Faultrep.dll
Description: Windows User Mode Crash Reporting DLL
Authors: © Microsoft Corporation. All rights reserved.
Version: 10.0.19041.5794
Architecture: 32-bit
Operating System: Windows NT
SHA256: b64dc51ae7deae051a122a1fa00729ea
File Size: 408.1 KB
Uploaded At: Dec. 1, 2025, 7:56 a.m.
Views: 6
Security Warning
This file has been flagged as potentially dangerous.
Reason: Detected potentially dangerous functions used for process injection: WriteProcessMemory, OpenProcess, CreateRemoteThread, VirtualAllocEx
Exported Functions
- (Ordinal: 1, Address: 0x12fa0)
- (Ordinal: 2, Address: 0x12fd0)
- BasepReportFault (Ordinal: 3, Address: 0x13550)
- CheckForReadOnlyResourceFilter (Ordinal: 4, Address: 0x13580)
- CheckPerUserCrossProcessThrottle (Ordinal: 5, Address: 0x12ba0)
- UpdatePerUserLastCrossProcessCollectionTime (Ordinal: 6, Address: 0x12c00)
- AddERExcludedApplicationA (Ordinal: 7, Address: 0x14220)
- AddERExcludedApplicationW (Ordinal: 8, Address: 0x141f0)
- CancelHangReporting (Ordinal: 9, Address: 0x13080)
- DllCanUnloadNow (Ordinal: 10, Address: 0xe080)
- DllGetClassObject (Ordinal: 11, Address: 0xe0b0)
- ReportCoreHang (Ordinal: 12, Address: 0x13000)
- ReportFault (Ordinal: 13, Address: 0x141b0)
- ReportHang (Ordinal: 14, Address: 0x12f80)
- WerReportHang (Ordinal: 15, Address: 0x13030)
- WerpGetDebugger (Ordinal: 16, Address: 0x1d7b0)
- WerpInitiateCrashReporting (Ordinal: 17, Address: 0x13d80)
- WerpLaunchAeDebug (Ordinal: 18, Address: 0x1daf0)
Imported DLLs & Functions
api-ms-win-core-apiquery-l1-1-0.dll
- ApiSetQueryApiSetPresence (Address: 0x10049060)
api-ms-win-core-com-l1-1-0.dll
- CoCreateInstance (Address: 0x10049084)
- CoGetMalloc (Address: 0x10049080)
- CoImpersonateClient (Address: 0x1004908c)
- CoInitializeEx (Address: 0x1004907c)
- CoRevertToSelf (Address: 0x1004906c)
- CoSetProxyBlanket (Address: 0x10049078)
- CoTaskMemAlloc (Address: 0x10049070)
- CoTaskMemFree (Address: 0x10049068)
- CoUninitialize (Address: 0x10049088)
- CoUnmarshalInterface (Address: 0x10049074)
api-ms-win-core-com-midlproxystub-l1-1-0.dll
- ObjectStublessClient3 (Address: 0x10049098)
- ObjectStublessClient4 (Address: 0x1004909c)
- ObjectStublessClient5 (Address: 0x100490a0)
- ObjectStublessClient6 (Address: 0x10049094)
api-ms-win-core-debug-l1-1-0.dll
- DebugBreak (Address: 0x100490ac)
- IsDebuggerPresent (Address: 0x100490b0)
- OutputDebugStringW (Address: 0x100490a8)
api-ms-win-core-debug-l1-1-1.dll
- CheckRemoteDebuggerPresent (Address: 0x100490b8)
api-ms-win-core-delayload-l1-1-0.dll
- DelayLoadFailureHook (Address: 0x100490c0)
api-ms-win-core-delayload-l1-1-1.dll
- ResolveDelayLoadedAPI (Address: 0x100490c8)
api-ms-win-core-errorhandling-l1-1-0.dll
- GetLastError (Address: 0x100490d4)
- RaiseException (Address: 0x100490e0)
- SetErrorMode (Address: 0x100490dc)
- SetLastError (Address: 0x100490d0)
