Windows XP DLL File Information - advapi32.dll |
The following DLL report was generated by automatic DLL script that scanned and loaded all DLL files in the system32 directory of Windows XP, extracted the information from them, and then saved it into HTML reports. If you want to view a report of another DLL, go to the main page of this Web site.
General Information
File Description: | Advanced Windows 32 Base API |
File Version: | 5.1.2600.5512 (xpsp.080413-2113) |
Company: | Microsoft Corporation |
Product Name: | Microsoft Windows Operating System |
DLL popularity | Very High - 713 other DLL files in system32 directory are statically linked to this file. |
File Size: | 603 KB |
Total Number of Exported Functions: | 676 |
Total Number of Exported Functions With Names: | 676 |
Section Headers
Name | Virtual Address | Raw Data Size | % of File | Characteristics | Section Contains... |
---|---|---|---|---|---|
.text | 0x00001000 | 476,672 Bytes | 77.2% | Read, Execute | Code |
.data | 0x00076000 | 11,264 Bytes | 1.8% | Write, Read | Initialized Data |
.rsrc | 0x0007b000 | 109,056 Bytes | 17.7% | Read | Initialized Data |
.reloc | 0x00096000 | 19,456 Bytes | 3.2% | Read, Discardable | Initialized Data |
Static Linking
advapi32.dll is statically linked to the following files:KERNEL32.dll
ntdll.dll
RPCRT4.dll
This means that when advapi32.dll is loaded, the above files are automatically loaded too. If one of these files is corrupted or missing, advapi32.dll won't be loaded.
General Resources Information
Resource Type | Number of Items | Total Size | % of File |
---|---|---|---|
Icons | 0 | 0 Bytes | 0.0% |
Animated Icons | 0 | 0 Bytes | 0.0% |
Cursors | 0 | 0 Bytes | 0.0% |
Animated Cursors | 0 | 0 Bytes | 0.0% |
Bitmaps | 0 | 0 Bytes | 0.0% |
AVI Files | 0 | 0 Bytes | 0.0% |
Dialog-Boxes | 0 | 0 Bytes | 0.0% |
HTML Related Files | 0 | 0 Bytes | 0.0% |
Menus | 0 | 0 Bytes | 0.0% |
Strings | 10 | 1,340 Bytes | 0.2% |
Type Libraries | 0 | 0 Bytes | 0.0% |
Manifest | 0 | 0 Bytes | 0.0% |
All Others | 4 | 107,121 Bytes | 17.3% |
Total | 14 | 108,461 Bytes | 17.6% |
Icons in this file
No icons found in this file
Cursors in this file
No cursors found in this file
Dialog-boxes list (up to 200 dialogs)
No dialog resources in this file.
String resources in this dll (up to 200 strings)
String ID | String Text |
---|---|
50001 | Disallowed |
50002 | Software will not run, regardless of the access rights of the user. |
50003 | Untrusted |
50004 | Allows programs to execute with only access to resources granted to open well-known groups, blocking access Administrator and Power User privileges, and personally granted rights. |
50005 | Restricted |
50006 | Software cannot access certain resources, such as cryptographic keys and credentials, regardless of the access rights of the user. |
50007 | Basic User |
50008 | Allows programs to execute as a user that does not have Administrator or Power User access rights, but can still access resouces accessible by normal users. |
50009 | Unrestricted |
50010 | Software access rights are determined by the access rights of the user. |
COM Classes/Interfaces
There is no type library in this file with COM classes/interfaces information
Exported Functions List
The following functions are exported by this dll:A_SHAFinal | A_SHAInit |
A_SHAUpdate | AbortSystemShutdownA |
