diagnostic.dll

Description: Diagnostic Module

Authors: © Microsoft Corporation. All rights reserved.

Version: 10.0.19041.6218

Architecture: 64-bit

Operating System: Windows NT

SHA256: 2380b25250eb55c7f7d6ff8c2ce864a0

File Size: 174.9 KB

Uploaded At: Dec. 1, 2025, 7:50 a.m.

Views: 5

Security Warning

This file has been flagged as potentially dangerous.


Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

  • ??0CAccessWMI@@IEAA@PEBG@Z (Ordinal: 1, Address: 0x1240)
  • ??0CAccessWMI@@QEAA@AEBV0@@Z (Ordinal: 2, Address: 0x1120)
  • ??0CCountArray@@QEAA@XZ (Ordinal: 3, Address: 0x14a10)
  • ??0CExistingOS@@QEAA@XZ (Ordinal: 4, Address: 0x3620)
  • ??0CHardwareID@@QEAA@XZ (Ordinal: 5, Address: 0x2690)
  • ??0CInstallSource@@QEAA@PEAU_BLACKBOARD@@@Z (Ordinal: 6, Address: 0x4ed0)
  • ??0CMoboAndProcInfo@@QEAA@AEBV0@@Z (Ordinal: 7, Address: 0x2220)
  • ??0CMoboAndProcInfo@@QEAA@XZ (Ordinal: 8, Address: 0x23a0)
  • ??0CNewOS@@QEAA@PEAU_BLACKBOARD@@@Z (Ordinal: 9, Address: 0x4480)
  • ??0CSqmDiagConsumer@@QEAA@AEBV0@@Z (Ordinal: 10, Address: 0x3100)
  • ??0CSqmDiagConsumer@@QEAA@XZ (Ordinal: 11, Address: 0x6780)
  • ??0IDiagConsumer@@QEAA@AEBV0@@Z (Ordinal: 12, Address: 0x3050)
  • ??0IDiagConsumer@@QEAA@XZ (Ordinal: 13, Address: 0x3050)
  • ??0InstallData@@QEAA@AEBV0@@Z (Ordinal: 14, Address: 0x32e0)
  • ??0InstallData@@QEAA@PEAU_BLACKBOARD@@@Z (Ordinal: 15, Address: 0x96d0)
  • ??0MachineHardWare@@QEAA@AEBV0@@Z (Ordinal: 16, Address: 0x3230)
  • ??0MachineHardWare@@QEAA@XZ (Ordinal: 17, Address: 0x89b0)
  • ??0NewSystem@@QEAA@AEBV0@@Z (Ordinal: 18, Address: 0x3280)
  • ??0NewSystem@@QEAA@PEAU_BLACKBOARD@@@Z (Ordinal: 19, Address: 0x8e60)
  • ??0OldSystem@@QEAA@AEBV0@@Z (Ordinal: 20, Address: 0x32c0)
  • ??0OldSystem@@QEAA@XZ (Ordinal: 21, Address: 0x9200)
  • ??1CAccessWMI@@MEAA@XZ (Ordinal: 22, Address: 0x1270)
  • ??1CCountArray@@QEAA@XZ (Ordinal: 23, Address: 0x14a50)
  • ??1CExistingOS@@QEAA@XZ (Ordinal: 24, Address: 0x3790)
  • ??1CHardwareID@@QEAA@XZ (Ordinal: 25, Address: 0x2830)
  • ??1CInstallSource@@QEAA@XZ (Ordinal: 26, Address: 0x4580)
  • ??1CMoboAndProcInfo@@UEAA@XZ (Ordinal: 27, Address: 0x24b0)
  • ??1CNewOS@@QEAA@XZ (Ordinal: 28, Address: 0x4580)
  • ??1CSqmDiagConsumer@@UEAA@XZ (Ordinal: 29, Address: 0x67b0)
  • ??1IDiagConsumer@@UEAA@XZ (Ordinal: 30, Address: 0x3030)
  • ??1InstallData@@QEAA@XZ (Ordinal: 31, Address: 0x9730)
  • ??1MachineHardWare@@QEAA@XZ (Ordinal: 32, Address: 0x8a00)
  • ??1NewSystem@@QEAA@XZ (Ordinal: 33, Address: 0x8ec0)
