MpClient.dll

Description: Client Interface

Version: 4.18.1909.6

Architecture: 32-bit

Operating System: Windows NT

SHA256: ac1a2fc2506f04f4d67a55adf6bd9b41

File Size: 677.7 KB

Uploaded At: Dec. 1, 2025, 8:33 a.m.

Views: 41

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

MpDbgAllocMemory (Ordinal: 1, Address: 0x25820)
MpGetEngineVersion (Ordinal: 2, Address: 0x24460)
MpTelemetryAddToAverageDWORD (Ordinal: 3, Address: 0x3eb50)
MpTelemetryAddToStreamDWORD64 (Ordinal: 4, Address: 0x3eb70)
MpTelemetryAddToStreamDWORD (Ordinal: 5, Address: 0x3eb60)
MpTelemetryAddToStreamString (Ordinal: 6, Address: 0x3eb60)
MpTelemetryIncrementDWORD (Ordinal: 7, Address: 0x3eb50)
MpTelemetryInitialize (Ordinal: 8, Address: 0x3eb40)
MpTelemetryIsOptIn (Ordinal: 9, Address: 0x3eb80)
MpTelemetryLiteralAddToAverageDWORD (Ordinal: 10, Address: 0x3eb50)
MpTelemetryLiteralAddToStreamDWORD64 (Ordinal: 11, Address: 0x3eb70)
MpTelemetryLiteralAddToStreamDWORD (Ordinal: 12, Address: 0x3eb60)
MpTelemetryLiteralAddToStreamString (Ordinal: 13, Address: 0x3eb60)
MpTelemetryLiteralIncrementDWORD (Ordinal: 14, Address: 0x3eb50)
MpTelemetryLiteralSetDWORD64 (Ordinal: 15, Address: 0x3eb60)
MpTelemetryLiteralSetDWORD (Ordinal: 16, Address: 0x3eb50)
MpTelemetryLiteralSetIfMaxDWORD (Ordinal: 17, Address: 0x3eb50)
MpTelemetryLiteralSetIfMinDWORD (Ordinal: 18, Address: 0x3eb50)
MpTelemetryLiteralSetString (Ordinal: 19, Address: 0x3eb50)
MpTelemetrySetConsent (Ordinal: 20, Address: 0x1da50)
MpTelemetrySetDWORD64 (Ordinal: 21, Address: 0x3eb60)
MpTelemetrySetDWORD (Ordinal: 22, Address: 0x3eb50)
MpTelemetrySetIfMaxDWORD (Ordinal: 23, Address: 0x3eb50)
MpTelemetrySetIfMinDWORD (Ordinal: 24, Address: 0x3eb50)
MpTelemetrySetString (Ordinal: 25, Address: 0x3eb50)
MpTelemetryUninitialize (Ordinal: 26, Address: 0x37570)
MpTelemetryUpdateUserConsent (Ordinal: 27, Address: 0x37570)
MpTelemetryUpload (Ordinal: 28, Address: 0x37570)
MpUpdateEngine (Ordinal: 29, Address: 0x245d0)
MputAddToAverageDWORD64Rpc (Ordinal: 30, Address: 0x2dc80)
MputAddToAverageDWORDRpc (Ordinal: 31, Address: 0x3fe70)
MputIncrementDWORD64Rpc (Ordinal: 32, Address: 0x2dc80)
MputIncrementDWORDRpc (Ordinal: 33, Address: 0x3fe70)
MputSetBoolRpc (Ordinal: 34, Address: 0x3fe70)
MputSetDWORD64Rpc (Ordinal: 35, Address: 0x2dc80)
MputSetDWORDRpc (Ordinal: 36, Address: 0x3fe70)
MputSetIfMaxDWORD64Rpc (Ordinal: 37, Address: 0x2dc80)
MputSetIfMaxDWORDRpc (Ordinal: 38, Address: 0x3fe70)
MputSetIfMinDWORD64Rpc (Ordinal: 39, Address: 0x2dc80)
MputSetIfMinDWORDRpc (Ordinal: 40, Address: 0x3fe70)
MputSetStringRpc (Ordinal: 41, Address: 0x3fe70)
MpAddDynamicSignatureFile (Ordinal: 42, Address: 0x24920)
MpAllocMemory (Ordinal: 43, Address: 0x25780)
MpAmsiCloseSession (Ordinal: 44, Address: 0x3a750)
MpAmsiScan (Ordinal: 45, Address: 0x39380)
MpCleanControl (Ordinal: 46, Address: 0x21910)
MpCleanOpen (Ordinal: 47, Address: 0x213d0)
