| Windows 10 DLL File Information - samsrv.dll |
The following DLL report was generated by automatic DLL script that scanned and loaded all DLL files in the system32 directory of Windows 10, extracted the information from them, and then saved it into HTML reports. If you want to view a report of another DLL, go to the main page of this Web site.
General Information
| File Description: | SAM Server DLL |
| File Version: | 10.0.10130.0 (fbl_impressive.150522-2224) |
| Company: | Microsoft Corporation |
| Product Name: | Microsoft® Windows® Operating System |
| DLL popularity | Very Low - There is no any other DLL in system32 directory that is statically linked to this file. |
| File Size: | 686 KB |
| Total Number of Exported Functions: | 323 |
| Total Number of Exported Functions With Names: | 323 |
Section Headers
| Name | Virtual Address | Raw Data Size | % of File | Characteristics | Section Contains... |
|---|---|---|---|---|---|
| .text | 0x00001000 | 620,032 Bytes | 88.3% | Read, Execute | Code |
| .data | 0x00099000 | 6,656 Bytes | 0.9% | Write, Read | Initialized Data |
| .idata | 0x0009d000 | 12,800 Bytes | 1.8% | Read | Initialized Data |
| .didat | 0x000a1000 | 512 Bytes | 0.1% | Write, Read | Initialized Data |
| .rsrc | 0x000a2000 | 33,280 Bytes | 4.7% | Read | Initialized Data |
| .reloc | 0x000ab000 | 28,160 Bytes | 4.0% | Read, Discardable | Initialized Data |
Static Linking
samsrv.dll is statically linked to the following files:msvcrt.dll
api-ms-win-core-file-l1-2-1.dll
api-ms-win-core-registry-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-1.dll
api-ms-win-core-sysinfo-l1-2-1.dll
api-ms-win-core-processthreads-l1-1-2.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-libraryloader-l1-2-0.dll
api-ms-win-core-heap-l2-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-security-base-l1-2-0.dll
api-ms-win-core-string-l1-1-0.dll
bcrypt.dll
api-ms-win-core-rtlsupport-l1-2-0.dll
api-ms-win-core-processenvironment-l1-2-0.dll
api-ms-win-core-localization-l1-2-1.dll
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-heap-l1-2-0.dll
api-ms-win-core-kernel32-legacy-l1-1-1.dll
api-ms-win-core-privateprofile-l1-1-1.dll
api-ms-win-core-string-obsolete-l1-1-0.dll
api-ms-win-core-apiquery-l1-1-0.dll
api-ms-win-security-lsalookup-l1-1-1.dll
LSASRV.dll
ntdll.dll
api-ms-win-core-memory-l1-1-2.dll
api-ms-win-core-delayload-l1-1-1.dll
CRYPT32.dll
api-ms-win-eventing-provider-l1-1-0.dll
This means that when samsrv.dll is loaded, the above files are automatically loaded too. If one of these files is corrupted or missing, samsrv.dll won't be loaded.
General Resources Information
| Resource Type | Number of Items | Total Size | % of File |
|---|---|---|---|
| Icons | 0 | 0 Bytes | 0.0% |
| Animated Icons | 0 | 0 Bytes | 0.0% |
| Cursors | 0 | 0 Bytes | 0.0% |
| Animated Cursors | 0 | 0 Bytes | 0.0% |
| Bitmaps | 0 | 0 Bytes | 0.0% |
| AVI Files | 0 | 0 Bytes | 0.0% |
| Dialog-Boxes | 0 | 0 Bytes | 0.0% |
| HTML Related Files | 0 | 0 Bytes | 0.0% |
| Menus | 0 | 0 Bytes | 0.0% |
| Strings | 2 | 748 Bytes | 0.1% |
| Type Libraries | 0 | 0 Bytes | 0.0% |
| Manifest | 0 | 0 Bytes | 0.0% |
| All Others | 5 | 102,962 Bytes | 14.7% |
| Total | 7 | 103,710 Bytes | 14.8% |
Icons in this file
No icons found in this file
Cursors in this file
No cursors found in this file
Dialog-boxes list (up to 1000 dialogs)
No dialog resources in this file.