- SetUnhandledExceptionFilter (Address: 0x100490e4)
- UnhandledExceptionFilter (Address: 0x100490d8)
api-ms-win-core-errorhandling-l1-1-3.dll
- SetThreadErrorMode (Address: 0x100490ec)
api-ms-win-core-file-l1-1-0.dll
- CompareFileTime (Address: 0x10049108)
- CreateDirectoryW (Address: 0x1004913c)
- CreateFileW (Address: 0x1004912c)
- DeleteFileW (Address: 0x10049144)
- FindClose (Address: 0x1004911c)
- FindFirstFileW (Address: 0x10049118)
- FindNextFileW (Address: 0x10049104)
- FlushFileBuffers (Address: 0x10049130)
- GetDriveTypeW (Address: 0x10049110)
- GetFileAttributesW (Address: 0x10049140)
- GetFinalPathNameByHandleW (Address: 0x100490f4)
- GetLogicalDriveStringsW (Address: 0x100490f8)
- GetLongPathNameW (Address: 0x10049138)
- GetTempFileNameW (Address: 0x10049128)
- QueryDosDeviceW (Address: 0x1004910c)
- ReadFile (Address: 0x10049100)
- SetEndOfFile (Address: 0x100490fc)
- SetFileAttributesW (Address: 0x10049120)
- SetFileInformationByHandle (Address: 0x10049124)
- SetFilePointerEx (Address: 0x10049134)
- WriteFile (Address: 0x10049114)
api-ms-win-core-file-l1-2-0.dll
- GetTempPathW (Address: 0x1004914c)
api-ms-win-core-file-l2-1-0.dll
- MoveFileExW (Address: 0x10049154)
api-ms-win-core-handle-l1-1-0.dll
- CloseHandle (Address: 0x10049160)
- DuplicateHandle (Address: 0x1004915c)
api-ms-win-core-heap-l1-1-0.dll
- GetProcessHeap (Address: 0x1004916c)
- HeapAlloc (Address: 0x10049170)
- HeapFree (Address: 0x10049168)
api-ms-win-core-heap-l2-1-0.dll
- LocalFree (Address: 0x10049178)
api-ms-win-core-libraryloader-l1-2-0.dll
- DisableThreadLibraryCalls (Address: 0x10049184)
- FreeLibrary (Address: 0x100491a0)
- FreeLibraryAndExitThread (Address: 0x100491a4)
- GetModuleFileNameA (Address: 0x10049198)
- GetModuleFileNameW (Address: 0x1004919c)
- GetModuleHandleExW (Address: 0x1004918c)
- GetModuleHandleW (Address: 0x10049180)
- GetProcAddress (Address: 0x10049188)
- LoadLibraryExW (Address: 0x10049190)
- LoadStringW (Address: 0x10049194)
api-ms-win-core-libraryloader-l1-2-1.dll
- LoadLibraryW (Address: 0x100491ac)
api-ms-win-core-localization-l1-2-0.dll
- FormatMessageW (Address: 0x100491b4)
- LCMapStringW (Address: 0x100491b8)
api-ms-win-core-localization-obsolete-l1-2-0.dll
- GetUserDefaultUILanguage (Address: 0x100491c0)
api-ms-win-core-memory-l1-1-0.dll
- CreateFileMappingW (Address: 0x100491ec)
- MapViewOfFile (Address: 0x100491dc)
- ReadProcessMemory (Address: 0x100491e4)
- UnmapViewOfFile (Address: 0x100491e0)
- VirtualAlloc (Address: 0x100491e8)
- VirtualAllocEx (Address: 0x100491d8)
- VirtualFree (Address: 0x100491c8)
- VirtualFreeEx (Address: 0x100491f0)
- VirtualQuery (Address: 0x100491d0)
- VirtualQueryEx (Address: 0x100491d4)
- WriteProcessMemory (Address: 0x100491cc)
api-ms-win-core-processenvironment-l1-1-0.dll
- ExpandEnvironmentStringsW (Address: 0x100491f8)
- SearchPathW (Address: 0x10049200)
