fwbase.dll

Description: Firewall Base DLL

Authors: © Microsoft Corporation. All rights reserved.

Version: 10.0.19041.6328

Architecture: 32-bit

Operating System: Windows NT

SHA256: 8192d77ac5cb059b3020110c516704e4

File Size: 157.0 KB

Uploaded At: Dec. 1, 2025, 7:56 a.m.

Views: 8

Security Warning

This file has been flagged as potentially dangerous.


Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

  • FwExtractPortNumber (Ordinal: 1, Address: 0x9e90)
  • FwIsValidPorts (Ordinal: 2, Address: 0x4ab0)
  • FwPortsToString (Ordinal: 3, Address: 0x47e0)
  • FWIndicatePortInUse_Helper (Ordinal: 4, Address: 0x92b0)
  • FwAddrChangeSourceInitialize (Ordinal: 5, Address: 0x9930)
  • FwAddrChangeSourceShutdown (Ordinal: 6, Address: 0x1b580)
  • FwAddrChangeSourceSignal (Ordinal: 7, Address: 0x99c0)
  • FwAlloc (Ordinal: 8, Address: 0x7cc0)
  • FwAllocArray (Ordinal: 9, Address: 0xa4b0)
  • FwAllocCheckSize (Ordinal: 10, Address: 0x6db0)
  • FwArrayAppend (Ordinal: 11, Address: 0x8a50)
  • FwArrayCat (Ordinal: 12, Address: 0x8b80)
  • FwArrayCopy (Ordinal: 13, Address: 0x8870)
  • FwArrayCreateFromRegistry (Ordinal: 14, Address: 0x1a6d0)
  • FwArrayDestroy (Ordinal: 15, Address: 0x6f00)
  • FwArrayErase (Ordinal: 16, Address: 0x1a890)
  • FwAuthSuiteEmpty (Ordinal: 17, Address: 0x1cac0)
  • FwAuthSuiteEmptyByVersion (Ordinal: 18, Address: 0x1cae0)
  • FwAuthorizedAppEncode (Ordinal: 19, Address: 0x1bf00)
  • FwBaseAlloc (Ordinal: 20, Address: 0x7cc0)
  • FwBaseAllocCheckSize (Ordinal: 21, Address: 0x6db0)
  • FwBaseFree (Ordinal: 22, Address: 0x7870)
  • FwBoolIsEqual (Ordinal: 23, Address: 0x9460)
  • FwBuildIndirectString (Ordinal: 24, Address: 0x19660)
  • FwCanonizeAuthorizedApps (Ordinal: 25, Address: 0x9420)
  • FwChangeSinkCreate (Ordinal: 26, Address: 0x84b0)
  • FwChangeSinkDestroy (Ordinal: 27, Address: 0x1b5b0)
  • FwChangeSourceInitialize (Ordinal: 28, Address: 0x9920)
  • FwChangeSourceShutdown (Ordinal: 29, Address: 0x1b5e0)
  • FwChangeSourceSignal (Ordinal: 30, Address: 0x95c0)
  • FwChangeSourceSignalStart (Ordinal: 31, Address: 0xa530)
  • FwCloseHandle (Ordinal: 32, Address: 0x8f00)
  • FwConstructRemoteMachineSPN (Ordinal: 33, Address: 0x196e0)
  • FwCreateDirectory (Ordinal: 34, Address: 0x19830)
  • FwCreateSDDLStringFromPolicyAppId (Ordinal: 35, Address: 0xf390)
  • FwCriticalSectionCreate (Ordinal: 36, Address: 0x9340)
  • FwCriticalSectionDestroy (Ordinal: 37, Address: 0x9590)
  • FwCriticalSectionEnter (Ordinal: 38, Address: 0x9180)
  • FwCriticalSectionLeave (Ordinal: 39, Address: 0x9170)
  • FwDWordMultiply (Ordinal: 40, Address: 0x6e00)
  • FwEnableMemTracing (Ordinal: 41, Address: 0x9680)
  • FwEnablePrivilege (Ordinal: 42, Address: 0x19940)
  • FwExpandEnvironmentStrings (Ordinal: 43, Address: 0x7b70)
  • FwFieldNameMatchStringBegining (Ordinal: 44, Address: 0x87d0)
  • FwFinalHash (Ordinal: 45, Address: 0x1ae60)
  • FwFree (Ordinal: 46, Address: 0x7870)
  • FwFreeCertCriteria (Ordinal: 47, Address: 0x1cb60)