  • ??1OldSystem@@QEAA@XZ (Ordinal: 34, Address: 0x9250)
  • ??4CAccessWMI@@QEAAAEAV0@AEBV0@@Z (Ordinal: 35, Address: 0x1170)
  • ??4CCountArray@@QEAAAEAV0@AEBV0@@Z (Ordinal: 36, Address: 0x3210)
  • ??4CDiagConsumerAdaptorFactory@@QEAAAEAV0@$$QEAV0@@Z (Ordinal: 37, Address: 0x3070)
  • ??4CDiagConsumerAdaptorFactory@@QEAAAEAV0@AEBV0@@Z (Ordinal: 38, Address: 0x3070)
  • ??4CExistingOS@@QEAAAEAV0@AEBV0@@Z (Ordinal: 39, Address: 0x2e80)
  • ??4CHardwareID@@QEAAAEAV0@AEBV0@@Z (Ordinal: 40, Address: 0x2660)
  • ??4CInstallSource@@QEAAAEAV0@AEBV0@@Z (Ordinal: 41, Address: 0x3010)
  • ??4CMoboAndProcInfo@@QEAAAEAV0@AEBV0@@Z (Ordinal: 42, Address: 0x22b0)
  • ??4CNewOS@@QEAAAEAV0@AEBV0@@Z (Ordinal: 43, Address: 0x2f90)
  • ??4CSqmDiagConsumer@@QEAAAEAV0@AEBV0@@Z (Ordinal: 44, Address: 0x3140)
  • ??4IDiagConsumer@@QEAAAEAV0@AEBV0@@Z (Ordinal: 45, Address: 0x3070)
  • ??4InstallData@@QEAAAEAV0@AEBV0@@Z (Ordinal: 46, Address: 0x32a0)
  • ??4MachineHardWare@@QEAAAEAV0@AEBV0@@Z (Ordinal: 47, Address: 0x3260)
  • ??4NewSystem@@QEAAAEAV0@AEBV0@@Z (Ordinal: 48, Address: 0x32a0)
  • ??4OldSystem@@QEAAAEAV0@AEBV0@@Z (Ordinal: 49, Address: 0x32a0)
  • ??_7CAccessWMI@@6B@ (Ordinal: 50, Address: 0x1b138)
  • ??_7CMoboAndProcInfo@@6B@ (Ordinal: 51, Address: 0x1b140)
  • ??_7CSqmDiagConsumer@@6B@ (Ordinal: 52, Address: 0x1b290)
  • ??_7IDiagConsumer@@6B@ (Ordinal: 53, Address: 0x1b2e0)
  • ??_7InstallData@@6B@ (Ordinal: 54, Address: 0x1b230)
  • ??_7MachineHardWare@@6B@ (Ordinal: 55, Address: 0x1b278)
  • ??_7NewSystem@@6B@ (Ordinal: 56, Address: 0x1b260)
  • ??_7OldSystem@@6B@ (Ordinal: 57, Address: 0x1b248)
  • ?AddToStream@CSqmDiagConsumer@@UEAAKKKK@Z (Ordinal: 58, Address: 0x74a0)
  • ?AddToStream@CSqmDiagConsumer@@UEAAKKKPEAG@Z (Ordinal: 59, Address: 0x7620)
  • CallBack_DiagnosticDataGeneration (Ordinal: 60, Address: 0xd040)
  • CallBack_DiagnosticDataSend (Ordinal: 61, Address: 0xdd60)
  • CallBack_EditionID (Ordinal: 62, Address: 0xc240)
  • CallBack_RestartSetup (Ordinal: 63, Address: 0xb980)
  • Callback_Diagnostic_Unattend (Ordinal: 64, Address: 0xb4c0)
  • CollectAndSendDiagDataToSQM (Ordinal: 65, Address: 0xf3e0)
  • CollectAndSendDiagDataToWatson (Ordinal: 66, Address: 0xfe80)
  • ?ConnectWMI@CAccessWMI@@IEAA_NXZ (Ordinal: 67, Address: 0x1430)
  • ?CreateInstance@CDiagConsumerAdaptorFactory@@SAKPEAPEAVIDiagConsumer@@@Z (Ordinal: 68, Address: 0x86a0)
  • ?DeleteInstance@CDiagConsumerAdaptorFactory@@SAXPEAVIDiagConsumer@@@Z (Ordinal: 69, Address: 0x8870)