AbortSystemShutdownW | AccessCheck |
AccessCheckAndAuditAlarmA | AccessCheckAndAuditAlarmW |
AccessCheckByType | AccessCheckByTypeAndAuditAlarmA |
AccessCheckByTypeAndAuditAlarmW | AccessCheckByTypeResultList |
AccessCheckByTypeResultListAndAuditAlarmA | AccessCheckByTypeResultListAndAuditAlarmByHandleA |
AccessCheckByTypeResultListAndAuditAlarmByHandleW | AccessCheckByTypeResultListAndAuditAlarmW |
AddAccessAllowedAce | AddAccessAllowedAceEx |
AddAccessAllowedObjectAce | AddAccessDeniedAce |
AddAccessDeniedAceEx | AddAccessDeniedObjectAce |
AddAce | AddAuditAccessAce |
AddAuditAccessAceEx | AddAuditAccessObjectAce |
AddUsersToEncryptedFile | AdjustTokenGroups |
AdjustTokenPrivileges | AllocateAndInitializeSid |
AllocateLocallyUniqueId | AreAllAccessesGranted |
AreAnyAccessesGranted | BackupEventLogA |
BackupEventLogW | BuildExplicitAccessWithNameA |
BuildExplicitAccessWithNameW | BuildImpersonateExplicitAccessWithNameA |
BuildImpersonateExplicitAccessWithNameW | BuildImpersonateTrusteeA |
BuildImpersonateTrusteeW | BuildSecurityDescriptorA |
BuildSecurityDescriptorW | BuildTrusteeWithNameA |
BuildTrusteeWithNameW | BuildTrusteeWithObjectsAndNameA |
BuildTrusteeWithObjectsAndNameW | BuildTrusteeWithObjectsAndSidA |
BuildTrusteeWithObjectsAndSidW | BuildTrusteeWithSidA |
BuildTrusteeWithSidW | CancelOverlappedAccess |
ChangeServiceConfig2A | ChangeServiceConfig2W |
ChangeServiceConfigA | ChangeServiceConfigW |
CheckTokenMembership | ClearEventLogA |
ClearEventLogW | CloseCodeAuthzLevel |
CloseEncryptedFileRaw | CloseEventLog |
CloseServiceHandle | CloseTrace |
CommandLineFromMsiDescriptor | ComputeAccessTokenFromCodeAuthzLevel |
ControlService | ControlTraceA |
ControlTraceW | ConvertAccessToSecurityDescriptorA |
ConvertAccessToSecurityDescriptorW | ConvertSDToStringSDRootDomainA |
ConvertSDToStringSDRootDomainW | ConvertSecurityDescriptorToAccessA |
ConvertSecurityDescriptorToAccessNamedA | ConvertSecurityDescriptorToAccessNamedW |
ConvertSecurityDescriptorToAccessW | ConvertSecurityDescriptorToStringSecurityDescriptorA |
ConvertSecurityDescriptorToStringSecurityDescriptorW | ConvertSidToStringSidA |
ConvertSidToStringSidW | ConvertStringSDToSDDomainA |
ConvertStringSDToSDDomainW | ConvertStringSDToSDRootDomainA |
ConvertStringSDToSDRootDomainW | ConvertStringSecurityDescriptorToSecurityDescriptorA |
ConvertStringSecurityDescriptorToSecurityDescriptorW | ConvertStringSidToSidA |
ConvertStringSidToSidW | ConvertToAutoInheritPrivateObjectSecurity |
CopySid | CreateCodeAuthzLevel |
CreatePrivateObjectSecurity | CreatePrivateObjectSecurityEx |
CreatePrivateObjectSecurityWithMultipleInheritance | CreateProcessAsUserA |
CreateProcessAsUserSecure | CreateProcessAsUserW |
CreateProcessWithLogonW | CreateRestrictedToken |
CreateServiceA | CreateServiceW |
CreateTraceInstanceId | CreateWellKnownSid |
CredDeleteA | CredDeleteW |
CredEnumerateA | CredEnumerateW |
CredFree | CredGetSessionTypes |
CredGetTargetInfoA | CredGetTargetInfoW |
CredIsMarshaledCredentialA | CredIsMarshaledCredentialW |
CredMarshalCredentialA | CredMarshalCredentialW |
CredProfileLoaded | CredReadA |
CredReadDomainCredentialsA | CredReadDomainCredentialsW |
CredReadW | CredRenameA |
CredRenameW | CredUnmarshalCredentialA |
CredUnmarshalCredentialW | CredWriteA |
CredWriteDomainCredentialsA | CredWriteDomainCredentialsW |
CredWriteW | CredpConvertCredential |