String resources in this dll (up to 1000 strings)
| String ID | String Text |
|---|---|
| 1 | Security Accounts Manager |
| 2 | The startup of this service signals other services that the Security Accounts Manager (SAM) is ready to accept requests. Disabling this service will prevent other services in the system from being notified when the SAM is ready, which may in turn cause those services to fail to start correctly. This service should not be disabled. |
COM Classes/Interfaces
There is no type library in this file with COM classes/interfaces information
Exported Functions List
The following functions are exported by this dll:| RtlDeleteElementGenericTable2 | RtlInitializeGenericTable2 |
| RtlInsertElementGenericTable2 | RtlLookupElementGenericTable2 |
| SAM_MIDL_user_allocate | SAM_MIDL_user_free |
| SamDsExtAlloc | SamDsExtFree |
| SamIAccountRestrictions | SamIAddDSNameToAlias |
| SamIChangePasswordForeignUser | SamIClaimIsValid |
| SamIConnect | SamIConvertSecurityAttributesToClaimsBlob |
| SamICopyCurrentDomainAccountSettings | SamICreateKrbTgt |
| SamIDecodeClaimsBlob | SamIDecodeClaimsBlobIntoClaimsSet |
| SamIDecodeClaimsBlobToAuthz | SamIDemote |
| SamIDemoteUndo | SamIDoFSMORoleChange |
| SamIFreeAuthzSecurityAttributesInfo | SamIFreeClaimsBlob |
| SamIFreeDecodedClaimsSet | SamIFreeLookupNamesInfo |
| SamIFreeLookupSidsInfo | SamIFreeOidList |
| SamIFreeRealmList | SamIFreeSecurityAttributesInfo |
| SamIFreeSidAndAttributesList | SamIFreeSidArray |
| SamIFreeVoid | SamIFree_SAMPR_DISPLAY_INFO_BUFFER |
| SamIFree_SAMPR_DOMAIN_INFO_BUFFER | SamIFree_SAMPR_ENUMERATION_BUFFER |
| SamIFree_SAMPR_GET_GROUPS_BUFFER | SamIFree_SAMPR_RETURNED_USTRING_ARRAY |
| SamIFree_SAMPR_ULONG_ARRAY | SamIFree_SAMPR_USER_INFO_BUFFER |
| SamIFree_UserInternal6Information | SamIGetAliasMembership |
| SamIGetConfigurationOidList | SamIGetDefaultAdministratorName |
| SamIGetResourceGroupMembershipsTransitive | SamIGetResourceGroupMembershipsTransitive2 |
| SamIGetUserLogonInformation | SamIGetUserLogonInformation2 |
| SamIGetUserLogonInformation3 | SamIGetUserLogonInformationEx |
| SamIHandleObjectUpdate | SamIImpersonateNullSession |
| SamIInitialize | SamIIsDownlevelDcUpgrade |
| SamIIsExtendedSidMode | SamIIsRebootAfterPromotion |
| SamIIsSetupInProgress | SamILoadDownlevelDatabase |
| SamILookupNamesBySid | SamILookupNamesInDomain |
| SamILookupSidsByName | SamILoopbackConnect |
| SamIMixedDomain | SamIMixedDomain2 |
| SamINT4UpgradeInProgress | SamINetLogonPing |
| SamINotifyRoleChange | SamIOpenUserByAlternateId |
| SamIPromote | SamIPromoteUndo |
| SamIPurgeSecrets | SamIQueryAccountSecretsCachability |
| SamIQueryCapabilities | SamIQueryRealmList |
| SamIQueryServerRole | SamIQueryServerRole2 |
| SamIRemoveDSNameFromAlias | SamIReplaceDownlevelDatabase |
| SamIReplicateAccountData | SamIResetBadPwdCountOnPdc |
| SamIRetrieveMultiplePrimaryCredentials | SamIRetrieveNGCKeyCredential |
| SamIRetrievePrimaryCredentials | SamIRevertNullSession |
| SamIScorePassword | SamISetAuditingInformation |
| SamISetMachinePassword | SamISetPasswordForeignUser2 |
| SamISetPasswordForeignUser3 | SamISetPasswordInfoOnDc |
