FWPUCLNT.DLL

Description: FWP/IPsec User-Mode API

Authors: © Microsoft Corporation. All rights reserved.

Version: 10.0.19041.6328

Architecture: 32-bit

Operating System: Windows NT

SHA256: 057c7342804cad7fda6200858d6362aa

File Size: 335.5 KB

Uploaded At: Dec. 1, 2025, 7:56 a.m.

Views: 7

Security Warning

This file has been flagged as potentially dangerous.


Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

  • FwpiExpandCriteria0 (Ordinal: 1, Address: 0x1c4d0)
  • FwpiFreeCriteria0 (Ordinal: 2, Address: 0x1c570)
  • FwpiVpnTriggerAddAppSids (Ordinal: 3, Address: 0x3d720)
  • FwpiVpnTriggerAddFilePaths (Ordinal: 4, Address: 0x3d780)
  • FwpiVpnTriggerAddSecurityDescriptor (Ordinal: 5, Address: 0x3d7e0)
  • FwpiVpnTriggerConfigureParameters (Ordinal: 6, Address: 0x3d880)
  • FwpiVpnTriggerEventSubscribe0 (Ordinal: 7, Address: 0x3d8e0)
  • FwpiVpnTriggerEventUnsubscribe0 (Ordinal: 8, Address: 0x3d9c0)
  • FwpiVpnTriggerInitializeNrptTriggering (Ordinal: 9, Address: 0x3da40)
  • FwpiVpnTriggerRemoveAppSids (Ordinal: 10, Address: 0x3daa0)
  • FwpiVpnTriggerRemoveFilePaths (Ordinal: 11, Address: 0x3db00)
  • FwpiVpnTriggerRemoveSecurityDescriptor (Ordinal: 12, Address: 0x3db60)
  • FwpiVpnTriggerResetNrptTriggering (Ordinal: 13, Address: 0x3dbc0)
  • FwpiVpnTriggerSetStateDisconnected (Ordinal: 14, Address: 0x3dc20)
  • FwpiVpnTriggerUninitializeNrptTriggering (Ordinal: 15, Address: 0x3dc80)
  • FwpmBitmapIndexFree0 (Ordinal: 16, Address: 0x1c590)
  • FwpmBitmapIndexGet0 (Ordinal: 17, Address: 0x1c630)
  • FwpmCalloutAdd0 (Ordinal: 18, Address: 0x18f90)
  • FwpmCalloutCreateEnumHandle0 (Ordinal: 19, Address: 0x1c6d0)
  • FwpmCalloutDeleteById0 (Ordinal: 20, Address: 0x1c730)
  • FwpmCalloutDeleteByKey0 (Ordinal: 21, Address: 0x1c7c0)
  • FwpmCalloutDestroyEnumHandle0 (Ordinal: 22, Address: 0x1c850)
  • FwpmCalloutEnum0 (Ordinal: 23, Address: 0x1c8b0)
  • FwpmCalloutGetById0 (Ordinal: 24, Address: 0x1c930)
  • FwpmCalloutGetByKey0 (Ordinal: 25, Address: 0x1c9a0)
  • FwpmCalloutGetSecurityInfoByKey0 (Ordinal: 26, Address: 0x1ca10)
  • FwpmCalloutSetSecurityInfoByKey0 (Ordinal: 27, Address: 0x1cac0)
  • FwpmCalloutSubscribeChanges0 (Ordinal: 28, Address: 0x1cb70)
  • FwpmCalloutSubscriptionsGet0 (Ordinal: 29, Address: 0x1cc50)
  • FwpmCalloutUnsubscribeChanges0 (Ordinal: 30, Address: 0x1ccc0)
  • FwpmConnectionCreateEnumHandle0 (Ordinal: 31, Address: 0x1cd40)
  • FwpmConnectionDestroyEnumHandle0 (Ordinal: 32, Address: 0x1cda0)
  • FwpmConnectionEnum0 (Ordinal: 33, Address: 0x1ce00)
  • FwpmConnectionGetById0 (Ordinal: 34, Address: 0x1ce80)
  • FwpmConnectionGetSecurityInfo0 (Ordinal: 35, Address: 0x1cef0)
  • FwpmConnectionSetSecurityInfo0 (Ordinal: 36, Address: 0x1cfa0)
  • FwpmConnectionSubscribe0 (Ordinal: 37, Address: 0x1d040)
  • FwpmConnectionUnsubscribe0 (Ordinal: 38, Address: 0x1d120)
  • FwpmDiagnoseNetFailure0 (Ordinal: 39, Address: 0x24160)
  • FwpmDynamicKeywordSubscribe0 (Ordinal: 40, Address: 0x19dd0)
