dbghelp.dll

Description: Windows Image Helper

Version: 10.0.19041.5848

Architecture: 64-bit

Operating System: Windows NT

SHA256: 6357f697069e90b475f78520f235aae7

File Size: 1.9 MB

Uploaded At: Dec. 1, 2025, 7:25 a.m.

Views: 17

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

(Ordinal: 1101, Address: 0x12eea0)
(Ordinal: 1102, Address: 0x12ef90)
(Ordinal: 1103, Address: 0x12f120)
(Ordinal: 1104, Address: 0x12f4a0)
(Ordinal: 1105, Address: 0x12fb80)
(Ordinal: 1106, Address: 0x12fc10)
(Ordinal: 1107, Address: 0x12f0e0)
(Ordinal: 1108, Address: 0x12f3d0)
(Ordinal: 1109, Address: 0x12fb00)
(Ordinal: 1110, Address: 0x12fba0)
SymAllocDiaString (Ordinal: 1111, Address: 0x12ed60)
SymFreeDiaString (Ordinal: 1112, Address: 0x12f020)
SymGetDiaSession (Ordinal: 1113, Address: 0x12f030)
SymGetLineFromAddrEx (Ordinal: 1114, Address: 0x12f0e0)
(Ordinal: 1115, Address: 0x12f160)
(Ordinal: 1116, Address: 0x12f230)
(Ordinal: 1117, Address: 0x12ed80)
(Ordinal: 1118, Address: 0x12ee30)
(Ordinal: 1119, Address: 0xffa60)
SymGetLineFromNameEx (Ordinal: 1120, Address: 0x12f3d0)
SymGetLineNextEx (Ordinal: 1121, Address: 0x12fb00)
SymGetLinePrevEx (Ordinal: 1122, Address: 0x12fba0)
SymGetOmapBlockBase (Ordinal: 1123, Address: 0x12fc30)
SymSetDiaSession (Ordinal: 1124, Address: 0x12fcb0)
_EFN_DumpImage (Ordinal: 1125, Address: 0x121330)
DbgHelpCreateUserDump (Ordinal: 1126, Address: 0x13de10)
DbgHelpCreateUserDumpW (Ordinal: 1127, Address: 0x13df10)
EnumDirTree (Ordinal: 1128, Address: 0x136fe0)
EnumDirTreeW (Ordinal: 1129, Address: 0x137110)
EnumerateLoadedModules (Ordinal: 1130, Address: 0x1307a0)
EnumerateLoadedModules64 (Ordinal: 1131, Address: 0x1307a0)
EnumerateLoadedModulesEx (Ordinal: 1132, Address: 0x130800)
EnumerateLoadedModulesExW (Ordinal: 1133, Address: 0x130860)
EnumerateLoadedModulesW64 (Ordinal: 1134, Address: 0x1308c0)
ExtensionApiVersion (Ordinal: 1135, Address: 0x1256e0)
FindDebugInfoFile (Ordinal: 1136, Address: 0x137160)
FindDebugInfoFileEx (Ordinal: 1137, Address: 0x137180)
FindDebugInfoFileExW (Ordinal: 1138, Address: 0x137250)
FindExecutableImage (Ordinal: 1139, Address: 0x1372a0)
FindExecutableImageEx (Ordinal: 1140, Address: 0x1372c0)
FindExecutableImageExW (Ordinal: 1141, Address: 0x1373c0)
FindFileInPath (Ordinal: 1142, Address: 0x137410)
FindFileInSearchPath (Ordinal: 1143, Address: 0x137460)
GetSymLoadError (Ordinal: 1144, Address: 0x130920)
GetTimestampForLoadedLibrary (Ordinal: 1145, Address: 0x1279a0)
ImageDirectoryEntryToData (Ordinal: 1146, Address: 0x127620)
ImageDirectoryEntryToDataEx (Ordinal: 1147, Address: 0x127640)
ImageNtHeader (Ordinal: 1148, Address: 0x127770)
ImageRvaToSection (Ordinal: 1149, Address: 0x1277b0)
ImageRvaToVa (Ordinal: 1150, Address: 0x127820)
ImagehlpApiVersion (Ordinal: 1151, Address: 0x1374b0)
ImagehlpApiVersionEx (Ordinal: 1152, Address: 0x1374c0)
MakeSureDirectoryPathExists (Ordinal: 1153, Address: 0x137500)
MiniDumpReadDumpStream (Ordinal: 1154, Address: 0x1c273a)
MiniDumpWriteDump (Ordinal: 1155, Address: 0x1c276b)
RangeMapAddPeImageSections (Ordinal: 1156, Address: 0x14f7c0)
RangeMapCreate (Ordinal: 1157, Address: 0x14f880)
RangeMapFree (Ordinal: 1158, Address: 0x14f8e0)
RangeMapRead (Ordinal: 1159, Address: 0x14f900)
RangeMapRemove (Ordinal: 1160, Address: 0x14f960)
RangeMapWrite (Ordinal: 1161, Address: 0x14f9b0)
RemoveInvalidModuleList (Ordinal: 1162, Address: 0x19470)
