fwbase.dll
Description: Firewall Base DLL
Authors: © Microsoft Corporation. All rights reserved.
Version: 10.0.19041.6328
Architecture: 32-bit
Operating System: Windows NT
SHA256: 8192d77ac5cb059b3020110c516704e4
File Size: 157.0 KB
Uploaded At: Dec. 1, 2025, 7:56 a.m.
Views: 8
Security Warning
This file has been flagged as potentially dangerous.
Reason: Detected potentially dangerous functions used for process injection: OpenProcess
Exported Functions
- FwExtractPortNumber (Ordinal: 1, Address: 0x9e90)
- FwIsValidPorts (Ordinal: 2, Address: 0x4ab0)
- FwPortsToString (Ordinal: 3, Address: 0x47e0)
- FWIndicatePortInUse_Helper (Ordinal: 4, Address: 0x92b0)
- FwAddrChangeSourceInitialize (Ordinal: 5, Address: 0x9930)
- FwAddrChangeSourceShutdown (Ordinal: 6, Address: 0x1b580)
- FwAddrChangeSourceSignal (Ordinal: 7, Address: 0x99c0)
- FwAlloc (Ordinal: 8, Address: 0x7cc0)
- FwAllocArray (Ordinal: 9, Address: 0xa4b0)
- FwAllocCheckSize (Ordinal: 10, Address: 0x6db0)
- FwArrayAppend (Ordinal: 11, Address: 0x8a50)
- FwArrayCat (Ordinal: 12, Address: 0x8b80)
- FwArrayCopy (Ordinal: 13, Address: 0x8870)
- FwArrayCreateFromRegistry (Ordinal: 14, Address: 0x1a6d0)
- FwArrayDestroy (Ordinal: 15, Address: 0x6f00)
- FwArrayErase (Ordinal: 16, Address: 0x1a890)
- FwAuthSuiteEmpty (Ordinal: 17, Address: 0x1cac0)
- FwAuthSuiteEmptyByVersion (Ordinal: 18, Address: 0x1cae0)
- FwAuthorizedAppEncode (Ordinal: 19, Address: 0x1bf00)
- FwBaseAlloc (Ordinal: 20, Address: 0x7cc0)
- FwBaseAllocCheckSize (Ordinal: 21, Address: 0x6db0)
- FwBaseFree (Ordinal: 22, Address: 0x7870)
- FwBoolIsEqual (Ordinal: 23, Address: 0x9460)
- FwBuildIndirectString (Ordinal: 24, Address: 0x19660)
- FwCanonizeAuthorizedApps (Ordinal: 25, Address: 0x9420)
- FwChangeSinkCreate (Ordinal: 26, Address: 0x84b0)
- FwChangeSinkDestroy (Ordinal: 27, Address: 0x1b5b0)
- FwChangeSourceInitialize (Ordinal: 28, Address: 0x9920)
- FwChangeSourceShutdown (Ordinal: 29, Address: 0x1b5e0)
- FwChangeSourceSignal (Ordinal: 30, Address: 0x95c0)
- FwChangeSourceSignalStart (Ordinal: 31, Address: 0xa530)
- FwCloseHandle (Ordinal: 32, Address: 0x8f00)
- FwConstructRemoteMachineSPN (Ordinal: 33, Address: 0x196e0)
- FwCreateDirectory (Ordinal: 34, Address: 0x19830)
- FwCreateSDDLStringFromPolicyAppId (Ordinal: 35, Address: 0xf390)
- FwCriticalSectionCreate (Ordinal: 36, Address: 0x9340)
- FwCriticalSectionDestroy (Ordinal: 37, Address: 0x9590)
- FwCriticalSectionEnter (Ordinal: 38, Address: 0x9180)
- FwCriticalSectionLeave (Ordinal: 39, Address: 0x9170)
- FwDWordMultiply (Ordinal: 40, Address: 0x6e00)
- FwEnableMemTracing (Ordinal: 41, Address: 0x9680)
- FwEnablePrivilege (Ordinal: 42, Address: 0x19940)
- FwExpandEnvironmentStrings (Ordinal: 43, Address: 0x7b70)
- FwFieldNameMatchStringBegining (Ordinal: 44, Address: 0x87d0)
- FwFinalHash (Ordinal: 45, Address: 0x1ae60)