| SamIStorePrimaryCredentials | SamITransformClaims |
| SamIUPNFromUserHandle | SamIUnLoadDownlevelDatabase |
| SamIUninitialize | SamIUpdateLogonStatistics |
| SamIValidateAccountName | SamIValidateNewAccountName |
| SampAccountControlToFlags | SampAcquireReadLock |
| SampAcquireSamLockExclusive | SampAcquireWriteLock |
| SampAddAccountToGroupMembers | SampAddAccountsAndApplyMemberships |
| SampAddDeltaTime | SampAddNonLocalDomainRelativeMemberships |
| SampAddSameDomainMemberToGlobalOrUniversalGroup | SampAddUserToGroup |
| SampAlInvalidateAliasInformation | SampAllocateNextCurrentRidFromIndex |
| SampApplyDomainUpdatesForAllDomains | SampAssignPrimaryGroup |
| SampAuditAccountEnableDisableChange | SampAuditAccountNameChange |
| SampAuditAnyEvent | SampAuditGroupTypeChange |
| SampAuditSidHistory | SampBuildDsNameFromSid |
| SampBuildSamProtection | SampCalculateLmAndNtOwfPasswords |
| SampChangeAliasAccountName | SampChangeGroupAccountName |
| SampChangeUserAccountName | SampCheckForAccountLockout |
| SampCheckGroupTypeBits | SampCheckSidType |
| SampCommitBufferedWrites | SampCompareDisplayStrings |
| SampComputePasswordExpired | SampConnect |
| SampConvertUiListToApiList | SampCreateAccountContext2 |
| SampCreateAliasInDomain | SampCreateContextEx |
| SampCreateDefaultUPN | SampCreateFullSid |
| SampCreateGroupInDomain | SampCreateUserInDomain |
| SampCurrentThreadOwnsLock | SampDeReferenceContext |
| SampDecrementActiveThreads | SampDecryptCredentialData |
| SampDeleteContext | SampDeleteDsDirsToDeleteKey |
| SampDeleteKeyForPostBootPromote | SampDeltaChangeNotify |
| SampDsChangePasswordUser | SampDsConvertReadAttrBlock |
| SampDsGetPrimaryDomainStart | SampDsInitializeSingleDomain |
| SampDsIsRunning | SampDsMakeAttrBlock |
| SampDsSetBuiltinDomainPolicy | SampDsSetDomainPolicy |
| SampDsSetPasswordUser | SampDsUpdateContextAttributes |
| SampDuplicateGroupInfo | SampDuplicateMachineInfo |
| SampDuplicateOemGroupInfo | SampDuplicateOemUserInfo |
| SampDuplicateUnicodeString | SampDuplicateUserInfo |
| SampEncryptCredentialData | SampExamineSid |
| SampExtendDefinedDomains | SampFlagsToAccountControl |
| SampFreeGroupInfo | SampFreeMachineInfo |
| SampFreeOemGroupInfo | SampFreeOemUserInfo |
| SampFreeUnicodeString | SampFreeUserInfo |
| SampGenerateRandomPassword | SampGetAccessAttribute |
| SampGetAccountDomainInfo | SampGetBehaviorVersion |
| SampGetCurrentOwnerAndPrimaryGroup | SampGetDisableOutboundRSO |
| SampGetDisableRSOOnPDCForward | SampGetDisableResetBadPwdCountForward |
| SampGetDisableSingleObjectRepl | SampGetDnsDomainNameFromIndex |
| SampGetDomainContextFromIndex | SampGetDomainObjectFromAccountContext |
| SampGetDomainObjectFromIndex | SampGetDomainServerRoleFromIndex |
| SampGetDomainSidFromAccountContext | SampGetDomainSidFromIndex |
| SampGetDomainSidListForSam | SampGetDomainUpgradeTasks |
| SampGetDownLevelDomainControllersPresent | SampGetExtendedAttribute |
| SampGetExternalNameFromIndex | SampGetFixedAttributes |
| SampGetHasNeverTime | SampGetIgnoreGCFailures |
| SampGetLogLevel | SampGetNT4UpgradeInProgress |
| SampGetNewAccountSecurityNt4 | SampGetNextUnmodifiedRidFromIndex |
