usosvc.dll
Description: Update Session Orchestrator Service
Authors: © Microsoft Corporation. All rights reserved.
Version: 10.0.19041.2304
Architecture: 64-bit
Operating System: Windows NT
SHA256: 584990e931ab56128c6ae783be5d1f01
File Size: 557.0 KB
Uploaded At: Dec. 1, 2025, 8:28 a.m.
Views: 18
Security Warning
This file has been flagged as potentially dangerous.
Reason: Detected potentially dangerous functions used for process injection: OpenProcess
Exported Functions
- GetDefaultConfiguration (Ordinal: 1, Address: 0x30060)
- GetNextAcceptableTime (Ordinal: 2, Address: 0x2f0c0)
- GetNextAcceptableTimeEx (Ordinal: 3, Address: 0x2f180)
- GetSmartActiveHours (Ordinal: 4, Address: 0x2f6d0)
- GetSmartActiveHoursEx (Ordinal: 5, Address: 0x2f780)
- GetSmartBusyCheckVelocityFeature (Ordinal: 6, Address: 0x33c60)
- GetTimeIntervalConfidence (Ordinal: 7, Address: 0x2fce0)
- GetUserActivityPredictionEx (Ordinal: 8, Address: 0x34570)
- ServiceMain (Ordinal: 9, Address: 0x138b0)
- SvchostPushServiceGlobals (Ordinal: 10, Address: 0x13140)
- DllCanUnloadNow (Ordinal: 11, Address: 0x8040)
- DllGetClassObject (Ordinal: 12, Address: 0x8060)
Imported DLLs & Functions
api-ms-win-core-apiquery-l1-1-0.dll
- ApiSetQueryApiSetPresence (Address: 0x180067ef0)
api-ms-win-core-com-l1-1-0.dll
- CoCreateFreeThreadedMarshaler (Address: 0x180067f70)
- CoCreateGuid (Address: 0x180067f50)
- CoCreateInstance (Address: 0x180067f38)
- CoDisconnectContext (Address: 0x180067f00)
- CoDisconnectObject (Address: 0x180067f18)
- CoImpersonateClient (Address: 0x180067f48)
- CoInitializeEx (Address: 0x180067f08)
- CoRegisterClassObject (Address: 0x180067f30)
- CoRevertToSelf (Address: 0x180067f58)
- CoRevokeClassObject (Address: 0x180067f28)
- CoTaskMemAlloc (Address: 0x180067f40)
- CoTaskMemFree (Address: 0x180067f20)
- CoTaskMemRealloc (Address: 0x180067f60)
- CoUninitialize (Address: 0x180067f10)
- CoWaitForMultipleHandles (Address: 0x180067f68)
api-ms-win-core-debug-l1-1-0.dll
- DebugBreak (Address: 0x180067f88)
- IsDebuggerPresent (Address: 0x180067f80)
- OutputDebugStringW (Address: 0x180067f90)
api-ms-win-core-delayload-l1-1-0.dll
- DelayLoadFailureHook (Address: 0x180067fa0)
api-ms-win-core-delayload-l1-1-1.dll
- ResolveDelayLoadedAPI (Address: 0x180067fb0)
api-ms-win-core-errorhandling-l1-1-0.dll
- GetLastError (Address: 0x180067fc0)
- RaiseException (Address: 0x180067fe0)
- SetLastError (Address: 0x180067fc8)
- SetUnhandledExceptionFilter (Address: 0x180067fd8)
- UnhandledExceptionFilter (Address: 0x180067fd0)
api-ms-win-core-file-l1-1-0.dll
- CompareFileTime (Address: 0x180068008)
- CreateDirectoryW (Address: 0x180068018)
- CreateFileW (Address: 0x180067ff8)
- DeleteFileW (Address: 0x180068020)
- FindClose (Address: 0x180068030)
- FindFirstFileW (Address: 0x180068000)
- FindNextFileW (Address: 0x180067ff0)
- GetFileAttributesExW (Address: 0x180068028)
- GetFileAttributesW (Address: 0x180068010)
api-ms-win-core-handle-l1-1-0.dll
- CloseHandle (Address: 0x180068048)
- DuplicateHandle (Address: 0x180068040)
api-ms-win-core-heap-l1-1-0.dll
- GetProcessHeap (Address: 0x180068058)