- FwFree (Ordinal: 46, Address: 0x7870)
- FwFreeCertCriteria (Ordinal: 47, Address: 0x1cb60)
- FwFreeRpcCallersProcessInfo (Ordinal: 48, Address: 0x77f0)
- FwGetAppBlockList (Ordinal: 49, Address: 0xa0d0)
- FwGetAuthorizedApp (Ordinal: 50, Address: 0x1bfd0)
- FwGetExpandedCanonicalLongPathName (Ordinal: 51, Address: 0x7730)
- FwGetIcmpSettings (Ordinal: 52, Address: 0x1c080)
- FwGetLongPathName (Ordinal: 53, Address: 0x7960)
- FwGetPolicyAppIdFromSDDLString (Ordinal: 54, Address: 0xf400)
- FwGetProfileIndexFromProfileType (Ordinal: 55, Address: 0x89e0)
- FwGetProfileTypeFromProfileIndex (Ordinal: 56, Address: 0x8a30)
- FwGetRemoteAdminSettings (Ordinal: 57, Address: 0x1c130)
- FwGetRpcCallersProcessImageName (Ordinal: 58, Address: 0x4b90)
- FwGetRpcCallersProcessInfo (Ordinal: 59, Address: 0x7da0)
- FwGetService (Ordinal: 60, Address: 0x1cdc0)
- FwGetServiceTypes (Ordinal: 61, Address: 0x1ce10)
- FwGetServices (Ordinal: 62, Address: 0x1c180)
- FwGetStaticFwPort (Ordinal: 63, Address: 0x1c240)
- FwGetStringId (Ordinal: 64, Address: 0x9010)
- FwGetStringIdForStatusCode (Ordinal: 65, Address: 0xa470)
- FwGetSysPathName (Ordinal: 66, Address: 0x19af0)
- FwGetTokenInformation (Ordinal: 67, Address: 0x6e40)
- FwHResultToWindowsError (Ordinal: 68, Address: 0x8b50)
- FwHashtableCreate (Ordinal: 69, Address: 0xa1a0)
- FwHashtableDestroy (Ordinal: 70, Address: 0x1ae80)
- FwHashtableEmpty (Ordinal: 71, Address: 0x9520)
- FwHashtableFind (Ordinal: 72, Address: 0x1af00)
- FwHashtableGetNext (Ordinal: 73, Address: 0x1af30)
- FwHashtableInsert (Ordinal: 74, Address: 0x1af50)
- FwHashtableIsEmpty (Ordinal: 75, Address: 0x10890)
- FwHashtableRemove (Ordinal: 76, Address: 0x1afb0)
- FwIOReadPortUseIndications (Ordinal: 77, Address: 0x9b00)
- FwIOWritePortUseIndications (Ordinal: 78, Address: 0x9a00)
- FwIcfAuthBypassServicesDestroy (Ordinal: 79, Address: 0x7d80)
- FwIcfAuthBypassSubNetsDestroy (Ordinal: 80, Address: 0x7d40)
- FwIcfAuthorizedAppCopy (Ordinal: 81, Address: 0x1aa20)
- FwIcfAuthorizedAppsCopy (Ordinal: 82, Address: 0x1ab50)
- FwIcfAuthorizedAppsDestroy (Ordinal: 83, Address: 0x1abc0)
- FwIcfDynamicFwPortDestroy (Ordinal: 84, Address: 0x71d0)
- FwIcfIpV4SubNetsCanonize (Ordinal: 85, Address: 0x9400)
- FwIcfIpV6SubNetsCanonize (Ordinal: 86, Address: 0x93e0)
- FwIcfSubNetsCopy (Ordinal: 87, Address: 0x1adb0)
- FwIcfSubNetsDestroy (Ordinal: 88, Address: 0x6d90)
- FwIcfSubNetsGetScope (Ordinal: 89, Address: 0x1ae30)
- FwIcfSubNetsIsEqual (Ordinal: 90, Address: 0x93a0)
- FwImageListDestroy (Ordinal: 91, Address: 0x1c310)
- FwImageListHasImage (Ordinal: 92, Address: 0x1c330)
- FwInitMemoryMgr (Ordinal: 93, Address: 0xf040)
- FwInitializeHashContext (Ordinal: 94, Address: 0x1afd0)
- FwIpV4SubNetDecode (Ordinal: 95, Address: 0x1c370)
- FwIsBuiltInPort (Ordinal: 96, Address: 0x1cee0)
- FwIsMachineLocalHost (Ordinal: 97, Address: 0x8f30)