| SampGetNoGcLogonEnforceKerberosIpCheck | SampGetNoGcLogonEnforceNTLMCheck |
| SampGetObjectSD | SampGetObjectTypeNameFromIndex |
| SampGetPasswordMustChangeWithUF_UAC | SampGetReverseMembershipTransitive |
| SampGetSamSubsystemName | SampGetSerialNumberDomain2 |
| SampGetServerObjectName | SampGetSidArrayAttribute |
| SampGetSidAttribute | SampGetSuccessAccountAuditingEnabled |
| SampGetUlongArrayAttribute | SampGetUnicodeStringAttribute |
| SampGetUserAccountControlComputed | SampGetUserAccountSettings |
| SampGetWillNeverTime | SampImpersonateClient |
| SampIncreaseBadPwdCountLoopback | SampIncrementActiveThreads |
| SampIncrementNetlogonChangeLogSerialNumber | SampInvalidateDomainCache |
| SampIsAccountBuiltIn | SampIsAuditingEnabled |
| SampIsBuiltinDomain | SampIsDomainHosted |
| SampIsServiceRunning | SampIsSetupInProgress |
| SampLogPrint | SampLookupContext |
| SampMarkPerAttributeInvalidFromWhichFields | SampNeedUserAccountSettingsDuringQuery |
| SampNetLogonNotificationRequired | SampNotifyAuditChange |
| SampNotifyReplicatedInChange | SampPasswordChangeNotify |
| SampPasswordChangeNotifyWorker | SampPositionOfHighestBit |
| SampQueryCapabilities | SampQueryInformationUserInternal |
| SampReadExtendedAttributes | SampRecordSystemSchemaVerisonInRegistry |
| SampReferenceContext | SampRegObjToDsObj |
| SampReleaseReadLock | SampReleaseSamLockExclusive |
| SampReleaseWriteLock | SampRemoveAccountFromGroupMembers |
| SampRemoveSameDomainMemberFromGlobalOrUniversalGroup | SampRemoveUserFromGroup |
| SampRenameKrbtgtAccount | SampReplaceUserLogonHours |
| SampReplaceUserV1aFixed | SampRetrieveGroupV1Fixed |
| SampRetrieveMultipleCredentials | SampRetrieveUserPasswords |
| SampRetrieveUserV1aFixed | SampRevertToSelf |
| SampRtlWellKnownPrivilegeCheck | SampSetAccessAttribute |
| SampSetAdminPassword | SampSetAttributeAccess |
| SampSetComputerObjectDsName | SampSetDSRMPasswordWorker |
| SampSetExtendedAttributeAccess | SampSetFixedAttributes |
| SampSetGlobalDsSids | SampSetPassword |
| SampSetPasswordInfoOnPdcByHandle | SampSetPasswordInfoOnPdcByIndex |
| SampSetSerialNumberDomain2 | SampSetTransactionDomain |
| SampSetTransactionWithinDomain | SampSetUnicodeStringAttribute |
| SampSetUserAccountControl | SampSplitSid |
| SampStoreObjectAttributes | SampStringFromGuid |
| SampTraceEvent | SampUpdateAccountDisabledFlag |
| SampUpdateComputedUserAccountControlBits | SampUpdateMixedModeAndFindDomain |
| SampUpdatePerformanceCounters | SampUpgradeUserParmsActual |
| SampUsingDsData | SampValidateDomainCacheCallback |
| SampValidateDomainControllerCreation | SampValidatePwdSettingAttempt |
| SampValidateRegAttributes | SampWriteEventLog |
| SampWriteGroupType | SamrAddMemberToAlias |
| SamrAddMemberToGroup | SamrCloseHandle |
| SamrCreateUser2InDomain | SamrCreateUserInDomain |
| SamrDeleteAlias | SamrDeleteGroup |
| SamrDeleteUser | SamrEnumerateUsersInDomain |
| SamrEnumerateUsersInDomain2 | SamrGetAliasMembership |
| SamrGetGroupsForUser | SamrLookupIdsInDomain |
| SamrLookupNamesInDomain | SamrLookupNamesInDomain2 |
| SamrOpenAlias | SamrOpenDomain |