CredpConvertTargetInfo | CredpDecodeCredential |
CredpEncodeCredential | CryptAcquireContextA |
CryptAcquireContextW | CryptContextAddRef |
CryptCreateHash | CryptDecrypt |
CryptDeriveKey | CryptDestroyHash |
CryptDestroyKey | CryptDuplicateHash |
CryptDuplicateKey | CryptEncrypt |
CryptEnumProviderTypesA | CryptEnumProviderTypesW |
CryptEnumProvidersA | CryptEnumProvidersW |
CryptExportKey | CryptGenKey |
CryptGenRandom | CryptGetDefaultProviderA |
CryptGetDefaultProviderW | CryptGetHashParam |
CryptGetKeyParam | CryptGetProvParam |
CryptGetUserKey | CryptHashData |
CryptHashSessionKey | CryptImportKey |
CryptReleaseContext | CryptSetHashParam |
CryptSetKeyParam | CryptSetProvParam |
CryptSetProviderA | CryptSetProviderExA |
CryptSetProviderExW | CryptSetProviderW |
CryptSignHashA | CryptSignHashW |
CryptVerifySignatureA | CryptVerifySignatureW |
DecryptFileA | DecryptFileW |
DeleteAce | DeleteService |
DeregisterEventSource | DestroyPrivateObjectSecurity |
DuplicateEncryptionInfoFile | DuplicateToken |
DuplicateTokenEx | ElfBackupEventLogFileA |
ElfBackupEventLogFileW | ElfChangeNotify |
ElfClearEventLogFileA | ElfClearEventLogFileW |
ElfCloseEventLog | ElfDeregisterEventSource |
ElfFlushEventLog | ElfNumberOfRecords |
ElfOldestRecord | ElfOpenBackupEventLogA |
ElfOpenBackupEventLogW | ElfOpenEventLogA |
ElfOpenEventLogW | ElfReadEventLogA |
ElfReadEventLogW | ElfRegisterEventSourceA |
ElfRegisterEventSourceW | ElfReportEventA |
ElfReportEventW | EnableTrace |
EncryptFileA | EncryptFileW |
EncryptedFileKeyInfo | EncryptionDisable |
EnumDependentServicesA | EnumDependentServicesW |
EnumServiceGroupW | EnumServicesStatusA |
EnumServicesStatusExA | EnumServicesStatusExW |
EnumServicesStatusW | EnumerateTraceGuids |
EqualDomainSid | EqualPrefixSid |
EqualSid | FileEncryptionStatusA |
FileEncryptionStatusW | FindFirstFreeAce |
FlushTraceA | FlushTraceW |
FreeEncryptedFileKeyInfo | FreeEncryptionCertificateHashList |
FreeInheritedFromArray | FreeSid |
GetAccessPermissionsForObjectA | GetAccessPermissionsForObjectW |
GetAce | GetAclInformation |
GetAuditedPermissionsFromAclA | GetAuditedPermissionsFromAclW |
GetCurrentHwProfileA | GetCurrentHwProfileW |
GetEffectiveRightsFromAclA | GetEffectiveRightsFromAclW |
GetEventLogInformation | GetExplicitEntriesFromAclA |
GetExplicitEntriesFromAclW | GetFileSecurityA |
GetFileSecurityW | GetInformationCodeAuthzLevelW |
GetInformationCodeAuthzPolicyW | GetInheritanceSourceA |
GetInheritanceSourceW | GetKernelObjectSecurity |
GetLengthSid | GetLocalManagedApplicationData |
GetLocalManagedApplications | GetManagedApplicationCategories |
GetManagedApplications | GetMultipleTrusteeA |
GetMultipleTrusteeOperationA | GetMultipleTrusteeOperationW |
GetMultipleTrusteeW | GetNamedSecurityInfoA |
GetNamedSecurityInfoExA | GetNamedSecurityInfoExW |
GetNamedSecurityInfoW | GetNumberOfEventLogRecords |
GetOldestEventLogRecord | GetOverlappedAccessResults |
GetPrivateObjectSecurity | GetSecurityDescriptorControl |
GetSecurityDescriptorDacl | GetSecurityDescriptorGroup |
GetSecurityDescriptorLength | GetSecurityDescriptorOwner |
GetSecurityDescriptorRMControl | GetSecurityDescriptorSacl |
GetSecurityInfo | GetSecurityInfoExA |
GetSecurityInfoExW | GetServiceDisplayNameA |
GetServiceDisplayNameW | GetServiceKeyNameA |
GetServiceKeyNameW | GetSidIdentifierAuthority |