  • FwpmDynamicKeywordUnsubscribe0 (Ordinal: 41, Address: 0x1a020)
  • FwpmEngineClose0 (Ordinal: 42, Address: 0x187c0)
  • FwpmEngineGetOption0 (Ordinal: 43, Address: 0x15db0)
  • FwpmEngineGetSecurityInfo0 (Ordinal: 44, Address: 0x1d1a0)
  • FwpmEngineOpen0 (Ordinal: 45, Address: 0x18eb0)
  • FwpmEngineSetOption0 (Ordinal: 46, Address: 0x179d0)
  • FwpmEngineSetSecurityInfo0 (Ordinal: 47, Address: 0x1d250)
  • FwpmEventProviderCreate0 (Ordinal: 48, Address: 0x17890)
  • FwpmEventProviderDestroy0 (Ordinal: 49, Address: 0x245a0)
  • FwpmEventProviderFireNetEvent0 (Ordinal: 50, Address: 0x245c0)
  • FwpmEventProviderIsNetEventTypeEnabled0 (Ordinal: 51, Address: 0x171f0)
  • FwpmFilterAdd0 (Ordinal: 52, Address: 0x17410)
  • FwpmFilterCreateEnumHandle0 (Ordinal: 53, Address: 0x189e0)
  • FwpmFilterDeleteById0 (Ordinal: 54, Address: 0x176b0)
  • FwpmFilterDeleteByKey0 (Ordinal: 55, Address: 0x19050)
  • FwpmFilterDestroyEnumHandle0 (Ordinal: 56, Address: 0x18a30)
  • FwpmFilterEnum0 (Ordinal: 57, Address: 0x18a80)
  • FwpmFilterGetById0 (Ordinal: 58, Address: 0x1d2f0)
  • FwpmFilterGetByKey0 (Ordinal: 59, Address: 0x17610)
  • FwpmFilterGetSecurityInfoByKey0 (Ordinal: 60, Address: 0x1d360)
  • FwpmFilterSetSecurityInfoByKey0 (Ordinal: 61, Address: 0x1d410)
  • FwpmFilterSubscribeChanges0 (Ordinal: 62, Address: 0x18700)
  • FwpmFilterSubscriptionsGet0 (Ordinal: 63, Address: 0x1d4c0)
  • FwpmFilterUnsubscribeChanges0 (Ordinal: 64, Address: 0x1d530)
  • FwpmFreeMemory0 (Ordinal: 65, Address: 0x17700)
  • FwpmGetAppIdFromFileName0 (Ordinal: 66, Address: 0x1d5b0)
  • FwpmGetSidFromOnlineId0 (Ordinal: 67, Address: 0x41250)
  • FwpmIPsecS2STunnelAddConditions0 (Ordinal: 68, Address: 0x1d6a0)
  • FwpmIPsecS2STunnelAddInterfaceToCompartment0 (Ordinal: 69, Address: 0x1d740)
  • FwpmIPsecS2STunnelGetInterfaceForCompartment0 (Ordinal: 70, Address: 0x1d7a0)
  • FwpmIPsecS2STunnelRemoveConditions0 (Ordinal: 71, Address: 0x1d800)
  • FwpmIPsecS2STunnelRemoveInterfaceFromCompartment0 (Ordinal: 72, Address: 0x1d8a0)
  • FwpmIPsecTunnelAdd0 (Ordinal: 73, Address: 0x1d900)
  • FwpmIPsecTunnelAdd1 (Ordinal: 74, Address: 0x1d9f0)
  • FwpmIPsecTunnelAdd2 (Ordinal: 75, Address: 0x1dae0)
  • FwpmIPsecTunnelAdd3 (Ordinal: 76, Address: 0x1dbc0)
  • FwpmIPsecTunnelAddConditions0 (Ordinal: 77, Address: 0x1dca0)
  • FwpmIPsecTunnelDeleteByKey0 (Ordinal: 78, Address: 0x1dd30)
  • FwpmLayerCreateEnumHandle0 (Ordinal: 79, Address: 0x1dd90)
  • FwpmLayerDestroyEnumHandle0 (Ordinal: 80, Address: 0x1ddf0)
  • FwpmLayerEnum0 (Ordinal: 81, Address: 0x1de50)
  • FwpmLayerGetById0 (Ordinal: 82, Address: 0x1ded0)
  • FwpmLayerGetByKey0 (Ordinal: 83, Address: 0x1df50)
  • FwpmLayerGetSecurityInfoByKey0 (Ordinal: 84, Address: 0x1dfc0)
  • FwpmLayerSetSecurityInfoByKey0 (Ordinal: 85, Address: 0x1e070)
  • FwpmNetEventCreateEnumHandle0 (Ordinal: 86, Address: 0x1e120)
  • FwpmNetEventDestroyEnumHandle0 (Ordinal: 87, Address: 0x1e180)
  • FwpmNetEventEnum0 (Ordinal: 88, Address: 0x1e1e0)