- HeapAlloc (Address: 0x180068060)
- HeapFree (Address: 0x180068068)
api-ms-win-core-heap-l2-1-0.dll
- LocalAlloc (Address: 0x180068078)
- LocalFree (Address: 0x180068080)
api-ms-win-core-interlocked-l1-1-0.dll
- InitializeSListHead (Address: 0x180068090)
api-ms-win-core-kernel32-legacy-l1-1-0.dll
- UnregisterWait (Address: 0x1800680a0)
api-ms-win-core-kernel32-legacy-l1-1-1.dll
- PowerClearRequest (Address: 0x1800680b8)
- PowerCreateRequest (Address: 0x1800680c8)
- PowerSetRequest (Address: 0x1800680b0)
- VerifyVersionInfoW (Address: 0x1800680c0)
api-ms-win-core-libraryloader-l1-2-0.dll
- DisableThreadLibraryCalls (Address: 0x180068108)
- FindResourceExW (Address: 0x1800680e0)
- FreeLibrary (Address: 0x1800680d8)
- GetModuleFileNameA (Address: 0x180068128)
- GetModuleFileNameW (Address: 0x1800680f8)
- GetModuleHandleExW (Address: 0x180068118)
- GetModuleHandleW (Address: 0x180068120)
- GetProcAddress (Address: 0x1800680f0)
- LoadLibraryExW (Address: 0x180068100)
- LoadResource (Address: 0x180068110)
- SizeofResource (Address: 0x1800680e8)
api-ms-win-core-libraryloader-l1-2-1.dll
- LoadLibraryW (Address: 0x180068138)
api-ms-win-core-localization-l1-2-0.dll
- FormatMessageW (Address: 0x180068148)
api-ms-win-core-path-l1-1-0.dll
- PathAllocCanonicalize (Address: 0x180068170)
- PathCchAppend (Address: 0x180068160)
- PathCchCanonicalize (Address: 0x180068178)
- PathCchRemoveBackslash (Address: 0x180068158)
- PathCchSkipRoot (Address: 0x180068168)
api-ms-win-core-processenvironment-l1-1-0.dll
- ExpandEnvironmentStringsW (Address: 0x180068188)
api-ms-win-core-processthreads-l1-1-0.dll
- CreateProcessAsUserW (Address: 0x1800681d8)
- CreateProcessW (Address: 0x180068198)
- CreateThread (Address: 0x1800681e0)
- GetCurrentProcess (Address: 0x1800681b0)
- GetCurrentProcessId (Address: 0x1800681a8)
- GetCurrentThreadId (Address: 0x1800681d0)
- GetExitCodeProcess (Address: 0x1800681c0)
- GetExitCodeThread (Address: 0x1800681c8)
- OpenProcessToken (Address: 0x1800681b8)
- TerminateProcess (Address: 0x1800681a0)
api-ms-win-core-processthreads-l1-1-1.dll
- IsProcessorFeaturePresent (Address: 0x1800681f8)
- OpenProcess (Address: 0x1800681f0)
api-ms-win-core-profile-l1-1-0.dll
- QueryPerformanceCounter (Address: 0x180068208)
api-ms-win-core-psapi-l1-1-0.dll
- QueryFullProcessImageNameW (Address: 0x180068218)
api-ms-win-core-registry-l1-1-0.dll
- RegCloseKey (Address: 0x180068250)
- RegCreateKeyExW (Address: 0x180068240)
- RegDeleteTreeW (Address: 0x180068268)
- RegDeleteValueW (Address: 0x180068270)
- RegEnumKeyExW (Address: 0x180068238)
- RegGetValueW (Address: 0x180068258)
- RegOpenKeyExW (Address: 0x180068228)
- RegQueryInfoKeyW (Address: 0x180068248)
- RegQueryValueExW (Address: 0x180068260)
- RegSetKeySecurity (Address: 0x180068278)
- RegSetValueExW (Address: 0x180068230)
api-ms-win-core-registry-l1-1-1.dll
- RegSetKeyValueW (Address: 0x180068288)
api-ms-win-core-rtlsupport-l1-1-0.dll
- RtlCaptureContext (Address: 0x1800682a0)
- RtlLookupFunctionEntry (Address: 0x180068298)
- RtlVirtualUnwind (Address: 0x1800682a8)
api-ms-win-core-shlwapi-legacy-l1-1-0.dll