GetSidLengthRequired | GetSidSubAuthority |
GetSidSubAuthorityCount | GetTokenInformation |
GetTraceEnableFlags | GetTraceEnableLevel |
GetTraceLoggerHandle | GetTrusteeFormA |
GetTrusteeFormW | GetTrusteeNameA |
GetTrusteeNameW | GetTrusteeTypeA |
GetTrusteeTypeW | GetUserNameA |
GetUserNameW | GetWindowsAccountDomainSid |
I_ScGetCurrentGroupStateW | I_ScIsSecurityProcess |
I_ScPnPGetServiceName | I_ScSendTSMessage |
I_ScSetServiceBitsA | I_ScSetServiceBitsW |
IdentifyCodeAuthzLevelW | ImpersonateAnonymousToken |
ImpersonateLoggedOnUser | ImpersonateNamedPipeClient |
ImpersonateSelf | InitializeAcl |
InitializeSecurityDescriptor | InitializeSid |
InitiateSystemShutdownA | InitiateSystemShutdownExA |
InitiateSystemShutdownExW | InitiateSystemShutdownW |
InstallApplication | IsTextUnicode |
IsTokenRestricted | IsTokenUntrusted |
IsValidAcl | IsValidSecurityDescriptor |
IsValidSid | IsWellKnownSid |
LockServiceDatabase | LogonUserA |
LogonUserExA | LogonUserExW |
LogonUserW | LookupAccountNameA |
LookupAccountNameW | LookupAccountSidA |
LookupAccountSidW | LookupPrivilegeDisplayNameA |
LookupPrivilegeDisplayNameW | LookupPrivilegeNameA |
LookupPrivilegeNameW | LookupPrivilegeValueA |
LookupPrivilegeValueW | LookupSecurityDescriptorPartsA |
LookupSecurityDescriptorPartsW | LsaAddAccountRights |
LsaAddPrivilegesToAccount | LsaClearAuditLog |
LsaClose | LsaCreateAccount |
LsaCreateSecret | LsaCreateTrustedDomain |
LsaCreateTrustedDomainEx | LsaDelete |
LsaDeleteTrustedDomain | LsaEnumerateAccountRights |
LsaEnumerateAccounts | LsaEnumerateAccountsWithUserRight |
LsaEnumeratePrivileges | LsaEnumeratePrivilegesOfAccount |
LsaEnumerateTrustedDomains | LsaEnumerateTrustedDomainsEx |
LsaFreeMemory | LsaGetQuotasForAccount |
LsaGetRemoteUserName | LsaGetSystemAccessAccount |
LsaGetUserName | LsaICLookupNames |
LsaICLookupNamesWithCreds | LsaICLookupSids |
LsaICLookupSidsWithCreds | LsaLookupNames |
LsaLookupNames2 | LsaLookupPrivilegeDisplayName |
LsaLookupPrivilegeName | LsaLookupPrivilegeValue |
LsaLookupSids | LsaNtStatusToWinError |
LsaOpenAccount | LsaOpenPolicy |
LsaOpenPolicySce | LsaOpenSecret |
LsaOpenTrustedDomain | LsaOpenTrustedDomainByName |
LsaQueryDomainInformationPolicy | LsaQueryForestTrustInformation |
LsaQueryInfoTrustedDomain | LsaQueryInformationPolicy |
LsaQuerySecret | LsaQuerySecurityObject |
LsaQueryTrustedDomainInfo | LsaQueryTrustedDomainInfoByName |
LsaRemoveAccountRights | LsaRemovePrivilegesFromAccount |
LsaRetrievePrivateData | LsaSetDomainInformationPolicy |
LsaSetForestTrustInformation | LsaSetInformationPolicy |
LsaSetInformationTrustedDomain | LsaSetQuotasForAccount |
LsaSetSecret | LsaSetSecurityObject |
LsaSetSystemAccessAccount | LsaSetTrustedDomainInfoByName |
LsaSetTrustedDomainInformation | LsaStorePrivateData |
MD4Final | MD4Init |
MD4Update | MD5Final |
MD5Init | MD5Update |
MSChapSrvChangePassword | MSChapSrvChangePassword2 |
MakeAbsoluteSD | MakeAbsoluteSD2 |
MakeSelfRelativeSD | MapGenericMask |
NotifyBootConfigStatus | NotifyChangeEventLog |
ObjectCloseAuditAlarmA | ObjectCloseAuditAlarmW |
ObjectDeleteAuditAlarmA | ObjectDeleteAuditAlarmW |
ObjectOpenAuditAlarmA | ObjectOpenAuditAlarmW |
ObjectPrivilegeAuditAlarmA | ObjectPrivilegeAuditAlarmW |
OpenBackupEventLogA | OpenBackupEventLogW |
OpenEncryptedFileRawA | OpenEncryptedFileRawW |
OpenEventLogA | OpenEventLogW |
