d3d9.dll

Description: Direct3D 9 Runtime

Version: 10.0.19041.5794

Architecture: 64-bit

Operating System: Windows NT

SHA256: 05cca6e73ae6cb02c1513b78517e1037

File Size: 1.8 MB

Uploaded At: Dec. 1, 2025, 7:25 a.m.

Views: 19

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

(Ordinal: 16, Address: 0x89450)
(Ordinal: 17, Address: 0x8b660)
(Ordinal: 18, Address: 0x8b6c0)
(Ordinal: 19, Address: 0x945a0)
Direct3DCreate9On12 (Ordinal: 20, Address: 0x45b90)
Direct3DCreate9On12Ex (Ordinal: 21, Address: 0x45bc0)
(Ordinal: 22, Address: 0x89460)
(Ordinal: 23, Address: 0x9c150)
Direct3DShaderValidatorCreate9 (Ordinal: 24, Address: 0xd53e0)
PSGPError (Ordinal: 25, Address: 0x80c00)
PSGPSampleTexture (Ordinal: 26, Address: 0x80c30)
D3DPERF_BeginEvent (Ordinal: 27, Address: 0x8b4b0)
D3DPERF_EndEvent (Ordinal: 28, Address: 0x8b500)
D3DPERF_GetStatus (Ordinal: 29, Address: 0x8b530)
D3DPERF_QueryRepeatFrame (Ordinal: 30, Address: 0x8b560)
D3DPERF_SetMarker (Ordinal: 31, Address: 0x8b5a0)
D3DPERF_SetOptions (Ordinal: 32, Address: 0x8b5e0)
D3DPERF_SetRegion (Ordinal: 33, Address: 0x8b610)
DebugSetLevel (Ordinal: 34, Address: 0x8b7a0)
DebugSetMute (Ordinal: 35, Address: 0x8b7e0)
Direct3D9EnableMaximizedWindowedModeShim (Ordinal: 36, Address: 0x8b650)
Direct3DCreate9 (Ordinal: 37, Address: 0x35c60)
Direct3DCreate9Ex (Ordinal: 38, Address: 0x35c90)

Imported DLLs & Functions

api-ms-win-appmodel-unlock-l1-1-0.dll

IsDeveloperModeEnabled (Address: 0x180159c20)

api-ms-win-core-apiquery-l1-1-0.dll

ApiSetQueryApiSetPresence (Address: 0x180159c30)

api-ms-win-core-com-l1-1-0.dll

CoCreateInstance (Address: 0x180159c50)
CoInitializeEx (Address: 0x180159c40)
CoTaskMemFree (Address: 0x180159c48)
CoUninitialize (Address: 0x180159c58)

api-ms-win-core-registry-l1-1-0.dll

RegCloseKey (Address: 0x180159c80)
RegCreateKeyExA (Address: 0x180159c98)
RegDeleteValueA (Address: 0x180159cb0)
RegEnumKeyExA (Address: 0x180159c90)
RegEnumValueA (Address: 0x180159c70)
RegGetValueA (Address: 0x180159ca8)
RegOpenKeyExA (Address: 0x180159c78)
RegQueryInfoKeyA (Address: 0x180159c68)
RegQueryValueExA (Address: 0x180159c88)
RegSetValueExA (Address: 0x180159ca0)

api-ms-win-core-versionansi-l1-1-0.dll

GetFileVersionInfoExA (Address: 0x180159cd0)
GetFileVersionInfoSizeExA (Address: 0x180159cc0)
VerQueryValueA (Address: 0x180159cc8)

api-ms-win-eventing-provider-l1-1-0.dll

EventRegister (Address: 0x180159ce8)
EventSetInformation (Address: 0x180159cf0)
EventUnregister (Address: 0x180159cf8)
EventWriteTransfer (Address: 0x180159ce0)

api-ms-win-gdi-dpiinfo-l1-1-0.dll

GetCurrentDpiInfo (Address: 0x180159d08)