  • FwpmNetEventEnum1 (Ordinal: 89, Address: 0x1e2e0)
  • FwpmNetEventEnum2 (Ordinal: 90, Address: 0x1e3e0)
  • FwpmNetEventEnum3 (Ordinal: 91, Address: 0x1e4e0)
  • FwpmNetEventEnum4 (Ordinal: 92, Address: 0x1e5e0)
  • FwpmNetEventEnum5 (Ordinal: 93, Address: 0x1e6e0)
  • FwpmNetEventSubscribe0 (Ordinal: 94, Address: 0x1e760)
  • FwpmNetEventSubscribe1 (Ordinal: 95, Address: 0x1e840)
  • FwpmNetEventSubscribe2 (Ordinal: 96, Address: 0x1e920)
  • FwpmNetEventSubscribe3 (Ordinal: 97, Address: 0x1ea00)
  • FwpmNetEventSubscribe4 (Ordinal: 98, Address: 0x17ef0)
  • FwpmNetEventSubscriptionsGet0 (Ordinal: 99, Address: 0x1eae0)
  • FwpmNetEventUnsubscribe0 (Ordinal: 100, Address: 0x1eb50)
  • FwpmNetEventsGetSecurityInfo0 (Ordinal: 101, Address: 0x1ebd0)
  • FwpmNetEventsLost0 (Ordinal: 102, Address: 0x1ec80)
  • FwpmNetEventsSetSecurityInfo0 (Ordinal: 103, Address: 0x1ece0)
  • FwpmProcessNameResolutionEvent0 (Ordinal: 104, Address: 0x1ed80)
  • FwpmProviderAdd0 (Ordinal: 105, Address: 0x18880)
  • FwpmProviderContextAdd0 (Ordinal: 106, Address: 0x18c00)
  • FwpmProviderContextAdd1 (Ordinal: 107, Address: 0x1efa0)
  • FwpmProviderContextAdd2 (Ordinal: 108, Address: 0x1f020)
  • FwpmProviderContextAdd3 (Ordinal: 109, Address: 0x18b60)
  • FwpmProviderContextCreateEnumHandle0 (Ordinal: 110, Address: 0x1f0c0)
  • FwpmProviderContextDeleteById0 (Ordinal: 111, Address: 0x1f120)
  • FwpmProviderContextDeleteByKey0 (Ordinal: 112, Address: 0x1f1b0)
  • FwpmProviderContextDestroyEnumHandle0 (Ordinal: 113, Address: 0x1f240)
  • FwpmProviderContextEnum0 (Ordinal: 114, Address: 0x1f2a0)
  • FwpmProviderContextEnum1 (Ordinal: 115, Address: 0x1f3a0)
  • FwpmProviderContextEnum2 (Ordinal: 116, Address: 0x1f4a0)
  • FwpmProviderContextEnum3 (Ordinal: 117, Address: 0x1f5a0)
  • FwpmProviderContextGetById0 (Ordinal: 118, Address: 0x1f620)
  • FwpmProviderContextGetById1 (Ordinal: 119, Address: 0x1f6f0)
  • FwpmProviderContextGetById2 (Ordinal: 120, Address: 0x1f7b0)
  • FwpmProviderContextGetById3 (Ordinal: 121, Address: 0x1f860)
  • FwpmProviderContextGetByKey0 (Ordinal: 122, Address: 0x1f8d0)
  • FwpmProviderContextGetByKey1 (Ordinal: 123, Address: 0x1f9a0)
  • FwpmProviderContextGetByKey2 (Ordinal: 124, Address: 0x1fa60)
  • FwpmProviderContextGetByKey3 (Ordinal: 125, Address: 0x1fb10)
  • FwpmProviderContextGetSecurityInfoByKey0 (Ordinal: 126, Address: 0x1fb80)
  • FwpmProviderContextSetSecurityInfoByKey0 (Ordinal: 127, Address: 0x1fc30)
  • FwpmProviderContextSubscribeChanges0 (Ordinal: 128, Address: 0x1fce0)
  • FwpmProviderContextSubscriptionsGet0 (Ordinal: 129, Address: 0x1fdc0)
  • FwpmProviderContextUnsubscribeChanges0 (Ordinal: 130, Address: 0x1fe30)
  • FwpmProviderCreateEnumHandle0 (Ordinal: 131, Address: 0x1feb0)
  • FwpmProviderDeleteByKey0 (Ordinal: 132, Address: 0x1ff10)
  • FwpmProviderDestroyEnumHandle0 (Ordinal: 133, Address: 0x1ffa0)
  • FwpmProviderEnum0 (Ordinal: 134, Address: 0x20000)
  • FwpmProviderGetByKey0 (Ordinal: 135, Address: 0x20080)