  • ?DestroyArray@CHardwareID@@AEAAXPEAV?$CAtlArray@PEBGV?$CElementTraits@PEBG@ATL@@@ATL@@@Z (Ordinal: 70, Address: 0x2890)
  • ?DetectBranch@CExistingOS@@AEAAXXZ (Ordinal: 71, Address: 0x3c00)
  • ?DetermineInstallImageType@CInstallSource@@SAKPEAU_BLACKBOARD@@@Z (Ordinal: 72, Address: 0x50a0)
  • ?DetermineInstallMedia@CInstallSource@@SAKPEAU_BLACKBOARD@@@Z (Ordinal: 73, Address: 0x50e0)
  • ?DetermineInstallMediaHashLabel@CInstallSource@@SAKPEAU_BLACKBOARD@@@Z (Ordinal: 74, Address: 0x51a0)
  • ?DetermineInstallType@CInstallSource@@SAKPEAU_BLACKBOARD@@@Z (Ordinal: 75, Address: 0x5040)
  • DiagnosticDataSendWorker (Ordinal: 76, Address: 0xe600)
  • ?DisconnectWMI@CAccessWMI@@IEAAXXZ (Ordinal: 77, Address: 0x1680)
  • DoWatsonReporting (Ordinal: 78, Address: 0x11ef0)
  • ?DoneReporting@CSqmDiagConsumer@@UEAAKPEAGK@Z (Ordinal: 79, Address: 0x77a0)
  • ?EnumDevices@CHardwareID@@AEAAXXZ (Ordinal: 80, Address: 0x2920)
  • ?ExecQuery@CAccessWMI@@IEAA_NXZ (Ordinal: 81, Address: 0x16f0)
  • ?FetchInfo@CAccessWMI@@IEAA_NPEBGAEAK@Z (Ordinal: 82, Address: 0x1920)
  • ?FetchInfo@CAccessWMI@@IEAA_NPEBGAEA_J@Z (Ordinal: 83, Address: 0x1a60)
  • ?FetchInfo@CAccessWMI@@IEAA_NPEBGPEAG_K@Z (Ordinal: 84, Address: 0x1b40)
  • ?FillWithBranchDetails@CNewOS@@AEAAXPEAG@Z (Ordinal: 85, Address: 0x4b00)
  • ?FillWithBuildDate@CNewOS@@AEAAXPEAG@Z (Ordinal: 86, Address: 0x4a70)
  • ?FillWithVersionAndBuildProperties@CNewOS@@AEAAXPEAG@Z (Ordinal: 87, Address: 0x4b90)
  • ?FindFilePathInAppDir@CNewOS@@AEAA_NPEAGIPEBG@Z (Ordinal: 88, Address: 0x4d10)
  • ?GetAvailPhysRAM@CMoboAndProcInfo@@QEAAKXZ (Ordinal: 89, Address: 0x21b0)
  • ?GetCompatibleIds@CHardwareID@@QEAAPEAPEBGXZ (Ordinal: 90, Address: 0x2650)
  • ?GetDeviceDword@CExistingOS@@QEAAKW4eDeviceDword@1@@Z (Ordinal: 91, Address: 0x42a0)
  • ?GetDeviceDword@CInstallSource@@QEAAKW4eDeviceDword@1@@Z (Ordinal: 92, Address: 0x5890)
  • ?GetDeviceDword@CNewOS@@QEAAKW4eDeviceDword@1@@Z (Ordinal: 93, Address: 0x4c90)
  • ?GetDeviceString@CExistingOS@@QEAAPEBGW4eDeviceString@1@@Z (Ordinal: 94, Address: 0x4260)
  • ?GetDeviceString@CNewOS@@QEAAPEBGW4eDeviceString@1@@Z (Ordinal: 95, Address: 0x4c50)
  • ?GetEdition@CNewOS@@SAPEBGPEAU_BLACKBOARD@@@Z (Ordinal: 96, Address: 0x4590)
  • ?GetFailedInstallCount@CExistingOS@@QEAAKXZ (Ordinal: 97, Address: 0x4350)
  • ?GetHardwareIds@CHardwareID@@QEAAPEAPEBGXZ (Ordinal: 98, Address: 0x2640)
  • ?GetInfo@CCountArray@@QEAAHIAEAK000AEAPEAG@Z (Ordinal: 99, Address: 0x14ee0)