api-ms-win-security-base-l1-1-0.dll

AddAccessAllowedAce (Address: 0x180159d18)
AddMandatoryAce (Address: 0x180159d70)
AllocateLocallyUniqueId (Address: 0x180159d78)
GetLengthSid (Address: 0x180159d68)
GetSidLengthRequired (Address: 0x180159d30)
GetSidSubAuthority (Address: 0x180159d28)
InitializeAcl (Address: 0x180159d58)
InitializeSecurityDescriptor (Address: 0x180159d50)
InitializeSid (Address: 0x180159d38)
IsValidSid (Address: 0x180159d48)
SetKernelObjectSecurity (Address: 0x180159d60)
SetSecurityDescriptorDacl (Address: 0x180159d20)
SetSecurityDescriptorSacl (Address: 0x180159d40)

api-ms-win-security-sddl-l1-1-0.dll

ConvertStringSidToSidW (Address: 0x180159d88)

api-ms-win-shell-shellfolders-l1-1-0.dll

SHGetKnownFolderPath (Address: 0x180159d98)

dwmapi.dll

(Address: 0x180159da8)
(Address: 0x180159db0)
(Address: 0x180159db8)
(Address: 0x180159dc8)
DwmIsCompositionEnabled (Address: 0x180159dc0)

GDI32.dll

BitBlt (Address: 0x180159568)
CreateCompatibleBitmap (Address: 0x1801590f0)
CreateCompatibleDC (Address: 0x180159120)
CreateDCA (Address: 0x180159558)
CreateDIBitmap (Address: 0x1801590a8)
CreateDIBSection (Address: 0x180159100)
CreateRectRgn (Address: 0x1801591e0)
D3DKMTCacheHybridQueryValue (Address: 0x180159098)
D3DKMTCheckExclusiveOwnership (Address: 0x180159430)
D3DKMTCheckMonitorPowerState (Address: 0x1801594e0)
D3DKMTCheckOcclusion (Address: 0x180159398)
D3DKMTCloseAdapter (Address: 0x1801592f8)
D3DKMTConfigureSharedResource (Address: 0x180159380)
D3DKMTCreateAllocation (Address: 0x1801592d0)
D3DKMTCreateAllocation2 (Address: 0x1801593f0)
D3DKMTCreateContext (Address: 0x180159498)
D3DKMTCreateContextVirtual (Address: 0x180159500)
D3DKMTCreateDCFromMemory (Address: 0x1801594c0)
D3DKMTCreateDevice (Address: 0x180159418)
D3DKMTCreateHwQueue (Address: 0x180159300)
D3DKMTCreateOverlay (Address: 0x1801595c0)
D3DKMTCreatePagingQueue (Address: 0x1801594b0)
D3DKMTCreateSynchronizationObject (Address: 0x1801593b8)
D3DKMTCreateSynchronizationObject2 (Address: 0x180159390)
D3DKMTDestroyAllocation (Address: 0x1801592e8)
D3DKMTDestroyAllocation2 (Address: 0x1801592c0)
D3DKMTDestroyContext (Address: 0x1801592e0)
D3DKMTDestroyDCFromMemory (Address: 0x1801593d0)
D3DKMTDestroyDevice (Address: 0x1801594c8)
D3DKMTDestroyHwQueue (Address: 0x180159440)
D3DKMTDestroyOverlay (Address: 0x180159330)
D3DKMTDestroyPagingQueue (Address: 0x1801593e8)
D3DKMTDestroySynchronizationObject (Address: 0x180159368)
D3DKMTEnumAdapters (Address: 0x180159320)
D3DKMTEscape (Address: 0x180159340)
D3DKMTEvict (Address: 0x1801592b8)
D3DKMTFlipOverlay (Address: 0x1801595b8)
D3DKMTFreeGpuVirtualAddress (Address: 0x1801592f0)
D3DKMTGetCachedHybridQueryValue (Address: 0x1801590a0)
