winsta.dll

Description: Winstation Library

Authors: © Microsoft Corporation. All rights reserved.

Version: 10.0.19041.6456

Architecture: 32-bit

Operating System: Windows NT

SHA256: 0e6881034adec1770f7f4b4ac352552d

File Size: 288.6 KB

Uploaded At: Dec. 1, 2025, 8:07 a.m.

Views: 9

Exported Functions

  • WinStationRegisterConsoleNotificationEx2 (Ordinal: 1, Address: 0x31290)
  • LogonIdFromWinStationNameA (Ordinal: 2, Address: 0x34380)
  • LogonIdFromWinStationNameW (Ordinal: 3, Address: 0x332b0)
  • RemoteAssistancePrepareSystemRestore (Ordinal: 4, Address: 0x343a0)
  • ServerGetInternetConnectorStatus (Ordinal: 5, Address: 0x343c0)
  • ServerLicensingClose (Ordinal: 6, Address: 0x33b50)
  • ServerLicensingDeactivateCurrentPolicy (Ordinal: 7, Address: 0x33bc0)
  • ServerLicensingFreePolicyInformation (Ordinal: 8, Address: 0x33c50)
  • ServerLicensingGetAadInfo (Ordinal: 9, Address: 0x33ca0)
  • ServerLicensingGetAvailablePolicyIds (Ordinal: 10, Address: 0x33d80)
  • ServerLicensingGetPolicy (Ordinal: 11, Address: 0x33e30)
  • ServerLicensingGetPolicyInformationA (Ordinal: 12, Address: 0x33ee0)
  • ServerLicensingGetPolicyInformationW (Ordinal: 13, Address: 0x33f40)
  • ServerLicensingLoadPolicy (Ordinal: 14, Address: 0x34030)
  • ServerLicensingOpenA (Ordinal: 15, Address: 0x34050)
  • ServerLicensingOpenW (Ordinal: 16, Address: 0x34080)
  • ServerLicensingSetAadInfo (Ordinal: 17, Address: 0x34170)
  • ServerLicensingSetPolicy (Ordinal: 18, Address: 0x34240)
  • ServerLicensingUnloadPolicy (Ordinal: 19, Address: 0x34030)
  • ServerQueryInetConnectorInformationA (Ordinal: 20, Address: 0x343e0)
  • ServerQueryInetConnectorInformationW (Ordinal: 21, Address: 0x34400)
  • ServerSetInternetConnectorStatus (Ordinal: 22, Address: 0x34420)
  • WTSRegisterSessionNotificationEx (Ordinal: 23, Address: 0x361e0)
  • WTSUnRegisterSessionNotificationEx (Ordinal: 24, Address: 0x36250)
  • WinStationActivateLicense (Ordinal: 25, Address: 0x34440)
  • WinStationAutoReconnect (Ordinal: 26, Address: 0x34460)
  • WinStationBroadcastSystemMessage (Ordinal: 27, Address: 0x194f0)
  • WinStationCheckAccess (Ordinal: 28, Address: 0x34480)
  • WinStationCheckLoopBack (Ordinal: 29, Address: 0x344a0)
  • WinStationCloseServer (Ordinal: 30, Address: 0x19a10)
  • WinStationConnectA (Ordinal: 31, Address: 0x344c0)
  • WinStationConnectAndLockDesktop (Ordinal: 32, Address: 0x2ebd0)
  • WinStationConnectCallback (Ordinal: 33, Address: 0x344e0)
  • WinStationConnectEx (Ordinal: 34, Address: 0x34500)
  • WinStationConnectW (Ordinal: 35, Address: 0x2ecf0)
  • WinStationConsumeCacheSession (Ordinal: 36, Address: 0x31dc0)
  • WinStationCreateChildSessionTransport (Ordinal: 37, Address: 0x31730)
  • WinStationDisconnect (Ordinal: 38, Address: 0x18100)
  • WinStationEnableChildSessions (Ordinal: 39, Address: 0x2ee20)
  • WinStationEnumerateA (Ordinal: 40, Address: 0x2ef10)
  • WinStationEnumerateContainerSessions (Ordinal: 41, Address: 0x1b060)