ReportSymbolLoadSummary (Ordinal: 1163, Address: 0x120bd0)
SearchTreeForFile (Ordinal: 1164, Address: 0x137690)
SearchTreeForFileW (Ordinal: 1165, Address: 0x1376c0)
SetCheckUserInterruptShared (Ordinal: 1166, Address: 0x19470)
SetSymLoadError (Ordinal: 1167, Address: 0x130930)
StackWalk (Ordinal: 1168, Address: 0xe170)
StackWalk64 (Ordinal: 1169, Address: 0xe170)
StackWalkEx (Ordinal: 1170, Address: 0xe2f0)
SymAddSourceStream (Ordinal: 1171, Address: 0x130940)
SymAddSourceStreamA (Ordinal: 1172, Address: 0x130950)
SymAddSourceStreamW (Ordinal: 1173, Address: 0x1309c0)
SymAddSymbol (Ordinal: 1174, Address: 0x130b60)
SymAddSymbolW (Ordinal: 1175, Address: 0x130be0)
SymAddrIncludeInlineTrace (Ordinal: 1176, Address: 0x130cf0)
SymCleanup (Ordinal: 1177, Address: 0xe120)
SymCompareInlineTrace (Ordinal: 1178, Address: 0x130e70)
SymDeleteSymbol (Ordinal: 1179, Address: 0x1313c0)
SymDeleteSymbolW (Ordinal: 1180, Address: 0x131430)
SymEnumLines (Ordinal: 1181, Address: 0x131520)
SymEnumLinesW (Ordinal: 1182, Address: 0x1315f0)
SymEnumProcesses (Ordinal: 1183, Address: 0x131660)
SymEnumSourceFileTokens (Ordinal: 1184, Address: 0x131700)
SymEnumSourceFiles (Ordinal: 1185, Address: 0x1317b0)
SymEnumSourceFilesW (Ordinal: 1186, Address: 0x1317e0)
SymEnumSourceLines (Ordinal: 1187, Address: 0x131810)
SymEnumSourceLinesW (Ordinal: 1188, Address: 0x131860)
SymEnumSym (Ordinal: 1189, Address: 0x1318b0)
SymEnumSymbols (Ordinal: 1190, Address: 0x1318e0)
SymEnumSymbolsEx (Ordinal: 1191, Address: 0x131910)
SymEnumSymbolsExW (Ordinal: 1192, Address: 0x1319b0)
SymEnumSymbolsForAddr (Ordinal: 1193, Address: 0x131a20)
SymEnumSymbolsForAddrW (Ordinal: 1194, Address: 0x131b50)
SymEnumSymbolsW (Ordinal: 1195, Address: 0x131c90)
SymEnumTypes (Ordinal: 1196, Address: 0x131cc0)
SymEnumTypesByName (Ordinal: 1197, Address: 0x131d10)
SymEnumTypesByNameW (Ordinal: 1198, Address: 0x131de0)
SymEnumTypesW (Ordinal: 1199, Address: 0x131e40)
SymEnumerateModules (Ordinal: 1200, Address: 0x131e90)
SymEnumerateModules64 (Ordinal: 1201, Address: 0x131e90)
SymEnumerateModulesW64 (Ordinal: 1202, Address: 0x131ed0)
SymEnumerateSymbols (Ordinal: 1203, Address: 0x131f10)
SymEnumerateSymbols64 (Ordinal: 1204, Address: 0x131f10)
SymEnumerateSymbolsW (Ordinal: 1205, Address: 0x131f60)
SymEnumerateSymbolsW64 (Ordinal: 1206, Address: 0x131f60)
SymFindDebugInfoFile (Ordinal: 1207, Address: 0x1376f0)
SymFindDebugInfoFileW (Ordinal: 1208, Address: 0x1377e0)
SymFindExecutableImage (Ordinal: 1209, Address: 0x137870)
SymFindExecutableImageW (Ordinal: 1210, Address: 0x137970)
SymFindFileInPath (Ordinal: 1211, Address: 0x137a00)
SymFindFileInPathW (Ordinal: 1212, Address: 0x137b40)
SymFromAddr (Ordinal: 1213, Address: 0x131fb0)
SymFromAddrW (Ordinal: 1214, Address: 0x131fe0)
SymFromIndex (Ordinal: 1215, Address: 0x132010)
SymFromIndexW (Ordinal: 1216, Address: 0x132080)
SymFromInlineContext (Ordinal: 1217, Address: 0x132180)
SymFromInlineContextW (Ordinal: 1218, Address: 0x1321e0)
SymFromName (Ordinal: 1219, Address: 0x198b0)
SymFromNameW (Ordinal: 1220, Address: 0x132240)
SymFromToken (Ordinal: 1221, Address: 0x132270)
SymFromTokenW (Ordinal: 1222, Address: 0x132320)
SymFunctionTableAccess (Ordinal: 1223, Address: 0xec60)
SymFunctionTableAccess64 (Ordinal: 1224, Address: 0xec60)
SymFunctionTableAccess64AccessRoutines (Ordinal: 1225, Address: 0xec80)
SymGetExtendedOption (Ordinal: 1226, Address: 0x132430)