  • FwpmProviderGetSecurityInfoByKey0 (Ordinal: 136, Address: 0x200f0)
  • FwpmProviderSetSecurityInfoByKey0 (Ordinal: 137, Address: 0x201a0)
  • FwpmProviderSubscribeChanges0 (Ordinal: 138, Address: 0x20250)
  • FwpmProviderSubscriptionsGet0 (Ordinal: 139, Address: 0x20330)
  • FwpmProviderUnsubscribeChanges0 (Ordinal: 140, Address: 0x203a0)
  • FwpmSessionCreateEnumHandle0 (Ordinal: 141, Address: 0x20420)
  • FwpmSessionDestroyEnumHandle0 (Ordinal: 142, Address: 0x20480)
  • FwpmSessionEnum0 (Ordinal: 143, Address: 0x204e0)
  • FwpmSubLayerAdd0 (Ordinal: 144, Address: 0x18930)
  • FwpmSubLayerCreateEnumHandle0 (Ordinal: 145, Address: 0x20560)
  • FwpmSubLayerDeleteByKey0 (Ordinal: 146, Address: 0x205c0)
  • FwpmSubLayerDestroyEnumHandle0 (Ordinal: 147, Address: 0x20650)
  • FwpmSubLayerEnum0 (Ordinal: 148, Address: 0x206b0)
  • FwpmSubLayerGetByKey0 (Ordinal: 149, Address: 0x20730)
  • FwpmSubLayerGetSecurityInfoByKey0 (Ordinal: 150, Address: 0x207a0)
  • FwpmSubLayerSetSecurityInfoByKey0 (Ordinal: 151, Address: 0x20850)
  • FwpmSubLayerSubscribeChanges0 (Ordinal: 152, Address: 0x20900)
  • FwpmSubLayerSubscriptionsGet0 (Ordinal: 153, Address: 0x209e0)
  • FwpmSubLayerUnsubscribeChanges0 (Ordinal: 154, Address: 0x20a50)
  • FwpmSystemPortsGet0 (Ordinal: 155, Address: 0x245e0)
  • FwpmSystemPortsSubscribe0 (Ordinal: 156, Address: 0x24620)
  • FwpmSystemPortsUnsubscribe0 (Ordinal: 157, Address: 0x246d0)
  • FwpmTraceRestoreDefaults0 (Ordinal: 158, Address: 0x24980)
  • FwpmTransactionAbort0 (Ordinal: 159, Address: 0x20ad0)
  • FwpmTransactionBegin0 (Ordinal: 160, Address: 0x175d0)
  • FwpmTransactionCommit0 (Ordinal: 161, Address: 0x17560)
  • FwpmvSwitchEventSubscribe0 (Ordinal: 162, Address: 0x20b50)
  • FwpmvSwitchEventUnsubscribe0 (Ordinal: 163, Address: 0x20c30)
  • FwpmvSwitchEventsGetSecurityInfo0 (Ordinal: 164, Address: 0x20cb0)
  • FwpmvSwitchEventsSetSecurityInfo0 (Ordinal: 165, Address: 0x20d60)
  • FwppConnectionGetByIPsecInfo (Ordinal: 166, Address: 0x20e90)
  • FwppConnectionGetByS2STunnelId (Ordinal: 167, Address: 0x20f10)
  • FwppConnectionGetS2STunnelId (Ordinal: 168, Address: 0x20f80)
  • FwppGetMD5HashBytes (Ordinal: 169, Address: 0x21160)
  • FwppIPsecSaContextCreate (Ordinal: 170, Address: 0x21190)
  • FwpsAleEndpointCreateEnumHandle0 (Ordinal: 171, Address: 0x214b0)
  • FwpsAleEndpointDestroyEnumHandle0 (Ordinal: 172, Address: 0x21510)
  • FwpsAleEndpointEnum0 (Ordinal: 173, Address: 0x21570)
  • FwpsAleEndpointGetById0 (Ordinal: 174, Address: 0x215f0)
  • FwpsAleEndpointGetSecurityInfo0 (Ordinal: 175, Address: 0x21660)
  • FwpsAleEndpointSetSecurityInfo0 (Ordinal: 176, Address: 0x21710)
  • FwpsAleExplicitCredentialsQuery0 (Ordinal: 177, Address: 0x217b0)
  • FwpsAleGetPortStatus0 (Ordinal: 178, Address: 0x21820)
  • FwpsClassifyUser0 (Ordinal: 179, Address: 0x218b0)
  • FwpsFreeMemory0 (Ordinal: 180, Address: 0x17700)
  • FwpsGetInProcReplicaOffset0 (Ordinal: 181, Address: 0x25710)
