System32Problems14[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

System32Problems14.zip
Size

26.9MB
MD5

040687f80e3a30def38432b10e6b97df
SHA1

88316af77cce9b39d699f208090b444fae72c01e
SHA256

d92c9429154487522829f73e2b7491ac98d41837f273462b0085481af89e74dd
SHA512

dd2966b07a1a40e093e2e3dad7bcffc19c9f180d79e96fe18dc3f43eb7a54d8ca185aa2c47475a17defe05c14537cc16fb10ba49ff4a6fcfb5fac151c9dc16ce
SSDEEP

393216:yHNwlJL0yTuH7cyGFsDxoceusBPqeJuMTi82LaL2llzIS8eQjAmYRLL3:+kJwpGODx5sBPqCDTi82eL2TomL3

Score

3^/10

Malware Config

Signatures

Unsigned PE 91 IoCs

Checks for missing Authenticode signature.

resource
unpack001/DWrite.dll
unpack001/DXP.dll
unpack001/DuCsps.dll
unpack001/DxpTaskSync.dll
unpack001/EAMProgressHandler.dll
unpack001/ELSCore.dll
unpack001/EapTeapAuth.dll
unpack001/EapTeapConfig.dll
unpack001/EapTeapExt.dll
unpack001/EasPolicyManagerBrokerPS.dll
unpack001/EdgeContent.dll
unpack001/EdgeManager.dll
unpack001/EdgeResetPlugin.dll
unpack001/EditBufferTestHook.dll
unpack001/EhStorAPI.dll
unpack001/EhStorPwdMgr.dll
unpack001/EhStorShell.dll
unpack001/EmailApis.dll
unpack001/EmojiDS.dll
unpack001/EnterpriseAPNCsp.dll
unpack001/EnterpriseAppMgmtClient.dll
unpack001/EnterpriseAppMgmtSvc.dll
unpack001/EnterpriseDesktopAppMgmtCSP.dll
unpack001/EnterpriseModernAppMgmtCSP.dll
unpack001/ErrorDetails.dll
unpack001/ErrorDetailsCore.dll
unpack001/EsclProtocol.dll
unpack001/EsclScan.dll
unpack001/EsclWiaDriver.dll
unpack001/dswave.dll
unpack001/dtsh.dll
unpack001/dui70.dll
unpack001/duser.dll
unpack001/dusmapi.dll
unpack001/dusmsvc.dll
unpack001/dwmcore.dll
unpack001/dwmghost.dll
unpack001/dwmredir.dll
unpack001/dwmscene.dll
unpack001/dxdiagn.dll
unpack001/dxgwdi.dll
unpack001/dxilconv.dll
unpack001/dxmasf.dll
unpack001/dxpps.dll
unpack001/dxtmsft.dll
unpack001/dxtrans.dll
unpack001/dynamoapi.dll
unpack001/eapp3hst.dll
unpack001/eappcfg.dll
unpack001/eappcfgui.dll
unpack001/eappgnui.dll
unpack001/eapphost.dll
unpack001/eappprxy.dll
unpack001/eapprovp.dll
unpack001/eapputil.dll
unpack001/eapsimextdesktop.dll
unpack001/eapsvc.dll
unpack001/easconsent.dll
unpack001/easinvoker.proxystub.dll
unpack001/easwrt.dll
unpack001/edgeIso.dll
unpack001/edgeangle.dll
unpack001/edgehtml.dll
unpack001/edpauditapi.dll
unpack001/edpcsp.dll
unpack001/edptask.dll
unpack001/edputil.dll
unpack001/eeprov.dll
unpack001/eeutil.dll
unpack001/efsadu.dll
unpack001/efsext.dll
unpack001/efslsaext.dll
unpack001/efssvc.dll
unpack001/efsutil.dll
unpack001/efswrt.dll
unpack001/els.dll
unpack001/elsTrans.dll
unpack001/elshyph.dll
unpack001/elslad.dll
unpack001/embeddedmodesvc.dll
unpack001/embeddedmodesvcapi.dll
unpack001/encapi.dll
unpack001/energy.dll
unpack001/energyprov.dll
unpack001/energytask.dll
unpack001/enrollmentapi.dll
unpack001/enterprisecsps.dll
unpack001/enterpriseetw.dll
unpack001/enterpriseresourcemanager.dll
unpack001/eqossnap.dll
unpack001/es.dll

Files

System32Problems14.zip
.zip
DWrite.dll
.dll windows:10 windows x64 arch:x64

57eb22ef5144c0ff295b9b8b61ef8699

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

DWrite.pdb

Imports

msvcrt

tanf
strcmp
sqrtf
sqrt
sinf
__dllonexit
pow
_unlock
_lock
?terminate@@YAXXZ
memset
atan2f
__C_specific_handler
memcmp
_initterm
??1type_info@@UEAA@XZ
logf
_amsg_exit
_XcptFilter
memmove
memcpy
log10f
__CxxFrameHandler3
floorf
floor
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
expf
free
cosf
ceilf
ceil
??0exception@@QEAA@XZ
__CxxFrameHandler4
_callnewh
_vsnwprintf
memcpy_s
_vsnprintf_s
memmove_s
realloc
_wcsicmp
wcsrchr
wcsnlen
strnlen
??_V@YAXPEAX@Z
sprintf_s
_itow_s
rand
calloc
iswalpha
wcschr
_ultow_s
_snprintf_s
wcstol
qsort
vsprintf_s
sscanf_s
sprintf
strcpy_s
strstr
strcat_s
isspace
strncmp
bsearch
strtod
strchr
strncpy_s
isalnum
_errno
strerror
malloc
_purecall
??3@YAXPEAX@Z
_onexit
wcscmp

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
AlpcGetMessageAttribute
AlpcInitializeMessageAttribute
NtAlpcSendWaitReceivePort
NtAlpcConnectPort
NtSetInformationThread
NtQueryInformationThread
RtlCaptureStackBackTrace
NtClose
RtlVirtualUnwind
RtlInitUnicodeString

api-ms-win-core-libraryloader-l1-2-0

FindResourceExW
LockResource
LoadResource
FreeLibraryAndExitThread
SizeofResource
GetModuleHandleExW
GetModuleFileNameA
DisableThreadLibraryCalls
GetModuleHandleW
GetProcAddress

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

CreateThread
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
GetCurrentThread
TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetTickCount
GetSystemTimeAsFileTime
GetSystemWindowsDirectoryW
GetSystemTime
GetTickCount64

api-ms-win-core-errorhandling-l1-1-0

RaiseException
GetLastError
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
SetErrorMode

api-ms-win-core-localization-l1-2-0

GetLocaleInfoEx
LCMapStringW
LocaleNameToLCID
FormatMessageW
GetACP
GetSystemDefaultLCID
GetUserDefaultLCID

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringA
OutputDebugStringW

api-ms-win-core-synch-l1-1-0

CreateSemaphoreExW
CreateMutexExW
LeaveCriticalSection
WaitForSingleObjectEx
SetEvent
AcquireSRWLockExclusive
ResetEvent
OpenSemaphoreW
WaitForMultipleObjectsEx
InitializeCriticalSection
WaitForSingleObject
DeleteCriticalSection
CreateEventW
EnterCriticalSection
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
ReleaseMutex
ReleaseSemaphore

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer

api-ms-win-core-registry-l1-1-0

RegEnumValueW
RegEnumKeyExW
RegQueryInfoKeyW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegGetValueW
RegNotifyChangeKeyValue

api-ms-win-core-file-l1-1-0

FindClose
FindCloseChangeNotification
FindFirstFileW
ReadFile
FindFirstChangeNotificationW
FindNextChangeNotification
CreateFileW
SetFileTime
GetFileInformationByHandle

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

rpcrt4

UuidCreate

api-ms-win-core-memory-l1-1-0

CreateFileMappingW
VirtualQuery
MapViewOfFileEx
UnmapViewOfFile
VirtualAlloc
VirtualFree

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventSetInformation
EventWriteTransfer

api-ms-win-security-base-l1-1-0

RevertToSelf
CreateWellKnownSid
ImpersonateLoggedOnUser

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-string-l1-1-0

CompareStringW
MultiByteToWideChar
CompareStringOrdinal
WideCharToMultiByte

api-ms-win-core-localization-l1-2-2

LCIDToLocaleName

api-ms-win-core-windowserrorreporting-l1-1-0

WerRegisterMemoryBlock

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DWriteCreateFactory

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_CODE
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 644KB - Virtual size: 642KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 108KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
DXCore.dll
.dll windows:10 windows x64 arch:x64

73e5752d4319a48a50937d14dbd63110

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:93:51:8b:ca:96:66:23:03:35:16:75:a7:1d:ab:90:ab:66:4c:0f:93:d0:4e:22:19:39:cd:fb:39:84:98:03
Signer

Actual PE Digest

0a:93:51:8b:ca:96:66:23:03:35:16:75:a7:1d:ab:90:ab:66:4c:0f:93:d0:4e:22:19:39:cd:fb:39:84:98:03

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

DXCore.pdb

Imports

msvcp_win

?_Throw_C_error@std@@YAXH@Z
_Mtx_lock
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Mtx_unlock
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
??Bid@locale@std@@QEAA_KXZ
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Incref@facet@locale@std@@UEAAXXZ
?out@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z
??0?$codecvt@GDU_Mbstatet@@@std@@QEAA@_K@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??1?$codecvt@GDU_Mbstatet@@@std@@MEAA@XZ
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
??0task_continuation_context@Concurrency@@AEAA@XZ
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
?_Xbad_function_call@std@@YAXXZ
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
_Cnd_init_in_situ
?_Throw_future_error@std@@YAXAEBVerror_code@1@@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
?_ReportUnobservedException@details@Concurrency@@YAXXZ
_Cnd_wait
?__ExceptionPtrToBool@@YA_NPEBX@Z
?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
_Cnd_register_at_thread_exit
_Cnd_broadcast
?__ExceptionPtrDestroy@@YAXPEAX@Z
_Cnd_destroy_in_situ
_Cnd_unregister_at_thread_exit
_Thrd_id

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o___std_type_info_destroy_list
_o___stdio_common_vsnprintf_s
_o___stdio_common_vswprintf
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__register_onexit_function
_o__seh_filter_dll
_o___std_exception_destroy
memmove
_o_abort
_o_ceilf
_o_free
_o_malloc
_o_terminate
_o_towlower
_o_wcsncpy_s
__C_specific_handler
__CxxFrameHandler3
__current_exception
__current_exception_context
_CxxThrowException
__std_terminate
__CxxFrameHandler4
_o___std_exception_copy
memcmp
memcpy
_o__purecall

api-ms-win-crt-string-l1-1-0

memset

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlUnsubscribeWnfStateChangeNotification
RtlFreeHeap
RtlAllocateHeap
RtlCaptureStackBackTrace
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlQueryWnfStateData
RtlSubscribeWnfStateChangeNotification

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetModuleFileNameA
GetModuleHandleExW
GetModuleFileNameW
GetModuleHandleExA
GetProcAddress

api-ms-win-core-synch-l1-1-0

CreateEventW
DeleteCriticalSection
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
ReleaseMutex
AcquireSRWLockExclusive
WaitForSingleObject
AcquireSRWLockShared
InitializeCriticalSectionEx
LeaveCriticalSection
WaitForSingleObjectEx
ReleaseSemaphore
EnterCriticalSection
ReleaseSRWLockShared
CreateSemaphoreExW
ReleaseSRWLockExclusive
CreateMutexExW
OpenSemaphoreW

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-errorhandling-l1-1-0

GetLastError
RaiseException
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
OutputDebugStringA
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWriteTransfer
EventUnregister
EventSetInformation

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW
RegEnumValueW
RegOpenKeyExW
RegCloseKey

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetSystemWindowsDirectoryW

api-ms-win-core-version-l1-1-1

GetFileVersionInfoSizeW
GetFileVersionInfoW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-file-l1-1-0

CreateFileW
GetFileTime

api-ms-win-core-psapi-l1-1-0

K32GetModuleInformation

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
InitOnceComplete

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

win32u

NtGdiDdDDISetVidPnSourceOwner
NtGdiDdDDINetDispStartMiracastDisplayDevice
NtDxgkUnpinResources
NtDxgkEnumAdapters3
NtGdiDdDDISignalSynchronizationObject
NtGdiDdDDIWaitForSynchronizationObject
NtGdiDdDDICreateSynchronizationObject
NtGdiDdDDIOpenResource
NtGdiDdDDICreateAllocation
NtGdiDdDDIChangeVideoMemoryReservation
NtGdiDdDDIQueryVideoMemoryInfo
NtGdiDdDDICloseAdapter
NtGdiDdDDIQueryAdapterInfo
NtDxgkPinResources

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

DXCoreCreateAdapterFactory

Sections

.text
Size: 132KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 764B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
DXP.dll
.dll regsvr32 windows:10 windows x64 arch:x64

af4577d0767d45221c18662f40ca84ab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

DXP.pdb

Imports

api-ms-win-crt-string-l1-1-0

wcscmp
memset

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
_o__wcsicmp
_o__wcsnicmp
memmove
_o_floor
_o_free
_o_iswspace
_o_malloc
_o_memcpy_s
__C_specific_handler
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
__std_terminate
__CxxFrameHandler4
memcmp
__CxxFrameHandler3
memcpy

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventWriteTransfer

api-ms-win-eventing-classicprovider-l1-1-0

UnregisterTraceGuids
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
TraceMessage
GetTraceLoggerHandle

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetProcAddress
GetModuleFileNameW
LoadStringW
GetModuleHandleExW
LoadLibraryExA
FreeLibrary
SizeofResource
LoadResource
LockResource
LoadLibraryExW
GetModuleHandleW

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
PropVariantClear
CoUninitialize
CoWaitForMultipleHandles
CoInitializeEx
CoTaskMemFree
CoCreateGuid
CoCreateInstance
StringFromGUID2
CoUnmarshalInterface
PropVariantCopy
CoMarshalInterThreadInterfaceInStream

api-ms-win-core-localization-l1-2-0

LCMapStringW

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionAndSpinCount
InitializeCriticalSection
WaitForSingleObjectEx
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
DeleteCriticalSection
SetEvent
ResetEvent
CreateEventW

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
TerminateProcess

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

oleaut32

VariantInit
SysAllocStringLen
VariantClear
SysAllocString
SysFreeString

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

rpcrt4

UuidFromStringW

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW
RegEnumValueW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo

api-ms-win-core-file-l1-1-0

CreateFileW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-libraryloader-l1-2-1

FindResourceW

api-ms-win-core-memory-l1-1-0

VirtualAlloc
VirtualFree

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-processthreads-l1-1-1

FlushInstructionCache
IsProcessorFeaturePresent

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList
InitializeSListHead
InterlockedPopEntrySList

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindExtensionW
PathParseIconLocationW

gdi32

GetTextExtentPoint32W
CreateSolidBrush
Rectangle
CreatePen
GetStockObject
ExcludeClipRect
GetDeviceCaps
DeleteObject
SelectObject

kernel32

OpenSemaphoreW
ReleaseMutex
ReleaseSemaphore
SetLastError
OutputDebugStringW
DebugBreak
GetModuleFileNameA
FormatMessageW
ReleaseActCtx
InitOnceBeginInitialize
DeactivateActCtx
ActivateActCtx
CreateSemaphoreExW
InitOnceComplete
CreateMutexExW
CreateActCtxW

ntdll

WinSqmEndSession
WinSqmIsOptedIn
WinSqmSetDWORD
WinSqmAddToStream
EtwEventUnregister
EtwLogTraceEvent
EtwEventWriteTransfer
EtwEventSetInformation
EtwEventRegister
WinSqmStartSession

shell32

SHCreateItemFromIDList
ord265
ord264
ord71
SHGetPropertyStoreForWindow
SHBindToObject
SHParseDisplayName
ord152
SHGetIDListFromObject
ord6
ord67
SHGetNameFromIDList
SHGetKnownFolderPath
SHCreateDirectoryExW
ShellExecuteExW
ord19
ShellExecuteW
SHChangeNotify
ord18
SHCreateDefaultExtractIcon
SHCreateShellItemArrayFromDataObject
AssocCreateForClasses
ord16
ord25
ord155
ord153
ord256
SHCreateDefaultContextMenu
SHCreateDataObject

shlwapi

ord538
ord158
ord174
ord156
ord514
ord618
ord278
ord24
ord256
ord219
SHStrDupW
ord615
ord199
ord176
StrCmpNW
ord168
ord204
StrStrW
ord12
ord172
ord215
StrCmpIW

user32

GetSysColor
SystemParametersInfoW
SendMessageW
ShowWindow
DestroyWindow
GetFocus
PostMessageW
SetWindowLongPtrW
AllowSetForegroundWindow
DeleteMenu
SetMenuItemInfoW
DestroyMenu
SetMenuDefaultItem
DialogBoxParamW
GetSystemMetrics
IsWindow
GetClientRect
UnregisterDeviceNotification
UnregisterClassW
RegisterClassExW
CreateWindowExW
RegisterDeviceNotificationW
PeekMessageW
GetWindowLongPtrW
DefWindowProcW
GetDC
ReleaseDC
DestroyIcon
LoadMenuW
RemoveMenu
CallWindowProcW
SetWindowPos
EnableWindow
GetComboBoxInfo
GetParent
MapWindowPoints
WindowFromDC
GetWindowRect
FillRect
GetSysColorBrush
SetWindowTextW
GetWindowTextW
GetDlgItem
DrawEdge
DrawTextW
EndDialog
UnregisterClassA
GetSubMenu

uxtheme

BeginBufferedPaint
SetWindowTheme
OpenThemeData
DrawThemeText
EndBufferedPaint
DrawThemeBackground
BufferedPaintInit
CloseThemeData
BufferedPaintUnInit
GetThemeBackgroundContentRect

setupapi

SetupDiGetDeviceInterfaceDetailW
SetupDiDeleteDeviceInterfaceData
SetupDiDestroyDeviceInfoList
SetupDiOpenDeviceInterfaceW
SetupDiCreateDeviceInfoList
SetupDiGetDeviceInterfaceAlias
SetupDiGetDevicePropertyW

propsys

PropVariantCompareEx
PropVariantToBoolean
PropVariantToStringAlloc
PSGetPropertyDescriptionListFromString
PSPropertyBag_WriteBOOL
PSPropertyBag_WriteUnknown
PSPropertyBag_ReadUnknown
VariantToBoolean
PSPropertyBag_WriteStr
PSPropertyBag_WriteDWORD
PSCreateMemoryPropertyStore
InitPropVariantFromCLSID
PSPropertyBag_ReadStr
PSFormatForDisplay
PSGetPropertyDescription
PSPropertyBag_ReadStrAlloc
InitPropVariantFromBuffer
PropVariantToVariant
PSGetPropertyFromPropertyStorage
PropVariantToGUID
PropVariantToString
VariantToInt32

api-ms-win-devices-query-l1-1-0

DevFreeObjectProperties
DevFindProperty
DevGetObjectProperties

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 224KB - Virtual size: 220KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 172KB - Virtual size: 171KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
DuCsps.dll
.dll windows:10 windows x64 arch:x64

5e309c4075f65c91e3599f8ab1d4148b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

DuCsps.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__register_onexit_function
_o__seh_filter_dll
_o__wcsicmp
_o_exit
_o_free
_o_malloc
_o_realloc
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
strchr
memcpy
memmove
__std_terminate
__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetModuleHandleExW
GetModuleFileNameA
GetProcAddress
GetModuleHandleW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-1-0

CreateSemaphoreExW
CreateMutexExW
OpenSemaphoreW
WaitForSingleObject
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
ReleaseSemaphore
ReleaseMutex

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

msvcp_win

??Bid@locale@std@@QEAA_KXZ
?id@?$ctype@G@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
??0_Lockit@std@@QEAA@H@Z
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Lockit@std@@QEAA@XZ
??1_Locinfo@std@@QEAA@XZ
?is@?$ctype@G@std@@QEBA_NFG@Z
?id@?$collate@G@std@@2V0locale@2@A
?_Incref@facet@locale@std@@UEAAXXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
_Wcsxfrm
?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z
_Wcscoll
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?tolower@?$ctype@G@std@@QEBAGG@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoUninitialize
CoTaskMemAlloc
CoCreateInstance
CoInitializeEx

oleaut32

SysAllocString
SafeArrayCreate
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayUnaccessData
SafeArrayAccessData
SysStringLen
VariantChangeType
VariantCopy
VariantInit
VariantClear
SysFreeString

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegGetValueW
RegEnumValueW
RegDeleteTreeW
RegEnumKeyExW
RegDeleteValueW
RegQueryInfoKeyW
RegOpenKeyExW
RegCreateKeyExW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-core-registry-l2-1-0

RegEnumKeyW

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

updateapi

GetInstalledPackageInfo
FreeInstalledPackageInfo

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 84KB - Virtual size: 82KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 420B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
DxpTaskSync.dll
.dll regsvr32 windows:10 windows x64 arch:x64

64cddaa03382aff2006bffad23888aef

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

DxpTaskSync.pdb

Imports

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
_o__wtoi
memmove
_o_calloc
_o_free
_o_malloc
_o_memcpy_s
_o_wmemcpy_s
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
__C_specific_handler
__std_terminate
__CxxFrameHandler4
_CxxThrowException
__C_specific_handler_noexcept
memcpy

ntdll

EtwEventSetInformation
EtwEventRegister
EtwEventUnregister
EtwLogTraceEvent
WinSqmAddToStream
WinSqmSetDWORD
WinSqmStartSession
WinSqmIsOptedIn
WinSqmIncrementDWORD
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
EtwEventWriteTransfer

kernel32

DeactivateActCtx
ActivateActCtx
CreateSemaphoreExW
GetModuleFileNameW
CreateActCtxW
ReleaseActCtx
LoadLibraryExW
InitOnceComplete
IsDebuggerPresent
InitializeSListHead
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetProcAddress
GetModuleHandleW
WaitForSingleObjectEx
ResetEvent
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapDestroy
HeapReAlloc
HeapSize
MulDiv
CompareStringW
LoadResource
FindResourceExW
LockResource
FileTimeToSystemTime
SizeofResource
CompareStringOrdinal
GetSystemTimeAsFileTime
CreateThread
CloseHandle
SetEvent
CreateEventW
WaitForSingleObject
WaitForMultipleObjects
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetProcessHeap
HeapAlloc
HeapFree
LocalFree
RaiseException
GetNumberFormatW
GetLastError
FormatMessageW
GetLocaleInfoW
DisableThreadLibraryCalls
CreateMutexExW
InitOnceBeginInitialize
OpenSemaphoreW
ReleaseMutex
ReleaseSemaphore
LocalAlloc
GetModuleHandleExW
GetModuleFileNameA
DebugBreak
SetLastError
OutputDebugStringW

ole32

CoCreateInstance
StringFromGUID2
CoUninitialize
CoTaskMemFree
CoInitializeEx
CoTaskMemAlloc
PropVariantClear

oleaut32

SysAllocString
SysFreeString
VariantInit
VariantClear

shlwapi

ord158
ord174
SHStrDupW
ord256
StrStrIW
ord219
ord199
StrTrimW
ord538
ord165
ord176
ord215
StrCmpIW
ord156
ord618
ord24
ord514
ord204
ord172
ord354

advapi32

RevertToSelf
ImpersonateLoggedOnUser
LogonUserW
RegSetKeyValueW
EventWriteTransfer
RegGetValueW
EventRegister
TraceMessage
GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
EventUnregister

shell32

ord25
SHBindToObject
ShellExecuteExW
SHParseDisplayName
ord28
SHShowManageLibraryUI
SHGetKnownFolderIDList
SHCreateItemFromIDList
ord155
ord18
SHGetIDListFromObject

user32

LoadIconW
IsWindow
GetWindowLongW
GetWindowRect
DestroyIcon
GetSysColor
LoadCursorW
SetCursor
SetWindowLongW
GetClientRect
LoadImageW
DefWindowProcW
DestroyWindow
SetWindowLongPtrW
CreateWindowExW
UnregisterClassW
GetWindowLongPtrW
RegisterClassExW
PostMessageW
GetDC
SendMessageW
GetComboBoxInfo
ReleaseDC
EnableWindow
LoadStringW
CharNextW
OffsetRect
GetMenuItemCount
GetWindow
GetMenuItemInfoW
UnregisterClassA
IsWindowEnabled
GetFocus
DeleteMenu

propsys

PropVariantToUInt64
PropVariantToGUID
PropVariantToBoolean
PSPropertyBag_ReadStr
PropVariantToFileTime
PSPropertyBag_ReadType
PropVariantToInt32
PropVariantToStringAlloc
PropVariantToString
InitPropVariantFromCLSID
PropVariantToUInt32

gdi32

SelectObject
DeleteObject
DeleteDC
GetTextExtentPoint32W
CreateCompatibleBitmap
BitBlt
StretchBlt
SetBkColor
ExtTextOutW
CreateCompatibleDC

gdiplus

GdipCreateFromHDC
GdipFillRectangleI
GdipDeleteGraphics
GdipCreateSolidFill
GdiplusStartup
GdiplusShutdown
GdipDeleteBrush

credui

CredUIParseUserNameW
CredUIPromptForCredentialsW

wevtapi

EvtNext
EvtRender
EvtCreateRenderContext
EvtClose
EvtSubscribe
EvtQuery

crypt32

CryptUnprotectData

dui70

?GetEnabled@Element@DirectUI@@QEAA_NXZ
?SelectionChange@Selector@DirectUI@@SA?AVUID@@XZ
?CreateInt@Value@DirectUI@@SAPEAV12@HW4DynamicScaleValue@@@Z
?SetValue@Element@DirectUI@@QEAAJPEBUPropertyInfo@2@HPEAVValue@2@@Z
?GetDisplayNode@Element@DirectUI@@QEAAPEAUHGADGET__@@XZ
?GetIntZero@Value@DirectUI@@SAPEAV12@XZ
?GetValue@Element@DirectUI@@QEAAPEAVValue@2@PEBUPropertyInfo@2@HPEAUUpdateCache@2@@Z
?OnInput@HWNDHost@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?GetClassInfoPtr@HWNDHost@DirectUI@@SAPEAUIClassInfo@2@XZ
?Register@HWNDHost@DirectUI@@SAJXZ
??0HWNDHost@DirectUI@@QEAA@XZ
?Initialize@HWNDHost@DirectUI@@QEAAJIIPEAVElement@2@PEAK@Z
??1HWNDHost@DirectUI@@UEAA@XZ
?DefaultAction@CCBase@DirectUI@@UEAAJXZ
?PostCreate@CCBase@DirectUI@@MEAAXPEAUHWND__@@@Z
?Initialize@CCListView@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z
??1CCListView@DirectUI@@UEAA@XZ
?OnInput@CCBase@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?OnPropertyChanged@CCBase@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?OnNotify@CCBase@DirectUI@@UEAA_NI_K_JPEA_J@Z
?OnCustomDraw@CCBase@DirectUI@@UEAA_NPEAUtagNMCUSTOMDRAWINFO@@PEA_J@Z
?OnLostDialogFocus@CCBase@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z
?OnReceivedDialogFocus@CCBase@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z
?CreateHWND@CCBase@DirectUI@@UEAAPEAUHWND__@@PEAU3@@Z
??0CCListView@DirectUI@@QEAA@XZ
?GetContentSize@CCListView@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?GetClassInfoPtr@CCListView@DirectUI@@SAPEAUIClassInfo@2@XZ
?Register@CCListView@DirectUI@@SAJXZ
?OnAdjustWindowSize@HWNDHost@DirectUI@@UEAAHHHI@Z
?OnHosted@HWNDHost@DirectUI@@MEAAXPEAVElement@2@@Z
?Add@Element@DirectUI@@QEAAJPEAV12@@Z
?SetClass@Element@DirectUI@@QEAAJPEBG@Z
?GetSelection@Selector@DirectUI@@QEAAPEAVElement@2@XZ
?GetLayoutPos@Element@DirectUI@@QEAAHXZ
?GetExtent@Element@DirectUI@@QEAAPEBUtagSIZE@@PEAPEAVValue@2@@Z
?GetSelected@Element@DirectUI@@QEAA_NXZ
?SetVisible@Element@DirectUI@@QEAAJ_N@Z
?SetWidth@Element@DirectUI@@QEAAJH@Z
?SetBorderThickness@Element@DirectUI@@QEAAJHHHH@Z
?SetContentString@Element@DirectUI@@QEAAJPEBG@Z
?SetID@Element@DirectUI@@QEAAJPEBG@Z
?SetSelected@Element@DirectUI@@QEAAJ_N@Z
?SetAlpha@Element@DirectUI@@QEAAJH@Z
?SetAccName@Element@DirectUI@@QEAAJPEBG@Z
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEAUHICON__@@_N11@Z
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEAUHBITMAP__@@EI_N11@Z
?SetValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@@Z
?StartDefer@Element@DirectUI@@QEAAXPEAK@Z
?EndDefer@Element@DirectUI@@QEAAXK@Z
?Add@Element@DirectUI@@QEAAJPEAV12@P6AHPEBX1@Z@Z
?Remove@Element@DirectUI@@QEAAJPEAV12@@Z
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z
?StopAnimation@Element@DirectUI@@QEAAXI@Z
?ContentProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?GetClassInfoPtr@Element@DirectUI@@SAPEAUIClassInfo@2@XZ
?Register@Element@DirectUI@@SAJXZ
?GetID@Element@DirectUI@@QEAAGXZ
StrToID
?Click@Button@DirectUI@@SA?AVUID@@XZ
?GetKeyWithin@Element@DirectUI@@QEAA_NXZ
?AddRef@XProvider@DirectUI@@UEAAKXZ
?SetParameter@XProvider@DirectUI@@UEAAJAEBU_GUID@@PEAX@Z
?GetDesiredSize@XProvider@DirectUI@@UEAAJHHPEAUtagSIZE@@@Z
?IsDescendent@XProvider@DirectUI@@UEAAJPEAVElement@2@PEA_N@Z
?SetFocus@XProvider@DirectUI@@UEAAJPEAVElement@2@@Z
?Navigate@XProvider@DirectUI@@UEAAJHPEA_N@Z
?CanSetFocus@XProvider@DirectUI@@UEAAJPEA_N@Z
?FindElementWithShortcutAndDoDefaultAction@XProvider@DirectUI@@UEAAHGH@Z
?GetHostedElementID@XProvider@DirectUI@@UEAAJPEAG@Z
?ForceThemeChange@XProvider@DirectUI@@UEAAJ_K_J@Z
?SetDefaultButtonTracking@XProvider@DirectUI@@UEAAJ_N@Z
?ClickDefaultButton@XProvider@DirectUI@@UEAAHXZ
?SetRegisteredDefaultButton@XProvider@DirectUI@@UEAAJPEAVElement@2@@Z
?SetButtonClassAcceptsEnterKey@XProvider@DirectUI@@UEAAJ_N@Z
?CreateXBaby@XProvider@DirectUI@@UEAAJPEAVIXElementCP@2@PEAUHWND__@@PEAVElement@2@PEAKPEAPEAUIXBaby@2@@Z
?GetRoot@XProvider@DirectUI@@IEAAPEAVElement@2@XZ
??0Element@DirectUI@@QEAA@XZ
??1Element@DirectUI@@UEAA@XZ
?Initialize@Element@DirectUI@@QEAAJIPEAV12@PEAK@Z
?OnPropertyChanged@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?OnInput@Element@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?OnEvent@Element@DirectUI@@UEAAXPEAUEvent@2@@Z
?GetInt@Value@DirectUI@@QEAAHXZ
?GetBool@Value@DirectUI@@QEAA_NXZ
??0CritSecLock@DirectUI@@QEAA@PEAU_RTL_CRITICAL_SECTION@@@Z
??1CritSecLock@DirectUI@@QEAA@XZ
?IsRTL@Element@DirectUI@@QEAA_NXZ
?IsRTLReading@Element@DirectUI@@UEAA_NXZ
?IsContentProtected@Element@DirectUI@@UEAA_NXZ
?QueryInterface@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
?UpdateTooltip@Element@DirectUI@@MEAAXPEAV12@@Z
?ActivateTooltip@Element@DirectUI@@MEAAXPEAV12@K@Z
?RemoveTooltip@Element@DirectUI@@MEAAXPEAV12@@Z
?GetKeyFocused@Element@DirectUI@@UEAA_NXZ
?SetAbsorbsShortcut@Element@DirectUI@@QEAAJ_N@Z
?GetHWND@HWNDHost@DirectUI@@UEAAPEAUHWND__@@XZ
?SetSelection@Combobox@DirectUI@@QEAAJH@Z
?Initialize@Combobox@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z
?Initialize@SelectorNoDefault@DirectUI@@QEAAJPEAVElement@2@PEAK@Z
??1SelectorNoDefault@DirectUI@@UEAA@XZ
?OnPropertyChanged@Selector@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?OnInput@Selector@DirectUI@@UEAAXPEAUInputEvent@2@@Z
UnInitThread
?OnInput@Combobox@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?OnAdjustWindowSize@Combobox@DirectUI@@UEAAHHHI@Z
?GetContentSize@Combobox@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?GetClassInfoPtr@Combobox@DirectUI@@SAPEAUIClassInfo@2@XZ
?Register@Combobox@DirectUI@@SAJXZ
?SelectionChange@Combobox@DirectUI@@SA?AVUID@@XZ
?SelectionProp@Combobox@DirectUI@@SAPEBUPropertyInfo@2@XZ
??0Combobox@DirectUI@@QEAA@XZ
??1Combobox@DirectUI@@UEAA@XZ
?CreateHWND@Combobox@DirectUI@@UEAAPEAUHWND__@@PEAU3@@Z
?OnEvent@SelectorNoDefault@DirectUI@@UEAAXPEAUEvent@2@@Z
?OnKeyFocusMoved@SelectorNoDefault@DirectUI@@UEAAXPEAVElement@2@0@Z
?GetClassInfoPtr@SelectorNoDefault@DirectUI@@SAPEAUIClassInfo@2@XZ
?Register@SelectorNoDefault@DirectUI@@SAJXZ
?SetSelection@SelectorNoDefault@DirectUI@@UEAAJPEAVElement@2@@Z
??0SelectorNoDefault@DirectUI@@QEAA@XZ
??0ClassInfoBase@DirectUI@@QEAA@XZ
??1ClassInfoBase@DirectUI@@UEAA@XZ
?Initialize@ClassInfoBase@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG_NPEBQEBUPropertyInfo@2@I@Z
?Register@ClassInfoBase@DirectUI@@QEAAJXZ
?ClassExist@ClassInfoBase@DirectUI@@SA_NPEAPEAUIClassInfo@2@PEBQEBUPropertyInfo@2@IPEAU32@PEAUHINSTANCE__@@PEBG_N@Z
?AddRef@ClassInfoBase@DirectUI@@UEAAXXZ
?Release@ClassInfoBase@DirectUI@@UEAAHXZ
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z
?GetByClassIndex@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z
?GetPICount@ClassInfoBase@DirectUI@@UEBAIXZ
?GetGlobalIndex@ClassInfoBase@DirectUI@@UEBAIXZ
?GetName@ClassInfoBase@DirectUI@@UEBAPEBGXZ
?IsValidProperty@ClassInfoBase@DirectUI@@UEBA_NPEBUPropertyInfo@2@@Z
?IsSubclassOf@ClassInfoBase@DirectUI@@UEBA_NPEAUIClassInfo@2@@Z
?GetModule@ClassInfoBase@DirectUI@@UEBAPEAUHINSTANCE__@@XZ
?IsGlobal@ClassInfoBase@DirectUI@@UEBA_NXZ
?AddChild@ClassInfoBase@DirectUI@@UEAAXXZ
?RemoveChild@ClassInfoBase@DirectUI@@UEAAXXZ
?GetChildren@ClassInfoBase@DirectUI@@UEBAHXZ
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UEBAXXZ
?Destroy@Element@DirectUI@@QEAAJ_N@Z
?GetContentStringAsDisplayed@Element@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEAUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanged@Element@DirectUI@@UEAAXPEAUPropertyInfo@2@HPEAVValue@2@1@Z
?OnGroupChanged@Element@DirectUI@@UEAAXH_N@Z
?OnKeyFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z
?OnMouseFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z
?OnDestroy@Element@DirectUI@@UEAAXXZ
?FireEvent@Element@DirectUI@@QEAAXPEAUEvent@2@_N1@Z
?SetActive@Element@DirectUI@@QEAAJH@Z
?GetContentSize@Element@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?Add@Element@DirectUI@@UEAAJPEAPEAV12@I@Z
?Insert@Element@DirectUI@@UEAAJPEAPEAV12@II@Z
?Remove@Element@DirectUI@@UEAAJPEAPEAV12@I@Z
?GetImmediateChild@Element@DirectUI@@QEAAPEAV12@PEAV12@@Z
?GetAdjacent@Element@DirectUI@@UEAAPEAV12@PEAV12@HPEBUNavReference@2@K@Z
?EnsureVisible@Element@DirectUI@@UEAA_NHHHH@Z
?SetKeyFocus@Element@DirectUI@@UEAAXXZ
?AddBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z
?RemoveBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z
?MessageCallback@Element@DirectUI@@UEAAIPEAUtagGMSG@@@Z
?GetImmersiveFocusRectOffsets@Element@DirectUI@@UEAAXPEAUtagRECT@@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MEAAXHH@Z
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?OnHosted@Element@DirectUI@@MEAAXPEAV12@@Z
?OnUnHosted@Element@DirectUI@@MEAAXPEAV12@@Z
?GetFactoryLock@Element@DirectUI@@SAPEAU_RTL_CRITICAL_SECTION@@XZ
?KeyboardNavigate@Element@DirectUI@@SA?AVUID@@XZ
?EnabledProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?GetAccessibleImpl@Element@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z
?DefaultAction@Element@DirectUI@@UEAAJXZ
?GetUIAElementProvider@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
?GetElementProviderImpl@Element@DirectUI@@UEAAJPEAVInvokeHelper@2@PEAPEAVElementProvider@2@@Z
?HandleUiaDestroyListener@Element@DirectUI@@UEAAXXZ
?HandleUiaPropertyListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?HandleUiaPropertyChangingListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@@Z
?HandleUiaEventListener@Element@DirectUI@@UEAAXPEAUEvent@2@@Z
?GetUiaFocusDelegate@Element@DirectUI@@UEAAPEAV12@XZ
?Init@NavReference@DirectUI@@QEAAXPEAVElement@2@PEAUtagRECT@@@Z
?OnPropertyChanged@HWNDHost@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?OnEvent@HWNDHost@DirectUI@@UEAAXPEAUEvent@2@@Z
?OnDestroy@HWNDHost@DirectUI@@UEAAXXZ
?OnNotify@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
?OnMessage@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
?OnSysChar@HWNDHost@DirectUI@@UEAA_NG@Z
?OnSinkThemeChanged@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
?OnCtrlThemeChanged@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
?OnWindowStyleChanged@HWNDHost@DirectUI@@UEAAX_KPEBUtagSTYLESTRUCT@@@Z
?MessageCallback@HWNDHost@DirectUI@@UEAAIPEAUtagGMSG@@@Z
?Paint@HWNDHost@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z
?GetKeyFocused@HWNDHost@DirectUI@@UEAA_NXZ
?SetKeyFocus@HWNDHost@DirectUI@@UEAAXXZ
?SetWindowDirection@HWNDHost@DirectUI@@UEAAXPEAUHWND__@@@Z
?GetAccessibleImpl@HWNDHost@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z
?OnUnHosted@HWNDHost@DirectUI@@MEAAXPEAVElement@2@@Z
?SyncRect@HWNDHost@DirectUI@@IEAAXI_N@Z
?EraseBkgnd@HWNDHost@DirectUI@@MEAA_NPEAUHDC__@@PEA_J@Z
?Release@Value@DirectUI@@QEAAXXZ
?HasChildren@Element@DirectUI@@QEAA_NXZ
?GetChildren@Element@DirectUI@@QEAAPEAV?$DynamicArray@PEAVElement@DirectUI@@$0A@@2@PEAPEAVValue@2@@Z
?SetLayoutPos@Element@DirectUI@@QEAAJH@Z
?SetEnabled@Element@DirectUI@@QEAAJ_N@Z
?Create@DUIXmlParser@DirectUI@@SAJPEAPEAV12@P6APEAVValue@2@PEBGPEAX@Z2P6AX11H2@Z2@Z
?Destroy@DUIXmlParser@DirectUI@@QEAAXXZ
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJIPEAUHINSTANCE__@@0@Z
?CreateElement@DUIXmlParser@DirectUI@@QEAAJPEBGPEAVElement@2@1PEAKPEAPEAV32@@Z
?GetAdjacent@Selector@DirectUI@@UEAAPEAVElement@2@PEAV32@HPEBUNavReference@2@K@Z
?GetAtom@Value@DirectUI@@QEAAGXZ
UnInitProcessPriv
InitThread
InitProcessPriv
?GetString@Value@DirectUI@@QEAAPEBGXZ
??0XProvider@DirectUI@@QEAA@XZ
??1XProvider@DirectUI@@UEAA@XZ
?QueryInterface@XProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
?Create@XResourceProvider@DirectUI@@SAJPEAUHINSTANCE__@@PEBG11PEAPEAV12@@Z
?Initialize@XProvider@DirectUI@@QEAAJPEAVElement@2@PEAVIXProviderCP@2@@Z
?CreateDUI@XProvider@DirectUI@@UEAAJPEAVIXElementCP@2@PEAPEAUHWND__@@@Z
?GetUnset@Value@DirectUI@@SAPEAV12@XZ
?GetAtomZero@Value@DirectUI@@SAPEAV12@XZ
?SetHandleEnterKey@XProvider@DirectUI@@IEAAX_N@Z
?GetClassInfoPtr@HWNDElement@DirectUI@@SAPEAUIClassInfo@2@XZ
?GetStringNull@Value@DirectUI@@SAPEAV12@XZ
?OnHosted@Combobox@DirectUI@@UEAAXPEAVElement@2@@Z
?Paint@Element@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z

duser

SetGadgetFocus

uxtheme

OpenThemeData
DrawThemeBackground
CloseThemeData
SetWindowTheme
IsThemeActive
GetThemeColor

wabsyncprovider

ord1

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 220KB - Virtual size: 216KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EAMProgressHandler.dll
.dll windows:10 windows x64 arch:x64

672b21e939ef41edd9ac92c8ffccf889

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

EAMProgressHandler.pdb

Imports

msvcrt

malloc
_initterm
_XcptFilter
free
_amsg_exit
__C_specific_handler
__CxxFrameHandler3
_lock
_callnewh
_itow_s
memmove
_vsnwprintf
_onexit
_unlock
_purecall
__dllonexit
memcpy_s
memcpy
memset

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleExW
GetModuleHandleExA
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleW

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive
AcquireSRWLockShared
CreateEventExW
AcquireSRWLockExclusive
SetEvent
WaitForMultipleObjectsEx
ReleaseSRWLockShared

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer
WindowsDuplicateString
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsCreateStringReference
WindowsCreateString
WindowsDeleteString

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler
CoWaitForMultipleHandles
CoGetApartmentType
CoTaskMemAlloc

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW
RoOriginateError

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
RaiseException

rpcrt4

UuidFromStringW

api-ms-win-core-winrt-l1-1-0

RoInitialize
RoUninitialize
RoActivateInstance
RoGetActivationFactory

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
RegDeleteTreeW
RegOpenCurrentUser
RegDeleteKeyExW

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 404B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ELSCore.dll
.dll windows:10 windows x64 arch:x64

fac06d7cf56dad67b79f54599ad1ba7b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

ElsCore.pdb

Imports

msvcrt

??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@XZ
_callnewh
__CxxFrameHandler3
_initterm
_errno
realloc
_lock
memmove
_CxxThrowException
memcpy
??0exception@@QEAA@AEBQEBDH@Z
?what@exception@@UEBAPEBDXZ
swscanf_s
wcsncpy_s
malloc
free
__dllonexit
_amsg_exit
_onexit
wcscpy_s
??1exception@@UEAA@XZ
??1type_info@@UEAA@XZ
memcpy_s
memset
memcmp
_unlock
_XcptFilter
_purecall
??3@YAXPEAX@Z
??_V@YAXPEAX@Z
__C_specific_handler
??0exception@@QEAA@AEBV0@@Z
wcscmp

ntdll

RtlCaptureContext
RtlInitUnicodeString
RtlGUIDFromString
RtlLookupFunctionEntry
RtlVirtualUnwind

oleaut32

VarUI4FromStr

api-ms-win-core-libraryloader-l1-2-0

LoadResource
LoadLibraryExW
GetProcAddress
SizeofResource
DisableThreadLibraryCalls
FreeLibrary
GetModuleHandleExW
GetModuleHandleW
GetModuleFileNameW
FindResourceExW

api-ms-win-core-localization-l1-2-0

LCMapStringW

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
InitOnceInitialize
Sleep

api-ms-win-core-synch-l1-1-0

InitializeSRWLock
LeaveCriticalSection
CreateEventW
InitializeCriticalSectionAndSpinCount
ReleaseSRWLockExclusive
SetEvent
AcquireSRWLockExclusive
InitializeCriticalSection
EnterCriticalSection
DeleteCriticalSection
WaitForSingleObject

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
CoUninitialize
CoInitializeEx

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegCreateKeyExW
RegLoadMUIStringW
RegOpenKeyExW
RegQueryValueExW
RegDeleteValueW

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-errorhandling-l1-1-0

RaiseException
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-file-l1-1-0

FindFirstFileW
FindClose
ReadFile
CreateFileW

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetExitCodeThread
CreateThread
GetCurrentProcessId
GetCurrentProcess
TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetSystemDirectoryW

api-ms-win-core-wow64-l1-1-1

GetSystemWow64DirectoryW

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-heap-l1-1-0

HeapReAlloc
HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem

api-ms-win-core-registry-l2-1-0

RegEnumKeyW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

Exports

Exports

MappingDoAction
MappingFreePropertyBag
MappingFreeServices
MappingGetServices
MappingRecognizeText

Sections

.text
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 780B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EapTeapAuth.dll
.dll windows:10 windows x64 arch:x64

d694e48cb310246a60f76cd55b06846b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

EapTeapAuth.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_abort
_o_ceilf
_o_free
_o_iswspace
_o_malloc
_o_terminate
_o_wcscpy_s
_o_wmemcpy_s
__C_specific_handler
__current_exception
__current_exception_context
_CxxThrowException
__CxxFrameHandler3
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___stdio_common_vswprintf_s
_o___std_exception_copy
_o___stdio_common_vswprintf
__std_terminate
_o___stdio_common_vsnprintf_s
__CxxFrameHandler4
memcpy

api-ms-win-crt-string-l1-1-0

memset

eapputil

EapConvertWireToHostFormat16
EapConvertHostToWireFormat32
EapConvertWireToHostFormat24
EapConvertHostToWireFormat16
EapConvertWireToHostFormat32
EapConvertHostToWireFormat24

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
FreeLibrary
GetModuleHandleExW
DisableThreadLibraryCalls
GetModuleHandleW
LoadStringW
GetProcAddress

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceBeginInitialize

api-ms-win-core-synch-l1-1-0

WaitForSingleObjectEx
CreateMutexExW
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
ReleaseMutex
OpenSemaphoreW

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
SetLastError
GetLastError
UnhandledExceptionFilter

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventUnregister
EventWriteTransfer
EventRegister

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList
InitializeSListHead

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo
RoFailFastWithErrorContext
RoOriginateErrorW
GetRestrictedErrorInfo

oleaut32

GetErrorInfo
SysStringLen
SetErrorInfo
SysFreeString
SysAllocString

api-ms-win-security-base-l1-1-0

RevertToSelf
GetTokenInformation
IsWellKnownSid
ImpersonateLoggedOnUser

api-ms-win-core-winrt-robuffer-l1-1-0

RoGetBufferMarshaler

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler
CoTaskMemAlloc

msvcp_win

?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

Exports

Exports

EapPeerFreeErrorMemory
EapPeerFreeMemory
EapPeerGetInfo

Sections

.text
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EapTeapConfig.dll
.dll windows:10 windows x64 arch:x64

7a977986b023404bcbd7511c5379b71b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

EapTeapConfig.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_abort
_o_free
_o_iswspace
_o_malloc
_o_realloc
_o_terminate
__C_specific_handler
_CxxThrowException
__CxxFrameHandler3
strchr
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset

eapputil

EapConvertWireToHostFormat32
EapConvertWireToHostFormat16
EapConvertHostToWireFormat32
EapConvertHostToWireFormat16

eappcfg

EapHostPeerConfigXml2Blob
EapHostPeerConfigBlob2Xml
EapHostPeerInvokeInteractiveUI
EapHostPeerFreeErrorMemory
EapHostPeerCredentialsXml2Blob
EapHostPeerFreeMemory

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
FreeLibrary
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
GetModuleFileNameA

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
InitOnceComplete

api-ms-win-core-synch-l1-1-0

CreateMutexExW
OpenSemaphoreW
ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreExW
WaitForSingleObjectEx
ReleaseMutex

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetLastError
SetUnhandledExceptionFilter

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWriteTransfer
EventSetInformation
EventUnregister

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-registry-l1-1-0

RegGetValueW

api-ms-win-core-winrt-error-l1-1-0

RoFailFastWithErrorContext
SetRestrictedErrorInfo
GetRestrictedErrorInfo

oleaut32

VariantCopy
GetErrorInfo
SysStringLen
SetErrorInfo
SysStringByteLen
VariantInit
SysFreeString
SysAllocString
VariantClear
SysAllocStringByteLen

api-ms-win-core-com-l1-1-0

CoCreateInstance

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

msvcp_win

?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?good@ios_base@std@@QEBA_NXZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
?is@?$ctype@G@std@@QEBA_NFG@Z
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??1_Locinfo@std@@QEAA@XZ
??1_Lockit@std@@QEAA@XZ
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
??0_Locinfo@std@@QEAA@PEBD@Z
??0_Lockit@std@@QEAA@H@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?id@?$ctype@G@std@@2V0locale@2@A
??Bid@locale@std@@QEAA_KXZ
?flags@ios_base@std@@QEBAHXZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?uncaught_exception@std@@YA_NXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
??1?$basic_istream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?width@ios_base@std@@QEBA_JXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?widen@?$ctype@G@std@@QEBAGD@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?id@?$collate@G@std@@2V0locale@2@A
?tolower@?$ctype@G@std@@QEBAGG@Z
_Wcsxfrm
_Wcscoll
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG0@Z
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
??0?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@H@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEAK@Z
?getline@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@PEAG_JG@Z
?gcount@?$basic_istream@GU?$char_traits@G@std@@@std@@QEBA_JXZ
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?clear@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
?fail@ios_base@std@@QEBA_NXZ
?setf@ios_base@std@@QEAAHHH@Z
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?eof@ios_base@std@@QEBA_NXZ
?_Xlength_error@std@@YAXPEBD@Z
?width@ios_base@std@@QEAA_J_J@Z
?_Xbad_alloc@std@@YAXXZ
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGXZ

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

Exports

Exports

EapPeerConfigBlob2Xml
EapPeerConfigXml2Blob
EapPeerCredentialsXml2Blob
EapPeerFreeErrorMemory
EapPeerFreeMemory
EapPeerGetMethodProperties
EapPeerGetNextPageGuid
EapPeerInvokeConfigUI
EapPeerInvokeInteractiveUI
EapPeerQueryInteractiveUIInputFields

Sections

.text
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 344B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EapTeapExt.dll
.dll windows:10 windows x64 arch:x64

70f25ccb43c9d3576c40fe13db66d00e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

eapteapext.pdb

Imports

msvcp_win

?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
?is@?$ctype@G@std@@QEBA_NFG@Z
?tolower@?$ctype@G@std@@QEBAGG@Z
?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
_Wcsxfrm
?_Xlength_error@std@@YAXPEBD@Z
?id@?$ctype@G@std@@2V0locale@2@A
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$collate@G@std@@2V0locale@2@A
?_Xbad_alloc@std@@YAXXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
_Wcscoll
??Bid@locale@std@@QEAA_KXZ
??1_Lockit@std@@QEAA@XZ