| SamrOpenGroup | SamrOpenUser |
| SamrQueryDisplayInformation | SamrQueryInformationDomain |
| SamrQueryInformationUser | SamrQueryInformationUser2 |
| SamrQuerySecurityObject | SamrRemoveMemberFromAlias |
| SamrRemoveMemberFromGroup | SamrRidToSid |
| SamrSetInformationAlias | SamrSetInformationGroup |
| SamrSetInformationUser | SamrSetSecurityObject |
| SamrValidatePassword |
Imported Functions List
The following functions are imported by this dll:- msvcrt.dll:
_XcptFilter __dllonexit _amsg_exit _callnewh _except_handler4_common _initterm _lock _onexit _ultow _unlock _vsnprintf _vsnwprintf _wcsicmp _wcsupr _wtoi free malloc memcmp memcpy memmove memset swprintf_s wcscpy_s wcscspn wcsncpy_s wcsstr wcstok wcstoul - api-ms-win-core-file-l1-2-1.dll:
KernelBase!CreateFileW KernelBase!DeleteFileW KernelBase!FindClose KernelBase!FindFirstFileW KernelBase!FindNextFileW KernelBase!FlushFileBuffers KernelBase!GetFileSize KernelBase!RemoveDirectoryW KernelBase!SetFileInformationByHandle KernelBase!SetFilePointer KernelBase!WriteFile - api-ms-win-core-registry-l1-1-0.dll:
KernelBase!RegCloseKey KernelBase!RegCreateKeyExA KernelBase!RegCreateKeyExW KernelBase!RegDeleteKeyExA KernelBase!RegEnumValueW KernelBase!RegGetValueW KernelBase!RegLoadKeyW KernelBase!RegNotifyChangeKeyValue KernelBase!RegOpenKeyExA KernelBase!RegOpenKeyExW KernelBase!RegQueryInfoKeyA KernelBase!RegQueryInfoKeyW KernelBase!RegQueryValueExA KernelBase!RegQueryValueExW KernelBase!RegSetValueExA KernelBase!RegSetValueExW KernelBase!RegUnLoadKeyW - api-ms-win-core-errorhandling-l1-1-1.dll:
KernelBase!GetLastError KernelBase!SetErrorMode KernelBase!SetUnhandledExceptionFilter KernelBase!UnhandledExceptionFilter ntdll!RtlRestoreLastWin32Error - api-ms-win-core-sysinfo-l1-2-1.dll:
KernelBase!GetComputerNameExW KernelBase!GetLocalTime KernelBase!GetSystemDirectoryW KernelBase!GetSystemInfo KernelBase!GetSystemTimeAsFileTime KernelBase!GetTickCount KernelBase!GetVersionExW KernelBase!GetWindowsDirectoryW ntdll!VerSetConditionMask - api-ms-win-core-processthreads-l1-1-2.dll:
kernel32!CreateThread kernel32!GetCurrentProcess kernel32!GetCurrentProcessId kernel32!GetCurrentThreadId kernel32!SetProcessShutdownParameters kernel32!SetThreadStackGuarantee kernel32!TerminateProcess kernel32!TlsAlloc kernel32!TlsFree kernel32!TlsGetValue kernel32!TlsSetValue - api-ms-win-core-handle-l1-1-0.dll:
KernelBase!CloseHandle - api-ms-win-core-libraryloader-l1-2-0.dll:
KernelBase!FreeLibrary KernelBase!GetModuleFileNameW KernelBase!GetModuleHandleExW KernelBase!GetModuleHandleW KernelBase!GetProcAddress KernelBase!LoadLibraryExW - api-ms-win-core-heap-l2-1-0.dll:
KernelBase!LocalAlloc KernelBase!LocalFree - api-ms-win-core-synch-l1-2-0.dll:
KernelBase!CreateEventW KernelBase!Sleep KernelBase!WaitForSingleObject ntdll!RtlDeleteCriticalSection ntdll!RtlEnterCriticalSection ntdll!RtlInitializeCriticalSection ntdll!RtlLeaveCriticalSection - api-ms-win-security-base-l1-2-0.dll:
KernelBase!CheckTokenMembership KernelBase!GetSecurityDescriptorDacl KernelBase!GetSecurityDescriptorLength KernelBase!ImpersonateLoggedOnUser KernelBase!RevertToSelf - api-ms-win-core-string-l1-1-0.dll:
KernelBase!CompareStringW KernelBase!GetStringTypeW - bcrypt.dll:
BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDestroyHash BCryptDestroyKey BCryptEncrypt BCryptFinishHash BCryptGenerateSymmetricKey BCryptHashData BCryptOpenAlgorithmProvider - api-ms-win-core-rtlsupport-l1-2-0.dll:
ntdll!RtlCompareMemory - api-ms-win-core-processenvironment-l1-2-0.dll:
KernelBase!GetEnvironmentVariableW - api-ms-win-core-localization-l1-2-1.dll:
KernelBase!FormatMessageW - api-ms-win-core-console-l1-1-0.dll:
KernelBase!SetConsoleCtrlHandler - api-ms-win-core-timezone-l1-1-0.dll:
KernelBase!GetTimeZoneInformation - api-ms-win-core-profile-l1-1-0.dll:
ntdll!RtlQueryPerformanceCounter - api-ms-win-core-heap-l1-2-0.dll:
KernelBase!GetProcessHeap ntdll!RtlAllocateHeap ntdll!RtlFreeHeap - api-ms-win-core-kernel32-legacy-l1-1-1.dll:
kernel32!GetComputerNameW - api-ms-win-core-privateprofile-l1-1-1.dll:
kernel32!GetPrivateProfileStringW - api-ms-win-core-string-obsolete-l1-1-0.dll:
kernel32!lstrcmpiW kernel32!lstrlenW - api-ms-win-core-apiquery-l1-1-0.dll:
ntdll!ApiSetQueryApiSetPresence - api-ms-win-security-lsalookup-l1-1-1.dll:
sechost!EnumerateIdentityProviders sechost!GetIdentityProviderInfoByGUID sechost!GetIdentityProviderInfoByName sechost!ReleaseIdentityProviderEnumContext - LSASRV.dll:
LsaIAdtAuditingEnabledByCategory LsaIAuditNotifyPackageLoad LsaIAuditSamEvent LsaIChangeSecretCipherKey LsaIFree_LSAPR_POLICY_INFORMATION LsaIHealthCheck LsaILookupWellKnownName LsaINoConnectedUserPolicy LsaINotifyChangeNotification LsaIOpenPolicyTrusted LsaIQueryInformationPolicyTrusted LsaIRegisterNotification LsaIRegisterPolicyChangeNotificationCallback LsaIRetrieveCurrentUserSid LsaISafeMode LsaISamIndicatedDsStarted LsaISetNewSyskey LsarClose LsarQueryInformationPolicy LsarSetInformationPolicy - ntdll.dll:
DbgPrint EtwEventRegister EtwEventUnregister EtwEventWrite EtwGetTraceEnableFlags EtwGetTraceEnableLevel EtwGetTraceLoggerHandle EtwLogTraceEvent EtwRegisterTraceGuidsW EtwTraceMessage EtwUnregisterTraceGuids LdrGetDllHandle LdrGetProcedureAddress LdrUnloadDll NlsMbOemCodePageTag NtAccessCheck NtAccessCheckAndAuditAlarm NtAdjustPrivilegesToken NtAllocateLocallyUniqueId NtClose NtCloseObjectAuditAlarm NtCreateEvent NtCreateFile NtCreateKey NtCreateToken NtDelayExecution NtDeleteKey NtDeleteObjectAuditAlarm NtDeleteValueKey NtDeviceIoControlFile NtDuplicateObject NtEnumerateKey NtEnumerateValueKey NtFlushKey NtFsControlFile NtImpersonateAnonymousToken NtLoadKey NtOpenEvent NtOpenFile NtOpenKey NtOpenProcess NtOpenProcessToken NtOpenThread NtOpenThreadToken NtPrivilegeCheck NtPrivilegedServiceAuditAlarm NtQueryAttributesFile NtQueryDirectoryFile NtQueryInformationToken NtQueryKey NtQueryObject NtQuerySecurityObject NtQuerySystemEnvironmentValueEx NtQuerySystemInformation NtQuerySystemTime NtQueryValueKey NtQueryVolumeInformationFile NtRaiseHardError NtRestoreKey NtSetEvent NtSetInformationThread NtSetSecurityObject NtSetValueKey NtUnloadKey NtWaitForSingleObject NtWriteFile RtlAbortRXact RtlAbsoluteToSelfRelativeSD RtlAcquireResourceExclusive RtlAcquireResourceShared RtlAddAccessAllowedAce RtlAddAccessDeniedAce