  • FwFreeRpcCallersProcessInfo (Ordinal: 48, Address: 0x77f0)
  • FwGetAppBlockList (Ordinal: 49, Address: 0xa0d0)
  • FwGetAuthorizedApp (Ordinal: 50, Address: 0x1bfd0)
  • FwGetExpandedCanonicalLongPathName (Ordinal: 51, Address: 0x7730)
  • FwGetIcmpSettings (Ordinal: 52, Address: 0x1c080)
  • FwGetLongPathName (Ordinal: 53, Address: 0x7960)
  • FwGetPolicyAppIdFromSDDLString (Ordinal: 54, Address: 0xf400)
  • FwGetProfileIndexFromProfileType (Ordinal: 55, Address: 0x89e0)
  • FwGetProfileTypeFromProfileIndex (Ordinal: 56, Address: 0x8a30)
  • FwGetRemoteAdminSettings (Ordinal: 57, Address: 0x1c130)
  • FwGetRpcCallersProcessImageName (Ordinal: 58, Address: 0x4b90)
  • FwGetRpcCallersProcessInfo (Ordinal: 59, Address: 0x7da0)
  • FwGetService (Ordinal: 60, Address: 0x1cdc0)
  • FwGetServiceTypes (Ordinal: 61, Address: 0x1ce10)
  • FwGetServices (Ordinal: 62, Address: 0x1c180)
  • FwGetStaticFwPort (Ordinal: 63, Address: 0x1c240)
  • FwGetStringId (Ordinal: 64, Address: 0x9010)
  • FwGetStringIdForStatusCode (Ordinal: 65, Address: 0xa470)
  • FwGetSysPathName (Ordinal: 66, Address: 0x19af0)
  • FwGetTokenInformation (Ordinal: 67, Address: 0x6e40)
  • FwHResultToWindowsError (Ordinal: 68, Address: 0x8b50)
  • FwHashtableCreate (Ordinal: 69, Address: 0xa1a0)
  • FwHashtableDestroy (Ordinal: 70, Address: 0x1ae80)
  • FwHashtableEmpty (Ordinal: 71, Address: 0x9520)
  • FwHashtableFind (Ordinal: 72, Address: 0x1af00)
  • FwHashtableGetNext (Ordinal: 73, Address: 0x1af30)
  • FwHashtableInsert (Ordinal: 74, Address: 0x1af50)
  • FwHashtableIsEmpty (Ordinal: 75, Address: 0x10890)
  • FwHashtableRemove (Ordinal: 76, Address: 0x1afb0)
  • FwIOReadPortUseIndications (Ordinal: 77, Address: 0x9b00)
  • FwIOWritePortUseIndications (Ordinal: 78, Address: 0x9a00)
  • FwIcfAuthBypassServicesDestroy (Ordinal: 79, Address: 0x7d80)
  • FwIcfAuthBypassSubNetsDestroy (Ordinal: 80, Address: 0x7d40)
  • FwIcfAuthorizedAppCopy (Ordinal: 81, Address: 0x1aa20)
  • FwIcfAuthorizedAppsCopy (Ordinal: 82, Address: 0x1ab50)
  • FwIcfAuthorizedAppsDestroy (Ordinal: 83, Address: 0x1abc0)
  • FwIcfDynamicFwPortDestroy (Ordinal: 84, Address: 0x71d0)
  • FwIcfIpV4SubNetsCanonize (Ordinal: 85, Address: 0x9400)
  • FwIcfIpV6SubNetsCanonize (Ordinal: 86, Address: 0x93e0)
  • FwIcfSubNetsCopy (Ordinal: 87, Address: 0x1adb0)
  • FwIcfSubNetsDestroy (Ordinal: 88, Address: 0x6d90)
  • FwIcfSubNetsGetScope (Ordinal: 89, Address: 0x1ae30)
  • FwIcfSubNetsIsEqual (Ordinal: 90, Address: 0x93a0)
  • FwImageListDestroy (Ordinal: 91, Address: 0x1c310)
  • FwImageListHasImage (Ordinal: 92, Address: 0x1c330)
  • FwInitMemoryMgr (Ordinal: 93, Address: 0xf040)
  • FwInitializeHashContext (Ordinal: 94, Address: 0x1afd0)
  • FwIpV4SubNetDecode (Ordinal: 95, Address: 0x1c370)
  • FwIsBuiltInPort (Ordinal: 96, Address: 0x1cee0)
  • FwIsMachineLocalHost (Ordinal: 97, Address: 0x8f30)
  • FwLicensingIsIoT (Ordinal: 98, Address: 0xa4e0)
  • FwLicensingIsNetIsolationOnly (Ordinal: 99, Address: 0x6960)
  • FwLicensingIsXbox (Ordinal: 100, Address: 0x9190)