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o___stdio_common_vsnprintf_s
_o___stdio_common_vswprintf
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_free
_o_malloc
_o_realloc
_o_terminate
__C_specific_handler
_CxxThrowException
strchr
__std_terminate
__CxxFrameHandler4
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset

user32

GetWindowTextLengthW
CheckDlgButton
SetWindowLongPtrW
SendMessageW
EndDialog
SetWindowTextW
GetWindowLongPtrW
IsDlgButtonChecked
GetDlgItem
EnableWindow
DialogBoxParamW
GetWindowTextW

eappcfg

EapHostPeerGetMethods
EapHostPeerInvokeConfigUI
EapHostPeerFreeErrorMemory
EapHostPeerFreeMemory

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleW
GetModuleFileNameA

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceBeginInitialize

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
WaitForSingleObjectEx
OpenSemaphoreW
ReleaseMutex
CreateMutexExW

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventUnregister
EventWriteTransfer
EventRegister

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

crypt32

CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertVerifyTimeValidity
CertFreeCertificateContext
CertGetNameStringW
CertGetCertificateContextProperty

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-sysinfo-l1-1-0

GetSystemTime
GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

eapputil

EapConvertHostToWireFormat16
EapConvertWireToHostFormat16
EapConvertHostToWireFormat32
EapConvertWireToHostFormat32

Exports

Exports

TeapExt_EapPeerInvokeConfigUI
TtlsExt_FreeMemoryExt

Sections

.text
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EasPolicyManagerBrokerPS.dll
.dll windows:10 windows x64 arch:x64

c1c6d574282e8ed469656b3a86bdf270

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

EasPolicyManagerBrokerPS.pdb

Imports

rpcrt4

NdrDllCanUnloadNow
NdrOleFree
NdrOleAllocate
NdrDllGetClassObject

msvcrt

_XcptFilter
__C_specific_handler
_initterm
malloc
free
_amsg_exit

ntdll

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

Exports

Exports

DllCanUnloadNow
DllGetClassObject
GetProxyDllInfo

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EdgeContent.dll
.dll windows:10 windows x64 arch:x64

ee05f0f3755fe6b6d61e61a9b446886e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

EdgeContent.pdb

Imports

msvcp_win

?_Throw_C_error@std@@YAXH@Z
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_unlock
_Cnd_init_in_situ
_Cnd_destroy_in_situ
_Cnd_broadcast
_Cnd_wait
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
?_ReportUnobservedException@details@Concurrency@@YAXXZ
??0task_continuation_context@Concurrency@@AEAA@XZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?__ExceptionPtrToBool@@YA_NPEBX@Z
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
_Strxfrm
_Strcoll
?is@?$ctype@D@std@@QEBA_NFD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAHH@Z
??Bios_base@std@@QEBA_NXZ
?_Xinvalid_argument@std@@YAXPEBD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?good@ios_base@std@@QEBA_NXZ
?flags@ios_base@std@@QEBAHXZ
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?widen@?$ctype@G@std@@QEBAGD@Z
??Bid@locale@std@@QEAA_KXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
??1?$codecvt@GDU_Mbstatet@@@std@@MEAA@XZ
??0?$codecvt@GDU_Mbstatet@@@std@@QEAA@_K@Z
?out@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
_Wcscoll
_Wcsxfrm
?_Xbad_function_call@std@@YAXXZ
?id@?$ctype@_W@std@@2V0locale@2@A
?id@?$collate@_W@std@@2V0locale@2@A
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?pbase@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W0@Z
?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z
?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z
?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@J@Z
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGXZ
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ
?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WXZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG0@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?id@?$ctype@G@std@@2V0locale@2@A
?_Xout_of_range@std@@YAXPEBD@Z
?uncaught_exception@std@@YA_NXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z
?setf@ios_base@std@@QEAAHHH@Z
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?widen@?$ctype@_W@std@@QEBA_WD@Z
?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z
?tolower@?$ctype@_W@std@@QEBA_W_W@Z
?is@?$ctype@_W@std@@QEBA_NF_W@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_Xbad_alloc@std@@YAXXZ

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
_o__stricmp
_o__strnicmp
_o__ultow_s
_o__wcsicmp
_o__wcsnicmp
_o__wcstoui64
_o__wtof
_o__wtoi
_o__wtoi64
_o__wtol
_o_abort
_o_bsearch_s
_o_ceil
_o_ceilf
_o_floor
_o_fputs
_o_free
_o_isalpha
_o_isdigit
_o_isspace
_o_iswalpha
_o_iswascii
_o_iswspace
_o_isxdigit
memchr
_o_malloc
_o_memcpy_s
_o_realloc
_o_strtol
_o_strtoull
_o_terminate
_o_towlower
_o_towupper
_o_wcscat_s
_o_wcscpy
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstod
_o_wcstok_s
_o_wcstol
_o_wcstoul
_o_wmemcpy_s
__C_specific_handler
__current_exception
__current_exception_context
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__itow_s
__std_type_info_compare
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
memcmp
wcsstr
wcschr
memcpy
wcsrchr
memmove
strchr
_o__cexit
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___stdio_common_vfwprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o___acrt_iob_func
_o____lc_codepage_func
__std_terminate
__CxxFrameHandler4
_CxxThrowException

api-ms-win-crt-string-l1-1-0

strncmp
wcslen
wcsncmp
strlen
wcscmp
memset
strcmp
wcsnlen

iertutil

ord792
ord795
ord61
ord102
ord793
ord58
ord79
ord64
ord791
ord97
ord231
ord59
ord820
CreateIUriBuilder
ord301
ord49
ord144
ord854
ord688
ord595
ord232
ord796
ord870
ord85
ord100
ord70
ord63
ord794
ord851
ord74
ord76
ord852
ord67
ord134
ord65
ord89
ord398
ord681
ord88
ord86
ord45
ord68
ord32
ord690
ord81
ord62
ord57
ord302
ord140
CreateUri
ord80
ord78
ord314
ord312
ord311
ord66
ord87
ord91
ord597
ord56
ord855
ord685
ord138
ord656
ord661
ord651
ord655
ord650
ord658
ord652
ord654
ord172
ord82
ord594
ord77
IntlPercentEncodeNormalize

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo
RoTransformError
RoOriginateError
RoOriginateErrorW
GetRestrictedErrorInfo

api-ms-win-core-winrt-error-l1-1-1

IsErrorPropagationEnabled
RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoUninitialize
RoInitialize
RoGetActivationFactory

api-ms-win-downlevel-advapi32-l1-1-0

RegOpenKeyExW
RegCloseKey
EventWriteTransfer
RegCreateKeyExW
RegQueryValueExW
RegGetValueW
OpenProcessToken
RevertToSelf
RegEnumKeyExW
RegDeleteTreeW
RegQueryInfoKeyW
ImpersonateLoggedOnUser
GetTokenInformation
RegSetValueExW
TraceMessageVa
AddAccessAllowedAce
GetLengthSid
InitializeAcl
IsValidSid
CheckTokenMembership
OpenThreadToken
EventWriteEx
EventRegister
EventUnregister
DuplicateToken

api-ms-win-core-kernel32-legacy-l1-1-0

RaiseFailFastException
WTSGetActiveConsoleSessionId
LoadLibraryW
WaitForMultipleObjects
FindResourceW

ntdll

NtUpdateWnfStateData
RtlGetSuiteMask
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
NtQueryWnfStateData
RtlIpv6AddressToStringW
RtlIpv4AddressToStringW
RtlCompareMemory
NtSetThreadExecutionState
RtlGetVersion
RtlGetDeviceFamilyInfoEnum
RtlQueryTokenHostIdAsUlong64
NtQueryInformationProcess

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleW
FreeLibrary
GetModuleFileNameA
LoadLibraryExA
DisableThreadLibraryCalls
GetModuleFileNameW
GetModuleHandleExW
LoadLibraryExW
SizeofResource
GetModuleHandleExA
LockResource
LoadResource

api-ms-win-core-synch-l1-1-0

WaitForMultipleObjectsEx
CreateEventExW
CreateMutexW
OpenEventW
ReleaseSRWLockExclusive
DeleteCriticalSection
CreateSemaphoreExW
InitializeCriticalSectionAndSpinCount
ReleaseSemaphore
CreateMutexExW
InitializeCriticalSectionEx
WaitForSingleObject
OpenSemaphoreW
CreateEventW
InitializeSRWLock
SetEvent
LeaveCriticalSection
AcquireSRWLockExclusive
ReleaseMutex
ReleaseSRWLockShared
WaitForSingleObjectEx
InitializeCriticalSection
EnterCriticalSection
AcquireSRWLockShared
ResetEvent

api-ms-win-core-heap-l1-1-0

HeapFree
HeapSize
HeapSetInformation
HeapAlloc
HeapReAlloc
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-processthreads-l1-1-0

TlsFree
TlsSetValue
CreateThread
GetCurrentProcess
GetThreadPriority
GetCurrentProcessId
GetProcessId
TlsAlloc
GetCurrentThread
OpenThread
SetThreadPriority
SetProcessShutdownParameters
TerminateProcess
GetCurrentThreadId
TlsGetValue

api-ms-win-eventing-provider-l1-1-0

EventSetInformation

api-ms-win-core-localization-l1-2-0

FormatMessageA
LocaleNameToLCID
GetLocaleInfoEx
ResolveLocaleName
GetLocaleInfoW
FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringA
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
WakeConditionVariable
InitOnceExecuteOnce
Sleep
InitOnceComplete
InitializeConditionVariable
SleepConditionVariableCS

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolWorkCallbacks
CloseThreadpoolWork
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SubmitThreadpoolWork
CreateThreadpoolTimer
CloseThreadpool
CreateThreadpoolWork
CreateThreadpoolCleanupGroup
TrySubmitThreadpoolCallback
SetThreadpoolThreadMaximum
CloseThreadpoolCleanupGroupMembers
SetThreadpoolTimer
CloseThreadpoolCleanupGroup
CreateThreadpool

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-processthreads-l1-1-1

OpenProcess
GetProcessMitigationPolicy
IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW
GetTickCount64
GetTickCount
GetSystemTime
GetLogicalProcessorInformation
GetVersionExW
GetComputerNameExW
GetSystemInfo
GetLocalTime
GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
CompareStringEx
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-processthreads-l1-1-3

SetProcessInformation
SetThreadDescription

api-ms-win-core-memory-l1-1-0

VirtualProtect
OpenFileMappingW
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
VirtualAlloc
VirtualQuery

windows.storage

SHGetKnownFolderPath
SHGetInstanceExplorer
SHGetSpecialFolderPathW

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient14
ObjectStublessClient12
ObjectStublessClient11
ObjectStublessClient3
ObjectStublessClient7
ObjectStublessClient13
ObjectStublessClient25
ObjectStublessClient24
ObjectStublessClient21
ObjectStublessClient29
ObjectStublessClient16
ObjectStublessClient30
ObjectStublessClient17
ObjectStublessClient26
ObjectStublessClient19
ObjectStublessClient23
ObjectStublessClient15
ObjectStublessClient20
ObjectStublessClient28
ObjectStublessClient18
ObjectStublessClient27
ObjectStublessClient22
ObjectStublessClient31
NdrProxyForwardingFunction7
NdrProxyForwardingFunction9
NdrProxyForwardingFunction10
NdrProxyForwardingFunction5
NdrProxyForwardingFunction11
NdrProxyForwardingFunction6
NdrProxyForwardingFunction8
NdrProxyForwardingFunction3
NdrProxyForwardingFunction4
ObjectStublessClient4
ObjectStublessClient10
ObjectStublessClient9
ObjectStublessClient8
ObjectStublessClient6
ObjectStublessClient5

api-ms-win-core-url-l1-1-0

UrlUnescapeW
GetAcceptLanguagesW
PathCreateFromUrlW
UrlEscapeW
UrlCanonicalizeA
UrlIsW
ParseURLW
UrlCanonicalizeW
UrlApplySchemeW

api-ms-win-core-windowserrorreporting-l1-1-1

WerRegisterCustomMetadata
WerRegisterAdditionalProcess

api-ms-win-core-windowserrorreporting-l1-1-0

WerSetFlags
WerUnregisterRuntimeExceptionModule
WerRegisterRuntimeExceptionModule

api-ms-win-core-job-l2-1-0

QueryInformationJobObject
CreateJobObjectW
AssignProcessToJobObject
SetInformationJobObject

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-downlevel-shlwapi-l2-1-0

SHStrDupW
IStream_Write
IStream_WriteStr
IStream_Reset
SHCreateStreamOnFileEx
IStream_Size
IStream_Read
SHCreateMemStream
SHGetValueW

api-ms-win-downlevel-user32-l1-1-0

CharLowerW

api-ms-win-core-kernel32-legacy-l1-1-1

PowerSetRequest
PowerClearRequest
PowerCreateRequest

api-ms-win-core-heap-obsolete-l1-1-0

LocalReAlloc
GlobalFree
GlobalAlloc
LocalAlloc
GlobalUnlock
GlobalLock
LocalFree

api-ms-win-core-localization-obsolete-l1-2-0

EnumUILanguagesW
GetUserDefaultUILanguage
GetSystemDefaultLocaleName

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpA

api-ms-win-core-file-l1-1-0

GetTempFileNameW
GetFileSize
FileTimeToLocalFileTime
FindNextFileW
WriteFile
SetFilePointerEx
GetFileAttributesW
LocalFileTimeToFileTime
FindFirstFileW
CompareFileTime
GetFileTime
CreateFileW
GetDriveTypeW
DeleteFileW
RemoveDirectoryW
FindClose
ReadFile
SetFilePointer
CreateDirectoryW
GetFullPathNameW
GetFileSizeEx
GetLongPathNameW

api-ms-win-core-file-l1-2-0

GetTempPathW
CreateFile2

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW
GetCurrentDirectoryW
SetEnvironmentVariableW

api-ms-win-core-path-l1-1-0

PathAllocCombine
PathCchAppend
PathCchRemoveBackslash
PathCchAddBackslash
PathCchCombine
PathCchCanonicalize

api-ms-win-core-file-l2-1-0

CopyFile2

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-sysinfo-l1-2-0

GetProductInfo
GetNativeSystemInfo

api-ms-win-core-io-l1-1-0

CreateIoCompletionPort
CancelIoEx
GetOverlappedResult
GetQueuedCompletionStatus

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-security-base-l1-2-0

CheckTokenCapability

api-ms-win-core-psapi-l1-1-0

K32GetProcessImageFileNameW
K32GetProcessMemoryInfo
K32EnumProcesses

api-ms-win-core-io-l1-1-1

CancelIo

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
IEGetWriteableFolderPath
IEIsInPrivateBrowsing
IEIsProtectedModeProcess
IERefreshElevationPolicy

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 948KB - Virtual size: 945KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 124KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ssm_url
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 88KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EdgeManager.dll
.dll regsvr32 windows:10 windows x64 arch:x64

c07142c5af2d8b71776c1999794146a4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

edgemanager.pdb

Imports

msvcp_win

??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@PEBX@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@K@Z
??0_Lockit@std@@QEAA@H@Z
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGXZ
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
??1_Lockit@std@@QEAA@XZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?width@ios_base@std@@QEAA_J_J@Z
?uncaught_exception@std@@YA_NXZ
?id@?$ctype@G@std@@2V0locale@2@A
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?in@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z
??0?$codecvt@GDU_Mbstatet@@@std@@QEAA@_K@Z
??1?$codecvt@GDU_Mbstatet@@@std@@MEAA@XZ
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?width@ios_base@std@@QEBA_JXZ
?flags@ios_base@std@@QEBAHXZ
?good@ios_base@std@@QEBA_NXZ
?_Xbad_function_call@std@@YAXXZ
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?widen@?$ctype@G@std@@QEBAGD@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG0@Z
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
??Bid@locale@std@@QEAA_KXZ
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?_Xout_of_range@std@@YAXPEBD@Z
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-crt-string-l1-1-0

wcscmp
memset
wcspbrk

api-ms-win-crt-math-l1-1-0

_finite

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__itow_s
_o__ltow_s
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wtof
_o__wtol
_o_ceilf
_o_floor
_o_free
_o_isalpha
_o_isdigit
_o_isxdigit
_o_malloc
_o_realloc
_o_strtol
_o_terminate
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstod
_o_wcstok_s
_o_wcstol
_o_wmemcpy_s
wcschr
wcsstr
__CxxFrameHandler3
__current_exception
__current_exception_context
_o__configure_narrow_argv
_CxxThrowException
memcpy
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__execute_onexit_table
_o__errno
__std_terminate
__C_specific_handler
__CxxFrameHandler4
_o__crt_atexit
__C_specific_handler_noexcept
memcmp

dcomp

ord1038

iertutil

ord650
ord799
ord870
ord902
ord597
ord398
ord594
CreateUri
ord797
ord301
ord791
ord795
ord793
ord140
ord300
ord144
ord792
ord794
ord305

urlmon

UrlMkGetSessionOption
CoInternetCombineUrl

api-ms-win-core-localregistry-l1-1-0

RegOpenKeyExW
RegSetValueExW
RegGetValueW
RegCloseKey
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumKeyExW
RegDeleteValueW

api-ms-win-rtcore-ntuser-synch-l1-1-0

MsgWaitForMultipleObjectsEx

api-ms-win-rtcore-ntuser-window-l1-1-0

GetWindowThreadProcessId
GetWindowLongPtrW
SetWindowLongPtrW
SendMessageTimeoutW
DefWindowProcW
DestroyWindow
PostThreadMessageW
RegisterWindowMessageW
GetMessageW
PostMessageW
CreateWindowExW
RegisterClassExW
SendMessageW
IsWindow
RemovePropW
SetPropW
DispatchMessageW
TranslateMessage
PostQuitMessage
PeekMessageW

api-ms-win-appmodel-runtime-l1-1-0

GetCurrentPackageFamilyName
GetCurrentApplicationUserModelId

oleaut32

SysStringLen
SafeArrayAccessData
SafeArrayUnaccessData
VariantInit
SafeArrayGetLBound
SafeArrayGetUBound
SysAllocStringLen
BSTR_UserSize
BSTR_UserFree
BSTR_UserUnmarshal64
UnRegisterTypeLi
BSTR_UserUnmarshal
LoadTypeLi
SysFreeString
BSTR_UserMarshal
RegisterTypeLi
SysAllocString
SafeArrayCreate
BSTR_UserMarshal64
BSTR_UserSize64
BSTR_UserFree64
VarUI4FromStr

api-ms-win-core-libraryloader-l1-2-0

LockResource
FindResourceExW
LoadResource
LoadStringW
GetModuleHandleW
FreeLibrary
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleExW
GetProcAddress
SizeofResource
GetModuleFileNameA
GetModuleHandleExA

api-ms-win-core-synch-l1-2-0

WakeByAddressAll
WaitOnAddress
InitOnceExecuteOnce

api-ms-win-core-heap-l1-1-0

HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc
HeapSize
HeapDestroy

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer
WindowsCreateStringReference
WindowsDeleteString
WindowsDuplicateString
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsCreateString
WindowsCompareStringOrdinal
WindowsGetStringLen

api-ms-win-core-synch-l1-1-0

InitializeSRWLock
SetEvent
CreateEventExW
CreateEventW
WaitForMultipleObjectsEx
InitializeCriticalSectionEx
DeleteCriticalSection
OpenSemaphoreW
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CreateSemaphoreExW
OpenEventW
TryEnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
ReleaseSemaphore
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
AcquireSRWLockShared
WaitForSingleObjectEx
ReleaseMutex
CreateMutexExW
ResetEvent

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventUnregister
EventWriteEx
EventRegister

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentProcess
OpenProcessToken
CreateThread
TerminateProcess
GetCurrentThreadId

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringOrdinal

api-ms-win-core-localization-l1-2-0

LCMapStringEx
FormatMessageW

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
GetLastError
SetLastError

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetTickCount64

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-heap-obsolete-l1-1-0

GlobalSize
GlobalUnlock
GlobalLock

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoGetActivationFactory

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW
ExpandEnvironmentStringsW

api-ms-win-core-file-l1-1-0

CreateDirectoryW
ReadFile
CreateFileW

ntdll

RtlNtStatusToDosError
NtQueryInformationProcess
ZwQueryWnfStateData

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent
OpenProcess

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrCmpNICW
StrCmpICW
StrCmpCW

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW

api-ms-win-security-base-l1-2-0

CheckTokenCapability

api-ms-win-security-base-l1-1-0

GetLengthSid
GetTokenInformation
CopySid

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolAllowThreadReuse
SHTaskPoolQueueTask

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW
FindResourceW

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
CloseThreadpoolWork
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CloseThreadpoolTimer

api-ms-win-core-namespace-l1-1-0

CreateBoundaryDescriptorW
CreatePrivateNamespaceW
OpenPrivateNamespaceW
DeleteBoundaryDescriptor
ClosePrivateNamespace

api-ms-win-core-toolhelp-l1-1-0

Process32FirstW
CreateToolhelp32Snapshot
Process32NextW

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

shcore

ord233
SHCreateMemStream
ord230
ord232

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

CreateCoreWebViewComponentAndUninitializedCoreWebViewComponentCallbackForWebInstance
CreateCoreWebViewControl
CreateCoreWebViewHostProcess
CreateCoreWebViewOOP
CreateEdgeIsoSession
CreateWebRuntimeDebugTargetClient
CreateWebRuntimeDebugTargetManager
CreateWebRuntimeDiagnosticsTarget
CreateWebViewControlAcceleratorKeyPressedEventArgs
CreateWebViewControlAndInitializeCoreWebViewComponentCallback
CreateWebViewControlMoveFocusRequestedEventArgs
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
EnsureServiceWorkerEnvironmentForWebView
EnsureWebDriverForWebViewHost
GetProxyDllInfo
GetWebDriverHostInstance

Sections

.text
Size: 664KB - Virtual size: 661KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 212KB - Virtual size: 209KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EdgeResetPlugin.dll
.dll windows:10 windows x64 arch:x64

8f67ce5442562fe7130009d80220c430

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

PDB Paths

EdgeResetPlugin.pdb

Imports

msvcrt

_wcsnicmp
isdigit
wcsstr
_wcsicmp
wcschr
wcsncmp
memcpy_s
_onexit
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
malloc
free
__C_specific_handler
vswprintf_s
_vscwprintf
wcsrchr
memmove_s
memset

ntdll

RtlAllocateHeap
RtlNtStatusToDosError
NtSetInformationFile
RtlFreeHeap
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

advapi32

RegGetValueW
RegCreateKeyW
RegEnumKeyExW
RegSetValueExW
RegEnumValueW
RegLoadAppKeyW
AdjustTokenPrivileges
OpenProcessToken
RegUnLoadKeyW
RegCloseKey
RegOpenKeyExW
RegLoadKeyW

kernel32

GetProcAddress
CreateDirectoryW
RaiseException
SizeofResource
LockResource
LoadResource
FindResourceExW
GetFullPathNameW
GetLongPathNameW
GetLastError
WideCharToMultiByte
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
HeapDestroy
SetFileInformationByHandle
GetFinalPathNameByHandleW
MultiByteToWideChar
Sleep
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
CompareStringW
GetFileAttributesW
CreateFileW
DeviceIoControl
GetFileInformationByHandleEx
CopyFileW
DeleteFileW
FindFirstFileW
FindNextFileW
FindClose
CreateHardLinkW
SetLastError
GetModuleHandleW
GetFileInformationByHandle
CloseHandle

user32

UnregisterClassA

oleaut32

SysAllocString
SysFreeString

wdscore

ConstructPartialMsgVW
CurrentIP
WdsSetupLogMessageW
WdsInitialize
WdsTerminate

Exports

Exports

Reset_Edge

Sections

.text
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EditBufferTestHook.dll
.dll windows:10 windows x64 arch:x64

305fe82001f625c3963f0278afa61753

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

EditBufferTestHook.pdb

Imports

msvcrt

??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@XZ
_callnewh
_ismbblead
_errno
__C_specific_handler
_initterm
_amsg_exit
__crtLCMapStringW
??1type_info@@UEAA@XZ
_XcptFilter
___mb_cur_max_func
calloc
___lc_codepage_func
___lc_handle_func
__uncaught_exception
abort
?terminate@@YAXXZ
_vsnwprintf
_vsnprintf_s
__dllonexit
memmove_s
_onexit
__pctype_func
memmove
memcmp
memcpy
__CxxFrameHandler3
_CxxThrowException
__CxxFrameHandler4
setlocale
_unlock
_lock
_beginthreadex
_wcsdup
?what@exception@@UEBAPEBDXZ
memcpy_s
_purecall
??1bad_cast@@UEAA@XZ
??0bad_cast@@QEAA@AEBV0@@Z
??0bad_cast@@QEAA@PEBD@Z
strcspn
malloc
sprintf_s
localeconv
_wsetlocale
??0exception@@QEAA@AEBV0@@Z
free
??1exception@@UEAA@XZ
memset
??0exception@@QEAA@AEBQEBD@Z
??_V@YAXPEAX@Z
??3@YAXPEAX@Z

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventSetInformation
EventWriteTransfer

api-ms-win-core-errorhandling-l1-1-3

TerminateProcessOnMemoryExhaustion

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter

api-ms-win-core-synch-l1-1-0

OpenSemaphoreW
ReleaseSRWLockShared
ReleaseMutex
CreateSemaphoreExW
WaitForSingleObjectEx
EnterCriticalSection
CreateMutexExW
AcquireSRWLockShared
AcquireSRWLockExclusive
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
DeleteCriticalSection
LeaveCriticalSection
CreateEventW
WaitForSingleObject
SetEvent
ReleaseSemaphore

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegSetValueExW
RegCloseKey
RegQueryValueExW

api-ms-win-core-string-l1-1-0

GetStringTypeW
WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
InitOnceComplete
Sleep

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

coremessaging

CoreUICreate

coreuicomponents

CoreUIFactoryCreate
CoreUIClientCreate

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleFileNameA
GetModuleHandleExW
GetModuleHandleW

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks

Exports

Exports

CreateEditBufferTestHook
CreateEditBufferTestHookClient
EnableTestHook
GetTestHookEnabled

Sections

.text
Size: 80KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EditionUpgradeHelper.dll
.dll windows:10 windows x64 arch:x64

fd0a481bd2975b2b442f3ee005cf9f95

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

47:a8:b3:7f:46:f3:1b:59:ba:14:f8:55:97:f5:0b:4a:3f:dd:19:c2:c9:66:68:18:6a:19:bc:3f:fa:d1:47:69
Signer

Actual PE Digest

47:a8:b3:7f:46:f3:1b:59:ba:14:f8:55:97:f5:0b:4a:3f:dd:19:c2:c9:66:68:18:6a:19:bc:3f:fa:d1:47:69

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

EditionUpgradeHelper.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memcpy
_o__configure_narrow_argv
_o_free
_o_malloc
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o__cexit
_o___stdio_common_vswprintf
_o__callnewh
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy

api-ms-win-crt-string-l1-1-0

memset
wcscmp

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetModuleHandleW
GetProcAddress
GetModuleFileNameA

api-ms-win-core-synch-l1-1-0

ReleaseMutex
CreateMutexExW
WaitForSingleObject
ReleaseSemaphore
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
AcquireSRWLockExclusive
CreateSemaphoreExW

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
RaiseException
SetUnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

oleaut32

SysAllocString
SysFreeString

api-ms-win-core-com-l1-1-0

StringFromGUID2
CoInitializeEx
CoUninitialize
CoCreateInstance

api-ms-win-core-winrt-string-l1-1-0

WindowsIsStringEmpty
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsStringHasEmbeddedNull

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventWriteTransfer
EventActivityIdControl
EventSetInformation

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW
RoOriginateError

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW
GetSystemTimeAsFileTime

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

shell32

ShellExecuteExW

ole32

CoGetObject

wldp

WldpQueryWindowsLockdownMode

kernel32

GetModuleFileNameW
GetProcessMitigationPolicy
LocalAlloc
FreeLibrary

user32

MessageBoxW

clipc

ClipGetLicenseAndPolicyForPfn

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 164KB - Virtual size: 163KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 508B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EditionUpgradeManagerObj.dll
.dll regsvr32 windows:10 windows x64 arch:x64

33e446093f5d355d732c779e351caa24

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8f:94:90:4a:c9:31:2d:db:10:73:d6:5d:a8:6d:af:4e:3c:99:3a:07:e8:15:d1:4d:f3:cf:19:91:0b:39:97:4c
Signer

Actual PE Digest

8f:94:90:4a:c9:31:2d:db:10:73:d6:5d:a8:6d:af:4e:3c:99:3a:07:e8:15:d1:4d:f3:cf:19:91:0b:39:97:4c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

EditionUpgradeManagerObj.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsicmp
_o_free
_o_malloc
_o_towupper
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o___stdio_common_vswprintf
wcschr
_o__cexit
_o__callnewh
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

wcscmp
memset

api-ms-win-core-libraryloader-l1-2-0

FreeLibraryAndExitThread
GetModuleFileNameA
GetModuleFileNameW
FreeLibrary
LoadLibraryExW
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
LockResource
LoadResource
FindResourceExW
DisableThreadLibraryCalls

api-ms-win-core-synch-l1-1-0

ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreExW
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
ReleaseMutex
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
DeleteCriticalSection
CreateEventExW
CreateEventW
SetEvent

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
GetLastError
RaiseException

api-ms-win-core-processthreads-l1-1-0

CreateThread
TerminateProcess
CreateProcessW
GetCurrentProcessId
SetThreadPriority
GetThreadId
GetCurrentProcess
GetCurrentThreadId
OpenProcessToken
GetExitCodeProcess
GetCurrentThread

api-ms-win-core-localization-l1-2-0

LCMapStringEx
FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl
EventRegister
EventSetInformation
EventUnregister
EventWriteTransfer

api-ms-win-core-winrt-l1-1-0

RoUninitialize
RoInitialize
RoGetActivationFactory

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
CoWaitForMultipleHandles

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError
SetRestrictedErrorInfo

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo

api-ms-win-core-memory-l1-1-0

VirtualQuery

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegCloseKey
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryInfoKeyW

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-security-base-l1-1-0

AdjustTokenPrivileges

api-ms-win-core-shutdown-l1-1-0

InitiateSystemShutdownExW

oleaut32

LoadTypeLi
RegisterTypeLi
UnRegisterTypeLi

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW
GetLocalTime
GetSystemTimeAsFileTime

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-file-l1-1-0

SetFilePointer
CreateFileW
WriteFile
CreateDirectoryW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

rpcrt4

UuidToStringW
RpcStringFreeW

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer
WindowsCreateStringReference
WindowsCreateString
WindowsDeleteString

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW
RegEnumKeyW

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

shell32

SHCreateItemInKnownFolder
SHGetIDListFromObject
ShellExecuteExW

ext-ms-win-branding-winbrand-l1-1-0

BrandingFormatString

dui70

?GetRoot@Element@DirectUI@@QEAAPEAV12@XZ
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJIPEAUHINSTANCE__@@0@Z
?CreateElement@DUIXmlParser@DirectUI@@QEAAJPEBGPEAVElement@2@1PEAKPEAPEAV32@@Z
?SetEnabled@Element@DirectUI@@QEAAJ_N@Z
?Destroy@DUIXmlParser@DirectUI@@QEAAXXZ
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z
?SetContentString@Element@DirectUI@@QEAAJPEBG@Z
?SetLayoutPos@Element@DirectUI@@QEAAJH@Z
StrToID
?Create@DUIXmlParser@DirectUI@@SAJPEAPEAV12@P6APEAVValue@2@PEBGPEAX@Z2P6AX11H2@Z2@Z

slc

SLOpen
SLConsumeRight
SLClose

windows.ui.immersive

ord100

kernel32

GetProcessMitigationPolicy
PackageNameAndPublisherIdFromFamilyName

user32

DispatchMessageW
PostQuitMessage
PeekMessageW
TranslateMessage
GetMessageW
PostMessageW
MsgWaitForMultipleObjects
PostThreadMessageW

pkeyhelper

GetProductKeyFromContentId

api-ms-win-security-cryptoapi-l1-1-0

CryptHashData
CryptCreateHash
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.imrsiv
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 68KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EhStorAPI.dll
.dll regsvr32 windows:10 windows x64 arch:x64

6b705af1e4a882c330cc1afa25f71fcc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

EhStorapi.pdb

Imports

msvcrt

memcpy_s
mbstowcs
free
__C_specific_handler
memmove_s
calloc
_wcsicmp
wcsrchr
wcsncpy_s
_purecall
_callnewh
_XcptFilter
_amsg_exit
_initterm
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_errno
realloc
_lock
_unlock
__dllonexit
_onexit
memcpy
malloc
__CxxFrameHandler4
_CxxThrowException
memset

user32

UnregisterClassA
AllowSetForegroundWindow
CharNextW

advapi32

RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
CreateProcessAsUserW
GetUserNameW
TraceMessage

kernel32

HeapDestroy
GetProcessHeap
HeapFree
HeapReAlloc
HeapSize
DisableThreadLibraryCalls
FindResourceExW
LoadResource
SizeofResource
MultiByteToWideChar
EnterCriticalSection
Sleep
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA
HeapAlloc
GetProcAddress
DeleteCriticalSection
CreateFileW
GetLastError
DeviceIoControl
CloseHandle
InitializeCriticalSection
SetEnvironmentVariableW
ExpandEnvironmentStringsW
WTSGetActiveConsoleSessionId
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
GetModuleFileNameW
FreeLibrary
RaiseException
LoadLibraryExW
GetModuleHandleW
lstrcmpiW
LeaveCriticalSection

oleaut32

VarUI4FromStr

setupapi

SetupDiGetClassDevsExW
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiDestroyDeviceInfoList
SetupDiCreateDeviceInfoList
SetupDiOpenDeviceInterfaceW
SetupDiGetDeviceInterfaceAlias
SetupDiGetClassDevsW
SetupDiGetCustomDevicePropertyW

shlwapi

ord487

wtsapi32

WTSQueryUserToken

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 60KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 364B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EhStorPwdMgr.dll
.dll windows:10 windows x64 arch:x64

e0b4f95716fbd7f7b80e6b58f5590169

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

EhStorPwdMgr.pdb

Imports

msvcrt

__CxxFrameHandler4
__C_specific_handler
_initterm
malloc
_amsg_exit
_XcptFilter
free
iswalpha
_wcsicmp
wcschr
_vsnwprintf
?terminate@@YAXXZ
memset

kernel32

DisableThreadLibraryCalls
GetLastError
CloseHandle
CreateEventW
WaitForSingleObject
Sleep
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
LocalFree
GetTickCount
LocalAlloc
WideCharToMultiByte
GetCommandLineW
CreateFileW
GetSystemTimeAsFileTime

user32

SetForegroundWindow
SetFocus
GetWindowTextW
LoadStringW
GetParent
SetWindowTextW
GetWindowLongPtrW
FindWindowExW
PostMessageW
KillTimer
SetTimer
ShowWindow
SendMessageW
SetWindowLongPtrW
GetDlgItem
SendDlgItemMessageW
EnableWindow

ole32

CoCreateInstance
CoInitializeEx
CoTaskMemFree
CoTaskMemAlloc

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
GetTraceLoggerHandle
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
TraceMessage

comctl32

ord344
CreatePropertySheetPageW
PropertySheetW
ord17

oleaut32

SysFreeString
SysAllocString

shell32

CommandLineToArgvW

ntdll

WinSqmAddToStream

Exports

Exports

DllMain
EnhancedStoragePasswordConfig
EnhancedStoragePasswordInitDisk

Sections

.text
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 72KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EhStorShell.dll
.dll regsvr32 windows:10 windows x64 arch:x64

8a90341b5906e05e7ed6ffb90f5bf7f9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

EhStorShell.pdb

Imports

msvcrt

?terminate@@YAXXZ
realloc
_initterm
memcmp
_CxxThrowException
??1type_info@@UEAA@XZ
_amsg_exit
_XcptFilter
_callnewh
memmove_s
calloc
toupper
_lock
_unlock
__dllonexit
_onexit
memcpy
__CxxFrameHandler4
_vsnwprintf
wcsncpy_s
malloc
free
_purecall
memcpy_s
__C_specific_handler
_errno
memset

kernel32

GetTickCount
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
SizeofResource
GetModuleFileNameW
InitializeCriticalSection
MultiByteToWideChar
GetLastError
RaiseException
FindResourceExW
LoadResource
GetProcAddress
DeleteCriticalSection
GetModuleHandleW
FreeLibrary
lstrcmpiW
LoadLibraryExW
CompareStringW
EnterCriticalSection
LeaveCriticalSection
GetLogicalDrives
GetDriveTypeW
CompareStringOrdinal
DisableThreadLibraryCalls
Sleep
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
OutputDebugStringA

user32

InsertMenuW
UnregisterClassA
CharNextW
LoadStringW
SetMenuDefaultItem

ole32

PropVariantClear
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CoGetMalloc
CoCreateInstance

oleaut32

VariantClear
VarUI4FromStr
SysAllocString
VariantInit

advapi32

RegQueryInfoKeyW
RegCloseKey
TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
UnregisterTraceGuids
RegCreateKeyExW

shell32

SHCreateItemFromIDList
SHGetIDListFromObject
SHCreateDefaultExtractIcon
ord18
ord155

propsys

PSCreateMemoryPropertyStore
PSGetPropertyFromPropertyStorage
PropVariantToStrRet
PropVariantToString
PropVariantCompareEx
PropVariantToVariant
InitVariantFromBuffer

shlwapi

ord219
ord158
ord176
SHStrDupW
ord199

comctl32

ord17

setupapi

SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsExW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 136KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 560B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EmailApis.dll
.dll windows:10 windows x64 arch:x64

9517f8e049c5a1b82f7c4673e66dbf0e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

EmailApis.pdb

Imports

msvcrt

memcmp
_onexit
__dllonexit
memcpy
__CxxFrameHandler3
memmove
__C_specific_handler
_lock
_errno
_initterm
_amsg_exit
_XcptFilter
_callnewh
wcstoul
wcschr
wcsncmp
_vscwprintf
_vsnwprintf_s
memmove_s
realloc
_vsnwprintf
_purecall
wcsncpy_s
malloc
free
memcpy_s
_unlock
memset

api-ms-win-core-libraryloader-l1-2-0

FindResourceExW
LoadResource
DisableThreadLibraryCalls
SizeofResource
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
FreeLibrary
GetProcAddress
LoadLibraryExW

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
InitOnceComplete
Sleep
InitOnceExecuteOnce

api-ms-win-core-synch-l1-1-0

ReleaseMutex
ReleaseSRWLockShared
WaitForSingleObjectEx
CreateEventExW
CreateEventW
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeSRWLock
InitializeCriticalSectionEx
DeleteCriticalSection
ReleaseSemaphore
OpenSemaphoreW
SetEvent
ReleaseSRWLockExclusive
CreateSemaphoreExW
WaitForSingleObject
AcquireSRWLockShared
InitializeCriticalSection
CreateMutexExW

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegQueryInfoKeyW
RegDeleteValueW
RegCloseKey
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl
EventSetInformation
EventUnregister
EventRegister
EventWriteTransfer

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-errorhandling-l1-1-0

GetLastError
RaiseException
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
TerminateProcess
SetThreadToken
GetCurrentProcess
OpenProcessToken
GetCurrentThread
OpenThreadToken
GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetTickCount64

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolWait
FreeLibraryWhenCallbackReturns
CloseThreadpoolWork
CreateThreadpoolWork
CloseThreadpoolWait
SubmitThreadpoolWork
WaitForThreadpoolWaitCallbacks
CreateThreadpoolWait

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-url-l1-1-0

UrlEscapeW
UrlUnescapeW

api-ms-win-core-file-l1-1-0

SetFileInformationByHandle
GetTempFileNameW
SetFileAttributesW
GetFileAttributesW
FindClose
GetFullPathNameW
CreateDirectoryW
RemoveDirectoryW
FindFirstFileW
FindNextFileW
CreateFileW
DeleteFileW

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-path-l1-1-0

PathAllocCombine
PathCchCombine

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFileExistsW

ntdll

RtlQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion

api-ms-win-service-management-l1-1-0

OpenSCManagerW
OpenServiceW
CloseServiceHandle

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

userdataplatformhelperutil

IsCommsSystemService
StartAndWaitForServiceForUser
GetUserTokenFromContext
RunServicesInProc
GetUserContextFromHandle
GenerateUserModeServiceName

systemeventsbrokerclient

SebCreateEmailNotificationEvent
SebDeleteEvent

appointmentapis

CreateRecurrencePatternFromProperties
CreatePropertiesFromRecurrencePattern

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 932KB - Virtual size: 928KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 280KB - Virtual size: 276KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 552B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EmojiDS.dll
.dll windows:10 windows x64 arch:x64

8e69b9df0634e78e372d273909b93b2b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

EmojiDS.pdb

Imports

msvcrt

??0exception@@QEAA@XZ
??0exception@@QEAA@AEBQEBD@Z
__CxxFrameHandler4
__CxxFrameHandler3
__C_specific_handler
_lock
_unlock
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
??_V@YAXPEAX@Z
_vsnprintf_s
_wcsicmp
memcpy_s
wcsnlen
?what@exception@@UEBAPEBDXZ
_CxxThrowException
__dllonexit
_initterm
malloc
free
_amsg_exit
_callnewh
memmove_s
_onexit
memcpy
memcmp
_vsnwprintf
??3@YAXPEAX@Z
_XcptFilter
_purecall
memmove
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
memset

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceExecuteOnce

api-ms-win-core-winrt-string-l1-1-0

WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsGetStringRawBuffer

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError
RoOriginateErrorW

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
AcquireSRWLockShared
AcquireSRWLockExclusive
LeaveCriticalSection
ReleaseSRWLockExclusive
WaitForSingleObject
ReleaseMutex
ReleaseSemaphore
EnterCriticalSection
WaitForSingleObjectEx
OpenSemaphoreW
CreateSemaphoreExW
ReleaseSRWLockShared
CreateMutexExW
InitializeCriticalSectionEx

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetModuleHandleW
GetModuleFileNameA
GetProcAddress
DisableThreadLibraryCalls

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetWindowsDirectoryW
GetSystemDirectoryW
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
SetLastError

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree

oleaut32

SysAllocString
SysFreeString
SysStringLen

api-ms-win-core-errorhandling-l1-1-3

TerminateProcessOnMemoryExhaustion

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFileExistsW

api-ms-win-core-file-l1-1-0

CreateDirectoryW
GetFileAttributesW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-registry-l1-1-0

RegGetValueW

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW
FormatMessageW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrRChrW
StrStrIW

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 612B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EnterpriseAPNCsp.dll
.dll windows:10 windows x64 arch:x64

fd2b5bc85aba3201bdb66cfa198a392c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

EnterpriseAPNCsp.pdb

Imports

msvcrt

memmove
_amsg_exit
memset
realloc
_initterm
_errno
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_onexit
memcpy
__CxxFrameHandler3
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
_XcptFilter
??0exception@@QEAA@AEBV0@@Z
wcsnlen
_vsnwprintf
_ltow_s
_wcsnicmp
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_callnewh
_unlock
__dllonexit
_wtol
_wcsicmp
_lock
memcpy_s
free
malloc
wcsncpy_s
__C_specific_handler
_purecall
??_V@YAXPEAX@Z
__CxxFrameHandler4
??3@YAXPEAX@Z
wcscmp

ntdll

RtlPublishWnfStateData
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

oleaut32

VariantClear
VarUI4FromStr
VariantInit
SysFreeString
VariantChangeType
SysAllocString

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringEx

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InitializeCriticalSection

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableFlags
RegisterTraceGuidsW
TraceMessage
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableLevel

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventWriteTransfer
EventSetInformation

api-ms-win-core-libraryloader-l1-2-0

LoadResource
SizeofResource
GetModuleHandleExA
FindResourceExW
GetModuleFileNameW
GetModuleHandleW
LoadLibraryExW
GetProcAddress
DisableThreadLibraryCalls
FreeLibrary

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoCreateInstance

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-errorhandling-l1-1-0

GetLastError
RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-registry-l1-1-0

RegDeleteTreeW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegCloseKey
RegDeleteValueW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

wwapi

WwanGetProfile
WwanDeleteDMConfigProfile
WwanSearchProfile
WwanSetInterface
WwanGetDMConfigProfile
WwanSetDMConfigProfile
WwanQueryInterfaceEx
WwanEnumerateInterfaces
WwanOpenHandle
WwanDeleteProfile
WwanFreeMemory
WwanCloseHandle
WwanQueryInterface
WwanSetProfile

rpcrt4

UuidFromStringW
UuidCreate

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

wwanprfl

WwanProfileGenerateXml
WwanProfileCleanup
WwanProfileDeinit
WwanProfileLoadXml
WwanProfileInit

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EnterpriseAppMgmtClient.dll
.dll windows:10 windows x64 arch:x64

3da4e10a413e35fc4a4be1719f71efd7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

EnterpriseAppMgmtClient.pdb

Imports

msvcrt

malloc
free
_amsg_exit
_initterm
__C_specific_handler
_XcptFilter

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

rpcrt4

NdrOleAllocate
NdrOleFree
NdrDllGetClassObject
NdrDllCanUnloadNow

oleaut32

BSTR_UserFree64
BSTR_UserFree
BSTR_UserSize
BSTR_UserUnmarshal
BSTR_UserMarshal
BSTR_UserMarshal64
BSTR_UserSize64
BSTR_UserUnmarshal64

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EnterpriseAppMgmtSvc.dll
.dll windows:10 windows x64 arch:x64

a8a18a454a171eadeab86bfb858684b2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

EnterpriseAppMgmtSvc.pdb

Imports

msvcrt

??0exception@@QEAA@AEBQEBD@Z
_callnewh
wcschr
wcsnlen
towupper
_vscwprintf
_wtol
_errno
_wtoi64
wcstok_s
wcstoul
_wtoi
wcscpy_s
wcsncmp
memmove_s
wcsrchr
??0exception@@QEAA@AEBQEBDH@Z
realloc
_wsplitpath_s
_wcsicmp
_wcsnicmp
memset
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
__CxxFrameHandler3
__C_specific_handler
_purecall
?what@exception@@UEBAPEBDXZ
_CxxThrowException
_initterm
malloc
free
_amsg_exit
_XcptFilter
_vsnprintf_s
memcpy
??0exception@@QEAA@AEBV0@@Z
memmove
swprintf_s
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
memcpy_s
_vsnwprintf
??_V@YAXPEAX@Z
__CxxFrameHandler4
swscanf_s
??3@YAXPEAX@Z
memcmp
wcscmp

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
LoadLibraryExA
GetModuleHandleExW
FreeLibrary
LoadLibraryExW
GetModuleHandleExA
GetProcAddress
GetModuleHandleW
DisableThreadLibraryCalls

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-processthreads-l1-1-0

OpenThreadToken
GetCurrentProcessId
GetCurrentThread
GetCurrentProcess
GetCurrentThreadId
TerminateProcess
OpenProcessToken

api-ms-win-core-com-l1-1-0

CLSIDFromString
StringFromGUID2
CoRevokeClassObject
CoCreateGuid
CoTaskMemFree
CoCreateInstance
CoImpersonateClient
CoGetApartmentType
CoTaskMemAlloc
CoInitializeEx
CreateStreamOnHGlobal
CoRegisterClassObject
CoSetProxyBlanket
CoUninitialize
CoDisconnectContext
CoRevertToSelf
CoResumeClassObjects
StringFromCLSID

api-ms-win-core-localization-l1-2-0

FormatMessageW

oleaut32

VariantClear
VarBstrCat
GetErrorInfo
SysStringLen
SysAllocStringLen
SysStringByteLen
VariantInit
SysAllocStringByteLen
SysAllocString
SysFreeString

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
SetLastError
RaiseException
SetUnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventUnregister
EventRegister
EventWriteTransfer

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

rpcrt4

I_RpcBindingInqLocalClientPID
RpcServerInqCallAttributesW

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceBeginInitialize
Sleep

api-ms-win-security-base-l1-1-0

GetTokenInformation
DuplicateTokenEx
FreeSid
AllocateAndInitializeSid
AdjustTokenPrivileges

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CreateThreadpoolCleanupGroup
CloseThreadpool
CreateThreadpoolWork
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolTimer
SetThreadpoolThreadMaximum
CloseThreadpoolCleanupGroup
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpool
CreateThreadpoolTimer
SetThreadpoolTimer

api-ms-win-eventing-classicprovider-l1-1-0

UnregisterTraceGuids
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
GetTraceEnableFlags

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
ReleaseSRWLockShared
CreateSemaphoreExW
ReleaseSemaphore
AcquireSRWLockExclusive
AcquireSRWLockShared
SetEvent
CreateEventW
ReleaseMutex
WaitForSingleObjectEx
InitializeCriticalSection
DeleteCriticalSection
CreateMutexExW
InitializeSRWLock
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
LeaveCriticalSection
EnterCriticalSection
OpenSemaphoreW

api-ms-win-service-core-l1-1-0

SetServiceStatus
RegisterServiceCtrlHandlerExW

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemInfo
GetTickCount

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

ntdll

RtlFreeHeap
RtlAllocateHeap
RtlFreeUnicodeString
RtlNtStatusToDosError
NtSetInformationFile
RtlInitUnicodeString
RtlCompareUnicodeString
RtlLookupElementGenericTableAvl
RtlConvertSidToUnicodeString
RtlInsertElementGenericTableAvl
RtlInitializeGenericTableAvl
RtlEnumerateGenericTableWithoutSplayingAvl
RtlDeleteElementGenericTableAvl
RtlIsStateSeparationEnabled
NtAccessCheck
RtlRandomEx
WinSqmIncrementDWORD
RtlReleaseSRWLockShared
RtlAcquireSRWLockShared
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
WinSqmAddToStreamEx
WinSqmStartSession
WinSqmEndSession

combase

ord167
ord69
ord66
ord67
ord68

dsclient

DSCreateSharedFileToken
DSFreeString
DSCopyFromSharedFile

api-ms-win-downlevel-shlwapi-l1-1-0

PathCreateFromUrlW

api-ms-win-appmodel-unlock-l1-1-0

IsSideloadingEnabled

ext-ms-win-shell32-shellfolders-l1-1-0

SHGetKnownFolderPath

api-ms-win-core-file-l1-1-0

RemoveDirectoryW
FindClose
GetFileAttributesW
GetLongPathNameW
CreateFileW
GetFullPathNameW
FindNextFileW
DeleteFileW
GetFileSize
CompareFileTime
SetFileInformationByHandle
SetFilePointer
CreateDirectoryW
ReadFile
SetFileAttributesW
GetFileInformationByHandle
FindFirstFileW
GetFinalPathNameByHandleW

api-ms-win-core-path-l1-1-0

PathAllocCanonicalize
PathAllocCombine
PathCchCombine

crypt32

CertOpenStore
CryptImportPublicKeyInfoEx2
CertNameToStrW
CertAddEncodedCertificateToStore
CertGetCertificateChain
CertCloseStore
CertFreeCertificateChain
CertFreeCertificateContext
CertFreeCTLContext
CryptMsgClose
CryptQueryObject
CryptMsgGetParam
CertGetNameStringW
CertCreateCertificateContext

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoInitialize
RoActivateInstance
RoUninitialize

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-string-l2-1-1

SHLoadIndirectString

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx
CreateHardLinkW
CopyFileExW

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegDeleteTreeW
RegEnumKeyExW
RegOpenCurrentUser
RegDeleteKeyExW
RegQueryInfoKeyW
RegQueryValueExW

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo
RoOriginateError
RoTransformError

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo

api-ms-win-security-provider-l1-1-0

SetNamedSecurityInfoW
SetEntriesInAclW

winhttp

WinHttpCrackUrl

api-ms-win-core-url-l1-1-0

UrlUnescapeW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
CompareStringW
WideCharToMultiByte

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindExtensionW

xmllite

CreateXmlReader
CreateXmlReaderInputWithEncodingName

bcrypt

BCryptFinishHash
BCryptDestroyKey
BCryptHashData
BCryptCreateHash
BCryptDestroyHash

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW
GetCurrentDirectoryW

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW

urlmon

CreateUri

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-memory-l1-1-0

VirtualQuery
VirtualProtect

cryptxml

CryptXmlClose
CryptXmlVerifySignature
CryptXmlGetReference
CryptXmlOpenToDecode
CryptXmlGetStatus
CryptXmlGetSignature
CryptXmlGetDocContext

omadmapi

ord79

api-ms-win-downlevel-shlwapi-l2-1-0

SHCreateStreamOnFileW

api-ms-win-appmodel-runtime-l1-1-0

PackageFamilyNameFromFullName

api-ms-win-appmodel-runtime-internal-l1-1-2

ProductIdFromPackageFamilyName

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
ServiceMain
SvchostPushServiceGlobals

