| Windows 10 DLL File Information - dbgeng.dll |
The following DLL report was generated by automatic DLL script that scanned and loaded all DLL files in the system32 directory of Windows 10, extracted the information from them, and then saved it into HTML reports. If you want to view a report of another DLL, go to the main page of this Web site.
General Information
| File Description: | Windows Symbolic Debugger Engine |
| File Version: | 10.0.10130.0 (fbl_impressive.150522-2224) |
| Company: | Microsoft Corporation |
| Product Name: | Microsoft® Windows® Operating System |
| DLL popularity | Very Low - There is no any other DLL in system32 directory that is statically linked to this file. |
| File Size: | 3,780 KB |
| Total Number of Exported Functions: | 4 |
| Total Number of Exported Functions With Names: | 4 |
Section Headers
| Name | Virtual Address | Raw Data Size | % of File | Characteristics | Section Contains... |
|---|---|---|---|---|---|
| .text | 0x00001000 | 3,431,424 Bytes | 88.6% | Read, Execute | Code |
| PAGER32C6 | 0x00347000 | 3,072 Bytes | 0.1% | Read, Execute | Code |
| .data | 0x00348000 | 180,736 Bytes | 4.7% | Write, Read | Initialized Data |
| .idata | 0x003aa000 | 10,752 Bytes | 0.3% | Read | Initialized Data |
| .didat | 0x003ad000 | 512 Bytes | 0.0% | Write, Read | Initialized Data |
| .mrdata | 0x003ae000 | 6,144 Bytes | 0.2% | Read | Initialized Data |
| .rsrc | 0x003b0000 | 24,576 Bytes | 0.6% | Read | Initialized Data |
| .reloc | 0x003b6000 | 212,992 Bytes | 5.5% | Read, Discardable | Initialized Data |
Static Linking
dbgeng.dll is statically linked to the following files:msvcrt.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
RPCRT4.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-misc-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-localregistry-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-io-l1-1-0.dll
dbgmodel.dll
bcrypt.dll
dbghelp.dll
ntdll.dll
XmlLite.dll
OLEAUT32.dll
api-ms-win-core-delayload-l1-1-0.dll
api-ms-win-security-base-l1-1-0.dll
This means that when dbgeng.dll is loaded, the above files are automatically loaded too. If one of these files is corrupted or missing, dbgeng.dll won't be loaded.
General Resources Information
| Resource Type | Number of Items | Total Size | % of File |
|---|---|---|---|
| Icons | 0 | 0 Bytes | 0.0% |
| Animated Icons | 0 | 0 Bytes | 0.0% |
| Cursors | 0 | 0 Bytes | 0.0% |
| Animated Cursors | 0 | 0 Bytes | 0.0% |
| Bitmaps | 0 | 0 Bytes | 0.0% |
| AVI Files | 0 | 0 Bytes | 0.0% |
| Dialog-Boxes | 0 | 0 Bytes | 0.0% |
| HTML Related Files | 0 | 0 Bytes | 0.0% |
| Menus | 0 | 0 Bytes | 0.0% |
| Strings | 116 | 22,712 Bytes | 0.6% |
| Type Libraries | 0 | 0 Bytes | 0.0% |
| Manifest | 0 | 0 Bytes | 0.0% |
| All Others | 1 | 940 Bytes | 0.0% |
| Total | 117 | 23,652 Bytes | 0.6% |
Icons in this file
No icons found in this file
Cursors in this file
No cursors found in this file
Dialog-boxes list (up to 1000 dialogs)
No dialog resources in this file.