  • WinStationEnumerateExW (Ordinal: 42, Address: 0x33570)
  • WinStationEnumerateLicenses (Ordinal: 43, Address: 0x34530)
  • WinStationEnumerateProcesses (Ordinal: 44, Address: 0x2eff0)
  • WinStationEnumerateW (Ordinal: 45, Address: 0x13280)
  • WinStationEnumerate_IndexedA (Ordinal: 46, Address: 0x34550)
  • WinStationEnumerate_IndexedW (Ordinal: 47, Address: 0x34570)
  • WinStationFreeConsoleNotification (Ordinal: 48, Address: 0x312b0)
  • WinStationFreeEXECENVDATAEX (Ordinal: 49, Address: 0x17640)
  • WinStationFreeGAPMemory (Ordinal: 50, Address: 0x2f100)
  • WinStationFreeMemory (Ordinal: 51, Address: 0x17780)
  • WinStationFreePropertyValue (Ordinal: 52, Address: 0x2f140)
  • WinStationFreeUserCertificates (Ordinal: 53, Address: 0x2f170)
  • WinStationFreeUserCredentials (Ordinal: 54, Address: 0x31ee0)
  • WinStationFreeUserSessionInfo (Ordinal: 55, Address: 0x10ca0)
  • WinStationGenerateLicense (Ordinal: 56, Address: 0x34590)
  • WinStationGetAllProcesses (Ordinal: 57, Address: 0x2f1a0)
  • WinStationGetAllSessionsEx (Ordinal: 58, Address: 0x112e0)
  • WinStationGetAllSessionsW (Ordinal: 59, Address: 0x33790)
  • WinStationGetAllUserSessions (Ordinal: 60, Address: 0x12630)
  • WinStationGetChildSessionId (Ordinal: 61, Address: 0x2f2d0)
  • WinStationGetConnectionProperty (Ordinal: 62, Address: 0x11f50)
  • WinStationGetCurrentSessionCapabilities (Ordinal: 63, Address: 0x18be0)
  • WinStationGetCurrentSessionConnectionProperty (Ordinal: 64, Address: 0x2f3d0)
  • WinStationGetCurrentSessionTerminalName (Ordinal: 65, Address: 0x10b30)
  • WinStationGetDeviceId (Ordinal: 66, Address: 0x2f4d0)
  • WinStationGetInitialApplication (Ordinal: 67, Address: 0x2f5d0)
  • WinStationGetLanAdapterNameA (Ordinal: 68, Address: 0x345b0)
  • WinStationGetLanAdapterNameW (Ordinal: 69, Address: 0x345d0)
  • WinStationGetLastWinlogonNotification (Ordinal: 70, Address: 0x1b140)
  • WinStationGetLoggedOnCount (Ordinal: 71, Address: 0x2f6f0)
  • WinStationGetMachinePolicy (Ordinal: 72, Address: 0x345f0)
  • WinStationGetParentSessionId (Ordinal: 73, Address: 0x2f7f0)
  • WinStationGetProcessSid (Ordinal: 74, Address: 0x2f900)
  • WinStationGetRedirectAuthInfo (Ordinal: 75, Address: 0x31f30)
  • WinStationGetRestrictedLogonInfo (Ordinal: 76, Address: 0x32020)
  • WinStationGetSessionIds (Ordinal: 77, Address: 0x2f970)
  • WinStationGetTermSrvCountersValue (Ordinal: 78, Address: 0x2fac0)
  • WinStationGetUserCertificates (Ordinal: 79, Address: 0x2fbf0)
  • WinStationGetUserCredentials (Ordinal: 80, Address: 0x32150)
  • WinStationGetUserProfile (Ordinal: 81, Address: 0x32390)
  • WinStationInstallLicense (Ordinal: 82, Address: 0x34610)
  • WinStationIsBoundToCacheTerminal (Ordinal: 83, Address: 0x32480)
  • WinStationIsChildSessionsEnabled (Ordinal: 84, Address: 0x2fda0)
  • WinStationIsCurrentSessionRemoteable (Ordinal: 85, Address: 0x133b0)