  • ?GetLanguage@CNewOS@@SAPEBGPEAU_BLACKBOARD@@@Z (Ordinal: 100, Address: 0x46d0)
  • ?GetNewOSDetails@CNewOS@@AEAAXXZ (Ordinal: 101, Address: 0x4840)
  • ?GetNewOSVersionInformation@CNewOS@@QEAAXPEAG@Z (Ordinal: 102, Address: 0x4a20)
  • ?GetNumberOfCompatableIDs@CHardwareID@@QEAAKXZ (Ordinal: 103, Address: 0x2630)
  • ?GetNumberOfHardwareIds@CHardwareID@@QEAAKXZ (Ordinal: 104, Address: 0x2620)
  • ?GetNumberOfProcessors@CMoboAndProcInfo@@QEAAKXZ (Ordinal: 105, Address: 0x21c0)
  • ?GetOEMInformation@CExistingOS@@AEAAXXZ (Ordinal: 106, Address: 0x39b0)
  • ?GetProcAddressWidth@CMoboAndProcInfo@@QEAAKXZ (Ordinal: 107, Address: 0x21d0)
  • ?GetProcArchitecture@CMoboAndProcInfo@@QEAAKXZ (Ordinal: 108, Address: 0x21e0)
  • ?GetProcFamily@CMoboAndProcInfo@@QEAAKXZ (Ordinal: 109, Address: 0x21f0)
  • ?GetProcStepping@CMoboAndProcInfo@@QEAAKXZ (Ordinal: 110, Address: 0x2210)
  • ?GetProcessorInfo@CMoboAndProcInfo@@AEAAXXZ (Ordinal: 111, Address: 0x24e0)
  • ?GetProcessorSpeedInMHz@CMoboAndProcInfo@@QEAAKXZ (Ordinal: 112, Address: 0x2200)
  • ?GetProperties@CHardwareID@@AEAAXKPEAXPEAU_SP_DEVINFO_DATA@@PEAV?$CAtlArray@PEBGV?$CElementTraits@PEBG@ATL@@@ATL@@@Z (Ordinal: 113, Address: 0x2a50)
  • ?GetSkuInfo@CExistingOS@@AEAAKPEAK@Z (Ordinal: 114, Address: 0x3f00)
  • ?GetSystemVersionDetails@CExistingOS@@AEAAXXZ (Ordinal: 115, Address: 0x3820)
  • ?GetTotalPhysRAM@CMoboAndProcInfo@@QEAAKXZ (Ordinal: 116, Address: 0x21a0)
  • ?GetWinImageArch@CNewOS@@SAKPEAU_BLACKBOARD@@@Z (Ordinal: 117, Address: 0x4810)
  • ?InLHPlus@CSqmDiagConsumer@@CAHXZ (Ordinal: 118, Address: 0x6150)
  • ?IncrementCount@CCountArray@@QEAAHKKKPEBG@Z (Ordinal: 119, Address: 0x14d20)
  • ?Initialize@CSqmDiagConsumer@@QEAAKKPEAU_GUID@@PEAG1HK@Z (Ordinal: 120, Address: 0x6cc0)
  • ?Initialize@CSqmDiagConsumer@@UEAAKKPEAU_GUID@@@Z (Ordinal: 121, Address: 0x67f0)
  • ?IsAlreadyProcessed@InstallData@@UEAAHPEAU_BLACKBOARD@@@Z (Ordinal: 122, Address: 0x9760)
  • ?IsAlreadyProcessed@MachineHardWare@@UEAAHPEAU_BLACKBOARD@@@Z (Ordinal: 123, Address: 0x8a40)
  • ?IsAlreadyProcessed@NewSystem@@UEAAHPEAU_BLACKBOARD@@@Z (Ordinal: 124, Address: 0x8ef0)
  • ?IsAlreadyProcessed@OldSystem@@UEAAHPEAU_BLACKBOARD@@@Z (Ordinal: 125, Address: 0x9290)
  • ?IsInternal@CInstallSource@@AEAAHXZ (Ordinal: 126, Address: 0x5410)
  • ?IsSubmitSuccessful@CSqmDiagConsumer@@UEAAHPEAG@Z (Ordinal: 127, Address: 0x8440)
  • ?LogErrorMessage@CAccessWMI@@IEAAXPEBGKW4tagLOG_SETUPLOG_SEVERITY@@@Z (Ordinal: 128, Address: 0x12a0)
  • ?LogErrorMessage@CHardwareID@@AEAAXPEBGK@Z (Ordinal: 129, Address: 0x2bf0)
