MpClient.dll

Description: Client Interface

Version: 4.18.1909.6

Architecture: 64-bit

Operating System: Windows NT

SHA256: 64ec615c046a59c08f0ddf3fe9f93e0c

File Size: 920.4 KB

Uploaded At: Dec. 1, 2025, 8:30 a.m.

Views: 51

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

MpDbgAllocMemory (Ordinal: 1, Address: 0xe720)
MpGetEngineVersion (Ordinal: 2, Address: 0xcfc0)
MpTelemetryAddToAverageDWORD (Ordinal: 3, Address: 0x1c30)
MpTelemetryAddToStreamDWORD64 (Ordinal: 4, Address: 0x1c30)
MpTelemetryAddToStreamDWORD (Ordinal: 5, Address: 0x1c30)
MpTelemetryAddToStreamString (Ordinal: 6, Address: 0x1c30)
MpTelemetryIncrementDWORD (Ordinal: 7, Address: 0x1c30)
MpTelemetryInitialize (Ordinal: 8, Address: 0x24f30)
MpTelemetryIsOptIn (Ordinal: 9, Address: 0x2f260)
MpTelemetryLiteralAddToAverageDWORD (Ordinal: 10, Address: 0x1c30)
MpTelemetryLiteralAddToStreamDWORD64 (Ordinal: 11, Address: 0x1c30)
MpTelemetryLiteralAddToStreamDWORD (Ordinal: 12, Address: 0x1c30)
MpTelemetryLiteralAddToStreamString (Ordinal: 13, Address: 0x1c30)
MpTelemetryLiteralIncrementDWORD (Ordinal: 14, Address: 0x1c30)
MpTelemetryLiteralSetDWORD64 (Ordinal: 15, Address: 0x1c30)
MpTelemetryLiteralSetDWORD (Ordinal: 16, Address: 0x1c30)
MpTelemetryLiteralSetIfMaxDWORD (Ordinal: 17, Address: 0x1c30)
MpTelemetryLiteralSetIfMinDWORD (Ordinal: 18, Address: 0x1c30)
MpTelemetryLiteralSetString (Ordinal: 19, Address: 0x1c30)
MpTelemetrySetConsent (Ordinal: 20, Address: 0x4f10)
MpTelemetrySetDWORD64 (Ordinal: 21, Address: 0x1c30)
MpTelemetrySetDWORD (Ordinal: 22, Address: 0x1c30)
MpTelemetrySetIfMaxDWORD (Ordinal: 23, Address: 0x1c30)
MpTelemetrySetIfMinDWORD (Ordinal: 24, Address: 0x1c30)
MpTelemetrySetString (Ordinal: 25, Address: 0x1c30)
MpTelemetryUninitialize (Ordinal: 26, Address: 0x24f30)
MpTelemetryUpdateUserConsent (Ordinal: 27, Address: 0x24f30)
MpTelemetryUpload (Ordinal: 28, Address: 0x24f30)
MpUpdateEngine (Ordinal: 29, Address: 0xd140)
MputAddToAverageDWORD64Rpc (Ordinal: 30, Address: 0x4f10)
MputAddToAverageDWORDRpc (Ordinal: 31, Address: 0x4f10)
MputIncrementDWORD64Rpc (Ordinal: 32, Address: 0x4f10)
MputIncrementDWORDRpc (Ordinal: 33, Address: 0x4f10)
MputSetBoolRpc (Ordinal: 34, Address: 0x4f10)
MputSetDWORD64Rpc (Ordinal: 35, Address: 0x4f10)
MputSetDWORDRpc (Ordinal: 36, Address: 0x4f10)
MputSetIfMaxDWORD64Rpc (Ordinal: 37, Address: 0x4f10)
MputSetIfMaxDWORDRpc (Ordinal: 38, Address: 0x4f10)
MputSetIfMinDWORD64Rpc (Ordinal: 39, Address: 0x4f10)
MputSetIfMinDWORDRpc (Ordinal: 40, Address: 0x4f10)
MputSetStringRpc (Ordinal: 41, Address: 0x4f10)
MpAddDynamicSignatureFile (Ordinal: 42, Address: 0xd520)
MpAllocMemory (Ordinal: 43, Address: 0xe650)
MpAmsiCloseSession (Ordinal: 44, Address: 0x29060)
MpAmsiScan (Ordinal: 45, Address: 0x27ac0)
MpCleanControl (Ordinal: 46, Address: 0x9a50)
MpCleanOpen (Ordinal: 47, Address: 0x9410)