  • FwLoadIndirectString (Ordinal: 101, Address: 0x6fc0)
  • FwLoadString (Ordinal: 102, Address: 0x96b0)
  • FwLookupAccountSid (Ordinal: 103, Address: 0x9f20)
  • FwMarshalledMetaDataCopy (Ordinal: 104, Address: 0x8990)
  • FwMarshalledMetaDataInitialize (Ordinal: 105, Address: 0x8b20)
  • FwMetaDataAddEnforcementState (Ordinal: 106, Address: 0x8c20)
  • FwMetaDataCopy (Ordinal: 107, Address: 0x19c10)
  • FwMetaDataFree (Ordinal: 108, Address: 0x9050)
  • FwMetaDataIsEnforcementStatePresent (Ordinal: 109, Address: 0x8f80)
  • FwModifySDDLStringWithPolicyAppId (Ordinal: 110, Address: 0xf490)
  • FwMultiByteToWideChar (Ordinal: 111, Address: 0x19d40)
  • FwNtStatusToHResult (Ordinal: 112, Address: 0xf790)
  • FwParseEdpCloudResourceStringToNrptRuleList (Ordinal: 113, Address: 0x1b090)
  • FwProfileTypesToString (Ordinal: 114, Address: 0x7210)
  • FwRegCloseKey (Ordinal: 115, Address: 0x91b0)
  • FwRegCreateKey (Ordinal: 116, Address: 0x8750)
  • FwRegDeleteAllValues (Ordinal: 117, Address: 0x19070)
  • FwRegDeleteKey (Ordinal: 118, Address: 0x19170)
  • FwRegDeleteValue (Ordinal: 119, Address: 0x91d0)
  • FwRegEnumValueNameAndValueData (Ordinal: 120, Address: 0xb630)
  • FwRegNotifyCreate (Ordinal: 121, Address: 0x82f0)
  • FwRegNotifyDestroy (Ordinal: 122, Address: 0x192f0)
  • FwRegOpenKey (Ordinal: 123, Address: 0x8270)
  • FwRegQueryDWord (Ordinal: 124, Address: 0x8530)
  • FwRegQueryNumKeys (Ordinal: 125, Address: 0x19350)
  • FwRegQueryNumValues (Ordinal: 126, Address: 0x94d0)
  • FwRegQueryString (Ordinal: 127, Address: 0x75c0)
  • FwRegSetDWord (Ordinal: 128, Address: 0x9610)
  • FwRegSetString (Ordinal: 129, Address: 0x90c0)
  • FwReleasePrivilege (Ordinal: 130, Address: 0x19ef0)
  • FwRemovePolicyAppIdFromSDDLString (Ordinal: 131, Address: 0xf7e0)
  • FwReplacePolicyAppIdInSDDLString (Ordinal: 132, Address: 0xf9f0)
  • FwReportErrorAsNtStatus (Ordinal: 133, Address: 0x19f80)
  • FwReportErrorAsWinError (Ordinal: 134, Address: 0x9cc0)
  • FwReportReturnError (Ordinal: 135, Address: 0x7190)
  • FwResolveIndirectString (Ordinal: 136, Address: 0x6f40)
  • FwRestructureHashtable (Ordinal: 137, Address: 0x1aff0)
  • FwServiceSidCreateInPlace (Ordinal: 138, Address: 0xa220)
  • FwSetMemLeakPolicy (Ordinal: 139, Address: 0x9680)
  • FwShutdownMemoryMgr (Ordinal: 140, Address: 0xf040)
  • FwSidCreate (Ordinal: 141, Address: 0x9e00)
  • FwSidDestroy (Ordinal: 142, Address: 0x19fd0)
  • FwSizeTAdd (Ordinal: 143, Address: 0x6d60)
  • FwSizeTMultiply (Ordinal: 144, Address: 0x6e00)
  • FwSortAddresses (Ordinal: 145, Address: 0x9250)
  • FwSortInterfaceLUIDs (Ordinal: 146, Address: 0x9490)
  • FwStaticFwPortEncode (Ordinal: 147, Address: 0x1c660)
  • FwStaticFwPortEncodeValueName (Ordinal: 148, Address: 0x1c760)
  • FwStringArrayCopy (Ordinal: 149, Address: 0xfad0)
  • FwStringBuild (Ordinal: 150, Address: 0x6c20)
  • FwStringBuildWithPrefix (Ordinal: 151, Address: 0xfc10)
  • FwStringCanonicalizeCopy (Ordinal: 152, Address: 0x19ff0)
  • FwStringConcat (Ordinal: 153, Address: 0xfd90)