- FwLicensingIsIoT (Ordinal: 98, Address: 0xa4e0)
- FwLicensingIsNetIsolationOnly (Ordinal: 99, Address: 0x6960)
- FwLicensingIsXbox (Ordinal: 100, Address: 0x9190)
- FwLoadIndirectString (Ordinal: 101, Address: 0x6fc0)
- FwLoadString (Ordinal: 102, Address: 0x96b0)
- FwLookupAccountSid (Ordinal: 103, Address: 0x9f20)
- FwMarshalledMetaDataCopy (Ordinal: 104, Address: 0x8990)
- FwMarshalledMetaDataInitialize (Ordinal: 105, Address: 0x8b20)
- FwMetaDataAddEnforcementState (Ordinal: 106, Address: 0x8c20)
- FwMetaDataCopy (Ordinal: 107, Address: 0x19c10)
- FwMetaDataFree (Ordinal: 108, Address: 0x9050)
- FwMetaDataIsEnforcementStatePresent (Ordinal: 109, Address: 0x8f80)
- FwModifySDDLStringWithPolicyAppId (Ordinal: 110, Address: 0xf490)
- FwMultiByteToWideChar (Ordinal: 111, Address: 0x19d40)
- FwNtStatusToHResult (Ordinal: 112, Address: 0xf790)
- FwParseEdpCloudResourceStringToNrptRuleList (Ordinal: 113, Address: 0x1b090)
- FwProfileTypesToString (Ordinal: 114, Address: 0x7210)
- FwRegCloseKey (Ordinal: 115, Address: 0x91b0)
- FwRegCreateKey (Ordinal: 116, Address: 0x8750)
- FwRegDeleteAllValues (Ordinal: 117, Address: 0x19070)
- FwRegDeleteKey (Ordinal: 118, Address: 0x19170)
- FwRegDeleteValue (Ordinal: 119, Address: 0x91d0)
- FwRegEnumValueNameAndValueData (Ordinal: 120, Address: 0xb630)
- FwRegNotifyCreate (Ordinal: 121, Address: 0x82f0)
- FwRegNotifyDestroy (Ordinal: 122, Address: 0x192f0)
- FwRegOpenKey (Ordinal: 123, Address: 0x8270)
- FwRegQueryDWord (Ordinal: 124, Address: 0x8530)
- FwRegQueryNumKeys (Ordinal: 125, Address: 0x19350)
- FwRegQueryNumValues (Ordinal: 126, Address: 0x94d0)
- FwRegQueryString (Ordinal: 127, Address: 0x75c0)
- FwRegSetDWord (Ordinal: 128, Address: 0x9610)
- FwRegSetString (Ordinal: 129, Address: 0x90c0)
- FwReleasePrivilege (Ordinal: 130, Address: 0x19ef0)
- FwRemovePolicyAppIdFromSDDLString (Ordinal: 131, Address: 0xf7e0)
- FwReplacePolicyAppIdInSDDLString (Ordinal: 132, Address: 0xf9f0)
- FwReportErrorAsNtStatus (Ordinal: 133, Address: 0x19f80)
- FwReportErrorAsWinError (Ordinal: 134, Address: 0x9cc0)
- FwReportReturnError (Ordinal: 135, Address: 0x7190)
- FwResolveIndirectString (Ordinal: 136, Address: 0x6f40)
- FwRestructureHashtable (Ordinal: 137, Address: 0x1aff0)
- FwServiceSidCreateInPlace (Ordinal: 138, Address: 0xa220)
- FwSetMemLeakPolicy (Ordinal: 139, Address: 0x9680)
- FwShutdownMemoryMgr (Ordinal: 140, Address: 0xf040)
- FwSidCreate (Ordinal: 141, Address: 0x9e00)
- FwSidDestroy (Ordinal: 142, Address: 0x19fd0)
- FwSizeTAdd (Ordinal: 143, Address: 0x6d60)
- FwSizeTMultiply (Ordinal: 144, Address: 0x6e00)
- FwSortAddresses (Ordinal: 145, Address: 0x9250)
- FwSortInterfaceLUIDs (Ordinal: 146, Address: 0x9490)
- FwStaticFwPortEncode (Ordinal: 147, Address: 0x1c660)
- FwStaticFwPortEncodeValueName (Ordinal: 148, Address: 0x1c760)