String resources in this dll (up to 1000 strings)
| String ID | String Text |
|---|---|
| 101 | Causes the debugger to automatically save all settings to the most recently loaded configuration file upon changing a setting. |
| 102 | Set or alter the symbol path. The symbol path specifies locations where the debugger looks for symbol files. |
| 103 | Allows DbgHelp to read symbols that are stored at an absolute address in memory. |
| 104 | Causes DbgHelp to search the public symbol table in a .pdb file only as a last resort. If any matches are found when searching the private symbol data, the public symbols will not be searched. This improves symbol search speed. |
| 105 | Causes all searches for symbol names to be case-insensitive. |
| 106 | When code has been optimized and there is no symbol at the expected location, this option causes the nearest symbol to be used instead. |
| 107 | Causes the symbol handler to ignore the CV record in the loaded image header when searching for symbols. |
| 108 | Causes public symbol names to be undecorated when they are displayed, and causes searches for symbol names to ignore symbol decorations. |
| 109 | No Description |
| 110 | Reduces the pickiness of the symbol handler when it is attempting to match symbols. |
| 111 | When active, symbols are not actually loaded when the target modules are loaded. |
| 112 | Turns on noisy symbol loading. This instructs the debugger to display information about its search for symbols. |
| 113 | Disables the symbol handler's automatic loading of modules. When this option is set and the debugger attempts to match a symbol, it will only search modules which have already been loaded. |
| 114 | Causes DbgHelp to ignore private symbol data, and search only the public symbol table for symbol information. This emulates the behavior of DbgHelp before support for these types was added. |
| 115 | (Kernel mode only) indicates whether Secure Mode is active. |
| 116 | Causes file access error dialog boxes to be suppressed. |
| 117 | Causes the debugger to perform a strict evaluation of all symbol files. |
| 118 | Prevents DbgHelp from searching the public symbol table. This can make symbol enumeration and symbol searches much faster. If you are concerned solely with search speed, the SYMOPT_AUTO_PUBLICS option is generally preferable to this one. |
| 119 | Suppresses authentication dialog boxes from the proxy server. This may result in SymSrv being unable to access a symbol store on the internet. |
| 120 | Controls C++ translation. When this symbol option is set, :: is replaced by __ in all symbols. |
| 121 | Prevents DbgHelp from searching the disk for a copy of the image when symbols are loaded. |
| 122 | Causes the debugger to ignore the environment variable settings for the symbol path and the executable image path. |
| 123 | Disables allowing symbol loading to use multiple threads. |
| 124 | Set or alter the extension DLL search path. |
| 125 | Automatic downloading of extensions from the extension repository. An implicit update is when we update 'ext.dll' when executing '!analyze' for instance. Can be set to Explicit, Implicit, or Disable. |
| 126 | Enables or disables support for source-line information. |
| 127 | Set or alter the source file search path. |
| 128 | Sets the default length of a stack trace display. |
| 129 | Specifies whether the debugger displays USHORT pointers and arrays as Unicode strings. |
| 130 | Sets the default behavior for commands that are capable of providing output in the Debugger Markup Language (DML) format. |
| 131 | Sets the default number base (radix) to the specified value. |
| 132 | Specifies whether integers are displayed in decimal format or in the default radix. |
| 133 | Prevents the debugger from checking the width of lines in the disassembly display. |
| 134 | (x86 and x64 targets only) Suppresses the display of raw bytes. |
| 135 | Prefixes each line of disassembly with the line number of the source code. |
| 136 | Network shares cannot be used for loading symbols and extensions. |
| 137 | Disables upload of Software Quality Metrics (SQM) data. |
| 138 | Disallow executing shell commands through the debugger. After this option has been set, it cannot be unset. |