MpCleanPrecheckStart (Ordinal: 48, Address: 0x21750)
MpCleanStart (Ordinal: 49, Address: 0x21810)
MpClientUtilExportFunctions (Ordinal: 50, Address: 0x25830)
MpClose (Ordinal: 51, Address: 0x1c150)
MpConfigClose (Ordinal: 52, Address: 0x25300)
MpConfigDelValue (Ordinal: 53, Address: 0x25420)
MpConfigGetValue (Ordinal: 54, Address: 0x25320)
MpConfigGetValueAlloc (Ordinal: 55, Address: 0x25380)
MpConfigInitialize (Ordinal: 56, Address: 0x25270)
MpConfigIteratorClose (Ordinal: 57, Address: 0x25300)
MpConfigIteratorEnum (Ordinal: 58, Address: 0x25490)
MpConfigIteratorOpen (Ordinal: 59, Address: 0x25450)
MpConfigOpen (Ordinal: 60, Address: 0x252d0)
MpConfigRegisterForNotifications (Ordinal: 61, Address: 0x254d0)
MpConfigSetValue (Ordinal: 62, Address: 0x253e0)
MpConfigUninitialize (Ordinal: 63, Address: 0x25280)
MpConfigUnregisterNotifications (Ordinal: 64, Address: 0x25510)
MpConveyDlpBypass (Ordinal: 65, Address: 0x2e6b0)
MpConveySampleSubmissionResult (Ordinal: 66, Address: 0x40d10)
MpConveyUserChoiceForSampleList (Ordinal: 67, Address: 0x40ee0)
MpCreateComInstance (Ordinal: 68, Address: 0x34a30)
MpDebugExportFunctions (Ordinal: 69, Address: 0x1abf0)
MpDeleteAsrHistory (Ordinal: 70, Address: 0x236b0)
MpDetectionEnumerate (Ordinal: 71, Address: 0x1fd00)
MpDetectionQuery (Ordinal: 72, Address: 0x1fdd0)
MpDynamicSignatureEnumerate (Ordinal: 73, Address: 0x250e0)
MpDynamicSignatureOpen (Ordinal: 74, Address: 0x24f60)
MpElevateCleanHandle (Ordinal: 75, Address: 0x227f0)
MpElevationHandleAcquire (Ordinal: 76, Address: 0x34a80)
MpElevationHandleActivate (Ordinal: 77, Address: 0x32010)
MpElevationHandleAttach (Ordinal: 78, Address: 0x31de0)
MpElevationHandleOpen (Ordinal: 79, Address: 0x31bb0)
MpErrorMessageFormat (Ordinal: 80, Address: 0x2ec50)
MpFastMemoryScan (Ordinal: 81, Address: 0x3b9c0)
MpFastMemoryScanOpen (Ordinal: 82, Address: 0x3b8b0)
MpFlushLowfiCache (Ordinal: 83, Address: 0x2dc90)
MpForcedReboot (Ordinal: 84, Address: 0x34e20)
MpFreeMemory (Ordinal: 85, Address: 0x257d0)
MpGenerateSignature (Ordinal: 86, Address: 0x2f8c0)
MpGenerateSignatureEx (Ordinal: 87, Address: 0x2f4f0)
MpGenerateThreatReport (Ordinal: 88, Address: 0x304e0)
MpGetAsrBlockedActionInfos (Ordinal: 89, Address: 0x23790)
MpGetAsrBlockedActions (Ordinal: 90, Address: 0x235b0)
MpGetAsrBlockedProcesses (Ordinal: 91, Address: 0x234b0)
MpGetCallistoDetections (Ordinal: 92, Address: 0x3fd40)
MpGetDevMode (Ordinal: 93, Address: 0x23a40)
MpGetHIPSRuleInfo (Ordinal: 94, Address: 0x232b0)
MpGetMAPSConnectivityStatusInfo (Ordinal: 95, Address: 0x30860)
MpGetRunningMode (Ordinal: 96, Address: 0x3f2c0)
MpGetSampleChunk (Ordinal: 97, Address: 0x40be0)
MpGetSampleListRequiringConsent (Ordinal: 98, Address: 0x40df0)
MpGetTPStateInfo (Ordinal: 99, Address: 0x23890)
MpGetTaskSchedulerStrings (Ordinal: 100, Address: 0x2ddb0)
MpHandleClose (Ordinal: 101, Address: 0x1bca0)
MpIsGivenRunningModeSupported (Ordinal: 102, Address: 0x3f4d0)