MpCleanPrecheckStart (Ordinal: 48, Address: 0x9810)
MpCleanStart (Ordinal: 49, Address: 0x9900)
MpClientUtilExportFunctions (Ordinal: 50, Address: 0xe730)
MpClose (Ordinal: 51, Address: 0x3160)
MpConfigClose (Ordinal: 52, Address: 0xe100)
MpConfigDelValue (Ordinal: 53, Address: 0xe240)
MpConfigGetValue (Ordinal: 54, Address: 0xe140)
MpConfigGetValueAlloc (Ordinal: 55, Address: 0xe1b0)
MpConfigInitialize (Ordinal: 56, Address: 0xe050)
MpConfigIteratorClose (Ordinal: 57, Address: 0xe100)
MpConfigIteratorEnum (Ordinal: 58, Address: 0xe290)
MpConfigIteratorOpen (Ordinal: 59, Address: 0xe260)
MpConfigOpen (Ordinal: 60, Address: 0xe0e0)
MpConfigRegisterForNotifications (Ordinal: 61, Address: 0xe2b0)
MpConfigSetValue (Ordinal: 62, Address: 0xe210)
MpConfigUninitialize (Ordinal: 63, Address: 0xe060)
MpConfigUnregisterNotifications (Ordinal: 64, Address: 0xe2e0)
MpConveyDlpBypass (Ordinal: 65, Address: 0x1a400)
MpConveySampleSubmissionResult (Ordinal: 66, Address: 0x31b90)
MpConveyUserChoiceForSampleList (Ordinal: 67, Address: 0x31dc0)
MpCreateComInstance (Ordinal: 68, Address: 0x221e0)
MpDebugExportFunctions (Ordinal: 69, Address: 0x1530)
MpDeleteAsrHistory (Ordinal: 70, Address: 0xbeb0)
MpDetectionEnumerate (Ordinal: 71, Address: 0x7790)
MpDetectionQuery (Ordinal: 72, Address: 0x7890)
MpDynamicSignatureEnumerate (Ordinal: 73, Address: 0xde50)
MpDynamicSignatureOpen (Ordinal: 74, Address: 0xdc80)
MpElevateCleanHandle (Ordinal: 75, Address: 0xacb0)
MpElevationHandleAcquire (Ordinal: 76, Address: 0x22210)
MpElevationHandleActivate (Ordinal: 77, Address: 0x1ea80)
MpElevationHandleAttach (Ordinal: 78, Address: 0x1e820)
MpElevationHandleOpen (Ordinal: 79, Address: 0x1e5c0)
MpErrorMessageFormat (Ordinal: 80, Address: 0x1aba0)
MpFastMemoryScan (Ordinal: 81, Address: 0x2a360)
MpFastMemoryScanOpen (Ordinal: 82, Address: 0x2a200)
MpFlushLowfiCache (Ordinal: 83, Address: 0x198a0)
MpForcedReboot (Ordinal: 84, Address: 0x226f0)
MpFreeMemory (Ordinal: 85, Address: 0xe6c0)
MpGenerateSignature (Ordinal: 86, Address: 0x1b890)
MpGenerateSignatureEx (Ordinal: 87, Address: 0x1b480)
MpGenerateThreatReport (Ordinal: 88, Address: 0x1c8c0)
MpGetAsrBlockedActionInfos (Ordinal: 89, Address: 0xbfb0)
MpGetAsrBlockedActions (Ordinal: 90, Address: 0xbd50)
MpGetAsrBlockedProcesses (Ordinal: 91, Address: 0xbbf0)
MpGetCallistoDetections (Ordinal: 92, Address: 0x30780)
MpGetDevMode (Ordinal: 93, Address: 0xc320)
MpGetHIPSRuleInfo (Ordinal: 94, Address: 0xb990)
MpGetMAPSConnectivityStatusInfo (Ordinal: 95, Address: 0x1ccc0)
MpGetRunningMode (Ordinal: 96, Address: 0x2fb00)
MpGetSampleChunk (Ordinal: 97, Address: 0x31a00)
MpGetSampleListRequiringConsent (Ordinal: 98, Address: 0x31ca0)
MpGetTPStateInfo (Ordinal: 99, Address: 0xc110)
MpGetTaskSchedulerStrings (Ordinal: 100, Address: 0x199f0)
MpHandleClose (Ordinal: 101, Address: 0x28e0)
MpIsGivenRunningModeSupported (Ordinal: 102, Address: 0x2fd60)