- PathFileExistsW (Address: 0x1800682c0)
- PathFindFileNameW (Address: 0x1800682b8)
api-ms-win-core-shutdown-l1-1-1.dll
- InitiateShutdownW (Address: 0x1800682d0)
api-ms-win-core-string-l1-1-0.dll
- MultiByteToWideChar (Address: 0x1800682e8)
- WideCharToMultiByte (Address: 0x1800682e0)
api-ms-win-core-string-l2-1-0.dll
- CharNextW (Address: 0x1800682f8)
api-ms-win-core-string-obsolete-l1-1-0.dll
- lstrcmpiW (Address: 0x180068308)
api-ms-win-core-synch-l1-1-0.dll
- AcquireSRWLockExclusive (Address: 0x1800683d0)
- AcquireSRWLockShared (Address: 0x180068370)
- CreateEventExW (Address: 0x180068368)
- CreateEventW (Address: 0x180068340)
- CreateMutexExW (Address: 0x180068318)
- CreateMutexW (Address: 0x1800683b0)
- CreateSemaphoreExW (Address: 0x1800683b8)
- DeleteCriticalSection (Address: 0x1800683c0)
- EnterCriticalSection (Address: 0x180068360)
- InitializeCriticalSection (Address: 0x1800683a8)
- InitializeCriticalSectionAndSpinCount (Address: 0x180068330)
- InitializeCriticalSectionEx (Address: 0x180068338)
- LeaveCriticalSection (Address: 0x180068350)
- OpenEventW (Address: 0x180068328)
- OpenSemaphoreW (Address: 0x180068320)
- ReleaseMutex (Address: 0x180068378)
- ReleaseSemaphore (Address: 0x1800683a0)
- ReleaseSRWLockExclusive (Address: 0x1800683c8)
- ReleaseSRWLockShared (Address: 0x180068358)
- ResetEvent (Address: 0x180068398)
- SetEvent (Address: 0x180068390)
- WaitForMultipleObjectsEx (Address: 0x180068388)
- WaitForSingleObject (Address: 0x180068380)
- WaitForSingleObjectEx (Address: 0x180068348)
api-ms-win-core-synch-l1-2-0.dll
- InitOnceBeginInitialize (Address: 0x1800683f0)
- InitOnceComplete (Address: 0x1800683e0)
- Sleep (Address: 0x1800683e8)
api-ms-win-core-synch-l1-2-1.dll
- WaitForMultipleObjects (Address: 0x180068400)
api-ms-win-core-sysinfo-l1-1-0.dll
- GetLocalTime (Address: 0x180068418)
- GetSystemDirectoryW (Address: 0x180068428)
- GetSystemTime (Address: 0x180068410)
- GetSystemTimeAsFileTime (Address: 0x180068430)
- GetTickCount (Address: 0x180068420)
- GetTickCount64 (Address: 0x180068438)
api-ms-win-core-sysinfo-l1-2-0.dll
- VerSetConditionMask (Address: 0x180068448)
api-ms-win-core-threadpool-l1-2-0.dll
- CloseThreadpool (Address: 0x180068470)
- CloseThreadpoolTimer (Address: 0x180068458)
- CreateThreadpool (Address: 0x180068490)
- CreateThreadpoolTimer (Address: 0x180068460)
- DisassociateCurrentThreadFromCallback (Address: 0x180068468)
- SetThreadpoolThreadMaximum (Address: 0x180068488)
- SetThreadpoolThreadMinimum (Address: 0x180068498)
- SetThreadpoolTimer (Address: 0x180068478)
- WaitForThreadpoolTimerCallbacks (Address: 0x180068480)
api-ms-win-core-timezone-l1-1-0.dll
- FileTimeToSystemTime (Address: 0x1800684b8)
- SystemTimeToFileTime (Address: 0x1800684b0)
- TzSpecificLocalTimeToSystemTime (Address: 0x1800684a8)
api-ms-win-core-winrt-l1-1-0.dll
- RoActivateInstance (Address: 0x1800684d0)
- RoGetActivationFactory (Address: 0x1800684c8)
api-ms-win-core-winrt-string-l1-1-0.dll
- WindowsCreateString (Address: 0x1800684f0)
- WindowsCreateStringReference (Address: 0x1800684e8)
- WindowsDeleteString (Address: 0x1800684e0)