MpIsRtpAutoEnable (Ordinal: 103, Address: 0x352e0)
MpManagerDisable (Ordinal: 104, Address: 0x1dc00)
MpManagerEnable (Ordinal: 105, Address: 0x1d770)
MpManagerOpen (Ordinal: 106, Address: 0x1b820)
MpManagerStatusQuery (Ordinal: 107, Address: 0x1bab0)
MpManagerStatusQueryEx (Ordinal: 108, Address: 0x1bad0)
MpManagerVersionQuery (Ordinal: 109, Address: 0x1b920)
MpManagerXBGMDisable (Ordinal: 110, Address: 0x1da50)
MpManagerXBGMEnable (Ordinal: 111, Address: 0x1da50)
MpMemoryScanStart (Ordinal: 112, Address: 0x38dc0)
MpNetworkCapture (Ordinal: 113, Address: 0x2e5e0)
MpNotificationRegister (Ordinal: 114, Address: 0x1c970)
MpOfflineScanInstall (Ordinal: 115, Address: 0x3f910)
MpOfflineScanStatusQuery (Ordinal: 116, Address: 0x3fa30)
MpOpen (Ordinal: 117, Address: 0x1be50)
MpProductGenuineCheck (Ordinal: 118, Address: 0x1da50)
MpQuarantineRequest (Ordinal: 119, Address: 0x23ad0)
MpQueryDefaultFolderGuardList (Ordinal: 120, Address: 0x2e420)
MpQueryEngineConfigDword (Ordinal: 121, Address: 0x2deb0)
MpQueryFileTrustByHandle (Ordinal: 122, Address: 0x2e0e0)
MpRemapCallistoDetections (Ordinal: 123, Address: 0x3fb90)
MpRemoveDynamicSignatureFile (Ordinal: 124, Address: 0x24a70)
MpRequestSnooze (Ordinal: 125, Address: 0x350b0)
MpSampleQuery (Ordinal: 126, Address: 0x288b0)
MpSampleSubmit (Ordinal: 127, Address: 0x28cb0)
MpScanControl (Ordinal: 128, Address: 0x1e5f0)
MpScanResult (Ordinal: 129, Address: 0x1e7b0)
MpScanStart (Ordinal: 130, Address: 0x1e5a0)
MpScanStartEx (Ordinal: 131, Address: 0x1e5c0)
MpSetBreakTheGlassStatus (Ordinal: 132, Address: 0x2e550)
MpSetTPState (Ordinal: 133, Address: 0x23920)
MpSetUacElevationDefaultWindowHandle (Ordinal: 134, Address: 0x34b50)
MpSmartLockerEnable (Ordinal: 135, Address: 0x2dff0)
MpThreatEnumerate (Ordinal: 136, Address: 0x1fc00)
MpThreatHistoryRequest (Ordinal: 137, Address: 0x20ad0)
MpThreatLocalizedInfoQuery (Ordinal: 138, Address: 0x20010)
MpThreatOpen (Ordinal: 139, Address: 0x1f6e0)
MpThreatQuery (Ordinal: 140, Address: 0x1fef0)
MpThreatRollup (Ordinal: 141, Address: 0x1f5a0)
MpTriggerErrorHeartbeatReport (Ordinal: 142, Address: 0x3f0e0)
MpTriggerHeartbeatOnUninstall (Ordinal: 143, Address: 0x3ee90)
MpTriggerStatusRefreshNotification (Ordinal: 144, Address: 0x3f3f0)
MpUpdateControl (Ordinal: 145, Address: 0x26fb0)
MpUpdateDevMode (Ordinal: 146, Address: 0x239b0)
MpUpdatePlatform (Ordinal: 147, Address: 0x24650)
MpUpdateStart (Ordinal: 148, Address: 0x26a30)
MpUpdateStartEx (Ordinal: 149, Address: 0x26a50)
MpUtilsExportFunctions (Ordinal: 150, Address: 0x1ac00)
MpWDEnable (Ordinal: 151, Address: 0x2cb40)
MpXBGMEnable (Ordinal: 152, Address: 0x1da50)
MpXBGMFreeEvent (Ordinal: 153, Address: 0x1c420)
MpXBGMGetData (Ordinal: 154, Address: 0x1da50)
MpXBGMPutData (Ordinal: 155, Address: 0x1da50)
MpXBGMUpdateIV (Ordinal: 156, Address: 0x2dc80)
WDEnable (Ordinal: 157, Address: 0x2cb20)
WDStatus (Ordinal: 158, Address: 0x2c720)