Sections

.text
Size: 448KB - Virtual size: 444KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 144KB - Virtual size: 143KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 376B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EnterpriseDesktopAppMgmtCSP.dll
.dll windows:10 windows x64 arch:x64

7eca309e5a881e41bbf0ca21900bf99c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

EnterpriseDesktopAppMgmtCSP.pdb

Imports

msvcp110_win

?_Winerror_map@std@@YAPEBDH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Syserror_map@std@@YAPEBDH@Z

msvcrt

_wcsnicmp
_wcsicmp
iswspace
_wtoi
memmove
__CxxFrameHandler3
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
free
_amsg_exit
_XcptFilter
_callnewh
malloc
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
??0exception@@QEAA@XZ
_vsnprintf_s
_vsnwprintf
memcpy_s
_purecall
__CxxFrameHandler4
??3@YAXPEAX@Z
??_V@YAXPEAX@Z
_CxxThrowException
memcpy
memset

advapi32

EventWriteTransfer
RegOpenKeyExW
RegCloseKey
EventUnregister
EventRegister

kernel32

GetSystemTimeAsFileTime
GetModuleHandleExA
Sleep
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetTickCount
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
LocalFree
GetLastError
CloseHandle
WaitForSingleObject
GetModuleHandleW
GetProcAddress
GetCurrentThreadId
FormatMessageW
HeapAlloc
GetProcessHeap
HeapFree
GetModuleHandleExW
GetModuleFileNameA
DebugBreak
IsDebuggerPresent
OutputDebugStringW
SetLastError
ReleaseSemaphore
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
lstrcmpW
GetCurrentProcessId
CreateMutexExW
CreateSemaphoreExW

oleaut32

SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreate
VariantClear
SysFreeString
SysStringLen
VariantInit
SysAllocString

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc

api-ms-win-eventing-provider-l1-1-0

EventSetInformation

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
InitOnceComplete

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
InitializeCriticalSection

api-ms-win-core-heap-l2-1-0

LocalAlloc

api-ms-win-security-base-l1-1-0

RevertToSelf
GetLengthSid
DuplicateTokenEx
CopySid
ImpersonateLoggedOnUser
GetTokenInformation

api-ms-win-security-lsalookup-l2-1-0

LookupAccountNameW

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW
RegQueryValueExW
RegDeleteKeyExW
RegSetValueExW
RegCreateKeyExW
RegQueryInfoKeyW

api-ms-win-core-processthreads-l1-1-0

CreateProcessAsUserW
OpenProcessToken
GetCurrentThread
OpenThreadToken

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW

wtsapi32

WTSQueryUserToken
WTSFreeMemoryExW
WTSEnumerateSessionsExW

msi

ord205
ord70

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 64KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 456B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EnterpriseModernAppMgmtCSP.dll
.dll windows:10 windows x64 arch:x64

ecc7f6dde69fb97c9158b6de31218098

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

EnterpriseModernAppMgmtCSP.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_free
_o_malloc
_o_memcpy_s
_o_wcstok_s
_o_wcstoul
__C_specific_handler
__CxxFrameHandler3
_o__crt_atexit
_o__configure_narrow_argv
__std_terminate
__CxxFrameHandler4
_o__cexit
_o__execute_onexit_table
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o__errno
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_CxxThrowException
memcmp
_o__wcsicmp
memcpy

api-ms-win-crt-string-l1-1-0

memset

ntdll

RtlIsMultiSessionSku
RtlInitUnicodeString
RtlFreeUnicodeString
RtlConvertSidToUnicodeString
RtlGetDeviceFamilyInfoEnum
RtlReportException
NtQuerySystemInformation
RtlCompareUnicodeString
RtlReleaseSRWLockShared
RtlAcquireSRWLockShared
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
RtlEnumerateGenericTableWithoutSplayingAvl
RtlInsertElementGenericTableAvl
RtlInitializeGenericTableAvl
RtlDeleteCriticalSection
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlDeleteElementGenericTableAvl
RtlLookupElementGenericTableAvl

appxalluserstore

DeleteAllPackagesFromPackageArray
IsInboxPackage
IsNonInboxAllUserPackageSpecificPackage
GetAllNonInboxPackagesFromRegistryStore

appxdeploymentclient

ord2
ord37
ord78

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoCreateFreeThreadedMarshaler
CoSetProxyBlanket
CoWaitForMultipleHandles
CoTaskMemFree
StringFromGUID2
CoTaskMemAlloc

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentThread
GetCurrentProcessId
GetCurrentThreadId
OpenThreadToken
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoActivateInstance
RoInitialize
RoUninitialize

api-ms-win-core-winrt-string-l1-1-0

WindowsIsStringEmpty
WindowsCreateStringReference
WindowsGetStringLen
WindowsDuplicateString
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateString
WindowsCompareStringOrdinal
WindowsTrimStringStart
WindowsTrimStringEnd

oleaut32

VariantInit
SysAllocStringLen
VariantClear
SysAllocString
SysStringLen
SysFreeString

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventRegister
EventUnregister
EventWriteTransfer
EventActivityIdControl

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter
SetLastError
GetLastError

api-ms-win-core-registry-l1-1-0

RegDeleteValueW
RegSetValueExW
RegOpenKeyExW
RegDeleteKeyExW
RegEnumKeyExW
RegQueryValueExW
RegCreateKeyExW
RegQueryInfoKeyW
RegOpenCurrentUser
RegCloseKey
RegDeleteTreeW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
WideCharToMultiByte

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-eventing-classicprovider-l1-1-0

UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetModuleHandleW
LoadLibraryExW
GetModuleHandleExA
GetModuleFileNameA
GetProcAddress
FreeLibrary

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-security-base-l1-1-0

RevertToSelf
ImpersonateLoggedOnUser
CopySid
GetLengthSid
GetTokenInformation

api-ms-win-core-synch-l1-1-0

SetEvent
CreateEventExW
DeleteCriticalSection
CreateSemaphoreExW
EnterCriticalSection
ReleaseSemaphore
LeaveCriticalSection
InitializeCriticalSectionEx
WaitForSingleObject
ReleaseMutex
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
InitializeCriticalSectionAndSpinCount
ResetEvent
CreateEventW
ReleaseSRWLockShared
AcquireSRWLockShared
CreateMutexExW

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 220KB - Virtual size: 218KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ErrorDetails.dll
.dll windows:10 windows x64 arch:x64

e783d4a999e838126a9bb50d20967cc5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

ErrorDetails.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__towlower_l
_o__wcsicmp
_o__wtol
_o_free
_o_malloc
_o_realloc
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
__CxxFrameHandler3
_CxxThrowException
wcschr
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__create_locale
_o___stdio_common_vswprintf
_o__configure_narrow_argv
_o___stdio_common_vsprintf_s
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
__std_terminate
__CxxFrameHandler4
_o__cexit
_o__callnewh
memcpy
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy

api-ms-win-crt-string-l1-1-0

memset
wcspbrk

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetModuleHandleExW
GetProcAddress
GetModuleFileNameA
GetModuleHandleW

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
TerminateProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetLocaleInfoW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

rpcrt4

UuidCreate
NdrOleAllocate
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrOleFree

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsDuplicateString
WindowsDeleteString
WindowsCreateString
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
HSTRING_UserUnmarshal64
HSTRING_UserUnmarshal
HSTRING_UserMarshal64
HSTRING_UserFree
HSTRING_UserSize64
HSTRING_UserFree64
HSTRING_UserMarshal
HSTRING_UserSize

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventWriteTransfer
EventRegister
EventUnregister

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW
GetRestrictedErrorInfo
RoOriginateError
RoTransformError
SetRestrictedErrorInfo

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
InitializeSRWLock
ReleaseSRWLockShared
SetEvent
CreateEventW
ReleaseMutex
CreateSemaphoreExW
AcquireSRWLockShared
ReleaseSemaphore
WaitForSingleObjectEx
ReleaseSRWLockExclusive
CreateMutexExW
OpenSemaphoreW
WaitForSingleObject

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce

api-ms-win-core-com-l1-1-0

CreateStreamOnHGlobal
CoReleaseMarshalData
CoTaskMemAlloc
CoTaskMemFree
CoMarshalInterface
CoGetInterfaceAndReleaseStream
CoCreateInstance
CoCreateFreeThreadedMarshaler

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError
RaiseException

api-ms-win-core-processthreads-l1-1-1

OpenProcess
IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoGetActivationFactory

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegOpenKeyExW
RegGetValueW

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate
IsErrorPropagationEnabled

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-path-l1-1-0

PathCchCombineEx

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-core-file-l1-1-0

GetFileSizeEx
ReadFile

api-ms-win-shell-shellfolders-l1-1-0

SHGetKnownFolderPath

ntdll

RtlPublishWnfStateData

api-ms-win-core-url-l1-1-0

UrlEscapeW
GetAcceptLanguagesW

api-ms-win-core-localization-obsolete-l1-2-0

GetSystemDefaultUILanguage

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolQueueTask
SHTaskPoolAllowThreadReuse

api-ms-win-core-string-l2-1-1

SHLoadIndirectString

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 132KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ErrorDetailsCore.dll
.dll windows:10 windows x64 arch:x64

82e8b2d890d3f927051f0e5f4eb811cd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

ErrorDetailsCore.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o___stdio_common_vsnprintf_s
_o___stdio_common_vsprintf_s
_o___stdio_common_vswprintf
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__seh_filter_dll
memcpy
_o__wcsicmp
_o__wtol
_o_free
_o_malloc
__C_specific_handler
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
wcschr
__CxxFrameHandler3
_CxxThrowException

api-ms-win-crt-string-l1-1-0

memset
wcspbrk

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetModuleHandleW
GetModuleFileNameA
GetModuleHandleExW
GetProcAddress

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventRegister
EventUnregister
EventWriteTransfer

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoTaskMemAlloc

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

rpcrt4

UuidCreate

api-ms-win-core-registry-l1-1-0

RegGetValueW

api-ms-win-core-string-l2-1-1

SHLoadIndirectString

Exports

Exports

FreeErrorDetails
GetErrorDetails
GetErrorDetailsWithContext

Sections

.text
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EsclProtocol.dll
.dll windows:10 windows x64 arch:x64

eaeea60461f744d7a583ca3e01c09f9b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

EsclProtocol.pdb

Imports

msvcp_win

?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?is@?$ctype@D@std@@QEBA_NFD@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
_Strxfrm
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??1_Locinfo@std@@QEAA@XZ
??1_Lockit@std@@QEAA@XZ
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
??0_Locinfo@std@@QEAA@PEBD@Z
??0_Lockit@std@@QEAA@H@Z
?id@?$ctype@D@std@@2V0locale@2@A
??Bid@locale@std@@QEAA_KXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
_Strcoll
?id@?$collate@D@std@@2V0locale@2@A
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xbad_alloc@std@@YAXXZ
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__stricmp
memmove
_o__wcsicmp
_o__wtoi
_o__wtol
_o_free
_o_malloc
_o_realloc
_o_strtol
_o_strtoul
__C_specific_handler
_CxxThrowException
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
memchr
memcmp
memcpy
wcsstr
strchr

api-ms-win-crt-string-l1-1-0

memset
wcsncmp
wcscmp

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetProcAddress
FreeLibrary
GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameA

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
InitOnceComplete
Sleep

api-ms-win-core-synch-l1-1-0

CreateEventW
OpenSemaphoreW
ResetEvent
ReleaseSRWLockShared
AcquireSRWLockExclusive
CreateSemaphoreExW
CreateMutexExW
EnterCriticalSection
ReleaseSRWLockExclusive
ReleaseSemaphore
CreateEventExW
AcquireSRWLockShared
ReleaseMutex
DeleteCriticalSection
WaitForSingleObject
WaitForSingleObjectEx
InitializeCriticalSectionEx
LeaveCriticalSection
SetEvent

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventUnregister
EventSetInformation
EventRegister

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
IsThreadpoolTimerSet

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoInitializeEx
CoTaskMemAlloc
CoCreateInstance

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

winhttp

WinHttpQueryHeaders
WinHttpCloseHandle
WinHttpReadData
WinHttpReceiveResponse
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpSetOption
WinHttpSetTimeouts
WinHttpOpenRequest
WinHttpConnect
WinHttpCrackUrl
WinHttpOpen

api-ms-win-core-io-l1-1-0

CancelIoEx
GetOverlappedResult

api-ms-win-core-file-l1-1-0

ReadFile
CreateFileW
WriteFile

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

oleaut32

VariantInit
SysAllocString
VariantClear
SysStringLen

rpcrt4

UuidFromStringW

api-ms-win-security-provider-l1-1-0

SetSecurityInfo

Exports

Exports

CancelScanJob
CloseScanner
FreeScannerCapabilities
GetScanJobState
GetScannerCapabilities
GetScannerStatus
OpenScanner
OpenUsbScanner
StartScanJob

Sections

.text
Size: 116KB - Virtual size: 113KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 376B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EsclScan.dll
.dll windows:10 windows x64 arch:x64

3f26735f98a6db2e34f101b6e911c745

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

EsclScan.pdb

Imports

msvcp_win

??0_Lockit@std@@QEAA@H@Z
??0_Locinfo@std@@QEAA@PEBD@Z
??1facet@locale@std@@MEAA@XZ
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
??1_Lockit@std@@QEAA@XZ
??1_Locinfo@std@@QEAA@XZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??0facet@locale@std@@IEAA@_K@Z
?_Xbad_alloc@std@@YAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
_Strxfrm
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?id@?$ctype@D@std@@2V0locale@2@A
??Bid@locale@std@@QEAA_KXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
_Strcoll
?_Incref@facet@locale@std@@UEAAXXZ
?id@?$collate@D@std@@2V0locale@2@A
_Thrd_yield
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?is@?$ctype@D@std@@QEBA_NFD@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__stricmp
memmove
_o__wcsicmp
_o__wtoi
_o__wtol
_o_abort
_o_free
_o_iswspace
_o_malloc
_o_realloc
_o_strtol
_o_strtoul
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o__crt_atexit
__std_terminate
__CxxFrameHandler4
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
strchr
wcsstr
memchr
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset
wcsncmp
wcscmp

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleHandleExW
GetModuleFileNameA
GetModuleHandleW
GetProcAddress
DisableThreadLibraryCalls

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceBeginInitialize
InitOnceComplete

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockShared
CreateEventW
ReleaseMutex
LeaveCriticalSection
CreateEventExW
SetEvent
WaitForSingleObject
CreateSemaphoreExW
DeleteCriticalSection
EnterCriticalSection
ResetEvent
InitializeCriticalSectionEx
ReleaseSemaphore
CreateMutexExW
AcquireSRWLockExclusive
WaitForSingleObjectEx
ReleaseSRWLockExclusive
OpenSemaphoreW
AcquireSRWLockShared

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventRegister
EventWriteTransfer
EventUnregister

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
TerminateProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
CoTaskMemFree
CoGetObjectContext
CoCreateFreeThreadedMarshaler
CoCreateInstance
CoInitializeEx
CoGetApartmentType

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList
InterlockedFlushSList
InitializeSListHead

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CloseThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
TrySubmitThreadpoolCallback
CreateThreadpoolWait
SetThreadpoolWait
CreateThreadpoolTimer
IsThreadpoolTimerSet

winhttp

WinHttpSetTimeouts
WinHttpOpen
WinHttpQueryHeaders
WinHttpReadData
WinHttpCrackUrl
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpConnect
WinHttpReceiveResponse
WinHttpAddRequestHeaders
WinHttpSetOption
WinHttpSendRequest

api-ms-win-core-io-l1-1-0

GetOverlappedResult
CancelIoEx

api-ms-win-core-file-l1-1-0

CreateFileW
WriteFile
ReadFile

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-security-provider-l1-1-0

SetSecurityInfo

oleaut32

GetErrorInfo
SetErrorInfo
SysStringLen
VariantClear
SysAllocString
VariantInit
SysFreeString

rpcrt4

UuidFromStringW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory

Sections

.text
Size: 196KB - Virtual size: 195KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EsclWiaDriver.dll
.dll regsvr32 windows:10 windows x64 arch:x64

7ab986d665d2661a38bcef364631dd87

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

EsclWiaDriver.pdb

Imports

msvcrt

memset
_onexit
memcmp
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
free
_callnewh
malloc
wcsstr
wcstol
memmove_s
__C_specific_handler
_wcsicmp
_purecall
memcpy_s
ceilf
__dllonexit
_vsnwprintf
wcscmp

wiaservc

wiasCreatePropContext
wiasSetPropChanged
wiasGetChangedValueLong
wiasCreateDrvItem
wiasGetDrvItem
wiasSetValidListLong
wiasFreePropContext
wiasGetRootItem
wiasQueueEvent
wiasValidateItemProperties
wiasWritePropGuid
wiasReadPropGuid
wiasUpdateScanRect
wiasReadPropLong
wiasIsPropChanged
wiasReadPropStr
wiasWritePropLong
wiasWritePropStr
wiasGetItemType
wiasWriteMultiple
wiasSetItemPropAttribs
wiasSetItemPropNames
wiasSetValidRangeLong

advapi32

RegSetValueExW
EventSetInformation
EventRegister
EventWriteTransfer
RegGetValueW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
EventUnregister
RegEnumValueW

cfgmgr32

CM_Get_Device_Interface_ListW
CM_Get_Device_IDW
CM_Get_Device_Interface_PropertyW
CM_Get_Parent
CM_Locate_DevNodeW

kernel32

CreateThreadpoolTimer
ReleaseSRWLockShared
SetThreadpoolTimer
AcquireSRWLockExclusive
CloseThreadpoolTimer
ReleaseSRWLockExclusive
WaitForThreadpoolTimerCallbacks
InitializeCriticalSectionEx
InitializeCriticalSection
IsThreadpoolTimerSet
DisableThreadLibraryCalls
GetDateFormatW
AcquireSRWLockShared
GetLocalTime
ResetEvent
SetEvent
GetTickCount64
CreateEventW
CreateFileW
SetFilePointer
WaitForMultipleObjects
WriteFile
CreateDirectoryW
GetComputerNameW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
DeviceIoControl
Sleep
LoadLibraryW
FreeLibrary
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
GetTimeFormatW
GetProcessHeap
GetModuleFileNameA
InitOnceBeginInitialize
CreateSemaphoreExW
HeapFree
SetLastError
ReleaseSemaphore
GetModuleHandleExW
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
FormatMessageW
GetLastError
OutputDebugStringW
InitOnceComplete
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
HeapAlloc
GetProcAddress
CreateMutexExW
GetCurrentProcessId
LocalFree
GetModuleHandleW
DebugBreak
IsDebuggerPresent
LocalAlloc

setupapi

SetupDiDestroyDeviceInfoList
SetupDiOpenDeviceInfoW
SetupDiGetDevicePropertyW
SetupDiCreateDeviceInfoList

user32

LoadStringW

oleaut32

SysAllocString
SysAllocStringLen
SysFreeString

ole32

CoTaskMemFree
CoTaskMemAlloc
CreateStreamOnHGlobal

gdiplus

GdipGetImageEncodersSize
GdipFree
GdipDisposeImage
GdipSaveImageToStream
GdipCloneImage
GdipGetImageEncoders
GdiplusShutdown
GdiplusStartup
GdipLoadImageFromStream
GdipAlloc

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 84KB - Virtual size: 83KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 236B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dswave.dll
.dll regsvr32 windows:10 windows x64 arch:x64

212b2b23f03c29147d65938face877a7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

dswave.pdb

Imports

msvcrt

memmove
wcstombs
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
free
_callnewh
malloc
_purecall
__CxxFrameHandler4
memcpy
memset

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetModuleFileNameA

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetVersionExA
GetSystemTimeAsFileTime

api-ms-win-core-com-l1-1-0

StringFromCLSID
CoTaskMemFree

api-ms-win-core-registry-l1-1-0

RegSetValueExA
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA

api-ms-win-core-registry-l2-1-0

RegDeleteKeyA
RegEnumKeyA

api-ms-win-core-heap-obsolete-l1-1-0

GlobalHandle
GlobalUnlock
GlobalLock

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-heap-l2-1-0

GlobalAlloc
GlobalFree

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

msacm32

acmStreamClose
acmStreamSize
acmStreamConvert
acmStreamUnprepareHeader
acmStreamPrepareHeader
acmStreamOpen
acmFormatSuggest

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 804B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dtsh.dll
.dll windows:10 windows x64 arch:x64

24e22f6a262daae20074fd7794f484be

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

dtsh.pdb

Imports

msvcrt

_XcptFilter
_callnewh
malloc
memmove_s
calloc
_beginthreadex
free
_purecall
_initterm
_lock
_unlock
__dllonexit
_onexit
__C_specific_handler
_amsg_exit
memset

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
ChangeServiceConfigW
StartServiceW
ControlService
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
OpenSCManagerW

kernel32

TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry
RtlCaptureContext
ActivateActCtx
DeactivateActCtx
CreateActCtxW
ReleaseActCtx
GetModuleHandleW
GetModuleFileNameW
LoadLibraryExW
GetProcAddress
GetCurrentProcess
RtlVirtualUnwind
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetLastError
DeleteCriticalSection
RaiseException
Sleep
CreateEventW
CloseHandle
SetEvent
WaitForSingleObject
OpenEventW
DisableThreadLibraryCalls
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount

user32

SetProcessDPIAware

rpcrt4

NdrDllCanUnloadNow
NdrDllGetClassObject
NdrOleAllocate
NdrOleFree

oleaut32

SysFreeString
SysAllocString

firewallapi

FWChangeNotificationCreate
FWChangeNotificationDestroy

api-ms-win-core-com-l1-1-0

CoTaskMemRealloc
CoSetProxyBlanket
CoGetMalloc
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance

api-ms-win-core-marshal-l1-1-0

HWND_UserMarshal
HWND_UserUnmarshal
HWND_UserFree
HWND_UserFree64
HWND_UserSize64
HWND_UserSize
HWND_UserMarshal64
HWND_UserUnmarshal64

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 972B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 304B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dui70.dll
.dll windows:10 windows x64 arch:x64

664b7ba37c9bf373236f627fa0def42c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

DUI70.pdb

Imports

msvcrt

ceilf
cosf
expf
floor
floorf
memcmp
memcpy
memmove
memset
powf
sin
sinf
sqrt
sqrtf
??1type_info@@UEAA@XZ
_onexit
__dllonexit
acosf
_lock
__CxxFrameHandler3
_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
wprintf
realloc
_isnan
iswalnum
_wcsnicmp
wcsstr
wcstok_s
iswalpha
wcsrchr
wcscspn
_wtol
iswdigit
_wtof
_snwscanf_s
wcsncmp
iswspace
free
_wcsdup
wcstol
wcschr
memcpy_s
_vsnprintf
__C_specific_handler
_vsnwprintf
__RTDynamicCast
_wcsicmp
_purecall
qsort
_unlock
wcscmp

ntdll

RtlUnsubscribeWnfStateChangeNotification
RtlSubscribeWnfStateChangeNotification
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlPublishWnfStateData
RtlCaptureStackBackTrace
EtwEventWriteTransfer
EtwEventSetInformation
EtwEventRegister
EtwEventUnregister
EtwLogTraceEvent
EtwUnregisterTraceGuids
EtwGetTraceEnableFlags
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwRegisterTraceGuidsW
RtlQueryWnfStateData

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemDirectoryW
GetTickCount64
GetVersionExW
GetVersion
GetSystemTimeAsFileTime

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
FreeLibrary
GetModuleFileNameW
FindResourceExW
GetModuleFileNameA
SizeofResource
LoadResource
FreeLibraryAndExitThread
LoadLibraryExW
GetProcAddress
GetModuleHandleW
DisableThreadLibraryCalls
LockResource
LoadStringW

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap
HeapReAlloc

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TlsFree
TlsAlloc
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsGetValue
CreateThread

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-synch-l1-1-0

InitializeSRWLock
EnterCriticalSection
ReleaseSemaphore
ReleaseMutex
LeaveCriticalSection
WaitForSingleObjectEx
WaitForSingleObject
CreateMutexExW
CreateSemaphoreExW
InitializeCriticalSectionEx
DeleteCriticalSection
ReleaseSRWLockExclusive
InitializeCriticalSectionAndSpinCount
CreateEventW
SetEvent
ResetEvent
InitializeCriticalSection
AcquireSRWLockExclusive
CreateEventExW
OpenMutexW
AcquireSRWLockShared
ReleaseSRWLockShared
OpenSemaphoreW

api-ms-win-core-string-l1-1-0

CompareStringW
WideCharToMultiByte
CompareStringOrdinal
MultiByteToWideChar

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegGetValueW
RegQueryValueExW
RegOpenKeyExW

api-ms-win-core-file-l1-1-0

SetFilePointer
WriteFile
GetFileSize
GetFileSizeEx
CreateFileW
ReadFile

api-ms-win-core-memory-l1-1-0

VirtualQueryEx
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW
FindResourceW

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
InitOnceComplete
Sleep
InitOnceBeginInitialize
InitOnceExecuteOnce
SleepConditionVariableSRW

api-ms-win-core-path-l1-1-0

PathCchAppend

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-localization-l1-2-0

GetThreadLocale
SetThreadPreferredUILanguages
GetLocaleInfoW
GetThreadUILanguage
FormatMessageW
GetThreadPreferredUILanguages

api-ms-win-core-string-l2-1-0

IsCharAlphaNumericW
CharUpperW

api-ms-win-core-memory-l1-1-1

SetProcessWorkingSetSizeEx
PrefetchVirtualMemory

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW
WaitForMultipleObjects

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc
GlobalFree
GlobalAlloc

api-ms-win-core-localization-l1-2-2

LCIDToLocaleName

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolWaitCallbacks
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolWait

api-ms-win-core-kernel32-legacy-l1-1-0

MulDiv

api-ms-win-core-atoms-l1-1-0

GetAtomNameW
AddAtomW
DeleteAtom
FindAtomW

api-ms-win-core-stringansi-l1-1-0

CharUpperA

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrTrimW

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock
GlobalLock

api-ms-win-core-sidebyside-l1-1-0

FindActCtxSectionStringW
QueryActCtxW
CreateActCtxW
DeactivateActCtx
ActivateActCtx

user32

ord2706
ord2705
ord2707
IsTopLevelWindow
ord2565
IsThreadDesktopComposited
UnionRect
RealGetWindowClassW
ord2635
GetSysColorBrush
ReleaseDC
LoadImageW
GetDC
KillTimer
SetTimer
GetSysColor
GetPropW
IsWindow
SetScrollInfo
GetScrollInfo
GetKeyState
GetForegroundWindow
RegisterPowerSettingNotification
UnregisterPowerSettingNotification
SetLayeredWindowAttributes
GetAncestor
GetSystemMetricsForDpi
GetThreadDpiAwarenessContext
AreDpiAwarenessContextsEqual
GetDpiForSystem
MonitorFromRect
RemovePropW
SetPropW
GetActiveWindow
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
SubtractRect
MoveWindow
SystemParametersInfoW
FillRect
OffsetRect
GetCaretBlinkTime
CopyImage
SetCaretPos
HideCaret
ShowCaret
DestroyCaret
CreateCaret
PtInRect
GetClientRect
RegisterWindowMessageW
MapWindowPoints
RedrawWindow
SetWindowRgn
GetWindowRgnBox
UpdateWindow
GetClassLongW
SetFocus
SetWindowTextW
IsChild
GetFocus
ShowWindow
SetParent
CallWindowProcW
GetDpiForWindow
GetWindowTextW
GetWindowTextLengthW
EnableWindow
GetCursorPos
CreateIconIndirect
LoadCursorFromFileW
DestroyIcon
GetIconInfo
PostQuitMessage
DispatchMessageW
TranslateMessage
GetMessageW
DrawFocusRect
FrameRect
DrawIconEx
CopyRect
SetRect
GetKeyNameTextW
MapVirtualKeyW
DrawFrameControl
InflateRect
GetSystemMetrics
DrawTextW
EqualRect
SetCursor
PostMessageW
EnumChildWindows
InvalidateRect
MonitorFromWindow
GetMonitorInfoW
GetWindowRect
AdjustWindowRectEx
GetParent
SetWindowLongW
GetWindowLongW
ClientToScreen
SetWindowPos
DestroyWindow
GetWindowLongPtrW
SetWindowLongPtrW
CreateWindowExW
RegisterClassExW
DefWindowProcW
LoadCursorW
GetClassInfoExW
SendMessageW
SetRectEmpty
IsRectEmpty
IntersectRect
GetGUIThreadInfo
ScreenToClient
NotifyWinEvent

gdi32

GetCurrentObject
CreateFontIndirectW
CreatePatternBrush
GetDeviceCaps
GetObjectW
CreateCompatibleDC
SelectObject
CreateCompatibleBitmap
CreateHalftonePalette
SelectPalette
RealizePalette
GetBrushOrgEx
SetStretchBltMode
SetBrushOrgEx
StretchBlt
DeleteDC
CreateDIBSection
GetDIBits
GdiGetCharDimensions
CreateBitmap
GetDCBrushColor
GetRgnBox
OffsetRgn
CombineRgn
ExtCreateRegion
GetRegionData
RectVisible
SetWindowOrgEx
OffsetWindowOrgEx
GetBkMode
GetTextMetricsW
DeleteEnhMetaFile
GetEnhMetaFileHeader
GetPixel
GetTextExtentPoint32W
SetPixel
GetTextColor
GdiGradientFill
PlayEnhMetaFile
SetDCBrushColor
SetBkMode
SetTextColor
DeleteObject
GetTextAlign
SetTextAlign
SelectClipRgn
IntersectClipRect
GetClipRgn
CreateRectRgn
GetStockObject
ExtTextOutW
SetBkColor
GetBkColor
PatBlt
LPtoDP
CreateSolidBrush
StretchDIBits
GdiTransparentBlt
GdiAlphaBlend
BitBlt
SetLayout
GetLayout
CreateDIBPatternBrushPt

kernelbase

GetCurrentPackageId

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

??0?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@QEAA@XZ
??0?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@QEAA@XZ
??0?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@QEAA@XZ
??0?$PatternProvider@VInvokeProvider@DirectUI@@UIInvokeProvider@@$0A@@DirectUI@@QEAA@XZ
??0?$PatternProvider@VRangeValueProvider@DirectUI@@UIRangeValueProvider@@$03@DirectUI@@QEAA@XZ
??0?$PatternProvider@VScrollItemProvider@DirectUI@@UIScrollItemProvider@@$05@DirectUI@@QEAA@XZ
??0?$PatternProvider@VScrollProvider@DirectUI@@UIScrollProvider@@$04@DirectUI@@QEAA@XZ
??0?$PatternProvider@VSelectionItemProvider@DirectUI@@UISelectionItemProvider@@$06@DirectUI@@QEAA@XZ
??0?$PatternProvider@VSelectionProvider@DirectUI@@UISelectionProvider@@$07@DirectUI@@QEAA@XZ
??0?$PatternProvider@VTableItemProvider@DirectUI@@UITableItemProvider@@$09@DirectUI@@QEAA@XZ
??0?$PatternProvider@VTableProvider@DirectUI@@UITableProvider@@$08@DirectUI@@QEAA@XZ
??0?$PatternProvider@VToggleProvider@DirectUI@@UIToggleProvider@@$0L@@DirectUI@@QEAA@XZ
??0?$PatternProvider@VValueProvider@DirectUI@@UIValueProvider@@$0M@@DirectUI@@QEAA@XZ
??0?$SafeArrayAccessor@H@DirectUI@@QEAA@XZ
??0AccessibleButton@DirectUI@@QEAA@$$QEAV01@@Z
??0AccessibleButton@DirectUI@@QEAA@AEBV01@@Z
??0AccessibleButton@DirectUI@@QEAA@XZ
??0AnimationStrip@DirectUI@@QEAA@AEBV01@@Z
??0AnimationStrip@DirectUI@@QEAA@XZ
??0AutoButton@DirectUI@@QEAA@$$QEAV01@@Z
??0AutoButton@DirectUI@@QEAA@AEBV01@@Z
??0AutoButton@DirectUI@@QEAA@XZ
??0AutoLock@DirectUI@@QEAA@PEAU_RTL_CRITICAL_SECTION@@@Z
??0AutoThread@DirectUI@@QEAA@XZ
??0AutoVariant@DirectUI@@QEAA@XZ
??0BaseScrollBar@DirectUI@@QEAA@$$QEAV01@@Z
??0BaseScrollBar@DirectUI@@QEAA@AEBV01@@Z
??0BaseScrollBar@DirectUI@@QEAA@XZ
??0BaseScrollViewer@DirectUI@@QEAA@AEBV01@@Z
??0BaseScrollViewer@DirectUI@@QEAA@XZ
??0Bind@DirectUI@@QEAA@$$QEAV01@@Z
??0Bind@DirectUI@@QEAA@AEBV01@@Z
??0Bind@DirectUI@@QEAA@XZ
??0BorderLayout@DirectUI@@QEAA@AEBV01@@Z
??0BorderLayout@DirectUI@@QEAA@XZ
??0Browser@DirectUI@@QEAA@$$QEAV01@@Z
??0Browser@DirectUI@@QEAA@AEBV01@@Z
??0Browser@DirectUI@@QEAA@XZ
??0BrowserSelectionProxy@DirectUI@@QEAA@$$QEAV01@@Z
??0BrowserSelectionProxy@DirectUI@@QEAA@AEBV01@@Z
??0BrowserSelectionProxy@DirectUI@@QEAA@XZ
??0Button@DirectUI@@QEAA@AEBV01@@Z
??0Button@DirectUI@@QEAA@XZ
??0CCAVI@DirectUI@@QEAA@$$QEAV01@@Z
??0CCAVI@DirectUI@@QEAA@AEBV01@@Z
??0CCAVI@DirectUI@@QEAA@XZ
??0CCBase@DirectUI@@QEAA@AEBV01@@Z
??0CCBase@DirectUI@@QEAA@KPEBG@Z
??0CCBaseCheckRadioButton@DirectUI@@QEAA@$$QEAV01@@Z
??0CCBaseCheckRadioButton@DirectUI@@QEAA@AEBV01@@Z
??0CCBaseCheckRadioButton@DirectUI@@QEAA@K@Z
??0CCBaseScrollBar@DirectUI@@QEAA@$$QEAV01@@Z
??0CCBaseScrollBar@DirectUI@@QEAA@AEBV01@@Z
??0CCBaseScrollBar@DirectUI@@QEAA@K@Z
??0CCCheckBox@DirectUI@@QEAA@$$QEAV01@@Z
??0CCCheckBox@DirectUI@@QEAA@AEBV01@@Z
??0CCCheckBox@DirectUI@@QEAA@K@Z
??0CCCommandLink@DirectUI@@QEAA@$$QEAV01@@Z
??0CCCommandLink@DirectUI@@QEAA@AEBV01@@Z
??0CCCommandLink@DirectUI@@QEAA@K@Z
??0CCHScrollBar@DirectUI@@QEAA@$$QEAV01@@Z
??0CCHScrollBar@DirectUI@@QEAA@AEBV01@@Z
??0CCHScrollBar@DirectUI@@QEAA@XZ
??0CCListBox@DirectUI@@QEAA@$$QEAV01@@Z
??0CCListBox@DirectUI@@QEAA@AEBV01@@Z
??0CCListBox@DirectUI@@QEAA@XZ
??0CCListView@DirectUI@@QEAA@$$QEAV01@@Z
??0CCListView@DirectUI@@QEAA@AEBV01@@Z
??0CCListView@DirectUI@@QEAA@XZ
??0CCProgressBar@DirectUI@@QEAA@$$QEAV01@@Z
??0CCProgressBar@DirectUI@@QEAA@AEBV01@@Z
??0CCProgressBar@DirectUI@@QEAA@XZ
??0CCPushButton@DirectUI@@QEAA@$$QEAV01@@Z
??0CCPushButton@DirectUI@@QEAA@AEBV01@@Z
??0CCPushButton@DirectUI@@QEAA@K@Z
??0CCRadioButton@DirectUI@@QEAA@$$QEAV01@@Z
??0CCRadioButton@DirectUI@@QEAA@AEBV01@@Z
??0CCRadioButton@DirectUI@@QEAA@XZ
??0CCSysLink@DirectUI@@QEAA@$$QEAV01@@Z
??0CCSysLink@DirectUI@@QEAA@AEBV01@@Z
??0CCSysLink@DirectUI@@QEAA@XZ
??0CCTrackBar@DirectUI@@QEAA@$$QEAV01@@Z
??0CCTrackBar@DirectUI@@QEAA@AEBV01@@Z
??0CCTrackBar@DirectUI@@QEAA@XZ
??0CCTreeView@DirectUI@@QEAA@$$QEAV01@@Z
??0CCTreeView@DirectUI@@QEAA@AEBV01@@Z
??0CCTreeView@DirectUI@@QEAA@K@Z
??0CCVScrollBar@DirectUI@@QEAA@$$QEAV01@@Z
??0CCVScrollBar@DirectUI@@QEAA@AEBV01@@Z
??0CCVScrollBar@DirectUI@@QEAA@XZ
??0CallstackTracker@DirectUI@@QEAA@XZ
??0CheckBoxGlyph@DirectUI@@QEAA@AEBV01@@Z
??0CheckBoxGlyph@DirectUI@@QEAA@XZ
??0ClassInfoBase@DirectUI@@QEAA@AEBV01@@Z
??0ClassInfoBase@DirectUI@@QEAA@XZ
??0Clipper@DirectUI@@QEAA@$$QEAV01@@Z
??0Clipper@DirectUI@@QEAA@AEBV01@@Z
??0Clipper@DirectUI@@QEAA@XZ
??0Combobox@DirectUI@@QEAA@AEBV01@@Z
??0Combobox@DirectUI@@QEAA@XZ
??0CritSecLock@DirectUI@@QEAA@PEAU_RTL_CRITICAL_SECTION@@@Z
??0DCSurface@DirectUI@@QEAA@AEBV01@@Z
??0DCSurface@DirectUI@@QEAA@PEAUHDC__@@@Z
??0DUIFactory@DirectUI@@QEAA@PEAUHWND__@@@Z
??0DUIXmlParser@DirectUI@@QEAA@AEBV01@@Z
??0DUIXmlParser@DirectUI@@QEAA@XZ
??0DialogElement@DirectUI@@QEAA@$$QEAV01@@Z
??0DialogElement@DirectUI@@QEAA@AEBV01@@Z
??0DialogElement@DirectUI@@QEAA@XZ
??0DuiAccessible@DirectUI@@QEAA@XZ
??0Edit@DirectUI@@QEAA@AEBV01@@Z
??0Edit@DirectUI@@QEAA@XZ
??0Element@DirectUI@@QEAA@AEBV01@@Z
??0Element@DirectUI@@QEAA@XZ
??0ElementProvider@DirectUI@@QEAA@XZ
??0ElementProxy@DirectUI@@IEAA@XZ
??0ElementProxy@DirectUI@@QEAA@$$QEAV01@@Z
??0ElementProxy@DirectUI@@QEAA@AEBV01@@Z
??0ElementWithHWND@DirectUI@@QEAA@$$QEAV01@@Z
??0ElementWithHWND@DirectUI@@QEAA@AEBV01@@Z
??0ElementWithHWND@DirectUI@@QEAA@XZ
??0ExpandCollapseProvider@DirectUI@@QEAA@XZ
??0ExpandCollapseProxy@DirectUI@@QEAA@$$QEAV01@@Z
??0ExpandCollapseProxy@DirectUI@@QEAA@AEBV01@@Z
??0ExpandCollapseProxy@DirectUI@@QEAA@XZ
??0Expandable@DirectUI@@QEAA@$$QEAV01@@Z
??0Expandable@DirectUI@@QEAA@AEBV01@@Z
??0Expandable@DirectUI@@QEAA@XZ
??0Expando@DirectUI@@QEAA@$$QEAV01@@Z
??0Expando@DirectUI@@QEAA@AEBV01@@Z
??0Expando@DirectUI@@QEAA@XZ
??0ExpandoButtonGlyph@DirectUI@@QEAA@AEBV01@@Z
??0ExpandoButtonGlyph@DirectUI@@QEAA@XZ
??0FillLayout@DirectUI@@QEAA@AEBV01@@Z
??0FillLayout@DirectUI@@QEAA@XZ
??0FlowLayout@DirectUI@@QEAA@AEBV01@@Z
??0FlowLayout@DirectUI@@QEAA@XZ
??0FontCache@DirectUI@@QEAA@$$QEAV01@@Z
??0FontCache@DirectUI@@QEAA@AEBV01@@Z
??0FontCache@DirectUI@@QEAA@XZ
??0FontCheckOut@DirectUI@@QEAA@PEAVElement@1@PEAUHDC__@@@Z
??0GridItemProvider@DirectUI@@QEAA@XZ
??0GridItemProxy@DirectUI@@QEAA@$$QEAV01@@Z
??0GridItemProxy@DirectUI@@QEAA@AEBV01@@Z
??0GridItemProxy@DirectUI@@QEAA@XZ
??0GridLayout@DirectUI@@QEAA@AEBV01@@Z
??0GridLayout@DirectUI@@QEAA@XZ
??0GridProvider@DirectUI@@QEAA@XZ
??0GridProxy@DirectUI@@QEAA@$$QEAV01@@Z
??0GridProxy@DirectUI@@QEAA@AEBV01@@Z
??0GridProxy@DirectUI@@QEAA@XZ
??0HWNDElement@DirectUI@@QEAA@AEBV01@@Z
??0HWNDElement@DirectUI@@QEAA@XZ
??0HWNDElementAccessible@DirectUI@@QEAA@XZ
??0HWNDElementProvider@DirectUI@@QEAA@XZ
??0HWNDElementProxy@DirectUI@@IEAA@XZ
??0HWNDElementProxy@DirectUI@@QEAA@$$QEAV01@@Z
??0HWNDElementProxy@DirectUI@@QEAA@AEBV01@@Z
??0HWNDHost@DirectUI@@QEAA@AEBV01@@Z
??0HWNDHost@DirectUI@@QEAA@XZ
??0HWNDHostAccessible@DirectUI@@QEAA@XZ
??0HWNDHostClientAccessible@DirectUI@@QEAA@XZ
??0IDataEngine@DirectUI@@QEAA@AEBU01@@Z
??0IDataEngine@DirectUI@@QEAA@XZ
??0IDataEntry@DirectUI@@QEAA@AEBU01@@Z
??0IDataEntry@DirectUI@@QEAA@XZ
??0IProvider@DirectUI@@QEAA@$$QEAV01@@Z
??0IProvider@DirectUI@@QEAA@AEBV01@@Z
??0IProvider@DirectUI@@QEAA@XZ
??0ISBLeak@DirectUI@@QEAA@$$QEAU01@@Z
??0ISBLeak@DirectUI@@QEAA@AEBU01@@Z
??0ISBLeak@DirectUI@@QEAA@XZ
??0IXElementCP@DirectUI@@QEAA@$$QEAV01@@Z
??0IXElementCP@DirectUI@@QEAA@AEBV01@@Z
??0IXElementCP@DirectUI@@QEAA@XZ
??0IXProviderCP@DirectUI@@QEAA@$$QEAV01@@Z
??0IXProviderCP@DirectUI@@QEAA@AEBV01@@Z
??0IXProviderCP@DirectUI@@QEAA@XZ
??0InvokeHelper@DirectUI@@QEAA@XZ
??0InvokeProvider@DirectUI@@QEAA@XZ
??0InvokeProxy@DirectUI@@QEAA@$$QEAV01@@Z
??0InvokeProxy@DirectUI@@QEAA@AEBV01@@Z
??0InvokeProxy@DirectUI@@QEAA@XZ
??0ItemList@DirectUI@@QEAA@XZ
??0Layout@DirectUI@@QEAA@AEBV01@@Z
??0Layout@DirectUI@@QEAA@XZ
??0LinkedList@DirectUI@@QEAA@XZ
??0Macro@DirectUI@@QEAA@$$QEAV01@@Z
??0Macro@DirectUI@@QEAA@AEBV01@@Z
??0Macro@DirectUI@@QEAA@XZ
??0ModernProgressBar@DirectUI@@QEAA@XZ
??0ModernProgressBarRangeValueProxy@DirectUI@@QEAA@$$QEAV01@@Z
??0ModernProgressBarRangeValueProxy@DirectUI@@QEAA@AEBV01@@Z
??0ModernProgressBarRangeValueProxy@DirectUI@@QEAA@XZ
??0ModernProgressRing@DirectUI@@QEAA@XZ
??0Movie@DirectUI@@QEAA@AEBV01@@Z
??0Movie@DirectUI@@QEAA@XZ
??0NativeHWNDHost@DirectUI@@QEAA@AEBV01@@Z
??0NativeHWNDHost@DirectUI@@QEAA@XZ
??0Navigator@DirectUI@@QEAA@$$QEAV01@@Z
??0Navigator@DirectUI@@QEAA@AEBV01@@Z
??0Navigator@DirectUI@@QEAA@XZ
??0NavigatorSelectionItemProxy@DirectUI@@QEAA@$$QEAV01@@Z
??0NavigatorSelectionItemProxy@DirectUI@@QEAA@AEBV01@@Z
??0NavigatorSelectionItemProxy@DirectUI@@QEAA@XZ
??0NineGridLayout@DirectUI@@QEAA@AEBV01@@Z
??0NineGridLayout@DirectUI@@QEAA@XZ
??0PText@DirectUI@@QEAA@AEBV01@@Z
??0PText@DirectUI@@QEAA@XZ
??0Page@DirectUI@@QEAA@$$QEAV01@@Z
??0Page@DirectUI@@QEAA@AEBV01@@Z
??0Page@DirectUI@@QEAA@XZ
??0Pages@DirectUI@@QEAA@$$QEAV01@@Z
??0Pages@DirectUI@@QEAA@AEBV01@@Z
??0Pages@DirectUI@@QEAA@XZ
??0Progress@DirectUI@@QEAA@AEBV01@@Z
??0Progress@DirectUI@@QEAA@XZ
??0ProgressRangeValueProxy@DirectUI@@QEAA@$$QEAV01@@Z
??0ProgressRangeValueProxy@DirectUI@@QEAA@AEBV01@@Z
??0ProgressRangeValueProxy@DirectUI@@QEAA@XZ
??0ProviderProxy@DirectUI@@IEAA@XZ
??0ProviderProxy@DirectUI@@QEAA@$$QEAV01@@Z
??0ProviderProxy@DirectUI@@QEAA@AEBV01@@Z
??0Proxy@DirectUI@@QEAA@AEBV01@@Z
??0Proxy@DirectUI@@QEAA@XZ
??0PushButton@DirectUI@@QEAA@$$QEAV01@@Z
??0PushButton@DirectUI@@QEAA@AEBV01@@Z
??0PushButton@DirectUI@@QEAA@XZ
??0RadioButtonGlyph@DirectUI@@QEAA@AEBV01@@Z
??0RadioButtonGlyph@DirectUI@@QEAA@XZ
??0RangeValueProvider@DirectUI@@QEAA@XZ
??0RangeValueProxy@DirectUI@@IEAA@XZ
??0RangeValueProxy@DirectUI@@QEAA@$$QEAV01@@Z
??0RangeValueProxy@DirectUI@@QEAA@AEBV01@@Z
??0RefPointElement@DirectUI@@QEAA@AEBV01@@Z
??0RefPointElement@DirectUI@@QEAA@XZ
??0RefcountBase@DirectUI@@QEAA@XZ
??0RepeatButton@DirectUI@@QEAA@AEBV01@@Z
??0RepeatButton@DirectUI@@QEAA@XZ
??0Repeater@DirectUI@@QEAA@$$QEAV01@@Z
??0Repeater@DirectUI@@QEAA@AEBV01@@Z
??0Repeater@DirectUI@@QEAA@XZ
??0ResourceModuleHandles@DirectUI@@QEAA@XZ
??0RichText@DirectUI@@QEAA@XZ
??0RowLayout@DirectUI@@QEAA@AEBV01@@Z
??0RowLayout@DirectUI@@QEAA@XZ
??0ScrollBar@DirectUI@@QEAA@AEBV01@@Z
??0ScrollBar@DirectUI@@QEAA@XZ
??0ScrollBarRangeValueProxy@DirectUI@@QEAA@$$QEAV01@@Z
??0ScrollBarRangeValueProxy@DirectUI@@QEAA@AEBV01@@Z
??0ScrollBarRangeValueProxy@DirectUI@@QEAA@XZ
??0ScrollItemProvider@DirectUI@@QEAA@XZ
??0ScrollItemProxy@DirectUI@@QEAA@$$QEAV01@@Z
??0ScrollItemProxy@DirectUI@@QEAA@AEBV01@@Z
??0ScrollItemProxy@DirectUI@@QEAA@XZ
??0ScrollProvider@DirectUI@@QEAA@XZ
??0ScrollProxy@DirectUI@@QEAA@$$QEAV01@@Z
??0ScrollProxy@DirectUI@@QEAA@AEBV01@@Z
??0ScrollProxy@DirectUI@@QEAA@XZ
??0ScrollViewer@DirectUI@@QEAA@AEBV01@@Z
??0ScrollViewer@DirectUI@@QEAA@XZ
??0SelectionItemProvider@DirectUI@@QEAA@XZ
??0SelectionItemProxy@DirectUI@@IEAA@XZ
??0SelectionItemProxy@DirectUI@@QEAA@$$QEAV01@@Z
??0SelectionItemProxy@DirectUI@@QEAA@AEBV01@@Z
??0SelectionProvider@DirectUI@@QEAA@XZ
??0SelectionProxy@DirectUI@@IEAA@XZ
??0SelectionProxy@DirectUI@@QEAA@$$QEAV01@@Z
??0SelectionProxy@DirectUI@@QEAA@AEBV01@@Z
??0Selector@DirectUI@@QEAA@AEBV01@@Z
??0Selector@DirectUI@@QEAA@XZ
??0SelectorNoDefault@DirectUI@@QEAA@$$QEAV01@@Z
??0SelectorNoDefault@DirectUI@@QEAA@AEBV01@@Z
??0SelectorNoDefault@DirectUI@@QEAA@XZ
??0SelectorSelectionItemProxy@DirectUI@@QEAA@$$QEAV01@@Z
??0SelectorSelectionItemProxy@DirectUI@@QEAA@AEBV01@@Z
??0SelectorSelectionItemProxy@DirectUI@@QEAA@XZ
??0SelectorSelectionProxy@DirectUI@@QEAA@$$QEAV01@@Z
??0SelectorSelectionProxy@DirectUI@@QEAA@AEBV01@@Z
??0SelectorSelectionProxy@DirectUI@@QEAA@XZ
??0ShellBorderLayout@DirectUI@@QEAA@AEBV01@@Z
??0ShellBorderLayout@DirectUI@@QEAA@XZ
??0StyleSheet@DirectUI@@QEAA@$$QEAV01@@Z
??0StyleSheet@DirectUI@@QEAA@AEBV01@@Z
??0StyleSheet@DirectUI@@QEAA@XZ
??0StyledScrollViewer@DirectUI@@QEAA@AEBV01@@Z
??0StyledScrollViewer@DirectUI@@QEAA@XZ
??0Surface@DirectUI@@QEAA@AEBV01@@Z
??0Surface@DirectUI@@QEAA@XZ
??0TableItemProvider@DirectUI@@QEAA@XZ
??0TableItemProxy@DirectUI@@QEAA@$$QEAV01@@Z
??0TableItemProxy@DirectUI@@QEAA@AEBV01@@Z
??0TableItemProxy@DirectUI@@QEAA@XZ
??0TableLayout@DirectUI@@QEAA@AEBV01@@Z
??0TableLayout@DirectUI@@QEAA@XZ
??0TableProvider@DirectUI@@QEAA@XZ
??0TableProxy@DirectUI@@QEAA@$$QEAV01@@Z
??0TableProxy@DirectUI@@QEAA@AEBV01@@Z
??0TableProxy@DirectUI@@QEAA@XZ
??0TaskPage@DirectUI@@QEAA@AEBV01@@Z
??0TaskPage@DirectUI@@QEAA@XZ
??0TextGraphic@DirectUI@@QEAA@$$QEAV01@@Z
??0TextGraphic@DirectUI@@QEAA@AEBV01@@Z
??0TextGraphic@DirectUI@@QEAA@XZ
??0Thumb@DirectUI@@QEAA@AEBV01@@Z
??0Thumb@DirectUI@@QEAA@XZ
??0ToggleProvider@DirectUI@@QEAA@XZ
??0ToggleProxy@DirectUI@@QEAA@$$QEAV01@@Z
??0ToggleProxy@DirectUI@@QEAA@AEBV01@@Z
??0ToggleProxy@DirectUI@@QEAA@XZ
??0TouchButton@DirectUI@@QEAA@XZ
??0TouchCheckBox@DirectUI@@QEAA@XZ
??0TouchCheckBoxGlyph@DirectUI@@QEAA@XZ
??0TouchCommandButton@DirectUI@@QEAA@XZ
??0TouchEdit2@DirectUI@@QEAA@XZ
??0TouchHWNDElement@DirectUI@@QEAA@XZ
??0TouchHyperLink@DirectUI@@QEAA@XZ
??0TouchRepeatButton@DirectUI@@QEAA@XZ
??0TouchScrollBar@DirectUI@@QEAA@XZ
??0TouchSelect@DirectUI@@QEAA@XZ
??0TouchSelectItem@DirectUI@@QEAA@XZ
??0UnknownElement@DirectUI@@QEAA@AEBV01@@Z
??0UnknownElement@DirectUI@@QEAA@XZ
??0ValueProvider@DirectUI@@QEAA@XZ
??0ValueProxy@DirectUI@@QEAA@$$QEAV01@@Z
??0ValueProxy@DirectUI@@QEAA@AEBV01@@Z
??0ValueProxy@DirectUI@@QEAA@XZ
??0VerticalFlowLayout@DirectUI@@QEAA@AEBV01@@Z
??0VerticalFlowLayout@DirectUI@@QEAA@XZ
??0Viewer@DirectUI@@QEAA@AEBV01@@Z
??0Viewer@DirectUI@@QEAA@XZ
??0XBaby@DirectUI@@QEAA@AEBV01@@Z
??0XBaby@DirectUI@@QEAA@XZ
??0XElement@DirectUI@@QEAA@AEBV01@@Z
??0XElement@DirectUI@@QEAA@XZ
??0XHost@DirectUI@@QEAA@XZ
??0XProvider@DirectUI@@QEAA@AEBV01@@Z
??0XProvider@DirectUI@@QEAA@XZ
??0XResourceProvider@DirectUI@@QEAA@$$QEAV01@@Z
??0XResourceProvider@DirectUI@@QEAA@AEBV01@@Z
??0XResourceProvider@DirectUI@@QEAA@XZ
??1?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@UEAA@XZ
??1?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@UEAA@XZ
??1?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@UEAA@XZ
??1?$PatternProvider@VInvokeProvider@DirectUI@@UIInvokeProvider@@$0A@@DirectUI@@UEAA@XZ
??1?$PatternProvider@VRangeValueProvider@DirectUI@@UIRangeValueProvider@@$03@DirectUI@@UEAA@XZ
??1?$PatternProvider@VScrollItemProvider@DirectUI@@UIScrollItemProvider@@$05@DirectUI@@UEAA@XZ
??1?$PatternProvider@VScrollProvider@DirectUI@@UIScrollProvider@@$04@DirectUI@@UEAA@XZ
??1?$PatternProvider@VSelectionItemProvider@DirectUI@@UISelectionItemProvider@@$06@DirectUI@@UEAA@XZ
??1?$PatternProvider@VSelectionProvider@DirectUI@@UISelectionProvider@@$07@DirectUI@@UEAA@XZ
??1?$PatternProvider@VTableItemProvider@DirectUI@@UITableItemProvider@@$09@DirectUI@@UEAA@XZ
??1?$PatternProvider@VTableProvider@DirectUI@@UITableProvider@@$08@DirectUI@@UEAA@XZ
??1?$PatternProvider@VToggleProvider@DirectUI@@UIToggleProvider@@$0L@@DirectUI@@UEAA@XZ
??1?$PatternProvider@VValueProvider@DirectUI@@UIValueProvider@@$0M@@DirectUI@@UEAA@XZ
??1?$SafeArrayAccessor@H@DirectUI@@QEAA@XZ
??1AccessibleButton@DirectUI@@UEAA@XZ
??1AnimationStrip@DirectUI@@UEAA@XZ
??1AutoButton@DirectUI@@UEAA@XZ
??1AutoLock@DirectUI@@QEAA@XZ
??1AutoThread@DirectUI@@QEAA@XZ
??1AutoVariant@DirectUI@@QEAA@XZ
??1BaseScrollViewer@DirectUI@@UEAA@XZ
??1Bind@DirectUI@@UEAA@XZ
??1BorderLayout@DirectUI@@UEAA@XZ
??1Browser@DirectUI@@UEAA@XZ
??1Button@DirectUI@@UEAA@XZ
??1CCAVI@DirectUI@@UEAA@XZ
??1CCBase@DirectUI@@UEAA@XZ
??1CCBaseCheckRadioButton@DirectUI@@UEAA@XZ
??1CCBaseScrollBar@DirectUI@@UEAA@XZ
??1CCCheckBox@DirectUI@@UEAA@XZ
??1CCCommandLink@DirectUI@@UEAA@XZ
??1CCHScrollBar@DirectUI@@UEAA@XZ
??1CCListBox@DirectUI@@UEAA@XZ
??1CCListView@DirectUI@@UEAA@XZ
??1CCProgressBar@DirectUI@@UEAA@XZ
??1CCPushButton@DirectUI@@UEAA@XZ
??1CCRadioButton@DirectUI@@UEAA@XZ
??1CCSysLink@DirectUI@@UEAA@XZ
??1CCTrackBar@DirectUI@@UEAA@XZ
??1CCTreeView@DirectUI@@UEAA@XZ
??1CCVScrollBar@DirectUI@@UEAA@XZ
??1CallstackTracker@DirectUI@@QEAA@XZ
??1CheckBoxGlyph@DirectUI@@UEAA@XZ
??1ClassInfoBase@DirectUI@@UEAA@XZ
??1Clipper@DirectUI@@UEAA@XZ
??1Combobox@DirectUI@@UEAA@XZ
??1CritSecLock@DirectUI@@QEAA@XZ
??1DCSurface@DirectUI@@UEAA@XZ
??1DUIFactory@DirectUI@@QEAA@XZ
??1DUIXmlParser@DirectUI@@UEAA@XZ
??1DialogElement@DirectUI@@UEAA@XZ
??1DuiAccessible@DirectUI@@UEAA@XZ
??1Edit@DirectUI@@UEAA@XZ
??1Element@DirectUI@@UEAA@XZ
??1ElementProvider@DirectUI@@UEAA@XZ
??1ElementWithHWND@DirectUI@@UEAA@XZ
??1ExpandCollapseProvider@DirectUI@@UEAA@XZ
??1Expandable@DirectUI@@UEAA@XZ
??1Expando@DirectUI@@UEAA@XZ
??1ExpandoButtonGlyph@DirectUI@@UEAA@XZ
??1FillLayout@DirectUI@@UEAA@XZ
??1FlowLayout@DirectUI@@UEAA@XZ
??1FontCheckOut@DirectUI@@QEAA@XZ
??1GridItemProvider@DirectUI@@UEAA@XZ
??1GridLayout@DirectUI@@UEAA@XZ
??1GridProvider@DirectUI@@UEAA@XZ
??1HWNDElement@DirectUI@@UEAA@XZ
??1HWNDElementAccessible@DirectUI@@UEAA@XZ
??1HWNDElementProvider@DirectUI@@UEAA@XZ
??1HWNDHost@DirectUI@@UEAA@XZ
??1HWNDHostAccessible@DirectUI@@UEAA@XZ
??1HWNDHostClientAccessible@DirectUI@@UEAA@XZ
??1IDataEngine@DirectUI@@UEAA@XZ
??1IDataEntry@DirectUI@@UEAA@XZ
??1InvokeHelper@DirectUI@@UEAA@XZ
??1InvokeProvider@DirectUI@@UEAA@XZ
??1ItemList@DirectUI@@UEAA@XZ
??1Layout@DirectUI@@UEAA@XZ
??1LinkedList@DirectUI@@QEAA@XZ
??1Macro@DirectUI@@UEAA@XZ
??1ModernProgressBar@DirectUI@@UEAA@XZ
??1ModernProgressRing@DirectUI@@UEAA@XZ
??1Movie@DirectUI@@UEAA@XZ
??1NativeHWNDHost@DirectUI@@UEAA@XZ
??1Navigator@DirectUI@@UEAA@XZ
??1NineGridLayout@DirectUI@@UEAA@XZ
??1PText@DirectUI@@UEAA@XZ
??1Page@DirectUI@@UEAA@XZ
??1Pages@DirectUI@@UEAA@XZ
??1Progress@DirectUI@@UEAA@XZ
??1Proxy@DirectUI@@UEAA@XZ
??1PushButton@DirectUI@@UEAA@XZ
??1RadioButtonGlyph@DirectUI@@UEAA@XZ
??1RangeValueProvider@DirectUI@@UEAA@XZ
??1RefPointElement@DirectUI@@UEAA@XZ
??1RefcountBase@DirectUI@@UEAA@XZ
??1RepeatButton@DirectUI@@UEAA@XZ
??1Repeater@DirectUI@@UEAA@XZ
??1ResourceModuleHandles@DirectUI@@QEAA@XZ
??1RichText@DirectUI@@UEAA@XZ
??1RowLayout@DirectUI@@UEAA@XZ
??1ScrollBar@DirectUI@@UEAA@XZ
??1ScrollItemProvider@DirectUI@@UEAA@XZ
??1ScrollProvider@DirectUI@@UEAA@XZ
??1ScrollViewer@DirectUI@@UEAA@XZ
??1SelectionItemProvider@DirectUI@@UEAA@XZ
??1SelectionProvider@DirectUI@@UEAA@XZ
??1Selector@DirectUI@@UEAA@XZ
??1SelectorNoDefault@DirectUI@@UEAA@XZ
??1ShellBorderLayout@DirectUI@@UEAA@XZ
??1StyledScrollViewer@DirectUI@@UEAA@XZ
??1Surface@DirectUI@@UEAA@XZ
??1TableItemProvider@DirectUI@@UEAA@XZ
??1TableLayout@DirectUI@@UEAA@XZ
??1TableProvider@DirectUI@@UEAA@XZ
??1TaskPage@DirectUI@@UEAA@XZ
??1TextGraphic@DirectUI@@UEAA@XZ
??1Thumb@DirectUI@@UEAA@XZ
??1ToggleProvider@DirectUI@@UEAA@XZ
??1TouchButton@DirectUI@@UEAA@XZ
??1TouchCheckBox@DirectUI@@UEAA@XZ
??1TouchCheckBoxGlyph@DirectUI@@UEAA@XZ
??1TouchHWNDElement@DirectUI@@UEAA@XZ
??1TouchHyperLink@DirectUI@@UEAA@XZ
??1TouchScrollBar@DirectUI@@UEAA@XZ
??1TouchSelect@DirectUI@@UEAA@XZ
??1TouchSelectItem@DirectUI@@UEAA@XZ
??1UnknownElement@DirectUI@@UEAA@XZ
??1ValueProvider@DirectUI@@UEAA@XZ
??1VerticalFlowLayout@DirectUI@@UEAA@XZ
??1Viewer@DirectUI@@UEAA@XZ
??1XBaby@DirectUI@@UEAA@XZ
??1XElement@DirectUI@@UEAA@XZ
??1XHost@DirectUI@@QEAA@XZ
??1XProvider@DirectUI@@UEAA@XZ
??4?$FunctionDefinition@H@DUIXmlParser@DirectUI@@QEAAAEAU012@$$QEAU012@@Z
??4?$FunctionDefinition@H@DUIXmlParser@DirectUI@@QEAAAEAU012@AEBU012@@Z
??4?$FunctionDefinition@K@DUIXmlParser@DirectUI@@QEAAAEAU012@$$QEAU012@@Z
??4?$FunctionDefinition@K@DUIXmlParser@DirectUI@@QEAAAEAU012@AEBU012@@Z
??4?$FunctionDefinition@PEAVValue@DirectUI@@@DUIXmlParser@DirectUI@@QEAAAEAU012@$$QEAU012@@Z
??4?$FunctionDefinition@PEAVValue@DirectUI@@@DUIXmlParser@DirectUI@@QEAAAEAU012@AEBU012@@Z
??4?$FunctionDefinition@UScaledRECT@DirectUI@@@DUIXmlParser@DirectUI@@QEAAAEAU012@$$QEAU012@@Z
??4?$FunctionDefinition@UScaledRECT@DirectUI@@@DUIXmlParser@DirectUI@@QEAAAEAU012@AEBU012@@Z
??4?$FunctionDefinition@UScaledSIZE@DirectUI@@@DUIXmlParser@DirectUI@@QEAAAEAU012@$$QEAU012@@Z
??4?$FunctionDefinition@UScaledSIZE@DirectUI@@@DUIXmlParser@DirectUI@@QEAAAEAU012@AEBU012@@Z
??4ACCESSIBLEROLE@AccessibleButton@DirectUI@@QEAAAEAU012@$$QEAU012@@Z
??4ACCESSIBLEROLE@AccessibleButton@DirectUI@@QEAAAEAU012@AEBU012@@Z
??4AccessibleButton@DirectUI@@QEAAAEAV01@$$QEAV01@@Z
??4AccessibleButton@DirectUI@@QEAAAEAV01@AEBV01@@Z
??4AnimationStrip@DirectUI@@QEAAAEAV01@AEBV01@@Z
??4AutoButton@DirectUI@@QEAAAEAV01@$$QEAV01@@Z
??4AutoButton@DirectUI@@QEAAAEAV01@AEBV01@@Z
??4AutoLock@DirectUI@@QEAAAEAV01@AEBV01@@Z
??4AutoThread@DirectUI@@QEAAAEAV01@AEBV01@@Z
??4AutoVariant@DirectUI@@QEAAAEAV01@AEBV01@@Z
??4BaseScrollBar@DirectUI@@QEAAAEAV01@$$QEAV01@@Z
??4BaseScrollBar@DirectUI@@QEAAAEAV01@AEBV01@@Z
??4BaseScrollViewer@DirectUI@@QEAAAEAV01@AEBV01@@Z
??4Bind@DirectUI@@QEAAAEAV01@$$QEAV01@@Z

