Faultrep.dll

Description: Windows User Mode Crash Reporting DLL

Authors: © Microsoft Corporation. All rights reserved.

Version: 10.0.19041.5794

Architecture: 32-bit

Operating System: Windows NT

SHA256: b64dc51ae7deae051a122a1fa00729ea

File Size: 408.1 KB

Uploaded At: Dec. 1, 2025, 7:56 a.m.

Views: 6

Security Warning

This file has been flagged as potentially dangerous.


Reason: Detected potentially dangerous functions used for process injection: WriteProcessMemory, OpenProcess, CreateRemoteThread, VirtualAllocEx

Exported Functions

  • (Ordinal: 1, Address: 0x12fa0)
  • (Ordinal: 2, Address: 0x12fd0)
  • BasepReportFault (Ordinal: 3, Address: 0x13550)
  • CheckForReadOnlyResourceFilter (Ordinal: 4, Address: 0x13580)
  • CheckPerUserCrossProcessThrottle (Ordinal: 5, Address: 0x12ba0)
  • UpdatePerUserLastCrossProcessCollectionTime (Ordinal: 6, Address: 0x12c00)
  • AddERExcludedApplicationA (Ordinal: 7, Address: 0x14220)
  • AddERExcludedApplicationW (Ordinal: 8, Address: 0x141f0)
  • CancelHangReporting (Ordinal: 9, Address: 0x13080)
  • DllCanUnloadNow (Ordinal: 10, Address: 0xe080)
  • DllGetClassObject (Ordinal: 11, Address: 0xe0b0)
  • ReportCoreHang (Ordinal: 12, Address: 0x13000)
  • ReportFault (Ordinal: 13, Address: 0x141b0)
  • ReportHang (Ordinal: 14, Address: 0x12f80)
  • WerReportHang (Ordinal: 15, Address: 0x13030)
  • WerpGetDebugger (Ordinal: 16, Address: 0x1d7b0)
  • WerpInitiateCrashReporting (Ordinal: 17, Address: 0x13d80)
  • WerpLaunchAeDebug (Ordinal: 18, Address: 0x1daf0)