- SetEnvironmentVariableW (Address: 0x100491fc)
api-ms-win-core-processsnapshot-l1-1-0.dll
- PssDuplicateSnapshot (Address: 0x1004920c)
- PssFreeSnapshot (Address: 0x10049218)
- PssQuerySnapshot (Address: 0x10049214)
- PssWalkMarkerCreate (Address: 0x10049210)
- PssWalkMarkerFree (Address: 0x10049208)
api-ms-win-core-processthreads-l1-1-0.dll
- CreateProcessW (Address: 0x10049248)
- CreateRemoteThread (Address: 0x10049268)
- CreateThread (Address: 0x10049240)
- DeleteProcThreadAttributeList (Address: 0x10049228)
- GetCurrentProcess (Address: 0x1004924c)
- GetCurrentProcessId (Address: 0x1004922c)
- GetCurrentThread (Address: 0x10049258)
- GetCurrentThreadId (Address: 0x10049224)
- GetExitCodeProcess (Address: 0x10049260)
- GetExitCodeThread (Address: 0x10049238)
- GetProcessId (Address: 0x10049234)
- GetProcessTimes (Address: 0x10049230)
- GetThreadId (Address: 0x1004925c)
- GetThreadPriority (Address: 0x1004923c)
- InitializeProcThreadAttributeList (Address: 0x1004926c)
- OpenProcessToken (Address: 0x10049244)
- OpenThread (Address: 0x10049250)
- SetThreadPriority (Address: 0x10049220)
- TerminateProcess (Address: 0x10049254)
- UpdateProcThreadAttribute (Address: 0x10049264)
api-ms-win-core-processthreads-l1-1-1.dll
- GetThreadContext (Address: 0x10049278)
- OpenProcess (Address: 0x10049274)
api-ms-win-core-profile-l1-1-0.dll
- QueryPerformanceCounter (Address: 0x10049280)
- QueryPerformanceFrequency (Address: 0x10049284)
api-ms-win-core-psapi-l1-1-0.dll
- K32EnumProcesses (Address: 0x10049298)
- K32EnumProcessModules (Address: 0x10049294)
- K32GetMappedFileNameW (Address: 0x10049290)
- K32GetModuleFileNameExW (Address: 0x1004929c)
- K32GetProcessImageFileNameW (Address: 0x1004928c)
- QueryFullProcessImageNameW (Address: 0x100492a0)
api-ms-win-core-registry-l1-1-0.dll
- RegCloseKey (Address: 0x100492d0)
- RegCreateKeyExW (Address: 0x100492b4)
- RegDeleteValueW (Address: 0x100492a8)
- RegEnumKeyExW (Address: 0x100492ac)
- RegGetKeySecurity (Address: 0x100492b0)
- RegGetValueW (Address: 0x100492b8)
- RegOpenKeyExW (Address: 0x100492c8)
- RegQueryInfoKeyW (Address: 0x100492cc)
- RegQueryValueExW (Address: 0x100492c4)
- RegSetKeySecurity (Address: 0x100492bc)
- RegSetValueExW (Address: 0x100492c0)
api-ms-win-core-registry-l1-1-1.dll
- RegSetKeyValueW (Address: 0x100492d8)
api-ms-win-core-registry-l2-1-0.dll
- RegDeleteKeyA (Address: 0x100492e0)
- RegDeleteKeyW (Address: 0x100492e4)
api-ms-win-core-shlwapi-obsolete-l1-1-0.dll
- StrStrIW (Address: 0x100492ec)
api-ms-win-core-string-l1-1-0.dll
- CompareStringW (Address: 0x100492f8)
- MultiByteToWideChar (Address: 0x100492fc)
- WideCharToMultiByte (Address: 0x100492f4)
api-ms-win-core-synch-l1-1-0.dll
- AcquireSRWLockExclusive (Address: 0x10049330)
- AcquireSRWLockShared (Address: 0x10049308)
- CreateEventW (Address: 0x1004935c)
- CreateMutexExW (Address: 0x1004932c)
- CreateMutexW (Address: 0x10049320)