api-ms-win-crt-private-l1-1-0.dll
- __C_specific_handler (Address: 0x1800685d0)
- __CxxFrameHandler3 (Address: 0x1800685a8)
- __CxxFrameHandler4 (Address: 0x1800685e0)
- __std_terminate (Address: 0x1800685d8)
- _CxxThrowException (Address: 0x1800685b0)
- _o___std_exception_copy (Address: 0x180068628)
- _o___std_exception_destroy (Address: 0x180068620)
- _o___std_type_info_destroy_list (Address: 0x180068618)
- _o___stdio_common_vsnprintf_s (Address: 0x180068610)
- _o___stdio_common_vsprintf_s (Address: 0x180068608)
- _o___stdio_common_vswprintf (Address: 0x1800685f0)
- _o___stdio_common_vswscanf (Address: 0x1800685e8)
- _o__beginthreadex (Address: 0x1800685c8)
- _o__callnewh (Address: 0x1800685c0)
- _o__cexit (Address: 0x1800685b8)
- _o__configure_narrow_argv (Address: 0x180068638)
- _o__crt_atexit (Address: 0x180068630)
- _o__errno (Address: 0x180068600)
- _o__execute_onexit_table (Address: 0x1800685f8)
- _o__initialize_narrow_environment (Address: 0x180068500)
- _o__initialize_onexit_table (Address: 0x180068508)
- _o__invalid_parameter_noinfo (Address: 0x180068510)
- _o__invalid_parameter_noinfo_noreturn (Address: 0x180068518)
- _o__purecall (Address: 0x180068520)
- _o__recalloc (Address: 0x180068528)
- _o__register_onexit_function (Address: 0x180068530)
- _o__seh_filter_dll (Address: 0x180068538)
- _o__set_errno (Address: 0x180068540)
- _o__wcsicmp (Address: 0x180068548)
- _o__wcsnicmp (Address: 0x180068550)
- _o__wtoi (Address: 0x180068560)
- _o__wtol (Address: 0x180068568)
- _o_free (Address: 0x180068570)
- _o_malloc (Address: 0x180068578)
- _o_strncpy_s (Address: 0x180068580)
- _o_strtol (Address: 0x180068588)
- _o_terminate (Address: 0x180068590)
- _o_towlower (Address: 0x180068598)
- _o_wcsncpy_s (Address: 0x1800685a0)
- memcmp (Address: 0x180068558)
- memcpy (Address: 0x180068650)
- memmove (Address: 0x180068658)
- strchr (Address: 0x180068640)
- strrchr (Address: 0x180068648)
api-ms-win-crt-runtime-l1-1-0.dll
- _initterm (Address: 0x180068668)
- _initterm_e (Address: 0x180068670)
api-ms-win-crt-string-l1-1-0.dll
- memset (Address: 0x180068680)
- wcscmp (Address: 0x180068688)
api-ms-win-eventing-controller-l1-1-0.dll
- ControlTraceW (Address: 0x180068698)
- EnableTraceEx2 (Address: 0x1800686a0)
- StartTraceW (Address: 0x1800686a8)
api-ms-win-eventing-legacy-l1-1-0.dll
- QueryTraceW (Address: 0x1800686b8)
api-ms-win-eventing-provider-l1-1-0.dll
- EventActivityIdControl (Address: 0x1800686c8)
- EventRegister (Address: 0x1800686d0)
- EventSetInformation (Address: 0x1800686d8)
- EventUnregister (Address: 0x1800686e0)
- EventWriteTransfer (Address: 0x1800686e8)
api-ms-win-oobe-notification-l1-1-0.dll
- RegisterWaitUntilOOBECompleted (Address: 0x1800686f8)
- UnregisterWaitUntilOOBECompleted (Address: 0x180068700)
api-ms-win-power-base-l1-1-0.dll
- CallNtPowerInformation (Address: 0x180068720)
- PowerRegisterSuspendResumeNotification (Address: 0x180068710)
- PowerUnregisterSuspendResumeNotification (Address: 0x180068718)
api-ms-win-power-setting-l1-1-0.dll
- PowerSettingRegisterNotification (Address: 0x180068738)
- PowerSettingUnregisterNotification (Address: 0x180068730)