OpenProcessToken | OpenSCManagerA |
OpenSCManagerW | OpenServiceA |
OpenServiceW | OpenThreadToken |
OpenTraceA | OpenTraceW |
PrivilegeCheck | PrivilegedServiceAuditAlarmA |
PrivilegedServiceAuditAlarmW | ProcessIdleTasks |
ProcessTrace | QueryAllTracesA |
QueryAllTracesW | QueryRecoveryAgentsOnEncryptedFile |
QueryServiceConfig2A | QueryServiceConfig2W |
QueryServiceConfigA | QueryServiceConfigW |
QueryServiceLockStatusA | QueryServiceLockStatusW |
QueryServiceObjectSecurity | QueryServiceStatus |
QueryServiceStatusEx | QueryTraceA |
QueryTraceW | QueryUsersOnEncryptedFile |
QueryWindows31FilesMigration | ReadEncryptedFileRaw |
ReadEventLogA | ReadEventLogW |
RegCloseKey | RegConnectRegistryA |
RegConnectRegistryW | RegCreateKeyA |
RegCreateKeyExA | RegCreateKeyExW |
RegCreateKeyW | RegDeleteKeyA |
RegDeleteKeyW | RegDeleteValueA |
RegDeleteValueW | RegDisablePredefinedCache |
RegDisablePredefinedCacheEx | RegEnumKeyA |
RegEnumKeyExA | RegEnumKeyExW |
RegEnumKeyW | RegEnumValueA |
RegEnumValueW | RegFlushKey |
RegGetKeySecurity | RegLoadKeyA |
RegLoadKeyW | RegNotifyChangeKeyValue |
RegOpenCurrentUser | RegOpenKeyA |
RegOpenKeyExA | RegOpenKeyExW |
RegOpenKeyW | RegOpenUserClassesRoot |
RegOverridePredefKey | RegQueryInfoKeyA |
RegQueryInfoKeyW | RegQueryMultipleValuesA |
RegQueryMultipleValuesW | RegQueryValueA |
RegQueryValueExA | RegQueryValueExW |
RegQueryValueW | RegReplaceKeyA |
RegReplaceKeyW | RegRestoreKeyA |
RegRestoreKeyW | RegSaveKeyA |
RegSaveKeyExA | RegSaveKeyExW |
RegSaveKeyW | RegSetKeySecurity |
RegSetValueA | RegSetValueExA |
RegSetValueExW | RegSetValueW |
RegUnLoadKeyA | RegUnLoadKeyW |
RegisterEventSourceA | RegisterEventSourceW |
RegisterIdleTask | RegisterServiceCtrlHandlerA |
RegisterServiceCtrlHandlerExA | RegisterServiceCtrlHandlerExW |
RegisterServiceCtrlHandlerW | RegisterTraceGuidsA |
RegisterTraceGuidsW | RemoveTraceCallback |
RemoveUsersFromEncryptedFile | ReportEventA |
ReportEventW | RevertToSelf |
SaferCloseLevel | SaferComputeTokenFromLevel |
SaferCreateLevel | SaferGetLevelInformation |
SaferGetPolicyInformation | SaferIdentifyLevel |
SaferRecordEventLogEntry | SaferSetLevelInformation |
SaferSetPolicyInformation | SaferiChangeRegistryScope |
SaferiCompareTokenLevels | SaferiIsExecutableFileType |
SaferiPopulateDefaultsInRegistry | SaferiRecordEventLogEntry |
SaferiReplaceProcessThreadTokens | SaferiSearchMatchingHashRules |
SetAclInformation | SetEntriesInAccessListA |
SetEntriesInAccessListW | SetEntriesInAclA |
SetEntriesInAclW | SetEntriesInAuditListA |
SetEntriesInAuditListW | SetFileSecurityA |
SetFileSecurityW | SetInformationCodeAuthzLevelW |
SetInformationCodeAuthzPolicyW | SetKernelObjectSecurity |
SetNamedSecurityInfoA | SetNamedSecurityInfoExA |
SetNamedSecurityInfoExW | SetNamedSecurityInfoW |
SetPrivateObjectSecurity | SetPrivateObjectSecurityEx |
SetSecurityDescriptorControl | SetSecurityDescriptorDacl |
SetSecurityDescriptorGroup | SetSecurityDescriptorOwner |
SetSecurityDescriptorRMControl | SetSecurityDescriptorSacl |
SetSecurityInfo | SetSecurityInfoExA |
SetSecurityInfoExW | SetServiceBits |
SetServiceObjectSecurity | SetServiceStatus |
SetThreadToken | SetTokenInformation |
SetTraceCallback | SetUserFileEncryptionKey |
StartServiceA | StartServiceCtrlDispatcherA |
StartServiceCtrlDispatcherW | StartServiceW |
StartTraceA | StartTraceW |
StopTraceA | StopTraceW |