- FwStringArrayCopy (Ordinal: 149, Address: 0xfad0)
- FwStringBuild (Ordinal: 150, Address: 0x6c20)
- FwStringBuildWithPrefix (Ordinal: 151, Address: 0xfc10)
- FwStringCanonicalizeCopy (Ordinal: 152, Address: 0x19ff0)
- FwStringConcat (Ordinal: 153, Address: 0xfd90)
- FwStringCopy (Ordinal: 154, Address: 0x7a60)
- FwStringCopyA (Ordinal: 155, Address: 0x1a170)
- FwStringCopyAtoWAlloc (Ordinal: 156, Address: 0x1a230)
- FwStringCopyWtoAAlloc (Ordinal: 157, Address: 0x1a320)
- FwStringPrefixConcat (Ordinal: 158, Address: 0xfe20)
- FwStringPrefixCopy (Ordinal: 159, Address: 0xfea0)
- FwSubNetsEncode (Ordinal: 160, Address: 0x1c9a0)
- FwSubstituteDeviceName (Ordinal: 161, Address: 0x4590)
- FwTriggerGetEventForSource (Ordinal: 162, Address: 0xa550)
- FwTriggerRearm (Ordinal: 163, Address: 0xa3e0)
- FwTriggerRegisterWait (Ordinal: 164, Address: 0xa310)
- FwTriggerUnregisterWait (Ordinal: 165, Address: 0x1b4c0)
- FwUpdateHash (Ordinal: 166, Address: 0x1b060)
- FwVerifyAuthenticationSet (Ordinal: 167, Address: 0x1cf10)
- FwVerifyAuthenticationSetQuery (Ordinal: 168, Address: 0x1d030)
- FwVerifyConnectionSecurityRule (Ordinal: 169, Address: 0x1d150)
- FwVerifyConnectionSecurityRuleQuery (Ordinal: 170, Address: 0x1d2b0)
- FwVerifyCryptoSet (Ordinal: 171, Address: 0x1d3d0)
- FwVerifyCryptoSetQuery (Ordinal: 172, Address: 0x1d4f0)
- FwVerifyFirewallRule (Ordinal: 173, Address: 0x4af0)
- FwVerifyFirewallRuleQuery (Ordinal: 174, Address: 0x8c50)
- FwVerifyMainModeRule (Ordinal: 175, Address: 0x1d610)
- FwVerifyMainModeRuleQuery (Ordinal: 176, Address: 0x1d700)
- FwVerifyNoHeapLeaks (Ordinal: 177, Address: 0xf040)
- FwWcsICmp (Ordinal: 178, Address: 0xa510)
- Int_FWVerifyAuthenticationSet (Ordinal: 179, Address: 0x1e260)
- Int_FWVerifyConnectionSecurityRule (Ordinal: 180, Address: 0x1e670)
- Int_FWVerifyCryptoSet (Ordinal: 181, Address: 0x1f8c0)
- Int_FWVerifyFirewallRule (Ordinal: 182, Address: 0x4e30)
- Int_FWVerifyMainModeRule (Ordinal: 183, Address: 0x1fc50)
- Int_FwIPV4RangeContainsMulticast (Ordinal: 184, Address: 0x200d0)
- Int_FwIPV6RangeContainsMulticast (Ordinal: 185, Address: 0x20120)
- Int_FwIsV6AddrLoopback (Ordinal: 186, Address: 0xa1f0)
- Int_FwValidateAndMigrateSecurityDescriptor (Ordinal: 187, Address: 0x4bf0)
- Int_FwValidateComplianceAndReduceAuthSetToVersion (Ordinal: 188, Address: 0x20150)
- Int_FwValidateComplianceAndReduceConnSecRuleToVersion (Ordinal: 189, Address: 0x20340)
- Int_FwValidateComplianceAndReduceCryptoSetToVersion (Ordinal: 190, Address: 0x20780)
- Int_FwValidateComplianceAndReduceFirewallRuleToVersion (Ordinal: 191, Address: 0x5820)
- Int_FwValidateComplianceAndReduceMainModeRuleToVersion (Ordinal: 192, Address: 0x20b60)
- Int_FwValidateSecurityDescriptor (Ordinal: 193, Address: 0x55c0)
- IsAddressesEmpty (Ordinal: 194, Address: 0x9d10)
- IsCSRuleTunnelMode (Ordinal: 195, Address: 0x1cbc0)