D3DKMTGetContextSchedulingPriority (Address: 0x180159540)
D3DKMTGetDeviceState (Address: 0x180159590)
D3DKMTGetDisplayModeList (Address: 0x1801593a0)
D3DKMTGetMultiPlaneOverlayCaps (Address: 0x180159560)
D3DKMTGetMultisampleMethodList (Address: 0x1801594d8)
D3DKMTGetOverlayState (Address: 0x1801595a8)
D3DKMTGetResourcePresentPrivateDriverData (Address: 0x180159598)
D3DKMTGetScanLine (Address: 0x180159518)
D3DKMTGetSharedPrimaryHandle (Address: 0x180159338)
D3DKMTInvalidateCache (Address: 0x180159448)
D3DKMTLock (Address: 0x180159530)
D3DKMTLock2 (Address: 0x1801592c8)
D3DKMTMakeResident (Address: 0x1801592a8)
D3DKMTMapGpuVirtualAddress (Address: 0x1801592d8)
D3DKMTMarkDeviceAsError (Address: 0x180159520)
D3DKMTOfferAllocations (Address: 0x1801595a0)
D3DKMTOpenAdapterFromDeviceName (Address: 0x1801594f8)
D3DKMTOpenAdapterFromHdc (Address: 0x1801593c8)
D3DKMTOpenResource (Address: 0x1801593d8)
D3DKMTOpenResource2 (Address: 0x180159538)
D3DKMTOpenResourceFromNtHandle (Address: 0x180159588)
D3DKMTOpenSyncObjectFromNtHandle2 (Address: 0x1801595b0)
D3DKMTPresent (Address: 0x1801592b0)
D3DKMTQueryAdapterInfo (Address: 0x180159578)
D3DKMTQueryAllocationResidency (Address: 0x1801593f8)
D3DKMTQueryResourceInfo (Address: 0x180159508)
D3DKMTQueryResourceInfoFromNtHandle (Address: 0x1801593e0)
D3DKMTQueryStatistics (Address: 0x180159370)
D3DKMTQueryVidPnExclusiveOwnership (Address: 0x180159438)
D3DKMTReclaimAllocations (Address: 0x1801593b0)
D3DKMTReclaimAllocations2 (Address: 0x180159490)
D3DKMTRegisterTrimNotification (Address: 0x180159310)
D3DKMTReleaseProcessVidPnSourceOwners (Address: 0x1801594a8)
D3DKMTRender (Address: 0x180159428)
D3DKMTReserveGpuVirtualAddress (Address: 0x1801594d0)
D3DKMTSetAllocationPriority (Address: 0x1801594f0)
D3DKMTSetContextSchedulingPriority (Address: 0x180159580)
D3DKMTSetDisplayMode (Address: 0x180159470)
D3DKMTSetDisplayPrivateDriverFormat (Address: 0x180159410)
D3DKMTSetGammaRamp (Address: 0x180159388)
D3DKMTSetQueuedLimit (Address: 0x180159458)
D3DKMTSetVidPnSourceOwner1 (Address: 0x180159480)
D3DKMTSharedPrimaryLockNotification (Address: 0x180159408)
D3DKMTSharedPrimaryUnLockNotification (Address: 0x180159308)
D3DKMTShareObjects (Address: 0x180159378)
D3DKMTSignalSynchronizationObject (Address: 0x180159488)
D3DKMTSignalSynchronizationObject2 (Address: 0x180159510)
D3DKMTSignalSynchronizationObjectFromCpu (Address: 0x180159550)
D3DKMTSignalSynchronizationObjectFromGpu (Address: 0x180159450)
D3DKMTSignalSynchronizationObjectFromGpu2 (Address: 0x1801594e8)
D3DKMTSubmitCommand (Address: 0x180159420)
D3DKMTSubmitCommandToHwQueue (Address: 0x1801594a0)
D3DKMTSubmitPresentToHwQueue (Address: 0x180159348)
D3DKMTSubmitSignalSyncObjectsToHwQueue (Address: 0x180159478)