MpIsRtpAutoEnable (Ordinal: 103, Address: 0x22ca0)
MpManagerDisable (Ordinal: 104, Address: 0x5140)
MpManagerEnable (Ordinal: 105, Address: 0x4bb0)
MpManagerOpen (Ordinal: 106, Address: 0x23a0)
MpManagerStatusQuery (Ordinal: 107, Address: 0x26c0)
MpManagerStatusQueryEx (Ordinal: 108, Address: 0x26d0)
MpManagerVersionQuery (Ordinal: 109, Address: 0x24f0)
MpManagerXBGMDisable (Ordinal: 110, Address: 0x4f10)
MpManagerXBGMEnable (Ordinal: 111, Address: 0x4f10)
MpMemoryScanStart (Ordinal: 112, Address: 0x273e0)
MpNetworkCapture (Ordinal: 113, Address: 0x1a310)
MpNotificationRegister (Ordinal: 114, Address: 0x3a70)
MpOfflineScanInstall (Ordinal: 115, Address: 0x30290)
MpOfflineScanStatusQuery (Ordinal: 116, Address: 0x303d0)
MpOpen (Ordinal: 117, Address: 0x2d50)
MpProductGenuineCheck (Ordinal: 118, Address: 0x4f10)
MpQuarantineRequest (Ordinal: 119, Address: 0xc3e0)
MpQueryDefaultFolderGuardList (Ordinal: 120, Address: 0x1a0e0)
MpQueryEngineConfigDword (Ordinal: 121, Address: 0x19b20)
MpQueryFileTrustByHandle (Ordinal: 122, Address: 0x19db0)
MpRemapCallistoDetections (Ordinal: 123, Address: 0x30580)
MpRemoveDynamicSignatureFile (Ordinal: 124, Address: 0xd6d0)
MpRequestSnooze (Ordinal: 125, Address: 0x22a00)
MpSampleQuery (Ordinal: 126, Address: 0x127a0)
MpSampleSubmit (Ordinal: 127, Address: 0x12c30)
MpScanControl (Ordinal: 128, Address: 0x5d50)
MpScanResult (Ordinal: 129, Address: 0x5f50)
MpScanStart (Ordinal: 130, Address: 0x5d10)
MpScanStartEx (Ordinal: 131, Address: 0x5d40)
MpSetBreakTheGlassStatus (Ordinal: 132, Address: 0x1a240)
MpSetTPState (Ordinal: 133, Address: 0xc1c0)
MpSetUacElevationDefaultWindowHandle (Ordinal: 134, Address: 0x22310)
MpSmartLockerEnable (Ordinal: 135, Address: 0x19cb0)
MpThreatEnumerate (Ordinal: 136, Address: 0x7660)
MpThreatHistoryRequest (Ordinal: 137, Address: 0x8950)
MpThreatLocalizedInfoQuery (Ordinal: 138, Address: 0x7b40)
MpThreatOpen (Ordinal: 139, Address: 0x7170)
MpThreatQuery (Ordinal: 140, Address: 0x79f0)
MpThreatRollup (Ordinal: 141, Address: 0x6fe0)
MpTriggerErrorHeartbeatReport (Ordinal: 142, Address: 0x2f8b0)
MpTriggerHeartbeatOnUninstall (Ordinal: 143, Address: 0x2f610)
MpTriggerStatusRefreshNotification (Ordinal: 144, Address: 0x2fc60)
MpUpdateControl (Ordinal: 145, Address: 0x10670)
MpUpdateDevMode (Ordinal: 146, Address: 0xc270)
MpUpdatePlatform (Ordinal: 147, Address: 0xd1c0)
MpUpdateStart (Ordinal: 148, Address: 0xff20)
MpUpdateStartEx (Ordinal: 149, Address: 0xff40)
MpUtilsExportFunctions (Ordinal: 150, Address: 0x1540)
MpWDEnable (Ordinal: 151, Address: 0x184a0)
MpXBGMEnable (Ordinal: 152, Address: 0x4f10)
MpXBGMFreeEvent (Ordinal: 153, Address: 0x3500)
MpXBGMGetData (Ordinal: 154, Address: 0x4f10)
MpXBGMPutData (Ordinal: 155, Address: 0x4f10)
MpXBGMUpdateIV (Ordinal: 156, Address: 0x4f10)
WDEnable (Ordinal: 157, Address: 0x18470)
WDStatus (Ordinal: 158, Address: 0x17fc0)