Imported DLLs & Functions

api-ms-win-core-apiquery-l1-1-0.dll
  • ApiSetQueryApiSetPresence (Address: 0x10049060)
api-ms-win-core-com-l1-1-0.dll
  • CoCreateInstance (Address: 0x10049084)
  • CoGetMalloc (Address: 0x10049080)
  • CoImpersonateClient (Address: 0x1004908c)
  • CoInitializeEx (Address: 0x1004907c)
  • CoRevertToSelf (Address: 0x1004906c)
  • CoSetProxyBlanket (Address: 0x10049078)
  • CoTaskMemAlloc (Address: 0x10049070)
  • CoTaskMemFree (Address: 0x10049068)
  • CoUninitialize (Address: 0x10049088)
  • CoUnmarshalInterface (Address: 0x10049074)
api-ms-win-core-com-midlproxystub-l1-1-0.dll
  • ObjectStublessClient3 (Address: 0x10049098)
  • ObjectStublessClient4 (Address: 0x1004909c)
  • ObjectStublessClient5 (Address: 0x100490a0)
  • ObjectStublessClient6 (Address: 0x10049094)
api-ms-win-core-debug-l1-1-0.dll
  • DebugBreak (Address: 0x100490ac)
  • IsDebuggerPresent (Address: 0x100490b0)
  • OutputDebugStringW (Address: 0x100490a8)
api-ms-win-core-debug-l1-1-1.dll
  • CheckRemoteDebuggerPresent (Address: 0x100490b8)
api-ms-win-core-delayload-l1-1-0.dll
  • DelayLoadFailureHook (Address: 0x100490c0)
api-ms-win-core-delayload-l1-1-1.dll
  • ResolveDelayLoadedAPI (Address: 0x100490c8)
api-ms-win-core-errorhandling-l1-1-0.dll
  • GetLastError (Address: 0x100490d4)
  • RaiseException (Address: 0x100490e0)
  • SetErrorMode (Address: 0x100490dc)
  • SetLastError (Address: 0x100490d0)
  • SetUnhandledExceptionFilter (Address: 0x100490e4)
  • UnhandledExceptionFilter (Address: 0x100490d8)
api-ms-win-core-errorhandling-l1-1-3.dll
  • SetThreadErrorMode (Address: 0x100490ec)
api-ms-win-core-file-l1-1-0.dll
  • CompareFileTime (Address: 0x10049108)
  • CreateDirectoryW (Address: 0x1004913c)
  • CreateFileW (Address: 0x1004912c)
  • DeleteFileW (Address: 0x10049144)
  • FindClose (Address: 0x1004911c)
  • FindFirstFileW (Address: 0x10049118)
  • FindNextFileW (Address: 0x10049104)
  • FlushFileBuffers (Address: 0x10049130)
  • GetDriveTypeW (Address: 0x10049110)
  • GetFileAttributesW (Address: 0x10049140)
  • GetFinalPathNameByHandleW (Address: 0x100490f4)
  • GetLogicalDriveStringsW (Address: 0x100490f8)
  • GetLongPathNameW (Address: 0x10049138)
  • GetTempFileNameW (Address: 0x10049128)
  • QueryDosDeviceW (Address: 0x1004910c)
  • ReadFile (Address: 0x10049100)
  • SetEndOfFile (Address: 0x100490fc)
  • SetFileAttributesW (Address: 0x10049120)
  • SetFileInformationByHandle (Address: 0x10049124)
  • SetFilePointerEx (Address: 0x10049134)
  • WriteFile (Address: 0x10049114)
api-ms-win-core-file-l1-2-0.dll
  • GetTempPathW (Address: 0x1004914c)
api-ms-win-core-file-l2-1-0.dll
  • MoveFileExW (Address: 0x10049154)
api-ms-win-core-handle-l1-1-0.dll
  • CloseHandle (Address: 0x10049160)
  • DuplicateHandle (Address: 0x1004915c)
api-ms-win-core-heap-l1-1-0.dll
  • GetProcessHeap (Address: 0x1004916c)
  • HeapAlloc (Address: 0x10049170)
  • HeapFree (Address: 0x10049168)
api-ms-win-core-heap-l2-1-0.dll
  • LocalFree (Address: 0x10049178)
api-ms-win-core-libraryloader-l1-2-0.dll
  • DisableThreadLibraryCalls (Address: 0x10049184)
  • FreeLibrary (Address: 0x100491a0)
  • FreeLibraryAndExitThread (Address: 0x100491a4)
  • GetModuleFileNameA (Address: 0x10049198)