D3DKMTSubmitWaitForSyncObjectsToHwQueue (Address: 0x1801594b8)
D3DKMTUnlock (Address: 0x180159528)
D3DKMTUnlock2 (Address: 0x180159350)
D3DKMTUnregisterTrimNotification (Address: 0x180159328)
D3DKMTUpdateAllocationProperty (Address: 0x180159358)
D3DKMTUpdateGpuVirtualAddress (Address: 0x1801593c0)
D3DKMTUpdateOverlay (Address: 0x180159400)
D3DKMTWaitForSynchronizationObject (Address: 0x180159360)
D3DKMTWaitForSynchronizationObject2 (Address: 0x180159548)
D3DKMTWaitForSynchronizationObjectFromCpu (Address: 0x180159318)
D3DKMTWaitForSynchronizationObjectFromGpu (Address: 0x180159460)
D3DKMTWaitForVerticalBlankEvent (Address: 0x180159570)
DdEntry1 (Address: 0x180159288)
DdEntry10 (Address: 0x180159278)
DdEntry11 (Address: 0x180159270)
DdEntry12 (Address: 0x180159178)
DdEntry13 (Address: 0x1801591e8)
DdEntry16 (Address: 0x180159110)
DdEntry17 (Address: 0x1801591d0)
DdEntry18 (Address: 0x180159240)
DdEntry19 (Address: 0x1801591f0)
DdEntry2 (Address: 0x1801590d8)
DdEntry20 (Address: 0x1801590d0)
DdEntry21 (Address: 0x1801591f8)
DdEntry22 (Address: 0x1801591a0)
DdEntry23 (Address: 0x1801591b8)
DdEntry24 (Address: 0x180159170)
DdEntry25 (Address: 0x180159128)
DdEntry26 (Address: 0x180159188)
DdEntry27 (Address: 0x1801590c8)
DdEntry28 (Address: 0x1801591b0)
DdEntry29 (Address: 0x180159140)
DdEntry3 (Address: 0x180159268)
DdEntry30 (Address: 0x180159108)
DdEntry31 (Address: 0x180159138)
DdEntry33 (Address: 0x180159090)
DdEntry34 (Address: 0x180159250)
DdEntry35 (Address: 0x1801591d8)
DdEntry36 (Address: 0x180159248)
DdEntry37 (Address: 0x180159198)
DdEntry38 (Address: 0x1801590e0)
DdEntry39 (Address: 0x180159260)
DdEntry4 (Address: 0x180159228)
DdEntry40 (Address: 0x180159220)
DdEntry41 (Address: 0x180159298)
DdEntry42 (Address: 0x180159118)
DdEntry43 (Address: 0x180159158)
DdEntry44 (Address: 0x180159148)
DdEntry45 (Address: 0x180159210)
DdEntry46 (Address: 0x180159168)
DdEntry48 (Address: 0x180159218)
DdEntry49 (Address: 0x1801592a0)
DdEntry5 (Address: 0x180159230)
DdEntry50 (Address: 0x180159160)
DdEntry53 (Address: 0x180159200)
DdEntry54 (Address: 0x1801590e8)
DdEntry56 (Address: 0x1801591c8)
DdEntry6 (Address: 0x180159130)
DdEntry9 (Address: 0x180159180)
DeleteDC (Address: 0x180159468)
DeleteObject (Address: 0x180159280)
GdiEntry1 (Address: 0x180159238)
GdiEntry13 (Address: 0x1801593a8)
GetDeviceCaps (Address: 0x1801590b8)
GetDeviceGammaRamp (Address: 0x1801591a8)
GetDIBits (Address: 0x1801591c0)
GetNearestColor (Address: 0x1801590b0)
GetRandomRgn (Address: 0x180159290)
GetRegionData (Address: 0x180159208)
GetSystemPaletteEntries (Address: 0x1801590c0)
SelectObject (Address: 0x1801590f8)
SetLayout (Address: 0x180159190)
SetStretchBltMode (Address: 0x180159258)
StretchBlt (Address: 0x180159150)