  • ?LogErrorMessageGLE@CHardwareID@@AEAAXPEBGK@Z (Ordinal: 130, Address: 0x2cb0)
  • ?LogFetchInfoError@CAccessWMI@@AEAAXPEBGI@Z (Ordinal: 131, Address: 0x1380)
  • ?LogToBB@InstallData@@UEAAXPEAU_BLACKBOARD@@@Z (Ordinal: 132, Address: 0x97e0)
  • ?LogToBB@MachineHardWare@@UEAAXPEAU_BLACKBOARD@@@Z (Ordinal: 133, Address: 0x8c50)
  • ?LogToBB@NewSystem@@UEAAXPEAU_BLACKBOARD@@@Z (Ordinal: 134, Address: 0x8f70)
  • ?LogToBB@OldSystem@@UEAAXPEAU_BLACKBOARD@@@Z (Ordinal: 135, Address: 0x9310)
  • ?LogToFile@InstallData@@UEAAXXZ (Ordinal: 136, Address: 0x4580)
  • ?LogToFile@MachineHardWare@@UEAAXXZ (Ordinal: 137, Address: 0x8ac0)
  • ?LogToFile@NewSystem@@UEAAXXZ (Ordinal: 138, Address: 0x4580)
  • ?LogToFile@OldSystem@@UEAAXXZ (Ordinal: 139, Address: 0x4580)
  • ?MAX_CHAR_SIZE@CExistingOS@@0HB (Ordinal: 140, Address: 0x1d3b0)
  • ?MAX_CHAR_SIZE@CNewOS@@0HB (Ordinal: 141, Address: 0x1d3b0)
  • Module_Init_Diagnostic (Ordinal: 142, Address: 0xac30)
  • ?NewElement@CCountArray@@AEAAHKKKPEBG@Z (Ordinal: 143, Address: 0x14b00)
  • ?NumElements@CCountArray@@QEAAIXZ (Ordinal: 144, Address: 0x3200)
  • ObtainBucketingParamsFromBlackBoard (Ordinal: 145, Address: 0x115d0)
  • ObtainBucketingParamsFromLogFile (Ordinal: 146, Address: 0x10700)
  • ObtainFilesToAttach (Ordinal: 147, Address: 0x11c60)
  • ProcessDiagnosticDetails (Ordinal: 148, Address: 0xf250)
  • ?ProcessFailedUpload@CSqmDiagConsumer@@CAKPEAG@Z (Ordinal: 149, Address: 0x61c0)
  • ?ResetWmiClassName@CAccessWMI@@IEAAXPEBG@Z (Ordinal: 150, Address: 0x1110)
  • RestoreIniValues (Ordinal: 151, Address: 0xbd20)
  • ?Set@CSqmDiagConsumer@@UEAAKKK@Z (Ordinal: 152, Address: 0x71c0)
  • ?Set@CSqmDiagConsumer@@UEAAKKPEAG@Z (Ordinal: 153, Address: 0x7330)
  • SetFromBlackBoard (Ordinal: 154, Address: 0x123a0)
  • SetFromFile (Ordinal: 155, Address: 0x134d0)
  • ?Shutdown@CSqmDiagConsumer@@UEAAKXZ (Ordinal: 156, Address: 0x85e0)
  • ?SqmUploadCallBack@CSqmDiagConsumer@@CAHJPEBGK@Z (Ordinal: 157, Address: 0x6460)
  • StartNetworking (Ordinal: 158, Address: 0x13cf0)
  • ?Submit@CSqmDiagConsumer@@UEAAKPEAGH@Z (Ordinal: 159, Address: 0x8010)
  • g_DiagERApi (Ordinal: 160, Address: 0x29170)
  • g_Kernel32 (Ordinal: 161, Address: 0x29030)
  • g_Shell32 (Ordinal: 162, Address: 0x29160)
  • g_Sqm (Ordinal: 163, Address: 0x29028)
  • g_Wdscore (Ordinal: 164, Address: 0x29168)
  • ?m_szEdition@CNewOS@@0PAGA (Ordinal: 165, Address: 0x29990)
  • ?m_szLanguage@CNewOS@@0PAGA (Ordinal: 166, Address: 0x29890)