SynchronizeWindows31FilesAndWindowsNTRegistry | SystemFunction001 |
SystemFunction002 | SystemFunction003 |
SystemFunction004 | SystemFunction005 |
SystemFunction006 | SystemFunction007 |
SystemFunction008 | SystemFunction009 |
SystemFunction010 | SystemFunction011 |
SystemFunction012 | SystemFunction013 |
SystemFunction014 | SystemFunction015 |
SystemFunction016 | SystemFunction017 |
SystemFunction018 | SystemFunction019 |
SystemFunction020 | SystemFunction021 |
SystemFunction022 | SystemFunction023 |
SystemFunction024 | SystemFunction025 |
SystemFunction026 | SystemFunction027 |
SystemFunction028 | SystemFunction029 |
SystemFunction030 | SystemFunction031 |
SystemFunction032 | SystemFunction033 |
SystemFunction034 | SystemFunction035 |
SystemFunction036 | SystemFunction040 |
SystemFunction041 | TraceEvent |
TraceEventInstance | TraceMessage |
TraceMessageVa | TreeResetNamedSecurityInfoA |
TreeResetNamedSecurityInfoW | TrusteeAccessToObjectA |
TrusteeAccessToObjectW | UninstallApplication |
UnlockServiceDatabase | UnregisterIdleTask |
UnregisterTraceGuids | UpdateTraceA |
UpdateTraceW | WdmWmiServiceMain |
WmiCloseBlock | WmiCloseTraceWithCursor |
WmiConvertTimestamp | WmiDevInstToInstanceNameA |
WmiDevInstToInstanceNameW | WmiEnumerateGuids |
WmiExecuteMethodA | WmiExecuteMethodW |
WmiFileHandleToInstanceNameA | WmiFileHandleToInstanceNameW |
WmiFreeBuffer | WmiGetFirstTraceOffset |
WmiGetNextEvent | WmiGetTraceHeader |
WmiMofEnumerateResourcesA | WmiMofEnumerateResourcesW |
WmiNotificationRegistrationA | WmiNotificationRegistrationW |
WmiOpenBlock | WmiOpenTraceWithCursor |
WmiParseTraceEvent | WmiQueryAllDataA |
WmiQueryAllDataMultipleA | WmiQueryAllDataMultipleW |
WmiQueryAllDataW | WmiQueryGuidInformation |
WmiQuerySingleInstanceA | WmiQuerySingleInstanceMultipleA |
WmiQuerySingleInstanceMultipleW | WmiQuerySingleInstanceW |
WmiReceiveNotificationsA | WmiReceiveNotificationsW |
WmiSetSingleInstanceA | WmiSetSingleInstanceW |
WmiSetSingleItemA | WmiSetSingleItemW |
Wow64Win32ApiEntry | WriteEncryptedFileRaw |
Imported Functions List
The following functions are imported by this dll:- KERNEL32.dll:
AreFileApisANSI CancelIo CloseHandle CompareFileTime CopyFileW CreateEventA CreateEventW CreateFileA CreateFileMappingA CreateFileMappingW CreateFileW CreateMutexW CreateProcessInternalA CreateProcessInternalW CreateThread CreateVirtualBuffer DelayLoadFailureHook DeleteFileW DeviceIoControl DuplicateHandle EnumUILanguagesW ExitThread ExpandEnvironmentStringsA ExpandEnvironmentStringsW FindClose FindFirstFileExW FindFirstFileW FindNextFileW FindResourceA FindResourceExW FormatMessageW FreeLibrary FreeVirtualBuffer GetCommandLineW GetComputerNameA GetComputerNameExW GetComputerNameW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetDiskFreeSpaceW GetDriveTypeW GetFileAttributesExW GetFileAttributesW GetFileSize GetFileSizeEx GetFileTime GetFullPathNameA GetFullPathNameW GetLocalTime GetLogicalDriveStringsW GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOverlappedResult GetPriorityClass GetPrivateProfileIntW GetPrivateProfileStringW GetProcAddress GetProcessHeap GetProfileIntA GetProfileStringA GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetSystemWindowsDirectoryW GetTickCount GetTimeZoneInformation GetUserDefaultUILanguage GetVersionExA GetVolumeInformationW GetWindowsDirectoryW