KERNEL32.dll

AcquireSRWLockExclusive (Address: 0x180159870)
AcquireSRWLockShared (Address: 0x180159830)
CloseHandle (Address: 0x180159858)
CloseThreadpoolTimer (Address: 0x180159878)
ConnectNamedPipe (Address: 0x180159710)
CreateEventA (Address: 0x180159668)
CreateFileA (Address: 0x1801596c8)
CreateMutexExW (Address: 0x180159838)
CreateMutexW (Address: 0x180159728)
CreateNamedPipeA (Address: 0x1801596c0)
CreateSemaphoreA (Address: 0x180159730)
CreateSemaphoreExA (Address: 0x180159778)
CreateSemaphoreExW (Address: 0x1801598d8)
CreateThread (Address: 0x180159670)
CreateThreadpoolTimer (Address: 0x180159840)
DebugBreak (Address: 0x1801598e0)
DelayLoadFailureHook (Address: 0x1801595f0)
DeleteCriticalSection (Address: 0x180159828)
DisableThreadLibraryCalls (Address: 0x180159770)
DisconnectNamedPipe (Address: 0x180159708)
EnterCriticalSection (Address: 0x1801598c8)
ExpandEnvironmentStringsW (Address: 0x180159930)
FindClose (Address: 0x180159608)
FindFirstFileW (Address: 0x180159618)
FindNextFileW (Address: 0x180159610)
FlushFileBuffers (Address: 0x180159700)
FormatMessageW (Address: 0x180159908)
FreeEnvironmentStringsW (Address: 0x180159620)
FreeLibrary (Address: 0x180159800)
FreeLibraryAndExitThread (Address: 0x180159780)
GetCurrentProcess (Address: 0x1801597c8)
GetCurrentProcessId (Address: 0x180159820)
GetCurrentThreadId (Address: 0x180159910)
GetDriveTypeW (Address: 0x180159600)
GetEnvironmentStringsW (Address: 0x180159628)
GetFileSize (Address: 0x1801595d0)
GetLastError (Address: 0x180159890)
GetLogicalProcessorInformation (Address: 0x1801595e0)
GetLongPathNameW (Address: 0x1801595f8)
GetModuleFileNameA (Address: 0x180159928)
GetModuleFileNameW (Address: 0x180159698)
GetModuleHandleA (Address: 0x180159788)
GetModuleHandleExA (Address: 0x180159680)
GetModuleHandleExW (Address: 0x180159918)
GetModuleHandleW (Address: 0x1801598e8)
GetNativeSystemInfo (Address: 0x180159810)
GetPrivateProfileStringA (Address: 0x1801596e0)
GetProcAddress (Address: 0x1801598f8)
GetProcessHeap (Address: 0x1801598f0)
GetProcessId (Address: 0x1801597c0)
GetProcessMitigationPolicy (Address: 0x180159690)
GetSystemTime (Address: 0x180159798)
GetSystemTimeAsFileTime (Address: 0x1801596a0)
GetTickCount (Address: 0x180159750)
GetVersionExA (Address: 0x1801595d8)
GlobalAddAtomA (Address: 0x180159738)
HeapAlloc (Address: 0x180159900)
HeapFree (Address: 0x180159920)
InitializeCriticalSection (Address: 0x1801597f0)
InitializeCriticalSectionEx (Address: 0x1801598b0)
InitializeSRWLock (Address: 0x1801597d0)
InitOnceBeginInitialize (Address: 0x180159660)
InitOnceComplete (Address: 0x180159638)
IsDebuggerPresent (Address: 0x180159818)
K32GetModuleFileNameExW (Address: 0x180159658)
LeaveCriticalSection (Address: 0x1801598b8)
LoadLibraryA (Address: 0x1801597e8)
LoadLibraryExW (Address: 0x1801597f8)
LoadLibraryW (Address: 0x1801597a8)
LocalAlloc (Address: 0x180159760)
LocalFree (Address: 0x180159758)
lstrcmpA (Address: 0x1801597d8)
OpenEventW (Address: 0x180159748)
OpenMutexW (Address: 0x180159720)
OpenProcess (Address: 0x180159640)
OpenSemaphoreW (Address: 0x180159860)
OutputDebugStringA (Address: 0x180159808)
OutputDebugStringW (Address: 0x180159880)
PeekNamedPipe (Address: 0x1801596f0)
QueryPerformanceCounter (Address: 0x180159790)
QueryPerformanceFrequency (Address: 0x1801597b0)
ReadFile (Address: 0x1801596f8)
RegGetValueW (Address: 0x180159650)
RegOpenKeyExW (Address: 0x180159648)
RegQueryValueExW (Address: 0x180159630)
ReleaseMutex (Address: 0x180159898)
ReleaseSemaphore (Address: 0x1801598c0)
ReleaseSRWLockExclusive (Address: 0x180159888)
ReleaseSRWLockShared (Address: 0x180159848)
ResetEvent (Address: 0x180159740)
ResolveDelayLoadedAPI (Address: 0x1801595e8)
SetErrorMode (Address: 0x1801597e0)
SetEvent (Address: 0x180159678)
SetLastError (Address: 0x1801598d0)
SetNamedPipeHandleState (Address: 0x180159718)
SetThreadpoolTimer (Address: 0x180159850)
SetUnhandledExceptionFilter (Address: 0x1801596b0)
Sleep (Address: 0x1801597b8)
TerminateProcess (Address: 0x1801596a8)
TransactNamedPipe (Address: 0x1801596d8)
UnhandledExceptionFilter (Address: 0x1801596b8)
VerifyVersionInfoA (Address: 0x180159768)
WaitForMultipleObjects (Address: 0x180159688)
WaitForSingleObject (Address: 0x1801598a0)
WaitForSingleObjectEx (Address: 0x180159868)
WaitForThreadpoolTimerCallbacks (Address: 0x1801598a8)
WaitNamedPipeA (Address: 0x1801596d0)
WideCharToMultiByte (Address: 0x1801597a0)
WriteFile (Address: 0x1801596e8)

