CBDHSvc.dll
Description: Microsoft (R) Clipboard History
Authors: © Microsoft Corporation. All rights reserved.
Version: 10.0.19041.6033
Architecture: 64-bit
Operating System: Windows NT
SHA256: 8ccfd4ea21ab27b7d24682e37783577e
File Size: 1004.0 KB
Uploaded At: Dec. 1, 2025, 7:23 a.m.
Views: 7
Security Warning
This file has been flagged as potentially dangerous.
Reason: Detected potentially dangerous functions used for process injection: OpenProcess
Exported Functions
- ServiceMain (Ordinal: 1, Address: 0x10ac0)
- SvchostPushServiceGlobals (Ordinal: 2, Address: 0x10be0)
Imported DLLs & Functions
api-ms-win-appmodel-runtime-l1-1-1.dll
- GetApplicationUserModelIdFromToken (Address: 0x1800c8e30)
api-ms-win-core-apiquery-l1-1-0.dll
- ApiSetQueryApiSetPresence (Address: 0x1800c8e40)
api-ms-win-core-atoms-l1-1-0.dll
- GlobalGetAtomNameW (Address: 0x1800c8e50)
api-ms-win-core-com-l1-1-0.dll
- CoCreateFreeThreadedMarshaler (Address: 0x1800c8f08)
- CoCreateGuid (Address: 0x1800c8e98)
- CoCreateInstance (Address: 0x1800c8ea8)
- CoDecrementMTAUsage (Address: 0x1800c8eb0)
- CoDisconnectContext (Address: 0x1800c8eb8)
- CoGetApartmentType (Address: 0x1800c8ed8)
- CoGetInterfaceAndReleaseStream (Address: 0x1800c8ea0)
- CoImpersonateClient (Address: 0x1800c8e70)
- CoIncrementMTAUsage (Address: 0x1800c8e88)
- CoInitializeEx (Address: 0x1800c8e60)
- CoMarshalInterface (Address: 0x1800c8ec0)
- CoRegisterClassObject (Address: 0x1800c8ef0)
- CoReleaseMarshalData (Address: 0x1800c8ed0)
- CoResumeClassObjects (Address: 0x1800c8ef8)
- CoRevertToSelf (Address: 0x1800c8e68)
- CoRevokeClassObject (Address: 0x1800c8ee8)
- CoTaskMemAlloc (Address: 0x1800c8f00)
- CoTaskMemFree (Address: 0x1800c8e78)
- CoUninitialize (Address: 0x1800c8e80)
- CoWaitForMultipleHandles (Address: 0x1800c8ee0)
- CreateStreamOnHGlobal (Address: 0x1800c8ec8)
- IIDFromString (Address: 0x1800c8e90)
- StringFromGUID2 (Address: 0x1800c8f10)
api-ms-win-core-com-l1-1-1.dll
- RoGetAgileReference (Address: 0x1800c8f20)
api-ms-win-core-debug-l1-1-0.dll
- DebugBreak (Address: 0x1800c8f38)
- IsDebuggerPresent (Address: 0x1800c8f40)
- OutputDebugStringW (Address: 0x1800c8f30)
api-ms-win-core-delayload-l1-1-0.dll
- DelayLoadFailureHook (Address: 0x1800c8f50)
api-ms-win-core-delayload-l1-1-1.dll
- ResolveDelayLoadedAPI (Address: 0x1800c8f60)
api-ms-win-core-errorhandling-l1-1-0.dll
- GetLastError (Address: 0x1800c8f90)
- RaiseException (Address: 0x1800c8f80)
- SetLastError (Address: 0x1800c8f88)
- SetUnhandledExceptionFilter (Address: 0x1800c8f78)
- UnhandledExceptionFilter (Address: 0x1800c8f70)
api-ms-win-core-file-l1-1-0.dll
- CreateDirectoryW (Address: 0x1800c8fa0)
api-ms-win-core-handle-l1-1-0.dll
- CloseHandle (Address: 0x1800c8fb0)
api-ms-win-core-heap-l1-1-0.dll
- GetProcessHeap (Address: 0x1800c8fc0)
- HeapAlloc (Address: 0x1800c8fc8)
- HeapFree (Address: 0x1800c8fd0)
api-ms-win-core-heap-l2-1-0.dll
- LocalAlloc (Address: 0x1800c8fe0)
- LocalFree (Address: 0x1800c8fe8)
api-ms-win-core-interlocked-l1-1-0.dll
- InitializeSListHead (Address: 0x1800c8ff8)
api-ms-win-core-kernel32-legacy-l1-1-0.dll
- UnregisterWait (Address: 0x1800c9008)
api-ms-win-core-libraryloader-l1-2-0.dll
- DisableThreadLibraryCalls (Address: 0x1800c9020)
- FindStringOrdinal (Address: 0x1800c9050)
- FreeLibrary (Address: 0x1800c9060)
- FreeLibraryAndExitThread (Address: 0x1800c9018)
- GetModuleFileNameA (Address: 0x1800c9038)