Imported DLLs & Functions

ADVAPI32.dll

AllocateAndInitializeSid (Address: 0x75b89f818)
ChangeServiceConfigW (Address: 0x75b89f838)
CheckTokenMembership (Address: 0x75b89f7b8)
CloseServiceHandle (Address: 0x75b89f8e0)
ControlTraceW (Address: 0x75b89f8b0)
ConvertStringSidToSidW (Address: 0x75b89f870)
CopySid (Address: 0x75b89f888)
DeregisterEventSource (Address: 0x75b89f858)
DuplicateToken (Address: 0x75b89f7e8)
EnableTrace (Address: 0x75b89f8b8)
FreeSid (Address: 0x75b89f820)
GetLengthSid (Address: 0x75b89f890)
GetTokenInformation (Address: 0x75b89f840)
GetTraceEnableFlags (Address: 0x75b89f910)
GetTraceEnableLevel (Address: 0x75b89f918)
GetTraceLoggerHandle (Address: 0x75b89f920)
InitializeAcl (Address: 0x75b89f830)
LookupAccountSidW (Address: 0x75b89f8c0)
NotifyServiceStatusChangeW (Address: 0x75b89f8d8)
OpenProcessToken (Address: 0x75b89f860)
OpenSCManagerW (Address: 0x75b89f8d0)
OpenServiceW (Address: 0x75b89f8f0)
OpenThreadToken (Address: 0x75b89f848)
QueryServiceConfigW (Address: 0x75b89f8c8)
QueryServiceStatus (Address: 0x75b89f8e8)
QueryTraceW (Address: 0x75b89f8a0)
RegCloseKey (Address: 0x75b89f868)
RegCreateKeyExW (Address: 0x75b89f7d8)
RegDeleteKeyW (Address: 0x75b89f7d0)
RegDeleteValueW (Address: 0x75b89f800)
RegEnumKeyExW (Address: 0x75b89f7e0)
RegEnumValueW (Address: 0x75b89f7f8)
RegisterEventSourceW (Address: 0x75b89f878)
RegisterTraceGuidsW (Address: 0x75b89f908)
RegNotifyChangeKeyValue (Address: 0x75b89f7c0)
RegOpenKeyExW (Address: 0x75b89f808)
RegQueryInfoKeyW (Address: 0x75b89f7c8)
RegQueryValueExW (Address: 0x75b89f850)
RegSetValueExW (Address: 0x75b89f810)
ReportEventW (Address: 0x75b89f880)
SetEntriesInAclW (Address: 0x75b89f7f0)
StartServiceW (Address: 0x75b89f828)
StartTraceW (Address: 0x75b89f8a8)
TraceEvent (Address: 0x75b89f898)
TraceMessage (Address: 0x75b89f8f8)
UnregisterTraceGuids (Address: 0x75b89f900)

api-ms-win-crt-convert-l1-1-0.dll

wcstoul (Address: 0x75b89fe90)

api-ms-win-crt-heap-l1-1-0.dll

_callnewh (Address: 0x75b89fed0)
_calloc_base (Address: 0x75b89feb8)
_free_base (Address: 0x75b89fec8)
_malloc_base (Address: 0x75b89fec0)
free (Address: 0x75b89fea0)
malloc (Address: 0x75b89feb0)
realloc (Address: 0x75b89fea8)

api-ms-win-crt-locale-l1-1-0.dll

___lc_codepage_func (Address: 0x75b89ff00)
___lc_collate_cp_func (Address: 0x75b89fef0)
___lc_locale_name_func (Address: 0x75b89fef8)
___mb_cur_max_func (Address: 0x75b89ff18)
__pctype_func (Address: 0x75b89ff08)
_lock_locales (Address: 0x75b89ff10)
_unlock_locales (Address: 0x75b89fee0)
setlocale (Address: 0x75b89fee8)