Imported DLLs & Functions

ADVAPI32.dll

AllocateAndInitializeSid (Address: 0x5b89d030)
ChangeServiceConfigW (Address: 0x5b89d040)
CheckTokenMembership (Address: 0x5b89d000)
CloseServiceHandle (Address: 0x5b89d094)
ControlTraceW (Address: 0x5b89d07c)
ConvertStringSidToSidW (Address: 0x5b89d05c)
CopySid (Address: 0x5b89d068)
DeregisterEventSource (Address: 0x5b89d050)
DuplicateToken (Address: 0x5b89d01c)
EnableTrace (Address: 0x5b89d080)
FreeSid (Address: 0x5b89d034)
GetLengthSid (Address: 0x5b89d06c)
GetTokenInformation (Address: 0x5b89d044)
GetTraceEnableFlags (Address: 0x5b89d0ac)
GetTraceEnableLevel (Address: 0x5b89d0b0)
GetTraceLoggerHandle (Address: 0x5b89d0b4)
InitializeAcl (Address: 0x5b89d03c)
LookupAccountSidW (Address: 0x5b89d084)
NotifyServiceStatusChangeW (Address: 0x5b89d090)
OpenProcessToken (Address: 0x5b89d054)
OpenSCManagerW (Address: 0x5b89d08c)
OpenServiceW (Address: 0x5b89d09c)
OpenThreadToken (Address: 0x5b89d048)
QueryServiceConfigW (Address: 0x5b89d088)
QueryServiceStatus (Address: 0x5b89d098)
QueryTraceW (Address: 0x5b89d074)
RegCloseKey (Address: 0x5b89d058)
RegCreateKeyExW (Address: 0x5b89d010)
RegDeleteKeyW (Address: 0x5b89d00c)
RegDeleteValueW (Address: 0x5b89d028)
RegEnumKeyExW (Address: 0x5b89d014)
RegEnumValueW (Address: 0x5b89d024)
RegisterEventSourceW (Address: 0x5b89d060)
RegisterTraceGuidsW (Address: 0x5b89d0a8)
RegNotifyChangeKeyValue (Address: 0x5b89d004)
RegOpenKeyExW (Address: 0x5b89d02c)
RegQueryInfoKeyW (Address: 0x5b89d008)
RegQueryValueExW (Address: 0x5b89d04c)
RegSetValueExW (Address: 0x5b89d018)
ReportEventW (Address: 0x5b89d064)
SetEntriesInAclW (Address: 0x5b89d020)
StartServiceW (Address: 0x5b89d038)
StartTraceW (Address: 0x5b89d078)
TraceEvent (Address: 0x5b89d070)
TraceMessage (Address: 0x5b89d0a0)
UnregisterTraceGuids (Address: 0x5b89d0a4)

api-ms-win-crt-convert-l1-1-0.dll

wcstoul (Address: 0x5b89d368)

api-ms-win-crt-heap-l1-1-0.dll

_callnewh (Address: 0x5b89d378)
_calloc_base (Address: 0x5b89d374)
_free_base (Address: 0x5b89d380)
_malloc_base (Address: 0x5b89d37c)
free (Address: 0x5b89d388)
malloc (Address: 0x5b89d384)
realloc (Address: 0x5b89d370)

api-ms-win-crt-locale-l1-1-0.dll

___lc_codepage_func (Address: 0x5b89d3a4)
___lc_collate_cp_func (Address: 0x5b89d398)
___lc_locale_name_func (Address: 0x5b89d3a8)
___mb_cur_max_func (Address: 0x5b89d39c)
__pctype_func (Address: 0x5b89d3a0)
_lock_locales (Address: 0x5b89d390)
_unlock_locales (Address: 0x5b89d3ac)
setlocale (Address: 0x5b89d394)