  • FwpsLayerCreateInProcReplica0 (Ordinal: 182, Address: 0x25790)
  • FwpsLayerReleaseInProcReplica0 (Ordinal: 183, Address: 0x25800)
  • FwpsOpenToken0 (Ordinal: 184, Address: 0x219d0)
  • FwpsQueryIPsecDosFWUsed0 (Ordinal: 185, Address: 0x21ad0)
  • FwpsQueryIPsecOffloadDone0 (Ordinal: 186, Address: 0x21b30)
  • GetUnifiedTraceHandle (Ordinal: 187, Address: 0x21b90)
  • IPsecDospGetSecurityInfo0 (Ordinal: 188, Address: 0x21bc0)
  • IPsecDospGetStatistics0 (Ordinal: 189, Address: 0x21c70)
  • IPsecDospSetSecurityInfo0 (Ordinal: 190, Address: 0x21ce0)
  • IPsecDospStateCreateEnumHandle0 (Ordinal: 191, Address: 0x21d80)
  • IPsecDospStateDestroyEnumHandle0 (Ordinal: 192, Address: 0x21de0)
  • IPsecDospStateEnum0 (Ordinal: 193, Address: 0x21e40)
  • IPsecGetKeyFromDictator0 (Ordinal: 194, Address: 0x22380)
  • IPsecGetStatistics0 (Ordinal: 195, Address: 0x22490)
  • IPsecGetStatistics1 (Ordinal: 196, Address: 0x22540)
  • IPsecKeyDictationCheck0 (Ordinal: 197, Address: 0x225b0)
  • IPsecKeyManagerAddAndRegister0 (Ordinal: 198, Address: 0x22620)
  • IPsecKeyManagerGetSecurityInfoByKey0 (Ordinal: 199, Address: 0x22780)
  • IPsecKeyManagerSetSecurityInfoByKey0 (Ordinal: 200, Address: 0x22830)
  • IPsecKeyManagerUnregisterAndDelete0 (Ordinal: 201, Address: 0x228e0)
  • IPsecKeyManagersGet0 (Ordinal: 202, Address: 0x22970)
  • IPsecKeyModuleAdd0 (Ordinal: 203, Address: 0x229e0)
  • IPsecKeyModuleDelete0 (Ordinal: 204, Address: 0x22b20)
  • IPsecKeyModuleUpdateAcquire0 (Ordinal: 205, Address: 0x22ba0)
  • IPsecKeyNotification0 (Ordinal: 206, Address: 0x22c10)
  • IPsecSaContextAddInbound0 (Ordinal: 207, Address: 0x22c80)
  • IPsecSaContextAddInbound1 (Ordinal: 208, Address: 0x22d10)
  • IPsecSaContextAddInboundAndTrackConnection (Ordinal: 209, Address: 0x22d80)
  • IPsecSaContextAddOutbound0 (Ordinal: 210, Address: 0x22df0)
  • IPsecSaContextAddOutbound1 (Ordinal: 211, Address: 0x22e80)
  • IPsecSaContextAddOutboundAndTrackConnection (Ordinal: 212, Address: 0x22ef0)
  • IPsecSaContextCreate0 (Ordinal: 213, Address: 0x22f60)
  • IPsecSaContextCreate1 (Ordinal: 214, Address: 0x22fe0)
  • IPsecSaContextCreateEnumHandle0 (Ordinal: 215, Address: 0x23060)
  • IPsecSaContextDeleteById0 (Ordinal: 216, Address: 0x230c0)
  • IPsecSaContextDestroyEnumHandle0 (Ordinal: 217, Address: 0x23120)
  • IPsecSaContextEnum0 (Ordinal: 218, Address: 0x23180)
  • IPsecSaContextEnum1 (Ordinal: 219, Address: 0x23280)
  • IPsecSaContextExpire0 (Ordinal: 220, Address: 0x23300)
  • IPsecSaContextGetById0 (Ordinal: 221, Address: 0x23360)
  • IPsecSaContextGetById1 (Ordinal: 222, Address: 0x23410)
  • IPsecSaContextGetSpi0 (Ordinal: 223, Address: 0x23480)
  • IPsecSaContextGetSpi1 (Ordinal: 224, Address: 0x23510)
  • IPsecSaContextSetSpi0 (Ordinal: 225, Address: 0x23590)
  • IPsecSaContextSubscribe0 (Ordinal: 226, Address: 0x23610)
  • IPsecSaContextSubscriptionsGet0 (Ordinal: 227, Address: 0x236f0)
  • IPsecSaContextUnsubscribe0 (Ordinal: 228, Address: 0x23760)