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 524KB - Virtual size: 522KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 68KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 56KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
duser.dll
.dll windows:10 windows x64 arch:x64

cd0b1bc6ff6f67a214b502c9e9c6a049

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

DUser.pdb

Imports

msvcrt

_wcsnicmp
_purecall
__CxxFrameHandler4
_isnan
_wcsicmp
realloc
sinf
powf
??1type_info@@UEAA@XZ
_beginthreadex
log10f
_finite
pow
memset
memmove
_resetstkoflw
sqrt
_onexit
__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
malloc
free
_amsg_exit
_XcptFilter
qsort
memcpy
_CxxThrowException
atan2
atan2f
ceil
cosf
floor
floorf
fmod
log
sqrtf

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetVersionExA
GetSystemInfo

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleW
DisableThreadLibraryCalls
GetModuleFileNameA
FreeLibrary
LoadLibraryExW
LoadLibraryExA

api-ms-win-core-registry-l1-1-0

RegOpenKeyExA
RegQueryValueExA
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegGetValueW

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TlsAlloc
GetCurrentProcessId
GetCurrentThreadId
TlsGetValue
GetExitCodeThread
TlsFree
TlsSetValue
TerminateProcess

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
SetLastError

api-ms-win-core-com-l1-1-0

CoCreateInstance

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
InitializeCriticalSection
SetEvent
EnterCriticalSection
CreateEventA
WaitForSingleObject
LeaveCriticalSection
ResetEvent
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
ReleaseSRWLockExclusive
WaitForMultipleObjectsEx

api-ms-win-core-synch-l1-2-0

Sleep
SleepConditionVariableSRW
InitOnceExecuteOnce
WakeAllConditionVariable

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-atoms-l1-1-0

GetAtomNameW
DeleteAtom
FindAtomW
AddAtomW

ntdll

EtwGetTraceEnableFlags
EtwGetTraceLoggerHandle
EtwRegisterTraceGuidsA
EtwGetTraceEnableLevel
EtwUnregisterTraceGuids
EtwLogTraceEvent

user32

TranslateMessage
GetKeyboardState
GetParent
SendMessageW
EndPaint
BeginPaint
IsWindow
GetClientRect
ClientToScreen
GetMonitorInfoW
SystemParametersInfoA
SendMessageA
SetRectEmpty
GetMessageA
GetMessageW
PeekMessageA
PeekMessageW
WaitMessage
GetWindowLongPtrA
SetWindowLongPtrW
DefWindowProcA
CallWindowProcW
GetPointerType
PostThreadMessageA
DrawTextW
WindowFromDC
SystemParametersInfoW
DispatchMessageA
IsThreadDesktopComposited
FillRect
MsgWaitForMultipleObjectsEx
GetQueueStatus
GetMessageTime
IntersectRect
IsRectEmpty
UnionRect
OffsetRect
GetSystemMetrics
GetKeyState
PtInRect
GetDoubleClickTime
ReleaseDC
GetWindowRect
GetFocus
SetFocus
GetCursorPos
ScreenToClient
GetCapture
ChildWindowFromPointEx
ReleaseCapture
GetWindowDC
RegisterWindowMessageA
SetWindowLongPtrA
CallWindowProcA
GetWindowLongPtrW
GetDC
InvalidateRect
SetCapture
TrackMouseEvent
GetCursorInfo
GetMessagePos
PostMessageA
GetPointerDeviceRects

gdi32

CombineRgn
CreatePolygonRgn
GetPixel
GetSystemPaletteEntries
GetDIBits
GetObjectType
CreateDCA
CreateRectRgn
SetWindowOrgEx
SelectClipRgn
StretchDIBits
SetViewportOrgEx
GetObjectA
OffsetRgn
GetViewportOrgEx
GetRandomRgn
SetBrushOrgEx
GetBrushOrgEx
GetCurrentObject
GetDeviceCaps
RestoreDC
SaveDC
ModifyWorldTransform
GetTextExtentExPointW
GetTextExtentPoint32W
CreateFontIndirectW
ExtTextOutW
TextOutW
D3DKMTDestroyDCFromMemory
D3DKMTCreateDCFromMemory
CreateDCW
GdiFlush
CreateDIBSection
GetClipBox
SetRectRgn
BitBlt
ExtSelectClipRgn
IntersectClipRect
GetClipRgn
GetWorldTransform
RealizePalette
SelectPalette
SetWorldTransform
SetGraphicsMode
GetWindowExtEx
GetViewportExtEx
DeleteDC
PatBlt
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
CreatePen
CreateSolidBrush
DeleteObject
GdiAlphaBlend

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc
HeapReAlloc

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-interlocked-l1-1-0

InterlockedFlushSList
QueryDepthSList
InterlockedPushEntrySList
InitializeSListHead
InterlockedPopEntrySList

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-memory-l1-1-0

VirtualFree
VirtualAlloc

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-processthreads-l1-1-1

FlushInstructionCache

api-ms-win-core-kernel32-legacy-l1-1-0

MulDiv

Exports

Exports

AddGadgetMessageHandler
AddLayeredRef
AdjustClipInsideRef
AttachWndProcA
AttachWndProcW
AutoTrace
BeginHideInputPaneAnimation
BeginShowInputPaneAnimation
BuildAnimation
BuildDropTarget
BuildInterpolation
CacheDWriteRenderTarget
ChangeCurrentAnimationScenario
ClearPushedOpacitiesFromGadgetTree
ClearTopmostVisual
CreateAction
CreateGadget
CustomGadgetHitTestQuery
DUserBuildGadget
DUserCastClass
DUserCastDirect
DUserCastHandle
DUserDeleteGadget
DUserFindClass
DUserFlushDeferredMessages
DUserFlushMessages
DUserGetAlphaPRID
DUserGetGutsData
DUserGetRectPRID
DUserGetRotatePRID
DUserGetScalePRID
DUserInstanceOf
DUserPostEvent
DUserPostMethod
DUserRegisterGuts
DUserRegisterStub
DUserRegisterSuper
DUserSendEvent
DUserSendMethod
DUserStopAnimation
DUserStopPVLAnimation
DeleteHandle
DestroyPendingDCVisuals
DetachGadgetVisuals
DetachWndProc
DisableContainerHwnd
DllMain
DrawGadgetTree
EndInputPaneAnimation
EnsureAnimationsEnabled
EnsureGadgetTransInitialized
EnumGadgets
FindGadgetFromPoint
FindGadgetMessages
FindGadgetTargetingInfo
FindStdColor
FireGadgetMessages
ForwardGadgetMessage
FreeGdiDxInteropStagingBuffer
GadgetTransCompositionChanged
GadgetTransSettingChanged
GetActionTimeslice
GetCachedDWriteRenderTarget
GetDUserModule
GetDebug
GetFinalAnimatingPosition
GetGadget
GetGadgetAnimation
GetGadgetBitmap
GetGadgetBufferInfo
GetGadgetCenterPoint
GetGadgetFlags
GetGadgetFocus
GetGadgetLayerInfo
GetGadgetMessageFilter
GetGadgetProperty
GetGadgetRect
GetGadgetRgn
GetGadgetRootInfo
GetGadgetRotation
GetGadgetScale
GetGadgetSize
GetGadgetStyle
GetGadgetTicket
GetGadgetVisual
GetMessageExA
GetMessageExW
GetStdColorBrushF
GetStdColorBrushI
GetStdColorF
GetStdColorI
GetStdColorName
GetStdColorPenF
GetStdColorPenI
GetStdPalette
InitGadgetComponent
InitGadgets
InvalidateGadget
InvalidateLayeredDescendants
IsGadgetParentChainStyle
IsInsideContext
IsStartDelete
LookupGadgetTicket
MapGadgetPoints
PeekMessageExA
PeekMessageExW
RegisterGadgetMessage
RegisterGadgetMessageString
RegisterGadgetProperty
ReleaseDetachedObjects
ReleaseLayeredRef
ReleaseMouseCapture
RemoveClippingImmunityFromVisual
RemoveGadgetMessageHandler
RemoveGadgetProperty
ResetDUserDevice
ScheduleGadgetTransitions
SetActionTimeslice
SetAtlasingHints
SetGadgetBufferInfo
SetGadgetCenterPoint
SetGadgetFillF
SetGadgetFillI
SetGadgetFlags
SetGadgetFocus
SetGadgetFocusEx
SetGadgetLayerInfo
SetGadgetMessageFilter
SetGadgetOrder
SetGadgetParent
SetGadgetProperty
SetGadgetRect
SetGadgetRootInfo
SetGadgetRotation
SetGadgetScale
SetGadgetStyle
SetHardwareDeviceUsage
SetMinimumDCompVersion
SetRestoreCachedLayeredRefFlag
SetTransitionVisualProperties
SetWindowResizeFlag
UnregisterGadgetMessage
UnregisterGadgetMessageString
UnregisterGadgetProperty
UtilBuildFont
UtilDrawBlendRect
UtilDrawOutlineRect
UtilGetColor
UtilSetBackground
WaitMessageEx

Sections

.text
Size: 444KB - Virtual size: 442KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 456B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dusmapi.dll
.dll windows:10 windows x64 arch:x64

c0522ad8dc2dcf2506df432827dc5bc7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

dusmapi.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_free
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__C_specific_handler
__std_terminate
__CxxFrameHandler4
_CxxThrowException
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleExW
GetModuleHandleW
DisableThreadLibraryCalls
GetModuleFileNameA

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionEx
AcquireSRWLockExclusive
WaitForSingleObject
ReleaseSRWLockShared
DeleteCriticalSection
CreateMutexExW
ReleaseSemaphore
ReleaseSRWLockExclusive
CreateSemaphoreExW
OpenSemaphoreW
WaitForSingleObjectEx
LeaveCriticalSection
EnterCriticalSection
AcquireSRWLockShared
ReleaseMutex

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventSetInformation
EventWriteTransfer
EventUnregister

rpcrt4

NdrClientCall3
RpcExceptionFilter
RpcBindingFromStringBindingW
RpcBindingFree
RpcStringBindingComposeW
RpcStringFreeW

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
InitOnceComplete

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer

Exports

Exports

DusmEnumConnectionList
DusmEnumProfileList
DusmFlushCostCache
DusmFree
DusmGetAttributedNetworkUsage
DusmGetConnectionListNetworkUsage
DusmGetNetworkUsage
DusmGetProviderNetworkUsage
DusmQueryBackgroundRestriction
DusmQueryConnectionProperties
DusmQueryCost
DusmQueryDataPlan
DusmQueryGlobalDpuState
DusmQueryOperatorCost
DusmQueryOperatorDataPlan
DusmQuerySource
DusmQueryUserCost
DusmQueryUserDataPlan
DusmResetNetworkUsage
DusmSetAttributionMapping
DusmSetBackgroundRestriction
DusmSetOperatorCost
DusmSetOperatorDataPlan
DusmSetProperty
DusmSetSource
DusmSetUserCost
DusmSetUserDataPlan

Sections

.text
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 424B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dusmsvc.dll
.dll windows:10 windows x64 arch:x64

4f3d12a8e21d1a5dbd34f7b3369fb862

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

dusmsvc.pdb

Imports

msvcp_win

?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?width@ios_base@std@@QEAA_J_J@Z
?width@ios_base@std@@QEBA_JXZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WXZ
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z
?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?setf@ios_base@std@@QEAAHHH@Z
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W0@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?pbase@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z
?uncaught_exception@std@@YA_NXZ
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?flags@ios_base@std@@QEBAHXZ
?good@ios_base@std@@QEBA_NXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z
?_Xbad_function_call@std@@YAXXZ
??7ios_base@std@@QEBA_NXZ
?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z
?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__errno
_o__wcsnicmp
_o_ceilf
_o_free
_o_malloc
_o_wcscat_s
_o_wcstoul
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o__crt_atexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
__C_specific_handler_noexcept
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleExA
DisableThreadLibraryCalls
GetModuleHandleExW
GetModuleFileNameA
LoadStringW
GetModuleHandleW
FreeLibrary
LoadLibraryExW

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockShared
CreateEventW
SetEvent
EnterCriticalSection
LeaveCriticalSection
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
WaitForSingleObject
CreateMutexExW
CreateSemaphoreExW
ReleaseSRWLockExclusive
AcquireSRWLockShared
InitializeCriticalSectionEx
AcquireSRWLockExclusive
ReleaseSemaphore
DeleteCriticalSection
CreateEventExW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetLastError
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetCurrentThread
OpenThreadToken
GetCurrentThreadId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventSetInformation
EventUnregister
EventRegister

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-core-com-l1-1-0

StringFromCLSID
CoTaskMemFree
CoInitializeEx
StringFromGUID2
CoUninitialize
CoSetProxyBlanket

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceBeginInitialize
Sleep
InitOnceExecuteOnce

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-security-base-l1-1-0

CheckTokenMembership
AllocateAndInitializeSid
FreeSid
GetTokenInformation

api-ms-win-core-kernel32-legacy-l1-1-0

UnregisterWait
RegisterWaitForSingleObject

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetSystemTimeAsFileTime
GetSystemTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolWorkCallbacks
CloseThreadpool
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolThreadMaximum
CreateThreadpoolTimer
SetThreadpoolThreadMinimum
SetThreadpoolTimer
CreateThreadpool
SubmitThreadpoolWork
CreateThreadpoolWait
CloseThreadpoolWork
CreateThreadpoolWork
SetThreadpoolWait
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks

api-ms-win-core-file-l1-1-0

FileTimeToLocalFileTime
CompareFileTime

api-ms-win-core-timezone-l1-1-0

TzSpecificLocalTimeToSystemTimeEx
SystemTimeToTzSpecificLocalTimeEx
GetDynamicTimeZoneInformation
FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-core-registry-l1-1-0

RegDeleteTreeW
RegQueryValueExW
RegGetValueW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
RegDeleteValueW
RegSetValueExW
RegEnumValueW
RegEnumKeyExW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
CompareStringEx

ntdll

RtlNtStatusToDosError
RtlWaitForWnfMetaNotification
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlPublishWnfStateData
NtQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlTestAndPublishWnfStateData

api-ms-win-core-registry-l1-1-1

RegDeleteKeyValueW
RegSetKeyValueW

api-ms-win-core-string-l2-1-1

SHLoadIndirectString

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

ServiceMain
SvchostPushServiceGlobals

Sections

.text
Size: 292KB - Virtual size: 291KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dwmapi.dll
.dll windows:10 windows x64 arch:x64

5afe3e97cb8df57e11a735fd26b6cd4b

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c2:29:e2:5e:14:01:5c:75:61:7c:f3:d6:d4:92:a3:16:43:b7:56:6d:22:71:fc:19:c6:e7:03:f5:2d:24:2e:10
Signer

Actual PE Digest

c2:29:e2:5e:14:01:5c:75:61:7c:f3:d6:d4:92:a3:16:43:b7:56:6d:22:71:fc:19:c6:e7:03:f5:2d:24:2e:10

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

dwmapi.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__execute_onexit_table
memmove
_o_floorf
__C_specific_handler
_o__errno
_o___std_type_info_destroy_list
wcsrchr
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o___stdio_common_vswprintf
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset

ntdll

NtCreateEvent
RtlInitUnicodeString
DbgPrompt
NtQuerySystemInformation
RtlCaptureStackBackTrace
DbgPrintEx
RtlDeleteElementGenericTable
RtlNumberGenericTableElements
RtlEnumerateGenericTableWithoutSplaying
WinSqmAddToStream
NtCreateSection
RtlFreeSid
RtlFreeHeap
RtlSetDaclSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
RtlCreateSecurityDescriptor
RtlAllocateHeap
RtlLengthSid
RtlAllocateAndInitializeSid
RtlInitializeGenericTable
RtlLookupElementGenericTable
RtlInsertElementGenericTable
EtwEventUnregister
EtwEventSetInformation
EtwEventRegister
WinSqmIsOptedIn
EtwEventWriteTransfer
NtUnmapViewOfSection
NtMapViewOfSection
NtConnectPort
NtAlpcSendWaitReceivePort
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SbSelectProcedure

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
DisableThreadLibraryCalls
GetModuleFileNameA
GetProcAddress
GetModuleHandleW
GetModuleHandleExW

api-ms-win-core-synch-l1-1-0

CreateSemaphoreExW
OpenEventW
CreateMutexExW
AcquireSRWLockShared
InitializeCriticalSection
InitializeCriticalSectionEx
CreateEventW
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
EnterCriticalSection
ReleaseSRWLockExclusive
ReleaseSemaphore
LeaveCriticalSection
ReleaseMutex
ReleaseSRWLockShared
WaitForSingleObject
DeleteCriticalSection

api-ms-win-core-heap-l1-1-0

HeapReAlloc
GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer

api-ms-win-core-processthreads-l1-1-0

TerminateThread
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
GetCurrentThread

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceExecuteOnce

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-errorhandling-l1-1-3

TerminateProcessOnMemoryExhaustion

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-kernel32-legacy-l1-1-0

MulDiv

win32u

NtDCompositionSetBlurredWallpaperSurface
NtDCompositionRegisterThumbnailVisual
NtDCompositionRegisterVirtualDesktopVisual
NtDCompositionSetChildRootVisual
NtDCompositionDuplicateSwapchainHandleToDwm

user32

SystemParametersInfoW
GetCapture
GetWindowInfo
ord2557
TrackMouseEvent
SetWinEventHook
UnhookWinEvent
ord2635
GetWindowLongPtrW
GetShellWindow
UpdateDefaultDesktopThumbnail
SetWindowCompositionTransition
GetWindow
GetAncestor
GetGuiResources
IsTopLevelWindow
GetSystemMetrics
IsThreadDesktopComposited
DwmGetDxSharedSurface
RemovePropW
GetPropW
ReleaseDC
GetClientRect
GetDC
GetWindowRect
GetDpiForWindow
GetWindowCompositionAttribute
GetWindowThreadProcessId
ord2574
SetWindowCompositionAttribute

gdi32

GetDIBits
DeleteObject
DeleteDC
GdiAlphaBlend
StretchDIBits
CreateDIBSection
CreateCompatibleDC
GetObjectW
GetRegionData
ScaleRgn
ScaleValues
ord1005
Rectangle
GetStockObject
SelectObject

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DwmAttachMilContent
DwmDefWindowProc
DwmDetachMilContent
DwmEnableBlurBehindWindow
DwmEnableComposition
DwmEnableMMCSS
DwmExtendFrameIntoClientArea
DwmFlush
DwmGetColorizationColor
DwmGetCompositionTimingInfo
DwmGetGraphicsStreamClient
DwmGetGraphicsStreamTransformHint
DwmGetTransportAttributes
DwmGetUnmetTabRequirements
DwmGetWindowAttribute
DwmInvalidateIconicBitmaps
DwmIsCompositionEnabled
DwmModifyPreviousDxFrameDuration
DwmQueryThumbnailSourceSize
DwmRegisterThumbnail
DwmRenderGesture
DwmSetDxFrameDuration
DwmSetIconicLivePreviewBitmap
DwmSetIconicThumbnail
DwmSetPresentParameters
DwmSetWindowAttribute
DwmShowContact
DwmTetherContact
DwmTetherTextContact
DwmTransitionOwnedWindow
DwmUnregisterThumbnail
DwmUpdateThumbnailProperties
DwmpAllocateSecurityDescriptor
DwmpDxGetWindowSharedSurface
DwmpDxUpdateWindowSharedSurface
DwmpDxgiIsThreadDesktopComposited
DwmpEnableDDASupport
DwmpFreeSecurityDescriptor
DwmpGetColorizationParameters
DwmpRenderFlick
DwmpSetColorizationParameters
DwmpUpdateProxyWindowForCapture

Sections

.text
Size: 88KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 316B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dwmcore.dll
.dll windows:10 windows x64 arch:x64

77960621649b76f102847f747833cb82

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

dwmcore.pdb

Imports

msvcp_win

?_Random_device@std@@YAIXZ
?_Xbad_function_call@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xoverflow_error@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA

api-ms-win-crt-runtime-l1-1-0

_errno
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_invalid_parameter_noinfo
_configure_narrow_argv
_cexit
_initterm
_initterm_e
_seh_filter_dll
_invoke_watson
_invalid_parameter_noinfo_noreturn

api-ms-win-crt-math-l1-1-0

fmaxf
log2f
_hypot
acos
acosf
asinf
tanf
atan2f
atanf
tan
sqrtf
ceilf
cosf
exp
modff
expf
floor
remainderf
floorf
log
fmod
log10f
fmodf
fminf
_isnan
logf
pow
powf
sin
sinf
sqrt
_finite

api-ms-win-crt-string-l1-1-0

strcpy_s
memset

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s
__stdio_common_vswprintf
__stdio_common_vsprintf
puts
__stdio_common_vsprintf_s

api-ms-win-crt-heap-l1-1-0

malloc
free
_recalloc

api-ms-win-crt-private-l1-1-0

__std_type_info_compare
memcpy
_purecall
__std_type_info_destroy_list
_CxxThrowException
memmove
__C_specific_handler
memcmp

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
FreeLibrary
GetModuleFileNameA
GetModuleHandleExW
GetModuleHandleW
GetModuleHandleExA

api-ms-win-core-synch-l1-1-0

CreateMutexExW
CreateEventExW
WaitForSingleObjectEx
OpenEventW
AcquireSRWLockExclusive
InitializeCriticalSectionAndSpinCount
ReleaseSRWLockExclusive
DeleteCriticalSection
ReleaseMutex
WaitForSingleObject
InitializeCriticalSection
InitializeCriticalSectionEx
OpenSemaphoreW
ReleaseSRWLockShared
LeaveCriticalSection
ReleaseSemaphore
AcquireSRWLockShared
ResetEvent
EnterCriticalSection
SetEvent
SetWaitableTimerEx
CancelWaitableTimer
InitializeSRWLock
CreateSemaphoreExW
CreateEventW

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapReAlloc
HeapFree
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
WaitForThreadpoolWorkCallbacks
CreateThreadpoolWork
SubmitThreadpoolWork
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolWork
CloseThreadpoolTimer

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetThreadId
GetCurrentThread
ProcessIdToSessionId
TlsAlloc
ResumeThread
SetThreadPriority
CreateThread
TlsFree
TlsGetValue
OpenProcessToken
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
TerminateThread
TlsSetValue

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringA
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-processthreads-l1-1-3

SetThreadDescription

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryValueW

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl
EventWriteTransfer
EventEnabled
EventRegister
EventUnregister
EventSetInformation

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceBeginInitialize
Sleep

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

ntdll

NtQueryDirectoryObject
NtOpenDirectoryObject
RtlInitUnicodeString
RtlFreeHeap
RtlAcquireSRWLockExclusive
RtlReleaseSRWLockExclusive
RtlInitializeSRWLock
RtlAllocateHeap
RtlGetDeviceFamilyInfoEnum
RtlLookupElementGenericTable
RtlDeleteElementGenericTable
NtUnmapViewOfSection
NtCreateSection
NtMapViewOfSection
RtlInsertElementGenericTable
RtlInitializeGenericTable
RtlEnumerateGenericTableWithoutSplaying
NtSetInformationProcess
EtwCheckCoverage
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfStateChangeNotification
RtlPublishWnfStateData
DbgPrintEx
NtQuerySystemInformation
DbgPrompt

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
OpenFileMappingW
CreateFileMappingW
MapViewOfFile

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA
LoadLibraryW

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead
QueryDepthSList
InterlockedPopEntrySList
InterlockedFlushSList
InterlockedPushEntrySList

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetTickCount64
GetVersionExW
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-kernel32-legacy-l1-1-0

PulseEvent

api-ms-win-core-synch-l1-2-1

CreateWaitableTimerW
WaitForMultipleObjects

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-rtlsupport-l1-1-0

RtlCompareMemory
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlCaptureStackBackTrace

api-ms-win-power-base-l1-1-0

CallNtPowerInformation

api-ms-win-core-realtime-l1-1-0

QueryThreadCycleTime

api-ms-win-core-psapi-l1-1-0

K32GetProcessMemoryInfo

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError
GetRestrictedErrorInfo
RoTransformError
SetRestrictedErrorInfo

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

rpcrt4

RpcStringFreeW
RpcStringBindingComposeW
RpcBindingFromStringBindingW
NdrClientCall3

api-ms-win-core-errorhandling-l1-1-3

TerminateProcessOnMemoryExhaustion

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-dx-d3dkmt-l1-1-0

D3DKMTQueryAdapterInfo
D3DKMTGetDeviceState
D3DKMTCloseAdapter
D3DKMTEscape

windowscodecs

WICCreateImagingFactory_Proxy

d3dcompiler_47

D3DCreateFunctionLinkingGraph
D3DLoadModule
D3DCreateLinker
D3DCreateBlob

d2d1

ord2
ord3
ord4
ord1
ord5

dwrite

DWriteCreateFactory

win32u

NtDCompositionBeginFrame
NtDCompositionSubmitDWMBatch
NtDCompositionCreateConnection
NtDCompositionDestroyConnection
NtDCompositionReferenceSharedResourceOnDwmChannel
NtDCompositionCreateSharedResourceHandle
NtDCompositionDestroyChannel
NtDCompositionCreateDwmChannel
NtDCompositionConfirmFrame
NtKSTWait
NtDCompositionWaitForCompositorClock
NtTokenManagerGetAnalogExclusiveSurfaceUpdates
NtSetCompositionSurfaceStatistics
NtTokenManagerGetAnalogExclusiveTokenEvent
NtTokenManagerConfirmOutstandingAnalogToken
NtTokenManagerThread
NtDCompositionGetFrameSurfaceUpdates
NtTokenManagerOpenSectionAndEvents
NtValidateCompositionSurfaceHandle
NtMITDispatchCompletion
NtMITDeactivateInputProcessing
NtMITActivateInputProcessing
NtDCompositionUpdatePointerCapture
NtDCompositionGetFrameStatistics
NtQueryCompositionInputSinkLuid
NtQueryCompositionInputIsImplicit
NtQueryCompositionInputQueueAndTransform
NtQueryCompositionInputSink
NtUpdateInputSinkTransforms
NtCloseCompositionInputSink
NtDCompositionGetConnectionBatch
NtDCompositionGetFrameLegacyTokens
NtQueryCompositionSurfaceFrameRate
NtSetCompositionSurfaceAnalogExclusive
NtSetCompositionSurfaceBufferUsage
NtQueryCompositionSurfaceRenderingRealization
NtQueryCompositionSurfaceBinding
NtSetCompositionSurfaceDirectFlipState
NtSetCompositionSurfaceIndependentFlipInfo
NtOpenCompositionSurfaceRealizationInfo
NtOpenCompositionSurfaceDirtyRegion
NtQueryCompositionSurfaceHDRMetaData
NtHWCursorUpdatePointer
NtKSTInitialize

dcomp

ord2504
ord2002
ord2001
DCompositionCreateSurfaceHandle

coremessaging

CoreUICreate
CoreUICallCreateConversationHost
CoreUICallReceive
CoreUICreateEx
CoreUICallCreateEndpointHost
CoreUICallSend

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-security-base-l1-1-0

PrivilegeCheck

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsCreateStringReference
WindowsCreateString

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-dx-d3dkmt-l1-1-1

D3DKMTOpenAdapterFromLuid

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1
CreateDXGIFactory2

Exports

Exports

MilCompositionEngine_CreateChannel
MilCompositionEngine_CreateCursorController
MilCompositionEngine_GetComposedEventId
MilCompositionEngine_Initialize
MilCompositionEngine_Uninitialize

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 152KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 640B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dwmghost.dll
.dll windows:10 windows x64 arch:x64

f029e716163dab71cec8bd18298184b6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

dwmghost.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
__C_specific_handler
_o__cexit
_o__crt_atexit
_o___stdio_common_vswprintf
_o__configure_narrow_argv
_o___std_type_info_destroy_list
memcpy

api-ms-win-crt-string-l1-1-0

memset

ntdll

ZwUpdateWnfStateData
ZwQueryWnfStateNameInformation
PssNtFreeSnapshot
NtQuerySystemInformation
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WinSqmIsOptedIn
WinSqmAddToStream
RtlCompareMemory
NtOpenEvent
NtWaitForSingleObject
RtlAllocateAndInitializeSid
RtlInitUnicodeString
NtAlpcConnectPort
EtwEventWriteNoRegistration
NtAlpcSendWaitReceivePort
RtlFreeSid
NtClose
PssNtCaptureSnapshot
NtOpenProcess
RtlQueryResourcePolicy

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleHandleW
LoadStringW
GetModuleFileNameA
LoadLibraryExW
GetModuleHandleExW
GetProcAddress

api-ms-win-core-synch-l1-1-0

CreateSemaphoreExW
SetEvent
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
ReleaseSemaphore
CreateEventW
WaitForMultipleObjectsEx
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
WaitForSingleObject

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TerminateProcess
CreateThread
GetCurrentThreadId
GetExitCodeThread
ResumeThread
GetCurrentProcess
SetThreadPriority

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer

api-ms-win-core-processthreads-l1-1-1

OpenProcess
IsProcessorFeaturePresent

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindFileNameW

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

user32

RegisterFrostWindow
GetDC
SetClassLongPtrW
GetClassNameW
GetWindowLongW
EndTask
MonitorFromPoint
MonitorFromWindow
GetSystemMetrics
MessageBeep
GetMonitorInfoW
FlashWindowEx
GetCaretBlinkTime
SystemParametersInfoW
IsDialogMessageW
MsgWaitForMultipleObjectsEx
CreateDialogParamW
CreateWindowInBand
GetUpdateRgn
SetWindowLongPtrW
GetWindowLongPtrW
OffsetRect
GetWindowBand
InternalGetWindowText
SetThreadDpiAwarenessContext
RegisterGhostWindow
InternalGetWindowIcon
UpdateWindow
InvalidateRect
GetDCEx
ReleaseDC
BeginPaint
EndPaint

gdi32

CreateDIBSection
BitBlt
SelectObject
CreateCompatibleDC
GdiAlphaBlend
GetStockObject
OffsetRgn
CreateRectRgn
DeleteDC
SelectClipRgn
DeleteObject
GetRandomRgn
CombineRgn
GetRgnBox
CreateCompatibleBitmap
GetDIBits

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

DWMGhostCleanup
DWMGhostHandleGhostMsg
DWMGhostInitialize
DWMGhostSetInShutdown

Sections

.text
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dwminit.dll
.dll windows:10 windows x64 arch:x64

3700e872087f8a3f8bd53abe97df4841

Code Sign

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bd:d3:b6:54:02:1e:6f:b0:f9:f0:90:f6:b9:c8:72:ff:5e:cc:a6:ea:a8:65:9d:1a:58:66:2c:16:28:ed:90:7e
Signer

Actual PE Digest

bd:d3:b6:54:02:1e:6f:b0:f9:f0:90:f6:b9:c8:72:ff:5e:cc:a6:ea:a8:65:9d:1a:58:66:2c:16:28:ed:90:7e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

dwminit.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_free
_o_malloc
__C_specific_handler
memcmp
_o__crt_atexit
_o___stdio_common_vswprintf
_o__cexit
_o__callnewh
_o__configure_narrow_argv
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_CxxThrowException
memcpy

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetProcAddress
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleExW
FreeLibrary

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
InitializeCriticalSection
DeleteCriticalSection
CreateEventExW
SetEvent
AcquireSRWLockShared
InitializeCriticalSectionEx
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CreateEventW
OpenEventW
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
LeaveCriticalSection

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

SetLastError
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetProcessTimes
CreateThread
GetCurrentProcessId
ResumeThread
GetCurrentThreadId
GetExitCodeProcess
ProcessIdToSessionId
CreateProcessAsUserW
GetProcessId
SetThreadPriority
TerminateProcess
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl
EventUnregister
EventSetInformation
EventRegister
EventWriteTransfer

api-ms-win-eventlog-legacy-l1-1-0

RegisterEventSourceW
DeregisterEventSource
ReportEventW

api-ms-win-core-processthreads-l1-1-3

SetThreadDescription

api-ms-win-security-base-l1-1-0

GetLengthSid
SetTokenInformation
ImpersonateLoggedOnUser
CreateRestrictedToken
RevertToSelf

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegOpenKeyExW
RegGetValueW
RegOpenCurrentUser
RegCloseKey

ntdll

RtlFreeSid
RtlAllocateAndInitializeSid
RtlInitUnicodeString
NtAlpcSendWaitReceivePort
NtQueryInformationProcess
RtlPublishWnfStateData
NtClose
NtConnectPort
NtUnmapViewOfSection
NtOpenEvent
NtSetEvent

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
RtlCaptureStackBackTrace

api-ms-win-core-errorhandling-l1-1-3

TerminateProcessOnMemoryExhaustion

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceBeginInitialize

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

win32u

NtKSTInitialize
NtKSTWait

Exports

Exports

DwmpCreateSessionProcess
DwmpIsInitialSessionInteractive
DwmpNotifyUserLogoff
DwmpNotifyUserLogon
DwmpShutdownWinlogonMouseThread
DwmpStartWinlogonMouseThread
DwmpTerminateSessionProcess

Sections

.text
Size: 56KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 220B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dwmredir.dll
.dll windows:10 windows x64 arch:x64

f9e23fa7b80b1fd04b768580b28e5f14

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

dwmredir.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__crt_atexit
__C_specific_handler
_o__errno
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleW
GetModuleFileNameA
DisableThreadLibraryCalls
LoadLibraryExA
GetModuleHandleExW
FreeLibrary

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockShared
CreateSemaphoreExW
ReleaseMutex
ReleaseSRWLockExclusive
EnterCriticalSection
InitializeCriticalSection
ReleaseSemaphore
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
AcquireSRWLockExclusive
OpenSemaphoreW
WaitForSingleObjectEx
WaitForSingleObject

api-ms-win-core-heap-l1-1-0

HeapReAlloc
HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer

api-ms-win-core-processthreads-l1-1-0

GetThreadId
GetCurrentProcessId
ProcessIdToSessionId
TerminateProcess
TerminateThread
GetCurrentThread
CreateThread
GetCurrentThreadId
SetThreadPriority
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount64
GetTickCount

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList
InitializeSListHead
InterlockedFlushSList

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureStackBackTrace
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-errorhandling-l1-1-3

TerminateProcessOnMemoryExhaustion

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegQueryValueExW
RegCloseKey

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

ntdll

EtwEventRegister
RtlEnumerateGenericTableWithoutSplaying
RtlLookupElementGenericTable
RtlInsertElementGenericTable
RtlDeleteElementGenericTable
EtwEventSetInformation
EtwEventUnregister
RtlInitUnicodeString
NtCreateWaitablePort
NtReplyPort
RtlNumberGenericTableElements
RtlIsGenericTableEmpty
NtAlpcSendWaitReceivePort
NtAcceptConnectPort
NtCompleteConnectPort
NtReplyWaitReceivePort
EtwEventWriteTransfer
NtQuerySystemInformation
DbgPrintEx
DbgPrompt
RtlInitializeGenericTable

user32

DwmValidateWindow
SignalRedirectionStartComplete
EnableSessionForMMCSS
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
IntersectRect
GetSystemMetrics
GetWindowThreadProcessId
ord2572
ReleaseDC
GetDC
ord2635
PostMessageW
IsWindowInDestroy
IsWindow
GetWindowRect
GetWindowDpiAwarenessContext
SetThreadDpiAwarenessContext
EqualRect
GetWindowCompositionAttribute
CheckProcessSession
GetGuiResources

gdi32

CombineRgn
GetRegionData
GetDCDpiScaleValue
CreateRectRgn
CreateCompatibleDC
CreateDIBSection
CreateCompatibleBitmap
SelectObject
BitBlt
DeleteDC
ExtCreateRegion
DeleteObject
ord1007

dwmcore

MilCompositionEngine_CreateChannel

win32u

NtCreateImplicitCompositionInputSink

dcomp

ord1060

coremessaging

CoreUICreateEx

api-ms-win-core-processthreads-l1-1-3

SetThreadDescription

api-ms-win-core-memory-l1-1-0

VirtualQuery
VirtualProtect

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

DwmInitializePort
DwmRedirectionManagerInitialize
DwmRedirectionManagerShutdown

Sections

.text
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 720B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dwmscene.dll
.dll windows:10 windows x64 arch:x64

b07c7afe20a7c75c864696d49f52598c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

DwmScene.pdb

Imports

msvcp_win

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?good@ios_base@std@@QEBA_NXZ
?flags@ios_base@std@@QEBAHXZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??Bid@locale@std@@QEAA_KXZ
?width@ios_base@std@@QEBA_JXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?width@ios_base@std@@QEAA_J_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$ctype@D@std@@2V0locale@2@A
?is@?$ctype@D@std@@QEBA_NFD@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
_Thrd_id
_Cnd_init_in_situ
_Cnd_destroy_in_situ
_Cnd_signal
?_Throw_Cpp_error@std@@YAXH@Z
_Thrd_join
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
_Cnd_timedwait
_Mtx_current_owns
_Xtime_get_ticks
_Cnd_do_broadcast_at_thread_exit
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ
?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WXZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?pbase@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W0@Z
?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z
?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z
?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?widen@?$ctype@_W@std@@QEBA_WD@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z
??Bios_base@std@@QEBA_NXZ
_Thrd_detach
_Cnd_broadcast
_Cnd_wait
?_Xinvalid_argument@std@@YAXPEBD@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_K@Z
_Thrd_yield
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z
_Mtx_init_in_situ
_Mtx_destroy_in_situ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?_Xbad_function_call@std@@YAXXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA
?_Throw_C_error@std@@YAXH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
_Mtx_lock
_Mtx_unlock
?_Syserror_map@std@@YAPEBDH@Z
_Query_perf_counter
_Query_perf_frequency

api-ms-win-crt-runtime-l1-1-0

_invoke_watson
_initterm
_initterm_e

api-ms-win-crt-math-l1-1-0

fminf
fmaxf
copysignf

api-ms-win-crt-string-l1-1-0

memset
strnlen

api-ms-win-crt-private-l1-1-0

_o__beginthreadex
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__fdclass
_o__fdsign
_o__free_base
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__malloc_base
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
memchr
_o_abort
_o_acosf
_o_atan2f
_o_cbrtf
_o_ceilf
_o_cosf
_o_expf
_o_floor
_o_floorf
_o_fmodf
_o_log
_o_log2f
_o_pow
_o_powf
_o_remainderf
_o_round
_o_roundf
_o_sinf
_o_sqrtf
_o_strncpy_s
_o_strtol
_o_strtoul
_o_tanf
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
_o__aligned_malloc
_o__aligned_free
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnprintf_s
_o___stdio_common_vfprintf
_o___std_type_info_name
_o___std_type_info_destroy_list
_o___acrt_iob_func
__std_type_info_compare
__std_type_info_hash
__std_terminate
__CxxFrameHandler4
memcpy
memcmp
_CxxThrowException
memmove
__RTDynamicCast
__CxxFrameHandler3
__RTtypeid
strrchr
strchr