api-ms-win-crt-multibyte-l1-1-0.dll

_ismbblead (Address: 0x75b89ff28)

api-ms-win-crt-runtime-l1-1-0.dll

_beginthreadex (Address: 0x75b89ff80)
_cexit (Address: 0x75b89ff68)
_configure_narrow_argv (Address: 0x75b89ff60)
_crt_atexit (Address: 0x75b89ff58)
_errno (Address: 0x75b89ff88)
_execute_onexit_table (Address: 0x75b89ff50)
_initialize_narrow_environment (Address: 0x75b89ff38)
_initialize_onexit_table (Address: 0x75b89ff40)
_initterm (Address: 0x75b89ffa0)
_initterm_e (Address: 0x75b89ff98)
_invalid_parameter_noinfo_noreturn (Address: 0x75b89ffa8)
_register_onexit_function (Address: 0x75b89ff48)
_seh_filter_dll (Address: 0x75b89ff90)
abort (Address: 0x75b89ff78)
terminate (Address: 0x75b89ff70)

api-ms-win-crt-stdio-l1-1-0.dll

__stdio_common_vsprintf (Address: 0x75b89ffb8)
__stdio_common_vswprintf (Address: 0x75b89ffc8)
__stdio_common_vswscanf (Address: 0x75b89ffc0)

api-ms-win-crt-string-l1-1-0.dll

_wcsdup (Address: 0x75b89fff8)
_wcsicmp (Address: 0x75b8a0000)
_wcsnicmp (Address: 0x75b8a0040)
_wcsupr (Address: 0x75b8a0048)
iswalpha (Address: 0x75b89fff0)
iswdigit (Address: 0x75b89ffe0)
iswspace (Address: 0x75b8a0030)
memset (Address: 0x75b89ffd8)
strcpy_s (Address: 0x75b89ffe8)
toupper (Address: 0x75b8a0018)
towlower (Address: 0x75b8a0010)
wcscmp (Address: 0x75b8a0028)
wcsncmp (Address: 0x75b8a0038)
wcsnlen (Address: 0x75b8a0008)
wcstok_s (Address: 0x75b8a0020)

api-ms-win-crt-utility-l1-1-0.dll

qsort (Address: 0x75b8a0060)
rand (Address: 0x75b8a0058)

CRYPT32.dll

CertVerifyCertificateChainPolicy (Address: 0x75b89f930)