GlobalMemoryStatus InitializeCriticalSection InterlockedCompareExchange InterlockedDecrement InterlockedExchange InterlockedExchangeAdd InterlockedIncrement IsBadWritePtr LoadLibraryA LoadLibraryExW LoadLibraryW LoadResource LocalAlloc LocalFree LocalReAlloc MapViewOfFile MoveFileW MultiByteToWideChar OpenEventW OpenFile OpenMutexW OpenProcess OutputDebugStringW QueryPerformanceCounter QueryWin31IniFilesMappedToRegistry RaiseException ReadFile ReadProcessMemory ReleaseMutex ResetEvent ResumeThread SearchPathW SetErrorMode SetEvent SetFilePointer SetNamedPipeHandleState SetThreadPriority SetUnhandledExceptionFilter SizeofResource Sleep SleepEx TerminateProcess UnhandledExceptionFilter UnmapViewOfFile VirtualAlloc VirtualBufferExceptionHandler VirtualFree WaitForMultipleObjectsEx WaitForSingleObject WaitNamedPipeW WideCharToMultiByte WriteFile WritePrivateProfileStringW _lclose lstrcatW lstrcmpW lstrcmpiW lstrcpy lstrcpyW lstrcpynW lstrlen lstrlenW ntdll!RtlAllocateHeap ntdll!RtlDeleteCriticalSection ntdll!RtlEnterCriticalSection ntdll!RtlFreeHeap ntdll!RtlGetLastWin32Error ntdll!RtlLeaveCriticalSection ntdll!RtlRestoreLastWin32Error - ntdll.dll:
CsrNewThread DbgPrint NlsMbCodePageTag NtAccessCheck NtAccessCheckAndAuditAlarm NtAccessCheckByType NtAccessCheckByTypeAndAuditAlarm NtAccessCheckByTypeResultList NtAccessCheckByTypeResultListAndAuditAlarm NtAccessCheckByTypeResultListAndAuditAlarmByHandle NtAdjustGroupsToken NtAdjustPrivilegesToken NtAllocateLocallyUniqueId NtAllocateVirtualMemory NtClearEvent NtClose NtCloseObjectAuditAlarm NtCompareTokens NtCreateEvent NtCreateFile NtCreateKey NtCreateSemaphore NtDeleteKey NtDeleteObjectAuditAlarm NtDeleteValueKey NtDeviceIoControlFile NtDuplicateObject NtDuplicateToken NtEnumerateKey NtEnumerateValueKey NtFilterToken NtFlushBuffersFile NtFlushKey NtFreeVirtualMemory NtFsControlFile NtImpersonateAnonymousToken NtLoadKey NtNotifyChangeKey NtNotifyChangeMultipleKeys NtOpenFile NtOpenKey NtOpenObjectAuditAlarm NtOpenProcess NtOpenProcessToken NtOpenSymbolicLinkObject NtOpenThreadToken NtPowerInformation NtPrivilegeCheck NtPrivilegeObjectAuditAlarm NtPrivilegedServiceAuditAlarm NtQueryInformationFile NtQueryInformationProcess NtQueryInformationThread NtQueryInformationToken NtQueryKey NtQueryMultipleValueKey NtQueryPerformanceCounter NtQuerySecurityObject NtQuerySymbolicLinkObject NtQuerySystemInformation NtQuerySystemTime NtQueryValueKey NtQueryVirtualMemory NtQueryVolumeInformationFile NtReadFile NtReleaseSemaphore NtReplaceKey NtRestoreKey NtSaveKey NtSaveKeyEx NtSaveMergedKeys NtSetEvent NtSetInformationFile NtSetInformationObject NtSetInformationProcess NtSetInformationThread NtSetInformationToken NtSetSecurityObject NtSetValueKey NtTerminateProcess NtTraceEvent NtUnloadKey NtWaitForMultipleObjects NtWaitForSingleObject NtWriteFile RtlAbsoluteToSelfRelativeSD RtlAddAccessAllowedAce RtlAddAccessAllowedAceEx RtlAddAccessAllowedObjectAce RtlAddAccessDeniedAce RtlAddAccessDeniedAceEx RtlAddAccessDeniedObjectAce RtlAddAce RtlAddAuditAccessAce RtlAddAuditAccessAceEx RtlAddAuditAccessObjectAce RtlAdjustPrivilege RtlAllocateAndInitializeSid RtlAllocateHandle RtlAllocateHeap RtlAnsiStringToUnicodeSize RtlAnsiStringToUnicodeString RtlAppendUnicodeStringToString RtlAppendUnicodeToString RtlAreAllAccessesGranted RtlAreAnyAccessesGranted RtlCompareMemory RtlCompareUnicodeString