| 139 | Controls debugger settings and configurations. |
| 140 | All settings related to the loading and interaction with symbols. |
| 141 | Modifies how symbols are loaded and used. |
| 142 | Advanced settings related to symbols, do not modify these unless you know what you're doing. |
| 143 | Settings related to the loading of extensions and individual extension settings. |
| 144 | Settings related to the display of sources when debugging. |
| 145 | Settings related to the information displayed by the debugger. |
| 146 | Settings related to the way code is disassembled and displayed. |
| 147 | Settings related to the initialization of the engine(these may require a restart of the session to take effect). |
| 148 | Indicates the minimum version of the 'What's New' banner to display. A high value will prevent banner display. |
| 149 | Settings related to input to the debugger and its various commands. |
| 150 | Use the extension evaluator (dx) as a replacement for the C++ evaluator (??) |
| 151 | State for any guest execution on this thread (e.g.: a WoW execution context) |
| 152 | Indicates the architecture that is a guest on this thread (e.g.: the architecture that WoW is simulating or running) |
| 153 | Use DataModel visualization engine for displaying locals/Watch window context |
| 154 | State pertaining to the current execution of the debugger (e.g.: user variables) |
| 155 | User variables which are maintained by the debugger and can be referenced by a pseudo-register prefix of @$ |
| 156 | Categorizied debugger managed pseudo-registers which can be referenced by a pseudo-register prefix of @$ |
| 157 | The result of the last expression evaluation. Referencable via @$exp |
| 158 | The effective address of the last instruction that executed (if such exists). Referencable via @$ea |
| 159 | The second effective address of the last instruction that executed (if such exists). Referencable via @$ea2 |
| 160 | The value that the last d* (Display Memory) command printed. Referencable via @$p |
| 161 | The return address that is currently on the stack. Referencable via @$ra |
| 162 | The address of the current thread (the ETHREAD in kernel mode, the TEB in user mode). Referencable via @$thread |
| 163 | The address of the current process (the EPROCESS in kernel mode, the PEB in user mode). Referencable via @$proc |
| 164 | The address of the thread environment block (TEB) of the current thread. Referencable via @$teb |
| 165 | The address of the process environment block (PEB) of the current thread. Referencable via @$peb |
| 166 | The thread id of the current thread. Referencable via @$tid |
| 167 | The process id of the currently executing thread. Referencable via @$tpid |
| 168 | The value of the primary return value register. Referencable via @$retreg |
| 169 | The value of the primary return value register in 64-bit format (e.g.: the edx:eax pair on x86). Referencable via @$retreg64 |
| 170 | The value of the instruction pointer register. Referencable via @$ip |
| 171 | The value of the instruction pointer at the time of the current event. This typically matches @$ip unless you switched threads or manually changed the instruction pointer. Referencable via @$eventip |
| 172 | The value of the instruction pointer at the time of the previous event. Referencable via @$previp |
| 173 | The value of an instruction pointer related to the current event. When you are branch tracing, this pointer is the pointer to the branch source. Referencable via @$relip |
| 174 | A user defined value referencable via @$t# where # is a numeric 0 - 19. Referencable via @$t# |
| 175 | The address of the entry point of the first executable of the current process. Referencable via @$exentry |
| 176 | The debugger id of the current thread. Referencable via @$dtid |
| 177 | The debugger id of the current process. Referencable via @$dpid |
| 178 | The debugger id of the current system (or session). Referencable via @$dsid |
| 179 | The current frame index. This index is the same frame number that the .frame (Set Local Context) command uses. Referencable via @$frame |