  • FwStringCopy (Ordinal: 154, Address: 0x7a60)
  • FwStringCopyA (Ordinal: 155, Address: 0x1a170)
  • FwStringCopyAtoWAlloc (Ordinal: 156, Address: 0x1a230)
  • FwStringCopyWtoAAlloc (Ordinal: 157, Address: 0x1a320)
  • FwStringPrefixConcat (Ordinal: 158, Address: 0xfe20)
  • FwStringPrefixCopy (Ordinal: 159, Address: 0xfea0)
  • FwSubNetsEncode (Ordinal: 160, Address: 0x1c9a0)
  • FwSubstituteDeviceName (Ordinal: 161, Address: 0x4590)
  • FwTriggerGetEventForSource (Ordinal: 162, Address: 0xa550)
  • FwTriggerRearm (Ordinal: 163, Address: 0xa3e0)
  • FwTriggerRegisterWait (Ordinal: 164, Address: 0xa310)
  • FwTriggerUnregisterWait (Ordinal: 165, Address: 0x1b4c0)
  • FwUpdateHash (Ordinal: 166, Address: 0x1b060)
  • FwVerifyAuthenticationSet (Ordinal: 167, Address: 0x1cf10)
  • FwVerifyAuthenticationSetQuery (Ordinal: 168, Address: 0x1d030)
  • FwVerifyConnectionSecurityRule (Ordinal: 169, Address: 0x1d150)
  • FwVerifyConnectionSecurityRuleQuery (Ordinal: 170, Address: 0x1d2b0)
  • FwVerifyCryptoSet (Ordinal: 171, Address: 0x1d3d0)
  • FwVerifyCryptoSetQuery (Ordinal: 172, Address: 0x1d4f0)
  • FwVerifyFirewallRule (Ordinal: 173, Address: 0x4af0)
  • FwVerifyFirewallRuleQuery (Ordinal: 174, Address: 0x8c50)
  • FwVerifyMainModeRule (Ordinal: 175, Address: 0x1d610)
  • FwVerifyMainModeRuleQuery (Ordinal: 176, Address: 0x1d700)
  • FwVerifyNoHeapLeaks (Ordinal: 177, Address: 0xf040)
  • FwWcsICmp (Ordinal: 178, Address: 0xa510)
  • Int_FWVerifyAuthenticationSet (Ordinal: 179, Address: 0x1e260)
  • Int_FWVerifyConnectionSecurityRule (Ordinal: 180, Address: 0x1e670)
  • Int_FWVerifyCryptoSet (Ordinal: 181, Address: 0x1f8c0)
  • Int_FWVerifyFirewallRule (Ordinal: 182, Address: 0x4e30)
  • Int_FWVerifyMainModeRule (Ordinal: 183, Address: 0x1fc50)
  • Int_FwIPV4RangeContainsMulticast (Ordinal: 184, Address: 0x200d0)
  • Int_FwIPV6RangeContainsMulticast (Ordinal: 185, Address: 0x20120)
  • Int_FwIsV6AddrLoopback (Ordinal: 186, Address: 0xa1f0)
  • Int_FwValidateAndMigrateSecurityDescriptor (Ordinal: 187, Address: 0x4bf0)
  • Int_FwValidateComplianceAndReduceAuthSetToVersion (Ordinal: 188, Address: 0x20150)
  • Int_FwValidateComplianceAndReduceConnSecRuleToVersion (Ordinal: 189, Address: 0x20340)
  • Int_FwValidateComplianceAndReduceCryptoSetToVersion (Ordinal: 190, Address: 0x20780)
  • Int_FwValidateComplianceAndReduceFirewallRuleToVersion (Ordinal: 191, Address: 0x5820)
  • Int_FwValidateComplianceAndReduceMainModeRuleToVersion (Ordinal: 192, Address: 0x20b60)
  • Int_FwValidateSecurityDescriptor (Ordinal: 193, Address: 0x55c0)
  • IsAddressesEmpty (Ordinal: 194, Address: 0x9d10)
  • IsCSRuleTunnelMode (Ordinal: 195, Address: 0x1cbc0)
  • IsRuleOldAuthApp (Ordinal: 196, Address: 0x8fc0)
  • IsRuleOldGlobalOpenPort (Ordinal: 197, Address: 0x9070)
  • IsRuleOldv1Compliant (Ordinal: 198, Address: 0x1cc50)
  • IsRuleOpenPortOrAuthApp (Ordinal: 199, Address: 0x1cc90)
  • Isv4AddressesEmpty (Ordinal: 200, Address: 0x9d70)
  • Isv6AddressesEmpty (Ordinal: 201, Address: 0x9d40)