RtlConvertSidToUnicodeString RtlConvertToAutoInheritSecurityObject RtlCopyLuid RtlCopySid RtlCopyUnicodeString RtlCreateAcl RtlCreateHeap RtlCreateQueryDebugBuffer RtlCreateSecurityDescriptor RtlCreateUnicodeString RtlCreateUnicodeStringFromAsciiz RtlDeleteAce RtlDeleteCriticalSection RtlDeleteElementGenericTable RtlDeleteSecurityObject RtlDestroyHandleTable RtlDestroyHeap RtlDestroyQueryDebugBuffer RtlDetermineDosPathNameType_U RtlDosPathNameToNtPathName_U RtlDuplicateUnicodeString RtlEnterCriticalSection RtlEnumerateGenericTableWithoutSplaying RtlEqualPrefixSid RtlEqualSid RtlEqualUnicodeString RtlExpandEnvironmentStrings_U RtlFirstFreeAce RtlFlushSecureMemoryCache RtlFormatCurrentUserKeyPath RtlFreeAnsiString RtlFreeAnsiString RtlFreeHandle RtlFreeHeap RtlFreeSid RtlGUIDFromString RtlGetAce RtlGetControlSecurityDescriptor RtlGetDaclSecurityDescriptor RtlGetFullPathName_U RtlGetGroupSecurityDescriptor RtlGetNtProductType RtlGetOwnerSecurityDescriptor RtlGetSaclSecurityDescriptor RtlGetSecurityDescriptorRMControl RtlGetVersion RtlIdentifierAuthoritySid RtlImageNtHeader RtlImpersonateSelf RtlInitAnsiString RtlInitString RtlInitUnicodeString RtlInitUnicodeStringEx RtlInitializeCriticalSection RtlInitializeGenericTable RtlInitializeHandleTable RtlInitializeSid RtlInsertElementGenericTable RtlIntegerToUnicodeString RtlIsGenericTableEmpty RtlIsTextUnicode RtlIsValidIndexHandle RtlLeaveCriticalSection RtlLengthRequiredSid RtlLengthSecurityDescriptor RtlLengthSid RtlLookupElementGenericTable RtlMakeSelfRelativeSD RtlMapGenericMask RtlMultiByteToUnicodeN RtlNewSecurityObject RtlNewSecurityObjectEx RtlNewSecurityObjectWithMultipleInheritance RtlNtStatusToDosError RtlNumberGenericTableElements RtlOemStringToUnicodeString RtlOpenCurrentUser RtlPrefixUnicodeString RtlQueryInformationAcl RtlQueryProcessDebugInformation RtlQueryRegistryValues RtlQuerySecurityObject RtlRandom RtlReAllocateHeap RtlSelfRelativeToAbsoluteSD RtlSelfRelativeToAbsoluteSD2 RtlSetControlSecurityDescriptor RtlSetDaclSecurityDescriptor RtlSetGroupSecurityDescriptor RtlSetInformationAcl RtlSetOwnerSecurityDescriptor RtlSetSaclSecurityDescriptor RtlSetSecurityDescriptorRMControl RtlSetSecurityObject RtlSetSecurityObjectEx RtlStringFromGUID RtlSubAuthorityCountSid RtlSubAuthoritySid RtlTimeToSecondsSince1970 RtlUnicodeStringToAnsiSize RtlUnicodeStringToAnsiString RtlUnicodeStringToInteger RtlUnicodeToMultiByteN RtlUnicodeToMultiByteSize RtlUnwind RtlUpcaseUnicodeChar RtlUpcaseUnicodeStringToOemString RtlValidAcl RtlValidRelativeSecurityDescriptor RtlValidSecurityDescriptor RtlValidSid _alloca_probe _alloca_probe _ftol _itow _snwprintf _strcmpi _strnicmp _ultow _vsnwprintf _wcsicmp _wcslwr _wcsnicmp atol iswctype mbstowcs memmove sprintf strchr strncpy strstr swprintf tolower wcscat wcschr wcscmp wcscpy wcslen wcsncmp wcsncpy wcsrchr wcsstr wcstol wcstombs wcstoul - RPCRT4.dll:
I_RpcBindingIsClientLocal I_RpcExceptionFilter I_RpcMapWin32Status NDRCContextBinding NdrClientCall2 RpcBindingFree RpcBindingFromStringBindingW RpcBindingSetAuthInfoA RpcBindingSetAuthInfoExA RpcBindingSetAuthInfoExW RpcBindingSetAuthInfoW RpcBindingToStringBindingW RpcEpResolveBinding RpcImpersonateClient RpcMgmtStatsVectorFree RpcRaiseException RpcRevertToSelf RpcSsDestroyClientContext RpcStringBindingComposeW RpcStringBindingParseW UuidCreate UuidFromStringW UuidToStringW