  • WinStationIsHelpAssistantSession (Ordinal: 86, Address: 0x325a0)
  • WinStationIsSessionPermitted (Ordinal: 87, Address: 0x19050)
  • WinStationIsSessionRemoteable (Ordinal: 88, Address: 0x132c0)
  • WinStationNameFromLogonIdA (Ordinal: 89, Address: 0x34630)
  • WinStationNameFromLogonIdW (Ordinal: 90, Address: 0x13160)
  • WinStationNegotiateSession (Ordinal: 91, Address: 0x18e00)
  • WinStationNtsdDebug (Ordinal: 92, Address: 0x34650)
  • WinStationOpenServerA (Ordinal: 93, Address: 0x2daf0)
  • WinStationOpenServerExA (Ordinal: 94, Address: 0x2dbc0)
  • WinStationOpenServerExW (Ordinal: 95, Address: 0x2dc90)
  • WinStationOpenServerW (Ordinal: 96, Address: 0x19990)
  • WinStationPreCreateGlassReplacementSession (Ordinal: 97, Address: 0x18400)
  • WinStationPreCreateGlassReplacementSessionEx (Ordinal: 98, Address: 0x18420)
  • WinStationQueryAllowConcurrentConnections (Ordinal: 99, Address: 0x34670)
  • WinStationQueryCurrentSessionInformation (Ordinal: 100, Address: 0x190f0)
  • WinStationQueryEnforcementCore (Ordinal: 101, Address: 0x19190)
  • WinStationQueryInformationA (Ordinal: 102, Address: 0x34690)
  • WinStationQueryInformationW (Ordinal: 103, Address: 0x15cb0)
  • WinStationQueryLicense (Ordinal: 104, Address: 0x346b0)
  • WinStationQueryLogonCredentialsW (Ordinal: 105, Address: 0x346d0)
  • WinStationQuerySessionVirtualIP (Ordinal: 106, Address: 0x362c0)
  • WinStationQueryUpdateRequired (Ordinal: 107, Address: 0x346f0)
  • WinStationRcmShadow2 (Ordinal: 108, Address: 0x2feb0)
  • WinStationRedirectErrorMessage (Ordinal: 109, Address: 0x325d0)
  • WinStationRedirectLogonBeginPainting (Ordinal: 110, Address: 0x326a0)
  • WinStationRedirectLogonError (Ordinal: 111, Address: 0x32780)
  • WinStationRedirectLogonMessage (Ordinal: 112, Address: 0x32880)
  • WinStationRedirectLogonStatus (Ordinal: 113, Address: 0x32970)
  • WinStationRegisterConsoleNotification (Ordinal: 114, Address: 0x11690)
  • WinStationRegisterConsoleNotificationEx (Ordinal: 115, Address: 0x312f0)
  • WinStationRegisterCurrentSessionNotificationEvent (Ordinal: 116, Address: 0x189d0)
  • WinStationRegisterNotificationEvent (Ordinal: 117, Address: 0x31320)
  • WinStationRemoveLicense (Ordinal: 118, Address: 0x34710)
  • WinStationRenameA (Ordinal: 119, Address: 0x34730)
  • WinStationRenameW (Ordinal: 120, Address: 0x34750)
  • WinStationReportLoggedOnCompleted (Ordinal: 121, Address: 0x1b250)
  • WinStationReportUIResult (Ordinal: 122, Address: 0x32a60)
  • WinStationReset (Ordinal: 123, Address: 0x2ffd0)
  • WinStationRevertFromServicesSession (Ordinal: 124, Address: 0x30080)
  • WinStationSendMessageA (Ordinal: 125, Address: 0x30160)
  • WinStationSendMessageW (Ordinal: 126, Address: 0x30240)
  • WinStationSendWindowMessage (Ordinal: 127, Address: 0x18cc0)
  • WinStationServerPing (Ordinal: 128, Address: 0x342f0)
  • WinStationSetAutologonPassword (Ordinal: 129, Address: 0x31800)
  • WinStationSetInformationA (Ordinal: 130, Address: 0x34770)