- CreateSemaphoreExW (Address: 0x10049358)
- DeleteCriticalSection (Address: 0x10049338)
- EnterCriticalSection (Address: 0x1004933c)
- InitializeCriticalSection (Address: 0x10049334)
- InitializeCriticalSectionEx (Address: 0x10049350)
- InitializeSRWLock (Address: 0x10049328)
- LeaveCriticalSection (Address: 0x10049340)
- OpenEventW (Address: 0x10049344)
- OpenMutexW (Address: 0x1004931c)
- OpenSemaphoreW (Address: 0x10049314)
- ReleaseMutex (Address: 0x10049304)
- ReleaseSemaphore (Address: 0x10049354)
- ReleaseSRWLockExclusive (Address: 0x10049324)
- ReleaseSRWLockShared (Address: 0x10049348)
- ResetEvent (Address: 0x10049318)
- SetEvent (Address: 0x1004934c)
- WaitForSingleObject (Address: 0x1004930c)
- WaitForSingleObjectEx (Address: 0x10049310)
api-ms-win-core-synch-l1-2-0.dll
- InitOnceBeginInitialize (Address: 0x10049368)
- InitOnceComplete (Address: 0x1004936c)
- Sleep (Address: 0x10049364)
api-ms-win-core-synch-l1-2-1.dll
- WaitForMultipleObjects (Address: 0x10049374)
api-ms-win-core-sysinfo-l1-1-0.dll
- GetSystemDirectoryW (Address: 0x10049384)
- GetSystemInfo (Address: 0x1004939c)
- GetSystemTime (Address: 0x1004938c)
- GetSystemTimeAsFileTime (Address: 0x10049398)
- GetTickCount (Address: 0x10049394)
- GetTickCount64 (Address: 0x10049390)
- GetVersionExW (Address: 0x10049388)
- GetWindowsDirectoryW (Address: 0x10049380)
- GlobalMemoryStatusEx (Address: 0x1004937c)
api-ms-win-core-threadpool-l1-2-0.dll
- CloseThreadpoolTimer (Address: 0x100493ac)
- CloseThreadpoolWait (Address: 0x100493b0)
- CreateThreadpoolTimer (Address: 0x100493a4)
- CreateThreadpoolWait (Address: 0x100493b4)
- SetThreadpoolTimer (Address: 0x100493bc)
- SetThreadpoolWait (Address: 0x100493a8)
- WaitForThreadpoolTimerCallbacks (Address: 0x100493c0)
- WaitForThreadpoolWaitCallbacks (Address: 0x100493b8)
api-ms-win-core-timezone-l1-1-0.dll
- FileTimeToSystemTime (Address: 0x100493cc)
- SystemTimeToFileTime (Address: 0x100493c8)
api-ms-win-core-toolhelp-l1-1-0.dll
- CreateToolhelp32Snapshot (Address: 0x100493e0)
- Module32FirstW (Address: 0x100493dc)
- Module32NextW (Address: 0x100493d4)
- Process32FirstW (Address: 0x100493ec)
- Process32NextW (Address: 0x100493d8)
- Thread32First (Address: 0x100493e8)
- Thread32Next (Address: 0x100493e4)
api-ms-win-core-version-l1-1-0.dll
- GetFileVersionInfoExW (Address: 0x100493f4)
- GetFileVersionInfoSizeExW (Address: 0x100493fc)
- VerQueryValueW (Address: 0x100493f8)
api-ms-win-core-windowserrorreporting-l1-1-0.dll
- GetApplicationRecoveryCallback (Address: 0x10049408)
- WerGetFlags (Address: 0x10049404)
api-ms-win-core-winrt-l1-1-0.dll
- RoGetActivationFactory (Address: 0x10049418)
- RoInitialize (Address: 0x10049414)
- RoUninitialize (Address: 0x10049410)
api-ms-win-core-winrt-string-l1-1-0.dll
- WindowsCreateStringReference (Address: 0x10049420)
api-ms-win-core-wow64-l1-1-0.dll