  • GetModuleFileNameW (Address: 0x1004919c)
  • GetModuleHandleExW (Address: 0x1004918c)
  • GetModuleHandleW (Address: 0x10049180)
  • GetProcAddress (Address: 0x10049188)
  • LoadLibraryExW (Address: 0x10049190)
  • LoadStringW (Address: 0x10049194)
api-ms-win-core-libraryloader-l1-2-1.dll
  • LoadLibraryW (Address: 0x100491ac)
api-ms-win-core-localization-l1-2-0.dll
  • FormatMessageW (Address: 0x100491b4)
  • LCMapStringW (Address: 0x100491b8)
api-ms-win-core-localization-obsolete-l1-2-0.dll
  • GetUserDefaultUILanguage (Address: 0x100491c0)
api-ms-win-core-memory-l1-1-0.dll
  • CreateFileMappingW (Address: 0x100491ec)
  • MapViewOfFile (Address: 0x100491dc)
  • ReadProcessMemory (Address: 0x100491e4)
  • UnmapViewOfFile (Address: 0x100491e0)
  • VirtualAlloc (Address: 0x100491e8)
  • VirtualAllocEx (Address: 0x100491d8)
  • VirtualFree (Address: 0x100491c8)
  • VirtualFreeEx (Address: 0x100491f0)
  • VirtualQuery (Address: 0x100491d0)
  • VirtualQueryEx (Address: 0x100491d4)
  • WriteProcessMemory (Address: 0x100491cc)
api-ms-win-core-processenvironment-l1-1-0.dll
  • ExpandEnvironmentStringsW (Address: 0x100491f8)
  • SearchPathW (Address: 0x10049200)
  • SetEnvironmentVariableW (Address: 0x100491fc)
api-ms-win-core-processsnapshot-l1-1-0.dll
  • PssDuplicateSnapshot (Address: 0x1004920c)
  • PssFreeSnapshot (Address: 0x10049218)
  • PssQuerySnapshot (Address: 0x10049214)
  • PssWalkMarkerCreate (Address: 0x10049210)
  • PssWalkMarkerFree (Address: 0x10049208)
api-ms-win-core-processthreads-l1-1-0.dll
  • CreateProcessW (Address: 0x10049248)
  • CreateRemoteThread (Address: 0x10049268)
  • CreateThread (Address: 0x10049240)
  • DeleteProcThreadAttributeList (Address: 0x10049228)
  • GetCurrentProcess (Address: 0x1004924c)
  • GetCurrentProcessId (Address: 0x1004922c)
  • GetCurrentThread (Address: 0x10049258)
  • GetCurrentThreadId (Address: 0x10049224)
  • GetExitCodeProcess (Address: 0x10049260)
  • GetExitCodeThread (Address: 0x10049238)
  • GetProcessId (Address: 0x10049234)
  • GetProcessTimes (Address: 0x10049230)
  • GetThreadId (Address: 0x1004925c)
  • GetThreadPriority (Address: 0x1004923c)
  • InitializeProcThreadAttributeList (Address: 0x1004926c)
  • OpenProcessToken (Address: 0x10049244)
  • OpenThread (Address: 0x10049250)
  • SetThreadPriority (Address: 0x10049220)
  • TerminateProcess (Address: 0x10049254)
  • UpdateProcThreadAttribute (Address: 0x10049264)
api-ms-win-core-processthreads-l1-1-1.dll
  • GetThreadContext (Address: 0x10049278)
  • OpenProcess (Address: 0x10049274)
api-ms-win-core-profile-l1-1-0.dll
  • QueryPerformanceCounter (Address: 0x10049280)
  • QueryPerformanceFrequency (Address: 0x10049284)
api-ms-win-core-psapi-l1-1-0.dll
  • K32EnumProcesses (Address: 0x10049298)
  • K32EnumProcessModules (Address: 0x10049294)
  • K32GetMappedFileNameW (Address: 0x10049290)
  • K32GetModuleFileNameExW (Address: 0x1004929c)
  • K32GetProcessImageFileNameW (Address: 0x1004928c)
  • QueryFullProcessImageNameW (Address: 0x100492a0)
api-ms-win-core-registry-l1-1-0.dll
  • RegCloseKey (Address: 0x100492d0)
  • RegCreateKeyExW (Address: 0x100492b4)
  • RegDeleteValueW (Address: 0x100492a8)
  • RegEnumKeyExW (Address: 0x100492ac)