SymGetFileLineOffsets64 (Ordinal: 1227, Address: 0x129d40)
SymGetHomeDirectory (Ordinal: 1228, Address: 0x132450)
SymGetHomeDirectoryW (Ordinal: 1229, Address: 0x1324d0)
SymGetLineFromAddr (Ordinal: 1230, Address: 0x132590)
SymGetLineFromAddr64 (Ordinal: 1231, Address: 0x132590)
SymGetLineFromAddrW64 (Ordinal: 1232, Address: 0x1325c0)
SymGetLineFromInlineContext (Ordinal: 1233, Address: 0x1325f0)
SymGetLineFromInlineContextW (Ordinal: 1234, Address: 0x132630)
SymGetLineFromName (Ordinal: 1235, Address: 0x132670)
SymGetLineFromName64 (Ordinal: 1236, Address: 0x132670)
SymGetLineFromNameW64 (Ordinal: 1237, Address: 0x1326a0)
SymGetLineNext (Ordinal: 1238, Address: 0x1326d0)
SymGetLineNext64 (Ordinal: 1239, Address: 0x1326d0)
SymGetLineNextW64 (Ordinal: 1240, Address: 0x1326e0)
SymGetLinePrev (Ordinal: 1241, Address: 0x132700)
SymGetLinePrev64 (Ordinal: 1242, Address: 0x132700)
SymGetLinePrevW64 (Ordinal: 1243, Address: 0x132710)
SymGetModuleBase (Ordinal: 1244, Address: 0xfa00)
SymGetModuleBase64 (Ordinal: 1245, Address: 0xfa00)
SymGetModuleInfo (Ordinal: 1246, Address: 0x132730)
SymGetModuleInfo64 (Ordinal: 1247, Address: 0x132730)
SymGetModuleInfoW (Ordinal: 1248, Address: 0x10a60)
SymGetModuleInfoW64 (Ordinal: 1249, Address: 0x10a60)
SymGetOmaps (Ordinal: 1250, Address: 0x1327c0)
SymGetOptions (Ordinal: 1251, Address: 0x192c0)
SymGetScope (Ordinal: 1252, Address: 0x1328b0)
SymGetScopeW (Ordinal: 1253, Address: 0x132930)
SymGetSearchPath (Ordinal: 1254, Address: 0x132a60)
SymGetSearchPathW (Ordinal: 1255, Address: 0x132af0)
SymGetSourceFile (Ordinal: 1256, Address: 0x132b60)
SymGetSourceFileChecksum (Ordinal: 1257, Address: 0x132be0)
SymGetSourceFileChecksumW (Ordinal: 1258, Address: 0x132c70)
SymGetSourceFileFromToken (Ordinal: 1259, Address: 0x132da0)
SymGetSourceFileFromTokenW (Ordinal: 1260, Address: 0x132e50)
SymGetSourceFileToken (Ordinal: 1261, Address: 0x132ed0)
SymGetSourceFileTokenW (Ordinal: 1262, Address: 0x132f40)
SymGetSourceFileW (Ordinal: 1263, Address: 0x133010)
SymGetSourceVarFromToken (Ordinal: 1264, Address: 0x133090)
SymGetSourceVarFromTokenW (Ordinal: 1265, Address: 0x133160)
SymGetSymFromAddr (Ordinal: 1266, Address: 0x133210)
SymGetSymFromAddr64 (Ordinal: 1267, Address: 0x133210)
SymGetSymFromName (Ordinal: 1268, Address: 0x133250)
SymGetSymFromName64 (Ordinal: 1269, Address: 0x133250)
SymGetSymNext (Ordinal: 1270, Address: 0x1332c0)
SymGetSymNext64 (Ordinal: 1271, Address: 0x1332c0)
SymGetSymPrev (Ordinal: 1272, Address: 0x1332e0)
SymGetSymPrev64 (Ordinal: 1273, Address: 0x1332e0)
SymGetSymbolFile (Ordinal: 1274, Address: 0x13c780)
SymGetSymbolFileW (Ordinal: 1275, Address: 0x13c8b0)
SymGetTypeFromName (Ordinal: 1276, Address: 0x1332f0)
SymGetTypeFromNameW (Ordinal: 1277, Address: 0x1333a0)
SymGetTypeInfo (Ordinal: 1278, Address: 0x133510)
SymGetTypeInfoEx (Ordinal: 1279, Address: 0x133550)
SymGetUnwindInfo (Ordinal: 1280, Address: 0x133580)
SymInitialize (Ordinal: 1281, Address: 0x11b60)
SymInitializeW (Ordinal: 1282, Address: 0x17d30)
SymLoadModule (Ordinal: 1283, Address: 0x1ae80)
SymLoadModule64 (Ordinal: 1284, Address: 0x1ae80)
SymLoadModuleEx (Ordinal: 1285, Address: 0x1aec0)
SymLoadModuleExW (Ordinal: 1286, Address: 0x133710)
SymMatchFileName (Ordinal: 1287, Address: 0x133770)
SymMatchFileNameW (Ordinal: 1288, Address: 0x133880)
SymMatchString (Ordinal: 1289, Address: 0x133970)
SymMatchStringA (Ordinal: 1290, Address: 0x1339b0)