- IsWow64Process (Address: 0x10049428)
api-ms-win-core-wow64-l1-1-1.dll
- GetSystemWow64Directory2W (Address: 0x10049434)
- GetSystemWow64DirectoryW (Address: 0x10049438)
- IsWow64Process2 (Address: 0x10049430)
api-ms-win-eventing-provider-l1-1-0.dll
- EventProviderEnabled (Address: 0x10049448)
- EventRegister (Address: 0x10049450)
- EventSetInformation (Address: 0x10049440)
- EventUnregister (Address: 0x10049444)
- EventWrite (Address: 0x10049454)
- EventWriteTransfer (Address: 0x1004944c)
api-ms-win-eventlog-legacy-l1-1-0.dll
- DeregisterEventSource (Address: 0x1004945c)
- RegisterEventSourceW (Address: 0x10049464)
- ReportEventW (Address: 0x10049460)
api-ms-win-security-base-l1-1-0.dll
- AdjustTokenGroups (Address: 0x10049490)
- AdjustTokenPrivileges (Address: 0x10049498)
- AllocateAndInitializeSid (Address: 0x10049488)
- CheckTokenMembership (Address: 0x10049494)
- CopySid (Address: 0x1004946c)
- CreateWellKnownSid (Address: 0x10049470)
- DuplicateToken (Address: 0x10049478)
- FreeSid (Address: 0x1004949c)
- GetLengthSid (Address: 0x10049474)
- GetSidSubAuthority (Address: 0x10049480)
- GetSidSubAuthorityCount (Address: 0x10049484)
- GetTokenInformation (Address: 0x1004947c)
- ImpersonateLoggedOnUser (Address: 0x1004948c)
- IsValidSid (Address: 0x100494a4)
- RevertToSelf (Address: 0x100494a0)
api-ms-win-security-lsalookup-l2-1-0.dll
- LookupAccountSidW (Address: 0x100494ac)
- LookupPrivilegeValueW (Address: 0x100494b0)
api-ms-win-security-sddl-l1-1-0.dll
- ConvertSidToStringSidW (Address: 0x100494b8)
- ConvertStringSecurityDescriptorToSecurityDescriptorW (Address: 0x100494bc)
api-ms-win-security-trustee-l1-1-0.dll
- BuildSecurityDescriptorW (Address: 0x100494c4)
api-ms-win-service-management-l1-1-0.dll
- CloseServiceHandle (Address: 0x100494d0)
- OpenSCManagerW (Address: 0x100494d8)
- OpenServiceW (Address: 0x100494cc)
- StartServiceW (Address: 0x100494d4)
api-ms-win-service-private-l1-1-0.dll
- I_QueryTagInformation (Address: 0x100494e0)
api-ms-win-shcore-obsolete-l1-1-0.dll
- CommandLineToArgvW (Address: 0x100494e8)
dbghelp.dll
- MiniDumpWriteDump (Address: 0x10049508)
- StackWalk64 (Address: 0x100494fc)
- SymCleanup (Address: 0x100494f4)
- SymFunctionTableAccess64 (Address: 0x100494f8)
- SymGetModuleBase64 (Address: 0x100494f0)
- SymGetModuleInfoW64 (Address: 0x10049504)
- SymInitialize (Address: 0x10049500)
KERNELBASE.dll
- CreateProcessAsUserW (Address: 0x10049000)
- LocalAlloc (Address: 0x10049004)
msvcrt.dll
- __CxxFrameHandler3 (Address: 0x1004955c)
- __dllonexit (Address: 0x10049538)
- _amsg_exit (Address: 0x10049560)
- _callnewh (Address: 0x10049554)
- _CxxThrowException (Address: 0x10049514)
- _except_handler4_common (Address: 0x10049528)
- _initterm (Address: 0x10049544)
- _local_unwind4 (Address: 0x10049558)
- _lock (Address: 0x10049540)
- _onexit (Address: 0x10049534)
- _purecall (Address: 0x10049550)