api-ms-win-security-base-l1-1-0.dll
- AdjustTokenPrivileges (Address: 0x180068748)
- AllocateAndInitializeSid (Address: 0x180068760)
- CheckTokenMembership (Address: 0x180068758)
- DuplicateTokenEx (Address: 0x180068750)
- FreeSid (Address: 0x180068778)
- GetTokenInformation (Address: 0x180068768)
- PrivilegeCheck (Address: 0x180068770)
api-ms-win-security-sddl-l1-1-0.dll
- ConvertStringSecurityDescriptorToSecurityDescriptorW (Address: 0x180068788)
api-ms-win-service-core-l1-1-0.dll
- RegisterServiceCtrlHandlerExW (Address: 0x1800687a0)
- SetServiceStatus (Address: 0x180068798)
api-ms-win-service-management-l1-1-0.dll
- CloseServiceHandle (Address: 0x1800687b8)
- OpenSCManagerW (Address: 0x1800687c0)
- OpenServiceW (Address: 0x1800687b0)
api-ms-win-service-private-l1-1-0.dll
- I_QueryTagInformation (Address: 0x1800687d0)
api-ms-win-stateseparation-helpers-l1-1-0.dll
- GetPersistedRegistryLocationW (Address: 0x1800687e0)
combase.dll
- (Address: 0x1800687f0)
- (Address: 0x1800687f8)
- (Address: 0x180068800)
- (Address: 0x180068808)
CRYPT32.dll
- CertVerifyCertificateChainPolicy (Address: 0x180067e00)
msvcp_win.dll
- _Cnd_broadcast (Address: 0x180068980)
- _Cnd_destroy_in_situ (Address: 0x180068990)
- _Cnd_do_broadcast_at_thread_exit (Address: 0x180068958)
- _Cnd_init_in_situ (Address: 0x180068968)
- _Cnd_wait (Address: 0x180068978)
- _Mtx_destroy_in_situ (Address: 0x180068830)
- _Mtx_init_in_situ (Address: 0x180068818)
- _Mtx_lock (Address: 0x180068840)
- _Mtx_unlock (Address: 0x180068868)
- _Thrd_detach (Address: 0x180068950)
- _Xtime_get_ticks (Address: 0x180068878)
- ?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ (Address: 0x180068908)
- ?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ (Address: 0x1800688f0)
- ?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ (Address: 0x1800688a8)
- ?_Throw_C_error@std@@YAXH@Z (Address: 0x180068838)
- ?_Throw_Cpp_error@std@@YAXH@Z (Address: 0x180068960)
- ?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ (Address: 0x180068910)
- ?_Xbad_alloc@std@@YAXXZ (Address: 0x180068988)
- ?_Xlength_error@std@@YAXPEBD@Z (Address: 0x180068848)
- ??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ (Address: 0x1800688d8)
- ??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z (Address: 0x1800688e0)
- ??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ (Address: 0x180068860)
- ??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ (Address: 0x1800688b0)
- ??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UEAA@XZ (Address: 0x1800688e8)
- ??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ (Address: 0x180068870)
- ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@H@Z (Address: 0x1800688f8)
- ?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGXZ (Address: 0x1800688d0)
- ?flags@ios_base@std@@QEBAHXZ (Address: 0x180068820)
- ?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ (Address: 0x180068900)
- ?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z (Address: 0x1800688a0)
- ?good@ios_base@std@@QEBA_NXZ (Address: 0x180068828)