  • RegGetKeySecurity (Address: 0x100492b0)
  • RegGetValueW (Address: 0x100492b8)
  • RegOpenKeyExW (Address: 0x100492c8)
  • RegQueryInfoKeyW (Address: 0x100492cc)
  • RegQueryValueExW (Address: 0x100492c4)
  • RegSetKeySecurity (Address: 0x100492bc)
  • RegSetValueExW (Address: 0x100492c0)
api-ms-win-core-registry-l1-1-1.dll
  • RegSetKeyValueW (Address: 0x100492d8)
api-ms-win-core-registry-l2-1-0.dll
  • RegDeleteKeyA (Address: 0x100492e0)
  • RegDeleteKeyW (Address: 0x100492e4)
api-ms-win-core-shlwapi-obsolete-l1-1-0.dll
  • StrStrIW (Address: 0x100492ec)
api-ms-win-core-string-l1-1-0.dll
  • CompareStringW (Address: 0x100492f8)
  • MultiByteToWideChar (Address: 0x100492fc)
  • WideCharToMultiByte (Address: 0x100492f4)
api-ms-win-core-synch-l1-1-0.dll
  • AcquireSRWLockExclusive (Address: 0x10049330)
  • AcquireSRWLockShared (Address: 0x10049308)
  • CreateEventW (Address: 0x1004935c)
  • CreateMutexExW (Address: 0x1004932c)
  • CreateMutexW (Address: 0x10049320)
  • CreateSemaphoreExW (Address: 0x10049358)
  • DeleteCriticalSection (Address: 0x10049338)
  • EnterCriticalSection (Address: 0x1004933c)
  • InitializeCriticalSection (Address: 0x10049334)
  • InitializeCriticalSectionEx (Address: 0x10049350)
  • InitializeSRWLock (Address: 0x10049328)
  • LeaveCriticalSection (Address: 0x10049340)
  • OpenEventW (Address: 0x10049344)
  • OpenMutexW (Address: 0x1004931c)
  • OpenSemaphoreW (Address: 0x10049314)
  • ReleaseMutex (Address: 0x10049304)
  • ReleaseSemaphore (Address: 0x10049354)
  • ReleaseSRWLockExclusive (Address: 0x10049324)
  • ReleaseSRWLockShared (Address: 0x10049348)
  • ResetEvent (Address: 0x10049318)
  • SetEvent (Address: 0x1004934c)
  • WaitForSingleObject (Address: 0x1004930c)
  • WaitForSingleObjectEx (Address: 0x10049310)
api-ms-win-core-synch-l1-2-0.dll
  • InitOnceBeginInitialize (Address: 0x10049368)
  • InitOnceComplete (Address: 0x1004936c)
  • Sleep (Address: 0x10049364)
api-ms-win-core-synch-l1-2-1.dll
  • WaitForMultipleObjects (Address: 0x10049374)
api-ms-win-core-sysinfo-l1-1-0.dll
  • GetSystemDirectoryW (Address: 0x10049384)
  • GetSystemInfo (Address: 0x1004939c)
  • GetSystemTime (Address: 0x1004938c)
  • GetSystemTimeAsFileTime (Address: 0x10049398)
  • GetTickCount (Address: 0x10049394)
  • GetTickCount64 (Address: 0x10049390)
  • GetVersionExW (Address: 0x10049388)
  • GetWindowsDirectoryW (Address: 0x10049380)
  • GlobalMemoryStatusEx (Address: 0x1004937c)
api-ms-win-core-threadpool-l1-2-0.dll
  • CloseThreadpoolTimer (Address: 0x100493ac)
  • CloseThreadpoolWait (Address: 0x100493b0)
  • CreateThreadpoolTimer (Address: 0x100493a4)
  • CreateThreadpoolWait (Address: 0x100493b4)
  • SetThreadpoolTimer (Address: 0x100493bc)
  • SetThreadpoolWait (Address: 0x100493a8)
  • WaitForThreadpoolTimerCallbacks (Address: 0x100493c0)
  • WaitForThreadpoolWaitCallbacks (Address: 0x100493b8)
api-ms-win-core-timezone-l1-1-0.dll
  • FileTimeToSystemTime (Address: 0x100493cc)
  • SystemTimeToFileTime (Address: 0x100493c8)
api-ms-win-core-toolhelp-l1-1-0.dll
  • CreateToolhelp32Snapshot (Address: 0x100493e0)
  • Module32FirstW (Address: 0x100493dc)
  • Module32NextW (Address: 0x100493d4)
  • Process32FirstW (Address: 0x100493ec)
  • Process32NextW (Address: 0x100493d8)