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
GetModuleHandleW
GetModuleHandleExW
GetProcAddress

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionAndSpinCount
OpenSemaphoreW
WaitForSingleObjectEx
EnterCriticalSection
DeleteCriticalSection
CreateMutexExW
ReleaseMutex
LeaveCriticalSection
WaitForSingleObject
ResetEvent
ReleaseSemaphore
CreateEventW
SetEvent
CreateSemaphoreExW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
SetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetCurrentThreadId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent
OutputDebugStringA

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-errorhandling-l1-1-3

TerminateProcessOnMemoryExhaustion

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GlobalMemoryStatusEx
GetSystemInfo

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventSetInformation
EventWriteTransfer
EventRegister

api-ms-win-core-com-l1-1-0

StringFromGUID2
CoCreateGuid

api-ms-win-core-psapi-l1-1-0

K32GetProcessMemoryInfo

d3d11

D3D11CreateDevice

d2d1

ord1

dxgi

CreateDXGIFactory1

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
InitOnceComplete

Exports

Exports

CreateDwmSceneRenderer

Sections

.text
Size: 996KB - Virtual size: 993KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 824KB - Virtual size: 820KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dxdiagn.dll
.dll regsvr32 windows:10 windows x64 arch:x64

b5acba6bc7a804f9f3c2e944eac2c509

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

dxdiagn.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsicmp
_o__wcsnicmp
_o__wsplitpath_s
_o__wtoi
_o_free
_o_isdigit
_o_iswalpha
_o_iswdigit
_o_malloc
_o_realloc
_o_terminate
_o_towlower
_o_towupper
__C_specific_handler
__current_exception
__current_exception_context
_CxxThrowException
_o__execute_onexit_table
_o__errno
wcsstr
wcsrchr
wcschr
__CxxFrameHandler3
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o__beginthreadex
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset
wcscmp
wcsnlen
wcsncmp

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW
lstrcmpW

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExA
FreeLibrary
GetModuleFileNameA
LoadStringW
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetModuleHandleExW

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl
EventRegister
EventUnregister
EventWriteTransfer
EventSetInformation

api-ms-win-core-file-l1-1-0

CreateFileW
GetFileAttributesW
FindClose
FindFirstFileW
FileTimeToLocalFileTime
GetFullPathNameW

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegSetValueExW
RegEnumKeyExW
RegEnumValueW
RegCloseKey
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW

api-ms-win-core-registry-l2-1-0

RegOpenKeyW
RegDeleteKeyW
RegEnumKeyW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetWindowsDirectoryW
GetSystemTimeAsFileTime
GetLocalTime
GetLogicalProcessorInformationEx
GetSystemDirectoryW
GetVersionExW
GlobalMemoryStatusEx
GetSystemInfo
GetSystemWindowsDirectoryW

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
SetLastError

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent
OpenProcess

d3d11

D3D11CreateDevice

d3d12

ord101

msvcp_win

?_Xlength_error@std@@YAXPEBD@Z

oleaut32

VariantCopy
VariantInit
VariantClear
SysAllocString
SafeArrayAccessData
SafeArrayUnaccessData
SysFreeString

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
CompareStringW

api-ms-win-core-com-l1-1-0

CoSetProxyBlanket
PropVariantClear
CoUninitialize
CoInitializeEx
CoCreateInstance
CLSIDFromString
CoTaskMemFree
StringFromGUID2

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
ReleaseSemaphore
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
CreateSemaphoreExW

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-service-management-l1-1-0

OpenSCManagerW
OpenServiceW
CloseServiceHandle

api-ms-win-service-management-l2-1-0

QueryServiceConfigW

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetLocaleInfoW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-version-l1-1-1

GetFileVersionInfoSizeW
GetFileVersionInfoW

api-ms-win-core-string-l2-1-0

CharLowerBuffW
CharNextW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-wow64-l1-1-0

Wow64EnableWow64FsRedirection

api-ms-win-core-processenvironment-l1-1-0

SetCurrentDirectoryW
GetCurrentDirectoryW
ExpandEnvironmentStringsW

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatW

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

api-ms-win-core-wow64-l1-1-1

GetSystemWow64DirectoryW

api-ms-win-devices-config-l1-1-1

CM_Get_Parent
CM_Get_Device_IDW
CM_Open_DevNode_Key
CM_Get_Child
CM_Get_Sibling
CM_Locate_DevNodeW
CM_Get_Device_Interface_PropertyW

api-ms-win-core-sysinfo-l1-2-1

GetPhysicallyInstalledSystemMemory

api-ms-win-core-privateprofile-l1-1-0

GetProfileIntW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo

api-ms-win-core-kernel32-legacy-l1-1-0

GetSystemPowerStatus
GlobalMemoryStatus

api-ms-win-core-kernel32-legacy-l1-1-1

GetFirmwareType

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString
WindowsDeleteString

api-ms-win-security-cryptoapi-l1-1-0

CryptReleaseContext
CryptAcquireContextW

api-ms-win-power-setting-l1-1-0

PowerGetActiveScheme
PowerReadACValue
PowerReadDCValue

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

devobj

DevObjEnumDeviceInfo
DevObjGetDeviceInstanceId
DevObjGetDeviceInterfaceProperty
DevObjGetDeviceRegistryProperty
DevObjDestroyDeviceInfoList
DevObjGetDeviceProperty
DevObjOpenDeviceInfo
DevObjGetDeviceInterfaceDetail
DevObjOpenDevRegKey
DevObjCreateDeviceInfoList
DevObjGetClassDevs
DevObjOpenDeviceInterface
DevObjEnumDeviceInterfaces

api-ms-win-mm-misc-l1-1-0

mmioClose
mmioRead
mmioDescend
mmioOpenW

dxgi

CreateDXGIFactory1

api-ms-win-ntuser-sysparams-l1-1-0

GetMonitorInfoW
EnumDisplaySettingsW
EnumDisplayDevicesW
DisplayConfigGetDeviceInfo
EnumDisplayMonitors
GetSystemMetrics
GetDisplayConfigBufferSizes
QueryDisplayConfig

api-ms-win-rtcore-ntuser-window-l1-1-0

FindWindowW

cfgmgr32

CM_Get_Device_Interface_AliasW
CM_Get_Device_ID_ExW

wmiclnt

WmiOpenBlock
WmiCloseBlock
WmiQuerySingleInstanceW

wintrust

CryptCATClose
CryptCATEnumerateCatAttr
CryptCATOpen

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-dx-d3dkmt-l1-1-1

D3DKMTNetDispQueryMiracastDisplayDeviceSupport

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 248KB - Virtual size: 247KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 108KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 380B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dxgi.dll
.dll windows:10 windows x64 arch:x64

a795f1531f5ed5f42e665214ee341d46

Code Sign

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

26:64:24:10:99:20:f6:c9:db:22:92:24:30:45:ab:6c:92:6e:31:aa:e9:57:02:59:6f:ed:6e:bb:1d:c1:fe:04
Signer

Actual PE Digest

26:64:24:10:99:20:f6:c9:db:22:92:24:30:45:ab:6c:92:6e:31:aa:e9:57:02:59:6f:ed:6e:bb:1d:c1:fe:04

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

dxgi.pdb

Imports

msvcp_win

_Mtx_init_in_situ
_Mtx_destroy_in_situ
?_Throw_C_error@std@@YAXH@Z
?_Xlength_error@std@@YAXPEBD@Z
_Mtx_lock
?_Xbad_function_call@std@@YAXXZ
_Mtx_unlock

api-ms-win-crt-string-l1-1-0

strncmp
wcsspn
memset
wcsncmp
wcscspn

api-ms-win-crt-math-l1-1-0

_finite

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__stricmp
_o__wcsicmp
memmove
_o__wcsnicmp
_o_atoi
_o_ceil
_o_ceilf
_o_free
_o_malloc
_o_pow
_o_powf
_o_terminate
_o_tolower
_o_wcstombs_s
__current_exception
__current_exception_context
_CxxThrowException
wcschr
wcsrchr
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o__execute_onexit_table
_o__errno
_o___std_exception_copy
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
__C_specific_handler
__std_terminate
__CxxFrameHandler4
_o__aligned_malloc
_o__aligned_free
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
__C_specific_handler_noexcept
memchr
_o___stdio_common_vsnprintf_s
memcmp
memcpy

ntdll

RtlReAllocateHeap
RtlAllocateHeap
ZwEnumerateValueKey
RtlDosPathNameToNtPathName_U_WithStatus
ZwCreateFile
NtQueryInformationFile
RtlAppendUnicodeToString
RtlAppendUnicodeStringToString
RtlRunOnceExecuteOnce
NtQueryWnfStateData
RtlGetDeviceFamilyInfoEnum
RtlPublishWnfStateData
ZwClose
RtlIsCriticalSectionLockedByThread
EtwEventUnregister
EtwEventRegister
RtlIsMultiSessionSku
RtlCaptureStackBackTrace
EtwEventWrite
EtwEventWriteTransfer
ZwOpenKey
ZwQueryValueKey
ZwQuerySystemInformation
RtlGetVersion
RtlSubscribeWnfStateChangeNotification
RtlQueryWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlInitUnicodeString
EtwEventSetInformation
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUpcaseUnicodeChar
RtlGetNativeSystemInformation
RtlFreeUnicodeString
ZwQueryDirectoryFile
RtlpEnsureBufferSize
RtlNtPathNameToDosPathName
ZwOpenFile
ZwEnumerateKey
RtlInitUnicodeStringEx
ZwQueryInformationFile
ZwCreateSection
RtlInitString
RtlxAnsiStringToUnicodeSize
RtlAnsiStringToUnicodeString
ZwUnmapViewOfSection
ZwMapViewOfSection
LdrResSearchResource
VerSetConditionMask
RtlVerifyVersionInfo
RtlImageDirectoryEntryToData
RtlFreeHeap
EtwEventWriteNoRegistration

win32u

NtQueryCompositionSurfaceStatistics
NtUnBindCompositionSurface
NtBindCompositionSurface

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
FreeLibrary
GetProcAddress
GetModuleHandleW
GetModuleHandleExW
GetModuleHandleExA
GetModuleHandleA
GetModuleFileNameA
GetModuleFileNameW
DisableThreadLibraryCalls

api-ms-win-core-synch-l1-1-0

OpenMutexW
CreateMutexW
ResetEvent
CreateSemaphoreExW
EnterCriticalSection
ReleaseSemaphore
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
InitializeCriticalSection
InitializeSRWLock
TryEnterCriticalSection
CreateEventA
SetEvent
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
InitializeCriticalSectionEx
CreateEventExW
WaitForSingleObject
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseSRWLockShared
ReleaseSRWLockExclusive
ReleaseMutex

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap
HeapReAlloc

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
RaiseException
SetLastError

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
SetThreadpoolWait
WaitForThreadpoolTimerCallbacks
CreateThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
SetThreadpoolTimer
CloseThreadpoolTimer

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
CreateThread
GetCurrentProcess
GetProcessId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent
OutputDebugStringA

api-ms-win-core-handle-l1-1-0

GetHandleInformation
CompareObjectHandles
DuplicateHandle
CloseHandle

api-ms-win-security-base-l1-1-0

GetSidLengthRequired
AddMandatoryAce
CheckTokenMembership
GetSidSubAuthority
IsValidSid
AllocateLocallyUniqueId
AddAccessAllowedAce
InitializeSid
AllocateAndInitializeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorSacl
SetKernelObjectSecurity
GetLengthSid
FreeSid
InitializeAcl

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-version-l1-1-0

GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA
LoadLibraryW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW
lstrcmpA
lstrcmpW

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW
GetVersionExA
GlobalMemoryStatusEx
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-registry-l1-1-0

RegQueryValueExA
RegEnumKeyExA
RegGetValueA
RegGetValueW
RegOpenKeyExW
RegOpenKeyExA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegNotifyChangeKeyValue
RegQueryValueExW

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
InitOnceComplete
Sleep

api-ms-win-core-quirks-l1-1-0

QuirkIsEnabled

api-ms-win-core-psapi-l1-1-0

K32GetModuleInformation

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-atoms-l1-1-0

GlobalAddAtomA

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

kernelbase

BaseFormatObjectAttributes

api-ms-win-core-file-l1-1-0

CreateFileA
GetFileSize

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

ApplyCompatResolutionQuirking
CompatString
CompatValue
CreateDXGIFactory
CreateDXGIFactory1
CreateDXGIFactory2
DXGID3D10CreateDevice
DXGID3D10CreateLayeredDevice
DXGID3D10GetLayeredDeviceSize
DXGID3D10RegisterLayers
DXGIDeclareAdapterRemovalSupport
DXGIDisableVBlankVirtualization
DXGIDumpJournal
DXGIGetDebugInterface1
DXGIReportAdapterConfiguration
PIXBeginCapture
PIXEndCapture
PIXGetCaptureState
SetAppCompatStringPointer
UpdateHMDEmulationStatus

Sections

.text
Size: 636KB - Virtual size: 632KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 188KB - Virtual size: 187KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dxgwdi.dll
.dll windows:10 windows x64 arch:x64

c602681bd4d66dec04b235437901e67a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

dxgwdi.pdb

Imports

msvcrt

__dllonexit
_unlock
_lock
_onexit
memcpy
_initterm
malloc
free
_amsg_exit
_XcptFilter
_wcsnicmp
__C_specific_handler
memcpy_s
_vsnwprintf
memset

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

ntdll

RtlCompareMemory
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

advapi32

DeregisterEventSource
RegSetValueExW
RegCloseKey
RegisterEventSourceW
GetTokenInformation
RegCreateKeyExW
ReportEventW

ole32

CoUninitialize
CoCreateInstance
CoInitializeEx

newdev

DiInstallDevice

wtsapi32

WTSQueryUserToken

wdi

WdiGetParameterDataLength
WdiGetDiagnosticModuleId
WdiGetParameterCount
WdiAddParameter
WdiGetEvent
WdiSetProblemDetectionResult
WdiSetResolution
WdiGetParameterData
WdiGetParameterByIndex

kernel32

Sleep
LocalFree
QueryFullProcessImageNameW
GetApplicationUserModelId
OpenProcess
LocalAlloc
WTSGetActiveConsoleSessionId
VirtualQuery
FreeLibrary
GetSystemInfo
RaiseException
AcquireSRWLockExclusive
RegisterWaitUntilOOBECompleted
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
ReleaseSRWLockExclusive
LoadLibraryExA
VirtualProtect
UnregisterWaitUntilOOBECompleted
IsDebuggerPresent
DebugBreak
GetModuleHandleW
GetProcessHeap
GetCurrentProcessId
CreateMutexExW
GetProcAddress
HeapAlloc
CloseHandle
OpenSemaphoreW
HeapFree
WaitForSingleObjectEx
OutputDebugStringW
GetLastError
GetModuleFileNameA
CreateSemaphoreExW
FormatMessageW
SetLastError
ReleaseSemaphore
GetModuleHandleExW
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex

gdi32

D3DKMTEscape
D3DKMTCloseAdapter
D3DKMTOpenAdapterFromDeviceName

Exports

Exports

WdiDiagnosticModuleMain
WdiGetDiagnosticModuleInterfaceVersion
WdiHandleInstance

Sections

.text
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dxilconv.dll
.dll windows:10 windows x64 arch:x64

f4672d2d473877d081fb82374a47667f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

dxilconv.pdb

Imports

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventRegister
EventSetInformation
EventUnregister

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
EnterCriticalSection
LeaveCriticalSection
CreateEventW
DeleteCriticalSection
SetEvent
WaitForSingleObjectEx
ResetEvent

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-util-l1-1-0

EncodePointer

api-ms-win-core-processthreads-l1-1-0

ExitProcess
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
GetStartupInfoW
GetProcessTimes
GetCurrentProcess
TlsFree
TlsGetValue
TlsAlloc
TlsSetValue

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoTaskMemAlloc
CoGetMalloc

api-ms-win-core-file-l1-1-0

DeleteFileW
GetFileInformationByHandle
SetFileTime
RemoveDirectoryW
FindFirstFileExW
FindFirstFileW
GetFileType
SetEndOfFile
ReadFile
FlushFileBuffers
CreateDirectoryW
GetFileAttributesW
GetFileSizeEx
CreateFileW
FindNextFileW
WriteFile
SetFilePointerEx
FindClose

api-ms-win-core-console-l2-1-0

GetConsoleScreenBufferInfo
SetConsoleTextAttribute

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentStringsW
GetCommandLineW
FreeEnvironmentStringsW
GetStdHandle
GetCurrentDirectoryW
SetStdHandle
GetCommandLineA

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetProcAddress
GetModuleHandleW
GetModuleHandleExW
LoadLibraryExW
GetModuleFileNameW

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-file-l2-1-0

CreateHardLinkW
MoveFileExW

api-ms-win-core-memory-l1-1-0

CreateFileMappingW
UnmapViewOfFile
MapViewOfFile

api-ms-win-core-console-l1-1-0

GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
WriteConsoleW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-localization-l1-2-0

IsValidCodePage
GetACP
LCMapStringW
GetOEMCP
GetCPInfo
FormatMessageA

api-ms-win-core-rtlsupport-l1-1-0

RtlPcToFileHeader
RtlLookupFunctionEntry
RtlCaptureContext
RtlUnwindEx
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapSize
HeapReAlloc
HeapAlloc
HeapFree

api-ms-win-core-fibers-l1-1-0

FlsGetValue
FlsFree
FlsSetValue
FlsAlloc

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead
InterlockedFlushSList

Exports

Exports

DxcCreateInstance
DxcCreateInstance2

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 214KB - Virtual size: 214KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dxmasf.dll
.dll regsvr32 windows:10 windows x64 arch:x64

c37372e2ab23407cd77ee3a555bfe06c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

smalldll.pdb

Imports

kernel32

DisableThreadLibraryCalls
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 4KB - Virtual size: 774B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dxpps.dll
.dll regsvr32 windows:10 windows x64 arch:x64

ace64f92359bb54a9f6d5167468fbf7f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

DXPPS.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
__C_specific_handler
_o___std_type_info_destroy_list

api-ms-win-crt-string-l1-1-0

memset

oleaut32

LPSAFEARRAY_UserMarshal
BSTR_UserFree
LPSAFEARRAY_UserSize
BSTR_UserUnmarshal64
LPSAFEARRAY_UserFree
LPSAFEARRAY_UserUnmarshal
LPSAFEARRAY_UserFree64
BSTR_UserMarshal64
LPSAFEARRAY_UserSize64
BSTR_UserSize64
BSTR_UserFree64
BSTR_UserSize
LPSAFEARRAY_UserUnmarshal64
BSTR_UserMarshal
BSTR_UserUnmarshal
LPSAFEARRAY_UserMarshal64

rpcrt4

NdrDllRegisterProxy
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrOleFree
NdrOleAllocate
NdrDllUnregisterProxy

kernel32

RtlVirtualUnwind
TerminateProcess
GetCurrentProcess
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 468B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dxtmsft.dll
.dll regsvr32 windows:10 windows x64 arch:x64

b0ca28c690aa63375095a66588470cea

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

dxtmsft.pdb

Imports

msvcrt

malloc
free
_XcptFilter
__C_specific_handler
_purecall
_amsg_exit
_initterm
sqrt
__CxxFrameHandler4
_resetstkoflw
_wcsicmp
_vsnwprintf
rand
srand
time
memcpy_s
?terminate@@YAXXZ
cos
memcmp
memcpy
memset
powf
sin
sinf
sqrtf

atl

ord15
ord21
ord23
ord16
ord30
ord32

kernel32

HeapFree
HeapSetInformation
HeapAlloc
GetProcessHeap
VirtualAlloc
GetCurrentProcess
GetCurrentThreadId
VirtualQuery
Sleep
RtlCaptureContext
VirtualProtect
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
IsBadReadPtr
GetTickCount
DeleteCriticalSection
GetSystemInfo
IsBadCodePtr
InitializeCriticalSection
LeaveCriticalSection
CloseHandle
EnterCriticalSection
WideCharToMultiByte
IsBadWritePtr
DisableThreadLibraryCalls
CreateEventW

oleaut32

SetErrorInfo
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreate
VariantClear
SysFreeString
LoadRegTypeLi
SysAllocString
VariantInit
VariantCopy
VariantChangeType
SysAllocStringLen
SysStringLen

user32

IntersectRect
CopyRect
GetSysColor
OffsetRect

ole32

CoCreateFreeThreadedMarshaler
CoCreateInstance

gdi32

DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
BitBlt
GetDIBits
SetICMMode
CreateColorSpaceW
SetColorSpace
SetDIBitsToDevice
DeleteObject
DeleteColorSpace

shlwapi

UrlCombineW

dxtrans

?DXDitherArray@@YAXPEBUDXDITHERDESC@@@Z
?DXOverArrayMMX@@YAXPEAVDXPMSAMPLE@@PEBV1@K@Z
?DXOverArray@@YAXPEAVDXPMSAMPLE@@PEBV1@K@Z

Exports

Exports

DllCanUnloadNow
DllEnumClassObjects
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 284KB - Virtual size: 283KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 80KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dxtrans.dll
.dll regsvr32 windows:10 windows x64 arch:x64

ef59ec57edf1640b9c6c4631e5855cc7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

dxtrans.pdb

Imports

msvcrt

sqrt
_initterm
_amsg_exit
_XcptFilter
_onexit
__dllonexit
_unlock
_lock
sinf
wcschr
iswspace
__CxxFrameHandler4
realloc
__C_specific_handler
malloc
free
memcpy_s
_purecall
memset
ceilf
cosf
floor
floorf
memcpy
sqrtf

atl

ord23
ord32
ord15
ord16
ord30
ord21

iertutil

ord650
ord701

urlmon

ord462

kernel32

CreateIoCompletionPort
EnterCriticalSection
CreateSemaphoreExW
IsBadReadPtr
DeleteCriticalSection
DisableThreadLibraryCalls
GetCurrentProcess
ReleaseSemaphore
InitializeCriticalSection
IsBadWritePtr
VirtualAlloc
CreateThread
WaitForMultipleObjectsEx
PostQueuedCompletionStatus
CreateSemaphoreW
GetQueuedCompletionStatus
SetEvent
LeaveCriticalSection
QueueUserAPC
ExitThread
ResetEvent
FreeLibrary
GetCurrentDirectoryW
WaitForSingleObject
GetCurrentThreadId
GetProcessHeap
HeapSetInformation
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
IsBadCodePtr
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetProcAddress
TerminateProcess
GetLastError
Sleep
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTickCount
HeapFree
CloseHandle
GetSystemInfo
HeapAlloc
LoadLibraryW
VirtualQuery
VirtualProtect
GetCurrentThread

ole32

CLSIDFromString
CLSIDFromProgID
CreateFileMoniker
CreateBindCtx
CoUninitialize
CoTaskMemFree
CoInitializeEx
CoCreateInstance
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc

user32

IntersectRect
IsCharAlphaW
SetRect
GetDesktopWindow
ReleaseDC
GetDC

oleaut32

VariantChangeType
VariantClear
LoadRegTypeLi
SysStringLen
SetErrorInfo
VariantInit
VariantCopy
SysAllocString
VariantChangeTypeEx
SysAllocStringLen
SysFreeString

gdi32

GetTextMetricsW
CreateCompatibleDC
GetObjectW
CreateFontIndirectW
GetPaletteEntries
GetKerningPairsW
BitBlt
PolyBezierTo
GetGlyphOutlineW
DeleteDC
StrokePath
FillPath
SetPolyFillMode
EndPath
CreateBrushIndirect
StrokeAndFillPath
SetMapMode
SelectObject
ExtCreatePen
BeginPath
MoveToEx
DeleteObject
LineTo

shlwapi

StrCmpNIW
StrCmpIW
ord154
ord158

Exports

Exports

?DXConstOverArray@@YAXPEAVDXPMSAMPLE@@AEBV1@K@Z
?DXConstUnderArray@@YAXPEAVDXPMSAMPLE@@AEBV1@K@Z
?DXDitherArray@@YAXPEBUDXDITHERDESC@@@Z
?DXLinearInterpolateArray@@YAXPEBVDXBASESAMPLE@@PEAUDXLIMAPINFO@@PEAV1@K@Z
?DXOverArray@@YAXPEAVDXPMSAMPLE@@PEBV1@K@Z
?DXOverArrayMMX@@YAXPEAVDXPMSAMPLE@@PEBV1@K@Z
DllCanUnloadNow
DllEnumClassObjects
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 204KB - Virtual size: 200KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dxva2.dll
.dll windows:10 windows x64 arch:x64

1a53a2a99944f5f7b735af312de55e45

Code Sign

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3c
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:23

Not After

01/09/2022, 18:23

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

68:70:d2:4e:d5:e6:97:f3:b3:b0:0b:7d:17:47:12:5a:b0:9d:84:64:40:72:09:e8:6b:01:29:5b:5e:96:8c:13
Signer

Actual PE Digest

68:70:d2:4e:d5:e6:97:f3:b3:b0:0b:7d:17:47:12:5a:b0:9d:84:64:40:72:09:e8:6b:01:29:5b:5e:96:8c:13

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

dxva2.pdb

Imports

msvcrt

_initterm
_XcptFilter
__C_specific_handler
memcpy
_amsg_exit
free
_callnewh
malloc
memset

api-ms-win-core-synch-l1-1-0

CreateEventW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
InitializeCriticalSection
SetEvent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoTaskMemAlloc

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleW
DisableThreadLibraryCalls

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

ntdll

RtlInitUnicodeString
RtlNtStatusToDosError

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

CapabilitiesRequestAndCapabilitiesReply
DXVA2CreateDirect3DDeviceManager9
DXVA2CreateVideoService
DXVAHD_CreateDevice
DegaussMonitor
DestroyPhysicalMonitor
DestroyPhysicalMonitors
GetCapabilitiesStringLength
GetMonitorBrightness
GetMonitorCapabilities
GetMonitorColorTemperature
GetMonitorContrast
GetMonitorDisplayAreaPosition
GetMonitorDisplayAreaSize
GetMonitorRedGreenOrBlueDrive
GetMonitorRedGreenOrBlueGain
GetMonitorTechnologyType
GetNumberOfPhysicalMonitorsFromHMONITOR
GetNumberOfPhysicalMonitorsFromIDirect3DDevice9
GetPhysicalMonitorsFromHMONITOR
GetPhysicalMonitorsFromIDirect3DDevice9
GetTimingReport
GetVCPFeatureAndVCPFeatureReply
OPMGetVideoOutputForTarget
OPMGetVideoOutputsFromHMONITOR
OPMGetVideoOutputsFromIDirect3DDevice9Object
RestoreMonitorFactoryColorDefaults
RestoreMonitorFactoryDefaults
SaveCurrentMonitorSettings
SaveCurrentSettings
SetMonitorBrightness
SetMonitorColorTemperature
SetMonitorContrast
SetMonitorDisplayAreaPosition
SetMonitorDisplayAreaSize
SetMonitorRedGreenOrBlueDrive
SetMonitorRedGreenOrBlueGain
SetVCPFeature

Sections

.text
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 620B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dynamoapi.dll
.dll windows:10 windows x64 arch:x64

0d3c9e0b1677a50587067482f3b4af06

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

dynamoapi.pdb

Imports

msvcrt

memcmp
_CxxThrowException
memcpy
??3@YAXPEAX@Z
__CxxFrameHandler4
_vsnwprintf
memcpy_s
_wcsicmp
_purecall
??1exception@@UEAA@XZ
_XcptFilter
??0exception@@QEAA@XZ
??0exception@@QEAA@AEBV0@@Z
_vsnprintf_s
wcsstr
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
__CxxFrameHandler3
memmove_s
_callnewh
memmove
_onexit
__dllonexit
_unlock
swprintf_s
_lock
__C_specific_handler
_initterm
malloc
free
_amsg_exit
memset

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError

msvcp110_win

?_Syserror_map@std@@YAPEBDH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Winerror_map@std@@YAPEBDH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleFileNameA
GetModuleHandleExW
GetModuleHandleW

oleaut32

VariantClear
SysStringByteLen
VariantChangeTypeEx
VariantInit
SysFreeString
SysAllocStringByteLen

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockShared
ReleaseSRWLockExclusive
CreateSemaphoreExW
EnterCriticalSection
AcquireSRWLockExclusive
LeaveCriticalSection
ReleaseMutex
CreateMutexExW
WaitForSingleObject
InitializeCriticalSectionEx
WaitForSingleObjectEx
AcquireSRWLockShared
OpenSemaphoreW
ReleaseSemaphore
DeleteCriticalSection

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-com-l1-1-0

CoTaskMemFree

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

ntdll

RtlIsStateSeparationEnabled

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW
RegDeleteTreeW
RegOpenKeyExW
RegCloseKey
RegDeleteValueW
RegCreateKeyExW
RegGetValueW

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW

dmcmnutils

OmaDmRegistrySetString
OmDmRegistryAllocAndGetString
OmaDmRegistrySetDWORD
OmaDmRegistryGetDWORD
OmaDmRegistryGetAllSubKeys
OmaDmRegistrySetBinary

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer

Exports

Exports

DynamoCheckIfAreaIsDynamicallyManaged

Sections

.text
Size: 56KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
eapp3hst.dll
.dll regsvr32 windows:10 windows x64 arch:x64

61fc4db94575189a33ca159d85a59f6d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

eapp3hst.pdb

Imports

msvcp_win

?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wtol
_o_free
_o_malloc
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wmemcpy_s
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__beginthreadex
wcsrchr
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__execute_onexit_table
_o__errno
__C_specific_handler
__std_terminate
__CxxFrameHandler4
_CxxThrowException
__C_specific_handler_noexcept
memcmp
_o__endthreadex
memcpy

api-ms-win-crt-string-l1-1-0

memset
wcsnlen

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EtwTraceMessage
EtwEventUnregister
EtwEventRegister
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
DbgPrint
EtwEventWriteTransfer
EtwEventEnabled

oleaut32

SysAllocString
VarUI4FromStr
ord452
ord450
ord446
ord447
SysFreeString
ord451
ord449
ord445
ord448

api-ms-win-core-libraryloader-l1-2-0

LoadResource
GetModuleHandleW
GetProcAddress
FreeLibrary
DisableThreadLibraryCalls
GetModuleFileNameW
FindResourceExW
GetModuleHandleExW
SizeofResource
LoadLibraryExW
GetModuleFileNameA

api-ms-win-core-synch-l1-1-0

ReleaseMutex
WaitForMultipleObjectsEx
CreateSemaphoreExW
CreateMutexExW
InitializeCriticalSectionEx
OpenSemaphoreW
ReleaseSemaphore
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
WaitForSingleObjectEx

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetProcessId
GetCurrentProcessId

rpcrt4

NdrDllGetClassObject
NdrDllCanUnloadNow
NdrOleFree
NdrOleAllocate
NdrDllRegisterProxy
NdrDllUnregisterProxy

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetSystemDirectoryW
GetVersionExW
GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
RaiseException
SetUnhandledExceptionFilter
SetLastError

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent
OpenProcess

combase

GetErrorInfo

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetThreadLocale
SetThreadLocale

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegLoadMUIStringW
RegDeleteValueW
RegQueryValueExW

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapSize
HeapAlloc

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-file-l1-1-0

CreateFileW

api-ms-win-core-handle-l1-1-0

DuplicateHandle
GetHandleInformation
CloseHandle

api-ms-win-core-memory-l1-1-0

MapViewOfFile
CreateFileMappingW
UnmapViewOfFile

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-security-base-l1-1-0

RevertToSelf
ImpersonateLoggedOnUser

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolTimer

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 212KB - Virtual size: 211KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
eappcfg.dll
.dll windows:10 windows x64 arch:x64

3f915741c7e4582f8829187ee8a811a6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

eappcfg.pdb

Imports

msvcp_win

?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wtol
_o_wcscat_s
_o_wmemcpy_s
__C_specific_handler
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__beginthreadex
_o__endthreadex
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__execute_onexit_table
_o__errno
wcsrchr
__std_terminate
__CxxFrameHandler4
_CxxThrowException
__C_specific_handler_noexcept
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

wcsnlen
memset

ntdll

RtlLookupFunctionEntry
RtlVirtualUnwind
EtwEventEnabled
EtwEventWriteTransfer
EtwTraceMessage
EtwEventRegister
EtwEventUnregister
EtwUnregisterTraceGuids
EtwGetTraceEnableFlags
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwRegisterTraceGuidsW
DbgPrint
RtlCaptureContext

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetProcAddress
GetModuleFileNameA
GetModuleHandleExW
FreeLibrary
GetModuleFileNameW
DisableThreadLibraryCalls

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-synch-l1-1-0

ReleaseMutex
ReleaseSemaphore
WaitForSingleObjectEx
WaitForSingleObject
LeaveCriticalSection
OpenSemaphoreW
AcquireSRWLockExclusive
CreateMutexExW
ReleaseSRWLockExclusive
EnterCriticalSection
DeleteCriticalSection
AcquireSRWLockShared
ReleaseSRWLockShared
InitializeCriticalSectionEx
InitializeCriticalSectionAndSpinCount
CreateSemaphoreExW
WaitForMultipleObjectsEx

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
TerminateProcess

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapSize
HeapAlloc

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemInfo
GetTickCount
GetSystemDirectoryW
GetVersionExW

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

api-ms-win-core-file-l1-1-0

CreateFileW

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
CreateFileMappingW
MapViewOfFile

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-registry-l1-1-0

RegLoadMUIStringW
RegQueryInfoKeyW
RegCloseKey
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

EapHostPeerConfigBlob2Xml
EapHostPeerConfigXml2Blob
EapHostPeerCreateMethodConfiguration
EapHostPeerCredentialsXml2Blob
EapHostPeerFreeErrorMemory
EapHostPeerFreeMemory
EapHostPeerGetMethodProperties
EapHostPeerGetMethods
EapHostPeerInvokeConfigUI
EapHostPeerInvokeIdentityUI
EapHostPeerInvokeInteractiveUI
EapHostPeerQueryCredentialInputFields
EapHostPeerQueryInteractiveUIInputFields
EapHostPeerQueryUIBlobFromInteractiveUIInputFields
EapHostPeerQueryUserBlobFromCredentialInputFields

Sections

.text
Size: 184KB - Virtual size: 181KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 564B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
eappcfgui.dll
.dll regsvr32 windows:10 windows x64 arch:x64

f2f85184f50d8b83dea89eda8f49a0bc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

eappcfgui.pdb

Imports

msvcp_win

?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-crt-string-l1-1-0

memset
wcsnlen

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsicmp
_o__wcsnicmp
_o__wtol
_o_floor
_o_free
_o_malloc
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wmemcpy_s
wcsrchr
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__beginthreadex
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o__execute_onexit_table
_o__errno
_o__endthreadex
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__C_specific_handler
__std_terminate
__CxxFrameHandler4
_CxxThrowException
__C_specific_handler_noexcept
__RTDynamicCast
memcmp
memcpy

ntdll

RtlInitString
RtlNtStatusToDosError
EtwEventWriteTransfer
EtwEventUnregister
EtwEventRegister
EtwEventEnabled
RtlCaptureContext
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
RtlLookupFunctionEntry
RtlVirtualUnwind
DbgPrint
WinSqmAddToStream
EtwTraceMessage

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
LoadStringW
GetProcAddress
GetModuleFileNameW
FindResourceExW
GetModuleHandleW
LoadResource
LoadLibraryExW
GetModuleFileNameA
GetModuleHandleExW
DisableThreadLibraryCalls
SizeofResource

api-ms-win-core-synch-l1-1-0

WaitForMultipleObjectsEx
ReleaseSRWLockShared
InitializeCriticalSectionEx
AcquireSRWLockShared
ReleaseSRWLockExclusive
InitializeCriticalSection
AcquireSRWLockExclusive
ReleaseSemaphore
ReleaseMutex
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
WaitForSingleObjectEx
WaitForSingleObject
OpenSemaphoreW
CreateMutexExW
CreateSemaphoreExW
LeaveCriticalSection
EnterCriticalSection

api-ms-win-core-heap-l1-1-0

HeapSize
HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-processthreads-l1-1-0

CreateThread
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
TerminateProcess

api-ms-win-core-localization-l1-2-0

SetThreadLocale
FormatMessageW
GetThreadLocale

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-errorhandling-l1-1-0

RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
RegLoadMUIStringW
RegDeleteValueW
RegQueryValueExW

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW
GetVersionExW
GetSystemTimeAsFileTime
GetComputerNameExW
GetTickCount
GetSystemInfo

api-ms-win-security-credentials-l1-1-0

CredProtectW
CredUnprotectW
CredIsProtectedW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-file-l1-1-0

CreateFileW

api-ms-win-core-memory-l1-1-0

CreateFileMappingW
UnmapViewOfFile
MapViewOfFile

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 212KB - Virtual size: 208KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 600B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
eappgnui.dll
.dll windows:10 windows x64 arch:x64

a81653ea431bdfecd2fcdcc7c6a4931a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

eappgnui.pdb

Imports

msvcp_win

?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-crt-string-l1-1-0

memset
wcsnlen

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__crt_atexit
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_wcscat_s
_o_wcscpy_s
_o_wmemcpy_s
wcsrchr
__C_specific_handler
_o___std_type_info_destroy_list
_o__configure_narrow_argv
_o___std_exception_destroy
_o___std_exception_copy
_o__cexit
__CxxFrameHandler4
_CxxThrowException
memcmp
memcpy

ntdll

EtwEventWriteTransfer
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
DbgPrint
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
EtwTraceMessage

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetModuleFileNameW
GetModuleHandleW
FreeLibrary
DisableThreadLibraryCalls

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-com-l1-1-0

StringFromGUID2

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection

api-ms-win-core-heap-l1-1-0

HeapSize
HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetSystemDirectoryW
GetVersionExW
GetSystemTimeAsFileTime

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

EapPeerFreeErrorMemory
EapPeerFreeMemory
EapPeerInvokeIdentityUI

Sections

.text
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 220B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
eapphost.dll
.dll regsvr32 windows:10 windows x64 arch:x64

d4fdb36188e109c426f79c5e042078e6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

eapphost.pdb

Imports

msvcp_win

?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?uncaught_exception@std@@YA_NXZ
?flags@ios_base@std@@QEBAHXZ
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?good@ios_base@std@@QEBA_NXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Xlength_error@std@@YAXPEBD@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ

api-ms-win-crt-string-l1-1-0

memset
wcsnlen

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsicmp
_o__wtol
_o_free
_o_malloc
_o_memcpy_s
_o_wcscpy_s
_o_wcsncpy_s
__RTtypeid
wcsrchr
_o___stdio_common_vswprintf_s
_o__cexit
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_name
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__execute_onexit_table
_o__errno
__C_specific_handler
__std_terminate
__CxxFrameHandler4
_o__crt_atexit
_o__configure_narrow_argv
_CxxThrowException
__C_specific_handler_noexcept
memcmp
memcpy

ntdll

EtwEventWriteTransfer
WinSqmSetDWORD
DbgPrint
WinSqmAddToStream
RtlCaptureContext
EtwEventSetInformation
EtwEventRegister
RtlLookupFunctionEntry
EtwEventUnregister
EtwEventEnabled
EtwUnregisterTraceGuids
RtlVirtualUnwind
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwTraceMessage

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
GetCurrentProcess

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree
HeapSize

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
LoadLibraryExW
FreeLibrary
LoadResource
FindResourceExW
GetModuleHandleW
GetModuleFileNameW
SizeofResource
GetModuleFileNameA
DisableThreadLibraryCalls
GetModuleHandleExA
GetModuleHandleExW

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
RaiseException

api-ms-win-core-handle-l1-1-0

CloseHandle
GetHandleInformation
DuplicateHandle

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection
CreateSemaphoreExW
LeaveCriticalSection
AcquireSRWLockExclusive
DeleteCriticalSection
CreateMutexExW
ReleaseSRWLockExclusive
InitializeCriticalSectionEx
AcquireSRWLockShared
ReleaseSemaphore
InitializeCriticalSectionAndSpinCount
ReleaseSRWLockShared
WaitForSingleObject
EnterCriticalSection
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW

api-ms-win-core-processthreads-l1-1-1

OpenProcess
IsProcessorFeaturePresent

api-ms-win-security-base-l1-1-0

ImpersonateLoggedOnUser
RevertToSelf

api-ms-win-security-credentials-l1-1-0

CredFree
CredDeleteW
CredProtectW
CredReadW

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegLoadMUIStringW
RegQueryValueExW
RegDeleteValueW
RegCloseKey
RegOpenKeyExW
RegEnumKeyExW

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

rpcrt4

NdrOleFree
NdrDllRegisterProxy
NdrDllUnregisterProxy
NdrDllCanUnloadNow
NdrOleAllocate
NdrDllGetClassObject

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceBeginInitialize

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW
GetSystemInfo
GetVersionExW
GetSystemTimeAsFileTime
GetTickCount

ncrypt

NCryptSetProperty
NCryptOpenStorageProvider
NCryptFreeObject

api-ms-win-core-file-l1-1-0

CreateFileW

api-ms-win-core-memory-l1-1-0

CreateFileMappingW
UnmapViewOfFile
MapViewOfFile

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

wkscli

NetGetJoinInformation

netutils

NetApiBufferFree

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
InitializeEapHost
OnSessionChange
StopServiceOnLowPower
UninitializeEapHost

Sections

.text
Size: 204KB - Virtual size: 201KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
eappprxy.dll
.dll windows:10 windows x64 arch:x64

ef76b54f1cadfc83b8391e8747ddb87f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

eappprxy.pdb

Imports

msvcp_win

?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-crt-string-l1-1-0

memset
wcsnlen

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__register_onexit_function
_o__seh_filter_dll
_o_wmemcpy_s
wcsrchr
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__cexit
_o__beginthreadex
__C_specific_handler
__std_terminate
__CxxFrameHandler4
_CxxThrowException
__C_specific_handler_noexcept
memcpy

ntdll

EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwRegisterTraceGuidsW
EtwEventWriteTransfer
EtwEventRegister
EtwEventUnregister
EtwUnregisterTraceGuids
EtwTraceMessage
EtwEventEnabled
DbgPrint
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
EtwGetTraceLoggerHandle

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapSize
HeapFree
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
SetLastError

api-ms-win-core-synch-l1-1-0

ReleaseMutex
ReleaseSemaphore
WaitForSingleObjectEx
WaitForSingleObject
OpenSemaphoreW
LeaveCriticalSection
EnterCriticalSection
CreateEventW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
CreateSemaphoreExW
CreateMutexExW
WaitForMultipleObjectsEx

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
DisableThreadLibraryCalls
GetModuleFileNameW
GetProcAddress
GetModuleHandleW
GetModuleFileNameA

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetVersionExW
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

EapHostPeerBeginSession
EapHostPeerClearConnection
EapHostPeerEndSession
EapHostPeerFreeEapError
EapHostPeerFreeRuntimeMemory
EapHostPeerGetAuthStatus
EapHostPeerGetDataToUnplumbCredentials
EapHostPeerGetEncryptedPassword
EapHostPeerGetIdentity
EapHostPeerGetResponseAttributes
EapHostPeerGetResult
EapHostPeerGetSendPacket
EapHostPeerGetUIContext
EapHostPeerInitialize
EapHostPeerProcessReceivedPacket
EapHostPeerSetResponseAttributes
EapHostPeerSetUIContext
EapHostPeerUninitialize

Sections

.text
Size: 60KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
eapprovp.dll
.dll windows:10 windows x64 arch:x64

33bb8ac4eea3a68cae84db8e8de97418

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

eapprovp.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__execute_onexit_table
memcpy
_o_free
_o_malloc
_o_memcpy_s
_o_strcat_s
_o_strcpy_s
_o_strncat_s
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o__cexit
_o__callnewh
_o__configure_narrow_argv
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
strchr
_o__crt_atexit
__CxxFrameHandler4
memcmp

api-ms-win-crt-string-l1-1-0

memmove_s
memset
strnlen

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegLoadKeyW
RegGetValueW
RegEnumKeyExW
RegUnLoadKeyW
RegOpenKeyExW
RegQueryValueExW

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage
GetTraceEnableFlags
GetTraceLoggerHandle
GetTraceEnableLevel
UnregisterTraceGuids
RegisterTraceGuidsW

api-ms-win-core-synch-l1-1-0

AcquireSRWLockShared
CreateMutexExW
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeCriticalSectionEx
ReleaseSemaphore
CreateSemaphoreExW
CreateMutexW
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
DeleteCriticalSection
ResetEvent
SetEvent
CreateEventW
ReleaseMutex
InitializeCriticalSection

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-security-base-l1-1-0

RevertToSelf
ImpersonateLoggedOnUser

api-ms-win-core-errorhandling-l1-1-0

SetLastError
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-security-credentials-l1-1-0

CredReadW
CredWriteA
CredIsProtectedW
CredUnprotectW
CredFree

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
CreateThread
TerminateProcess

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleFileNameA
GetModuleHandleExW

crypt32

CertFindExtension
CryptUnprotectData
CryptDecodeObjectEx
CryptBinaryToStringW
CertGetCertificateContextProperty
CertOpenStore
CertDuplicateCertificateContext
CertFindCertificateInStore
CertFreeCertificateContext
CertCloseStore

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

iphlpapi

GetIfEntry2
ConvertInterfaceGuidToLuid

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer

wkscli

NetGetJoinInformation

netutils

NetApiBufferFree

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-file-l1-1-0

CompareFileTime

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

Exports

Exports

EapProvPlugGetInfo
EapProvPluginDeinitialize
EapProvPluginInitialize
EapProvPluginTestForAuthenticatingWlanInterfaces
EapProvPluginWlanCloseHandle
EapProvPluginWlanOpenHandle
EapProvPluginWlanRegisterNotification

Sections

.text
Size: 56KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
eapputil.dll
.dll windows:10 windows x64 arch:x64

568cf50ff6e498e759434b44c218216e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

eapputil.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsicmp
_o_abort
_o_free
_o_iswspace
_o_malloc
_o_realloc
_o_terminate
__C_specific_handler
_o__configure_narrow_argv
_CxxThrowException
_o__cexit
_o__callnewh
__CxxFrameHandler3
strchr
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o__crt_atexit
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

strcmp
memset

eappprxy

EapHostPeerGetSendPacket
EapHostPeerGetResult
EapHostPeerGetUIContext
EapHostPeerProcessReceivedPacket
EapHostPeerSetUIContext
EapHostPeerEndSession
EapHostPeerUninitialize
EapHostPeerFreeEapError
EapHostPeerInitialize
EapHostPeerBeginSession

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
DisableThreadLibraryCalls
GetModuleHandleExW
GetModuleHandleW
FreeLibrary
GetModuleFileNameA

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
InitOnceComplete

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
ReleaseSemaphore
LeaveCriticalSection
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
CreateMutexExW
ReleaseSRWLockShared
AcquireSRWLockShared
DeleteCriticalSection
AcquireSRWLockExclusive
CreateSemaphoreExW
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
WaitForSingleObject

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
GetLastError

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventSetInformation
EventWriteTransfer

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead
InterlockedFlushSList

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegGetValueW

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer

api-ms-win-core-winrt-error-l1-1-0

RoFailFastWithErrorContext
RoOriginateErrorW
SetRestrictedErrorInfo
GetRestrictedErrorInfo

oleaut32

SysFreeString
GetErrorInfo
SysAllocString
SysStringLen
SetErrorInfo

sspicli

QueryContextAttributesW
SetContextAttributesW
InitializeSecurityContextW
AcquireCredentialsHandleW
FreeCredentialsHandle
DeleteSecurityContext
DecryptMessage
ApplyControlToken
FreeContextBuffer
EncryptMessage

api-ms-win-core-winrt-robuffer-l1-1-0

RoGetBufferMarshaler

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
CoCreateFreeThreadedMarshaler

crypt32

CryptDecodeObjectEx
CertFindExtension
CertVerifyCertificateChainPolicy
CertGetCertificateContextProperty
CertFreeCertificateContext
CertFreeCertificateChain
CertGetCertificateChain
CertGetNameStringW
CertCompareCertificateName
CertGetEnhancedKeyUsage
CertVerifySubjectCertificateContext

bcrypt

BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptDestroyHash
BCryptGetProperty

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

msvcp_win

?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?id@?$ctype@G@std@@2V0locale@2@A
??Bid@locale@std@@QEAA_KXZ
?id@?$collate@G@std@@2V0locale@2@A
_Wcsxfrm
_Wcscoll
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?tolower@?$ctype@G@std@@QEBAGG@Z
?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Xbad_alloc@std@@YAXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Xbad_function_call@std@@YAXXZ
??1facet@locale@std@@MEAA@XZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
?_Xlength_error@std@@YAXPEBD@Z
??0_Lockit@std@@QEAA@H@Z
??0facet@locale@std@@IEAA@_K@Z
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Lockit@std@@QEAA@XZ
??1_Locinfo@std@@QEAA@XZ
?is@?$ctype@G@std@@QEBA_NFG@Z
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Incref@facet@locale@std@@UEAAXXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
EapConvertHostToWireFormat16
EapConvertHostToWireFormat24
EapConvertHostToWireFormat32
EapConvertWireToHostFormat16
EapConvertWireToHostFormat24
EapConvertWireToHostFormat32
EapUseLegacyTlsStack

Sections

.text
Size: 176KB - Virtual size: 175KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
eapsimextdesktop.dll
.dll windows:10 windows x64 arch:x64

5f1d0d233e77dd9b23dc61f377a52f32

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

EapSimExtDesktop.pdb

Imports

msvcp_win

?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsicmp
_o_free
_o_malloc
_o_wcscpy_s
_o_wcsncpy_s
_CxxThrowException
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__cexit
_o__callnewh
__std_terminate
__C_specific_handler
__CxxFrameHandler4
__CxxFrameHandler3
__C_specific_handler_noexcept
__RTDynamicCast
memcmp
memcpy

oleaut32

VarUI4FromStr

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
LoadStringW
SizeofResource
FreeLibrary
DisableThreadLibraryCalls
GetModuleHandleW
FindResourceExW
LoadResource
GetProcAddress
LoadLibraryExW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionEx
WaitForSingleObject
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection

api-ms-win-core-com-l1-1-0

CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
StringFromIID
CoTaskMemFree

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegEnumKeyExW
RegDeleteValueW
RegCloseKey
RegSetValueExW
RegOpenKeyExW

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister

api-ms-win-eventing-classicprovider-l1-1-0

RegisterTraceGuidsW
TraceMessage
UnregisterTraceGuids
GetTraceEnableFlags
GetTraceLoggerHandle
GetTraceEnableLevel