| 180 | The debugger id of the breakpoint which caused the debuggee to stop. Referencable via @$bphit |
| 181 | The value of the instruction pointer for the current local context (also known as the scope). Referenced via @$scopeip |
| 182 | The address of the common language ruintime (CLR) exception object. Referenced via @$clrex |
| 183 | The address of the last encountered common language runtime (CLR) exception object. Referenced via @$lastclrex |
| 184 | The current time, according to the computer that the debugger is running on. Referenced via @$dbgtime |
| 185 | The value of the current call stack pointer. This pointer is the register that is most representative of call stack depth. Referenced via @$csp |
| 186 | The return value of the last function that .call (call function) called or that is used in an .fnret /s command. The data type of @$callret is the data type of this return value. Referenced via @$callret |
| 187 | Indicates what chance of exception the debugger is processing. Referenced via @$exr_chance |
| 188 | Indicates the code of exception that the debugger is processing. Referenced via @$exr_code |
| 189 | Indicates the number of parameters for the exception that the debugger is processing. Referenced via @$exr_numparams |
| 190 | The #th parameter of the exception that the debugger is processing where # is a numeric 0-14. Referencable via @$exr_param# |
| 192 | The size of a pointer. Referencable via @$ptrsize |
| 193 | The number of bytes in one page of memory. Referencable via @$pagesize |
| 195 | The address of the KPCR for the current processor. Only available in kernel mode. Referencable via @$pcr |
| 196 | The address of the KPRCB for the current processor. Only available in kernel mode. Referencable via @$prcb |
| 197 | The current value of the register containing the first argument to functions. Referencable via @$argreg |
| 198 | The bugcheck code that the debugger is currently processing. Referencable via @$bug_code |
| 199 | The #th parameter of the bugcheck that the debugger is processing where # is a numeric 0-3. Referencable via @$bug_param# |
| 200 | Add(Name, Value) - Method which adds a variable of the specified name to the list of user variables |
| 201 | Clear() - Method which removes all user variables |
| 202 | Remove(Name) - Method which removes a variable from the list of user variables |
| 203 | Generally useful pseudo-registers |
| 204 | Pseudo-registers which alias machine specific registers by general names |
| 205 | Pseudo-registers which are available for user temporary storage |
| 206 | Pseudo-registers which are only relevant to kernel debugging |
| 207 | Pseudo-registers related to error handling, exceptions, and bug checks |
| 208 | Debugger variables which are owned by the debugger and can be referenced by a pseudo-register prefix of @$ |
| 209 | Refers to the session (system) that is currently active in the debugger interface. Referencable via @$cursession |
| 210 | Refers to the process that is currently active in the debugger interface. Referencable via @$curprocess |
| 211 | Refers to the thread that is currently active in the debugger interface. Referencable via @$curthread |
| 212 | Refers to the stack frame that is currently active in the debugger interface. Referencable via @$curframe |
| 213 | Refers to the collection of user managed variables. Referencable via @$vars |
| 214 | General utility methods for debugger users |
| 215 | Utility methods pertaining to collection objects and collection types |
| 216 | FromListEntry(ListEntry, TypeName, FieldExpression) - Method which converts a LIST_ENTRY specified by the 'ListEntry' parameter of types whose name is specified by the string 'TypeName' and whose embedded links within that type are accessed via an expression specified by the string 'FieldExpression' into a collection object |
| 217 | Indicates the default recursion depth to use when displaying via the data model [dx -r#] |
| 218 | If not set, the debugger will call function table unwind callback DLLs installed through API calls to RtlInstallFunctionTableCallback without requiring the DLL to be explicitly known to the system |
COM Classes/Interfaces
