt-private-l1-1-0.dll
- __C_specific_handler (Address: 0x1800ac128)
- __CxxFrameHandler3 (Address: 0x1800ac1d0)
- __CxxFrameHandler4 (Address: 0x1800ac1a8)
- __std_terminate (Address: 0x1800ac198)
- _CxxThrowException (Address: 0x1800ac1c8)
- _o___std_exception_copy (Address: 0x1800ac130)
- _o___std_exception_destroy (Address: 0x1800ac0d0)
- _o___std_type_info_destroy_list (Address: 0x1800ac1c0)
- _o___stdio_common_vsnprintf_s (Address: 0x1800ac1a0)
- _o___stdio_common_vswprintf (Address: 0x1800ac140)
- _o___stdio_common_vswscanf (Address: 0x1800ac138)
- _o__callnewh (Address: 0x1800ac170)
- _o__cexit (Address: 0x1800ac0e0)
- _o__configure_narrow_argv (Address: 0x1800ac190)
- _o__crt_atexit (Address: 0x1800ac188)
- _o__errno (Address: 0x1800ac180)
- _o__execute_onexit_table (Address: 0x1800ac178)
- _o__get_errno (Address: 0x1800ac168)
- _o__initialize_narrow_environment (Address: 0x1800ac160)
- _o__initialize_onexit_table (Address: 0x1800ac158)
- _o__invalid_parameter_noinfo (Address: 0x1800ac150)
- _o__invalid_parameter_noinfo_noreturn (Address: 0x1800ac148)
- _o__purecall (Address: 0x1800ac0a8)
- _o__register_onexit_function (Address: 0x1800ac0b0)
- _o__seh_filter_dll (Address: 0x1800ac0b8)
- _o__set_errno (Address: 0x1800ac0c0)
- _o__ui64tow_s (Address: 0x1800ac0c8)
- _o__wcsicmp (Address: 0x1800ac0d8)
- _o_free (Address: 0x1800ac0f0)
- _o_iswspace (Address: 0x1800ac0f8)
- _o_malloc (Address: 0x1800ac100)
- _o_pow (Address: 0x1800ac108)
- _o_realloc (Address: 0x1800ac110)
- _o_terminate (Address: 0x1800ac118)
- _o_toupper (Address: 0x1800ac120)
- memcmp (Address: 0x1800ac1b0)
- memcpy (Address: 0x1800ac1b8)
- memmove (Address: 0x1800ac0e8)
api-ms-win-crt-runtime-l1-1-0.dll
- _initterm (Address: 0x1800ac1e0)
- _initterm_e (Address: 0x1800ac1e8)
api-ms-win-crt-string-l1-1-0.dll
- memset (Address: 0x1800ac1f8)
- wcscmp (Address: 0x1800ac200)
api-ms-win-eventing-provider-l1-1-0.dll
- EventActivityIdControl (Address: 0x1800ac218)
- EventProviderEnabled (Address: 0x1800ac220)
- EventRegister (Address: 0x1800ac210)
- EventSetInformation (Address: 0x1800ac230)
- EventUnregister (Address: 0x1800ac238)
- EventWriteTransfer (Address: 0x1800ac228)
api-ms-win-security-base-l1-1-0.dll
- AllocateAndInitializeSid (Address: 0x1800ac260)
- CheckTokenMembership (Address: 0x1800ac250)
- DuplicateTokenEx (Address: 0x1800ac268)
- FreeSid (Address: 0x1800ac248)
- GetTokenInformation (Address: 0x1800ac258)
api-ms-win-security-capability-l1-1-0.dll
- CapabilityCheck (Address: 0x1800ac278)
api-ms-win-security-sddl-l1-1-0.dll
- ConvertSidToStringSidW (Address: 0x1800ac288)
api-ms-win-shlwapi-winrt-storage-l1-1-1.dll
- (Address: 0x1800ac298)
- (Address: 0x1800ac2a0)
- (Address: 0x1800ac2a8)
combase.dll
- (Address: 0x1800ac2b8)
- (Address: 0x1800ac2c0)
- (Address: 0x1800ac2c8)
- (Address: 0x1800ac2d0)
d3d11.dll
- D3D11CreateDevice (Address: 0x1800ac2e0)
msvcp_win.dll
- _Wcscoll (Address: 0x1800ac2f0)
- _Wcsxfrm (Address: 0x1800ac380)
- ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ (Address: 0x1800ac428)
- ?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z (Address: 0x1800ac3e8)
- ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ (Address: 0x1800ac2f8)
- ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ (Address: 0x1800ac408)
- ?_Incref@facet@locale@std@@UEAAXXZ (Address: 0x1800ac3f0)
- ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z (Address: 0x1800ac3f8)
- ?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ (Address: 0x1800ac468)
- ?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ (Address: 0x1800ac4a0)