  • WinStationSetInformationW (Ordinal: 131, Address: 0x304b0)
  • WinStationSetLastWinlogonNotification (Ordinal: 132, Address: 0x1b350)
  • WinStationSetPoolCount (Ordinal: 133, Address: 0x34790)
  • WinStationSetRenderHint (Ordinal: 134, Address: 0x36440)
  • WinStationShadow (Ordinal: 135, Address: 0x305f0)
  • WinStationShadowAccessCheck (Ordinal: 136, Address: 0x30730)
  • WinStationShadowStop2 (Ordinal: 137, Address: 0x30840)
  • WinStationShadowStop (Ordinal: 138, Address: 0x30950)
  • WinStationShutdownSystem (Ordinal: 139, Address: 0x30a90)
  • WinStationSwitchToServicesSession (Ordinal: 140, Address: 0x30ab0)
  • WinStationSystemShutdownStarted (Ordinal: 141, Address: 0x32b30)
  • WinStationSystemShutdownWait (Ordinal: 142, Address: 0x32c50)
  • WinStationTerminateGlassReplacementSession (Ordinal: 143, Address: 0x32d00)
  • WinStationTerminateProcess (Ordinal: 144, Address: 0x30b90)
  • WinStationUnRegisterConsoleNotification (Ordinal: 145, Address: 0x17a20)
  • WinStationUnRegisterNotificationEvent (Ordinal: 146, Address: 0x18f60)
  • WinStationUserLoginAccessCheck (Ordinal: 147, Address: 0x32e20)
  • WinStationVerify (Ordinal: 148, Address: 0x30c80)
  • WinStationVirtualOpen (Ordinal: 149, Address: 0x30d90)
  • WinStationVirtualOpenEx (Ordinal: 150, Address: 0x17ea0)
  • WinStationWaitSystemEvent (Ordinal: 151, Address: 0x31350)
  • _NWLogonQueryAdmin (Ordinal: 152, Address: 0x347b0)
  • _NWLogonSetAdmin (Ordinal: 153, Address: 0x347d0)
  • _WinStationAnnoyancePopup (Ordinal: 154, Address: 0x347f0)
  • _WinStationBeepOpen (Ordinal: 155, Address: 0x30e20)
  • _WinStationBreakPoint (Ordinal: 156, Address: 0x34810)
  • _WinStationCallback (Ordinal: 157, Address: 0x34830)
  • _WinStationCheckForApplicationName (Ordinal: 158, Address: 0x34850)
  • _WinStationFUSCanRemoteUserDisconnect (Ordinal: 159, Address: 0x34870)
  • _WinStationGetApplicationInfo (Ordinal: 160, Address: 0x34890)
  • _WinStationNotifyDisconnectPipe (Ordinal: 161, Address: 0x348b0)
  • _WinStationNotifyLogoff (Ordinal: 162, Address: 0x348d0)
  • _WinStationNotifyLogon (Ordinal: 163, Address: 0x348f0)
  • _WinStationNotifyNewSession (Ordinal: 164, Address: 0x34910)
  • _WinStationOpenSessionDirectory (Ordinal: 165, Address: 0x34930)
  • _WinStationReInitializeSecurity (Ordinal: 166, Address: 0x34950)
  • _WinStationReadRegistry (Ordinal: 167, Address: 0x34970)
  • _WinStationSessionInitialized (Ordinal: 168, Address: 0x32e50)
  • _WinStationShadowTarget2 (Ordinal: 169, Address: 0x30e60)
  • _WinStationShadowTarget (Ordinal: 170, Address: 0x31040)
  • _WinStationShadowTargetSetup (Ordinal: 171, Address: 0x31080)
  • _WinStationUpdateClientCachedCredentials (Ordinal: 172, Address: 0x34980)
  • _WinStationUpdateSettings (Ordinal: 173, Address: 0x349a0)
  • _WinStationUpdateUserConfig (Ordinal: 174, Address: 0x349c0)
  • _WinStationWaitForConnect (Ordinal: 175, Address: 0x18ed0)