Imported DLLs & Functions

ADVAPI32.dll
  • ConvertStringSecurityDescriptorToSecurityDescriptorW (Address: 0x18001b788)
  • RegCloseKey (Address: 0x18001b790)
  • RegCreateKeyExW (Address: 0x18001b798)
  • RegOpenKeyExW (Address: 0x18001b7b0)
  • RegQueryValueExW (Address: 0x18001b7b8)
  • RegSetKeySecurity (Address: 0x18001b7a0)
  • RegSetValueExW (Address: 0x18001b7a8)
diagER.dll
  • DiagERAddBucketingParameters (Address: 0x18001bda0)
  • DiagERAddFiles (Address: 0x18001bda8)
  • DiagERInitialize (Address: 0x18001bd90)
  • DiagERSetHeader (Address: 0x18001bd98)
  • DiagERSubmit (Address: 0x18001bdb0)
  • DiagERTerminate (Address: 0x18001bd88)
KERNEL32.dll
  • AcquireSRWLockExclusive (Address: 0x18001b818)
  • CloseHandle (Address: 0x18001b988)
  • CompareStringW (Address: 0x18001bb90)
  • CopyFileExW (Address: 0x18001b970)
  • CreateDirectoryW (Address: 0x18001b9d0)
  • CreateEventW (Address: 0x18001ba68)
  • CreateFileMappingW (Address: 0x18001baf0)
  • CreateFileW (Address: 0x18001b980)
  • CreateProcessA (Address: 0x18001ba28)
  • CreateProcessW (Address: 0x18001ba20)
  • CreateThread (Address: 0x18001ba60)
  • DebugBreak (Address: 0x18001bb30)
  • DeleteCriticalSection (Address: 0x18001bab8)
  • DeleteFileW (Address: 0x18001b9c0)
  • DeviceIoControl (Address: 0x18001b7d0)
  • DuplicateHandle (Address: 0x18001b9b8)
  • EnterCriticalSection (Address: 0x18001baa8)
  • ExitProcess (Address: 0x18001ba38)
  • ExpandEnvironmentStringsW (Address: 0x18001bb40)
  • FindClose (Address: 0x18001ba18)
  • FindFirstFileW (Address: 0x18001ba08)
  • FindNextFileW (Address: 0x18001ba10)
  • FindResourceExW (Address: 0x18001b8f0)
  • FreeLibrary (Address: 0x18001b888)
  • GetCommandLineW (Address: 0x18001bb20)
  • GetComputerNameExW (Address: 0x18001ba98)
  • GetCurrentProcess (Address: 0x18001b850)
  • GetCurrentProcessId (Address: 0x18001b7e0)
  • GetCurrentThreadId (Address: 0x18001bb10)
  • GetDiskFreeSpaceExW (Address: 0x18001bae8)
  • GetDiskFreeSpaceW (Address: 0x18001bae0)
  • GetDriveTypeW (Address: 0x18001b8b8)
  • GetEnvironmentVariableW (Address: 0x18001b8f8)
  • GetExitCodeProcess (Address: 0x18001bb38)
  • GetFileAttributesW (Address: 0x18001b8a0)
  • GetFileSize (Address: 0x18001bad0)
  • GetFileType (Address: 0x18001bac8)
  • GetFullPathNameW (Address: 0x18001b898)
  • GetLastError (Address: 0x18001b830)
  • GetLocaleInfoW (Address: 0x18001bb48)
  • GetLocalTime (Address: 0x18001bb78)
  • GetLogicalDrives (Address: 0x18001b998)
  • GetLogicalDriveStringsW (Address: 0x18001b990)
  • GetModuleFileNameW (Address: 0x18001b890)
  • GetOverlappedResult (Address: 0x18001bac0)
  • GetPrivateProfileSectionNamesW (Address: 0x18001bb60)
  • GetPrivateProfileSectionW (Address: 0x18001bb68)
  • GetPrivateProfileStringW (Address: 0x18001bb18)
  • GetProcAddress (Address: 0x18001b848)
  • GetProcessHeap (Address: 0x18001b860)
  • GetShortPathNameW (Address: 0x18001b9f0)
  • GetSystemDefaultLCID (Address: 0x18001b870)
  • GetSystemDirectoryW (Address: 0x18001b878)
  • GetSystemInfo (Address: 0x18001b838)
  • GetSystemTime (Address: 0x18001b8b0)
  • GetSystemTimeAsFileTime (Address: 0x18001bb70)
  • GetTempFileNameW (Address: 0x18001b9e8)
  • GetTempPathW (Address: 0x18001b9e0)
  • GetTickCount (Address: 0x18001ba00)
  • GetTimeZoneInformation (Address: 0x18001b8a8)
  • GetVersionExA (Address: 0x18001b908)
  • GetVersionExW (Address: 0x18001b868)
  • GetVolumeInformationW (Address: 0x18001b8d0)
  • GetVolumePathNameW (Address: 0x18001b8c8)
  • GetWindowsDirectoryW (Address: 0x18001b9c8)