- GetModuleFileNameW (Address: 0x1800c9058)
- GetModuleHandleExW (Address: 0x1800c9028)
- GetModuleHandleW (Address: 0x1800c9030)
- GetProcAddress (Address: 0x1800c9040)
- LoadLibraryExW (Address: 0x1800c9048)
api-ms-win-core-localization-l1-2-0.dll
- FormatMessageW (Address: 0x1800c9070)
api-ms-win-core-path-l1-1-0.dll
- PathCchSkipRoot (Address: 0x1800c9080)
api-ms-win-core-processthreads-l1-1-0.dll
- GetCurrentProcess (Address: 0x1800c90b0)
- GetCurrentProcessId (Address: 0x1800c90a0)
- GetCurrentThread (Address: 0x1800c90b8)
- GetCurrentThreadId (Address: 0x1800c90a8)
- GetProcessId (Address: 0x1800c9098)
- OpenProcessToken (Address: 0x1800c9090)
- OpenThreadToken (Address: 0x1800c90c0)
- ProcessIdToSessionId (Address: 0x1800c90d0)
- TerminateProcess (Address: 0x1800c90c8)
api-ms-win-core-processthreads-l1-1-1.dll
- IsProcessorFeaturePresent (Address: 0x1800c90e8)
- OpenProcess (Address: 0x1800c90e0)
api-ms-win-core-profile-l1-1-0.dll
- QueryPerformanceCounter (Address: 0x1800c90f8)
api-ms-win-core-psapi-l1-1-0.dll
- K32GetModuleFileNameExW (Address: 0x1800c9108)
api-ms-win-core-realtime-l1-1-0.dll
- QueryUnbiasedInterruptTime (Address: 0x1800c9118)
api-ms-win-core-registry-l1-1-0.dll
- RegCloseKey (Address: 0x1800c9148)
- RegCreateKeyExW (Address: 0x1800c9158)
- RegEnumKeyExW (Address: 0x1800c9160)
- RegGetValueW (Address: 0x1800c9130)
- RegNotifyChangeKeyValue (Address: 0x1800c9138)
- RegOpenKeyExW (Address: 0x1800c9150)
- RegQueryInfoKeyW (Address: 0x1800c9140)
- RegQueryValueExW (Address: 0x1800c9128)
api-ms-win-core-registry-l1-1-1.dll
- RegSetKeyValueW (Address: 0x1800c9170)
api-ms-win-core-rtlsupport-l1-1-0.dll
- RtlCaptureContext (Address: 0x1800c9180)
- RtlLookupFunctionEntry (Address: 0x1800c9188)
- RtlVirtualUnwind (Address: 0x1800c9190)
api-ms-win-core-shlwapi-legacy-l1-1-0.dll
- PathFindFileNameW (Address: 0x1800c91a8)
- PathIsFileSpecW (Address: 0x1800c91a0)
api-ms-win-core-synch-l1-1-0.dll
- AcquireSRWLockExclusive (Address: 0x1800c9258)
- AcquireSRWLockShared (Address: 0x1800c91c8)
- CreateEventExW (Address: 0x1800c91b8)
- CreateEventW (Address: 0x1800c91e8)
- CreateMutexExW (Address: 0x1800c91d0)
- CreateSemaphoreExW (Address: 0x1800c91e0)
- DeleteCriticalSection (Address: 0x1800c91c0)
- EnterCriticalSection (Address: 0x1800c9238)
- InitializeCriticalSectionAndSpinCount (Address: 0x1800c9230)
- InitializeCriticalSectionEx (Address: 0x1800c9218)
- InitializeSRWLock (Address: 0x1800c9208)
- LeaveCriticalSection (Address: 0x1800c9210)
- OpenSemaphoreW (Address: 0x1800c9250)
- ReleaseMutex (Address: 0x1800c9240)
- ReleaseSemaphore (Address: 0x1800c91f0)
- ReleaseSRWLockExclusive (Address: 0x1800c9248)
- ReleaseSRWLockShared (Address: 0x1800c9200)
- ResetEvent (Address: 0x1800c9228)
- SetEvent (Address: 0x1800c91f8)
- TryAcquireSRWLockExclusive (Address: 0x1800c91d8)
- WaitForSingleObject (Address: 0x1800c9220)
- WaitForSingleObjectEx (Address: 0x1800c9260)
api-ms-win-core-synch-l1-2-0.dll
- InitOnceBeginInitialize (Address: 0x1800c9298)
- InitOnceComplete (Address: 0x1800c92a0)
- InitOnceExecuteOnce (Address: 0x1800c9270)
- Sleep (Address: 0x1800c9290)
- WaitOnAddress (Address: 0x1800c9288)
- WakeByAddressAll (Address: 0x1800c9280)
- WakeByAddressSingle (Address: 0x1800c9278)
api-ms-win-core-sysinfo-l1-1-0.dll
- GetSystemTimeAsFileTime (Address: 0x1800c92b8)
- GetTickCount (Address: 0x1800c92c0)