- _unlock (Address: 0x1004953c)
- _vsnprintf_s (Address: 0x1004956c)
- _vsnwprintf (Address: 0x10049580)
- _XcptFilter (Address: 0x10049564)
- ??0exception@@QAE@ABV0@@Z (Address: 0x10049570)
- ??0exception@@QAE@XZ (Address: 0x10049574)
- ??1exception@@UAE@XZ (Address: 0x10049578)
- ??1type_info@@UAE@XZ (Address: 0x1004952c)
- ?terminate@@YAXXZ (Address: 0x10049530)
- free (Address: 0x10049568)
- malloc (Address: 0x10049548)
- memcmp (Address: 0x1004951c)
- memcpy (Address: 0x10049520)
- memcpy_s (Address: 0x1004957c)
- memmove (Address: 0x10049524)
- memset (Address: 0x10049588)
- rand (Address: 0x10049518)
- realloc (Address: 0x10049510)
- srand (Address: 0x10049584)
- time (Address: 0x1004954c)
ntdll.dll
- _errno (Address: 0x100496cc)
- _vscwprintf (Address: 0x100496ec)
- _wcsicmp (Address: 0x100496e4)
- _wcsnicmp (Address: 0x100496e8)
- _wcstoui64 (Address: 0x100495b4)
- _wtoi (Address: 0x100496d8)
- DbgPrint (Address: 0x100495b8)
- DbgPrintEx (Address: 0x100496f0)
- EtwCheckCoverage (Address: 0x1004961c)
- EtwEventWriteNoRegistration (Address: 0x10049654)
- EtwGetTraceEnableFlags (Address: 0x100496fc)
- EtwGetTraceEnableLevel (Address: 0x10049700)
- EtwGetTraceLoggerHandle (Address: 0x10049704)
- EtwRegisterTraceGuidsW (Address: 0x100496f8)
- EtwTraceMessage (Address: 0x10049708)
- EtwUnregisterTraceGuids (Address: 0x100496f4)
- isspace (Address: 0x100495bc)
- iswspace (Address: 0x100496e0)
- memmove_s (Address: 0x100495d4)
- NtAllocateVirtualMemory (Address: 0x100495a4)
- NtAlpcConnectPort (Address: 0x1004966c)
- NtAlpcSendWaitReceivePort (Address: 0x10049670)
- NtClearEvent (Address: 0x100495e4)
- NtClose (Address: 0x100496a0)
- NtCreateFile (Address: 0x1004959c)
- NtDeviceIoControlFile (Address: 0x100495a0)
- NtFreeVirtualMemory (Address: 0x100495a8)
- NtOpenEvent (Address: 0x1004965c)
- NtOpenKey (Address: 0x10049604)
- NtOpenProcess (Address: 0x10049698)
- NtQueryEvent (Address: 0x10049690)
- NtQueryInformationProcess (Address: 0x100496c4)
- NtQueryInformationThread (Address: 0x100495b0)
- NtQueryInformationToken (Address: 0x10049684)
- NtQueryLicenseValue (Address: 0x10049688)
- NtQuerySystemInformation (Address: 0x10049658)
- NtQueryValueKey (Address: 0x100495fc)
- NtResumeProcess (Address: 0x10049628)
- NtResumeThread (Address: 0x10049630)
- NtSetInformationFile (Address: 0x10049694)
- NtSetInformationProcess (Address: 0x10049620)
- NtSetSystemInformation (Address: 0x10049640)
- NtSuspendProcess (Address: 0x10049634)
- NtSuspendThread (Address: 0x1004962c)
- NtSystemDebugControl (Address: 0x100496b8)
- NtWaitForMultipleObjects (Address: 0x100495e8)
- NtWaitForSingleObject (Address: 0x10049660)
- PssNtCaptureSnapshot (Address: 0x1004969c)
- PssNtFreeSnapshot (Address: 0x10049648)
- RtlAcquireSRWLockExclusive (Address: 0x10049590)
- RtlAdjustPrivilege (Address: 0x100495ac)
- RtlAllocateAndInitializeSid (Address: 0x10049664)