- IsRuleOldAuthApp (Ordinal: 196, Address: 0x8fc0)
- IsRuleOldGlobalOpenPort (Ordinal: 197, Address: 0x9070)
- IsRuleOldv1Compliant (Ordinal: 198, Address: 0x1cc50)
- IsRuleOpenPortOrAuthApp (Ordinal: 199, Address: 0x1cc90)
- Isv4AddressesEmpty (Ordinal: 200, Address: 0x9d70)
- Isv6AddressesEmpty (Ordinal: 201, Address: 0x9d40)
Imported DLLs & Functions
api-ms-win-core-apiquery-l1-1-0.dll
- ApiSetQueryApiSetPresence (Address: 0x10025010)
api-ms-win-core-com-l1-1-0.dll
- CoCreateGuid (Address: 0x10025018)
- StringFromGUID2 (Address: 0x1002501c)
api-ms-win-core-debug-l1-1-0.dll
- DebugBreak (Address: 0x10025024)
- IsDebuggerPresent (Address: 0x10025028)
- OutputDebugStringW (Address: 0x1002502c)
api-ms-win-core-delayload-l1-1-0.dll
- DelayLoadFailureHook (Address: 0x10025034)
api-ms-win-core-delayload-l1-1-1.dll
- ResolveDelayLoadedAPI (Address: 0x1002503c)
api-ms-win-core-errorhandling-l1-1-0.dll
- GetLastError (Address: 0x10025050)
- SetLastError (Address: 0x10025048)
- SetUnhandledExceptionFilter (Address: 0x1002504c)
- UnhandledExceptionFilter (Address: 0x10025044)
api-ms-win-core-file-l1-1-0.dll
- CreateDirectoryW (Address: 0x1002505c)
- CreateFileW (Address: 0x10025058)
- GetLongPathNameW (Address: 0x10025060)
api-ms-win-core-handle-l1-1-0.dll
- CloseHandle (Address: 0x10025068)
api-ms-win-core-heap-l1-1-0.dll
- GetProcessHeap (Address: 0x10025070)
- HeapAlloc (Address: 0x10025078)
- HeapFree (Address: 0x10025074)
api-ms-win-core-heap-l2-1-0.dll
- LocalAlloc (Address: 0x10025080)
- LocalFree (Address: 0x10025084)
api-ms-win-core-libraryloader-l1-2-0.dll
- FreeLibrary (Address: 0x10025090)
- GetModuleFileNameA (Address: 0x100250a4)
- GetModuleHandleExW (Address: 0x100250a0)
- GetModuleHandleW (Address: 0x1002509c)
- GetProcAddress (Address: 0x10025098)
- LoadLibraryExW (Address: 0x1002508c)
- LoadStringW (Address: 0x10025094)
api-ms-win-core-localization-l1-2-0.dll
- FormatMessageW (Address: 0x100250ac)
api-ms-win-core-processenvironment-l1-1-0.dll
- ExpandEnvironmentStringsW (Address: 0x100250b4)
api-ms-win-core-processthreads-l1-1-0.dll
- GetCurrentProcess (Address: 0x100250c8)
- GetCurrentProcessId (Address: 0x100250c0)
- GetCurrentThread (Address: 0x100250d0)
- GetCurrentThreadId (Address: 0x100250d8)
- OpenProcessToken (Address: 0x100250cc)
- OpenThreadToken (Address: 0x100250d4)
- SetThreadToken (Address: 0x100250c4)
- TerminateProcess (Address: 0x100250bc)
api-ms-win-core-processthreads-l1-1-1.dll
- OpenProcess (Address: 0x100250e0)
api-ms-win-core-profile-l1-1-0.dll
- QueryPerformanceCounter (Address: 0x100250e8)
api-ms-win-core-registry-l1-1-0.dll
- RegCloseKey (Address: 0x100250f0)
- RegCreateKeyExW (Address: 0x100250f4)
- RegDeleteTreeW (Address: 0x100250f8)
- RegDeleteValueW (Address: 0x1002510c)
- RegEnumValueW (Address: 0x10025108)
- RegNotifyChangeKeyValue (Address: 0x10025104)
- RegOpenKeyExW (Address: 0x100250fc)