SymMatchStringW (Ordinal: 1291, Address: 0x1339c0)
SymNext (Ordinal: 1292, Address: 0x133a00)
SymNextW (Ordinal: 1293, Address: 0x133aa0)
SymPrev (Ordinal: 1294, Address: 0x133ac0)
SymPrevW (Ordinal: 1295, Address: 0x133b60)
SymQueryInlineTrace (Ordinal: 1296, Address: 0x133b70)
SymRefreshModuleList (Ordinal: 1297, Address: 0x133e80)
SymRegisterCallback (Ordinal: 1298, Address: 0x133f00)
SymRegisterCallback64 (Ordinal: 1299, Address: 0x133f00)
SymRegisterCallbackW64 (Ordinal: 1300, Address: 0x133f80)
SymRegisterFunctionEntryCallback (Ordinal: 1301, Address: 0x134010)
SymRegisterFunctionEntryCallback64 (Ordinal: 1302, Address: 0x134010)
SymSearch (Ordinal: 1303, Address: 0x134090)
SymSearchW (Ordinal: 1304, Address: 0x134150)
SymSetContext (Ordinal: 1305, Address: 0x1341d0)
SymSetExtendedOption (Ordinal: 1306, Address: 0x134290)
SymSetHomeDirectory (Ordinal: 1307, Address: 0x1342c0)
SymSetHomeDirectoryW (Ordinal: 1308, Address: 0x134360)
SymSetOptions (Ordinal: 1309, Address: 0x181c0)
SymSetParentWindow (Ordinal: 1310, Address: 0x1343e0)
SymSetScopeFromAddr (Ordinal: 1311, Address: 0x134410)
SymSetScopeFromIndex (Ordinal: 1312, Address: 0x134420)
SymSetScopeFromInlineContext (Ordinal: 1313, Address: 0x1344e0)
SymSetSearchPath (Ordinal: 1314, Address: 0x1345a0)
SymSetSearchPathW (Ordinal: 1315, Address: 0x179d0)
SymSrvDeltaName (Ordinal: 1316, Address: 0x13cd60)
SymSrvDeltaNameW (Ordinal: 1317, Address: 0x13ce30)
SymSrvGetFileIndexInfo (Ordinal: 1318, Address: 0x13cfd0)
SymSrvGetFileIndexInfoW (Ordinal: 1319, Address: 0x13d0b0)
SymSrvGetFileIndexString (Ordinal: 1320, Address: 0x13d1f0)
SymSrvGetFileIndexStringW (Ordinal: 1321, Address: 0x13d2b0)
SymSrvGetFileIndexes (Ordinal: 1322, Address: 0x13d380)
SymSrvGetFileIndexesW (Ordinal: 1323, Address: 0x13d3f0)
SymSrvGetSupplement (Ordinal: 1324, Address: 0x13d4b0)
SymSrvGetSupplementW (Ordinal: 1325, Address: 0x13d570)
SymSrvIsStore (Ordinal: 1326, Address: 0x13d690)
SymSrvIsStoreW (Ordinal: 1327, Address: 0x13d6e0)
SymSrvStoreFile (Ordinal: 1328, Address: 0x13d820)
SymSrvStoreFileW (Ordinal: 1329, Address: 0x13d8c0)
SymSrvStoreSupplement (Ordinal: 1330, Address: 0x13d980)
SymSrvStoreSupplementW (Ordinal: 1331, Address: 0x13da50)
SymUnDName (Ordinal: 1332, Address: 0x1345f0)
SymUnDName64 (Ordinal: 1333, Address: 0x1345f0)
SymUnloadModule (Ordinal: 1334, Address: 0x134650)
SymUnloadModule64 (Ordinal: 1335, Address: 0x134650)
UnDecorateSymbolName (Ordinal: 1336, Address: 0x8900)
UnDecorateSymbolNameW (Ordinal: 1337, Address: 0x134740)
WinDbgExtensionDllInit (Ordinal: 1338, Address: 0x1257d0)
block (Ordinal: 1339, Address: 0x125820)
chksym (Ordinal: 1340, Address: 0x1259f0)
dbghelp (Ordinal: 1341, Address: 0x134880)
dh (Ordinal: 1342, Address: 0x125be0)
fptr (Ordinal: 1343, Address: 0x125bf0)
homedir (Ordinal: 1344, Address: 0x125c80)
inlinedbg (Ordinal: 1345, Address: 0x125db0)
itoldyouso (Ordinal: 1346, Address: 0x125e20)
lmi (Ordinal: 1347, Address: 0x126010)
lminfo (Ordinal: 1348, Address: 0x126330)
omap (Ordinal: 1349, Address: 0x126550)
optdbgdump (Ordinal: 1350, Address: 0x126770)
optdbgdumpaddr (Ordinal: 1351, Address: 0x1268c0)
srcfiles (Ordinal: 1352, Address: 0x126a10)
stack_force_ebp (Ordinal: 1353, Address: 0x126b40)
stackdbg (Ordinal: 1354, Address: 0x126cb0)
sym (Ordinal: 1355, Address: 0x126e80)
symsrv (Ordinal: 1356, Address: 0x126fd0)
vc7fpo (Ordinal: 1357, Address: 0x127020)