RtlAddAce RtlAddActionToRXact RtlAddAttributeActionToRXact RtlAddAuditAccessAce RtlAdjustPrivilege RtlAllocateAndInitializeSid RtlAllocateHeap RtlAnsiStringToUnicodeString RtlAppendUnicodeStringToString RtlAppendUnicodeToString RtlApplyRXactNoFlush RtlAreAllAccessesGranted RtlCheckTokenCapability RtlCheckTokenMembershipEx RtlClearAllBits RtlCompareString RtlCompareUnicodeString RtlConvertSidToUnicodeString RtlCopySecurityDescriptor RtlCopySid RtlCopyUnicodeString RtlCreateAcl RtlCreateAndSetSD RtlCreateEnvironment RtlCreateSecurityDescriptor RtlCreateUnicodeString RtlCreateUnicodeStringFromAsciiz RtlDecompressBufferEx RtlDeleteResource RtlDeleteSecurityObject RtlDestroyEnvironment RtlDnsHostNameToComputerName RtlDosPathNameToNtPathName_U_WithStatus RtlDuplicateUnicodeString RtlEnterCriticalSection RtlEqualComputerName RtlEqualDomainName RtlEqualSid RtlEqualUnicodeString RtlExpandEnvironmentStrings_U RtlExtendedIntegerMultiply RtlExtendedLargeIntegerDivide RtlFindMessage RtlFreeAnsiString RtlFreeAnsiString RtlFreeHeap RtlFreeSid RtlGetAce RtlGetCompressionWorkSpaceSize RtlGetControlSecurityDescriptor RtlGetDaclSecurityDescriptor RtlGetGroupSecurityDescriptor RtlGetNtProductType RtlGetOwnerSecurityDescriptor RtlGetProductInfo RtlGetSaclSecurityDescriptor RtlGetVersion RtlIdentifierAuthoritySid RtlImageNtHeader RtlInitAnsiString RtlInitString RtlInitUnicodeString RtlInitUnicodeStringEx RtlInitializeBitMap RtlInitializeCriticalSection RtlInitializeCriticalSectionAndSpinCount RtlInitializeGenericTableAvl RtlInitializeRXact RtlInitializeResource RtlInitializeSid RtlInsertElementGenericTableAvl RtlIntegerToUnicodeString RtlIsMultiSessionSku RtlLeaveCriticalSection RtlLengthRequiredSid RtlLengthSecurityDescriptor RtlLengthSid RtlLookupElementGenericTableAvl RtlMakeSelfRelativeSD RtlMapGenericMask RtlNtStatusToDosError RtlNtStatusToDosErrorNoTeb RtlOemStringToUnicodeString RtlQueryInformationAcl RtlQueryRegistryValuesEx RtlReAllocateHeap RtlReleaseResource RtlSetAllBits RtlSetBits RtlSetControlSecurityDescriptor RtlSetDaclSecurityDescriptor RtlSetEnvironmentVariable RtlSetGroupSecurityDescriptor RtlSetOwnerSecurityDescriptor RtlSetSaclSecurityDescriptor RtlSetSecurityObject RtlSetThreadErrorMode RtlStartRXact RtlStringFromGUID RtlSubAuthorityCountSid RtlSubAuthoritySid RtlTimeToTimeFields RtlUnicodeStringToAnsiSize RtlUnicodeStringToAnsiString RtlUnicodeToOemN RtlUpcaseUnicodeStringToOemString RtlValidAcl RtlValidRelativeSecurityDescriptor RtlValidSid RtlValidateUnicodeString RtlVerifyVersionInfo RtlpNtCreateKey RtlpNtEnumerateSubKey RtlpNtOpenKey RtlpNtQueryValueKey RtlpNtSetValueKey _memicmp _vscwprintf _wcsnicmp strchr towupper wcsncmp wcsrchr - api-ms-win-core-memory-l1-1-2.dll:
KernelBase!VirtualAlloc KernelBase!VirtualProtect KernelBase!VirtualQuery - api-ms-win-core-delayload-l1-1-1.dll:
KernelBase!DelayLoadFailureHook KernelBase!ResolveDelayLoadedAPI - CRYPT32.dll:
CertCloseStore CertFindCertificateInStore CertFindExtension CertFreeCertificateContext CertOpenStore CryptBinaryToStringW CryptDecodeObjectEx - api-ms-win-eventing-provider-l1-1-0.dll:
ntdll!EtwEventRegister ntdll!EtwEventWrite