- ?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ (Address: 0x180068890)
- ?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z (Address: 0x180068918)
- ?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ (Address: 0x180068898)
- ?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ (Address: 0x1800688c8)
- ?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z (Address: 0x180068920)
- ?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z (Address: 0x1800688b8)
- ?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ (Address: 0x180068928)
- ?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z (Address: 0x180068880)
- ?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z (Address: 0x180068888)
- ?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ (Address: 0x180068930)
- ?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ (Address: 0x1800688c0)
- ?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ (Address: 0x180068938)
- ?uncaught_exception@std@@YA_NXZ (Address: 0x180068970)
- ?width@ios_base@std@@QEAA_J_J@Z (Address: 0x180068858)
- ?width@ios_base@std@@QEBA_JXZ (Address: 0x180068850)
- ?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z (Address: 0x180068940)
- ?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z (Address: 0x180068948)
ntdll.dll
- DbgPrintEx (Address: 0x1800689a0)
- LdrAddRefDll (Address: 0x180068a08)
- LdrUnloadDll (Address: 0x180068a00)
- NtIsSystemResumeAutomatic (Address: 0x1800689f0)
- NtPowerInformation (Address: 0x1800689f8)
- NtQueryWnfStateData (Address: 0x1800689e0)
- RtlAllocateHeap (Address: 0x1800689c0)
- RtlFreeHeap (Address: 0x1800689b8)
- RtlNtStatusToDosError (Address: 0x180068a10)
- RtlPublishWnfStateData (Address: 0x1800689d0)
- RtlRaiseStatus (Address: 0x1800689a8)
- RtlRandomEx (Address: 0x1800689c8)
- RtlReAllocateHeap (Address: 0x1800689b0)
- RtlSubscribeWnfStateChangeNotification (Address: 0x1800689e8)
- RtlUnsubscribeWnfNotificationWaitForCompletion (Address: 0x1800689d8)
OLEAUT32.dll
- SysAllocString (Address: 0x180067e48)
- SysFreeString (Address: 0x180067e50)
- VarBstrCmp (Address: 0x180067e10)
- VariantChangeType (Address: 0x180067e20)
- VariantClear (Address: 0x180067e38)
- VariantCopy (Address: 0x180067e28)
- VariantInit (Address: 0x180067e40)
- VariantTimeToSystemTime (Address: 0x180067e18)
- VarUI4FromStr (Address: 0x180067e30)
profapi.dll
- (Address: 0x180068a20)
RPCRT4.dll
- I_RpcBindingInqLocalClientPID (Address: 0x180067e98)
- NdrClientCall3 (Address: 0x180067e78)
- RpcBindingFree (Address: 0x180067e70)
- RpcBindingFromStringBindingW (Address: 0x180067e90)
- RpcBindingSetAuthInfoExW (Address: 0x180067e68)
- RpcStringBindingComposeW (Address: 0x180067e88)
- RpcStringFreeW (Address: 0x180067e60)
- UuidCreate (Address: 0x180067e80)
UMPDC.dll
- PdcTaskClientRegister (Address: 0x180067eb8)
- PdcTaskClientRequest (Address: 0x180067eb0)
- PdcTaskClientUnregister (Address: 0x180067ea8)
UpdatePolicy.dll
- ReadPolicy (Address: 0x180067ed0)
- ReadPolicyWithFallback (Address: 0x180067ed8)
- ReleaseEnterprisePolicyValue (Address: 0x180067ee0)
- ReleaseUpdatePolicyValue (Address: 0x180067ec8)