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
TerminateProcess

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
GetLastError

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

dui70

?KeyWithinProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
InitThread
?GetRoot@Element@DirectUI@@QEAAPEAV12@XZ
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z
?GetEncodedContentString@Element@DirectUI@@QEAAJPEAG_K@Z
?ContentProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
StrToID
?RemoveLocalValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZ@Z
?SetInputScope@TouchEdit2@DirectUI@@QEAAJW4__MIDL___MIDL_itf_inputscope_0000_0000_0001@@@Z
?SetLayoutPos@Element@DirectUI@@QEAAJH@Z
?SetContentString@Element@DirectUI@@QEAAJPEBG@Z
?SetContentAlign@Element@DirectUI@@QEAAJH@Z
?SetClass@Element@DirectUI@@QEAAJPEBG@Z
UnInitThread
?UserTextChanged@TouchEditBase@DirectUI@@SA?AVUID@@XZ
?SetMaxLength@TouchEditBase@DirectUI@@QEAAJH@Z
?SelectionChange@TouchSelect@DirectUI@@SA?AVUID@@XZ
?AddString@TouchSelect@DirectUI@@QEAAJPEBG@Z
?RemoveAll@TouchSelect@DirectUI@@QEAAXXZ
?SetSelectionIndex@TouchSelect@DirectUI@@QEAAJH@Z
?GetClassInfoPtr@HWNDElement@DirectUI@@SAPEAUIClassInfo@2@XZ

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

DllCanUnloadNow
DllGetClassObject
EapSimExtCallRunWizard
EapSimExtGetIdentityPageGuid
EapSimExtInvokeUIAndGetConfig

Sections

.text
Size: 80KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 764B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
eapsvc.dll
.dll windows:10 windows x64 arch:x64

ee7945f26f0caac4aaa740903633b7c5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

eapsvc.pdb

Imports

msvcp_win

?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z

api-ms-win-crt-string-l1-1-0

wcsnlen
memset

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo_noreturn
_o__register_onexit_function
_o__seh_filter_dll
_o__beginthreadex
memmove
_o__wcstoui64
_o_wmemcpy_s
__C_specific_handler
wcsrchr
_o__crt_atexit
_o__configure_narrow_argv
_o___stdio_common_vsprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__cexit
__std_terminate
__CxxFrameHandler4
_CxxThrowException
memcpy

ntdll

EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwTraceMessage
DbgPrint
EtwEventWriteTransfer
EtwEventEnabled
EtwEventUnregister
EtwEventRegister

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleFileNameW
GetModuleHandleExW
DisableThreadLibraryCalls
FreeLibrary

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegNotifyChangeKeyValue
RegEnumKeyExW
RegCreateKeyExW
RegQueryInfoKeyW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionAndSpinCount
WaitForMultipleObjectsEx
CreateEventW
WaitForSingleObject
LeaveCriticalSection
DeleteCriticalSection
EnterCriticalSection
SetEvent
ResetEvent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
TerminateProcess

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapSize
HeapFree
GetProcessHeap

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetSystemInfo
GetSystemTimeAsFileTime

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

ServiceMain

Sections

.text
Size: 52KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 272B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
easconsent.dll
.dll windows:10 windows x64 arch:x64

0f5fb189b44b2aa2464fbff39554dbb5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

EASConsent.pdb

Imports

msvcrt

_callnewh
_onexit
__dllonexit
_unlock
_lock
__CxxFrameHandler3
__C_specific_handler
_initterm
malloc
_amsg_exit
_XcptFilter
free
_purecall
memset

rpcrt4

NdrOleAllocate
NdrOleFree
NdrDllGetClassObject
NdrDllCanUnloadNow

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
LoadStringW

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoTaskMemAlloc

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

user32

GetMessageW
DispatchMessageW
TranslateMessage

dui70

?CreateElement@DUIXmlParser@DirectUI@@QEAAJPEBGPEAVElement@2@1PEAKPEAPEAV32@@Z
UnInitProcessPriv
UnInitThread
?Destroy@DUIXmlParser@DirectUI@@QEAAXXZ
?Destroy@Element@DirectUI@@QEAAJ_N@Z
InitProcessPriv
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJIPEAUHINSTANCE__@@0@Z
?Create@DUIXmlParser@DirectUI@@SAJPEAPEAV12@P6APEAVValue@2@PEBGPEAX@Z2P6AX11H2@Z2@Z
InitThread

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 232B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
easinvoker.proxystub.dll
.dll regsvr32 windows:10 windows x64 arch:x64

648bf44de652effca3afcf86003f3016

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

easinvoker.proxystub.pdb

Imports

msvcrt

malloc
free
_amsg_exit
_initterm
__C_specific_handler
_XcptFilter

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

rpcrt4

NdrDllGetClassObject
NdrOleFree
NdrDllRegisterProxy
NdrDllUnregisterProxy
NdrOleAllocate
NdrDllCanUnloadNow

oleaut32

VARIANT_UserMarshal
LPSAFEARRAY_UserUnmarshal64
BSTR_UserMarshal
BSTR_UserUnmarshal
LPSAFEARRAY_UserMarshal64
BSTR_UserMarshal64
LPSAFEARRAY_UserSize64
BSTR_UserSize64
BSTR_UserFree64
VARIANT_UserUnmarshal64
VARIANT_UserFree64
LPSAFEARRAY_UserMarshal
VARIANT_UserSize
LPSAFEARRAY_UserFree64
VARIANT_UserUnmarshal
VARIANT_UserFree
LPSAFEARRAY_UserUnmarshal
BSTR_UserSize
VARIANT_UserSize64
VARIANT_UserMarshal64
BSTR_UserFree
LPSAFEARRAY_UserSize
BSTR_UserUnmarshal64
LPSAFEARRAY_UserFree

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo

Sections

.text
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 996B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
easwrt.dll
.dll windows:10 windows x64 arch:x64

aaf9dfcbbe1d67f347ec8a2238e82815

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

easwrt.pdb

Imports

msvcrt

__CxxFrameHandler3
_onexit
_vsnwprintf
__dllonexit
_unlock
_lock
memcpy
_initterm
_amsg_exit
_XcptFilter
memcpy_s
_wtoi
_callnewh
malloc
free
_purecall
__C_specific_handler
memset

twinapi.appcore

ord12
ord500
ord2
ord3

api-ms-win-core-com-l1-1-0

CoGetCallContext
CoGetInterfaceAndReleaseStream
CoMarshalInterface
CoGetCallerTID
CreateStreamOnHGlobal
CoReleaseMarshalData
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
StringFromGUID2
CoTaskMemFree
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc

api-ms-win-core-registry-l1-1-0

RegDeleteTreeW
RegEnumValueW
RegGetValueW
RegQueryInfoKeyW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
UnregisterTraceGuids
TraceMessage
GetTraceEnableFlags
GetTraceLoggerHandle
RegisterTraceGuidsW

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceExecuteOnce

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsStringHasEmbeddedNull
WindowsGetStringRawBuffer
WindowsIsStringEmpty
WindowsCreateString

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventUnregister
EventRegister

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
DeleteCriticalSection
CreateMutexExW
ReleaseSRWLockShared
ReleaseSemaphore
AcquireSRWLockShared
WaitForSingleObject
ReleaseSRWLockExclusive
CreateSemaphoreExW
ReleaseMutex
InitializeCriticalSection
WaitForSingleObjectEx
OpenSemaphoreW

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError
RoOriginateErrorW
GetRestrictedErrorInfo
SetRestrictedErrorInfo
RoTransformError

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
GetModuleHandleExA
GetModuleHandleExW
GetModuleFileNameA
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleW
FreeLibrary

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
RaiseException
SetLastError

rpcrt4

I_RpcExceptionFilter
RpcBindingFromStringBindingW
RpcStringFreeW
RpcBindingFree
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrOleFree
NdrOleAllocate
NdrClientCall3
I_RpcMapWin32Status
RpcBindingSetAuthInfoExW
RpcBindingBind
RpcBindingCreateW
RpcStringBindingComposeW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

oleaut32

VariantClear
VariantInit

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

OpenThreadToken
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
OpenProcessToken
GetCurrentThread
GetProcessId
TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-security-base-l1-1-0

EqualSid
GetSecurityDescriptorDacl
CopySid
CreateWellKnownSid
GetLengthSid
GetTokenInformation
DuplicateToken
CheckTokenMembership
PrivilegeCheck

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-winrt-error-l1-1-1

IsErrorPropagationEnabled
RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolAllowThreadReuse
SHTaskPoolQueueTask

combase

ord157
ord90

advapi32

RegCloseKey
RegDeleteValueW
OpenServiceW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
AllocateAndInitializeSid
FreeSid
StartServiceW

kernel32

CreateFileW
GetSystemWindowsDirectoryW

ntdll

RtlInitializeResource
RtlAcquireResourceExclusive
RtlReleaseResource
NtOpenThreadToken
NtClose
NtDuplicateToken
NtOpenProcessToken
WinSqmSetString
NtGetCachedSigningLevel
NtSetCachedSigningLevel
NtQuerySystemInformation
NtQueryInformationToken
RtlInitUnicodeString
RtlInitializeSid
RtlSubAuthoritySid
RtlDeleteResource
RtlLengthSid
RtlCopySid
RtlIsMultiSessionSku
RtlSubAuthorityCountSid
RtlGetDeviceFamilyInfoEnum
RtlNtStatusToDosError
RtlEqualSid
RtlGetNtProductType

ole32

CoGetObject

user32

SystemParametersInfoW
UpdatePerUserSystemParameters
GetWindowThreadProcessId
ord2521
ord2529
GetWindow
GetClassNameW
IsWindow
GetAncestor
EnableWindow

authz

AuthzInitializeResourceManager
AuthzFreeContext
AuthzAccessCheck
AuthzAddSidsToContext
AuthzInitializeContextFromSid
AuthzFreeResourceManager

samcli

NetUserGetInfo

netutils

NetApiBufferFree

api-ms-win-security-lsapolicy-l1-1-0

LsaQueryInformationPolicy
LsaClose
LsaOpenPolicy
LsaLookupSids
LsaFreeMemory

samlib

SamOpenUser
SamQueryInformationDomain
SamQueryInformationUser
SamFreeMemory
SamQuerySecurityObject
SamConnect
SamCloseHandle
SamOpenDomain

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
EasClientSecurityPolicyApply
EasClientSecurityPolicyCheckCompliance
EasGetClientDeviceInformation
EasRegisterEncryptionProvider
EasShowConsentDialog
EasUnRegisterEncryptionProvider

Sections

.text
Size: 112KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
edgeIso.dll
.dll windows:10 windows x64 arch:x64

d223650c301a7e63be7b1befe1ddaa02

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

edgeIso.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__register_onexit_function
_o__seh_filter_dll
_o__wcsicmp
_o__wcsnicmp
memmove
_o__wtoi
_o__wtoi64
_o_ceilf
_o_free
_o_iswspace
_o_malloc
_o_memcpy_s
_o_realloc
_o_terminate
_o_wcscpy_s
_o_wmemcpy_s
__C_specific_handler
__current_exception
__current_exception_context
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
_CxxThrowException
memcmp
memcpy
wcschr

api-ms-win-crt-string-l1-1-0

memset
wcsncmp
wcsnlen

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleHandleExW
GetModuleFileNameW
GetModuleFileNameA
GetModuleHandleExA
GetProcAddress
LoadLibraryExW
GetModuleHandleW
DisableThreadLibraryCalls

api-ms-win-core-heap-l1-1-0

HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-processthreads-l1-1-0

CreateThread
GetThreadId
GetCurrentProcess
TerminateProcess
TlsGetValue
TlsFree
TlsAlloc
GetCurrentThread
OpenThreadToken
ResumeThread
OpenThread
SuspendThread
TerminateThread
DeleteProcThreadAttributeList
TlsSetValue
CreateProcessAsUserW
CreateProcessW
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
OpenProcessToken
GetCurrentThreadId
GetCurrentProcessId
GetExitCodeProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-synch-l1-1-0

ResetEvent
CreateEventW
EnterCriticalSection
CreateEventExW
ReleaseSRWLockExclusive
InitializeCriticalSectionEx
InitializeCriticalSectionAndSpinCount
CreateSemaphoreExW
CreateMutexExW
ReleaseSRWLockShared
AcquireSRWLockShared
InitializeCriticalSection
TryAcquireSRWLockExclusive
SetEvent
AcquireSRWLockExclusive
InitializeSRWLock
OpenSemaphoreW
WaitForSingleObject
DeleteCriticalSection
WaitForSingleObjectEx
ReleaseMutex
ReleaseSemaphore
OpenEventW
TryEnterCriticalSection
LeaveCriticalSection

api-ms-win-core-errorhandling-l1-1-0

SetLastError
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-security-base-l1-1-0

DuplicateTokenEx
SetTokenInformation
GetSidSubAuthority
GetTokenInformation
InitializeSid
GetSidLengthRequired
GetSidSubAuthorityCount
FreeSid
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
CopySid
GetLengthSid
AllocateAndInitializeSid
DeleteAce
AddAce
AddMandatoryAce
SetKernelObjectSecurity
GetKernelObjectSecurity
SetSecurityDescriptorSacl
InitializeSecurityDescriptor
IsValidSid
AddAccessAllowedAceEx
InitializeAcl
EqualSid
GetAce
GetSecurityDescriptorSacl
GetSidIdentifierAuthority

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventRegister
EventUnregister
EventSetInformation

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-atoms-l1-1-0

FindAtomW
AddAtomW
DeleteAtom

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent
GetThreadContext
OpenProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetVersionExA
GetSystemDirectoryW
GetTickCount64
GetSystemTimeAsFileTime
GetSystemInfo

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrStrIW
StrCmpICW
QISearch

api-ms-win-core-com-l1-1-0

StringFromGUID2
CoCreateInstance
CoReleaseMarshalData
CoGetInterfaceAndReleaseStream
CreateStreamOnHGlobal
CoMarshalInterface
CoGetMarshalSizeMax
CoUninitialize
CoInitializeEx
CoGetApartmentType
CoRevertToSelf
CoImpersonateClient
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoInitializeSecurity
CoWaitForMultipleHandles
CoUnmarshalInterface
CoTaskMemAlloc

api-ms-win-core-file-l1-1-0

GetShortPathNameW
FindNextFileW
FindClose
FindFirstFileExW

api-ms-win-core-winrt-string-l1-1-0

WindowsDuplicateString
WindowsCreateString
WindowsDeleteString
WindowsCreateStringReference
WindowsGetStringRawBuffer

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoGetActivationFactory

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegEnumKeyExW
RegOpenKeyExW
RegGetValueW
RegSetValueExW

api-ms-win-core-memory-l1-1-0

CreateFileMappingW
MapViewOfFile
OpenFileMappingW
UnmapViewOfFile
MapViewOfFileEx
VirtualQuery

api-ms-win-core-namespace-l1-1-0

CreatePrivateNamespaceW
ClosePrivateNamespace
AddSIDToBoundaryDescriptor
CreateBoundaryDescriptorW
OpenPrivateNamespaceW
DeleteBoundaryDescriptor

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
InitOnceComplete
InitOnceExecuteOnce
Sleep

api-ms-win-core-job-l1-1-0

IsProcessInJob

api-ms-win-core-job-l2-1-0

CreateJobObjectW
AssignProcessToJobObject
SetInformationJobObject

api-ms-win-core-kernel32-legacy-l1-1-0

UnregisterWait
RegisterWaitForSingleObject

ntdll

RtlQueryTokenHostIdAsUlong64
NtQuerySystemInformation
RtlReportExceptionEx
RtlGetSuiteMask
NtQueryVirtualMemory
RtlImageDirectoryEntryToData
RtlQueryPackageClaims

api-ms-win-core-windowserrorreporting-l1-1-0

WerUnregisterMemoryBlock
WerRegisterMemoryBlock

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW
RoOriginateError
RoTransformError
GetRestrictedErrorInfo
SetRestrictedErrorInfo

api-ms-win-core-com-private-l1-1-0

CoSetErrorInfo
CoGetErrorInfo

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-security-base-l1-2-0

CheckTokenCapability

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx
QueueUserWorkItem

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-winrt-error-l1-1-1

RoReportFailedDelegate
IsErrorPropagationEnabled
RoGetMatchingRestrictedErrorInfo

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-toolhelp-l1-1-0

CreateToolhelp32Snapshot
Process32NextW
Process32FirstW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindFileNameW

Sections

.text
Size: 324KB - Virtual size: 321KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 84KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 432B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
edgeangle.dll
.dll windows:10 windows x64 arch:x64

a5e6b09b796a0e02062498adfc98f791

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

edgeangle.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm
_invoke_watson

api-ms-win-crt-private-l1-1-0

_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__fdclass
_o__fdsign
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__cexit
memmove
_o__wcsicmp
_o_acosf
_o_acoshf
_o_asinf
_o_asinhf
_o_atan2f
_o_atanf
_o_atanhf
_o_atoi
_o_ceil
_o_ceilf
_o_cosf
_o_coshf
_o_exit
_o_exp2f
_o_expf
_o_floor
_o_floorf
_o_free
_o_fwrite
_o_isdigit
_o_log
_o_logf
_o_malloc
_o_mbstowcs_s
_o_modff
_o_pow
_o_powf
_o_realloc
_o_round
_o_roundf
_o_sinf
_o_sinhf
_o_sqrtf
_o_strcpy_s
_o_strtoul
_o_tanf
_o_tanhf
_o_wcstombs
__C_specific_handler
__CxxFrameHandler3
_o___stdio_common_vsprintf_s
_o___stdio_common_vsprintf
_o___stdio_common_vfprintf
_o___std_type_info_destroy_list
strstr
_o___acrt_iob_func
memchr
memcpy
memcmp

api-ms-win-crt-string-l1-1-0

memset
strncmp
strcmp

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
FreeLibrary
GetProcAddress
GetModuleFileNameW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindFileNameW

api-ms-win-eventing-provider-l1-1-0

EventWriteEx

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
RaiseException
GetLastError
UnhandledExceptionFilter

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrCmpICW
StrStrIW

api-ms-win-core-processthreads-l1-1-0

TlsFree
GetCurrentThreadId
TlsGetValue
TlsAlloc
TlsSetValue
GetCurrentProcess
TerminateProcess
GetCurrentProcessId

ntdll

RtlGetSuiteMask

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceExecuteOnce

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

iertutil

ord870
ord793
ord594
ord398
ord597
ord791

msvcp_win

?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?setf@ios_base@std@@QEAAHHH@Z
?setf@ios_base@std@@QEAAHH@Z
?flags@ios_base@std@@QEAAHH@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?good@ios_base@std@@QEBA_NXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z
?fail@ios_base@std@@QEBA_NXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
?precision@ios_base@std@@QEAA_J_J@Z
?unsetf@ios_base@std@@QEAAXH@Z
?classic@locale@std@@SAAEBV12@XZ
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z
?flags@ios_base@std@@QEBAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?width@ios_base@std@@QEBA_JXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?width@ios_base@std@@QEAA_J_J@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ

chakra

MemProtectHeapDestroy
MemProtectHeapUnrootAndZero
MemProtectHeapCreate

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-synch-l1-1-0

WaitForSingleObjectEx
SetEvent
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
CreateEventW
ResetEvent
DeleteCriticalSection

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-crt-math-l1-1-0

truncf

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 372KB - Virtual size: 369KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 84KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
edgehtml.dll
.dll windows:10 windows x64 arch:x64

c006e0ecb192312c64f868f5d47c13e5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

edgehtml.pdb

Imports

msvcrt

wcstol
wcsrchr
iswalnum
_wcslwr_s
_wcslwr
_ui64tow_s
_wcstoui64
_itow_s
_wcsupr_s
sprintf_s
__ExceptionPtrCreate
__ExceptionPtrDestroy
__ExceptionPtrToBool
__ExceptionPtrRethrow
__ExceptionPtrCopy
_i64tow_s
abort
modf
_isnan
_fpclass
strncmp
_ltow
_aligned_free
_aligned_malloc
strstr
iswcntrl
tolower
_wcsupr
_wcsrev
wcstok_s
towlower
_stricmp
_wtoi64
time
_set_errno
_errno
_controlfp_s
malloc
free
wcsstr
iswpunct
iswascii
_resetstkoflw
_ultoa_s
mbstowcs
calloc
_mbscmp
strncpy_s
_ismbcdigit
_mbschr
strtol
strchr
_mbsstr
_mbsspn
_mbscspn
_mbsicmp
wcscat_s
__CxxFrameHandler4
??1exception@@UEAA@XZ
??0exception@@QEAA@XZ
??0exception@@QEAA@AEBV0@@Z
_vsnprintf_s
iswspace
swscanf_s
isalpha
isxdigit
isdigit
??0exception@@QEAA@AEBQEBD@Z
__mb_cur_max
?what@exception@@UEBAPEBDXZ
_strlwr_s
strcpy_s
wcstombs_s
strrchr
towupper
wcscpy_s
_wcsdup
??8type_info@@QEBAHAEBV0@@Z
__crtCompareStringW
__crtCompareStringA
__crtLCMapStringW
__crtLCMapStringA
_wsetlocale
___lc_handle_func
setlocale
_CxxThrowException
__CxxFrameHandler3
memcpy
memmove
___mb_cur_max_func
___lc_codepage_func
_ismbblead
ldexp
strcspn
??0bad_cast@@QEAA@PEBD@Z
localeconv
??0bad_cast@@QEAA@AEBV0@@Z
??1bad_cast@@UEAA@XZ
memset
__pctype_func
isupper
islower
_Getdays
_Getmonths
_W_Getdays
_W_Getmonths
_W_Gettnames
_Wcsftime
_Gettnames
_Strftime
isspace
memchr
___lc_collate_cp_func
memcmp
sqrt
_XcptFilter
_amsg_exit
_initterm
?terminate@@YAXXZ
vswprintf_s
isalnum
expf
exp
cosf
cos
ceilf
sinf
wcstod
wcstoul
qsort
bsearch_s
floorf
qsort_s
sin
iswalpha
iswdigit
_finite
_ltow_s
powf
pow
_ultow_s
wcsnlen
_wtol
logf
swprintf_s
log10f
log
fmodf
bsearch
_wtof
_wtoi
tanf
_wcsnicmp
??1type_info@@UEAA@XZ
_onexit
__dllonexit
fmod
wcsncmp
wcschr
_unlock
_lock
_wcsicmp
__C_specific_handler
_vsnprintf
_vsnwprintf
memmove_s
memcpy_s
_purecall
sqrtf
iswprint
_statusfp
_clearfp
iswlower
strtoul
wcsspn
wcscspn
fwrite
strnlen
__uncaught_exception
wcstok
tan
floor
wcsncpy_s
_HUGE
iswxdigit
wcsncat_s
realloc
__iob_func
acos
acosf
asin
asinf
atan
atan2
atan2f
atanf
ceil
wcscmp

chakra

MemProtectHeapUnrootAndZero
RecyclerNativeHeapGetRealAddressFromInterior
RecyclerNativeHeapCreateWeakReference
RecyclerNativeHeapCollectGarbageInThread
RecyclerNativeHeapGetStrongReference
RecyclerNativeHeapAddExternalMemoryUsage
JsVarToExtension
MemProtectHeapNotifyCurrentThreadDetach
RecyclerNativeHeapRootAddRef
MemProtectHeapDestroy
MemProtectHeapSynchronizeWithCollector
RecyclerNativeHeapAllocTraced
RecyclerNativeHeapRootRelease
MemProtectHeapRootAlloc
MemProtectHeapReportHeapSize
MemProtectHeapDisableCollection
MemProtectHeapRootRealloc
JsDiscardBackgroundParse
MemProtectHeapProtectCurrentThread
MemProtectHeapUnprotectCurrentThread
JsCreateThreadService
MemProtectHeapCreate
RecyclerNativeHeapAllocTracedFinalized
JsQueueBackgroundParse

ntdll

NtQueryInformationProcess
NtQuerySystemInformation
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
RtlGetSuiteMask
RtlCaptureContext
RtlGetDeviceFamilyInfoEnum
NtClose
RtlIpv6AddressToStringExW
RtlIpv4AddressToStringExW
RtlDllShutdownInProgress
VerSetConditionMask
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlNtStatusToDosError

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
LockResource
LoadLibraryExA
FreeLibrary
LoadResource
FreeLibraryAndExitThread
GetModuleHandleW
GetProcAddress
LoadStringW
SizeofResource
GetModuleHandleExA
FindResourceExW
GetModuleFileNameA
GetModuleHandleExW
LoadLibraryExW

api-ms-win-core-localization-l1-2-0

IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoEx
GetCPInfo
GetUserDefaultLangID
GetLocaleInfoW
GetUserGeoID
GetGeoInfoW
IsValidLocaleName
GetUserDefaultLocaleName
FormatMessageW
ResolveLocaleName
IsDBCSLeadByte
LCMapStringEx
LocaleNameToLCID
SetThreadPreferredUILanguages
GetACP
IsDBCSLeadByteEx
GetThreadUILanguage
GetSystemDefaultLCID

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
OutputDebugStringA
DebugBreak

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventSetInformation
EventRegister
EventActivityIdControl
EventWriteEx
EventWrite
EventWriteTransfer

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive
ReleaseSRWLockShared
SetEvent
CreateMutexExW
CreateSemaphoreExW
ReleaseMutex
InitializeCriticalSectionEx
InitializeSRWLock
ReleaseSemaphore
AcquireSRWLockExclusive
OpenEventW
TryEnterCriticalSection
WaitForSingleObjectEx
ResetEvent
WaitForMultipleObjectsEx
DeleteCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
CreateEventExW
CreateMutexW
WaitForSingleObject
OpenSemaphoreW
LeaveCriticalSection
InitializeCriticalSection
AcquireSRWLockShared
CreateEventW

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-errorhandling-l1-1-0

GetLastError
RaiseException
SetErrorMode
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

TlsFree
TlsSetValue
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
OpenProcessToken
TlsGetValue
ProcessIdToSessionId
TerminateProcess
GetProcessIdOfThread
GetProcessId
CreateThread
ResumeThread
ExitProcess
OpenThread
GetExitCodeProcess
CreateProcessAsUserW
OpenThreadToken
CreateProcessW
SetThreadPriority
GetCurrentThread
GetThreadPriority
TlsAlloc
QueueUserAPC
GetProcessTimes

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapSize
HeapDestroy
HeapSetInformation
HeapAlloc
HeapFree
HeapReAlloc

api-ms-win-core-fibers-l1-1-0

FlsSetValue
FlsFree
FlsAlloc

api-ms-win-core-memory-l1-1-0

FlushViewOfFile
MapViewOfFileEx
MapViewOfFile
OpenFileMappingW
VirtualProtect
VirtualQuery
CreateFileMappingW
VirtualFree
VirtualAlloc
UnmapViewOfFile

api-ms-win-core-atoms-l1-1-0

DeleteAtom
AddAtomW
FindAtomW

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetLogicalProcessorInformation
GetSystemInfo
GetTickCount64
GetSystemWindowsDirectoryW
GlobalMemoryStatusEx
GetTickCount
GetLocalTime
GetSystemDirectoryW
GetVersionExA
GetSystemTime
GetSystemTimeAsFileTime
GetSystemTimeAdjustment

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW
InitializeConditionVariable
InitOnceBeginInitialize
InitOnceComplete
SleepConditionVariableCS
WaitOnAddress
WakeByAddressAll
WakeAllConditionVariable
Sleep
InitOnceExecuteOnce
InitOnceInitialize

api-ms-win-core-path-l1-1-0

PathCchAddExtension
PathCchCanonicalize
PathCchRemoveExtension
PathCchAppendEx
PathCchCombine
PathCchCombineEx
PathAllocCombine
PathCchAppend
PathCchCanonicalizeEx

api-ms-win-core-shlwapi-legacy-l1-1-0

PathIsRelativeW
PathFileExistsW
PathMatchSpecW
PathSearchAndQualifyW
PathFindFileNameW
PathIsFileSpecW
PathGetCharTypeW
PathStripPathW
PathFindExtensionW
SHExpandEnvironmentStringsW
PathRemoveFileSpecW
IsCharSpaceW
PathUnquoteSpacesW
PathGetDriveNumberW
PathIsUNCW

api-ms-win-core-file-l1-1-0

FindNextFileW
SetFileAttributesW
CompareFileTime
CreateDirectoryW
SetEndOfFile
GetFileTime
FileTimeToLocalFileTime
GetDiskFreeSpaceExW
SetFilePointerEx
FindFirstChangeNotificationW
GetFullPathNameW
FindFirstFileW
RemoveDirectoryW
GetFileSizeEx
GetFileAttributesW
GetLongPathNameW
FindClose
FindNextChangeNotification
GetFileAttributesExW
GetFileSize
GetFullPathNameA
FindCloseChangeNotification
ReadFile
WriteFile
SetFilePointer
GetFileType
CreateFileW
FindFirstFileExW
GetTempFileNameW
DeleteFileW

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrCmpICA
StrCmpNIW
StrCmpICW
StrCmpNCW
StrCmpNICW
StrStrA
StrStrIA
StrChrA
StrToIntA
StrToIntW
StrRStrIW
StrToInt64ExW
StrCmpNW
StrCmpCW
StrCmpNICA
StrCSpnW
StrPBrkW
StrStrIW
StrDupW
StrCmpIW
StrChrNW
StrTrimW
StrToIntExW
QISearch
StrChrW
StrCmpW
StrChrNIW
StrStrW

api-ms-win-ntuser-sysparams-l1-1-0

GetMonitorInfoW
EnumDisplaySettingsW
GetSystemMetrics
SystemParametersInfoW

api-ms-win-core-kernel32-legacy-l1-1-0

WTSGetActiveConsoleSessionId
RegisterWaitForSingleObject
GetComputerNameW

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolWait
CreateThreadpoolTimer
SetThreadpoolThreadMaximum
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolTimer
CallbackMayRunLong
CreateThreadpoolCleanupGroup
CloseThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CloseThreadpool
SetThreadpoolThreadMinimum
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
TrySubmitThreadpoolCallback
SetThreadpoolWait
CreateThreadpool
WaitForThreadpoolWorkCallbacks

api-ms-win-core-largeinteger-l1-1-0

MulDiv

api-ms-win-core-string-l2-1-0

IsCharAlphaNumericW
CharUpperW
CharNextW
CharLowerBuffW
CharLowerW

api-ms-win-core-url-l1-1-0

UrlIsW
PathIsURLW
UrlCombineW
HashData
UrlCanonicalizeW
UrlGetLocationW
UrlCreateFromPathW
UrlUnescapeW
ParseURLW
UrlApplySchemeW
UrlIsNoHistoryW
PathCreateFromUrlW
UrlEscapeW
GetAcceptLanguagesW
UrlGetPartW

api-ms-win-core-localization-l1-2-2

LCIDToLocaleName
GetSystemDefaultLocaleName

api-ms-win-security-base-l1-1-0

InitializeAcl
CopySid
DuplicateTokenEx
AddAccessAllowedAce
GetTokenInformation
GetLengthSid
IsValidSid
AllocateLocallyUniqueId
GetSidSubAuthority
GetSidSubAuthorityCount

api-ms-win-core-kernel32-legacy-l1-1-1

PowerSetRequest
PowerClearRequest
VerifyVersionInfoW
PowerCreateRequest

api-ms-win-core-processthreads-l1-1-1

OpenProcess
GetProcessMitigationPolicy

api-ms-win-core-heap-l2-1-0

GlobalAlloc
LocalFree
LocalReAlloc
GlobalFree
LocalAlloc

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW
LoadLibraryA
FindResourceW

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegSetValueExW
RegDeleteTreeW
RegOpenKeyExA
RegGetValueW
RegEnumKeyExW
RegQueryInfoKeyW

api-ms-win-core-string-l2-1-1

SHLoadIndirectString

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpA
lstrcmpiW
lstrcmpiA
lstrcmpW
lstrlenW

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx
DeleteTimerQueueTimer
QueueUserWorkItem
CreateTimerQueueTimer

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
CompareStringEx
CompareStringW
MultiByteToWideChar
GetStringTypeW
CompareStringOrdinal

api-ms-win-core-processenvironment-l1-2-0

SearchPathA

api-ms-win-core-heap-obsolete-l1-1-0

GlobalReAlloc
LocalSize
GlobalSize
GlobalLock
GlobalUnlock
GlobalFlags

api-ms-win-core-sidebyside-l1-1-0

DeactivateActCtx
CreateActCtxW
ReleaseActCtx
ActivateActCtx

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-core-processenvironment-l1-1-0

SearchPathW
GetCurrentDirectoryW
SetEnvironmentVariableW
GetEnvironmentVariableW
ExpandEnvironmentStringsW

api-ms-win-core-privateprofile-l1-1-0

GetProfileIntA
GetProfileIntW
WritePrivateProfileStringW

api-ms-win-core-com-private-l1-1-0

CoRegisterInitializeSpy
CoRegisterMessageFilter
CoRevokeInitializeSpy

api-ms-win-core-file-l1-2-0

GetTempPathW
CreateFile2

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-mm-time-l1-1-0

timeEndPeriod
timeBeginPeriod

api-ms-win-core-job-l1-1-0

IsProcessInJob

api-ms-win-core-datetime-l1-1-1

GetDateFormatEx
GetTimeFormatEx

api-ms-win-core-systemtopology-l1-1-0

GetNumaHighestNodeNumber

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo
GetSystemTimePreciseAsFileTime

api-ms-win-core-file-l2-1-0

MoveFileExW
GetFileInformationByHandleEx

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList
InterlockedFlushSList
InterlockedPopEntrySList
InitializeSListHead
QueryDepthSList

api-ms-win-core-processtopology-obsolete-l1-1-0

GetActiveProcessorCount

api-ms-win-core-fibers-l2-1-0

SwitchToFiber
CreateFiber
DeleteFiber
ConvertFiberToThread
ConvertThreadToFiber

api-ms-win-core-marshal-l1-1-0

HWND_UserUnmarshal64
CLIPFORMAT_UserFree
HWND_UserMarshal64
HWND_UserUnmarshal
CLIPFORMAT_UserMarshal64
CLIPFORMAT_UserFree64
HWND_UserMarshal
CLIPFORMAT_UserSize64
CLIPFORMAT_UserUnmarshal64
HWND_UserFree
HWND_UserFree64
CLIPFORMAT_UserUnmarshal
CLIPFORMAT_UserMarshal
CLIPFORMAT_UserSize
HWND_UserSize
HWND_UserSize64

api-ms-win-core-localization-obsolete-l1-2-0

GetNumberFormatW
GetUserDefaultUILanguage
EnumUILanguagesW
GetSystemDefaultUILanguage

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW

api-ms-win-core-realtime-l1-1-0

QueryThreadCycleTime
QueryProcessCycleTime

api-ms-win-core-psapi-l1-1-0

K32GetProcessMemoryInfo

api-ms-win-core-interlocked-l1-2-0

InterlockedPushListSListEx

api-ms-win-core-stringansi-l1-1-0

CharLowerA

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadsFromDll
ResolveDelayLoadedAPI

api-ms-win-core-processthreads-l1-1-3

SetThreadDescription
SetProcessInformation

api-ms-win-core-errorhandling-l1-1-3

TerminateProcessOnMemoryExhaustion

api-ms-win-core-registry-l1-1-1

RegDeleteKeyValueW

api-ms-win-core-version-l1-1-0

GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW

rometadata

MetaDataGetDispenser

api-ms-win-ole32-ie-l1-1-0

OleRun
CoInitialize
CreateBindCtx
ReleaseStgMedium

kernelbase

OpenGlobalizationUserSettingsKey

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-namedpipe-l1-1-0

CreatePipe

api-ms-win-core-localization-ansi-l1-1-0

GetStringTypeExA

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-memory-l1-1-1

VirtualUnlock

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage

api-ms-win-core-windowserrorreporting-l1-1-0

WerRegisterMemoryBlock
WerUnregisterMemoryBlock

Exports

Exports

CIGTestHookLoadLibraryWorkerThread
ClearPhishingFilterData
ClearTemporaryWebDataAsync
ConvertAndEscapePostData
CreateCoreWebView
CreateDiagnosticsToolObject
CreateHTMLPropertyPage
DllCanUnloadNow
DllEnumClassObjects
DllGetClassObject
Fetch_CreateOriginAgnosticFetch
GetColorValueFromString
GetWebPlatformObject
InitializeLocalHtmlEngine
MatchExactGetIDsOfNames
ShowHTMLDialog
ShowHTMLDialogEx
ShowModalDialog
ShowModelessHTMLDialog
Streams_CreateByteChunk
Streams_CreateDefaultSizedByteChunk
Streams_CreateDefaultSizedWideCharChunk
Streams_CreateReadableStream
Streams_CreateReadableStreamFromFileHandle
Streams_CreateReadableStreamFromFilePath
Streams_CreateWideCharChunk
Streams_CreateWritableStream
TravelLogCreateInstance
UninitializeLocalHtmlEngine

Sections

.text
Size: 18.5MB - Virtual size: 18.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5.4MB - Virtual size: 5.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 144KB - Virtual size: 227KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 636KB - Virtual size: 635KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
edpauditapi.dll
.dll windows:10 windows x64 arch:x64

2b8c53f7e01f69d246527cbda76fcf26

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

edpauditapi.pdb

Imports

msvcrt

_wcsdup
__crtLCMapStringW
_wsetlocale
?what@exception@@UEBAPEBDXZ
memset
_purecall
strcspn
vswprintf_s
wcscat_s
wcscpy_s
abort
_ismbblead
___mb_cur_max_func
strncpy_s
___lc_codepage_func
calloc
??0bad_cast@@QEAA@AEBV0@@Z
??0bad_cast@@QEAA@PEBD@Z
??1bad_cast@@UEAA@XZ
??_V@YAXPEAX@Z
wcsnlen
___lc_handle_func
__pctype_func
??0exception@@QEAA@AEBQEBDH@Z
__uncaught_exception
memmove
memcpy
__CxxFrameHandler3
_CxxThrowException
setlocale
_callnewh
_errno
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
wcsncpy_s
_onexit
sprintf_s
memmove_s
__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
malloc
free
wcsrchr
swprintf_s
_amsg_exit
_vscwprintf
localeconv
_XcptFilter
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
??3@YAXPEAX@Z
memcpy_s
_vsnwprintf
strnlen
__CxxFrameHandler4

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventWriteTransfer
EventRegister
EventUnregister

api-ms-win-core-libraryloader-l1-2-0

SizeofResource
FindResourceExW
LockResource
GetModuleHandleW
GetProcAddress
LoadResource
GetModuleFileNameA
GetModuleHandleExW

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionEx
CreateMutexExW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateSemaphoreExW
ReleaseSRWLockExclusive
ReleaseSemaphore
OpenSemaphoreW
WaitForSingleObject
InitializeSRWLock
ReleaseMutex
WaitForSingleObjectEx
AcquireSRWLockExclusive

api-ms-win-core-heap-l1-1-0

HeapSize
HeapDestroy
GetProcessHeap
HeapReAlloc
HeapAlloc
HeapFree

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
RaiseException
SetUnhandledExceptionFilter
SetLastError

api-ms-win-eventing-consumer-l1-1-0

OpenTraceW
CloseTrace
ProcessTrace

api-ms-win-eventing-controller-l1-1-0

EventAccessControl
ControlTraceW

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
TerminateProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-sysinfo-l1-1-0

GetWindowsDirectoryW
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-eventing-tdh-l1-1-0

TdhGetProperty
TdhGetPropertySize
TdhGetEventInformation

ntdll

NtCreateFile
RtlNtStatusToDosError
RtlFreeHeap
RtlGetNtSystemRoot
NtClose
RtlValidSid
RtlInitUnicodeString
RtlAllocateHeap
NtReadFile

api-ms-win-core-file-l1-1-0

FindFirstFileW
GetFileAttributesW
FindNextFileW
CompareFileTime
FindClose

api-ms-win-core-com-l1-1-0

StringFromGUID2
CoTaskMemFree
CoTaskMemAlloc

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

ws2_32

WSACleanup
ntohl
WSAAddressToStringW
ntohs
WSAStartup

api-ms-win-core-timezone-l1-1-0

SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte
GetStringTypeW

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

Exports

Exports

EdpAuditHarden
EdpAuditLogApplicationGenerated
EdpAuditLogApplicationLearning
EdpAuditLogDataCopied
EdpAuditLogProtectionRemoved
EdpAuditLogSiteLearning
EdpAuditLoggerRegister
EdpAuditLoggerUnregister
EdpAuditRead
EdpFlushTraces
EdpGetLogFullPathFromRelativePath
ReadAuditLogByCount
ReadAuditLogByTimeRange

Sections

.text
Size: 88KB - Virtual size: 86KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
edpcsp.dll
.dll windows:10 windows x64 arch:x64

404e8e3012e79b10470338cf4dc3e644

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

EDPCSP.pdb

Imports

msvcp110_win

?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ
?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
?_Add_vtordisp2@?$basic_ostream@GU?$char_traits@G@std@@@std@@UEAAXXZ
?_Add_vtordisp1@?$basic_istream@GU?$char_traits@G@std@@@std@@UEAAXXZ
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Xbad_alloc@std@@YAXXZ
?_Syserror_map@std@@YAPEBDH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Winerror_map@std@@YAPEBDH@Z
?_Xout_of_range@std@@YAXPEBD@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_BADOFF@std@@3_JB
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?pbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA_N_N@Z

msvcrt

memmove
memcpy
memcmp
_CxxThrowException
memset
strrchr
__CxxFrameHandler4
??_V@YAXPEAX@Z
_vsnwprintf
memcpy_s
??3@YAXPEAX@Z
_purecall
??1exception@@UEAA@XZ
??0exception@@QEAA@XZ
??0exception@@QEAA@AEBV0@@Z
__CxxFrameHandler3
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
wcstoul
_wcsnicmp
memmove_s
strncpy_s
_set_errno
_errno
strtol
strchr
sprintf_s
?terminate@@YAXXZ
__C_specific_handler
_vsnprintf_s
_initterm
free
_amsg_exit
_XcptFilter
_callnewh
malloc
wcstok_s
_wcsicmp
wcsnlen

dmcmnutils

MBToUnicode
DmGetActiveUserSid
UnicodeToMB
DmWnfQuery

policymanager

EnterprisePolicyManagerStore_EDPCSPConfigSourceAreaPolicyGetValue
EnterprisePolicyManagerStore_EDPCSPConfigSourceAreaPolicySetValue
EnterprisePolicyManagerStore_PublishAnyDelayedWnfs
EnterprisePolicyManagerStore_EDPCSPConfigSourceAreaDeleteChild
EnterprisePolicyManagerStore_PerformEvaluatorMerge
EnterprisePolicyManagerStore_GetPolicyDoNotAllowFromMetadata

ntdll

RtlIsStateSeparationEnabled
RtlIsMultiSessionSku
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlNtStatusToDosError
NtQueryWnfStateData
ZwQueryWnfStateData

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
LoadLibraryExA
GetModuleFileNameA
GetModuleHandleExA
GetModuleHandleExW
FreeLibrary
GetModuleHandleW
GetProcAddress

oleaut32

VariantClear
SafeArrayGetLBound
SafeArrayLock
SafeArrayDestroy
SafeArrayUnlock
SafeArrayGetUBound
SafeArrayCreate
VariantInit
SysFreeString
SysAllocString

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-com-l1-1-0

CLSIDFromString
CoUninitialize
CoInitializeSecurity
CoTaskMemFree
CoInitializeEx
CoSetProxyBlanket
CoCreateInstance
CoTaskMemAlloc

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

IdnToAscii
IdnToUnicode
FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
Sleep
InitOnceComplete

api-ms-win-core-synch-l1-1-0

OpenSemaphoreW
WaitForSingleObjectEx
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
ReleaseMutex
CreateMutexExW
DeleteCriticalSection
AcquireSRWLockShared
EnterCriticalSection
ReleaseSRWLockShared
LeaveCriticalSection
ReleaseSRWLockExclusive
InitializeCriticalSectionEx
AcquireSRWLockExclusive

api-ms-win-core-errorhandling-l1-1-0

GetLastError
RaiseException
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventWriteTransfer
EventUnregister
EventActivityIdControl
EventRegister

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetSystemInfo

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW
RegCloseKey
RegEnumKeyExW
RegCreateKeyExW
RegGetValueW
RegOpenKeyExW
RegSetValueExW
RegDeleteValueW
RegQueryValueExW
RegEnumValueW

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer

api-ms-win-security-base-l1-1-0

RevertToSelf
ImpersonateLoggedOnUser

rpcrt4

UuidCreate

api-ms-win-core-memory-l1-1-0

VirtualQuery
VirtualProtect

Exports

Exports

CreateAllEdpTasks
DeleteAllEdpTasks
DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 112KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 632B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
edptask.dll
.dll regsvr32 windows:10 windows x64 arch:x64

ab301cd41c3aab3af32a265c9f53ba52

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

EdpTask.pdb

Imports

msvcrt

__dllonexit
malloc
_unlock
_lock
?terminate@@YAXXZ
__C_specific_handler
??3@YAXPEAX@Z
_amsg_exit
_vsnprintf_s
_XcptFilter
memmove
??1type_info@@UEAA@XZ
memcpy
__CxxFrameHandler3
??0exception@@QEAA@AEBV0@@Z
free
_vsnwprintf
_CxxThrowException
??0exception@@QEAA@XZ
__CxxFrameHandler4
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBDH@Z
_wcsdup
memcpy_s
_wcsicmp
??1exception@@UEAA@XZ
_initterm
??0exception@@QEAA@AEBQEBD@Z
_onexit
_purecall
_callnewh
memset

api-ms-win-core-libraryloader-l1-2-0

LoadResource
GetModuleHandleExW
GetProcAddress
FreeLibraryAndExitThread
LockResource
LoadLibraryExA
DisableThreadLibraryCalls
FindResourceExW
GetModuleHandleW
FreeLibrary
GetModuleFileNameA

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
CreateSemaphoreExW
ReleaseSemaphore
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CreateMutexExW

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
TerminateProcess
OpenProcessToken
ResumeThread
CreateThread
GetCurrentProcess
GetCurrentProcessId

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetLastError
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetSystemInfo
GetVersionExW
GetSystemWindowsDirectoryW

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree

api-ms-win-core-registry-l1-1-0

RegGetValueW

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsGetStringRawBuffer

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventWriteTransfer
EventSetInformation
EventRegister

api-ms-win-security-base-l1-1-0

GetTokenInformation
AllocateAndInitializeSid
FreeSid

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-core-winrt-l1-1-0

RoActivateInstance

rpcrt4

RpcBindingFromStringBindingW
RpcBindingFree
RpcStringFreeW
RpcBindingSetAuthInfoExW
RpcStringBindingComposeW
NdrClientCall3

api-ms-win-service-management-l1-1-0

OpenServiceW
CloseServiceHandle
OpenSCManagerW
StartServiceW

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

ntdll

RtlNtStatusToDosError
NtQueryWnfStateData
RtlIsMultiSessionSku

api-ms-win-core-memory-l1-1-0

VirtualQuery
VirtualProtect

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 60KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 712B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
edputil.dll
.dll windows:10 windows x64 arch:x64

41072b14f7ec860bcfe8235f9568b698

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

edputil.pdb

Imports

msvcrt

wcsnlen
_purecall
wcsrchr
_XcptFilter
_amsg_exit
free
malloc
??3@YAXPEAX@Z
_initterm
_vsnwprintf
wcsncpy_s
_wcsicmp
_wcsnicmp
wcsstr
wcsncmp
wcstok_s
wcschr
_callnewh
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
_CxxThrowException
memcpy
memmove
??1type_info@@UEAA@XZ
__C_specific_handler
_lock
memcmp
__dllonexit
_onexit
memcpy_s
__CxxFrameHandler3
_unlock
memset

api-ms-win-core-libraryloader-l1-2-0

LoadStringA
FindResourceExW
LoadResource
GetModuleFileNameA
LoadLibraryExW
GetProcAddress
LoadStringW
FreeLibrary
LoadLibraryExA
LockResource
GetModuleHandleW
GetModuleHandleExW
GetModuleHandleExA
DisableThreadLibraryCalls

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceBeginInitialize
InitOnceComplete

api-ms-win-core-synch-l1-1-0

InitializeSRWLock
OpenSemaphoreW
WaitForSingleObjectEx
CreateMutexExW
CreateSemaphoreExW
EnterCriticalSection
LeaveCriticalSection
ReleaseSemaphore
ReleaseSRWLockExclusive
InitializeCriticalSection
ReleaseMutex
DeleteCriticalSection
AcquireSRWLockExclusive
WaitForSingleObject

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

SetLastError
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventRegister
EventSetInformation
EventActivityIdControl
EventUnregister

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TerminateProcess
TlsGetValue
OpenThreadToken
GetCurrentThreadId
GetCurrentProcess
GetCurrentThread
OpenProcessToken
TlsSetValue
TlsFree
TlsAlloc

api-ms-win-core-localization-l1-2-0

IdnToAscii
FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree

api-ms-win-core-heap-l2-1-0

LocalAlloc
GlobalFree
GlobalAlloc
LocalFree

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsGetStringRawBuffer
WindowsGetStringLen
WindowsCreateStringReference

api-ms-win-security-base-l1-1-0

GetLengthSid
GetTokenInformation
CopySid
IsValidSid

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCompareMemory
RtlCaptureContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock
GlobalLock
GlobalSize

ntdll

RtlCopyUnicodeString
RtlAllocateHeap
RtlAppendUnicodeToString
RtlAppendUnicodeStringToString
NtUpdateWnfStateData
RtlNtStatusToDosErrorNoTeb
ZwQueryWnfStateData
RtlCompareUnicodeString
RtlFreeHeap
NtQueryWnfStateData
RtlNtStatusToDosError
NtQuerySecurityAttributesToken
RtlInitUnicodeString

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegOpenCurrentUser
RegCloseKey

api-ms-win-core-memory-l1-1-0

VirtualQuery
VirtualProtect

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

EdpAddAppClipboardConsentInCache
EdpAuditAction
EdpCanCallerAccessWin32Clipboard
EdpCheckAccess
EdpCheckAccessForContext
EdpCheckIsDpapiNgEntId
EdpCheckIsRmsEntId
EdpClearClipboardMetaData
EdpConvertProtectorToExternalId
EdpFreeContext
EdpGetAppLockerUniqueAppIdentifier
EdpGetAppLockerUniqueAppIdentifierByToken
EdpGetAppLockerUniqueAppIdentifierByTokenEx
EdpGetClipboardAccessDeniedData
EdpGetContextForBinaryPath
EdpGetContextForImpersonatedToken
EdpGetContextForPackageFullName
EdpGetContextForProcess
EdpGetContextForWindow
EdpGetDataInfoFromDataObject
EdpGetDataInfoFromWin32Clipboard
EdpGetEnterpriseIdForClipboard
EdpGetEnterpriseIdForDataObject
EdpGetEnterpriseIdForUIEnforcement
EdpGetEnterpriseIdForUIEnforcementFromProcess
EdpGetFilePathsForDataObject
EdpGetIsManaged
EdpGetPersonalEnterpriseIdString
EdpGetPrimaryIdentities
EdpGetPrimaryIdentityIfManaged
EdpGetRevocationInfo
EdpGetSourceAppIdForClipboard
EdpGetSourceIsEnlightenedForClipboard
EdpGetWindowFromThreadId
EdpIsAppClipboardConsentCached
EdpIsContextExemptOrEnlightenedAllowed
EdpIsFileAccessAllowed
EdpIsUIPolicyEvaluationEnabledForThread
EdpIsValidSubjectForEncryption
EdpParseIdentityString
EdpParseProtectorDescriptor
EdpQueryIdentityWithProtectorDescriptor
EdpRequestAccess
EdpRequestAccessForContext
EdpSetEnterpriseIdForClipboard
EdpSetSourceAppIdForClipboard
EdpSetSourceIsEnlightenedForClipboard
EdpShouldShowEnterpriseIndicator
EdpUtilCreateEnterpriseContextFromEnterpriseId
EdpUtilFreeEnterpriseContext
EdpUtilGetEnterpriseContextByName
EdpUtilGetEnterpriseContextByProcess
EdpUtilGetEnterpriseContextByWindowHandle
EdpUtilGetEnterpriseContextForCurrentView
EdpUtilGetEnterpriseContextForView
EdpUtilIsAppEnlightened
EdpUtilQueryPolicy
GetProcessUniqueIdFromToken

Sections

.text
Size: 96KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 424B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 604B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
eeprov.dll
.dll windows:10 windows x64 arch:x64

4c3e7bfb59f740b4d6b85d5684725041

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

eeprov.pdb

Imports

api-ms-win-crt-string-l1-1-0

wcscmp
memset
wcsnlen

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsicmp
_o_ceilf
_o_free
_o_malloc
_o_memcpy_s
_o_qsort
_o_terminate
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstok_s
__C_specific_handler
__current_exception
__current_exception_context
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o__execute_onexit_table
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o__errno
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__CxxFrameHandler3
_CxxThrowException
__std_terminate
__CxxFrameHandler4
wcsrchr
wcsstr
__C_specific_handler_noexcept
memcmp
memcpy