  • IPsecSaContextUpdate0 (Ordinal: 229, Address: 0x237e0)
  • IPsecSaCreateEnumHandle0 (Ordinal: 230, Address: 0x23840)
  • IPsecSaDbGetSecurityInfo0 (Ordinal: 231, Address: 0x238a0)
  • IPsecSaDbSetSecurityInfo0 (Ordinal: 232, Address: 0x23950)
  • IPsecSaDestroyEnumHandle0 (Ordinal: 233, Address: 0x239f0)
  • IPsecSaEnum0 (Ordinal: 234, Address: 0x23a50)
  • IPsecSaEnum1 (Ordinal: 235, Address: 0x23b50)
  • IPsecSaInitiateAsync0 (Ordinal: 236, Address: 0x23bd0)
  • IkeextGetConfigParameters0 (Ordinal: 237, Address: 0x25880)
  • IkeextGetStatistics0 (Ordinal: 238, Address: 0x259d0)
  • IkeextGetStatistics1 (Ordinal: 239, Address: 0x25a50)
  • IkeextSaCreateEnumHandle0 (Ordinal: 240, Address: 0x25b30)
  • IkeextSaDbGetSecurityInfo0 (Ordinal: 241, Address: 0x25ba0)
  • IkeextSaDbSetSecurityInfo0 (Ordinal: 242, Address: 0x25c60)
  • IkeextSaDeleteById0 (Ordinal: 243, Address: 0x25d10)
  • IkeextSaDestroyEnumHandle0 (Ordinal: 244, Address: 0x25d80)
  • IkeextSaEnum0 (Ordinal: 245, Address: 0x25df0)
  • IkeextSaEnum1 (Ordinal: 246, Address: 0x25ef0)
  • IkeextSaEnum2 (Ordinal: 247, Address: 0x25ff0)
  • IkeextSaGetById0 (Ordinal: 248, Address: 0x26070)
  • IkeextSaGetById1 (Ordinal: 249, Address: 0x26110)
  • IkeextSaGetById2 (Ordinal: 250, Address: 0x261b0)
  • IkeextSaUpdateAdditionalAddressesByTunnelId0 (Ordinal: 251, Address: 0x26230)
  • IkeextSaUpdatePreferredAddressesByTunnelId0 (Ordinal: 252, Address: 0x26310)
  • IkeextSetConfigParameters0 (Ordinal: 253, Address: 0x263f0)
  • NamespaceCallout (Ordinal: 254, Address: 0x15770)
  • WFPRIODequeueCompletion (Ordinal: 255, Address: 0x3dce0)
  • WSADeleteSocketPeerTargetName (Ordinal: 256, Address: 0x26500)
  • WSAImpersonateSocketPeer (Ordinal: 257, Address: 0x26540)
  • WSAQuerySocketSecurity (Ordinal: 258, Address: 0x266c0)
  • WSARevertImpersonation (Ordinal: 259, Address: 0x26710)
  • WSASetSocketPeerTargetName (Ordinal: 260, Address: 0x26740)
  • WSASetSocketSecurity (Ordinal: 261, Address: 0x26780)
  • WfpCloseDPConfigureHandle (Ordinal: 262, Address: 0x3de10)
  • WfpConfigureDPSecurityDescriptor (Ordinal: 263, Address: 0x3de30)
  • WfpCreateDPConfigureHandle (Ordinal: 264, Address: 0x3de80)
  • WfpRIOChannelClose (Ordinal: 265, Address: 0x3de10)
  • WfpRIOCleanupRequestQueue (Ordinal: 266, Address: 0x3e0e0)
  • WfpRIOCloseCompletionQueue (Ordinal: 267, Address: 0x3e160)
  • WfpRIOCreateChannel (Ordinal: 268, Address: 0x3e1e0)
  • WfpRIOCreateCompletionQueue (Ordinal: 269, Address: 0x3e210)
  • WfpRIOCreateRequestQueue (Ordinal: 270, Address: 0x3e390)
  • WfpRIODeregisterBuffer (Ordinal: 271, Address: 0x3e510)
  • WfpRIOIndicateActivityThreshold (Ordinal: 272, Address: 0x3e570)
  • WfpRIONotify (Ordinal: 273, Address: 0x3e5c0)
  • WfpRIOReceive (Ordinal: 274, Address: 0x3e620)
  • WfpRIORegisterBuffer (Ordinal: 275, Address: 0x3e6d0)
  • WfpRIOResume (Ordinal: 276, Address: 0x3e760)
  • WfpRIOSend (Ordinal: 277, Address: 0x3e7b0)
  • WfpRIOSuspend (Ordinal: 278, Address: 0x3e860)