There is no type library in this file with COM classes/interfaces information
Exported Functions List
The following functions are exported by this dll:| DebugConnect | DebugConnectWide | DebugCreate | DebugCreateEx |
Imported Functions List
The following functions are imported by this dll:- msvcrt.dll:
_CIlog _CIpow _CxxThrowException _XcptFilter __CxxFrameHandler __dllonexit __doserrno _amsg_exit _callnewh _errno _except_handler4_common _ftol2 _ftol2_sse _initterm _itow_s _lock _memicmp _onexit _purecall _set_errno _snwprintf_s _spawnlp _strcmpi _strcmpi _strlwr _strnicmp _strtoui64 _ui64tow_s _ultow_s _unlock _vscwprintf _vsnprintf _vsnwprintf _wcsdup _wcsicmp _wcslwr _wcsnicmp _wcstoui64 _wcsupr _wctime _wfopen _wgetenv _wsetlocale _wsplitpath_s _wtoi _wtol atoi atol calloc ctime div fclose feof fgets fgetws fprintf free frexp fseek ftell getenv isalnum isalpha isdigit isprint isspace iswalnum iswalpha iswdigit iswprint iswspace iswupper iswxdigit ldexp malloc memcmp memcpy memcpy_s memmove memmove_s memset printf public: __thiscall exception::exception(char const * const &) public: __thiscall exception::exception(char const * const &,int) public: __thiscall exception::exception(class exception const &) public: virtual __thiscall exception::~exception(void) public: virtual __thiscall type_info::~type_info(void) public: virtual char const * __thiscall exception::what(void)const qsort realloc sscanf_s strchr strncmp strnlen strpbrk strrchr strstr swprintf_s swscanf time towlower towupper void __cdecl operator delete(void *) void __cdecl operator delete[](void *) void __cdecl terminate(void) vswprintf_s wcscat_s wcschr wcscpy_s wcsncmp wcsncpy_s wcsnlen wcsrchr wcsstr wcstod wcstol wcstoul - api-ms-win-core-processenvironment-l1-1-0.dll:
KernelBase!ExpandEnvironmentStringsW KernelBase!GetCommandLineW KernelBase!GetCurrentDirectoryW KernelBase!GetEnvironmentVariableW KernelBase!SearchPathW KernelBase!SetEnvironmentVariableA KernelBase!SetEnvironmentVariableW - api-ms-win-core-debug-l1-1-0.dll:
KernelBase!DebugBreak KernelBase!OutputDebugStringA - api-ms-win-core-string-l1-1-0.dll:
KernelBase!CompareStringOrdinal KernelBase!CompareStringW KernelBase!MultiByteToWideChar KernelBase!WideCharToMultiByte - api-ms-win-core-errorhandling-l1-1-0.dll:
KernelBase!GetLastError KernelBase!RaiseException KernelBase!SetErrorMode KernelBase!SetUnhandledExceptionFilter KernelBase!UnhandledExceptionFilter ntdll!RtlRestoreLastWin32Error - RPCRT4.dll:
UuidCreate - api-ms-win-core-synch-l1-1-0.dll:
KernelBase!CreateEventA KernelBase!CreateEventW KernelBase!CreateMutexW KernelBase!InitializeCriticalSectionEx KernelBase!OpenProcess KernelBase!ReleaseMutex KernelBase!ReleaseSemaphore KernelBase!ResetEvent KernelBase!SetEvent KernelBase!SleepEx KernelBase!WaitForMultipleObjectsEx KernelBase!WaitForSingleObject KernelBase!WaitForSingleObjectEx ntdll!RtlAcquireSRWLockExclusive ntdll!RtlDeleteCriticalSection ntdll!RtlEnterCriticalSection ntdll!RtlInitializeCriticalSection ntdll!RtlLeaveCriticalSection ntdll!RtlReleaseSRWLockExclusive - api-ms-win-core-processthreads-l1-1-0.dll:
KernelBase!OpenProcessToken kernel32!CreateProcessW kernel32!CreateRemoteThread kernel32!CreateThread kernel32!GetCurrentProcess kernel32!GetCurrentProcessId kernel32!GetCurrentThread kernel32!GetCurrentThreadId kernel32!GetExitCodeProcess kernel32!GetExitCodeThread kernel32!GetPriorityClass kernel32!GetProcessTimes kernel32!GetThreadPriority kernel32!QueueUserAPC kernel32!ResumeThread kernel32!SuspendThread kernel32!TerminateProcess kernel32!TerminateThread ntdll!RtlExitUserThread - api-ms-win-core-sysinfo-l1-1-0.dll:
KernelBase!GetComputerNameExW KernelBase!GetLocalTime KernelBase!GetSystemDirectoryW KernelBase!GetSystemInfo KernelBase!GetSystemTimeAsFileTime KernelBase!GetTickCount KernelBase!GetTimeZoneInformation KernelBase!GetVersionExA KernelBase!GetVersionExW KernelBase!SystemTimeToFileTime - api-ms-win-core-handle-l1-1-0.dll:
KernelBase!CloseHandle KernelBase!DuplicateHandle - api-ms-win-core-misc-l1-1-0.dll:
KernelBase!FormatMessageW KernelBase!LocalAlloc KernelBase!LocalFree KernelBase!Sleep KernelBase!lstrcmpiW - api-ms-win-core-libraryloader-l1-1-0.dll:
KernelBase!DisableThreadLibraryCalls KernelBase!FreeLibrary KernelBase!FreeLibraryAndExitThread KernelBase!GetModuleFileNameA KernelBase!GetModuleFileNameW KernelBase!GetModuleHandleA KernelBase!GetModuleHandleExW KernelBase!GetModuleHandleW KernelBase!GetProcAddress KernelBase!LoadLibraryExA KernelBase!LoadLibraryExW KernelBase!LoadResource KernelBase!LoadStringW KernelBase!LockResource KernelBase!SizeofResource - api-ms-win-core-memory-l1-1-0.dll:
KernelBase!CreateFileMappingW KernelBase!MapViewOfFile KernelBase!ReadProcessMemory KernelBase!UnmapViewOfFile KernelBase!VirtualAlloc KernelBase!VirtualAllocEx KernelBase!VirtualFree KernelBase!VirtualFreeEx KernelBase!VirtualProtect KernelBase!VirtualProtectEx KernelBase!VirtualQuery KernelBase!VirtualQueryEx KernelBase!WriteProcessMemory - api-ms-win-core-localregistry-l1-1-0.dll:
KernelBase!RegCloseKey KernelBase!RegCreateKeyExW KernelBase!RegDeleteValueW KernelBase!RegEnumValueW KernelBase!RegOpenKeyExA KernelBase!RegOpenKeyExW KernelBase!RegQueryValueExA KernelBase!RegQueryValueExW - api-ms-win-core-file-l1-1-0.dll:
KernelBase!CreateDirectoryW KernelBase!CreateFileA KernelBase!CreateFileW KernelBase!DeleteFileA KernelBase!DeleteFileW KernelBase!FileTimeToLocalFileTime KernelBase!FileTimeToSystemTime KernelBase!FindClose KernelBase!FindFirstFileA KernelBase!FindFirstFileW KernelBase!FindNextFileW KernelBase!GetDriveTypeW KernelBase!GetFileAttributesW KernelBase!GetFileSize KernelBase!GetFileSizeEx KernelBase!GetFileTime KernelBase!GetFullPathNameW KernelBase!GetTempFileNameW KernelBase!ReadFile KernelBase!SetFilePointer KernelBase!SetFilePointerEx KernelBase!WriteFile - api-ms-win-core-profile-l1-1-0.dll:
ntdll!RtlQueryPerformanceCounter ntdll!RtlQueryPerformanceFrequency - api-ms-win-core-heap-l1-1-0.dll:
KernelBase!GetProcessHeap KernelBase!HeapCreate KernelBase!HeapDestroy ntdll!RtlAllocateHeap ntdll!RtlFreeHeap ntdll!RtlReAllocateHeap - api-ms-win-core-io-l1-1-0.dll:
kernel32!DeviceIoControl kernel32!GetOverlappedResult - dbgmodel.dll:
CreateDataModelManager - bcrypt.dll:
BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDestroyHash BCryptFinishHash BCryptGetProperty BCryptHashData BCryptOpenAlgorithmProvider - dbghelp.dll:
DbgHelpCreateUserDump FindExecutableImageExW GetTimestampForLoadedLibrary ImageDirectoryEntryToDataEx ImageNtHeader ImageRvaToVa ImagehlpApiVersionEx RemoveInvalidModuleList ReportSymbolLoadSummary SetCheckUserInterruptShared SetSymLoadError StackWalkEx SymAddSymbol SymAddSymbolW SymAddrIncludeInlineTrace SymCleanup SymCompareInlineTrace SymDeleteSymbolW SymEnumLinesW SymEnumSourceLinesW SymEnumSymbolsExW SymEnumSymbolsForAddrW SymEnumSymbolsW SymEnumTypesByNameW SymEnumTypesW SymFindFileInPathW SymFreeDiaString SymFromAddrW SymFromIndexW SymFromInlineContextW SymFromNameW SymFromTokenW SymFunctionTableAccess64 SymGetDiaSession SymGetFileLineOffsets64 SymGetHomeDirectoryW SymGetLineFromAddrW64 SymGetLineFromInlineContextW SymGetLineFromNameW64 SymGetModuleInfoW64 SymGetOptions SymGetSourceFileFromTokenW SymGetSourceFileTokenW SymGetSourceVarFromTokenW SymGetTypeFromNameW SymGetTypeInfo SymGetTypeInfoEx SymGetUnwindInfo SymInitializeW SymLoadModule64 SymLoadModuleExW SymMatchFileNameW SymMatchStringA SymMatchStringW SymNextW SymPrevW SymQueryInlineTrace SymRegisterCallbackW64 SymRegisterFunctionEntryCallback64 SymSearchW SymSetOptions SymSetScopeFromIndex SymSetScopeFromInlineContext SymSetSearchPathW SymUnloadModule64 dbghelp - ntdll.dll:
DbgPrintEx NtAllocateVirtualMemory NtClose NtFreeVirtualMemory NtQuerySystemInformation NtSetTimerResolution RtlCompareMemory RtlCopyContext RtlReleasePebLock RtlTryAcquirePebLock - XmlLite.dll:
CreateXmlReader CreateXmlWriter - OLEAUT32.dll:
SysAllocString SysFreeString VariantChangeType VariantClear VariantCopy VariantInit - api-ms-win-core-delayload-l1-1-0.dll:
KernelBase!DelayLoadFailureHook - api-ms-win-security-base-l1-1-0.dll:
KernelBase!AddAccessAllowedAce KernelBase!AddAccessDeniedAce KernelBase!AdjustTokenPrivileges KernelBase!AllocateAndInitializeSid KernelBase!CheckTokenMembership KernelBase!FreeSid KernelBase!GetLengthSid KernelBase!InitializeAcl KernelBase!InitializeSecurityDescriptor KernelBase!SetSecurityDescriptorDacl