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
GetLastError
SetLastError

ntdll

RtlInitializeSRWLock
RtlClearBit
RtlFindSetBits
RtlInitializeBitMap
RtlRbInsertNodeEx
RtlEqualSid
RtlLengthSid
NtQuerySystemInformation
RtlCopySid
RtlCompareMemoryUlong
RtlReleaseSRWLockShared
RtlTimeToTimeFields
RtlNtStatusToDosError
NtPowerInformation
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
RtlUpcaseUnicodeString
RtlInitUnicodeString
RtlGetDeviceFamilyInfoEnum
RtlRbRemoveNode
RtlAcquireSRWLockShared
RtlFreeHeap
RtlAllocateHeap
RtlEnumerateEntryHashTable
RtlEndEnumerationHashTable
RtlCreateHashTable
RtlRemoveEntryHashTable
RtlInitEnumerationHashTable
RtlInsertEntryHashTable
RtlGetNextEntryHashTable
RtlLookupEntryHashTable

api-ms-win-core-version-l1-1-1

GetFileVersionInfoSizeW
GetFileVersionInfoW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-file-l1-1-0

CreateFileW
GetLogicalDrives

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCompareMemory

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetLogicalProcessorInformationEx
GetSystemInfo
GetTickCount64

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventSetInformation
EventWriteTransfer

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

api-ms-win-power-setting-l1-1-0

PowerSettingRegisterNotification
PowerSettingUnregisterNotification

devobj

DevObjGetDeviceInterfaceDetail
DevObjDestroyDeviceInfoList
DevObjCreateClassDeviceInfoList
DevObjGetClassDevs
DevObjEnumDeviceInterfaces
DevObjCreateDeviceInfoList

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegCloseKey
RegDeleteValueW

api-ms-win-core-synch-l1-1-0

CreateEventA
AcquireSRWLockShared
CreateMutexExW
EnterCriticalSection
ReleaseSRWLockShared
LeaveCriticalSection
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
InitializeCriticalSection
ReleaseSRWLockExclusive
DeleteCriticalSection
WaitForSingleObject
CreateSemaphoreExW
InitializeCriticalSectionEx
ReleaseSemaphore
ReleaseMutex

api-ms-win-power-base-l1-1-0

CallNtPowerInformation

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage

api-ms-win-core-realtime-l1-1-1

QueryInterruptTime
QueryInterruptTimePrecise

api-ms-win-security-base-l1-1-0

CreateWellKnownSid

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleW
FreeLibrary
SizeofResource
GetModuleHandleExA
GetModuleHandleExW
GetModuleFileNameW
LoadResource
DisableThreadLibraryCalls
FindResourceExW
GetModuleFileNameA
LoadLibraryExW

api-ms-win-core-com-l1-1-0

PropVariantClear
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CreateThreadpoolTimer
CreateThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
CloseThreadpoolTimer
SetThreadpoolWait
WaitForThreadpoolTimerCallbacks

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-apiquery-l2-1-0

IsApiSetImplemented

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-appmodel-runtime-l1-1-0

PackageIdFromFullName

msvcp_win

?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

rpcrt4

RpcServerUseProtseqW
NdrServerCallAll
NdrServerCall2
RpcServerRegisterIf3
RpcServerInqCallAttributesA
RpcBindingVectorFree
RpcBindingFree
RpcEpRegisterW
RpcServerRegisterIfEx
NdrAsyncServerCall
Ndr64AsyncServerCallAll
RpcAsyncCancelCall
RpcServerInqBindings
RpcServerUseProtseqEpW
RpcStringFreeW
RpcServerUnregisterIfEx
Ndr64AsyncClientCall
RpcServerInqCallAttributesW
RpcAsyncAbortCall
RpcAsyncCompleteCall
RpcAsyncInitializeHandle
RpcBindingFromStringBindingW
RpcStringBindingComposeW

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-heap-l2-1-0

LocalFree

oleaut32

VarUI4FromStr

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

SruInitializeProvider
SruUninitializeProvider

Sections

.text
Size: 172KB - Virtual size: 169KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 804B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
eeutil.dll
.dll windows:10 windows x64 arch:x64

5094bbcd0cbabeeb74411249a258988d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

eeutil.pdb

Imports

msvcrt

__C_specific_handler
??1type_info@@UEAA@XZ
_initterm
_lock
_XcptFilter
__CxxFrameHandler3
_CxxThrowException
_unlock
__dllonexit
_onexit
_callnewh
memset
??0exception@@QEAA@AEBQEBDH@Z
malloc
_wcsupr_s
_purecall
_vsnprintf_s
__CxxFrameHandler4
?terminate@@YAXXZ
_vsnwprintf
??0exception@@QEAA@XZ
memmove_s
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBV0@@Z
memcpy_s
printf
_wcsicmp
wcstol
puts
free
_vsnprintf
_amsg_exit
memcmp
wcscmp

oleaut32

SysFreeString
SysAllocString
SysStringByteLen
VarBstrCmp
SysAllocStringByteLen

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-1-0

ReleaseSemaphore
SetEvent
AcquireSRWLockExclusive
ReleaseSRWLockShared
EnterCriticalSection
InitializeCriticalSectionEx
AcquireSRWLockShared
WaitForSingleObject
OpenSemaphoreW
CreateEventW
ReleaseMutex
WaitForSingleObjectEx
ReleaseSRWLockExclusive
LeaveCriticalSection
CreateSemaphoreExW
WaitForMultipleObjectsEx
CreateMutexExW
DeleteCriticalSection

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter

api-ms-win-core-com-l1-1-0

StringFromGUID2
CoCreateInstance
CoInitializeSecurity
CoInitializeEx

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetSystemTime

api-ms-win-core-console-l1-1-0

SetConsoleCtrlHandler

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameA
GetProcAddress

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
OutputDebugStringA
IsDebuggerPresent

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventUnregister
EventSetInformation
EventRegister

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceBeginInitialize
Sleep

api-ms-win-core-string-l2-1-1

SHLoadIndirectString

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

xmllite

CreateXmlWriter

api-ms-win-shcore-stream-l1-1-0

SHCreateStreamOnFileW

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrChrW
StrCmpW

api-ms-win-core-perfcounters-l1-1-0

PerfCreateInstance
PerfSetCounterSetInfo
PerfStartProvider
PerfStopProvider
PerfDeleteInstance
PerfSetULongCounterValue

srumapi

SruUnregisterRealTimeStats
SruQueryStats
SruUpdateStats
SruRegisterRealTimeStats

Exports

Exports

EeUtilCommand

Sections

.text
Size: 72KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 272B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
efsadu.dll
.dll windows:10 windows x64 arch:x64

3ce5d8ad3a384b3abf8559b2e1fedcea

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

efsadu.pdb

Imports

mfc42u

ord2593
ord4747
ord3501
ord3806
ord912
ord626
ord1040
ord1126
ord2329
ord4557
ord4473
ord3417
ord6351
ord4721
ord5245
ord287
ord2906
ord2517
ord1442
ord6614
ord6328
ord4257
ord4609
ord5077
ord2975
ord5887
ord2661
ord665
ord4548
ord6385
ord3761
ord4771
ord5702
ord4752
ord1777
ord6437
ord4789
ord5687
ord6886
ord2629
ord1082
ord288
ord6440
ord1544
ord1586
ord1555
ord1583
ord1585
ord355
ord1477
ord1553
ord1416
ord1491
ord1577
ord1463
ord822
ord1067
ord3743
ord4988
ord3535
ord5699
ord2140
ord2457
ord1736
ord5683
ord5484
ord3933
ord6814
ord2060
ord2559
ord2586
ord852
ord337
ord2515
ord6071
ord4191
ord1388
ord5615
ord2412
ord3468
ord5722
ord5724
ord4368
ord5065
ord5730
ord5711
ord6053
ord3049
ord2670
ord5229
ord4017
ord5712
ord4694
ord6812
ord5586
ord2399
ord5663
ord4741
ord1778
ord5406
ord6813
ord4365
ord3243
ord3362
ord4815
ord3231
ord3366
ord3052
ord3166
ord3046
ord4082
ord4083
ord4077
ord3164
ord4371
ord4983
ord812
ord4770
ord4836
ord3916
ord2752
ord1063
ord659
ord4598
ord6632
ord6887

msvcrt

??1exception@@UEAA@XZ
memcpy_s
_vsnwprintf
??_V@YAXPEAX@Z
_ltow_s
_onexit
memset
memcpy
??0exception@@QEAA@XZ
_CxxThrowException
strcmp
_wcsicmp
__CxxFrameHandler3
_XcptFilter
??1type_info@@UEAA@XZ
_amsg_exit
??0exception@@QEAA@AEBV0@@Z
_initterm
_vsnprintf_s
__C_specific_handler
malloc
memcmp
?terminate@@YAXXZ
_lock
_unlock
free
__CxxFrameHandler4
__dllonexit

shell32

Shell_NotifyIconW
ShellExecuteW
ord155
SHGetFolderPathW
SHCreateItemFromParsingName
ord190
SHChangeNotifySuspendResume

shlwapi

StrDupW
ord278

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
LoadStringW
GetModuleHandleW
GetModuleFileNameW
GetModuleFileNameA
GetModuleHandleExW

api-ms-win-core-synch-l1-1-0

WaitForSingleObjectEx
CreateSemaphoreExW
OpenEventW
OpenSemaphoreW
ReleaseMutex
CreateMutexExW
WaitForSingleObject
ReleaseSemaphore

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
TerminateProcess
OpenThreadToken
GetCurrentProcess
CreateThread
OpenProcessToken
GetCurrentThread
GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

GetLocaleInfoEx
FormatMessageW
GetUserPreferredUILanguages

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
OutputDebugStringA
IsDebuggerPresent
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

dsrole

DsRoleFreeMemory
DsRoleGetPrimaryDomainInformation

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

crypt32

CertAddCertificateLinkToStore
CryptEncodeObjectEx
CertEnumCertificatesInStore
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CryptStringToBinaryW
CertGetNameStringW
CryptDecodeObject
CertFindExtension
CertGetEnhancedKeyUsage
CertVerifyTimeValidity
CertSetCertificateContextProperty
CertGetCertificateContextProperty
CertAddCertificateContextToStore
CertFreeCertificateContext
CertCloseStore
CryptBinaryToStringW
CertFindCertificateInStore
CertGetCertificateChain
CertCreateCertificateContext
CertOpenStore

api-ms-win-security-credentials-l1-1-0

CredFree
CredMarshalCredentialW

api-ms-win-core-com-l1-1-0

CoInitializeEx
CoTaskMemAlloc
CoUninitialize
CoTaskMemFree
CoCreateInstance

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

oleaut32

SysAllocString
SysFreeString
SysStringByteLen

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegQueryValueExW

rpcrt4

UuidCreate
RpcStringFreeW
UuidToStringW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-file-l1-1-0

FindClose
FindFirstFileExW
GetFullPathNameW
FindNextFileW
GetFileAttributesW

api-ms-win-core-processenvironment-l1-1-0

GetCurrentDirectoryW
SetCurrentDirectoryW

api-ms-win-service-management-l1-1-0

CloseServiceHandle
OpenServiceW
OpenSCManagerW

api-ms-win-service-management-l2-1-0

ChangeServiceConfigW

api-ms-win-eventing-provider-l1-1-0

EventEnabled
EventUnregister
EventRegister
EventWrite

api-ms-win-security-base-l1-1-0

GetTokenInformation
CopySid
GetLengthSid
CheckTokenMembership
EqualSid

wldap32

ord16
ord73
ord170
ord18
ord208
ord224
ord26
ord140
ord41
ord13

logoncli

DsGetDcNameW

netutils

NetApiBufferFree

userenv

RefreshPolicy

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

efsutil

EfsUtilGetCertContextFromCertHash
EfsUtilGetUserKey
EfsUtilSetSmartcardPin
EfsUtilReleaseUserKey
EfsUtilCreateSelfSignedCertificate
EfsUtilCheckCurrentKeyCapabilities
EfsUtilGetSmartcardProviderName
EfsUtilGetCurrentUserInformation
EfsUtilGetCurrentKey
EfsUtilSmartcardCredsNeededError
EfsUtilApplyGroupPolicy

advapi32

LsaClose
LsaFreeMemory
LsaLookupSids
LsaOpenPolicy
RemoveUsersFromEncryptedFile
AddUsersToEncryptedFile
FreeEncryptionCertificateHashList
QueryRecoveryAgentsOnEncryptedFile
QueryUsersOnEncryptedFile
CryptSetProvParam
EncryptFileW
SetUserFileEncryptionKeyEx
UsePinForEncryptedFilesW

credui

CredPackAuthenticationBufferW
CredUIPromptForWindowsCredentialsW
CredUnPackAuthenticationBufferW

cryptui

CryptUIDlgSelectCertificateW
CryptUIWizExport

feclient

EfsClientFreeKeyInfo
EdpIsConsumerDataProtectionEnforced
EfsClientQueryProtectors
EfsClientFreeProtectorList
EfsClientGetKeyInfo

kernel32

ActivateActCtx
FindActCtxSectionStringW
CreateActCtxW
QueryActCtxW
GetComputerNameW
lstrlenW
DeactivateActCtx

ntdll

RtlNtStatusToDosError
RtlAllocateAndInitializeSid
NtQueryInformationToken
RtlFreeSid

ole32

CoInitialize

user32

GetClientRect
EnableWindow
PostMessageW
DestroyWindow
SendMessageW
KillTimer
MessageBoxW
TranslateMessage
GetMessageW
SetTimer
LoadIconW
DefWindowProcW
PostQuitMessage
DispatchMessageW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

AddUserToObjectW
BackCurrentEfsCert
EfsDetail
EfsUIUtilCheckScardStatus
EfsUIUtilCreateSelfSignedCertificate
EfsUIUtilEncryptMyDocuments
EfsUIUtilEnrollEfsCertificate
EfsUIUtilEnrollEfsCertificateEx
EfsUIUtilInstallDra
EfsUIUtilKeyBackup
EfsUIUtilPromptForPin
EfsUIUtilPromptForPinDialog
EfsUIUtilSelectCard
EfsUIUtilShowBalloonAndWait

Sections

.text
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
efscore.dll
.dll windows:10 windows x64 arch:x64

c949008c82dec04127248624aae3ee92

Code Sign

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5c:df:a1:fd:ad:73:89:fe:e2:7e:86:5e:c3:65:27:9a:2d:f3:c7:b3:f2:71:c8:5b:c5:e6:c0:c4:b7:21:16:89
Signer

Actual PE Digest

5c:df:a1:fd:ad:73:89:fe:e2:7e:86:5e:c3:65:27:9a:2d:f3:c7:b3:f2:71:c8:5b:c5:e6:c0:c4:b7:21:16:89

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

efscore.pdb

Imports

msvcrt

abort
__uncaught_exception
calloc
wcsrchr
wcschr
__pctype_func
_ismbblead
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_wcslwr
___lc_codepage_func
___lc_handle_func
wcstok_s
_onexit
wcsstr
_errno
memmove_s
__dllonexit
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
___mb_cur_max_func
_initterm
_amsg_exit
__CxxFrameHandler4
_unlock
_XcptFilter
_lock
setlocale
??0exception@@QEAA@XZ
memmove
memcpy
memcmp
__CxxFrameHandler3
_CxxThrowException
??0exception@@QEAA@AEBQEBDH@Z
_callnewh
malloc
iswspace
_wtoi64
__C_specific_handler
_wcsicmp
swprintf_s
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBD@Z
??0bad_cast@@QEAA@AEBV0@@Z
??1bad_cast@@UEAA@XZ
??0bad_cast@@QEAA@PEBD@Z
_wsetlocale
__crtLCMapStringW
_wcsdup
_wcsrev
wcstoul
_vsnprintf
wcsnlen
wcsncmp
free
_wcsnicmp
??1exception@@UEAA@XZ
_purecall
??3@YAXPEAX@Z
memcpy_s
_vsnwprintf
memset
wcscmp

api-ms-win-core-libraryloader-l1-2-0

FindResourceExW
GetModuleHandleExA
LockResource
GetModuleFileNameW
FreeLibrary
LoadLibraryExW
GetModuleHandleW
LoadResource
GetProcAddress
GetModuleFileNameA
GetModuleHandleExW

api-ms-win-core-synch-l1-1-0

TryAcquireSRWLockExclusive
CreateMutexW
ReleaseSRWLockShared
LeaveCriticalSection
CreateMutexExW
CreateEventW
TryAcquireSRWLockShared
CreateSemaphoreExW
TryEnterCriticalSection
InitializeCriticalSection
SetEvent
InitializeCriticalSectionEx
ReleaseSemaphore
WaitForSingleObject
ResetEvent
WaitForSingleObjectEx
AcquireSRWLockExclusive
CreateWaitableTimerExW
InitializeSRWLock
ReleaseMutex
DeleteCriticalSection
OpenSemaphoreW
EnterCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockShared
CancelWaitableTimer
SetWaitableTimerEx
CreateEventExW

api-ms-win-core-heap-l1-1-0

HeapFree
HeapDestroy
HeapCreate
HeapAlloc
GetProcessHeap
HeapSetInformation

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
RaiseException
SetLastError

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolWork
CloseThreadpoolTimer
CreateThreadpool
CreateThreadpoolCleanupGroup
SetThreadpoolThreadMinimum
SetThreadpoolThreadMaximum
CloseThreadpoolCleanupGroupMembers
CreateThreadpoolWait
CloseThreadpoolCleanupGroup
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
IsThreadpoolTimerSet
CloseThreadpoolWait
CreateThreadpoolTimer
SubmitThreadpoolWork
CreateThreadpoolWork
CloseThreadpool
SetThreadpoolTimer
CallbackMayRunLong
WaitForThreadpoolWorkCallbacks
WaitForThreadpoolTimerCallbacks

api-ms-win-core-processthreads-l1-1-0

ResumeThread
CreateThread
GetCurrentThread
OpenThreadToken
GetCurrentProcessId
TerminateThread
SetThreadToken
TerminateProcess
OpenProcessToken
SetThreadStackGuarantee
GetCurrentThreadId
GetCurrentProcess
GetThreadId

api-ms-win-core-localization-l1-2-0

FormatMessageW
IdnToAscii

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventUnregister
EventWriteTransfer
EventRegister
EventActivityIdControl

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetVersionExW
GetSystemInfo
GetLocalTime
GetSystemTime
GetTickCount64
GetComputerNameExW

api-ms-win-core-file-l1-1-0

SetFileTime
FindFirstFileExW
WriteFile
FlushFileBuffers
DeleteFileW
SetFileInformationByHandle
CreateDirectoryW
RemoveDirectoryW
GetTempFileNameW
GetFullPathNameW
GetDriveTypeW
FindFirstVolumeW
FindNextVolumeW
FindVolumeClose
CreateFileW
GetFileSizeEx
FindFirstFileW
FindNextFileW
FindClose
GetVolumeInformationW
ReadFile
GetFileAttributesExW
GetVolumeInformationByHandleW
GetFinalPathNameByHandleW
GetFileAttributesW
GetFileInformationByHandle
CompareFileTime
SetFilePointer
GetVolumePathNameW
GetFileTime

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
SleepConditionVariableSRW
InitOnceComplete
Sleep
WakeAllConditionVariable

api-ms-win-core-registry-l1-1-0

RegDeleteValueW
RegEnumValueW
RegQueryInfoKeyW
RegQueryValueExW
RegDeleteTreeW
RegNotifyChangeKeyValue
RegCloseKey
RegEnumKeyExW
RegFlushKey
RegSetValueExW
RegCreateKeyExW
RegGetValueW
RegOpenCurrentUser
RegOpenKeyExW

api-ms-win-core-com-l1-1-0

CoTaskMemRealloc
CoTaskMemAlloc
CoCreateGuid
CoCreateFreeThreadedMarshaler
CoIncrementMTAUsage
CoWaitForMultipleHandles
CoDecrementMTAUsage
CoTaskMemFree
StringFromGUID2
StringFromCLSID

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-memory-l1-1-0

VirtualQuery
VirtualAlloc
VirtualProtect
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
VirtualFree

crypt32

CertSetCertificateContextProperty
CertDuplicateCertificateContext
CertOpenStore
CertFindCertificateInStore
CertCloseStore
CertCreateCertificateContext
CertGetCertificateContextProperty
CryptBinaryToStringW
CryptImportPublicKeyInfoEx2
CryptStringToBinaryW
CertFreeCertificateChainEngine
CryptUnprotectMemory
CryptProtectMemory
CertVerifyTimeValidity
CertDeleteCertificateFromStore
CertAddEncodedCertificateToStore
CertFreeCertificateContext

api-ms-win-core-winrt-l1-1-0

RoUninitialize
RoGetActivationFactory
RoInitialize

api-ms-win-security-base-l1-1-0

DuplicateToken
CheckTokenMembership
CreateWellKnownSid
EqualSid
PrivilegeCheck
ImpersonateLoggedOnUser
GetTokenInformation
CopySid
IsValidSid
GetLengthSid
GetSidSubAuthorityCount
SetTokenInformation
GetSidSubAuthority
AdjustTokenPrivileges
DuplicateTokenEx
RevertToSelf

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime

ncrypt

NCryptOpenStorageProvider
NCryptFreeObject
NCryptImportKey
NCryptDeriveKey
NCryptSecretAgreement
NCryptCreateProtectionDescriptor
NCryptProtectSecret
NCryptCloseProtectionDescriptor
NCryptUnprotectSecret
NCryptExportKey
NCryptGetProtectionDescriptorInfo
NCryptOpenKey
NCryptSetProperty
NCryptGetProperty

authz

AuthziAllocateAuditParams
AuthziInitializeAuditEventType
AuthziInitializeAuditParams
AuthziInitializeAuditEvent
AuthziFreeAuditParams
AuthziFreeAuditEventType
AuthziLogAuditEvent
AuthzFreeAuditEvent

bcrypt

BCryptCreateHash
BCryptKeyDerivation
BCryptDestroySecret
BCryptDeriveKey
BCryptHash
BCryptSecretAgreement
BCryptGetFipsAlgorithmMode
BCryptImportKeyPair
BCryptDuplicateKey
BCryptFinishHash
BCryptDestroyHash
BCryptGenerateKeyPair
BCryptFinalizeKeyPair
BCryptExportKey
BCryptDecrypt
BCryptEncrypt
BCryptGenerateSymmetricKey
BCryptImportKey
BCryptDestroyKey
BCryptHashData
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptGetProperty
BCryptSetProperty
BCryptGenRandom

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCompareMemory
RtlLookupFunctionEntry
RtlCaptureContext

userenv

LeaveCriticalPolicySection
UnloadUserProfile
LoadUserProfileW
EnterCriticalPolicySection
UnregisterGPNotification
ExpandEnvironmentStringsForUserW
RegisterGPNotification

netutils

NetApiBufferFree

dsrole

DsRoleGetPrimaryDomainInformation
DsRoleFreeMemory

sspicli

LsaUnregisterPolicyChangeNotification
LsaFreeReturnBuffer
LsaRegisterPolicyChangeNotification
LsaGetLogonSessionData

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx
ReplaceFileW
MoveFileExW
CopyFile2

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW
ConvertSidToStringSidW

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-file-l1-2-0

GetVolumePathNamesForVolumeNameW
GetVolumeNameForVolumeMountPointW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
GetStringTypeW
CompareStringOrdinal
WideCharToMultiByte

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-1

OpenProcess
GetProcessMitigationPolicy

oleaut32

SysFreeString

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateStringReference

api-ms-win-power-base-l1-1-0

PowerUnregisterSuspendResumeNotification
PowerRegisterSuspendResumeNotification

winhttp

WinHttpCloseHandle
WinHttpConnect
WinHttpSetOption
WinHttpOpenRequest
WinHttpSendRequest
WinHttpQueryHeaders
WinHttpAddRequestHeaders
WinHttpOpen
WinHttpReceiveResponse
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpCrackUrl

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW
UnregisterWait
RegisterWaitForSingleObject

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem
DeleteTimerQueueTimer
UnregisterWaitEx
CreateTimerQueueTimer

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindExtensionW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-appmodel-runtime-l1-1-0

PackageFamilyNameFromFullName

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

profapi

ord104

ntdll

EtwEventRegister
EtwEventUnregister
EtwEventEnabled
EtwEventWrite
RtlAllocateHeap
RtlAcquireSRWLockShared
RtlReleaseSRWLockShared
RtlPublishWnfStateData
RtlUpcaseUnicodeChar
NtUpdateWnfStateData
RtlDosPathNameToNtPathName_U_WithStatus
RtlCreateSystemVolumeInformationFolder
RtlDoesFileExists_U
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
NtSetInformationToken
RtlCopyUnicodeString
RtlQueryPackageClaims
RtlImageNtHeader
RtlCompareUnicodeString
RtlEnterCriticalSection
NtReadFile
NtQueryObject
RtlReleaseResource
RtlAcquireResourceExclusive
NtQueryWnfStateData
NtSetInformationThread
NtOpenThreadToken
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAceEx
RtlLengthSid
RtlSubAuthoritySid
RtlInitializeSid
RtlLengthRequiredSid
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlFreeUnicodeString
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
NtFlushBuffersFile
NtQueryVolumeInformationFile
ZwQueryWnfStateData
NtWriteFile
RtlGetDaclSecurityDescriptor
NtSetInformationFile
NtFsControlFile
NtQueryInformationFile
RtlFreeHeap
NtCreateFile
RtlDosPathNameToNtPathName_U
RtlInitUnicodeString
RtlEqualSid
RtlNtStatusToDosError
RtlDllShutdownInProgress
RtlUnsubscribeWnfStateChangeNotification
NtQuerySecurityAttributesToken
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlSubscribeWnfStateChangeNotification
RtlConvertSidToUnicodeString
RtlValidSid
NtQueryInformationToken
RtlInitializeSRWLock
RtlCopySid
RtlDeleteResource
RtlIsMultiSessionSku
RtlDeleteCriticalSection
RtlInitializeCriticalSection
RtlIsCloudFilesPlaceholder
RtlInitializeResource
RtlAcquireResourceShared
NtQuerySystemTime
NtClose
ZwQueryInformationToken
ZwOpenThreadTokenEx
ZwClose
ZwOpenProcessTokenEx
ZwQueryInformationProcess
RtlQueryWnfStateData
RtlLeaveCriticalSection

iertutil

CreateUri

api-ms-win-service-private-l1-1-0

I_QueryTagInformation

api-ms-win-core-memory-l1-1-1

SetProcessWorkingSetSizeEx
GetProcessWorkingSetSizeEx
VirtualLock
VirtualUnlock

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

EdpDllAllowFileAccessForProcess
EdpDllCredSvcControl
EdpDllCredentialCreate
EdpDllCredentialDelete
EdpDllCredentialExists
EdpDllCredentialQuery
EdpDllDplUpgradePinInfo
EdpDllDplUpgradeVerifyUser
EdpDllDplUserCredentialsSet
EdpDllDplUserUnlockComplete
EdpDllDplUserUnlockStart
EdpDllGetCredServiceState
EdpDllGetLockSessionUnwrappedKey
EdpDllGetLockSessionWrappedKey
EdpDllGetTfaCache
EdpDllPurgeAppLearningEvents
EdpDllQueryDplEnforcedPolicyOwnerIds
EdpDllQueryRevokedPolicyOwnerIds
EdpDllQueueFileForEncryption
EdpDllRmsClearKeys
EdpDllRmsContainerizeFile
EdpDllRmsDecontainerizeFile
EdpDllRmsGetContainerIdentity
EdpDllServiceFileEncryptionQueue
EdpWriteAppLearningLog
EdpWriteSiteLearningLog
EfsDllAddUsersToFileSrv
EfsDllAllocateHeap
EfsDllCheckFileAccess
EfsDllCloseFileRaw
EfsDllConstructEFS
EfsDllDecryptFek
EfsDllDecryptFileSrv
EfsDllDisabled
EfsDllDplAppKeyCachingFeatureEnabled
EfsDllDuplicateEncryptionInfoFileSrv
EfsDllEncryptFileSrv
EfsDllErrorToNtStatus
EfsDllFileKeyInfoSrv
EfsDllFreeHeap
EfsDllFreeUserInfo
EfsDllGetLocalFileName
EfsDllGetLogFile
EfsDllGetUserInfo
EfsDllGetVolumeRoot
EfsDllIsConsumerProtectionEnforced
EfsDllIsNonEfsSKU
EfsDllLoadUserProfile
EfsDllMarkFileForDelete
EfsDllOefsAcquireExclusiveOperation
EfsDllOefsCheckSupportByFilePath
EfsDllOefsReleaseExclusiveOperation
EfsDllOnSessionChange
EfsDllOnSessionUserChange
EfsDllOpenFileRaw
EfsDllQueryProtectorsSrv
EfsDllQueryRecoveryAgentsSrv
EfsDllQueryUsersOnFileSrv
EfsDllReadFileRaw
EfsDllRemoveUsersFromFileSrv
EfsDllReprotectFile
EfsDllSetFileEncryptionKeySrv
EfsDllShareDecline
EfsDllSsoFlushUserCache
EfsDllUnloadUserProfile
EfsDllUsePinForEncryptedFilesSrv
EfsDllValidateEfsStream
EfsDllWriteEncryptedFileWithHeader
EfsDllWriteFileRaw
EfsInitialize
EfsProcessRecoveryPolicy
EfsUnInitialize
EfsValidateEfsStream

Sections

.text
Size: 936KB - Virtual size: 932KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 200KB - Virtual size: 197KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
efsext.dll
.dll windows:10 windows x64 arch:x64

991e0c6b2e42067a5caaef41a508d76d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

efsext.pdb

Imports

msvcrt

memcpy
__CxxFrameHandler3
??1type_info@@UEAA@XZ
_onexit
__dllonexit
__CxxFrameHandler4
_lock
?terminate@@YAXXZ
__C_specific_handler
_initterm
malloc
_amsg_exit
_XcptFilter
free
_purecall
wcsncmp
_CxxThrowException
??0exception@@QEAA@XZ
_vsnprintf_s
memcpy_s
_vsnwprintf
??0exception@@QEAA@AEBV0@@Z
_callnewh
wcschr
??1exception@@UEAA@XZ
_unlock
memset

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolQueueTask

shell32

ShellExecuteW
ord916
ShellExecuteExW
ord155
SHChangeNotifySuspendResume
ord190

dui70

?GetClassInfoPtr@TouchCheckBox@DirectUI@@SAPEAUIClassInfo@2@XZ
?GetClassInfoPtr@TouchHyperLink@DirectUI@@SAPEAUIClassInfo@2@XZ
UnInitProcessPriv
InitProcessPriv
?VisibleProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?SetValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@@Z
?CreateBool@Value@DirectUI@@SAPEAV12@_N@Z
?_ZeroRelease@Value@DirectUI@@AEAAXXZ
InitThread
?GetCheckedState@TouchCheckBox@DirectUI@@QEAA?AW4CheckedStateFlags@2@XZ
?MultipleClick@TouchButton@DirectUI@@SA?AVUID@@XZ
?Click@TouchButton@DirectUI@@SA?AVUID@@XZ
?AddListener@Element@DirectUI@@QEAAJPEAUIElementListener@2@@Z
?CreateElement@DUIXmlParser@DirectUI@@QEAAJPEBGPEAVElement@2@1PEAKPEAPEAV32@@Z
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJIPEAUHINSTANCE__@@0@Z
?Create@DUIXmlParser@DirectUI@@SAJPEAPEAV12@P6APEAVValue@2@PEBGPEAX@Z2P6AX11H2@Z2@Z
?Destroy@DUIXmlParser@DirectUI@@QEAAXXZ
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z
UnInitThread
StrToID

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentThreadId
OpenThreadToken
OpenProcessToken
CreateProcessAsUserW
GetCurrentProcessId
TerminateProcess
GetCurrentThread

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetModuleFileNameA
LoadResource
GetModuleHandleW
LockResource
GetProcAddress
LoadStringW
FindResourceExW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter

api-ms-win-core-synch-l1-1-0

OpenSemaphoreW
WaitForSingleObject
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CreateMutexExW
WaitForSingleObjectEx
ReleaseMutex
ReleaseSemaphore
SetEvent
CreateEventW
CreateSemaphoreExW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoTaskMemAlloc
CoGetMalloc
CoCreateFreeThreadedMarshaler
CoTaskMemRealloc
CoCreateInstance
CoInitializeEx
CoUninitialize

api-ms-win-security-base-l1-1-0

DuplicateTokenEx
EqualSid
AllocateAndInitializeSid
FreeSid
GetTokenInformation

crypt32

CryptBinaryToStringW
CryptStringToBinaryA

api-ms-win-security-credentials-l1-1-0

CredUnprotectW

rpcrt4

RpcImpersonateClient
RpcRevertToSelf
NdrClientCall3
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcBindingSetAuthInfoExW
RpcStringFreeW
RpcBindingFree

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventSetInformation
EventWriteTransfer

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegOpenCurrentUser

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemWindowsDirectoryW
GetSystemTimeAsFileTime

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW
RegDeleteKeyValueW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage

api-ms-win-service-management-l1-1-0

CloseServiceHandle
OpenServiceW
StartServiceW
OpenSCManagerW

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

api-ms-win-appmodel-runtime-l1-1-0

ClosePackageInfo
GetPackageFullName
GetPackageFamilyName
GetCurrentPackageInfo
GetPackageInfo
OpenPackageInfoByFullName

ntdll

RtlFreeHeap
NtQueryInformationToken
RtlInitUnicodeString
RtlAllocateHeap
RtlNtStatusToDosErrorNoTeb
RtlCompareUnicodeString

user32

MsgWaitForMultipleObjects

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

EdpPlatform_QueryUserSessionState
EdpPlatform_RegisterUserSessionNotification
EdpPlatform_ShowDialog
EdpPlatform_ShowUI
EdpPlatform_UnregisterUserSessionNotification
EfsPlatform_GetCallerID
EfsPlatform_IsCallerAutomaticallyDelegated
EfsPlatform_LaunchPromptUI
EfsPlatform_SuspendNotificationsAndEncryptFile
EfsPlatform_UnpackSecurePin
FVE_LaunchConsentPromptUI
FVE_LaunchSDCardUI

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 428B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
efslsaext.dll
.dll windows:10 windows x64 arch:x64

c36f4de38a219e4430089ef28ca195bb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

efslsaext.pdb

Imports

msvcrt

_lock
__C_specific_handler
_initterm
malloc
free
_amsg_exit
_onexit
memcpy_s
??3@YAXPEAX@Z
memcmp
__dllonexit
memcpy
_wcsicmp
_vsnwprintf
_unlock
_XcptFilter
_wcsnicmp
memset

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleExA
GetModuleHandleExW
GetModuleFileNameA
GetModuleHandleW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

SetThreadToken
GetCurrentProcessId
GetCurrentThreadId
OpenThreadToken
TerminateProcess
GetCurrentThread
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
WaitForSingleObjectEx
OpenSemaphoreW
ReleaseMutex
SleepEx
AcquireSRWLockExclusive
CreateSemaphoreExW
CreateMutexExW
ReleaseSRWLockExclusive
ReleaseSemaphore

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolTimer

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventWriteTransfer
EventRegister
EventUnregister

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceComplete
InitOnceBeginInitialize

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetComputerNameExW
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-string-l1-1-0

CompareStringW

ntdll

RtlQueryPackageClaims
EtwEventUnregister
NtReadFile
NtFsControlFile
RtlDosPathNameToNtPathName_U
NtQueryVolumeInformationFile
RtlInitUnicodeString
NtClose
NtQueryInformationFile
NtCreateFile
EtwEventRegister
NtWriteFile
RtlFreeHeap
RtlAllocateHeap
RtlNtStatusToDosError
EtwEventEnabled
RtlLengthSid
RtlValidSid
EtwEventWrite

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-file-l1-1-0

RemoveDirectoryW
DeleteFileW
GetVolumePathNameW
GetVolumeInformationByHandleW
CreateFileW
GetDriveTypeW
GetFinalPathNameByHandleW
GetFileAttributesW

api-ms-win-core-memory-l1-1-0

VirtualAlloc
VirtualFree

api-ms-win-security-base-l1-1-0

AdjustTokenPrivileges
RevertToSelf

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

Exports

Exports

InitializeLsaExtension

Sections

.text
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
efssvc.dll
.dll windows:10 windows x64 arch:x64

69a215f8a09b5674114c808a4a9bbf40

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

efssvc.pdb

Imports

msvcrt

_vsnwprintf
memcpy_s
memset
_wcsicmp
memcpy
_onexit
__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
free
_callnewh
malloc

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
GetProcAddress
GetModuleHandleW
FreeLibrary
GetModuleHandleExW
LoadLibraryExA

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-service-core-l1-1-0

SetServiceStatus
RegisterServiceCtrlHandlerExW

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
GetLastError

api-ms-win-core-synch-l1-1-0

SetEvent
CreateMutexExW
WaitForSingleObject
CreateSemaphoreExW
ReleaseSemaphore
ReleaseMutex
WaitForSingleObjectEx
AcquireSRWLockExclusive
OpenSemaphoreW
CreateEventW
ReleaseSRWLockExclusive

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-registry-l1-1-0

RegGetValueW

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-heap-l2-1-0

LocalFree

rpcrt4

RpcRaiseException
RpcImpersonateClient
RpcServerInqCallAttributesW
RpcStringFreeW
I_RpcBindingIsClientLocal
RpcBindingToStringBindingW
I_RpcOpenClientProcess
NdrServerCall2
NdrServerCallAll
RpcRevertToSelf
RpcBindingInqAuthClientW
RpcServerInterfaceGroupActivate
RpcServerInterfaceGroupCreateW
RpcServerRegisterAuthInfoW
RpcStringBindingParseW
RpcServerInterfaceGroupClose

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-security-base-l1-1-0

CreateWellKnownSid
CheckTokenMembership
GetTokenInformation
GetSidSubAuthorityCount
IsWellKnownSid
GetSidSubAuthority

api-ms-win-core-synch-l1-2-0

InitOnceComplete
Sleep
InitOnceBeginInitialize

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetCurrentThreadId
OpenProcessToken
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemInfo
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-file-l1-1-0

GetFileAttributesW
CreateFileW

ntdll

NtQueryInformationToken
RtlAllocateHeap
RtlFreeHeap
RtlValidRelativeSecurityDescriptor
RtlValidSid
EtwEventWrite
EtwEventEnabled
EtwEventUnregister
EtwEventRegister
NtSetEvent
NtOpenEvent
NtCreateEvent
NtQueryVolumeInformationFile
RtlInitUnicodeString
RtlNtStatusToDosError
NtClearEvent
NtClose
NtOpenThreadToken

api-ms-win-core-memory-l1-1-0

VirtualProtect
VirtualQuery

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventWriteTransfer
EventUnregister
EventRegister

api-ms-win-core-featurestaging-l1-1-0

UnsubscribeFeatureStateChangeNotification
SubscribeFeatureStateChangeNotification
RecordFeatureUsage
GetFeatureEnabledState

Exports

Exports

EfsServiceMain

Sections

.text
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 632B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
efsutil.dll
.dll windows:10 windows x64 arch:x64

2373e3569135a63081a8ea11ad9df3e2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

efsutil.pdb

Imports

msvcrt

__C_specific_handler
free
strcmp
_amsg_exit
malloc
_initterm
_XcptFilter
memset
memcpy
memcmp
wcscmp

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleExA

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

crypt32

CertCreateCertificateContext
CryptImportPublicKeyInfoEx2
CertGetEnhancedKeyUsage
CryptAcquireCertificatePrivateKey
CertVerifyTimeValidity
CertCompareCertificateName
CertFreeCertificateContext
CertOpenStore
CertGetNameStringW
CryptDecodeObject
CertFindExtension
CertFindCertificateInStore
CertDeleteCertificateFromStore
CertSetCertificateContextProperty
CertCreateSelfSignCertificate
CertGetIntendedKeyUsage
CertStrToNameW
CertAddCertificateContextToStore
CryptEncodeObject
CertGetCertificateContextProperty
CertCloseStore

api-ms-win-core-errorhandling-l1-1-0

SetLastError
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

ncrypt

NCryptOpenStorageProvider
NCryptGetProperty
NCryptFreeObject
NCryptDeleteKey
NCryptFinalizeKey
NCryptCreatePersistedKey
NCryptSetProperty

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegOpenKeyExW
RegGetValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW

bcrypt

BCryptGetProperty
BCryptDestroyKey

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-sysinfo-l1-1-0

GetSystemTime
GetSystemInfo
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
OpenThreadToken
GetCurrentThread
OpenProcessToken
GetCurrentProcess
SetThreadStackGuarantee
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-security-base-l1-1-0

DuplicateToken
GetTokenInformation
IsValidSid
GetLengthSid

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-core-handle-l1-1-0

CloseHandle

dsrole

DsRoleFreeMemory
DsRoleGetPrimaryDomainInformation

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

ntdll

EtwEventEnabled
EtwEventWrite
RtlImageNtHeader
RtlInitUnicodeString
RtlNtStatusToDosError
RtlUnicodeStringToAnsiString

api-ms-win-core-memory-l1-1-0

VirtualProtect
VirtualQuery
VirtualAlloc

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

EfsUtilApplyGroupPolicy
EfsUtilCheckCurrentKeyCapabilities
EfsUtilCreateSelfSignedCertificate
EfsUtilFreeParsedRecoveryPolicy
EfsUtilGetCertContextFromCertHash
EfsUtilGetCertDisplayInformation
EfsUtilGetCertNameFromCertContext
EfsUtilGetCurrentKey
EfsUtilGetCurrentKey_Deprecated
EfsUtilGetCurrentUserInformation
EfsUtilGetProvider
EfsUtilGetPublicKeyType
EfsUtilGetSmartcardProviderName
EfsUtilGetUserKey
EfsUtilIsSmartcardKey
EfsUtilIsSmartcardProvider
EfsUtilParseDataRecoveryPolicy_1_1
EfsUtilReleaseProvider
EfsUtilReleaseUserKey
EfsUtilSetCurrentKey
EfsUtilSetSmartcardPin
EfsUtilSmartcardCredsNeededError

Sections

.text
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
efswrt.dll
.dll windows:10 windows x64 arch:x64

417f3f511d236978a21895ad100d2ba3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

efswrt.pdb

Imports

msvcrt

??0exception@@QEAA@AEBQEBD@Z
_CxxThrowException
memcmp
??0exception@@QEAA@AEBQEBDH@Z
?what@exception@@UEBAPEBDXZ
_onexit
_callnewh
malloc
__CxxFrameHandler3
memcpy
??1type_info@@UEAA@XZ
wcsrchr
_ui64tow_s
_purecall
__C_specific_handler
qsort
_wcsicmp
memmove
_vsnprintf_s
memset
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
_XcptFilter
??3@YAXPEAX@Z
_amsg_exit
free
__CxxFrameHandler4
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
memcpy_s
memmove_s
wcstoul
wcschr
wcsnlen
wcsstr
wcsncmp
_wcsnicmp
iswalpha
_vsnwprintf
_initterm
??_V@YAXPEAX@Z
realloc
wcstok_s
wcscpy_s
wcscmp

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
LoadLibraryExW
FindStringOrdinal
GetModuleHandleW
FreeLibrary
GetProcAddress
LoadStringW
GetModuleHandleExW
GetModuleHandleExA
GetModuleFileNameW
DisableThreadLibraryCalls

api-ms-win-core-synch-l1-2-0

InitOnceComplete
Sleep
InitOnceExecuteOnce
WakeAllConditionVariable
SleepConditionVariableSRW
WakeByAddressAll
InitOnceBeginInitialize
WaitOnAddress

api-ms-win-core-synch-l1-1-0

OpenSemaphoreW
TryAcquireSRWLockShared
WaitForSingleObject
CreateMutexExW
TryEnterCriticalSection
WaitForSingleObjectEx
DeleteCriticalSection
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
InitializeCriticalSectionEx
LeaveCriticalSection
TryAcquireSRWLockExclusive
CreateEventExW
InitializeSRWLock
CreateMutexW
CreateSemaphoreExW
InitializeCriticalSection
SetEvent
ReleaseSRWLockExclusive
EnterCriticalSection
ReleaseSemaphore
ReleaseMutex

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
RaiseException
SetLastError

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsGetStringRawBuffer
WindowsCreateStringReference
WindowsCreateString
HSTRING_UserSize64
HSTRING_UserFree64
WindowsGetStringLen
WindowsDuplicateString
HSTRING_UserMarshal64
HSTRING_UserUnmarshal
HSTRING_UserUnmarshal64
HSTRING_UserMarshal
HSTRING_UserSize
HSTRING_UserFree

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-eventing-classicprovider-l1-1-0

RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids
GetTraceEnableFlags
TraceMessage

api-ms-win-core-processthreads-l1-1-0

OpenThreadToken
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
OpenProcessToken
GetCurrentThreadId
GetProcessId
GetCurrentThread

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo
RoOriginateErrorW
GetRestrictedErrorInfo
RoOriginateError
RoTransformError

api-ms-win-core-localization-l1-2-0

FormatMessageW
IdnToAscii

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl
EventRegister
EventWriteTransfer
EventSetInformation
EventUnregister

api-ms-win-security-base-l1-1-0

CopySid
GetSidSubAuthority
GetSidSubAuthorityCount
GetLengthSid
GetAce
GetTokenInformation
RevertToSelf
EqualSid
ImpersonateLoggedOnUser

api-ms-win-core-com-l1-1-0

CoWaitForMultipleHandles
CoGetApartmentType
CoGetCallContext
CoGetCallerTID
CoCreateInstance
CoTaskMemRealloc
CoIncrementMTAUsage
CoDecrementMTAUsage
CoGetInterfaceAndReleaseStream
CoMarshalInterface
CoTaskMemAlloc
CoMarshalInterThreadInterfaceInStream
CoCreateFreeThreadedMarshaler
CoReleaseMarshalData
CoTaskMemFree
CreateStreamOnHGlobal

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegOpenKeyExW
RegGetValueW
RegCreateKeyExW
RegNotifyChangeKeyValue
RegCloseKey
RegOpenCurrentUser

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolWaitCallbacks
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CloseThreadpoolWait
CreateThreadpoolWork
CreateThreadpoolWait
CloseThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolWait
SubmitThreadpoolWork
FreeLibraryWhenCallbackReturns

api-ms-win-core-file-l1-1-0

GetFileAttributesW
FindNextFileW
CreateFileW
FindFirstFileW
GetLongPathNameW
GetDriveTypeW
GetFullPathNameW
GetVolumePathNameW
FindClose

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoInitialize
RoUninitialize

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled
RoReportFailedDelegate

api-ms-win-core-processthreads-l1-1-1

GetProcessMitigationPolicy
OpenProcess

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-path-l1-1-0

PathCchSkipRoot
PathIsUNCEx
PathCchRemoveFileSpec

api-ms-win-core-file-l1-2-0

GetVolumeNameForVolumeMountPointW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindExtensionW

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrStrIW

api-ms-win-core-marshal-l1-1-0

HWND_UserSize64
HWND_UserSize
HWND_UserUnmarshal
HWND_UserFree64
HWND_UserFree
HWND_UserMarshal
HWND_UserMarshal64
HWND_UserUnmarshal64

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-url-l1-1-0

UrlGetPartW

combase

ord148
ord90
ord157

ntdll

NtOpenFile
NtOpenThreadToken
NtDuplicateObject
NtClose
NtDeviceIoControlFile
NtSetInformationThread
NtDuplicateToken
NtOpenProcessToken
RtlCompareMemory
NtQuerySecurityAttributesToken
RtlFreeHeap
RtlCopyUnicodeString
RtlAllocateHeap
RtlCompareUnicodeString
RtlQueryPackageClaims
RtlNtStatusToDosError
NtFsControlFile
RtlGetDaclSecurityDescriptor
NtQuerySecurityObject
RtlCreateSecurityDescriptor
ZwQueryWnfStateData
RtlAddAccessAllowedAce
RtlLengthSid
RtlAddAce
NtSetSecurityObject
RtlQueryInformationAcl
RtlGetAce
RtlSetDaclSecurityDescriptor
RtlInitUnicodeString
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlIsMultiSessionSku
NtQueryWnfStateData
RtlPublishWnfStateData
ZwQueryInformationToken
RtlConvertSidToUnicodeString
ZwOpenThreadTokenEx
ZwClose
ZwOpenProcessTokenEx
ZwQueryInformationProcess
RtlFreeUnicodeString
RtlSubscribeWnfStateChangeNotification
RtlCreateAcl

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

CdplGetFileProtectionLevel
CdplGetFileProtectionLevelAndUser
CdplIsAppAllowedToRun
CdplIsAppDataProtectionSupported
CdplIsSupported
CdplProtectFileToLevel
CdplProtectFileToLevelWithResult
CdplProtectKnownUserFolders
CdplProtectSecretToLevel
CdplSetIsPolicyEnabledForCurrentUser
CdplSetIsPolicyEnabledForUser
CdplUnprotectSecret
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DpmBufferFree
DpmProtectSecretToIdentity
DpmStreamClose
DpmStreamOpenToProtectToIdentity
DpmStreamOpenToUnprotect
DpmStreamUpdate
DpmUnprotectSecret
EnterpriseDataCopyProtection
EnterpriseDataGetStatus
EnterpriseDataProtect
EnterpriseDataRevoke
FreeIdentityProtectorList
GetEnterpriseActionForCopy
GetEnterpriseIdForNetworkPath
ProtectFileToEnterpriseIdentity
ProtectFileToIdentity
ProtectOrReprotectFileToIdentity
QueryIdentityProtectors
UnprotectFile

Sections

.text
Size: 524KB - Virtual size: 522KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 232KB - Virtual size: 229KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
els.dll
.dll regsvr32 windows:10 windows x64 arch:x64