- RegQueryInfoKeyW (Address: 0x10025110)
- RegQueryValueExW (Address: 0x10025100)
- RegSetValueExW (Address: 0x10025114)
api-ms-win-core-shlwapi-legacy-l1-1-0.dll
- PathCanonicalizeW (Address: 0x10025124)
- PathFindNextComponentW (Address: 0x1002511c)
- PathIsRelativeW (Address: 0x10025120)
- PathSkipRootW (Address: 0x10025128)
api-ms-win-core-string-l1-1-0.dll
- CompareStringW (Address: 0x10025138)
- MultiByteToWideChar (Address: 0x10025130)
- WideCharToMultiByte (Address: 0x10025134)
api-ms-win-core-string-l2-1-1.dll
- SHLoadIndirectString (Address: 0x10025140)
api-ms-win-core-string-obsolete-l1-1-0.dll
- lstrcmpiW (Address: 0x10025148)
api-ms-win-core-synch-l1-1-0.dll
- AcquireSRWLockExclusive (Address: 0x10025174)
- AcquireSRWLockShared (Address: 0x10025168)
- CreateEventW (Address: 0x10025188)
- CreateMutexExW (Address: 0x10025184)
- CreateSemaphoreExW (Address: 0x10025190)
- DeleteCriticalSection (Address: 0x10025178)
- EnterCriticalSection (Address: 0x10025154)
- InitializeCriticalSectionAndSpinCount (Address: 0x1002518c)
- InitializeCriticalSectionEx (Address: 0x1002516c)
- LeaveCriticalSection (Address: 0x10025180)
- OpenSemaphoreW (Address: 0x1002517c)
- ReleaseMutex (Address: 0x10025150)
- ReleaseSemaphore (Address: 0x1002515c)
- ReleaseSRWLockExclusive (Address: 0x10025170)
- ReleaseSRWLockShared (Address: 0x10025164)
- SetEvent (Address: 0x10025194)
- WaitForSingleObject (Address: 0x10025160)
- WaitForSingleObjectEx (Address: 0x10025158)
api-ms-win-core-synch-l1-2-0.dll
- Sleep (Address: 0x1002519c)
api-ms-win-core-sysinfo-l1-1-0.dll
- GetComputerNameExW (Address: 0x100251a8)
- GetSystemTimeAsFileTime (Address: 0x100251b0)
- GetTickCount (Address: 0x100251a4)
- GetVersionExW (Address: 0x100251ac)
api-ms-win-core-threadpool-l1-2-0.dll
- CloseThreadpoolTimer (Address: 0x100251cc)
- CloseThreadpoolWait (Address: 0x100251c0)
- CreateThreadpoolTimer (Address: 0x100251c8)
- CreateThreadpoolWait (Address: 0x100251c4)
- SetThreadpoolTimer (Address: 0x100251d4)
- SetThreadpoolWait (Address: 0x100251b8)
- WaitForThreadpoolTimerCallbacks (Address: 0x100251d0)
- WaitForThreadpoolWaitCallbacks (Address: 0x100251bc)
api-ms-win-core-threadpool-legacy-l1-1-0.dll
- QueueUserWorkItem (Address: 0x100251dc)
- UnregisterWaitEx (Address: 0x100251e0)
api-ms-win-core-threadpool-private-l1-1-0.dll
- RegisterWaitForSingleObjectEx (Address: 0x100251e8)
api-ms-win-security-base-l1-1-0.dll
- AdjustTokenPrivileges (Address: 0x100251fc)
- AllocateAndInitializeSid (Address: 0x10025204)
- DuplicateTokenEx (Address: 0x10025200)
- FreeSid (Address: 0x10025208)
- GetAce (Address: 0x100251f0)
- GetSecurityDescriptorDacl (Address: 0x100251f4)
- GetTokenInformation (Address: 0x1002520c)
- IsValidSecurityDescriptor (Address: 0x100251f8)
msvcrt.dll
- __CxxFrameHandler3 (Address: 0x1002522c)
- __dllonexit (Address: 0x10025274)