  • Thread32First (Address: 0x100493e8)
  • Thread32Next (Address: 0x100493e4)
api-ms-win-core-version-l1-1-0.dll
  • GetFileVersionInfoExW (Address: 0x100493f4)
  • GetFileVersionInfoSizeExW (Address: 0x100493fc)
  • VerQueryValueW (Address: 0x100493f8)
api-ms-win-core-windowserrorreporting-l1-1-0.dll
  • GetApplicationRecoveryCallback (Address: 0x10049408)
  • WerGetFlags (Address: 0x10049404)
api-ms-win-core-winrt-l1-1-0.dll
  • RoGetActivationFactory (Address: 0x10049418)
  • RoInitialize (Address: 0x10049414)
  • RoUninitialize (Address: 0x10049410)
api-ms-win-core-winrt-string-l1-1-0.dll
  • WindowsCreateStringReference (Address: 0x10049420)
api-ms-win-core-wow64-l1-1-0.dll
  • IsWow64Process (Address: 0x10049428)
api-ms-win-core-wow64-l1-1-1.dll
  • GetSystemWow64Directory2W (Address: 0x10049434)
  • GetSystemWow64DirectoryW (Address: 0x10049438)
  • IsWow64Process2 (Address: 0x10049430)
api-ms-win-eventing-provider-l1-1-0.dll
  • EventProviderEnabled (Address: 0x10049448)
  • EventRegister (Address: 0x10049450)
  • EventSetInformation (Address: 0x10049440)
  • EventUnregister (Address: 0x10049444)
  • EventWrite (Address: 0x10049454)
  • EventWriteTransfer (Address: 0x1004944c)
api-ms-win-eventlog-legacy-l1-1-0.dll
  • DeregisterEventSource (Address: 0x1004945c)
  • RegisterEventSourceW (Address: 0x10049464)
  • ReportEventW (Address: 0x10049460)
api-ms-win-security-base-l1-1-0.dll
  • AdjustTokenGroups (Address: 0x10049490)
  • AdjustTokenPrivileges (Address: 0x10049498)
  • AllocateAndInitializeSid (Address: 0x10049488)
  • CheckTokenMembership (Address: 0x10049494)
  • CopySid (Address: 0x1004946c)
  • CreateWellKnownSid (Address: 0x10049470)
  • DuplicateToken (Address: 0x10049478)
  • FreeSid (Address: 0x1004949c)
  • GetLengthSid (Address: 0x10049474)
  • GetSidSubAuthority (Address: 0x10049480)
  • GetSidSubAuthorityCount (Address: 0x10049484)
  • GetTokenInformation (Address: 0x1004947c)
  • ImpersonateLoggedOnUser (Address: 0x1004948c)
  • IsValidSid (Address: 0x100494a4)
  • RevertToSelf (Address: 0x100494a0)
api-ms-win-security-lsalookup-l2-1-0.dll
  • LookupAccountSidW (Address: 0x100494ac)
  • LookupPrivilegeValueW (Address: 0x100494b0)
api-ms-win-security-sddl-l1-1-0.dll
  • ConvertSidToStringSidW (Address: 0x100494b8)
  • ConvertStringSecurityDescriptorToSecurityDescriptorW (Address: 0x100494bc)
api-ms-win-security-trustee-l1-1-0.dll
  • BuildSecurityDescriptorW (Address: 0x100494c4)
api-ms-win-service-management-l1-1-0.dll
  • CloseServiceHandle (Address: 0x100494d0)
  • OpenSCManagerW (Address: 0x100494d8)
  • OpenServiceW (Address: 0x100494cc)
  • StartServiceW (Address: 0x100494d4)
api-ms-win-service-private-l1-1-0.dll
  • I_QueryTagInformation (Address: 0x100494e0)
api-ms-win-shcore-obsolete-l1-1-0.dll
  • CommandLineToArgvW (Address: 0x100494e8)
dbghelp.dll
  • MiniDumpWriteDump (Address: 0x10049508)
  • StackWalk64 (Address: 0x100494fc)
  • SymCleanup (Address: 0x100494f4)
  • SymFunctionTableAccess64 (Address: 0x100494f8)
  • SymGetModuleBase64 (Address: 0x100494f0)
  • SymGetModuleInfoW64 (Address: 0x10049504)
  • SymInitialize (Address: 0x10049500)
KERNELBASE.dll
  • CreateProcessAsUserW (Address: 0x10049000)
  • LocalAlloc (Address: 0x10049004)