Imported DLLs & Functions

api-ms-win-core-debug-l1-1-0.dll

DebugBreak (Address: 0x10317b9a0)
IsDebuggerPresent (Address: 0x10317b9a8)
OutputDebugStringA (Address: 0x10317b990)
OutputDebugStringW (Address: 0x10317b998)

api-ms-win-core-delayload-l1-1-0.dll

DelayLoadFailureHook (Address: 0x10317b9b8)

api-ms-win-core-errorhandling-l1-1-0.dll

GetLastError (Address: 0x10317b9d0)
SetErrorMode (Address: 0x10317b9e8)
SetLastError (Address: 0x10317b9c8)
SetUnhandledExceptionFilter (Address: 0x10317b9d8)
UnhandledExceptionFilter (Address: 0x10317b9e0)

api-ms-win-core-file-l1-1-0.dll

CreateDirectoryA (Address: 0x10317baa0)
CreateDirectoryW (Address: 0x10317ba60)
CreateFileA (Address: 0x10317ba68)
CreateFileW (Address: 0x10317ba80)
DeleteFileW (Address: 0x10317ba48)
FindClose (Address: 0x10317ba38)
FindFirstFileW (Address: 0x10317ba70)
FindNextFileW (Address: 0x10317b9f8)
GetFileAttributesA (Address: 0x10317ba28)
GetFileAttributesW (Address: 0x10317ba78)
GetFileSize (Address: 0x10317ba90)
GetFileSizeEx (Address: 0x10317ba88)
GetFileType (Address: 0x10317ba18)
GetFullPathNameW (Address: 0x10317ba50)
ReadFile (Address: 0x10317ba58)
RemoveDirectoryW (Address: 0x10317ba98)
SetEndOfFile (Address: 0x10317ba20)
SetFileAttributesW (Address: 0x10317ba08)
SetFilePointer (Address: 0x10317ba30)
SetFilePointerEx (Address: 0x10317ba40)
SetFileTime (Address: 0x10317ba10)
WriteFile (Address: 0x10317ba00)