api-ms-win-crt-multibyte-l1-1-0.dll

_ismbblead (Address: 0x5b89d3b4)

api-ms-win-crt-runtime-l1-1-0.dll

_beginthreadex (Address: 0x5b89d3c4)
_cexit (Address: 0x5b89d3f0)
_configure_narrow_argv (Address: 0x5b89d3d0)
_crt_atexit (Address: 0x5b89d3ec)
_errno (Address: 0x5b89d3e4)
_execute_onexit_table (Address: 0x5b89d3e8)
_initialize_narrow_environment (Address: 0x5b89d3d4)
_initialize_onexit_table (Address: 0x5b89d3d8)
_initterm (Address: 0x5b89d3bc)
_initterm_e (Address: 0x5b89d3c0)
_invalid_parameter_noinfo_noreturn (Address: 0x5b89d3f4)
_register_onexit_function (Address: 0x5b89d3e0)
_seh_filter_dll (Address: 0x5b89d3cc)
abort (Address: 0x5b89d3dc)
terminate (Address: 0x5b89d3c8)

api-ms-win-crt-stdio-l1-1-0.dll

__stdio_common_vsprintf (Address: 0x5b89d3fc)
__stdio_common_vswprintf (Address: 0x5b89d404)
__stdio_common_vswscanf (Address: 0x5b89d400)

api-ms-win-crt-string-l1-1-0.dll

_wcsdup (Address: 0x5b89d418)
_wcsicmp (Address: 0x5b89d41c)
_wcsnicmp (Address: 0x5b89d440)
_wcsupr (Address: 0x5b89d43c)
iswalpha (Address: 0x5b89d414)
iswdigit (Address: 0x5b89d40c)
iswspace (Address: 0x5b89d438)
memset (Address: 0x5b89d434)
strcpy_s (Address: 0x5b89d410)
toupper (Address: 0x5b89d428)
towlower (Address: 0x5b89d424)
wcsncmp (Address: 0x5b89d430)
wcsnlen (Address: 0x5b89d420)
wcstok_s (Address: 0x5b89d42c)

api-ms-win-crt-utility-l1-1-0.dll

qsort (Address: 0x5b89d448)
rand (Address: 0x5b89d44c)

CRYPT32.dll

CertVerifyCertificateChainPolicy (Address: 0x5b89d0bc)