Imported DLLs & Functions

api-ms-win-core-apiquery-l1-1-0.dll
  • ApiSetQueryApiSetPresence (Address: 0x10025010)
api-ms-win-core-com-l1-1-0.dll
  • CoCreateGuid (Address: 0x10025018)
  • StringFromGUID2 (Address: 0x1002501c)
api-ms-win-core-debug-l1-1-0.dll
  • DebugBreak (Address: 0x10025024)
  • IsDebuggerPresent (Address: 0x10025028)
  • OutputDebugStringW (Address: 0x1002502c)
api-ms-win-core-delayload-l1-1-0.dll
  • DelayLoadFailureHook (Address: 0x10025034)
api-ms-win-core-delayload-l1-1-1.dll
  • ResolveDelayLoadedAPI (Address: 0x1002503c)
api-ms-win-core-errorhandling-l1-1-0.dll
  • GetLastError (Address: 0x10025050)
  • SetLastError (Address: 0x10025048)
  • SetUnhandledExceptionFilter (Address: 0x1002504c)
  • UnhandledExceptionFilter (Address: 0x10025044)
api-ms-win-core-file-l1-1-0.dll
  • CreateDirectoryW (Address: 0x1002505c)
  • CreateFileW (Address: 0x10025058)
  • GetLongPathNameW (Address: 0x10025060)
api-ms-win-core-handle-l1-1-0.dll
  • CloseHandle (Address: 0x10025068)
api-ms-win-core-heap-l1-1-0.dll
  • GetProcessHeap (Address: 0x10025070)
  • HeapAlloc (Address: 0x10025078)
  • HeapFree (Address: 0x10025074)
api-ms-win-core-heap-l2-1-0.dll
  • LocalAlloc (Address: 0x10025080)
  • LocalFree (Address: 0x10025084)
api-ms-win-core-libraryloader-l1-2-0.dll
  • FreeLibrary (Address: 0x10025090)
  • GetModuleFileNameA (Address: 0x100250a4)
  • GetModuleHandleExW (Address: 0x100250a0)
  • GetModuleHandleW (Address: 0x1002509c)
  • GetProcAddress (Address: 0x10025098)
  • LoadLibraryExW (Address: 0x1002508c)
  • LoadStringW (Address: 0x10025094)
api-ms-win-core-localization-l1-2-0.dll
  • FormatMessageW (Address: 0x100250ac)
api-ms-win-core-processenvironment-l1-1-0.dll
  • ExpandEnvironmentStringsW (Address: 0x100250b4)
api-ms-win-core-processthreads-l1-1-0.dll
  • GetCurrentProcess (Address: 0x100250c8)
  • GetCurrentProcessId (Address: 0x100250c0)
  • GetCurrentThread (Address: 0x100250d0)
  • GetCurrentThreadId (Address: 0x100250d8)
  • OpenProcessToken (Address: 0x100250cc)
  • OpenThreadToken (Address: 0x100250d4)
  • SetThreadToken (Address: 0x100250c4)
  • TerminateProcess (Address: 0x100250bc)
api-ms-win-core-processthreads-l1-1-1.dll
  • OpenProcess (Address: 0x100250e0)
api-ms-win-core-profile-l1-1-0.dll
  • QueryPerformanceCounter (Address: 0x100250e8)
api-ms-win-core-registry-l1-1-0.dll
  • RegCloseKey (Address: 0x100250f0)
  • RegCreateKeyExW (Address: 0x100250f4)
  • RegDeleteTreeW (Address: 0x100250f8)
  • RegDeleteValueW (Address: 0x1002510c)
  • RegEnumValueW (Address: 0x10025108)
  • RegNotifyChangeKeyValue (Address: 0x10025104)
  • RegOpenKeyExW (Address: 0x100250fc)
  • RegQueryInfoKeyW (Address: 0x10025110)
  • RegQueryValueExW (Address: 0x10025100)
  • RegSetValueExW (Address: 0x10025114)
api-ms-win-core-shlwapi-legacy-l1-1-0.dll
  • PathCanonicalizeW (Address: 0x10025124)