api-ms-win-core-handle-l1-1-0.dll

CloseHandle (Address: 0x10317bab8)
DuplicateHandle (Address: 0x10317bab0)

api-ms-win-core-heap-l1-1-0.dll

GetProcessHeap (Address: 0x10317bae0)
HeapAlloc (Address: 0x10317bad8)
HeapFree (Address: 0x10317bac8)
HeapReAlloc (Address: 0x10317bad0)

api-ms-win-core-interlocked-l1-1-0.dll

InitializeSListHead (Address: 0x10317baf0)

api-ms-win-core-io-l1-1-0.dll

DeviceIoControl (Address: 0x10317bb00)

api-ms-win-core-kernel32-legacy-l1-1-0.dll

CreateFileMappingA (Address: 0x10317bb10)

api-ms-win-core-libraryloader-l1-1-0.dll

FreeLibrary (Address: 0x10317bb30)
GetModuleFileNameW (Address: 0x10317bb20)
GetModuleHandleExW (Address: 0x10317bb40)
GetModuleHandleW (Address: 0x10317bb38)
GetProcAddress (Address: 0x10317bb48)
LoadLibraryExA (Address: 0x10317bb50)
LoadLibraryExW (Address: 0x10317bb28)

api-ms-win-core-localization-l1-1-0.dll

LCMapStringEx (Address: 0x10317bb60)
LCMapStringW (Address: 0x10317bb68)

api-ms-win-core-localregistry-l1-1-0.dll

RegCloseKey (Address: 0x10317bb88)
RegEnumKeyExW (Address: 0x10317bb80)
RegOpenKeyExW (Address: 0x10317bb78)
RegQueryInfoKeyW (Address: 0x10317bb98)
RegQueryValueExW (Address: 0x10317bb90)

api-ms-win-core-memory-l1-1-0.dll

CreateFileMappingW (Address: 0x10317bbc0)
MapViewOfFile (Address: 0x10317bbc8)
MapViewOfFileEx (Address: 0x10317bbd8)
ReadProcessMemory (Address: 0x10317bbe0)
UnmapViewOfFile (Address: 0x10317bbb8)
VirtualAlloc (Address: 0x10317bba8)
VirtualFree (Address: 0x10317bbd0)
VirtualProtect (Address: 0x10317bbb0)

api-ms-win-core-misc-l1-1-0.dll

FormatMessageW (Address: 0x10317bbf8)
LocalAlloc (Address: 0x10317bbf0)
Sleep (Address: 0x10317bc00)

api-ms-win-core-processenvironment-l1-1-0.dll

ExpandEnvironmentStringsW (Address: 0x10317bc20)
GetEnvironmentVariableW (Address: 0x10317bc10)
SetEnvironmentVariableA (Address: 0x10317bc18)

api-ms-win-core-processthreads-l1-1-0.dll

GetCurrentProcess (Address: 0x10317bc30)
GetCurrentProcessId (Address: 0x10317bc48)
GetCurrentThread (Address: 0x10317bc68)
GetCurrentThreadId (Address: 0x10317bc58)
OpenThreadToken (Address: 0x10317bc38)
TerminateProcess (Address: 0x10317bc70)
TlsAlloc (Address: 0x10317bc78)
TlsFree (Address: 0x10317bc50)
TlsGetValue (Address: 0x10317bc60)
TlsSetValue (Address: 0x10317bc40)

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter (Address: 0x10317bc88)

api-ms-win-core-rtlsupport-l1-1-0.dll

RtlCaptureContext (Address: 0x10317bc98)
RtlLookupFunctionEntry (Address: 0x10317bca8)
RtlVirtualUnwind (Address: 0x10317bca0)

api-ms-win-core-string-l1-1-0.dll

GetStringTypeW (Address: 0x10317bcc8)
MultiByteToWideChar (Address: 0x10317bcc0)
WideCharToMultiByte (Address: 0x10317bcb8)

api-ms-win-core-synch-l1-1-0.dll

AcquireSRWLockExclusive (Address: 0x10317bce8)
DeleteCriticalSection (Address: 0x10317bce0)
EnterCriticalSection (Address: 0x10317bd00)
InitializeCriticalSection (Address: 0x10317bd10)
InitializeCriticalSectionAndSpinCount (Address: 0x10317bd18)
InitializeCriticalSectionEx (Address: 0x10317bcd8)
LeaveCriticalSection (Address: 0x10317bd08)
OpenProcess (Address: 0x10317bcf0)
ReleaseSRWLockExclusive (Address: 0x10317bcf8)