KERNEL32.dll

AcquireSRWLockExclusive (Address: 0x5b89d2cc)
CancelSynchronousIo (Address: 0x5b89d20c)
CancelThreadpoolIo (Address: 0x5b89d264)
CloseHandle (Address: 0x5b89d1ec)
CloseThreadpool (Address: 0x5b89d118)
CloseThreadpoolIo (Address: 0x5b89d2d8)
CloseThreadpoolTimer (Address: 0x5b89d27c)
CloseThreadpoolWait (Address: 0x5b89d270)
CloseThreadpoolWork (Address: 0x5b89d1f4)
CompareFileTime (Address: 0x5b89d124)
CompareStringEx (Address: 0x5b89d294)
CopyFileW (Address: 0x5b89d0f0)
CreateDirectoryW (Address: 0x5b89d0ec)
CreateEventW (Address: 0x5b89d1c4)
CreateFileMappingW (Address: 0x5b89d244)
CreateFileW (Address: 0x5b89d0c8)
CreateIoCompletionPort (Address: 0x5b89d200)
CreateMutexW (Address: 0x5b89d1f0)
CreateProcessW (Address: 0x5b89d24c)
CreateSemaphoreW (Address: 0x5b89d248)
CreateThread (Address: 0x5b89d1c0)
CreateThreadpool (Address: 0x5b89d254)
CreateThreadpoolIo (Address: 0x5b89d258)
CreateThreadpoolTimer (Address: 0x5b89d2d4)
CreateThreadpoolWait (Address: 0x5b89d280)
CreateThreadpoolWork (Address: 0x5b89d300)
CreateTimerQueueTimer (Address: 0x5b89d2bc)
DebugBreak (Address: 0x5b89d240)
DecodePointer (Address: 0x5b89d1fc)
DeleteCriticalSection (Address: 0x5b89d148)
DeleteFileW (Address: 0x5b89d180)
DeleteTimerQueueTimer (Address: 0x5b89d2c8)
DuplicateHandle (Address: 0x5b89d29c)
EncodePointer (Address: 0x5b89d14c)
EnterCriticalSection (Address: 0x5b89d2c4)
ExpandEnvironmentStringsW (Address: 0x5b89d0e8)
FileTimeToSystemTime (Address: 0x5b89d228)
FindClose (Address: 0x5b89d0dc)
FindFirstFileW (Address: 0x5b89d0d4)
FindNextFileW (Address: 0x5b89d0d8)
FindResourceW (Address: 0x5b89d0fc)
FlushFileBuffers (Address: 0x5b89d178)
FlushViewOfFile (Address: 0x5b89d17c)
FormatMessageW (Address: 0x5b89d19c)
FreeLibrary (Address: 0x5b89d194)
GetCurrentProcess (Address: 0x5b89d174)
GetCurrentProcessId (Address: 0x5b89d1cc)
GetCurrentThread (Address: 0x5b89d0c4)
GetCurrentThreadId (Address: 0x5b89d1d0)
GetEnvironmentVariableW (Address: 0x5b89d120)
GetFileAttributesExW (Address: 0x5b89d1d8)
GetFileAttributesW (Address: 0x5b89d0e0)
GetFileSizeEx (Address: 0x5b89d230)
GetLastError (Address: 0x5b89d164)
GetLocalTime (Address: 0x5b89d11c)
GetModuleFileNameW (Address: 0x5b89d0f8)
GetModuleHandleExW (Address: 0x5b89d1e0)
GetModuleHandleW (Address: 0x5b89d16c)
GetProcAddress (Address: 0x5b89d168)
GetProcessHeap (Address: 0x5b89d1f8)
GetProcessTimes (Address: 0x5b89d0e4)
GetQueuedCompletionStatus (Address: 0x5b89d208)
GetStringTypeW (Address: 0x5b89d2ac)
GetSystemDirectoryW (Address: 0x5b89d2a0)
GetSystemInfo (Address: 0x5b89d2b4)
GetSystemTimeAsFileTime (Address: 0x5b89d1d4)
GetTickCount (Address: 0x5b89d190)
GetTickCount64 (Address: 0x5b89d114)
GetVersionExW (Address: 0x5b89d170)
HeapAlloc (Address: 0x5b89d1b8)
HeapCreate (Address: 0x5b89d2fc)
HeapDestroy (Address: 0x5b89d2ec)
HeapFree (Address: 0x5b89d1b4)
HeapReAlloc (Address: 0x5b89d2f0)
HeapSize (Address: 0x5b89d2f4)
HeapValidate (Address: 0x5b89d2f8)
InitializeConditionVariable (Address: 0x5b89d28c)
InitializeCriticalSection (Address: 0x5b89d10c)
InitializeCriticalSectionAndSpinCount (Address: 0x5b89d144)
InitializeCriticalSectionEx (Address: 0x5b89d298)
InitializeSListHead (Address: 0x5b89d160)
InterlockedFlushSList (Address: 0x5b89d154)
IsProcessorFeaturePresent (Address: 0x5b89d15c)
LCMapStringEx (Address: 0x5b89d290)
LeaveCriticalSection (Address: 0x5b89d1bc)
LoadLibraryExA (Address: 0x5b89d2e0)
LoadLibraryExW (Address: 0x5b89d130)
LoadLibraryW (Address: 0x5b89d0f4)
LoadResource (Address: 0x5b89d104)
LocalFileTimeToFileTime (Address: 0x5b89d128)
LocalFree (Address: 0x5b89d198)
LockResource (Address: 0x5b89d108)
MapViewOfFile (Address: 0x5b89d23c)
MultiByteToWideChar (Address: 0x5b89d220)
OpenEventW (Address: 0x5b89d2a8)
OpenFileMappingW (Address: 0x5b89d2a4)
OpenProcess (Address: 0x5b89d1a8)
PostQueuedCompletionStatus (Address: 0x5b89d204)
QueryPerformanceCounter (Address: 0x5b89d18c)
QueryPerformanceFrequency (Address: 0x5b89d224)
RaiseException (Address: 0x5b89d150)
ReadFile (Address: 0x5b89d234)
RegisterWaitForSingleObject (Address: 0x5b89d1ac)
ReleaseMutex (Address: 0x5b89d1e4)
ReleaseSemaphore (Address: 0x5b89d2b8)
ReleaseSRWLockExclusive (Address: 0x5b89d2dc)
RemoveDirectoryW (Address: 0x5b89d0d0)
ResetEvent (Address: 0x5b89d184)
RtlUnwind (Address: 0x5b89d158)
SetEnvironmentVariableW (Address: 0x5b89d2b0)
SetEvent (Address: 0x5b89d1c8)
SetFileAttributesW (Address: 0x5b89d0cc)
SetLastError (Address: 0x5b89d1a4)
SetThreadpoolThreadMaximum (Address: 0x5b89d278)
SetThreadpoolThreadMinimum (Address: 0x5b89d26c)
SetThreadpoolTimer (Address: 0x5b89d1dc)
SetThreadpoolWait (Address: 0x5b89d2d0)
SizeofResource (Address: 0x5b89d100)
Sleep (Address: 0x5b89d210)
SleepConditionVariableCS (Address: 0x5b89d284)
StartThreadpoolIo (Address: 0x5b89d250)
SubmitThreadpoolWork (Address: 0x5b89d2e4)
SwitchToThread (Address: 0x5b89d188)
SystemTimeToFileTime (Address: 0x5b89d12c)
TlsAlloc (Address: 0x5b89d140)
TlsFree (Address: 0x5b89d134)
TlsGetValue (Address: 0x5b89d13c)
TlsSetValue (Address: 0x5b89d138)
TryEnterCriticalSection (Address: 0x5b89d110)
UnmapViewOfFile (Address: 0x5b89d1a0)
UnregisterWaitEx (Address: 0x5b89d1b0)
VirtualLock (Address: 0x5b89d2c0)
VirtualProtect (Address: 0x5b89d2e8)
VirtualQuery (Address: 0x5b89d238)
WaitForMultipleObjects (Address: 0x5b89d1e8)
WaitForSingleObject (Address: 0x5b89d214)
WaitForSingleObjectEx (Address: 0x5b89d218)
WaitForThreadpoolIoCallbacks (Address: 0x5b89d25c)
WaitForThreadpoolTimerCallbacks (Address: 0x5b89d260)
WaitForThreadpoolWaitCallbacks (Address: 0x5b89d274)
WaitForThreadpoolWorkCallbacks (Address: 0x5b89d268)
WakeAllConditionVariable (Address: 0x5b89d288)
WideCharToMultiByte (Address: 0x5b89d21c)
WriteFile (Address: 0x5b89d22c)