KERNELBASE.dll

CheckIsMSIXPackage (Address: 0x180159960)
GetApplicationUserModelId (Address: 0x180159948)
GetCurrentApplicationUserModelId (Address: 0x180159968)
GetCurrentPackageFamilyName (Address: 0x180159950)
GetCurrentPackageFullName (Address: 0x180159958)
GetPackageFamilyName (Address: 0x180159940)

msvcrt.dll

__C_specific_handler (Address: 0x180159f78)
__CxxFrameHandler3 (Address: 0x180159fa8)
__dllonexit (Address: 0x180159fe0)
__iscsym (Address: 0x180159f98)
_amsg_exit (Address: 0x180159fb0)
_CxxThrowException (Address: 0x180159f10)
_initterm (Address: 0x180159fb8)
_lock (Address: 0x180159fd0)
_onexit (Address: 0x180159fe8)
_purecall (Address: 0x180159ed8)
_stricmp (Address: 0x180159f38)
_unlock (Address: 0x180159fd8)
_vsnprintf (Address: 0x180159f30)
_vsnprintf_s (Address: 0x180159e38)
_vsnwprintf (Address: 0x180159f20)
_wcsicmp (Address: 0x180159e70)
_wcslwr (Address: 0x180159e88)
_wcsnicmp (Address: 0x180159e58)
_wtoi (Address: 0x180159e48)
_XcptFilter (Address: 0x180159fa0)
??0exception@@QEAA@AEBV0@@Z (Address: 0x180159e30)
??0exception@@QEAA@XZ (Address: 0x180159e28)
??1exception@@UEAA@XZ (Address: 0x180159f70)
??1type_info@@UEAA@XZ (Address: 0x180159fc8)
?terminate@@YAXXZ (Address: 0x180159fc0)
abort (Address: 0x180159f80)
ceil (Address: 0x180159f60)
cos (Address: 0x180159f58)
cosf (Address: 0x180159f50)
expf (Address: 0x180159ef8)
floor (Address: 0x180159ee8)
floorf (Address: 0x180159ee0)
free (Address: 0x180159f28)
log10f (Address: 0x180159e40)
logf (Address: 0x180159e20)
malloc (Address: 0x180159f08)
memcmp (Address: 0x180159ef0)
memcpy (Address: 0x180159dd8)
memcpy_s (Address: 0x180159f18)
memmove (Address: 0x180159de0)
memmove_s (Address: 0x180159f00)
memset (Address: 0x180159de8)
pow (Address: 0x180159df0)
powf (Address: 0x180159df8)
qsort (Address: 0x180159ec0)
sinf (Address: 0x180159e00)
sprintf_s (Address: 0x180159ec8)
sqrt (Address: 0x180159e08)
sqrtf (Address: 0x180159e10)
sscanf_s (Address: 0x180159f88)
strcat_s (Address: 0x180159ed0)
strcmp (Address: 0x180159e18)
strcpy_s (Address: 0x180159f40)
strncmp (Address: 0x180159eb0)
strrchr (Address: 0x180159f48)
strstr (Address: 0x180159f90)
swprintf_s (Address: 0x180159e60)
swscanf_s (Address: 0x180159e68)
toupper (Address: 0x180159ea8)
wcscat_s (Address: 0x180159e80)
wcschr (Address: 0x180159e50)
wcscmp (Address: 0x180159ff0)
wcscpy_s (Address: 0x180159e78)
wcsncmp (Address: 0x180159ea0)
wcsrchr (Address: 0x180159e98)
wcsspn (Address: 0x180159eb8)
wcsstr (Address: 0x180159e90)
wcstol (Address: 0x180159f68)