  • PathFindNextComponentW (Address: 0x1002511c)
  • PathIsRelativeW (Address: 0x10025120)
  • PathSkipRootW (Address: 0x10025128)
api-ms-win-core-string-l1-1-0.dll
  • CompareStringW (Address: 0x10025138)
  • MultiByteToWideChar (Address: 0x10025130)
  • WideCharToMultiByte (Address: 0x10025134)
api-ms-win-core-string-l2-1-1.dll
  • SHLoadIndirectString (Address: 0x10025140)
api-ms-win-core-string-obsolete-l1-1-0.dll
  • lstrcmpiW (Address: 0x10025148)
api-ms-win-core-synch-l1-1-0.dll
  • AcquireSRWLockExclusive (Address: 0x10025174)
  • AcquireSRWLockShared (Address: 0x10025168)
  • CreateEventW (Address: 0x10025188)
  • CreateMutexExW (Address: 0x10025184)
  • CreateSemaphoreExW (Address: 0x10025190)
  • DeleteCriticalSection (Address: 0x10025178)
  • EnterCriticalSection (Address: 0x10025154)
  • InitializeCriticalSectionAndSpinCount (Address: 0x1002518c)
  • InitializeCriticalSectionEx (Address: 0x1002516c)
  • LeaveCriticalSection (Address: 0x10025180)
  • OpenSemaphoreW (Address: 0x1002517c)
  • ReleaseMutex (Address: 0x10025150)
  • ReleaseSemaphore (Address: 0x1002515c)
  • ReleaseSRWLockExclusive (Address: 0x10025170)
  • ReleaseSRWLockShared (Address: 0x10025164)
  • SetEvent (Address: 0x10025194)
  • WaitForSingleObject (Address: 0x10025160)
  • WaitForSingleObjectEx (Address: 0x10025158)
api-ms-win-core-synch-l1-2-0.dll
  • Sleep (Address: 0x1002519c)
api-ms-win-core-sysinfo-l1-1-0.dll
  • GetComputerNameExW (Address: 0x100251a8)
  • GetSystemTimeAsFileTime (Address: 0x100251b0)
  • GetTickCount (Address: 0x100251a4)
  • GetVersionExW (Address: 0x100251ac)
api-ms-win-core-threadpool-l1-2-0.dll
  • CloseThreadpoolTimer (Address: 0x100251cc)
  • CloseThreadpoolWait (Address: 0x100251c0)
  • CreateThreadpoolTimer (Address: 0x100251c8)
  • CreateThreadpoolWait (Address: 0x100251c4)
  • SetThreadpoolTimer (Address: 0x100251d4)
  • SetThreadpoolWait (Address: 0x100251b8)
  • WaitForThreadpoolTimerCallbacks (Address: 0x100251d0)
  • WaitForThreadpoolWaitCallbacks (Address: 0x100251bc)
api-ms-win-core-threadpool-legacy-l1-1-0.dll
  • QueueUserWorkItem (Address: 0x100251dc)
  • UnregisterWaitEx (Address: 0x100251e0)
api-ms-win-core-threadpool-private-l1-1-0.dll
  • RegisterWaitForSingleObjectEx (Address: 0x100251e8)
api-ms-win-security-base-l1-1-0.dll
  • AdjustTokenPrivileges (Address: 0x100251fc)
  • AllocateAndInitializeSid (Address: 0x10025204)
  • DuplicateTokenEx (Address: 0x10025200)
  • FreeSid (Address: 0x10025208)
  • GetAce (Address: 0x100251f0)
  • GetSecurityDescriptorDacl (Address: 0x100251f4)
  • GetTokenInformation (Address: 0x1002520c)
  • IsValidSecurityDescriptor (Address: 0x100251f8)
msvcrt.dll
  • __CxxFrameHandler3 (Address: 0x1002522c)
  • __dllonexit (Address: 0x10025274)
  • _amsg_exit (Address: 0x10025248)
  • _CxxThrowException (Address: 0x10025298)
  • _except_handler4_common (Address: 0x100252a0)