14794d4f4bf5be539f984653c7d6d01c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

els.pdb

Imports

msvcrt

_ultow
_itow
wcsrchr
_snwprintf_s
wcscat_s
__CxxFrameHandler4
qsort
_wcslwr
wcsspn
_vsnwprintf_s
towlower
malloc
swprintf_s
wcschr
_wcsupr
wcsncpy_s
_wcsicmp
_vsnwprintf
__C_specific_handler
wcsncmp
wcspbrk
wcsstr
_wcsnicmp
??0exception@@QEAA@AEBQEBDH@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
_CxxThrowException
__CxxFrameHandler3
memcpy
memmove
_XcptFilter
_amsg_exit
_initterm
_lock
_unlock
__dllonexit
_onexit
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
??_V@YAXPEAX@Z
_purecall
??3@YAXPEAX@Z
wcstoul
??0exception@@QEAA@AEBV0@@Z
_callnewh
free
wcscpy_s
??0exception@@QEAA@AEBQEBD@Z
memset

ntdll

RtlSecondsSince1970ToTime
RtlLengthSid
RtlTimeToSecondsSince1970
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

advapi32

RegDeleteValueW
RegDeleteKeyW
RegConnectRegistryW
RegCreateKeyExW
IsValidSid
ReadEventLogW
OpenEventLogW
OpenBackupEventLogW
GetOldestEventLogRecord
RegEnumKeyExW
CloseEventLog
ClearEventLogW
BackupEventLogW
ConvertStringSidToSidW
GetLengthSid
LookupAccountSidW
RegCloseKey
RegOpenKeyExW
RegGetValueW
RegQueryValueExW
RegSetValueExW
GetNumberOfEventLogRecords
EqualSid

kernel32

CreateFileW
GetSystemDirectoryW
SystemTimeToFileTime
CreateThread
GetLocalTime
GetWindowsDirectoryW
WideCharToMultiByte
HeapFree
GetProcessHeap
HeapAlloc
GetTimeZoneInformation
DisableThreadLibraryCalls
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetCommandLineW
LocalFileTimeToFileTime
GetCurrentThreadId
GetComputerNameW
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
DeleteFileW
GetFileAttributesExW
WriteFile
GetFileSize
GetDateFormatW
GetDriveTypeW
GetTimeFormatW
FileTimeToLocalFileTime
InitializeCriticalSection
FileTimeToSystemTime
CloseHandle
LoadLibraryExW
GetLastError
lstrcmpiW
lstrlenW
LocalFree
lstrcmpW
ExpandEnvironmentStringsW
FormatMessageW
FreeLibrary
SetLastError
DeactivateActCtx
LoadLibraryW
GetProcAddress
ActivateActCtx
FindActCtxSectionStringW
CreateActCtxW
GetModuleFileNameW
GetModuleHandleExW
QueryActCtxW
OutputDebugStringA
GlobalFree
GetSystemWindowsDirectoryW
GlobalAlloc
GlobalLock
GlobalUnlock
GetLocaleInfoW
LocalAlloc
GetTickCount

user32

DestroyWindow
EnumThreadWindows
GetClassNameW
IsWindowEnabled
WinHelpW
DefWindowProcW
CreateWindowExW
RegisterClassW
LoadStringW
GetDlgItemInt
SetDlgItemInt
GetWindowTextLengthW
PostQuitMessage
CheckDlgButton
DispatchMessageW
TranslateMessage
IsDialogMessageW
GetMessageW
GetWindow
CharLowerBuffW
LoadIconW
LoadBitmapW
LoadImageW
SetForegroundWindow
RegisterClipboardFormatW
SendMessageW
GetDlgItem
SetWindowPos
GetParent
FindWindowExW
SetWindowLongPtrW
GetWindowTextW
SetWindowTextW
GetDlgItemTextW
LoadCursorW
SetCursor
DestroyIcon
GetSysColor
CheckRadioButton
GetWindowRect
GetDC
ReleaseDC
GetSystemMetrics
EnableWindow
PostMessageW
OpenClipboard
EmptyClipboard
EndDialog
SetClipboardData
CloseClipboard
ShowWindow
SetDlgItemTextW
GetFocus
SetFocus
MessageBoxW
DialogBoxParamW
CreateDialogParamW
GetWindowLongPtrW
IsDlgButtonChecked
GetClientRect

gdi32

GetObjectW
GetTextMetricsW
SetMapMode
GetMapMode
DeleteObject
CreateFontIndirectW

ole32

CoGetInterfaceAndReleaseStream
CreateStreamOnHGlobal
CoTaskMemAlloc
CoMarshalInterThreadInterfaceInStream
IIDFromString
CoInitialize
ReleaseStgMedium
CoCreateInstance
CoUninitialize

rpcrt4

NdrOleAllocate
NdrOleFree
NdrDllCanUnloadNow
NdrDllGetClassObject

netutils

NetpwNameValidate
NetpwNameCanonicalize
NetApiBufferFree

dsrole

DsRoleGetPrimaryDomainInformation
DsRoleFreeMemory

logoncli

DsGetDcNameW

srvcli

NetShareGetInfo

wkscli

NetWkstaGetInfo

shlwapi

wnsprintfW
PathCombineW
PathRemoveBlanksW

shell32

CommandLineToArgvW
ShellExecuteW

ntdsapi

DsCrackNamesW
DsFreeSchemaGuidMapW
DsMapSchemaGuidsW
DsFreeNameResultW
DsUnBindW
DsBindW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

activeds

ord20
ord9
ord15

mpr

WNetGetUniversalNameW

wintrust

WTGetSignatureInfo

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 160KB - Virtual size: 157KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
elsTrans.dll
.dll windows:10 windows x64 arch:x64

2b6f9afadff17e3d1de36577203c0635

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

elstrans.pdb

Imports

msvcrt

memcpy_s
_initterm
malloc
free
_amsg_exit
_XcptFilter
wcscpy_s
_wcsicmp
__C_specific_handler
memcmp

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
DisableThreadLibraryCalls
GetModuleHandleW
GetModuleFileNameW

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentProcess
TerminateProcess
TlsFree
TlsGetValue
GetCurrentThreadId
TlsSetValue
TlsAlloc

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegOpenKeyExW
RegLoadMUIStringW
RegCloseKey

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW
GetSystemTimeAsFileTime
GetTickCount
GetSystemWindowsDirectoryW

api-ms-win-core-file-l1-1-0

FindClose
FindFirstFileW
GetFileSize
CreateFileW
ReadFile

api-ms-win-core-memory-l1-1-0

CreateFileMappingW
MapViewOfFile
UnmapViewOfFile

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-localization-l1-2-0

LCMapStringW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-registry-l2-1-0

RegEnumKeyW

ntdll

RtlGUIDFromString
RtlInitUnicodeString

api-ms-win-core-wow64-l1-1-1

GetSystemWow64DirectoryW

api-ms-win-core-wow64-l1-1-0

IsWow64Process

Exports

Exports

DoAction
EnumServices
FreePropertyBag
FreeService
InitService
RecognizeText

Sections

.text
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
elshyph.dll
.dll windows:10 windows x64 arch:x64

a32be4ef95d1eeb1858bc3c7720cc13f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

elshyph.pdb

Imports

msvcrt

__CxxFrameHandler4
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UEAA@XZ
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
??0exception@@QEAA@XZ
__CxxFrameHandler3
memset
_callnewh
??0exception@@QEAA@AEBQEBDH@Z
free
realloc
malloc
_purecall
??_V@YAXPEAX@Z
??0exception@@QEAA@AEBQEBD@Z
memmove
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBV0@@Z
??3@YAXPEAX@Z
??1exception@@UEAA@XZ
memcpy
_CxxThrowException
memcmp
wcscmp

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

kernel32

GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
Sleep
TerminateProcess
AcquireSRWLockExclusive
GetSystemWindowsDirectoryW
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
InitializeSRWLock
CompareStringOrdinal
MapViewOfFile
CreateFileMappingW
GetLastError
CreateFileW
CloseHandle
UnmapViewOfFile
DisableThreadLibraryCalls
LocalFree

advapi32

EventRegister
EventUnregister
EventWriteTransfer

shlwapi

PathAppendW

bcp47langs

GetClosestMatchingUserLanguage

Exports

Exports

DoAction
FreePropertyBag
FreeService
InitService
RecognizeText

Sections

.text
Size: 60KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
elslad.dll
.dll windows:10 windows x64 arch:x64

f9ee4c01b78702d81f20b7dfc5e90a0b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

elslad.pdb

Imports

msvcrt

_lock
_unlock
??0exception@@QEAA@AEBQEBD@Z
__C_specific_handler
_initterm
free
__dllonexit
memcpy_s
_callnewh
??0exception@@QEAA@AEBQEBDH@Z
_onexit
_XcptFilter
malloc
_purecall
??3@YAXPEAX@Z
memmove
memcpy
__CxxFrameHandler4
__CxxFrameHandler3
??1type_info@@UEAA@XZ
memset
qsort
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
_amsg_exit
??0exception@@QEAA@AEBV0@@Z
wcscmp

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
HeapReAlloc
GetProcessHeap

api-ms-win-core-localization-l1-2-0

LCMapStringW

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsDeleteString
WindowsGetStringRawBuffer

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
RaiseException
UnhandledExceptionFilter

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

bcp47langs

Bcp47GetDistance
GetUserLanguages

Exports

Exports

DoAction
FreePropertyBag
FreeService
InitService
RecognizeText

Sections

.text
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 628KB - Virtual size: 627KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
embeddedmodesvc.dll
.dll windows:10 windows x64 arch:x64

bd8c35dc7c32da37252dbf5be4716a25

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

embeddedmodesvc.pdb

Imports

msvcp_win

?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__crt_atexit
_o_free
_o_malloc
_o_powf
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__configure_narrow_argv
__std_terminate
__CxxFrameHandler4
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
GetModuleFileNameA

api-ms-win-core-synch-l1-1-0

SetEvent
CreateMutexExW
CreateEventW
InitializeCriticalSectionEx
DeleteCriticalSection
AcquireSRWLockShared
WaitForSingleObjectEx
CreateEventExW
ReleaseSRWLockExclusive
ReleaseSRWLockShared
ReleaseMutex
AcquireSRWLockExclusive
WaitForSingleObject
OpenSemaphoreW
ReleaseSemaphore
ResetEvent
LeaveCriticalSection
CreateSemaphoreExW
EnterCriticalSection
WaitForMultipleObjectsEx
SetWaitableTimerEx
CreateWaitableTimerExW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
RaiseException
SetLastError
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

ProcessIdToSessionId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
CreateThread
GetCurrentThreadId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventRegister
EventActivityIdControl
EventWriteTransfer
EventUnregister

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
InitOnceComplete
InitOnceBeginInitialize

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-service-core-l1-1-0

SetServiceStatus
RegisterServiceCtrlHandlerExW

api-ms-win-service-management-l2-1-0

ChangeServiceConfig2W
QueryServiceConfig2W
ChangeServiceConfigW
QueryServiceConfigW

api-ms-win-service-management-l1-1-0

OpenSCManagerW
OpenServiceW

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
CoTaskMemFree
CoInitializeEx
CoUninitialize

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

rpcrt4

RpcEpUnregister
RpcServerUnregisterIfEx
NdrServerCall2
RpcBindingVectorFree
RpcServerRegisterIf3
RpcServerInqBindings
RpcEpRegisterW
NdrServerCallAll
RpcServerInqCallAttributesW
RpcServerUseProtseqW

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegEnumValueW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegGetValueW
RegQueryInfoKeyW
RegFlushKey

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoInitialize
RoUninitialize

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount64

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

ntdll

RtlLengthSid
RtlCopySid
RtlSubscribeWnfStateChangeNotification
NtQueryWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion

ondemandbrokerclient

CreateOnDemandBrokerClient

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-core-registry-l1-1-1

RegDeleteKeyValueW

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsCreateStringReference
WindowsGetStringRawBuffer

api-ms-win-core-sysinfo-l1-2-0

GetSystemFirmwareTable

bcrypt

BCryptHashData
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptFinishHash
BCryptGetProperty
BCryptOpenAlgorithmProvider

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject
ServiceMain

Sections

.text
Size: 104KB - Virtual size: 102KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 668B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
embeddedmodesvcapi.dll
.dll windows:10 windows x64 arch:x64

03a60404fe691877cdb62d5e1b2b6e2e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

embeddedmodesvcapi.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memcpy
_o__cexit
_o_free
_o_malloc
__CxxFrameHandler3
_CxxThrowException
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__C_specific_handler
__std_terminate
__CxxFrameHandler4
memcmp

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
FreeLibrary
GetModuleFileNameA
GetModuleHandleExW
GetModuleHandleW
LoadLibraryExA
DisableThreadLibraryCalls

api-ms-win-core-synch-l1-1-0

WaitForSingleObjectEx
AcquireSRWLockShared
CreateMutexExW
ReleaseSRWLockShared
ReleaseMutex
CreateSemaphoreExW
WaitForSingleObject
OpenSemaphoreW
AcquireSRWLockExclusive
ReleaseSemaphore
ReleaseSRWLockExclusive

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
GetLastError
RaiseException

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentProcess
TerminateProcess
GetCurrentThreadId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError
RoOriginateErrorW

rpcrt4

NdrClientCall3
RpcBindingCreateW
RpcBindingFree
I_RpcExceptionFilter
RpcBindingBind

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceExecuteOnce

api-ms-win-core-winrt-string-l1-1-0

WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsGetStringRawBuffer

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemInfo

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-sysinfo-l1-2-0

GetSystemFirmwareTable

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW

api-ms-win-core-memory-l1-1-0

VirtualProtect
VirtualQuery

Exports

Exports

ActivatePackage
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
IsEmbeddedModeAllowed

Sections

.text
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 320B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
encapi.dll
.dll regsvr32 windows:10 windows x64 arch:x64

5778d880eac3a5f962f3a973cf5455c0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

encapi.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
_o_free
_o_malloc
__C_specific_handler
_o__cexit
_o__callnewh
_o___stdio_common_vsnwprintf_s
_o___std_type_info_destroy_list
memcmp

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
SetEvent
DeleteCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateEventW
CreateEventA
ResetEvent
WaitForSingleObject

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
CoFreeUnusedLibraries
StringFromGUID2
CoTaskMemFree
CoInitializeEx
CoUninitialize
CoCreateInstance
IIDFromString

api-ms-win-core-io-l1-1-0

DeviceIoControl
GetOverlappedResult

oleaut32

SysAllocString
SysStringByteLen
SysFreeString
SysStringLen

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
GetProcAddress
GetModuleHandleW
DisableThreadLibraryCalls

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetVersionExW

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
CreateThread
TerminateProcess

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegEnumKeyExW
RegOpenKeyExW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
energy.dll
.dll windows:10 windows x64 arch:x64

1e0b283717ec142ba98775afbfee8e27

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

energy.pdb

Imports

msvcp_win

?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?clear@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Gninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?_Gndec@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Init@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXXZ
?getloc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?widen@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGD@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?put@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@G@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBGHH@Z
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG0@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?setf@ios_base@std@@QEAAHH@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@_J@Z
?swap@?$basic_ostream@GU?$char_traits@G@std@@@std@@IEAAXAEAV12@@Z
?swap@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXAEAV12@@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
_Mtx_unlock
_Mtx_init_in_situ
_Mtx_lock
_Mtx_destroy_in_situ
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?setf@ios_base@std@@QEAAHHH@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??Bid@locale@std@@QEAA_KXZ
?widen@?$ctype@G@std@@QEBAGD@Z
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?id@?$ctype@G@std@@2V0locale@2@A
?_Xout_of_range@std@@YAXPEBD@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@H@Z
?_Xlength_error@std@@YAXPEBD@Z
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
?good@ios_base@std@@QEBA_NXZ
?flags@ios_base@std@@QEBAHXZ
?width@ios_base@std@@QEBA_JXZ
?_Throw_C_error@std@@YAXH@Z
?width@ios_base@std@@QEAA_J_J@Z
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@K@Z
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGXZ
?_Xbad_alloc@std@@YAXXZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?exceptions@ios_base@std@@QEAAXH@Z
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?_Getcat@?$codecvt@GDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?out@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?in@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@M@Z
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?uncaught_exception@std@@YA_NXZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ

api-ms-win-crt-string-l1-1-0

memset
wcsnlen
__isascii
wcscmp

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e
__doserrno

api-ms-win-crt-private-l1-1-0

memcpy
memcmp
_CxxThrowException
__current_exception_context
__current_exception
__C_specific_handler
_o_wcstoul
__CxxFrameHandler4
__std_terminate
wcsrchr
_o___acrt_iob_func
_o___std_exception_copy
_o___std_exception_destroy
_o___std_type_info_destroy_list
_o___stdio_common_vfwprintf
_o___stdio_common_vfwprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vswprintf_s
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__execute_onexit_table
_o__fseeki64
_o__get_stream_buffer_pointers
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo_noreturn
_o__lock_file
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__unlock_file
_o__wcsicmp
_o__wcsnicmp
_o__wfopen_s
_o_ceilf
_o_fclose
_o_fflush
_o_fgetc
_o_fgetpos
_o_fgetwc
_o_floor
_o_fputc
_o_fputwc
_o_fread
_o_free
_o_fsetpos
_o_fwrite
_o_iswprint
_o_malloc
_o_setvbuf
_o_terminate
_o_ungetc
_o_ungetwc

api-ms-win-core-processtopology-obsolete-l1-1-0

GetActiveProcessorCount

api-ms-win-ole32-ie-l1-1-0

CoInitialize

api-ms-win-core-kernel32-legacy-l1-1-0

GetSystemPowerStatus
FindResourceW

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlCopySid
RtlLengthSid
NtQueryWnfStateData
NtPowerInformation
RtlAdjustPrivilege
RtlNtStatusToDosError
RtlGetPersistedStateLocation
RtlLoadString

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventUnregister
EventSetInformation
EventRegister
EventWrite

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-synch-l1-1-0

WaitForSingleObjectEx
EnterCriticalSection
SetEvent
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
ResetEvent
CreateEventW

api-ms-win-core-file-l1-1-0

GetFileSizeEx
ReadFile
CreateFileW
FindClose
FindNextFileW
FileTimeToLocalFileTime
CompareFileTime
FindFirstFileW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-com-l1-1-0

CoInitializeEx
CoCreateGuid
CoUninitialize
CoTaskMemFree
CoCreateInstance

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime
TzSpecificLocalTimeToSystemTime
SystemTimeToTzSpecificLocalTime

api-ms-win-core-sysinfo-l1-1-0

GetSystemTime
GetComputerNameExW
GetVersionExW
GetSystemTimeAsFileTime

rpcrt4

UuidCreate
UuidHash

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-eventing-consumer-l1-1-0

OpenTraceW
CloseTrace
ProcessTrace

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
DisableThreadLibraryCalls
LoadResource
LockResource
GetModuleHandleW
SizeofResource
GetModuleHandleExA
LoadStringW
LoadLibraryExW
FreeLibrary

api-ms-win-core-heap-l1-1-0

HeapCreate
GetProcessHeap
HeapDestroy
HeapAlloc
HeapFree

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-path-l1-1-0

PathCchAppend
PathCchRemoveBackslash

api-ms-win-power-setting-l1-1-0

PowerGetActiveScheme

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-eventing-controller-l1-1-0

EnableTraceEx2
TraceSetInformation
StartTraceW
ControlTraceW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-eventing-tdh-l1-1-0

TdhUnloadManifest
TdhGetProperty
TdhGetPropertySize
TdhGetEventInformation
TdhGetEventMapInformation

powrprof

PowerEnumerate
PowerReadACValueIndex
PowerReadDCValueIndexEx
PowerEnumerateSettings
PowerReadDCValueIndex
PowerReadACValueIndexEx

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

oleaut32

GetErrorInfo
SysAllocString
SysFreeString
VariantClear

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

Exports

Exports

CreateProvisioningXml
EnergyWizard_Analyze
EnergyWizard_CancelTrace
EnergyWizard_CollectTrace
EnergyWizard_CreateEnergyWizard
EnergyWizard_DefaultTraceDuration
EnergyWizard_DestroyEnergyWizard
EnergyWizard_GetLogEntryCounts
EnergyWizard_SaveReport
EnergyWizard_SqmAnalysis
EnergyWizard_TransformReport
SaveBatteryReport
SaveSleepStudyReport
SaveSystemSleepDiagnosticsReport
SendScreenOnTelemetry
TransformBatteryReport
TransformSleepStudyReport
TransformSystemSleepDiagnosticsReport

Sections

.text
Size: 536KB - Virtual size: 533KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 168KB - Virtual size: 167KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
energyprov.dll
.dll windows:10 windows x64 arch:x64

46f53085b7b64bbc74b8844ba66ed9c7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

energyprov.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__localtime64_s
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsdup
_o_ceilf
_o_free
_o_malloc
_o_terminate
_o_wcscpy_s
_o_wcsftime
_o_wcstoul
_o_wmemcpy_s
__C_specific_handler
__current_exception
__current_exception_context
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o__execute_onexit_table
_o__errno
__CxxFrameHandler4
__std_terminate
wcsrchr
wcsstr
wcschr
__CxxFrameHandler3
_CxxThrowException
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o__crt_atexit
_o___std_exception_copy
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset
wcscmp

ntdll

RtlNtStatusToDosError
RtlRbInsertNodeEx
NtUpdateWnfStateData
RtlGetPersistedStateLocation
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
NtPowerInformation
RtlFreeHeap
RtlAllocateHeap
RtlDowncaseUnicodeString
NtQuerySystemInformation
RtlCrc64
RtlQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlInitUnicodeString
RtlUnsubscribeWnfNotificationWaitForCompletion

api-ms-win-core-synch-l1-1-0

OpenSemaphoreW
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseMutex
ReleaseSemaphore
CancelWaitableTimer
SetWaitableTimerEx
ReleaseSRWLockExclusive
ResetEvent
WaitForSingleObjectEx
InitializeCriticalSection
WaitForSingleObject
SetEvent
CreateEventW
EnterCriticalSection
LeaveCriticalSection
ReleaseSRWLockShared
DeleteCriticalSection
SetWaitableTimer
CreateMutexExW
CreateSemaphoreExW
CreateWaitableTimerExW
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetLastError
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount64
GetSystemTime

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

CreateThread
TerminateProcess
GetCurrentProcess
ResumeThread
GetCurrentThreadId
GetCurrentProcessId
TerminateThread

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExA
GetModuleHandleExW
GetModuleHandleW
LoadResource
LockResource
SizeofResource
FindResourceExW
GetModuleFileNameA
GetProcAddress
DisableThreadLibraryCalls

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

msvcp_win

?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventRegister
EventUnregister
EventSetInformation

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegOpenKeyExW
RegGetValueW
RegQueryValueExW
RegSetValueExW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-file-l1-1-0

CompareFileTime
CreateFileW

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-power-setting-l1-1-0

PowerGetActiveScheme
PowerReadDCValue
PowerSettingRegisterNotification
PowerReadACValue
PowerSettingUnregisterNotification

api-ms-win-power-base-l1-1-0

PowerUnregisterSuspendResumeNotification
PowerRegisterSuspendResumeNotification

api-ms-win-core-com-l1-1-0

CoCreateGuid
CoCreateInstance
CoTaskMemFree

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapSize
HeapReAlloc
HeapDestroy
HeapAlloc

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-synch-l1-2-1

CreateWaitableTimerW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

rpcrt4

NdrClientCall3
RpcExceptionFilter
RpcStringBindingComposeA
RpcBindingFromStringBindingA
RpcStringFreeA
RpcBindingFree
RpcBindingSetAuthInfoA

api-ms-win-eventing-controller-l1-1-0

ControlTraceW
StopTraceW
StartTraceW
EnableTraceEx2

devobj

DevObjDestroyDeviceInfoList
DevObjGetDeviceInterfaceDetail
DevObjEnumDeviceInterfaces
DevObjGetClassDevs
DevObjCreateDeviceInfoList
DevObjCreateClassDeviceInfoList

api-ms-win-shell-shdirectory-l1-1-0

ord290

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

powrprof

PowerReadDCDefaultIndex
PowerSettingAccessCheck
PowerReadACDefaultIndex

Exports

Exports

SruInitializeProvider
SruUninitializeProvider

Sections

.text
Size: 172KB - Virtual size: 168KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 464B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
energytask.dll
.dll regsvr32 windows:10 windows x64 arch:x64

662a03343ed3360adec7223aaaddd20e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

energytask.pdb

Imports

msvcrt

__C_specific_handler
_initterm
_amsg_exit
_vsnwprintf
_XcptFilter
_callnewh
malloc
free
_wcsdup
wcscmp

api-ms-win-core-file-l1-1-0

DeleteFileW
FindNextFileW
CompareFileTime
FindFirstFileW
FindClose

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection
AcquireSRWLockExclusive
LeaveCriticalSection
ReleaseSRWLockExclusive
WaitForSingleObject
DeleteCriticalSection
EnterCriticalSection

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExA
GetModuleHandleExW
DisableThreadLibraryCalls
FreeLibrary
FreeLibraryAndExitThread
GetProcAddress
GetModuleHandleExA

api-ms-win-shell-shdirectory-l1-1-0

ord290

api-ms-win-core-com-l1-1-0

CoTaskMemFree

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
ResumeThread
CreateThread
TerminateProcess

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
RaiseException

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemInfo
GetSystemTimeAsFileTime
GetLocalTime

api-ms-win-core-path-l1-1-0

PathCchAppend

api-ms-win-core-file-l2-1-0

CopyFileExW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

kernelbase

WTSIsServerContainer

energy

EnergyWizard_CollectTrace
EnergyWizard_DestroyEnergyWizard
EnergyWizard_Analyze
EnergyWizard_SaveReport
EnergyWizard_SqmAnalysis
EnergyWizard_CancelTrace
EnergyWizard_CreateEnergyWizard
EnergyWizard_TransformReport

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-registry-l1-1-0

RegGetValueW

api-ms-win-core-memory-l1-1-0

VirtualProtect
VirtualQuery

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 116B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
enrollmentapi.dll
.dll windows:10 windows x64 arch:x64

77659e88f3e64d7f565128b55e3b7d06

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

enrollmentapi.pdb

Imports

msvcp110_win

?_Xbad_alloc@std@@YAXXZ
?_Syserror_map@std@@YAPEBDH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Winerror_map@std@@YAPEBDH@Z

msvcrt

_callnewh
_XcptFilter
_amsg_exit
_initterm
?terminate@@YAXXZ
memcpy
memcmp
_CxxThrowException
_lock
_unlock
__dllonexit
memset
free
malloc
??3@YAXPEAX@Z
__CxxFrameHandler4
__C_specific_handler
_vsnwprintf
memcpy_s
_onexit
_purecall
??1exception@@UEAA@XZ
??0exception@@QEAA@XZ
??0exception@@QEAA@AEBV0@@Z
_vsnprintf_s
??1type_info@@UEAA@XZ
memmove_s

ntdll

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
RtlIsStateSeparationEnabled

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventUnregister
EventRegister

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetModuleFileNameA
GetProcAddress
DisableThreadLibraryCalls
GetModuleHandleW

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockExclusive
CreateSemaphoreExW
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
ReleaseMutex
CreateMutexExW
ReleaseSRWLockShared
ReleaseSemaphore
OpenSemaphoreW
WaitForSingleObjectEx
DeleteCriticalSection

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
SetLastError

oleaut32

VariantClear

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
TerminateProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

dmenrollengine

ord10

Exports

Exports

IsDeviceEnrolled

Sections

.text
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 200B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
enterprisecsps.dll
.dll windows:10 windows x64 arch:x64

0d90977e755011526db298cfbf3c8755

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

enterprisecsps.pdb

Imports

dmenterprisediagnostics

RecordDiagnosticsError

msvcp110_win

??Bios_base@std@@QEBAPEAXXZ
?id@?$codecvt@GDH@std@@2V0locale@2@A
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Winerror_map@std@@YAPEBDH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Orphan_all@_Container_base0@std@@QEAAXXZ
?_Swap_all@_Container_base0@std@@QEAAXAEAU12@@Z
?_Xbad_function_call@std@@YAXXZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Orphan_all@_Container_base12@std@@QEAAXXZ
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_BADOFF@std@@3_JB
?in@?$codecvt@GDH@std@@QEBAHAEAHPEBD1AEAPEBDPEAG3AEAPEAG@Z
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?pbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA_N_N@Z
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ
?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ
?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
??0?$codecvt@GDH@std@@QEAA@_K@Z
??1?$codecvt@GDH@std@@MEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??Bid@locale@std@@QEAA_KXZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
?is@?$ctype@G@std@@QEBA_NFG@Z
?tolower@?$ctype@G@std@@QEBAGG@Z
?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
_Wcsxfrm
?id@?$ctype@G@std@@2V0locale@2@A
?uncaught_exception@std@@YA_NXZ
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?_Add_vtordisp1@?$basic_ios@GU?$char_traits@G@std@@@std@@UEAAXXZ
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGXZ
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@J@Z
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?endl@std@@YAAEAV?$basic_ostream@GU?$char_traits@G@std@@@1@AEAV21@@Z
?width@ios_base@std@@QEAA_J_J@Z
?width@ios_base@std@@QEBA_JXZ
?flags@ios_base@std@@QEBAHXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?_Add_vtordisp2@?$basic_ostream@GU?$char_traits@G@std@@@std@@UEAAXXZ
?_Add_vtordisp1@?$basic_istream@GU?$char_traits@G@std@@@std@@UEAAXXZ
??1_Container_base12@std@@QEAA@XZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG0@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
?id@?$codecvt@DDH@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBGHH@Z
?_Getcat@?$codecvt@DDH@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?good@ios_base@std@@QEBA_NXZ
?_Add_vtordisp1@?$basic_istream@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Add_vtordisp2@?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Add_vtordisp2@?$basic_ios@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Add_vtordisp1@?$basic_ios@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??0_Container_base12@std@@QEAA@XZ
_Wcscoll
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?id@?$collate@G@std@@2V0locale@2@A
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?swap@?$basic_ostream@DU?$char_traits@D@std@@@std@@IEAAXAEAV12@@Z
?swap@?$basic_istream@DU?$char_traits@D@std@@@std@@IEAAXAEAV12@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?out@?$codecvt@DDH@std@@QEBAHAEAHPEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDH@std@@QEBAHAEAHPEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?unshift@?$codecvt@DDH@std@@QEBAHAEAHPEAD1AEAPEAD@Z
?_Getcat@?$codecvt@GDH@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z

msvcrt

??3@YAXPEAX@Z
__CxxFrameHandler4
??_V@YAXPEAX@Z
_vsnwprintf
memcpy_s
_purecall
??1exception@@UEAA@XZ
wcscmp
??0exception@@QEAA@XZ
??0exception@@QEAA@AEBV0@@Z
_vsnprintf_s
__C_specific_handler
wcsncpy_s
malloc
free
memmove_s
_wcsicmp
_wcsnicmp
swscanf
wcschr
wcsstr
__ExceptionPtrCreate
__ExceptionPtrCopy
wcstok_s
__ExceptionPtrDestroy
?what@exception@@UEBAPEBDXZ
?terminate@@YAXXZ
__ExceptionPtrCurrentException
__ExceptionPtrRethrow
??8type_info@@QEBAHAEBV0@@Z
wcsrchr
toupper
??1bad_cast@@UEAA@XZ
??0bad_cast@@QEAA@PEBD@Z
??0bad_cast@@QEAA@AEBV0@@Z
realloc
strchr
swprintf_s
mbstowcs_s
srand
rand
??0exception@@QEAA@AEBQEBD@Z
_errno
sprintf_s
wcsncmp
_wcslwr
towlower
wcstol
_itow_s
_wtof
_fpclass
fputc
fflush
fclose
fgetc
fwrite
fgetpos
setvbuf
ungetc
fsetpos
_fseeki64
wcscpy_s
_callnewh
__CxxFrameHandler3
_XcptFilter
_amsg_exit
_initterm
_lock
_unlock
__dllonexit
_onexit
??1type_info@@UEAA@XZ
_CxxThrowException
__RTDynamicCast
memcmp
memcpy
memmove
memset
_wtoi

ntdll

RtlNtStatusToDosErrorNoTeb
RtlVirtualUnwind
NtDeleteWnfStateName
RtlCaptureContext
RtlIsMultiUsersInSessionSku
NtQuerySystemInformation
RtlNtStatusToDosError
RtlGetDeviceFamilyInfoEnum
WinSqmSetDWORD
WinSqmStartSession
WinSqmEndSession
RtlIsStateSeparationEnabled
NtCreateWnfStateName
RtlLookupFunctionEntry
RtlPublishWnfStateData

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
FindStringOrdinal
GetModuleHandleExW
FindResourceExW
LoadLibraryExA
LoadResource
GetProcAddress
GetModuleFileNameA
GetModuleHandleExA
SizeofResource
LoadStringW
LoadLibraryExW
GetModuleHandleW
FreeLibrary
DisableThreadLibraryCalls

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
OpenSemaphoreW
InitializeCriticalSection
CreateEventExW
AcquireSRWLockExclusive
CreateMutexExW
ReleaseMutex
ResetEvent
WaitForSingleObject
SetEvent
ReleaseSemaphore
WaitForSingleObjectEx
EnterCriticalSection
CreateSemaphoreExW
LeaveCriticalSection
CreateEventW
OpenEventW
DeleteCriticalSection
InitializeCriticalSectionEx

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-errorhandling-l1-1-0

GetLastError
RaiseException
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
CreateThread
OpenThreadToken
GetCurrentProcessId
TerminateThread
CreateProcessAsUserW
GetCurrentProcess
GetCurrentThreadId
OpenProcessToken
TerminateProcess
CreateProcessW

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringA
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

oleaut32

VariantCopy
SafeArrayGetElement
VariantTimeToSystemTime
SafeArrayGetDim
SysFreeString
VariantChangeType
SysAllocStringByteLen
VarUI4FromStr
SafeArrayCreate
SafeArrayLock
VariantChangeTypeEx
SafeArrayDestroy
SysAllocString
SafeArrayGetUBound
VariantClear
VariantInit
SysStringByteLen
SafeArrayGetLBound
SysAllocStringLen
SysStringLen
SafeArrayUnlock
SystemTimeToVariantTime
SafeArrayAccessData
SafeArrayUnaccessData

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventSetInformation
EventWriteTransfer
EventActivityIdControl

api-ms-win-core-string-l2-1-0

CharLowerBuffW
CharNextW

api-ms-win-core-registry-l1-1-0

RegDeleteKeyExW
RegOpenCurrentUser
RegQueryValueExW
RegGetValueW
RegCreateKeyExW
RegSetValueExW
RegEnumValueW
RegDeleteTreeW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteValueW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringW

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolTimer
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
SetThreadpoolTimer

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree
GlobalFree

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

crypt32

CryptSetKeyIdentifierProperty
CryptBinaryToStringW
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CryptAcquireCertificatePrivateKey
CryptUnprotectData
CryptProtectData
CertGetCertificateContextProperty
CertAddCertificateContextToStore
CertDeleteCertificateFromStore
CertAddEncodedCertificateToStore
CryptHashCertificate2
CertGetNameStringW
CertRDNValueToStrW
CryptDecodeObjectEx
CertFindExtension
CertCreateCertificateContext
CryptDecryptMessage
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertOpenStore
CertCloseStore
CryptExportPublicKeyInfo

api-ms-win-core-sysinfo-l1-1-0

GetSystemWindowsDirectoryW
GetComputerNameExW
GetTickCount
GetSystemTime
GetSystemInfo
GetTickCount64
GetSystemTimeAsFileTime
GetLocalTime
GetWindowsDirectoryW

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
WakeAllConditionVariable
InitOnceComplete
Sleep
SleepConditionVariableSRW

rpcrt4

RpcBindingFree
NdrClientCall3
RpcBindingCreateW
I_RpcExceptionFilter
UuidCreate
RpcBindingBind
UuidFromStringW
RpcStringFreeW
UuidToStringW

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW
RegDeleteKeyValueW

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsCreateString
WindowsCreateStringReference
WindowsGetStringRawBuffer

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoInitialize
RoUninitialize
RoGetActivationFactory

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW
ConvertStringSidToSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-realtime-l1-1-1

QueryUnbiasedInterruptTimePrecise

api-ms-win-core-shutdown-l1-1-0

InitiateSystemShutdownExW

api-ms-win-security-base-l1-1-0

GetTokenInformation
CreateWellKnownSid
AdjustTokenPrivileges

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo
RoOriginateError

ncrypt

NCryptGetProperty
NCryptDeleteKey
NCryptOpenStorageProvider
NCryptCreatePersistedKey
NCryptSetProperty
NCryptFreeObject
NCryptOpenKey

iphlpapi

GetAdaptersAddresses
GetIfEntry2

ws2_32

InetNtopW

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-core-file-l1-1-0

GetFullPathNameW
FindFirstFileW
CreateFileW
DeleteFileW
CompareFileTime
ReadFile
GetFileAttributesW
FindNextFileW
FileTimeToLocalFileTime
SetFileAttributesW
WriteFile
FindClose
SetFileInformationByHandle
RemoveDirectoryW
CreateDirectoryW

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec
PathCchSkipRoot
PathCchAppend
PathCchCombine
PathAllocCombine

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-firmware-l1-1-0

SetFirmwareEnvironmentVariableW
GetFirmwareEnvironmentVariableW

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

cryptsp

CryptCreateHash
CryptReleaseContext
CryptAcquireContextW
CryptHashData
CryptDestroyHash
CryptGetHashParam

api-ms-win-core-registry-l2-1-0

RegEnumKeyW
RegDeleteKeyW

api-ms-win-core-kernel32-legacy-l1-1-0

GetSystemPowerStatus
GetNamedPipeClientProcessId

api-ms-win-core-string-obsolete-l1-1-0

lstrlenA
lstrcmpiW

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock
GlobalLock

omadmapi

ord104
ord44
ord52
ord22
ord47
ord53
ord56
ord27
ord54
ord23
ord166
ord79
ord24

dmcmnutils

OmaDmRegistryGetString
OmaDmRegistryGetDWORD
OmaDmRegistrySetDWORD
OmaDmRegistryDeleteValue
OmaDmRegistrySetString
HexStringToBinary
DecodeBase64W
EncodeBase64W
BinaryToHexString
DmRaiseToastNotification
DMGetClientHardwareUID
SafeWideCharToMultiByte
OmDmRegistryAllocAndGetString
DmDisableTask
BigStrcat
DmEnableTask
CopyString
DmDeleteTask
DmGetTargetAik
DmGetTpmInfo
IsWvdFeatureAllowed
CreateBstrArray
DmGetTpmState
DmRevertToSelf
InvStrCmpIW
DmGetActiveUserSid
DmImpersonate
DmGetCurrentUserSid
OmaDmRegistrySetBinary
OmaDmRegistryGetBinary
OmaDmRegistryGetAllSubKeys
OmaDmRegistryGetAllValues
UnicodeToMB
MBToUnicode
DmGenerateAttestationClaims

dmcfgutils

SyncGetDeviceUniqueID

policymanager

EnterprisePolicyManagerStore_EvaluatePoliciesUpdateCurrent
EnterprisePolicyManagerStore_GetEnrollmentTypeFromEnrollment
EnterprisePolicyManagerStore_DeleteProvider
EnterprisePolicyManagerStore_DoesProviderExist
EnterprisePolicyManagerStore_CreateProviderHive
EnterprisePolicyManagerStore_GetAllProviderContextSidAreas
EnterprisePolicyManagerStore_CSPConfigSourceDeleteChild
EnterprisePolicyManagerStore_CSPConfigSourceAreaCreateNodeInstance
EnterprisePolicyManagerStore_EnsureProviderContextSidAreaExist
EnterprisePolicyManagerStore_CSPConfigSourceAreaGetChildNodeNames
EnterprisePolicyManagerStore_IsValidArea
EnterprisePolicyManagerStore_CSPConfigSourceAreaDeleteChild
EnterprisePolicyManagerStore_CSPConfigSourceAreaPolicyCreateNodeInstance
EnterprisePolicyManagerStore_CSPConfigSourceAreaPolicyGetValue
EnterprisePolicyManagerStore_IsValidPolicy
EnterprisePolicyManagerStore_CSPResultAreaPolicyGetValue
EnterprisePolicyManagerStore_IsPolicyAreaForIngestedAdmx
EnterprisePolicyManagerStore_DeleteEnrollmentAdmxMetadata
EnterprisePolicyManagerStore_IsADMXIngestionAllowed
EnterprisePolicyManagerStore_DeleteEnrollmentAppAdmxMetadata
EnterprisePolicyManagerStore_CSPConfigSourceAreaPolicySetValue
EnterprisePolicyManagerStore_GetPolicyTypeFromMetadata
EnterprisePolicyManagerStore_CSPResultGetAreaChildNodeNames
EnterprisePolicyManagerStore_DeleteEnrollmentAppSettingTypeAdmxMetadata
EnterprisePolicyManagerStore_GetAdmxFileData
EnterprisePolicyManagerStore_VerifyAdmxPoliciesAreNotSet
EnterprisePolicyManagerStore_IngestAdmxTextBlob
EnterprisePolicyManagerStore_DoesProviderContextSidAreaPolicyValueExist
EnterprisePolicyManagerStore_SetProviderContextSidAreaPolicyValue
EnterprisePolicyManagerStore_GetCurrentPolicyValue
EnterprisePolicyManagerStore_CSPResultAreaGetChildNodeNames
EnterprisePolicyManagerStore_GetAllCurrentSidAreaPolicies
EnterprisePolicyManagerStore_GetAllProviderContextSidAreaPolicies
EnterprisePolicyManagerStore_DeleteProviderContextSidAreaPolicy
EnterprisePolicyManagerStore_GetProviderContextSidAreaPolicyValue
PolicyManager_IsPolicySetByMobileDeviceManager
EnterprisePolicyManagerStore_PublishAnyDelayedWnfs

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

xmllite

CreateXmlWriter
CreateXmlReader
CreateXmlReaderInputWithEncodingName
CreateXmlWriterOutputWithEncodingName

api-ms-win-shcore-stream-l1-1-0

SHCreateStreamOnFileW
SHCreateMemStream

combase

ord154

api-ms-win-shcore-registry-l1-1-0

SHCopyKeyW

sspicli

GetUserNameExW

api-ms-win-core-processthreads-l1-1-1

GetProcessMitigationPolicy

api-ms-win-service-management-l2-1-0

QueryServiceStatusEx

api-ms-win-service-management-l1-1-0

OpenSCManagerW
StartServiceW
OpenServiceW
CloseServiceHandle

api-ms-win-core-namedpipe-l1-1-0

CreateNamedPipeW
ConnectNamedPipe

api-ms-win-core-memory-l1-1-0

VirtualQuery
VirtualProtect

certenroll

ord45

Exports

Exports

DllCanUnloadNow
DllGetClassObject
GetPushStatus
SetPushPFN

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 436KB - Virtual size: 432KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 68KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 760B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
enterpriseetw.dll
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 4KB - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
enterpriseresourcemanager.dll
.dll windows:10 windows x64 arch:x64

c3667d034578385644eff193c5e1ac37

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

enterpriseresourcemanager.pdb

Imports

msvcp110_win

??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
?_Xbad_alloc@std@@YAXXZ
?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?_BADOFF@std@@3_JB
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?pbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
?_Syserror_map@std@@YAPEBDH@Z
?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA_N_N@Z
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ
??Bios_base@std@@QEBAPEAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ
?_Winerror_map@std@@YAPEBDH@Z
?_Xout_of_range@std@@YAXPEBD@Z
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Add_vtordisp1@?$basic_istream@GU?$char_traits@G@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?_Add_vtordisp2@?$basic_ostream@GU?$char_traits@G@std@@@std@@UEAAXXZ

msvcrt

memcpy
memcmp
_CxxThrowException
memmove
??0exception@@QEAA@AEBV0@@Z
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
__CxxFrameHandler3
__C_specific_handler
_initterm
free
_amsg_exit
_XcptFilter
_callnewh
malloc
memmove_s
wcschr
_vsnprintf_s
memset
sprintf_s
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
_purecall
??3@YAXPEAX@Z
wcscat_s
_wcsicmp
memcpy_s
_vsnwprintf
??_V@YAXPEAX@Z
__CxxFrameHandler4

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlIsStateSeparationEnabled

oleaut32

SysStringLen
SysFreeString

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventWriteTransfer
EventRegister
EventSetInformation

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetModuleHandleW
LoadLibraryExA
GetModuleHandleExW
GetModuleFileNameA
FreeLibrary
GetProcAddress

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegDeleteKeyExW
RegDeleteTreeW
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegEnumKeyExW
RegGetValueW
RegEnumValueW
RegDeleteValueW
RegQueryInfoKeyW
RegOpenKeyExW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
RaiseException
SetLastError
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemInfo
GetSystemTime
GetTickCount

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

rpcrt4

UuidFromStringW
UuidCreate

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
ReleaseSemaphore
LeaveCriticalSection
InitializeCriticalSectionEx
CreateSemaphoreExW
DeleteCriticalSection
AcquireSRWLockShared
ReleaseMutex
CreateMutexExW
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
WaitForSingleObject
OpenSemaphoreW
WaitForSingleObjectEx

api-ms-win-core-com-l1-1-0

CoCreateInstance

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
SleepConditionVariableSRW
Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrStrIW

dmcmnutils

UnicodeToMB

api-ms-win-core-memory-l1-1-0

VirtualQuery
VirtualProtect

Exports

Exports

EnterpriseResourceManagerStore_DeleteResource
EnterpriseResourceManagerStore_DeleteTrackedResourcesForEnrollment
EnterpriseResourceManagerStore_GenerateWmiResourcePath
EnterpriseResourceManagerStore_IsResourceProvisioned
EnterpriseResourceManagerStore_NormalizeURI
EnterpriseResourceManagerStore_RemoveAllIgnoredUri
EnterpriseResourceManagerStore_ReplaceResourceNodePath
EnterpriseResourceManagerStore_SaveIgnoredURI
EnterpriseResourceManagerStore_WriteResourceNodePath
EnterpriseResourceManager_ScopeData_IsValid

Sections

.text
Size: 80KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
eqossnap.dll
.dll regsvr32 windows:10 windows x64 arch:x64

6850cbadc757e1ca8814cc9c1fc23f85

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

eqossnap.pdb

Imports

mfc42u

ord6886
ord6887

msvcrt

free
_amsg_exit
_XcptFilter
malloc
__CxxFrameHandler4
_initterm
??1type_info@@UEAA@XZ
_vsnwprintf
wcstoul
__C_specific_handler
_purecall
memset

api-ms-win-core-libraryloader-l1-2-0

LoadStringW
GetProcAddress
GetModuleFileNameW
GetModuleHandleExW

api-ms-win-core-heap-l2-1-0

GlobalAlloc
GlobalFree

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCompareMemory
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
RegQueryValueExW
RegCloseKey

api-ms-win-core-com-l1-1-0

CoTaskMemFree
StringFromCLSID
CreateStreamOnHGlobal
CoTaskMemAlloc

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
GetLastError

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW
RegOpenKeyW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW
lstrcmpW

api-ms-win-core-sidebyside-l1-1-0

QueryActCtxW
CreateActCtxW
FindActCtxSectionStringW
DeactivateActCtx
ActivateActCtx

ntdll

RtlIpv6StringToAddressW
RtlIpv4StringToAddressW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 52KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 368B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
es.dll
.dll windows:10 windows x64 arch:x64

531a8539e1438bbf12b56ca2133c5a77

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

ES.pdb

Imports

msvcrt

__dllonexit
_onexit
sqrt
memset
_purecall
_unlock
free
malloc
wcsstr
wcsrchr
_local_unwind
_wcsicmp
_lock
?terminate@@YAXXZ
_ultow
wcscpy_s
_waccess
__CxxFrameHandler4
_vsnwprintf
_vsnprintf
_initterm
_beginthreadex
_wcsnicmp
iswalnum
iswalpha
iswdigit
_resetstkoflw
__C_specific_handler
exp
memcmp
_itow_s
towupper
memcpy
wcsncmp
_XcptFilter
_amsg_exit
wcscmp

ntdll

RtlAllocateHeap
RtlDelete
RtlSplay
RtlDllShutdownInProgress
RtlDeleteCriticalSection
RtlInitializeCriticalSectionAndSpinCount
RtlImageNtHeader
RtlFreeHeap
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
NtQueryEvent
RtlNtStatusToDosError
RtlInitUnicodeString
NtOpenEvent
RtlApplicationVerifierStop
RtlCreateServiceSid

api-ms-win-core-string-l1-1-0

CompareStringW

api-ms-win-core-synch-l1-1-0

CreateEventW
EnterCriticalSection
WaitForSingleObject
ReleaseSemaphore
SetEvent
ResetEvent
DeleteCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateSemaphoreExW
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx

api-ms-win-core-processthreads-l1-1-0

OpenThreadToken
CreateThread
CreateProcessW
GetExitCodeProcess
GetCurrentProcess
OpenProcessToken
SetThreadPriority
SetThreadToken
GetCurrentThread
GetCurrentThreadId
SetThreadStackGuarantee
GetCurrentProcessId
TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemInfo
GetLocalTime
GetTickCount
GetTickCount64

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
RaiseException

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetUserDefaultLCID

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-heap-l2-1-0

LocalFree
GlobalAlloc
GlobalFree
LocalAlloc

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
FindResourceExW
LockResource
DisableThreadLibraryCalls
FreeLibraryAndExitThread
GetProcAddress
LoadStringW
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleExW
LoadResource
GetModuleHandleW

api-ms-win-core-file-l1-1-0

FindClose
SetFileAttributesW
FindFirstFileW
CreateDirectoryW
DeleteFileW
GetFileAttributesW
FindNextFileW

api-ms-win-core-registry-l1-1-0

RegLoadKeyW
RegOpenKeyExW
RegUnLoadKeyW
RegQueryValueExW
RegNotifyChangeKeyValue
RegCloseKey
RegGetValueW
RegQueryInfoKeyW
RegSetValueExW
RegDeleteValueW
RegEnumValueW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteTreeW

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
Sleep

api-ms-win-security-base-l1-1-0

AdjustTokenPrivileges
EqualSid
GetSecurityDescriptorDacl
GetLengthSid
CheckTokenMembership
FreeSid
GetTokenInformation
AllocateAndInitializeSid

rpcrt4

IUnknown_QueryInterface_Proxy
I_RpcBindingInqLocalClientPID
I_RpcBindingInqTransportType
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrStubForwardingFunction
IUnknown_AddRef_Proxy
NdrOleFree
IUnknown_Release_Proxy
I_RpcOpenClientProcess
NdrOleAllocate
NdrStubCall3

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CreateThreadpoolWait

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
OutputDebugStringA
IsDebuggerPresent

api-ms-win-core-processenvironment-l1-1-0

SearchPathW
ExpandEnvironmentStringsW

api-ms-win-core-com-midlproxystub-l1-1-0

NdrProxyForwardingFunction9
NdrProxyForwardingFunction10
NdrProxyForwardingFunction11
NdrProxyForwardingFunction8
ObjectStublessClient25
ObjectStublessClient24
NdrProxyForwardingFunction7
ObjectStublessClient12
NdrProxyForwardingFunction3
ObjectStublessClient21
ObjectStublessClient16
ObjectStublessClient5
ObjectStublessClient10
ObjectStublessClient17
ObjectStublessClient26
ObjectStublessClient14
ObjectStublessClient8
NdrProxyForwardingFunction5
NdrProxyForwardingFunction4
NdrProxyForwardingFunction12
ObjectStublessClient19
ObjectStublessClient11
ObjectStublessClient22
ObjectStublessClient13
ObjectStublessClient7
NdrProxyForwardingFunction6
ObjectStublessClient23
ObjectStublessClient15
ObjectStublessClient20
ObjectStublessClient28
ObjectStublessClient18
ObjectStublessClient27
ObjectStublessClient9

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx
DeleteTimerQueueTimer
CreateTimerQueueTimer
ChangeTimerQueueTimer

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW

api-ms-win-core-io-l1-1-0

CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-memory-l1-1-0

VirtualQuery
VirtualProtect
VirtualAlloc

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock
GlobalLock

api-ms-win-core-threadpool-private-l1-1-0

RegisterWaitForSingleObjectEx

Exports

Exports

DllCanUnloadNow
DllGetClassObject
LCEControlServer
NotifyLogoffUser
NotifyLogonUser
ServiceMain
SvchostPushServiceGlobals

Sections

.text
Size: 252KB - Virtual size: 248KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

57eb22ef5144c0ff295b9b8b61ef8699

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-errorhandling-l1-1-2

rpcrt4

api-ms-win-core-memory-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-localization-l1-2-2

api-ms-win-core-windowserrorreporting-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

RT_CODE Size: 4KB - Virtual size: 2KB

.rdata Size: 644KB - Virtual size: 642KB

.data Size: 4KB - Virtual size: 35KB

.pdata Size: 92KB - Virtual size: 91KB

.didat Size: 4KB - Virtual size: 576B

.rsrc Size: 108KB - Virtual size: 106KB

.reloc Size: 8KB - Virtual size: 7KB

73e5752d4319a48a50937d14dbd63110

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5fCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

0a:93:51:8b:ca:96:66:23:03:35:16:75:a7:1d:ab:90:ab:66:4c:0f:93:d0:4e:22:19:39:cd:fb:39:84:98:03Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp_win

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

ntdll

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-version-l1-1-1

api-ms-win-core-version-l1-1-0

.text
Size: 1.6MB - Virtual size: 1.6MB

RT_CODE
Size: 4KB - Virtual size: 2KB

.rdata
Size: 644KB - Virtual size: 642KB

.data
Size: 4KB - Virtual size: 35KB

.pdata
Size: 92KB - Virtual size: 91KB

.didat
Size: 4KB - Virtual size: 576B

.rsrc
Size: 108KB - Virtual size: 106KB

.reloc
Size: 8KB - Virtual size: 7KB

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

0a:93:51:8b:ca:96:66:23:03:35:16:75:a7:1d:ab:90:ab:66:4c:0f:93:d0:4e:22:19:39:cd:fb:39:84:98:03
Signer

.text
Size: 132KB - Virtual size: 129KB

.rdata
Size: 48KB - Virtual size: 46KB

.data
Size: 4KB - Virtual size: 11KB

.pdata
Size: 12KB - Virtual size: 9KB

.didat
Size: 4KB - Virtual size: 136B

.rsrc
Size: 4KB - Virtual size: 984B

.reloc
Size: 4KB - Virtual size: 764B