- GetTickCount64 (Address: 0x1800c92b0)
api-ms-win-core-sysinfo-l1-2-0.dll
- GetSystemTimePreciseAsFileTime (Address: 0x1800c92d0)
api-ms-win-core-threadpool-l1-2-0.dll
- CloseThreadpoolTimer (Address: 0x1800c9300)
- CloseThreadpoolWait (Address: 0x1800c92f8)
- CreateThreadpoolTimer (Address: 0x1800c9310)
- CreateThreadpoolWait (Address: 0x1800c9318)
- SetThreadpoolTimer (Address: 0x1800c92f0)
- SetThreadpoolWait (Address: 0x1800c9308)
- WaitForThreadpoolTimerCallbacks (Address: 0x1800c92e0)
- WaitForThreadpoolWaitCallbacks (Address: 0x1800c92e8)
api-ms-win-core-util-l1-1-0.dll
- DecodePointer (Address: 0x1800c9328)
- EncodePointer (Address: 0x1800c9330)
api-ms-win-core-winrt-error-l1-1-0.dll
- GetRestrictedErrorInfo (Address: 0x1800c9358)
- RoOriginateError (Address: 0x1800c9360)
- RoOriginateErrorW (Address: 0x1800c9350)
- RoTransformError (Address: 0x1800c9340)
- SetRestrictedErrorInfo (Address: 0x1800c9348)
api-ms-win-core-winrt-error-l1-1-1.dll
- IsErrorPropagationEnabled (Address: 0x1800c9378)
- RoGetMatchingRestrictedErrorInfo (Address: 0x1800c9370)
- RoReportFailedDelegate (Address: 0x1800c9380)
api-ms-win-core-winrt-l1-1-0.dll
- RoActivateInstance (Address: 0x1800c93a8)
- RoGetActivationFactory (Address: 0x1800c9398)
- RoRegisterActivationFactories (Address: 0x1800c93a0)
- RoRevokeActivationFactories (Address: 0x1800c9390)
api-ms-win-core-winrt-string-l1-1-0.dll
- WindowsCompareStringOrdinal (Address: 0x1800c93c8)
- WindowsCreateString (Address: 0x1800c93e0)
- WindowsCreateStringReference (Address: 0x1800c93d8)
- WindowsDeleteString (Address: 0x1800c93c0)
- WindowsDuplicateString (Address: 0x1800c93d0)
- WindowsGetStringRawBuffer (Address: 0x1800c93b8)
- WindowsIsStringEmpty (Address: 0x1800c93f0)
- WindowsStringHasEmbeddedNull (Address: 0x1800c93e8)
api-ms-win-crt-math-l1-1-0.dll
- ceilf (Address: 0x1800c9400)
api-ms-win-crt-private-l1-1-0.dll
- __C_specific_handler (Address: 0x1800c9490)
- __CxxFrameHandler3 (Address: 0x1800c9498)
- __CxxFrameHandler4 (Address: 0x1800c9538)
- __std_terminate (Address: 0x1800c9530)
- __std_type_info_compare (Address: 0x1800c9518)
- _CxxThrowException (Address: 0x1800c94a0)
- _o___std_exception_copy (Address: 0x1800c9508)
- _o___std_exception_destroy (Address: 0x1800c9500)
- _o___std_type_info_destroy_list (Address: 0x1800c94f8)
- _o___stdio_common_vsnprintf_s (Address: 0x1800c94f0)
- _o___stdio_common_vsprintf_s (Address: 0x1800c94e8)
- _o___stdio_common_vswprintf (Address: 0x1800c94e0)
- _o___stdio_common_vswscanf (Address: 0x1800c94d8)
- _o__beginthreadex (Address: 0x1800c94d0)
- _o__callnewh (Address: 0x1800c94c8)
- _o__cexit (Address: 0x1800c94c0)
- _o__configure_narrow_argv (Address: 0x1800c94b8)
- _o__crt_atexit (Address: 0x1800c94b0)
- _o__difftime64 (Address: 0x1800c94a8)
- _o__errno (Address: 0x1800c9528)
- _o__execute_onexit_table (Address: 0x1800c9520)
- _o__gmtime64 (Address: 0x1800c9410)
- _o__initialize_narrow_environment (Address: 0x1800c9418)
- _o__initialize_onexit_table (Address: 0x1800c9420)
- _o__invalid_parameter_noinfo (Address: 0x1800c9428)
- _o__invalid_parameter_noinfo_noreturn (Address: 0x1800c9430)
- _o__mkgmtime64 (Address: 0x1800c9438)
- _o__purecall (Address: 0x1800c9440)
- _o__register_onexit_function (Address: 0x1800c9448)
- _o__seh_filter_dll (Address: 0x1800c9450)
- _o__wcsicmp (Address: 0x1800c9458)
- _o_free (Address: 0x1800c9468)
- _o_malloc (Address: 0x1800c9470)