ntdll.dll

EtwEventRegister (Address: 0x18015a1a0)
EtwEventUnregister (Address: 0x18015a198)
EtwEventWriteNoRegistration (Address: 0x18015a080)
EtwEventWriteTransfer (Address: 0x18015a180)
EtwGetTraceEnableFlags (Address: 0x18015a1c8)
EtwGetTraceEnableLevel (Address: 0x18015a1e0)
EtwGetTraceLoggerHandle (Address: 0x18015a1d0)
EtwLogTraceEvent (Address: 0x18015a188)
EtwRegisterTraceGuidsA (Address: 0x18015a1d8)
EtwUnregisterTraceGuids (Address: 0x18015a1c0)
LdrResSearchResource (Address: 0x18015a030)
NtClose (Address: 0x18015a058)
NtQueryInformationProcess (Address: 0x18015a168)
NtQueryValueKey (Address: 0x18015a190)
NtQueryWnfStateData (Address: 0x18015a160)
RtlAllocateHeap (Address: 0x18015a158)
RtlAnsiStringToUnicodeString (Address: 0x18015a088)
RtlAppendUnicodeStringToString (Address: 0x18015a0e0)
RtlAppendUnicodeToString (Address: 0x18015a0d8)
RtlCaptureContext (Address: 0x18015a1b8)
RtlCopyUnicodeString (Address: 0x18015a078)
RtlDllShutdownInProgress (Address: 0x18015a178)
RtlDosPathNameToNtPathName_U_WithStatus (Address: 0x18015a110)
RtlFormatCurrentUserKeyPath (Address: 0x18015a0d0)
RtlFreeHeap (Address: 0x18015a140)
RtlFreeUnicodeString (Address: 0x18015a100)
RtlGetNativeSystemInformation (Address: 0x18015a120)
RtlGetVersion (Address: 0x18015a048)
RtlGUIDFromString (Address: 0x18015a170)
RtlImageDirectoryEntryToData (Address: 0x18015a040)
RtlInitString (Address: 0x18015a098)
RtlInitUnicodeString (Address: 0x18015a130)
RtlInitUnicodeStringEx (Address: 0x18015a0f0)
RtlIsCriticalSectionLockedByThread (Address: 0x18015a1e8)
RtlLookupFunctionEntry (Address: 0x18015a1b0)
RtlNtPathNameToDosPathName (Address: 0x18015a018)
RtlpEnsureBufferSize (Address: 0x18015a010)
RtlPublishWnfStateData (Address: 0x18015a1f0)
RtlReAllocateHeap (Address: 0x18015a150)
RtlRunOnceExecuteOnce (Address: 0x18015a050)
RtlUnicodeStringToAnsiString (Address: 0x18015a000)
RtlUnicodeStringToInteger (Address: 0x18015a070)
RtlUpcaseUnicodeChar (Address: 0x18015a128)
RtlUpcaseUnicodeString (Address: 0x18015a0a0)
RtlVerifyVersionInfo (Address: 0x18015a038)
RtlVirtualUnwind (Address: 0x18015a1a8)
RtlxAnsiStringToUnicodeSize (Address: 0x18015a090)
VerSetConditionMask (Address: 0x18015a1f8)
ZwClose (Address: 0x18015a138)
ZwCreateFile (Address: 0x18015a0c8)
ZwCreateSection (Address: 0x18015a0b8)
ZwEnumerateKey (Address: 0x18015a148)
ZwEnumerateValueKey (Address: 0x18015a068)
ZwMapViewOfSection (Address: 0x18015a028)
ZwOpenFile (Address: 0x18015a108)
ZwOpenKey (Address: 0x18015a0f8)
ZwQueryDirectoryFile (Address: 0x18015a008)
ZwQueryInformationFile (Address: 0x18015a0c0)
ZwQueryInformationProcess (Address: 0x18015a0b0)
ZwQueryKey (Address: 0x18015a060)
ZwQuerySystemInformation (Address: 0x18015a118)
ZwQueryValueKey (Address: 0x18015a0e8)
ZwSetInformationProcess (Address: 0x18015a0a8)
ZwUnmapViewOfSection (Address: 0x18015a020)