api-ms-win-core-synch-l1-2-0.dll

InitOnceExecuteOnce (Address: 0x10317bd28)

api-ms-win-core-sysinfo-l1-1-0.dll

GetSystemDirectoryW (Address: 0x10317bd60)
GetSystemInfo (Address: 0x10317bd40)
GetSystemTime (Address: 0x10317bd38)
GetSystemTimeAsFileTime (Address: 0x10317bd50)
GetTickCount (Address: 0x10317bd48)
GetVersionExA (Address: 0x10317bd68)
GetVersionExW (Address: 0x10317bd58)
SystemTimeToFileTime (Address: 0x10317bd70)

api-ms-win-core-util-l1-1-0.dll

DecodePointer (Address: 0x10317bd80)
EncodePointer (Address: 0x10317bd88)

api-ms-win-crt-locale-l1-1-0.dll

_lock_locales (Address: 0x10317bda0)
_unlock_locales (Address: 0x10317bd98)

api-ms-win-crt-private-l1-1-0.dll

__C_specific_handler (Address: 0x10317c0e0)
__CxxFrameHandler3 (Address: 0x10317c0e8)
__std_terminate (Address: 0x10317c090)
__uncaught_exception (Address: 0x10317bfd0)
__unDName (Address: 0x10317c0d0)
__unDNameEx (Address: 0x10317c0b8)
_CxxThrowException (Address: 0x10317bfd8)
_o____lc_codepage_func (Address: 0x10317c078)
_o____lc_locale_name_func (Address: 0x10317c070)
_o____mb_cur_max_func (Address: 0x10317c068)
_o___acrt_iob_func (Address: 0x10317c060)
_o___pctype_func (Address: 0x10317c058)
_o___std_exception_copy (Address: 0x10317c050)
_o___std_exception_destroy (Address: 0x10317c048)
_o___std_type_info_destroy_list (Address: 0x10317c040)
_o___stdio_common_vfprintf (Address: 0x10317c038)
_o___stdio_common_vsnprintf_s (Address: 0x10317c030)
_o___stdio_common_vsnwprintf_s (Address: 0x10317c028)
_o___stdio_common_vsprintf_s (Address: 0x10317c020)
_o___stdio_common_vsscanf (Address: 0x10317c018)
_o___stdio_common_vswprintf_s (Address: 0x10317c010)
_o__callnewh (Address: 0x10317c008)
_o__calloc_base (Address: 0x10317c000)
_o__cexit (Address: 0x10317bff8)
_o__close (Address: 0x10317bff0)
_o__configure_narrow_argv (Address: 0x10317bfe8)
_o__crt_atexit (Address: 0x10317bfe0)
_o__errno (Address: 0x10317bdb0)
_o__execute_onexit_table (Address: 0x10317bdb8)
_o__filelengthi64 (Address: 0x10317bdc0)
_o__fullpath (Address: 0x10317bdc8)
_o__initialize_narrow_environment (Address: 0x10317bdd0)
_o__initialize_onexit_table (Address: 0x10317bdd8)
_o__invalid_parameter_noinfo (Address: 0x10317bde0)
_o__invalid_parameter_noinfo_noreturn (Address: 0x10317bde8)
_o__itoa_s (Address: 0x10317bdf0)
_o__lseeki64 (Address: 0x10317bdf8)
_o__ltoa (Address: 0x10317be00)
_o__mbscmp (Address: 0x10317be08)
_o__memicmp (Address: 0x10317be10)
_o__open_osfhandle (Address: 0x10317be18)
_o__purecall (Address: 0x10317be20)
_o__read (Address: 0x10317be28)
_o__register_onexit_function (Address: 0x10317be30)
_o__seh_filter_dll (Address: 0x10317be38)
_o__splitpath_s (Address: 0x10317be40)
_o__stricmp (Address: 0x10317be48)
_o__strlwr (Address: 0x10317be50)
_o__strnicmp (Address: 0x10317be58)
_o__wcsdup (Address: 0x10317be60)
_o__wcsicmp (Address: 0x10317be68)
_o__wcslwr (Address: 0x10317be70)
_o__wcsnicmp (Address: 0x10317be78)
_o__wctime64 (Address: 0x10317be80)
_o__wdupenv_s (Address: 0x10317be88)
_o__wfsopen (Address: 0x10317be90)
_o__wfullpath (Address: 0x10317be98)
_o__wgetenv (Address: 0x10317bea0)
_o__wmakepath_s (Address: 0x10317bea8)
_o__wsplitpath_s (Address: 0x10317beb0)
_o__wtoi (Address: 0x10317beb8)
_o_abort (Address: 0x10317bec0)
_o_atoi (Address: 0x10317bec8)
_o_atol (Address: 0x10317bed0)
_o_bsearch (Address: 0x10317bed8)
_o_calloc (Address: 0x10317bee0)
_o_fclose (Address: 0x10317bee8)
_o_fflush (Address: 0x10317bef0)
_o_fread (Address: 0x10317bef8)
_o_free (Address: 0x10317bf00)
_o_frexp (Address: 0x10317bf08)
_o_fseek (Address: 0x10317bf10)
_o_ftell (Address: 0x10317bf18)
_o_isspace (Address: 0x10317bf20)
_o_iswprint (Address: 0x10317bf28)
_o_iswspace (Address: 0x10317bf30)
_o_iswxdigit (Address: 0x10317bf38)
_o_localeconv (Address: 0x10317bf40)
_o_malloc (Address: 0x10317bf48)
_o_qsort (Address: 0x10317bf50)
_o_realloc (Address: 0x10317bf58)
_o_setlocale (Address: 0x10317bf60)
_o_strcat_s (Address: 0x10317bf68)
_o_strcpy_s (Address: 0x10317bf70)
_o_strncat_s (Address: 0x10317bf78)
_o_strncpy_s (Address: 0x10317bf80)
_o_terminate (Address: 0x10317bf88)
_o_tolower (Address: 0x10317bf90)
_o_towlower (Address: 0x10317bf98)
_o_wcscat_s (Address: 0x10317bfa0)
_o_wcscpy_s (Address: 0x10317bfa8)
_o_wcsncat_s (Address: 0x10317bfb0)
_o_wcsncpy_s (Address: 0x10317bfb8)
_o_wcstoul (Address: 0x10317bfc0)
_o_wmemcpy_s (Address: 0x10317bfc8)
memcmp (Address: 0x10317c0b0)
memcpy (Address: 0x10317c0d8)
memmove (Address: 0x10317c0a8)
strchr (Address: 0x10317c0c8)
strrchr (Address: 0x10317c0c0)
strstr (Address: 0x10317c088)
wcschr (Address: 0x10317c0a0)
wcsrchr (Address: 0x10317c080)
wcsstr (Address: 0x10317c098)