- _o_realloc (Address: 0x1800c9478)
- _o_terminate (Address: 0x1800c9480)
- _o_wcsftime (Address: 0x1800c9488)
- memcmp (Address: 0x1800c9540)
- memcpy (Address: 0x1800c9548)
- memmove (Address: 0x1800c9460)
- wcschr (Address: 0x1800c9510)
api-ms-win-crt-runtime-l1-1-0.dll
- _initterm (Address: 0x1800c9560)
- _initterm_e (Address: 0x1800c9558)
api-ms-win-crt-string-l1-1-0.dll
- memset (Address: 0x1800c9570)
- wcscmp (Address: 0x1800c9578)
api-ms-win-eventing-provider-l1-1-0.dll
- EventActivityIdControl (Address: 0x1800c95a0)
- EventRegister (Address: 0x1800c9588)
- EventSetInformation (Address: 0x1800c9590)
- EventUnregister (Address: 0x1800c95a8)
- EventWriteTransfer (Address: 0x1800c9598)
api-ms-win-ntuser-sysparams-l1-1-0.dll
- GetSystemMetrics (Address: 0x1800c95b8)
api-ms-win-power-setting-l1-1-0.dll
- PowerSettingRegisterNotification (Address: 0x1800c95d0)
- PowerSettingUnregisterNotification (Address: 0x1800c95c8)
api-ms-win-rtcore-ntuser-window-l1-1-0.dll
- DestroyWindow (Address: 0x1800c95f8)
- GetForegroundWindow (Address: 0x1800c95e0)
- GetPropW (Address: 0x1800c95f0)
- GetWindowThreadProcessId (Address: 0x1800c95e8)
api-ms-win-security-base-l1-1-0.dll
- AccessCheck (Address: 0x1800c9608)
- CheckTokenMembership (Address: 0x1800c9628)
- CreateWellKnownSid (Address: 0x1800c9620)
- GetTokenInformation (Address: 0x1800c9618)
- MapGenericMask (Address: 0x1800c9610)
api-ms-win-security-sddl-l1-1-0.dll
- ConvertStringSecurityDescriptorToSecurityDescriptorW (Address: 0x1800c9638)
api-ms-win-service-core-l1-1-0.dll
- RegisterServiceCtrlHandlerExW (Address: 0x1800c9650)
- SetServiceStatus (Address: 0x1800c9648)
api-ms-win-shcore-taskpool-l1-1-0.dll
- SHTaskPoolAllowThreadReuse (Address: 0x1800c9668)
- SHTaskPoolGetUniqueContext (Address: 0x1800c9660)
- SHTaskPoolQueueTask (Address: 0x1800c9670)
api-ms-win-shcore-thread-l1-1-0.dll
- SHGetThreadRef (Address: 0x1800c9680)
combase.dll
- (Address: 0x1800c9690)
msvcp_win.dll
- _Cnd_broadcast (Address: 0x1800c97d0)
- _Cnd_destroy_in_situ (Address: 0x1800c96b0)
- _Cnd_do_broadcast_at_thread_exit (Address: 0x1800c97a8)
- _Cnd_init_in_situ (Address: 0x1800c96b8)
- _Cnd_wait (Address: 0x1800c96a8)
- _Mtx_destroy_in_situ (Address: 0x1800c97c8)
- _Mtx_init_in_situ (Address: 0x1800c97e0)
- _Mtx_lock (Address: 0x1800c97f0)
- _Mtx_unlock (Address: 0x1800c97f8)
- _Thrd_detach (Address: 0x1800c9720)
- _Thrd_id (Address: 0x1800c9840)
- _Thrd_join (Address: 0x1800c9768)
- _Xtime_get_ticks (Address: 0x1800c9740)
- ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z (Address: 0x1800c9780)
- ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z (Address: 0x1800c9790)
- ?__ExceptionPtrCreate@@YAXPEAX@Z (Address: 0x1800c9820)
- ?__ExceptionPtrCurrentException@@YAXPEAX@Z (Address: 0x1800c9708)
- ?__ExceptionPtrDestroy@@YAXPEAX@Z (Address: 0x1800c9808)
- ?__ExceptionPtrRethrow@@YAXPEBX@Z (Address: 0x1800c97b8)
- ?__ExceptionPtrToBool@@YA_NPEBX@Z (Address: 0x1800c97c0)
- ?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z (Address: 0x1800c9818)
- ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ (Address: 0x1800c9870)
- ?_Execute_once@std@@YAHAEAUonce_flag@1@P6AHPEAX1PEAPEAX@Z1@Z (Address: 0x1800c9800)
- ?_Incref@facet@locale@std@@UEAAXXZ (Address: 0x1800c9848)
- ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z (Address: 0x1800c9868)
- ?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ (Address: 0x1800c9890)
- ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z (Address: 0x1800c9828)
- ?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ (Address: 0x1800c9700)
- ?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ (Address: 0x1800c96d8)
- ?_Throw_C_error@std@@YAXH@Z (Address: 0x1800c9798)
- ?_Throw_Cpp_error@std@@YAXH@Z (Address: 0x1800c97a0)
- ?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ (Address: 0x1800c9718)
- ?_Xbad_alloc@std@@YAXXZ (Address: 0x1800c9888)
- ?_Xbad_function_call@std@@YAXXZ (Address: 0x1800c96a0)
- ?_XGetLastError@std@@YAXXZ (Address: 0x1800c9788)
- ?_Xlength_error@std@@YAXPEBD@Z (Address: 0x1800c9830)
- ?_Xout_of_range@std@@YAXPEBD@Z (Address: 0x1800c9878)
- ??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ (Address: 0x1800c9770)
- ??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z (Address: 0x1800c9778)
- ??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ (Address: 0x1800c9858)
- ??0?$codecvt@GDU_Mbstatet@@@std@@QEAA@_K@Z (Address: 0x1800c9838)
- ??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ (Address: 0x1800c96c0)
- ??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ (Address: 0x1800c96c8)
- ??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ (Address: 0x1800c96e0)
- ??1?$codecvt@GDU_Mbstatet@@@std@@MEAA@XZ (Address: 0x1800c9860)
- ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z (Address: 0x1800c97d8)
- ??Bid@locale@std@@QEAA_KXZ (Address: 0x1800c9810)
- ?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ (Address: 0x1800c96f0)
- ?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z (Address: 0x1800c96d0)
- ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ (Address: 0x1800c97b0)
- ?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A (Address: 0x1800c97e8)
- ?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z (Address: 0x1800c9758)
- ?in@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z (Address: 0x1800c9850)
- ?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z (Address: 0x1800c9750)
- ?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z (Address: 0x1800c96e8)
- ?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ (Address: 0x1800c9738)
- ?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z (Address: 0x1800c9728)
- ?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z (Address: 0x1800c9760)
- ?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ (Address: 0x1800c96f8)
- ?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ (Address: 0x1800c9880)
- ?uncaught_exception@std@@YA_NXZ (Address: 0x1800c9710)
- ?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z (Address: 0x1800c9748)
- ?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z (Address: 0x1800c9730)
ntdll.dll
- NtQueryInformationProcess (Address: 0x1800c9900)
- NtQueryInformationToken (Address: 0x1800c98d8)
- NtQueryWnfStateData (Address: 0x1800c98b0)
- RtlAllocateHeap (Address: 0x1800c98e8)
- RtlCompareUnicodeString (Address: 0x1800c98f8)
- RtlFreeHeap (Address: 0x1800c98d0)
- RtlInitUnicodeString (Address: 0x1800c98e0)
- RtlIsMultiSessionSku (Address: 0x1800c98c8)
- RtlIsMultiUsersInSessionSku (Address: 0x1800c98c0)
- RtlNtStatusToDosErrorNoTeb (Address: 0x1800c98f0)
- RtlPublishWnfStateData (Address: 0x1800c98a0)
- RtlSubscribeWnfStateChangeNotification (Address: 0x1800c98b8)
- RtlUnsubscribeWnfNotificationWaitForCompletion (Address: 0x1800c98a8)