- ?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ (Address: 0x1800ac4b8)
- ?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ (Address: 0x1800ac480)
- ?_Xbad_alloc@std@@YAXXZ (Address: 0x1800ac318)
- ?_Xlength_error@std@@YAXPEBD@Z (Address: 0x1800ac3b8)
- ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z (Address: 0x1800ac300)
- ??0_Locinfo@std@@QEAA@PEBD@Z (Address: 0x1800ac368)
- ??0_Lockit@std@@QEAA@H@Z (Address: 0x1800ac440)
- ??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ (Address: 0x1800ac370)
- ??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z (Address: 0x1800ac3a0)
- ??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ (Address: 0x1800ac358)
- ??0facet@locale@std@@IEAA@_K@Z (Address: 0x1800ac410)
- ??1_Locinfo@std@@QEAA@XZ (Address: 0x1800ac3d8)
- ??1_Lockit@std@@QEAA@XZ (Address: 0x1800ac3d0)
- ??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ (Address: 0x1800ac460)
- ??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ (Address: 0x1800ac458)
- ??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ (Address: 0x1800ac430)
- ??1facet@locale@std@@MEAA@XZ (Address: 0x1800ac418)
- ??Bid@locale@std@@QEAA_KXZ (Address: 0x1800ac3c8)
- ?c_str@?$_Yarn@D@std@@QEBAPEBDXZ (Address: 0x1800ac3a8)
- ?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ (Address: 0x1800ac378)
- ?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ (Address: 0x1800ac420)
- ?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ (Address: 0x1800ac390)
- ?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGXZ (Address: 0x1800ac4d0)
- ?flags@ios_base@std@@QEBAHXZ (Address: 0x1800ac4b0)
- ?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ (Address: 0x1800ac470)
- ?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z (Address: 0x1800ac438)
- ?good@ios_base@std@@QEBA_NXZ (Address: 0x1800ac490)
- ?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ (Address: 0x1800ac450)
- ?id@?$collate@G@std@@2V0locale@2@A (Address: 0x1800ac3c0)
- ?id@?$ctype@G@std@@2V0locale@2@A (Address: 0x1800ac400)
- ?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z (Address: 0x1800ac348)
- ?is@?$ctype@G@std@@QEBA_NFG@Z (Address: 0x1800ac3e0)
- ?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ (Address: 0x1800ac360)
- ?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ (Address: 0x1800ac448)
- ?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ (Address: 0x1800ac4c8)
- ?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z (Address: 0x1800ac340)
- ?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z (Address: 0x1800ac388)
- ?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG0@Z (Address: 0x1800ac4e0)
- ?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z (Address: 0x1800ac398)
- ?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z (Address: 0x1800ac3b0)
- ?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ (Address: 0x1800ac328)
- ?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z (Address: 0x1800ac4c0)
- ?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z (Address: 0x1800ac350)
- ?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ (Address: 0x1800ac498)
- ?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ (Address: 0x1800ac478)
- ?tolower@?$ctype@G@std@@QEBAGG@Z (Address: 0x1800ac310)
- ?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z (Address: 0x1800ac320)
- ?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ (Address: 0x1800ac330)
- ?uncaught_exception@std@@YA_NXZ (Address: 0x1800ac488)
- ?width@ios_base@std@@QEAA_J_J@Z (Address: 0x1800ac4d8)