Imported DLLs & Functions

api-ms-win-core-debug-l1-1-0.dll
  • DebugBreak (Address: 0x1004500c)
  • IsDebuggerPresent (Address: 0x10045014)
  • OutputDebugStringA (Address: 0x10045010)
  • OutputDebugStringW (Address: 0x10045008)
api-ms-win-core-delayload-l1-1-0.dll
  • DelayLoadFailureHook (Address: 0x1004501c)
api-ms-win-core-delayload-l1-1-1.dll
  • ResolveDelayLoadedAPI (Address: 0x10045024)
api-ms-win-core-errorhandling-l1-1-0.dll
  • GetLastError (Address: 0x10045034)
  • SetLastError (Address: 0x10045038)
  • SetUnhandledExceptionFilter (Address: 0x10045030)
  • UnhandledExceptionFilter (Address: 0x1004502c)
api-ms-win-core-handle-l1-1-0.dll
  • CloseHandle (Address: 0x10045044)
  • DuplicateHandle (Address: 0x10045040)
api-ms-win-core-heap-l1-1-0.dll
  • GetProcessHeap (Address: 0x10045050)
  • HeapAlloc (Address: 0x10045054)
  • HeapFree (Address: 0x1004504c)
api-ms-win-core-heap-l2-1-0.dll
  • LocalAlloc (Address: 0x1004505c)
  • LocalFree (Address: 0x10045060)
api-ms-win-core-kernel32-legacy-l1-1-0.dll
  • GetComputerNameW (Address: 0x10045068)
api-ms-win-core-libraryloader-l1-2-0.dll
  • DisableThreadLibraryCalls (Address: 0x10045078)
  • FreeLibrary (Address: 0x10045090)
  • GetModuleFileNameA (Address: 0x10045084)
  • GetModuleFileNameW (Address: 0x10045088)
  • GetModuleHandleExA (Address: 0x10045074)
  • GetModuleHandleExW (Address: 0x1004507c)
  • GetModuleHandleW (Address: 0x10045080)
  • GetProcAddress (Address: 0x10045070)
  • LoadLibraryExW (Address: 0x1004508c)
api-ms-win-core-localization-l1-2-0.dll
  • FormatMessageW (Address: 0x10045098)
api-ms-win-core-processenvironment-l1-1-0.dll
  • ExpandEnvironmentStringsW (Address: 0x100450a0)
api-ms-win-core-processthreads-l1-1-0.dll
  • CreateThread (Address: 0x100450bc)
  • GetCurrentProcess (Address: 0x100450cc)
  • GetCurrentProcessId (Address: 0x100450b0)
  • GetCurrentThread (Address: 0x100450c0)
  • GetCurrentThreadId (Address: 0x100450ac)
  • GetExitCodeThread (Address: 0x100450b8)
  • OpenProcessToken (Address: 0x100450c4)
  • OpenThreadToken (Address: 0x100450b4)
  • ProcessIdToSessionId (Address: 0x100450a8)
  • TerminateProcess (Address: 0x100450c8)
api-ms-win-core-processthreads-l1-1-1.dll
  • GetProcessMitigationPolicy (Address: 0x100450d4)
api-ms-win-core-profile-l1-1-0.dll
  • QueryPerformanceCounter (Address: 0x100450dc)
api-ms-win-core-registry-l1-1-0.dll
  • RegCloseKey (Address: 0x100450e4)
  • RegOpenKeyExW (Address: 0x100450e8)
  • RegQueryValueExW (Address: 0x100450ec)
api-ms-win-core-synch-l1-1-0.dll
  • AcquireSRWLockExclusive (Address: 0x10045104)
  • AcquireSRWLockShared (Address: 0x1004510c)
  • CreateEventW (Address: 0x10045114)
  • CreateMutexExW (Address: 0x100450f4)
  • CreateSemaphoreExW (Address: 0x10045134)
  • DeleteCriticalSection (Address: 0x10045128)
  • EnterCriticalSection (Address: 0x10045124)
  • InitializeCriticalSection (Address: 0x10045110)
  • InitializeCriticalSectionEx (Address: 0x10045118)
  • LeaveCriticalSection (Address: 0x10045120)
  • OpenEventW (Address: 0x10045130)
  • OpenSemaphoreW (Address: 0x100450fc)
  • ReleaseMutex (Address: 0x10045138)
  • ReleaseSemaphore (Address: 0x1004512c)
  • ReleaseSRWLockExclusive (Address: 0x10045108)
  • ReleaseSRWLockShared (Address: 0x100450f8)
  • SetEvent (Address: 0x1004513c)
  • WaitForSingleObject (Address: 0x1004511c)
  • WaitForSingleObjectEx (Address: 0x10045100)
api-ms-win-core-synch-l1-2-0.dll