  • GlobalAlloc (Address: 0x18001b948)
  • GlobalFree (Address: 0x18001b960)
  • GlobalLock (Address: 0x18001b950)
  • GlobalMemoryStatus (Address: 0x18001b910)
  • GlobalMemoryStatusEx (Address: 0x18001b840)
  • GlobalSize (Address: 0x18001b968)
  • GlobalUnlock (Address: 0x18001b958)
  • HeapAlloc (Address: 0x18001b8c0)
  • HeapCompact (Address: 0x18001b930)
  • HeapCreate (Address: 0x18001b918)
  • HeapDestroy (Address: 0x18001b920)
  • HeapFree (Address: 0x18001b858)
  • HeapReAlloc (Address: 0x18001b928)
  • HeapSize (Address: 0x18001bb88)
  • HeapValidate (Address: 0x18001b938)
  • HeapWalk (Address: 0x18001b940)
  • InitializeCriticalSection (Address: 0x18001baa0)
  • LeaveCriticalSection (Address: 0x18001bab0)
  • LoadLibraryExA (Address: 0x18001b828)
  • LoadLibraryExW (Address: 0x18001bb28)
  • LoadLibraryW (Address: 0x18001b880)
  • LoadResource (Address: 0x18001b8e8)
  • LocalFree (Address: 0x18001b800)
  • LockResource (Address: 0x18001b8e0)
  • MapViewOfFile (Address: 0x18001baf8)
  • MoveFileExW (Address: 0x18001b978)
  • OpenEventW (Address: 0x18001ba70)
  • OpenProcess (Address: 0x18001ba30)
  • OutputDebugStringA (Address: 0x18001b7d8)
  • QueryPerformanceCounter (Address: 0x18001b7e8)
  • RaiseException (Address: 0x18001bb08)
  • ReadFile (Address: 0x18001b9a0)
  • ReleaseSRWLockExclusive (Address: 0x18001b820)
  • RemoveDirectoryW (Address: 0x18001b9f8)
  • ResetEvent (Address: 0x18001ba88)
  • SetEndOfFile (Address: 0x18001ba58)
  • SetErrorMode (Address: 0x18001bad8)
  • SetEvent (Address: 0x18001ba80)
  • SetFileAttributesW (Address: 0x18001b9d8)
  • SetFilePointer (Address: 0x18001b9b0)
  • SetFileTime (Address: 0x18001ba50)
  • SetLastError (Address: 0x18001b900)
  • SetUnhandledExceptionFilter (Address: 0x18001b7f0)
  • SizeofResource (Address: 0x18001b8d8)
  • Sleep (Address: 0x18001ba90)
  • SystemTimeToFileTime (Address: 0x18001bb80)
  • TerminateProcess (Address: 0x18001ba40)
  • UnhandledExceptionFilter (Address: 0x18001b7f8)
  • UnmapViewOfFile (Address: 0x18001bb00)
  • VirtualAlloc (Address: 0x18001bb50)
  • VirtualFree (Address: 0x18001b808)
  • VirtualProtect (Address: 0x18001b7c8)
  • VirtualQuery (Address: 0x18001b810)
  • WaitForMultipleObjectsEx (Address: 0x18001ba78)
  • WaitForSingleObject (Address: 0x18001ba48)
  • WriteFile (Address: 0x18001b9a8)
  • WritePrivateProfileStringW (Address: 0x18001bb58)
msvcrt.dll
  • __C_specific_handler (Address: 0x18001bde8)
  • __CxxFrameHandler3 (Address: 0x18001bf00)
  • __dllonexit (Address: 0x18001be48)
  • _amsg_exit (Address: 0x18001be78)
  • _callnewh (Address: 0x18001be88)
  • _CxxThrowException (Address: 0x18001be08)
  • _errno (Address: 0x18001be20)
  • _initterm (Address: 0x18001be70)
  • _lock (Address: 0x18001be58)
  • _onexit (Address: 0x18001be38)
  • _purecall (Address: 0x18001bec8)
  • _unlock (Address: 0x18001be50)
  • _vscwprintf (Address: 0x18001be40)
  • _vsnprintf (Address: 0x18001be28)
  • _vsnwprintf (Address: 0x18001bee8)
  • _wcsicmp (Address: 0x18001bef8)
  • _wcslwr_s (Address: 0x18001bee0)
  • _wcsnicmp (Address: 0x18001be30)
  • _wfopen (Address: 0x18001bdc0)
  • _wtoi (Address: 0x18001bea0)
  • _wtoi64 (Address: 0x18001bdd0)
  • _wtol (Address: 0x18001bdc8)
  • _XcptFilter (Address: 0x18001be80)
  • ??1type_info@@UEAA@XZ (Address: 0x18001be60)
  • ?terminate@@YAXXZ (Address: 0x18001be68)
  • calloc (Address: 0x18001beb0)
  • fclose (Address: 0x18001bdd8)
  • fgetws (Address: 0x18001bef0)
  • free (Address: 0x18001bea8)
  • malloc (Address: 0x18001bde0)