KERNEL32.dll

AcquireSRWLockExclusive (Address: 0x75b89fd78)
CancelSynchronousIo (Address: 0x75b89fbe0)
CancelThreadpoolIo (Address: 0x75b89fc90)
CloseHandle (Address: 0x75b89fba0)
CloseThreadpool (Address: 0x75b89f9e8)
CloseThreadpoolIo (Address: 0x75b89fd68)
CloseThreadpoolTimer (Address: 0x75b89fcc0)
CloseThreadpoolWait (Address: 0x75b89fca8)
CloseThreadpoolWork (Address: 0x75b89fbb0)
CompareFileTime (Address: 0x75b89fa00)
CompareStringEx (Address: 0x75b89fcf8)
CopyFileW (Address: 0x75b89f998)
CreateDirectoryW (Address: 0x75b89f990)
CreateEventW (Address: 0x75b89fb48)
CreateFileMappingW (Address: 0x75b89fc50)
CreateFileW (Address: 0x75b89f948)
CreateIoCompletionPort (Address: 0x75b89fbc8)
CreateMutexW (Address: 0x75b89fba8)
CreateProcessW (Address: 0x75b89fc60)
CreateSemaphoreW (Address: 0x75b89fc58)
CreateThread (Address: 0x75b89fb40)
CreateThreadpool (Address: 0x75b89fc70)
CreateThreadpoolIo (Address: 0x75b89fc78)
CreateThreadpoolTimer (Address: 0x75b89fd60)
CreateThreadpoolWait (Address: 0x75b89fcc8)
CreateThreadpoolWork (Address: 0x75b89fd88)
CreateTimerQueueTimer (Address: 0x75b89fd40)
DebugBreak (Address: 0x75b89fc48)
DecodePointer (Address: 0x75b89fbc0)
DeleteCriticalSection (Address: 0x75b89fa48)
DeleteFileW (Address: 0x75b89fac0)
DeleteTimerQueueTimer (Address: 0x75b89fb88)
DuplicateHandle (Address: 0x75b89fd00)
EncodePointer (Address: 0x75b89fa50)
EnterCriticalSection (Address: 0x75b89fd50)
ExpandEnvironmentStringsW (Address: 0x75b89f988)
FileTimeToSystemTime (Address: 0x75b89fc18)
FindClose (Address: 0x75b89f970)
FindFirstFileW (Address: 0x75b89f960)
FindNextFileW (Address: 0x75b89f968)
FindResourceW (Address: 0x75b89f9b0)
FlushFileBuffers (Address: 0x75b89fab0)
FlushViewOfFile (Address: 0x75b89fab8)
FormatMessageW (Address: 0x75b89faf8)
FreeLibrary (Address: 0x75b89fae8)
GetCurrentProcess (Address: 0x75b89faa8)
GetCurrentProcessId (Address: 0x75b89fb58)
GetCurrentThread (Address: 0x75b89f940)
GetCurrentThreadId (Address: 0x75b89fb60)
GetEnvironmentVariableW (Address: 0x75b89f9f8)
GetFileAttributesExW (Address: 0x75b89fb70)
GetFileAttributesW (Address: 0x75b89f978)
GetFileSizeEx (Address: 0x75b89fc28)
GetLastError (Address: 0x75b89fa88)
GetLocalTime (Address: 0x75b89f9f0)
GetModuleFileNameW (Address: 0x75b89f9a8)
GetModuleHandleExW (Address: 0x75b89fb80)
GetModuleHandleW (Address: 0x75b89fa98)
GetProcAddress (Address: 0x75b89fa90)
GetProcessHeap (Address: 0x75b89fbb8)
GetProcessTimes (Address: 0x75b89f980)
GetQueuedCompletionStatus (Address: 0x75b89fbd8)
GetStringTypeW (Address: 0x75b89fd30)
GetSystemDirectoryW (Address: 0x75b89fd08)
GetSystemInfo (Address: 0x75b89fd58)
GetSystemTimeAsFileTime (Address: 0x75b89fb68)
GetTickCount (Address: 0x75b89fae0)
GetTickCount64 (Address: 0x75b89f9e0)
GetVersionExW (Address: 0x75b89faa0)
HeapAlloc (Address: 0x75b89fb30)
HeapCreate (Address: 0x75b89fdc0)
HeapDestroy (Address: 0x75b89fda0)
HeapFree (Address: 0x75b89fb28)
HeapReAlloc (Address: 0x75b89fda8)
HeapSize (Address: 0x75b89fdb0)
HeapValidate (Address: 0x75b89fdb8)
InitializeConditionVariable (Address: 0x75b89fce8)
InitializeCriticalSection (Address: 0x75b89f9d0)
InitializeCriticalSectionAndSpinCount (Address: 0x75b89fa40)
InitializeCriticalSectionEx (Address: 0x75b89fd20)
InitializeSListHead (Address: 0x75b89fa80)
InterlockedFlushSList (Address: 0x75b89fa68)
LCMapStringEx (Address: 0x75b89fcf0)
LeaveCriticalSection (Address: 0x75b89fb38)
LoadLibraryExA (Address: 0x75b89fd90)
LoadLibraryExW (Address: 0x75b89fa18)
LoadLibraryW (Address: 0x75b89f9a0)
LoadResource (Address: 0x75b89f9c0)
LocalFileTimeToFileTime (Address: 0x75b89fa08)
LocalFree (Address: 0x75b89faf0)
LockResource (Address: 0x75b89f9c8)
MapViewOfFile (Address: 0x75b89fc40)
MultiByteToWideChar (Address: 0x75b89fc08)
OpenEventW (Address: 0x75b89fd18)
OpenFileMappingW (Address: 0x75b89fd10)
OpenProcess (Address: 0x75b89fb10)
PostQueuedCompletionStatus (Address: 0x75b89fbd0)
QueryPerformanceCounter (Address: 0x75b89fad8)
QueryPerformanceFrequency (Address: 0x75b89fc10)
RaiseException (Address: 0x75b89fa58)
ReadFile (Address: 0x75b89fc30)
RegisterWaitForSingleObject (Address: 0x75b89fb18)
ReleaseMutex (Address: 0x75b89fb90)
ReleaseSemaphore (Address: 0x75b89fd38)
ReleaseSRWLockExclusive (Address: 0x75b89fd80)
RemoveDirectoryW (Address: 0x75b89f958)
ResetEvent (Address: 0x75b89fac8)
RtlLookupFunctionEntry (Address: 0x75b89fa78)
RtlPcToFileHeader (Address: 0x75b89fa60)
RtlUnwindEx (Address: 0x75b89fa70)
SetEnvironmentVariableW (Address: 0x75b89fd28)
SetEvent (Address: 0x75b89fb50)
SetFileAttributesW (Address: 0x75b89f950)
SetLastError (Address: 0x75b89fb08)
SetThreadpoolThreadMaximum (Address: 0x75b89fcb8)
SetThreadpoolThreadMinimum (Address: 0x75b89fca0)
SetThreadpoolTimer (Address: 0x75b89fcd0)
SetThreadpoolWait (Address: 0x75b89fb78)
SizeofResource (Address: 0x75b89f9b8)
Sleep (Address: 0x75b89fbe8)
SleepConditionVariableCS (Address: 0x75b89fcd8)
StartThreadpoolIo (Address: 0x75b89fc68)
SubmitThreadpoolWork (Address: 0x75b89fd70)
SwitchToThread (Address: 0x75b89fad0)
SystemTimeToFileTime (Address: 0x75b89fa10)
TlsAlloc (Address: 0x75b89fa38)
TlsFree (Address: 0x75b89fa20)
TlsGetValue (Address: 0x75b89fa30)
TlsSetValue (Address: 0x75b89fa28)
TryEnterCriticalSection (Address: 0x75b89f9d8)
UnmapViewOfFile (Address: 0x75b89fb00)
UnregisterWaitEx (Address: 0x75b89fb20)
VirtualLock (Address: 0x75b89fd48)
VirtualProtect (Address: 0x75b89fd98)
VirtualQuery (Address: 0x75b89fc38)
WaitForMultipleObjects (Address: 0x75b89fb98)
WaitForSingleObject (Address: 0x75b89fbf0)
WaitForSingleObjectEx (Address: 0x75b89fbf8)
WaitForThreadpoolIoCallbacks (Address: 0x75b89fc80)
WaitForThreadpoolTimerCallbacks (Address: 0x75b89fc88)
WaitForThreadpoolWaitCallbacks (Address: 0x75b89fcb0)
WaitForThreadpoolWorkCallbacks (Address: 0x75b89fc98)
WakeAllConditionVariable (Address: 0x75b89fce0)
WideCharToMultiByte (Address: 0x75b89fc00)
WriteFile (Address: 0x75b89fc20)