Imported DLLs & Functions

api-ms-win-core-delayload-l1-1-0.dll
  • DelayLoadFailureHook (Address: 0x10050044)
api-ms-win-core-delayload-l1-1-1.dll
  • ResolveDelayLoadedAPI (Address: 0x1005004c)
api-ms-win-core-errorhandling-l1-1-0.dll
  • GetLastError (Address: 0x1005005c)
  • SetUnhandledExceptionFilter (Address: 0x10050054)
  • UnhandledExceptionFilter (Address: 0x10050058)
api-ms-win-core-file-l1-1-0.dll
  • CreateFileW (Address: 0x10050064)
api-ms-win-core-handle-l1-1-0.dll
  • CloseHandle (Address: 0x1005006c)
  • DuplicateHandle (Address: 0x10050070)
api-ms-win-core-heap-l1-1-0.dll
  • GetProcessHeap (Address: 0x10050088)
  • HeapAlloc (Address: 0x10050078)
  • HeapFree (Address: 0x10050084)
  • HeapReAlloc (Address: 0x10050080)
  • HeapSize (Address: 0x1005007c)
api-ms-win-core-libraryloader-l1-2-0.dll
  • DisableThreadLibraryCalls (Address: 0x10050094)
  • FreeLibrary (Address: 0x10050090)
  • FreeLibraryAndExitThread (Address: 0x100500a0)
  • GetModuleHandleA (Address: 0x100500a8)
  • GetModuleHandleExA (Address: 0x10050098)
  • GetModuleHandleExW (Address: 0x1005009c)
  • GetProcAddress (Address: 0x100500a4)
api-ms-win-core-processenvironment-l1-1-0.dll
  • ExpandEnvironmentStringsW (Address: 0x100500b0)
api-ms-win-core-processthreads-l1-1-0.dll
  • CreateThread (Address: 0x100500c0)
  • GetCurrentProcess (Address: 0x100500bc)
  • GetCurrentProcessId (Address: 0x100500d0)
  • GetCurrentThread (Address: 0x100500dc)
  • GetCurrentThreadId (Address: 0x100500c4)
  • GetThreadId (Address: 0x100500c8)
  • OpenProcessToken (Address: 0x100500cc)
  • OpenThreadToken (Address: 0x100500d8)
  • SetThreadToken (Address: 0x100500d4)
  • TerminateProcess (Address: 0x100500b8)
api-ms-win-core-processthreads-l1-1-1.dll
  • OpenProcess (Address: 0x100500e4)
api-ms-win-core-profile-l1-1-0.dll
  • QueryPerformanceCounter (Address: 0x100500ec)
api-ms-win-core-registry-l1-1-0.dll
  • RegCloseKey (Address: 0x10050118)
  • RegCreateKeyExW (Address: 0x1005010c)
  • RegDeleteKeyExW (Address: 0x10050104)
  • RegDeleteValueW (Address: 0x10050108)
  • RegEnumKeyExW (Address: 0x100500fc)
  • RegEnumValueW (Address: 0x100500f4)
  • RegNotifyChangeKeyValue (Address: 0x10050110)
  • RegOpenKeyExW (Address: 0x10050114)
  • RegQueryValueExW (Address: 0x10050100)
  • RegSetValueExW (Address: 0x100500f8)
api-ms-win-core-string-l1-1-0.dll
  • CompareStringW (Address: 0x10050120)
api-ms-win-core-synch-l1-1-0.dll
  • AcquireSRWLockExclusive (Address: 0x10050158)
  • CreateEventW (Address: 0x10050160)
  • CreateSemaphoreExW (Address: 0x1005015c)
  • DeleteCriticalSection (Address: 0x10050140)
  • EnterCriticalSection (Address: 0x10050144)
  • InitializeCriticalSectionAndSpinCount (Address: 0x1005013c)
  • InitializeSRWLock (Address: 0x10050130)
  • LeaveCriticalSection (Address: 0x1005014c)
  • OpenEventW (Address: 0x10050138)
  • ReleaseSemaphore (Address: 0x10050128)
  • ReleaseSRWLockExclusive (Address: 0x10050134)
  • SetEvent (Address: 0x10050150)
  • TryAcquireSRWLockExclusive (Address: 0x1005012c)
  • TryEnterCriticalSection (Address: 0x10050148)
  • WaitForSingleObject (Address: 0x10050154)
api-ms-win-core-synch-l1-2-0.dll
  • Sleep (Address: 0x10050168)
api-ms-win-core-sysinfo-l1-1-0.dll
  • GetSystemTimeAsFileTime (Address: 0x10050174)
  • GetTickCount (Address: 0x10050170)
api-ms-win-core-threadpool-l1-2-0.dll
  • CloseThreadpoolTimer (Address: 0x1005017c)
  • CreateThreadpoolTimer (Address: 0x10050180)
  • SetThreadpoolTimer (Address: 0x10050188)
  • WaitForThreadpoolTimerCallbacks (Address: 0x10050184)
api-ms-win-core-threadpool-legacy-l1-1-0.dll
  • QueueUserWorkItem (Address: 0x10050194)
  • UnregisterWaitEx (Address: 0x10050190)
api-ms-win-core-threadpool-private-l1-1-0.dll
  • RegisterWaitForSingleObjectEx (Address: 0x1005019c)
api-ms-win-eventing-provider-l1-1-0.dll
  • EventRegister (Address: 0x100501ac)
  • EventSetInformation (Address: 0x100501b0)
  • EventUnregister (Address: 0x100501a4)
  • EventWriteTransfer (Address: 0x100501a8)
api-ms-win-security-base-l1-1-0.dll
  • CopySid (Address: 0x100501c4)
  • GetLengthSid (Address: 0x100501bc)