  • memcpy (Address: 0x18001be00)
  • memcpy_s (Address: 0x18001be98)
  • memmove_s (Address: 0x18001beb8)
  • memset (Address: 0x18001be10)
  • realloc (Address: 0x18001be18)
  • vswprintf_s (Address: 0x18001be90)
  • wcschr (Address: 0x18001bec0)
  • wcscmp (Address: 0x18001bf08)
  • wcsncmp (Address: 0x18001bdf8)
  • wcsrchr (Address: 0x18001bed0)
  • wcsstr (Address: 0x18001bdf0)
  • wcstok_s (Address: 0x18001bed8)
ntdll.dll
  • RtlAllocateHeap (Address: 0x18001bf30)
  • RtlCaptureContext (Address: 0x18001bf18)
  • RtlFreeHeap (Address: 0x18001bf38)
  • RtlGetThreadErrorMode (Address: 0x18001bf48)
  • RtlLookupFunctionEntry (Address: 0x18001bf20)
  • RtlSetThreadErrorMode (Address: 0x18001bf40)
  • RtlVirtualUnwind (Address: 0x18001bf28)
ole32.dll
  • CoCreateGuid (Address: 0x18001bf78)
  • CoCreateInstance (Address: 0x18001bf60)
  • CoInitializeEx (Address: 0x18001bf80)
  • CoInitializeSecurity (Address: 0x18001bf58)
  • CoSetProxyBlanket (Address: 0x18001bf68)
  • CoUninitialize (Address: 0x18001bf70)
OLEAUT32.dll
  • SysAllocString (Address: 0x18001bbc0)
  • SysAllocStringByteLen (Address: 0x18001bba8)
  • SysFreeString (Address: 0x18001bba0)
  • SysStringLen (Address: 0x18001bbb0)
  • VariantChangeType (Address: 0x18001bbb8)
SETUPAPI.dll
  • SetupDiDestroyDeviceInfoList (Address: 0x18001bbe0)
  • SetupDiEnumDeviceInfo (Address: 0x18001bbd0)
  • SetupDiGetClassDevsW (Address: 0x18001bbd8)
  • SetupDiGetDeviceRegistryPropertyW (Address: 0x18001bbe8)
SHELL32.dll
  • ExtractIconExW (Address: 0x18001bc00)
  • ShellExecuteExW (Address: 0x18001bbf8)
SHLWAPI.dll
  • PathAppendW (Address: 0x18001bc18)
  • PathCombineW (Address: 0x18001bc20)
  • PathFileExistsW (Address: 0x18001bc10)
UNATTEND.DLL
  • UnattendGetFlag (Address: 0x18001bc30)
USER32.dll
  • CharLowerW (Address: 0x18001bc48)
  • CharNextW (Address: 0x18001bc50)
  • CharUpperW (Address: 0x18001bc60)
  • GetSystemMetrics (Address: 0x18001bc58)
  • UnregisterClassA (Address: 0x18001bc40)
VERSION.dll
  • GetFileVersionInfoExW (Address: 0x18001bc70)
  • GetFileVersionInfoSizeExW (Address: 0x18001bc80)
  • VerQueryValueW (Address: 0x18001bc78)
WDSCORE.dll
  • ConstructPartialMsgVW (Address: 0x18001bd38)
  • CurrentIP (Address: 0x18001bd40)
  • EndMajorTask (Address: 0x18001bd68)
  • EndMinorTask (Address: 0x18001bcc0)
  • StartMajorTask (Address: 0x18001bce8)
  • StartMinorTask (Address: 0x18001bcc8)
  • WdsAbortBlackboardItemEnum (Address: 0x18001bd50)
  • WdsAddModule (Address: 0x18001bcf8)
  • WdsCreateBlackboard (Address: 0x18001bca0)
  • WdsDestroyBlackboard (Address: 0x18001bca8)
  • WdsEnumFirstBlackboardItem (Address: 0x18001bcd8)
  • WdsEnumNextBlackboardItem (Address: 0x18001bcd0)
  • WdsFreeData (Address: 0x18001bce0)
  • WdsGetBlackboardValue (Address: 0x18001bc90)
  • WdsInitializeCallbackArray (Address: 0x18001bd20)
  • WdsInitializeDataBinary (Address: 0x18001bd58)
  • WdsInitializeDataStringW (Address: 0x18001bc98)
  • WdsInitializeDataUInt32 (Address: 0x18001bcb8)
  • WdsInitializeDataUInt64 (Address: 0x18001bcb0)
  • WdsPublish (Address: 0x18001bd18)
  • WdsPublishImmediateAsync (Address: 0x18001bcf0)
  • WdsPublishImmediateEx (Address: 0x18001bd00)
  • WdsSetBlackboardValue (Address: 0x18001bd60)
  • WdsSetNextExecutionGroup (Address: 0x18001bd08)
  • WdsSetupLogDestroy (Address: 0x18001bd28)
  • WdsSetupLogInit (Address: 0x18001bd30)
  • WdsSetupLogMessageW (Address: 0x18001bd48)
  • WdsSubscribeEx (Address: 0x18001bd10)
WDSUTIL.dll
  • ?IsUpgrade@CUpgradeUserSetting@@SAHXZ (Address: 0x18001bd78)