msvcrt.dll
  • __CxxFrameHandler3 (Address: 0x1004955c)
  • __dllonexit (Address: 0x10049538)
  • _amsg_exit (Address: 0x10049560)
  • _callnewh (Address: 0x10049554)
  • _CxxThrowException (Address: 0x10049514)
  • _except_handler4_common (Address: 0x10049528)
  • _initterm (Address: 0x10049544)
  • _local_unwind4 (Address: 0x10049558)
  • _lock (Address: 0x10049540)
  • _onexit (Address: 0x10049534)
  • _purecall (Address: 0x10049550)
  • _unlock (Address: 0x1004953c)
  • _vsnprintf_s (Address: 0x1004956c)
  • _vsnwprintf (Address: 0x10049580)
  • _XcptFilter (Address: 0x10049564)
  • ??0exception@@QAE@ABV0@@Z (Address: 0x10049570)
  • ??0exception@@QAE@XZ (Address: 0x10049574)
  • ??1exception@@UAE@XZ (Address: 0x10049578)
  • ??1type_info@@UAE@XZ (Address: 0x1004952c)
  • ?terminate@@YAXXZ (Address: 0x10049530)
  • free (Address: 0x10049568)
  • malloc (Address: 0x10049548)
  • memcmp (Address: 0x1004951c)
  • memcpy (Address: 0x10049520)
  • memcpy_s (Address: 0x1004957c)
  • memmove (Address: 0x10049524)
  • memset (Address: 0x10049588)
  • rand (Address: 0x10049518)
  • realloc (Address: 0x10049510)
  • srand (Address: 0x10049584)
  • time (Address: 0x1004954c)
ntdll.dll
  • _errno (Address: 0x100496cc)
  • _vscwprintf (Address: 0x100496ec)
  • _wcsicmp (Address: 0x100496e4)
  • _wcsnicmp (Address: 0x100496e8)
  • _wcstoui64 (Address: 0x100495b4)
  • _wtoi (Address: 0x100496d8)
  • DbgPrint (Address: 0x100495b8)
  • DbgPrintEx (Address: 0x100496f0)
  • EtwCheckCoverage (Address: 0x1004961c)
  • EtwEventWriteNoRegistration (Address: 0x10049654)
  • EtwGetTraceEnableFlags (Address: 0x100496fc)
  • EtwGetTraceEnableLevel (Address: 0x10049700)
  • EtwGetTraceLoggerHandle (Address: 0x10049704)
  • EtwRegisterTraceGuidsW (Address: 0x100496f8)
  • EtwTraceMessage (Address: 0x10049708)
  • EtwUnregisterTraceGuids (Address: 0x100496f4)
  • isspace (Address: 0x100495bc)
  • iswspace (Address: 0x100496e0)
  • memmove_s (Address: 0x100495d4)
  • NtAllocateVirtualMemory (Address: 0x100495a4)
  • NtAlpcConnectPort (Address: 0x1004966c)
  • NtAlpcSendWaitReceivePort (Address: 0x10049670)
  • NtClearEvent (Address: 0x100495e4)
  • NtClose (Address: 0x100496a0)
  • NtCreateFile (Address: 0x1004959c)
  • NtDeviceIoControlFile (Address: 0x100495a0)
  • NtFreeVirtualMemory (Address: 0x100495a8)
  • NtOpenEvent (Address: 0x1004965c)
  • NtOpenKey (Address: 0x10049604)
  • NtOpenProcess (Address: 0x10049698)
  • NtQueryEvent (Address: 0x10049690)
  • NtQueryInformationProcess (Address: 0x100496c4)
  • NtQueryInformationThread (Address: 0x100495b0)
  • NtQueryInformationToken (Address: 0x10049684)
  • NtQueryLicenseValue (Address: 0x10049688)
  • NtQuerySystemInformation (Address: 0x10049658)
  • NtQueryValueKey (Address: 0x100495fc)
  • NtResumeProcess (Address: 0x10049628)
  • NtResumeThread (Address: 0x10049630)
  • NtSetInformationFile (Address: 0x10049694)
  • NtSetInformationProcess (Address: 0x10049620)
  • NtSetSystemInformation (Address: 0x10049640)
  • NtSuspendProcess (Address: 0x10049634)
  • NtSuspendThread (Address: 0x1004962c)
  • NtSystemDebugControl (Address: 0x100496b8)
  • NtWaitForMultipleObjects (Address: 0x100495e8)
  • NtWaitForSingleObject (Address: 0x10049660)