  • GetTokenInformation (Address: 0x100501b8)
  • RevertToSelf (Address: 0x100501c0)
bcrypt.dll
  • BCryptCreateHash (Address: 0x100501d0)
  • BCryptDestroyHash (Address: 0x100501dc)
  • BCryptFinishHash (Address: 0x100501d8)
  • BCryptGetProperty (Address: 0x100501e0)
  • BCryptHashData (Address: 0x100501d4)
  • BCryptOpenAlgorithmProvider (Address: 0x100501cc)
msvcrt.dll
  • _amsg_exit (Address: 0x10050210)
  • _except_handler4_common (Address: 0x100501ec)
  • _initterm (Address: 0x100501f4)
  • _wcsicmp (Address: 0x100501e8)
  • _wcslwr (Address: 0x10050214)
  • _wcslwr_s (Address: 0x10050208)
  • _XcptFilter (Address: 0x1005021c)
  • free (Address: 0x1005020c)
  • malloc (Address: 0x100501fc)
  • memcmp (Address: 0x10050200)
  • memcpy (Address: 0x10050204)
  • memset (Address: 0x10050218)
  • qsort (Address: 0x100501f0)
  • wcschr (Address: 0x100501f8)
ntdll.dll
  • EtwEventActivityIdControl (Address: 0x10050278)
  • EtwEventEnabled (Address: 0x1005026c)
  • EtwEventRegister (Address: 0x100502ec)
  • EtwEventUnregister (Address: 0x1005027c)
  • EtwEventWrite (Address: 0x10050274)
  • EtwEventWriteTransfer (Address: 0x10050270)
  • EtwGetTraceEnableFlags (Address: 0x100502dc)
  • EtwGetTraceEnableLevel (Address: 0x100502e4)
  • EtwGetTraceLoggerHandle (Address: 0x100502e0)
  • EtwRegisterTraceGuidsW (Address: 0x100502e8)
  • EtwTraceMessage (Address: 0x100502d0)
  • EtwUnregisterTraceGuids (Address: 0x100502d8)
  • NtClose (Address: 0x10050284)
  • NtCreateFile (Address: 0x1005028c)
  • NtDeviceIoControlFile (Address: 0x10050288)
  • NtQueryInformationToken (Address: 0x10050298)
  • NtQueryObject (Address: 0x1005023c)
  • RtlAbsoluteToSelfRelativeSD (Address: 0x10050230)
  • RtlAllocateHeap (Address: 0x10050224)
  • RtlContractHashTable (Address: 0x10050238)
  • RtlCopySid (Address: 0x100502a0)
  • RtlCreateHashTable (Address: 0x10050268)
  • RtlCreateSecurityDescriptor (Address: 0x100502bc)
  • RtlDeleteHashTable (Address: 0x10050264)
  • RtlEndEnumerationHashTable (Address: 0x10050248)
  • RtlEnumerateEntryHashTable (Address: 0x1005024c)
  • RtlEqualSid (Address: 0x1005029c)
  • RtlExpandHashTable (Address: 0x10050240)
  • RtlFreeHeap (Address: 0x100502d4)
  • RtlGetControlSecurityDescriptor (Address: 0x1005022c)
  • RtlGetDaclSecurityDescriptor (Address: 0x100502c4)
  • RtlGetGroupSecurityDescriptor (Address: 0x100502c8)
  • RtlGetNextEntryHashTable (Address: 0x10050254)
  • RtlGetOwnerSecurityDescriptor (Address: 0x100502cc)
  • RtlGetSaclSecurityDescriptor (Address: 0x100502c0)
  • RtlGetThreadPreferredUILanguages (Address: 0x10050244)
  • RtlInitEnumerationHashTable (Address: 0x10050250)
  • RtlInitUnicodeString (Address: 0x10050290)
  • RtlInsertEntryHashTable (Address: 0x10050260)
  • RtlLengthSecurityDescriptor (Address: 0x10050228)
  • RtlLengthSid (Address: 0x100502a4)
  • RtlLookupEntryHashTable (Address: 0x10050258)
  • RtlNtStatusToDosError (Address: 0x10050280)
  • RtlRemoveEntryHashTable (Address: 0x1005025c)
  • RtlSetDaclSecurityDescriptor (Address: 0x100502b0)
  • RtlSetGroupSecurityDescriptor (Address: 0x100502b4)
  • RtlSetOwnerSecurityDescriptor (Address: 0x100502b8)
  • RtlSetSaclSecurityDescriptor (Address: 0x100502ac)
  • RtlSubAuthorityCountSid (Address: 0x10050234)
  • RtlValidSecurityDescriptor (Address: 0x10050294)
  • RtlValidSid (Address: 0x100502a8)
RPCRT4.dll
  • I_RpcExceptionFilter (Address: 0x10050030)
  • MesDecodeBufferHandleCreate (Address: 0x1005003c)
  • MesEncodeDynBufferHandleCreate (Address: 0x10050034)
  • MesHandleFree (Address: 0x10050038)
  • NdrAsyncClientCall2 (Address: 0x10050018)
  • NdrClientCall4 (Address: 0x10050014)
  • NdrMesTypeDecode2 (Address: 0x1005000c)
  • NdrMesTypeEncode2 (Address: 0x10050008)
  • RpcAsyncCompleteCall (Address: 0x10050000)
  • RpcAsyncInitializeHandle (Address: 0x10050004)
  • RpcBindingBind (Address: 0x10050010)
  • RpcBindingCreateW (Address: 0x1005001c)
  • RpcBindingFree (Address: 0x10050024)
  • RpcBindingSetOption (Address: 0x10050020)
  • RpcSsDestroyClientContext (Address: 0x1005002c)
  • UuidCreate (Address: 0x10050028)