ntdll.dll

RtlGetVersion (Address: 0x5b89d454)
RtlNtStatusToDosError (Address: 0x5b89d458)

ole32.dll

CoCreateInstance (Address: 0x5b89d464)
CoGetObject (Address: 0x5b89d46c)
CoInitializeEx (Address: 0x5b89d468)
CoUninitialize (Address: 0x5b89d460)
IIDFromString (Address: 0x5b89d470)

OLEAUT32.dll

SafeArrayCreate (Address: 0x5b89d310)
SafeArrayGetDim (Address: 0x5b89d308)
SysAllocString (Address: 0x5b89d31c)
SysAllocStringLen (Address: 0x5b89d314)
SysFreeString (Address: 0x5b89d320)
VariantClear (Address: 0x5b89d30c)
VariantInit (Address: 0x5b89d318)

RPCRT4.dll

NdrClientCall4 (Address: 0x5b89d338)
RpcBindingFree (Address: 0x5b89d350)
RpcBindingFromStringBindingW (Address: 0x5b89d328)
RpcBindingSetAuthInfoExW (Address: 0x5b89d334)
RpcBindingSetOption (Address: 0x5b89d330)
RpcSmDestroyClientContext (Address: 0x5b89d34c)
RpcStringBindingComposeW (Address: 0x5b89d32c)
RpcStringFreeW (Address: 0x5b89d348)
UuidCreate (Address: 0x5b89d33c)
UuidFromStringW (Address: 0x5b89d344)
UuidToStringW (Address: 0x5b89d340)

USER32.dll

GetLastActivePopup (Address: 0x5b89d358)
IsWindow (Address: 0x5b89d35c)
LoadStringW (Address: 0x5b89d360)