- RtlAllocateHeap (Address: 0x100495c8)
- RtlCompareMemory (Address: 0x100496b4)
- RtlCompareUnicodeString (Address: 0x1004967c)
- RtlCreateProcessReflection (Address: 0x100496c0)
- RtlDecodeSystemPointer (Address: 0x100495e0)
- RtlDetermineDosPathNameType_U (Address: 0x100495f8)
- RtlFreeHeap (Address: 0x100495c4)
- RtlFreeSid (Address: 0x10049674)
- RtlGetCurrentTransaction (Address: 0x100495f0)
- RtlGetNtSystemRoot (Address: 0x100495f4)
- RtlGetUnloadEventTraceEx (Address: 0x10049618)
- RtlIdentifierAuthoritySid (Address: 0x1004963c)
- RtlImageNtHeaderEx (Address: 0x1004968c)
- RtlInitUnicodeString (Address: 0x10049668)
- RtlInitUnicodeStringEx (Address: 0x10049600)
- RtlNtStatusToDosError (Address: 0x100495dc)
- RtlNtStatusToDosErrorNoTeb (Address: 0x10049680)
- RtlQueryResourcePolicy (Address: 0x10049678)
- RtlQueryWnfStateData (Address: 0x100495d0)
- RtlReleasePebLock (Address: 0x1004960c)
- RtlReleaseSRWLockExclusive (Address: 0x10049594)
- RtlSecondsSince1970ToTime (Address: 0x100496a4)
- RtlSetCurrentTransaction (Address: 0x100495ec)
- RtlSetThreadErrorMode (Address: 0x100495c0)
- RtlSleepConditionVariableSRW (Address: 0x1004970c)
- RtlSubAuthorityCountSid (Address: 0x10049638)
- RtlTryAcquirePebLock (Address: 0x10049614)
- RtlWakeAllConditionVariable (Address: 0x10049644)
- RtlWerpReportException (Address: 0x100496bc)
- swprintf_s (Address: 0x100496a8)
- tolower (Address: 0x100495cc)
- toupper (Address: 0x100496d4)
- towlower (Address: 0x10049624)
- wcscat_s (Address: 0x100496ac)
- wcschr (Address: 0x100496dc)
- wcscpy_s (Address: 0x10049598)
- wcsncmp (Address: 0x10049610)
- wcsncpy_s (Address: 0x100496b0)
- wcsrchr (Address: 0x100496d0)
- wcsstr (Address: 0x10049608)
- wcstoul (Address: 0x100496c8)
- ZwQueryInformationThread (Address: 0x100495d8)
- ZwQueryWnfStateNameInformation (Address: 0x1004964c)
- ZwUpdateWnfStateData (Address: 0x10049650)
RPCRT4.dll
- CStdStubBuffer_AddRef (Address: 0x10049048)
- CStdStubBuffer_Connect (Address: 0x10049054)
- CStdStubBuffer_CountRefs (Address: 0x1004900c)
- CStdStubBuffer_DebugServerQueryInterface (Address: 0x10049040)
- CStdStubBuffer_DebugServerRelease (Address: 0x10049018)
- CStdStubBuffer_Disconnect (Address: 0x10049024)
- CStdStubBuffer_Invoke (Address: 0x10049038)
- CStdStubBuffer_IsIIDSupported (Address: 0x1004903c)
- CStdStubBuffer_QueryInterface (Address: 0x10049010)
- IUnknown_AddRef_Proxy (Address: 0x10049044)
- IUnknown_QueryInterface_Proxy (Address: 0x1004902c)
- IUnknown_Release_Proxy (Address: 0x10049030)
- NdrCStdStubBuffer_Release (Address: 0x10049058)
- NdrDllCanUnloadNow (Address: 0x10049050)
- NdrDllGetClassObject (Address: 0x1004904c)
- NdrOleAllocate (Address: 0x10049034)
- NdrOleFree (Address: 0x10049014)
- RpcStringFreeW (Address: 0x10049028)
- UuidCreate (Address: 0x10049020)
- UuidToStringW (Address: 0x1004901c)