- _amsg_exit (Address: 0x10025248)
- _CxxThrowException (Address: 0x10025298)
- _except_handler4_common (Address: 0x100252a0)
- _initterm (Address: 0x10025224)
- _lock (Address: 0x100252a8)
- _onexit (Address: 0x10025270)
- _purecall (Address: 0x100252a4)
- _ultow (Address: 0x1002527c)
- _unlock (Address: 0x10025278)
- _vsnprintf_s (Address: 0x10025220)
- _vsnwprintf (Address: 0x1002526c)
- _wcsicmp (Address: 0x10025280)
- _wcsnicmp (Address: 0x10025268)
- _XcptFilter (Address: 0x10025240)
- ??0exception@@QAE@ABV0@@Z (Address: 0x1002521c)
- ??0exception@@QAE@XZ (Address: 0x10025214)
- ??1exception@@UAE@XZ (Address: 0x10025228)
- ??1type_info@@UAE@XZ (Address: 0x10025218)
- ??3@YAXPAX@Z (Address: 0x10025294)
- free (Address: 0x100252ac)
- iswalpha (Address: 0x10025238)
- iswdigit (Address: 0x10025264)
- malloc (Address: 0x1002524c)
- memcmp (Address: 0x1002528c)
- memcpy (Address: 0x10025254)
- memcpy_s (Address: 0x1002529c)
- memmove (Address: 0x10025250)
- memmove_s (Address: 0x10025290)
- memset (Address: 0x100252b0)
- qsort (Address: 0x10025244)
- towupper (Address: 0x10025230)
- wcschr (Address: 0x1002525c)
- wcsncmp (Address: 0x10025288)
- wcsncpy_s (Address: 0x10025284)
- wcspbrk (Address: 0x10025234)
- wcsstr (Address: 0x10025258)
- wcstok_s (Address: 0x1002523c)
- wcstoul (Address: 0x10025260)
ntdll.dll
- EtwEventWrite (Address: 0x100252f0)
- EtwGetTraceEnableFlags (Address: 0x1002531c)
- EtwGetTraceEnableLevel (Address: 0x10025324)
- EtwGetTraceLoggerHandle (Address: 0x10025320)
- EtwRegisterTraceGuidsW (Address: 0x10025328)
- EtwTraceMessage (Address: 0x10025314)
- EtwUnregisterTraceGuids (Address: 0x10025318)
- NtClose (Address: 0x10025304)
- NtOpenSymbolicLinkObject (Address: 0x1002530c)
- NtQueryInformationProcess (Address: 0x100252c0)
- NtQueryObject (Address: 0x10025300)
- NtQuerySymbolicLinkObject (Address: 0x10025308)
- RtlCanonicalizeDomainName (Address: 0x100252f4)
- RtlContractHashTable (Address: 0x100252c4)
- RtlCreateHashTable (Address: 0x100252ec)
- RtlCreateServiceSid (Address: 0x100252fc)
- RtlDeleteHashTable (Address: 0x100252e8)
- RtlEndEnumerationHashTable (Address: 0x100252cc)
- RtlEnumerateEntryHashTable (Address: 0x100252d0)
- RtlExpandHashTable (Address: 0x100252c8)
- RtlFreeUnicodeString (Address: 0x1002532c)
- RtlGetNextEntryHashTable (Address: 0x100252d8)
- RtlInitEnumerationHashTable (Address: 0x100252d4)
- RtlInitUnicodeString (Address: 0x10025310)
- RtlInsertEntryHashTable (Address: 0x100252e4)
- RtlIpv4AddressToStringW (Address: 0x100252b8)
- RtlIpv4StringToAddressW (Address: 0x100252bc)
- RtlLookupEntryHashTable (Address: 0x100252dc)
- RtlNtStatusToDosError (Address: 0x100252f8)
- RtlRemoveEntryHashTable (Address: 0x100252e0)
RPCRT4.dll
- I_RpcBindingInqLocalClientPID (Address: 0x10025008)
- RpcImpersonateClient (Address: 0x10025004)
- RpcRevertToSelf (Address: 0x10025000)