  • Sleep (Address: 0x10045144)
api-ms-win-core-sysinfo-l1-1-0.dll
  • GetSystemTimeAsFileTime (Address: 0x1004514c)
  • GetTickCount (Address: 0x10045150)
api-ms-win-core-threadpool-l1-2-0.dll
  • CloseThreadpoolTimer (Address: 0x10045158)
  • CreateThreadpoolTimer (Address: 0x10045164)
  • SetThreadpoolTimer (Address: 0x10045160)
  • WaitForThreadpoolTimerCallbacks (Address: 0x1004515c)
api-ms-win-core-threadpool-legacy-l1-1-0.dll
  • QueueUserWorkItem (Address: 0x1004516c)
api-ms-win-eventing-classicprovider-l1-1-0.dll
  • TraceMessage (Address: 0x10045174)
api-ms-win-eventing-provider-l1-1-0.dll
  • EventRegister (Address: 0x10045188)
  • EventSetInformation (Address: 0x1004517c)
  • EventUnregister (Address: 0x10045180)
  • EventWriteTransfer (Address: 0x10045184)
KERNELBASE.dll
  • WTSGetServiceSessionId (Address: 0x10045000)
msvcrt.dll
  • __CxxFrameHandler3 (Address: 0x10045200)
  • __dllonexit (Address: 0x100451ec)
  • _amsg_exit (Address: 0x100451c8)
  • _callnewh (Address: 0x100451dc)
  • _CxxThrowException (Address: 0x100451b8)
  • _except_handler4_common (Address: 0x10045208)
  • _initterm (Address: 0x10045198)
  • _lock (Address: 0x100451fc)
  • _onexit (Address: 0x100451e8)
  • _purecall (Address: 0x100451b0)
  • _resetstkoflw (Address: 0x1004521c)
  • _strnicmp (Address: 0x10045210)
  • _unlock (Address: 0x100451f8)
  • _vsnprintf (Address: 0x100451d4)
  • _vsnwprintf (Address: 0x100451e0)
  • _wcsicmp (Address: 0x1004520c)
  • _XcptFilter (Address: 0x100451c0)
  • ??_V@YAXPAX@Z (Address: 0x10045218)
  • ??0exception@@QAE@ABQBD@Z (Address: 0x100451d8)
  • ??0exception@@QAE@ABQBDH@Z (Address: 0x100451d0)
  • ??0exception@@QAE@ABV0@@Z (Address: 0x100451cc)
  • ??1exception@@UAE@XZ (Address: 0x100451c4)
  • ??1type_info@@UAE@XZ (Address: 0x1004519c)
  • ??3@YAXPAX@Z (Address: 0x10045214)
  • ?what@exception@@UBEPBDXZ (Address: 0x100451bc)
  • free (Address: 0x100451a4)
  • malloc (Address: 0x100451b4)
  • memcmp (Address: 0x100451e4)
  • memcpy (Address: 0x100451a8)
  • memcpy_s (Address: 0x100451f4)
  • memmove (Address: 0x100451a0)
  • memmove_s (Address: 0x100451ac)
  • memset (Address: 0x10045190)
  • rand (Address: 0x100451f0)
  • srand (Address: 0x10045194)
  • time (Address: 0x10045204)
ntdll.dll
  • EtwEventUnregister (Address: 0x10045248)
  • NtClose (Address: 0x1004525c)
  • NtOpenProcess (Address: 0x10045268)
  • NtOpenProcessToken (Address: 0x1004527c)
  • NtQueryInformationProcess (Address: 0x1004526c)
  • NtQueryInformationToken (Address: 0x10045264)
  • NtQuerySystemInformation (Address: 0x10045274)
  • NtQuerySystemTime (Address: 0x10045278)
  • NtTerminateProcess (Address: 0x1004524c)
  • RtlAdjustPrivilege (Address: 0x10045258)
  • RtlAllocateAndInitializeSid (Address: 0x1004522c)
  • RtlCaptureStackBackTrace (Address: 0x10045228)
  • RtlCopySid (Address: 0x10045254)
  • RtlDeleteCriticalSection (Address: 0x10045244)
  • RtlEnterCriticalSection (Address: 0x10045240)
  • RtlFreeSid (Address: 0x10045224)
  • RtlGetSuiteMask (Address: 0x10045234)
  • RtlInitializeCriticalSection (Address: 0x10045238)
  • RtlLeaveCriticalSection (Address: 0x10045230)
  • RtlLengthSid (Address: 0x10045260)
  • RtlMultiByteToUnicodeN (Address: 0x10045284)
  • RtlNtStatusToDosError (Address: 0x10045250)
  • RtlUnicodeToMultiByteN (Address: 0x10045270)
  • RtlUnicodeToMultiByteSize (Address: 0x1004523c)
  • RtlValidSid (Address: 0x10045280)