USER32.dll

AttachThreadInput (Address: 0x180159980)
CallWindowProcA (Address: 0x180159b00)
CallWindowProcW (Address: 0x180159b10)
ClientToScreen (Address: 0x180159be0)
CloseClipboard (Address: 0x180159a90)
CloseDesktop (Address: 0x180159a78)
CreateIconIndirect (Address: 0x180159a18)
CreateWindowExA (Address: 0x180159b90)
DefWindowProcA (Address: 0x180159b78)
DestroyIcon (Address: 0x180159a38)
DestroyWindow (Address: 0x1801599a0)
DispatchMessageA (Address: 0x1801599a8)
DisplayConfigGetDeviceInfo (Address: 0x180159ba0)
EmptyClipboard (Address: 0x180159aa0)
EnumDisplayDevicesA (Address: 0x180159b98)
EnumDisplayMonitors (Address: 0x1801599d0)
EnumDisplaySettingsA (Address: 0x180159bd8)
EqualRect (Address: 0x1801599d8)
GetAncestor (Address: 0x1801599f0)
GetClientRect (Address: 0x180159bd0)
GetCursor (Address: 0x180159a40)
GetCursorPos (Address: 0x180159a10)
GetDC (Address: 0x180159c08)
GetDesktopWindow (Address: 0x180159a30)
GetForegroundWindow (Address: 0x180159ac0)
GetKeyState (Address: 0x180159ae8)
GetMonitorInfoA (Address: 0x180159bb8)
GetPropW (Address: 0x180159998)
GetSystemMetrics (Address: 0x180159bf0)
GetThreadDesktop (Address: 0x180159a70)
GetUserObjectInformationA (Address: 0x180159a80)
GetWindow (Address: 0x1801599b0)
GetWindowDC (Address: 0x180159a20)
GetWindowDisplayAffinity (Address: 0x180159ab8)
GetWindowInfo (Address: 0x180159c00)
GetWindowLongA (Address: 0x180159ad8)
GetWindowLongPtrA (Address: 0x180159b48)
GetWindowLongPtrW (Address: 0x1801599c0)
GetWindowRect (Address: 0x180159ab0)
GetWindowThreadProcessId (Address: 0x1801599b8)
IntersectRect (Address: 0x180159bc0)
IsIconic (Address: 0x180159b68)
IsRectEmpty (Address: 0x1801599e0)
IsWindow (Address: 0x180159ae0)
IsWindowUnicode (Address: 0x1801599c8)
IsWindowVisible (Address: 0x180159b50)
IsZoomed (Address: 0x180159c10)
KillTimer (Address: 0x180159b20)
LoadCursorW (Address: 0x180159a50)
LoadIconA (Address: 0x180159b80)
MonitorFromWindow (Address: 0x180159b70)
mouse_event (Address: 0x180159ad0)
MsgWaitForMultipleObjects (Address: 0x180159988)
NotifyOverlayWindow (Address: 0x180159a28)
OffsetRect (Address: 0x180159be8)
OpenClipboard (Address: 0x180159aa8)
OpenInputDesktop (Address: 0x180159a88)
PeekMessageA (Address: 0x180159b38)
PostMessageA (Address: 0x180159af0)
PtInRect (Address: 0x180159a00)
RegisterClassA (Address: 0x180159b88)
RegisterHotKey (Address: 0x180159a68)
ReleaseDC (Address: 0x180159bf8)
RemovePropW (Address: 0x180159990)
SendMessageA (Address: 0x180159af8)
SetClipboardData (Address: 0x180159a98)
SetCursor (Address: 0x180159a48)
SetCursorPos (Address: 0x180159a08)
SetForegroundWindow (Address: 0x180159ac8)
SetPropW (Address: 0x180159978)
SetRect (Address: 0x180159bc8)
SetRectEmpty (Address: 0x180159a58)
SetTimer (Address: 0x180159b28)
SetWindowDisplayAffinity (Address: 0x1801599f8)
SetWindowLongA (Address: 0x1801599e8)
SetWindowLongPtrA (Address: 0x180159b08)
SetWindowLongPtrW (Address: 0x180159b18)
SetWindowPos (Address: 0x180159bb0)
ShowWindow (Address: 0x180159b58)
SystemParametersInfoA (Address: 0x180159ba8)
TranslateMessage (Address: 0x180159b30)
UnionRect (Address: 0x180159b60)
UnregisterClassA (Address: 0x180159b40)
UnregisterHotKey (Address: 0x180159a60)

win32u.dll

NtBindCompositionSurface (Address: 0x18015a218)
NtNotifyPresentToCompositionSurface (Address: 0x18015a220)
NtQueryCompositionSurfaceStatistics (Address: 0x18015a210)
NtUnBindCompositionSurface (Address: 0x18015a208)