api-ms-win-crt-runtime-l1-1-0.dll

__doserrno (Address: 0x10317c108)
_initterm (Address: 0x10317c100)
_initterm_e (Address: 0x10317c0f8)

api-ms-win-crt-string-l1-1-0.dll

memset (Address: 0x10317c150)
strcmp (Address: 0x10317c140)
strcspn (Address: 0x10317c130)
strlen (Address: 0x10317c128)
strncmp (Address: 0x10317c120)
strnlen (Address: 0x10317c118)
wcscmp (Address: 0x10317c148)
wcsncmp (Address: 0x10317c158)
wcsnlen (Address: 0x10317c138)

api-ms-win-crt-time-l1-1-0.dll

_ctime64 (Address: 0x10317c168)
_time64 (Address: 0x10317c170)

api-ms-win-downlevel-kernel32-l2-1-0.dll

LocalFree (Address: 0x10317c180)

api-ms-win-eventing-provider-l1-1-0.dll

EventActivityIdControl (Address: 0x10317c198)
EventRegister (Address: 0x10317c190)
EventUnregister (Address: 0x10317c1a8)
EventWriteTransfer (Address: 0x10317c1a0)

api-ms-win-security-base-l1-1-0.dll

AccessCheck (Address: 0x10317c1c0)
GetFileSecurityW (Address: 0x10317c1c8)
ImpersonateSelf (Address: 0x10317c1d0)
RevertToSelf (Address: 0x10317c1b8)

ntdll.dll

NtQueryInformationProcess (Address: 0x10317c218)
NtQueryObject (Address: 0x10317c1e0)
RtlCreateQueryDebugBuffer (Address: 0x10317c1e8)
RtlDestroyQueryDebugBuffer (Address: 0x10317c208)
RtlEqualUnicodeString (Address: 0x10317c210)
RtlQueryProcessDebugInformation (Address: 0x10317c1f0)
RtlRunOnceExecuteOnce (Address: 0x10317c1f8)
RtlUTF8ToUnicodeN (Address: 0x10317c200)