ntdll.dll

RtlGetVersion (Address: 0x75b8a0070)
RtlNtStatusToDosError (Address: 0x75b8a0078)

ole32.dll

CoCreateInstance (Address: 0x75b8a0090)
CoGetObject (Address: 0x75b8a00a0)
CoInitializeEx (Address: 0x75b8a0098)
CoUninitialize (Address: 0x75b8a00a8)
IIDFromString (Address: 0x75b8a0088)

OLEAUT32.dll

SafeArrayCreate (Address: 0x75b89fde0)
SafeArrayGetDim (Address: 0x75b89fdf8)
SysAllocString (Address: 0x75b89fdd0)
SysAllocStringLen (Address: 0x75b89fde8)
SysFreeString (Address: 0x75b89fe00)
VariantClear (Address: 0x75b89fdd8)
VariantInit (Address: 0x75b89fdf0)

RPCRT4.dll

NdrClientCall3 (Address: 0x75b89fe38)
RpcBindingFree (Address: 0x75b89fe10)
RpcBindingFromStringBindingW (Address: 0x75b89fe30)
RpcBindingSetAuthInfoExW (Address: 0x75b89fe20)
RpcBindingSetOption (Address: 0x75b89fe28)
RpcSmDestroyClientContext (Address: 0x75b89fe58)
RpcStringBindingComposeW (Address: 0x75b89fe18)
RpcStringFreeW (Address: 0x75b89fe60)
UuidCreate (Address: 0x75b89fe40)
UuidFromStringW (Address: 0x75b89fe50)
UuidToStringW (Address: 0x75b89fe48)

USER32.dll

GetLastActivePopup (Address: 0x75b89fe70)
IsWindow (Address: 0x75b89fe78)
LoadStringW (Address: 0x75b89fe80)