- ?width@ios_base@std@@QEBA_JXZ (Address: 0x1800ac4a8)
- ?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z (Address: 0x1800ac338)
- ?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z (Address: 0x1800ac308)
ntdll.dll
- NtQueryInformationToken (Address: 0x1800ac530)
- NtQueryWnfStateData (Address: 0x1800ac588)
- RtlAcquireSRWLockExclusive (Address: 0x1800ac570)
- RtlAllocateHeap (Address: 0x1800ac510)
- RtlCompareUnicodeString (Address: 0x1800ac500)
- RtlFreeHeap (Address: 0x1800ac538)
- RtlInitUnicodeString (Address: 0x1800ac520)
- RtlNtStatusToDosErrorNoTeb (Address: 0x1800ac508)
- RtlPublishWnfStateData (Address: 0x1800ac4f8)
- RtlQueryResourcePolicy (Address: 0x1800ac548)
- RtlReleaseSRWLockExclusive (Address: 0x1800ac568)
- RtlSleepConditionVariableSRW (Address: 0x1800ac580)
- RtlSubscribeWnfStateChangeNotification (Address: 0x1800ac4f0)
- RtlUnsubscribeWnfNotificationWaitForCompletion (Address: 0x1800ac518)
- RtlWakeAllConditionVariable (Address: 0x1800ac578)
- strchr (Address: 0x1800ac558)
- wcschr (Address: 0x1800ac540)
- wcscspn (Address: 0x1800ac560)
- wcsrchr (Address: 0x1800ac550)
- wcsstr (Address: 0x1800ac528)
OLEAUT32.dll
- SafeArrayAccessData (Address: 0x1800ab8e0)
- SafeArrayCreate (Address: 0x1800ab8b8)
- SafeArrayDestroy (Address: 0x1800ab8d0)
- SafeArrayGetDim (Address: 0x1800ab8d8)
- SafeArrayUnaccessData (Address: 0x1800ab8c0)
- SysFreeString (Address: 0x1800ab8b0)
- SysStringLen (Address: 0x1800ab8c8)
PROPSYS.dll
- PropVariantToBoolean (Address: 0x1800ab900)
- PropVariantToStringAlloc (Address: 0x1800ab8f8)
- PropVariantToUInt32 (Address: 0x1800ab8f0)
- PSCreateMemoryPropertyStore (Address: 0x1800ab910)
- PSPropertyBag_WriteStr (Address: 0x1800ab908)
SHCORE.dll
- (Address: 0x1800ab930)
- (Address: 0x1800ab938)
- (Address: 0x1800ab940)
- (Address: 0x1800ab950)
- (Address: 0x1800ab980)
- (Address: 0x1800ab9a8)
- CreateRandomAccessStreamOverStream (Address: 0x1800ab9a0)
- IStream_Read (Address: 0x1800ab988)
- IStream_Size (Address: 0x1800ab990)
- IUnknown_GetSite (Address: 0x1800ab958)
- IUnknown_QueryService (Address: 0x1800ab928)
- IUnknown_SetSite (Address: 0x1800ab960)
- SHAnsiToUnicode (Address: 0x1800ab978)
- SHCreateMemStream (Address: 0x1800ab9c8)
- SHCreateThreadRef (Address: 0x1800ab968)
- SHGetThreadRef (Address: 0x1800ab998)
- SHSetThreadRef (Address: 0x1800ab970)
- SHStrDupA (Address: 0x1800ab920)
- SHStrDupW (Address: 0x1800ab9c0)
- SHTaskPoolAllowThreadReuse (Address: 0x1800ab9b0)
- SHTaskPoolGetUniqueContext (Address: 0x1800ab948)
- SHTaskPoolQueueTask (Address: 0x1800ab9b8)
USER32.dll
- AllowSetForegroundWindow (Address: 0x1800aba80)
- CopyImage (Address: 0x1800aba08)
- CopyRect (Address: 0x1800aba00)
- CreatePopupMenu (Address: 0x1800aba60)
- DestroyIcon (Address: 0x1800aba40)
- DestroyMenu (Address: 0x1800aba50)
- FindWindowW (Address: 0x1800ab9e8)
- GetDC (Address: 0x1800aba28)
- GetDesktopWindow (Address: 0x1800aba70)
- GetIconInfo (Address: 0x1800aba20)
- GetMenuDefaultItem (Address: 0x1800aba38)
- GetMenuItemCount (Address: 0x1800aba58)
- GetMenuItemInfoW (Address: 0x1800aba68)
- GetSysColor (Address: 0x1800ab9f8)
- GetSystemMetrics (Address: 0x1800ab9d8)
- GetWindowThreadProcessId (Address: 0x1800aba30)
- LoadImageW (Address: 0x1800aba18)
- LockWorkStation (Address: 0x1800ab9e0)
- ReleaseDC (Address: 0x1800aba10)
- SendMessageTimeoutW (Address: 0x1800aba78)
- SendMessageW (Address: 0x1800aba48)
- SystemParametersInfoW (Address: 0x1800ab9f0)
UxTheme.dll
- (Address: 0x1800aba90)
- (Address: 0x1800aba98)
- (Address: 0x1800abaa0)
WININET.dll
- InternetCrackUrlW (Address: 0x1800abab0)