  • PssNtCaptureSnapshot (Address: 0x1004969c)
  • PssNtFreeSnapshot (Address: 0x10049648)
  • RtlAcquireSRWLockExclusive (Address: 0x10049590)
  • RtlAdjustPrivilege (Address: 0x100495ac)
  • RtlAllocateAndInitializeSid (Address: 0x10049664)
  • RtlAllocateHeap (Address: 0x100495c8)
  • RtlCompareMemory (Address: 0x100496b4)
  • RtlCompareUnicodeString (Address: 0x1004967c)
  • RtlCreateProcessReflection (Address: 0x100496c0)
  • RtlDecodeSystemPointer (Address: 0x100495e0)
  • RtlDetermineDosPathNameType_U (Address: 0x100495f8)
  • RtlFreeHeap (Address: 0x100495c4)
  • RtlFreeSid (Address: 0x10049674)
  • RtlGetCurrentTransaction (Address: 0x100495f0)
  • RtlGetNtSystemRoot (Address: 0x100495f4)
  • RtlGetUnloadEventTraceEx (Address: 0x10049618)
  • RtlIdentifierAuthoritySid (Address: 0x1004963c)
  • RtlImageNtHeaderEx (Address: 0x1004968c)
  • RtlInitUnicodeString (Address: 0x10049668)
  • RtlInitUnicodeStringEx (Address: 0x10049600)
  • RtlNtStatusToDosError (Address: 0x100495dc)
  • RtlNtStatusToDosErrorNoTeb (Address: 0x10049680)
  • RtlQueryResourcePolicy (Address: 0x10049678)
  • RtlQueryWnfStateData (Address: 0x100495d0)
  • RtlReleasePebLock (Address: 0x1004960c)
  • RtlReleaseSRWLockExclusive (Address: 0x10049594)
  • RtlSecondsSince1970ToTime (Address: 0x100496a4)
  • RtlSetCurrentTransaction (Address: 0x100495ec)
  • RtlSetThreadErrorMode (Address: 0x100495c0)
  • RtlSleepConditionVariableSRW (Address: 0x1004970c)
  • RtlSubAuthorityCountSid (Address: 0x10049638)
  • RtlTryAcquirePebLock (Address: 0x10049614)
  • RtlWakeAllConditionVariable (Address: 0x10049644)
  • RtlWerpReportException (Address: 0x100496bc)
  • swprintf_s (Address: 0x100496a8)
  • tolower (Address: 0x100495cc)
  • toupper (Address: 0x100496d4)
  • towlower (Address: 0x10049624)
  • wcscat_s (Address: 0x100496ac)
  • wcschr (Address: 0x100496dc)
  • wcscpy_s (Address: 0x10049598)
  • wcsncmp (Address: 0x10049610)
  • wcsncpy_s (Address: 0x100496b0)
  • wcsrchr (Address: 0x100496d0)
  • wcsstr (Address: 0x10049608)
  • wcstoul (Address: 0x100496c8)
  • ZwQueryInformationThread (Address: 0x100495d8)
  • ZwQueryWnfStateNameInformation (Address: 0x1004964c)
  • ZwUpdateWnfStateData (Address: 0x10049650)
RPCRT4.dll
  • CStdStubBuffer_AddRef (Address: 0x10049048)
  • CStdStubBuffer_Connect (Address: 0x10049054)
  • CStdStubBuffer_CountRefs (Address: 0x1004900c)
  • CStdStubBuffer_DebugServerQueryInterface (Address: 0x10049040)
  • CStdStubBuffer_DebugServerRelease (Address: 0x10049018)
  • CStdStubBuffer_Disconnect (Address: 0x10049024)
  • CStdStubBuffer_Invoke (Address: 0x10049038)
  • CStdStubBuffer_IsIIDSupported (Address: 0x1004903c)
  • CStdStubBuffer_QueryInterface (Address: 0x10049010)
  • IUnknown_AddRef_Proxy (Address: 0x10049044)
  • IUnknown_QueryInterface_Proxy (Address: 0x1004902c)
  • IUnknown_Release_Proxy (Address: 0x10049030)
  • NdrCStdStubBuffer_Release (Address: 0x10049058)
  • NdrDllCanUnloadNow (Address: 0x10049050)
  • NdrDllGetClassObject (Address: 0x1004904c)
  • NdrOleAllocate (Address: 0x10049034)
  • NdrOleFree (Address: 0x10049014)
  • RpcStringFreeW (Address: 0x10049028)
  • UuidCreate (Address: 0x10049020)
  • UuidToStringW (Address: 0x1004901c)