  • _initterm (Address: 0x10025224)
  • _lock (Address: 0x100252a8)
  • _onexit (Address: 0x10025270)
  • _purecall (Address: 0x100252a4)
  • _ultow (Address: 0x1002527c)
  • _unlock (Address: 0x10025278)
  • _vsnprintf_s (Address: 0x10025220)
  • _vsnwprintf (Address: 0x1002526c)
  • _wcsicmp (Address: 0x10025280)
  • _wcsnicmp (Address: 0x10025268)
  • _XcptFilter (Address: 0x10025240)
  • ??0exception@@QAE@ABV0@@Z (Address: 0x1002521c)
  • ??0exception@@QAE@XZ (Address: 0x10025214)
  • ??1exception@@UAE@XZ (Address: 0x10025228)
  • ??1type_info@@UAE@XZ (Address: 0x10025218)
  • ??3@YAXPAX@Z (Address: 0x10025294)
  • free (Address: 0x100252ac)
  • iswalpha (Address: 0x10025238)
  • iswdigit (Address: 0x10025264)
  • malloc (Address: 0x1002524c)
  • memcmp (Address: 0x1002528c)
  • memcpy (Address: 0x10025254)
  • memcpy_s (Address: 0x1002529c)
  • memmove (Address: 0x10025250)
  • memmove_s (Address: 0x10025290)
  • memset (Address: 0x100252b0)
  • qsort (Address: 0x10025244)
  • towupper (Address: 0x10025230)
  • wcschr (Address: 0x1002525c)
  • wcsncmp (Address: 0x10025288)
  • wcsncpy_s (Address: 0x10025284)
  • wcspbrk (Address: 0x10025234)
  • wcsstr (Address: 0x10025258)
  • wcstok_s (Address: 0x1002523c)
  • wcstoul (Address: 0x10025260)
ntdll.dll
  • EtwEventWrite (Address: 0x100252f0)
  • EtwGetTraceEnableFlags (Address: 0x1002531c)
  • EtwGetTraceEnableLevel (Address: 0x10025324)
  • EtwGetTraceLoggerHandle (Address: 0x10025320)
  • EtwRegisterTraceGuidsW (Address: 0x10025328)
  • EtwTraceMessage (Address: 0x10025314)
  • EtwUnregisterTraceGuids (Address: 0x10025318)
  • NtClose (Address: 0x10025304)
  • NtOpenSymbolicLinkObject (Address: 0x1002530c)
  • NtQueryInformationProcess (Address: 0x100252c0)
  • NtQueryObject (Address: 0x10025300)
  • NtQuerySymbolicLinkObject (Address: 0x10025308)
  • RtlCanonicalizeDomainName (Address: 0x100252f4)
  • RtlContractHashTable (Address: 0x100252c4)
  • RtlCreateHashTable (Address: 0x100252ec)
  • RtlCreateServiceSid (Address: 0x100252fc)
  • RtlDeleteHashTable (Address: 0x100252e8)
  • RtlEndEnumerationHashTable (Address: 0x100252cc)
  • RtlEnumerateEntryHashTable (Address: 0x100252d0)
  • RtlExpandHashTable (Address: 0x100252c8)
  • RtlFreeUnicodeString (Address: 0x1002532c)
  • RtlGetNextEntryHashTable (Address: 0x100252d8)
  • RtlInitEnumerationHashTable (Address: 0x100252d4)
  • RtlInitUnicodeString (Address: 0x10025310)
  • RtlInsertEntryHashTable (Address: 0x100252e4)
  • RtlIpv4AddressToStringW (Address: 0x100252b8)
  • RtlIpv4StringToAddressW (Address: 0x100252bc)
  • RtlLookupEntryHashTable (Address: 0x100252dc)
  • RtlNtStatusToDosError (Address: 0x100252f8)
  • RtlRemoveEntryHashTable (Address: 0x100252e0)
RPCRT4.dll
  • I_RpcBindingInqLocalClientPID (Address: 0x10025008)
  • RpcImpersonateClient (Address: 0x10025004)
  • RpcRevertToSelf (Address: 0x10025000)