AcLayers.dll
v10.0.19041.5438
32-bit
Windows NT
Analyzed
Security warning
This file has been flagged as potentially dangerous, and downloads are disabled.
Reason: Detected potentially dangerous functions used for process injection: WriteProcessMemory
Exported functions 2
GetHookAPIs
#1 · 0x4ae50
NotifyShims
#2 · 0x4aee0
No function matches your filter.
Imported DLLs & functions 334
ApiSetQueryApiSetPresence
0x795793ac
RegCloseKey
0x795793b8
RegCreateKeyExW
0x795793bc
RegDeleteKeyExW
0x795793cc
RegEnumKeyExW
0x795793d0
RegGetKeySecurity
0x795793c8
RegOpenKeyExA
0x795793c4
RegOpenKeyExW
0x795793d4
RegQueryValueExW
0x795793b4
RegSetValueExW
0x795793c0
EventWriteTransfer
0x795793dc
AllocateAndInitializeSid
0x795793fc
CheckTokenMembership
0x795793f0
CopySid
0x795793f8
FreeSid
0x79579404
GetAce
0x795793ec
GetAclInformation
0x79579400
GetFileSecurityW
0x795793f4
GetSecurityDescriptorDacl
0x795793e4
GetTokenInformation
0x795793e8
SE_COM_AddHook
0x7957941c
SE_COM_AddServer
0x7957940c
SE_COM_HookObject
0x79579410
SE_COM_Lookup
0x79579414
SE_GetShimId
0x79579420
SE_ShimDPF
0x79579418
GDI32.dll
13
CreateCompatibleBitmap
0x79579020
CreateCompatibleDC
0x79579004
CreateDIBSection
0x79579008
CreateSolidBrush
0x79579018
DeleteDC
0x79579014
DeleteObject
0x79579010
GdiFlush
0x79579000
GetDIBits
0x7957900c
GetObjectType
0x79579030
OffsetClipRgn
0x79579028
OffsetRgn
0x7957902c
OffsetWindowOrgEx
0x7957901c
SelectObject
0x79579024
KERNEL32.dll
128
AcquireSRWLockExclusive
0x79579174
AcquireSRWLockShared
0x79579180
AddAtomW
0x79579184
CancelIo
0x79579044
CloseHandle
0x795791f4
CompareStringA
0x79579140
CompareStringEx
0x795791ac
CompareStringW
0x7957913c
CopyFileA
0x79579164
CopyFileW
0x7957915c
CreateActCtxW
0x795790b4
CreateDirectoryW
0x79579150
CreateEventW
0x79579050
CreateFileA
0x795791f8
CreateFileMappingW
0x79579060
CreateFileW
0x795790cc
CreateMutexW
0x795790ac
CreateProcessW
0x79579074
CreateThread
0x795790f4
DelayLoadFailureHook
0x79579098
DeleteCriticalSection
0x79579054
DeleteFileA
0x79579160
DeleteFileW
0x79579158
DeleteProcThreadAttributeList
0x795791bc
EnterCriticalSection
0x7957910c
ExitProcess
0x795791e4
ExpandEnvironmentStringsA
0x7957911c
ExpandEnvironmentStringsW
0x795791b8
FindClose
0x79579144
FindFirstFileW
0x7957914c
FindNextFileW
0x79579148
FindNLSStringEx
0x79579188
GetApplicationRestartSettings
0x79579118
GetCommandLineA
0x79579220
GetCommandLineW
0x7957903c
GetCurrentActCtx
0x795791d4
GetCurrentDirectoryW
0x795790a8
GetCurrentProcess
0x795791e8
GetCurrentProcessId
0x79579200
GetCurrentThread
0x7957906c
GetCurrentThreadId
0x7957917c
GetDriveTypeW
0x795790e0
GetEnvironmentVariableA
0x79579208
GetFileAttributesW
0x79579100
GetFileSize
0x795790c4
GetFullPathNameW
0x795790a4
GetLastError
0x795791e0
GetLocaleInfoEx
0x795791a8
GetLogicalDriveStringsW
0x795790e4
GetModuleFileNameW
0x795790d8
GetModuleHandleA
0x79579224
GetModuleHandleW
0x795791ec
GetProcAddress
0x7957921c
GetProcessHeap
0x795791a0
GetShortPathNameA
0x7957912c
GetShortPathNameW
0x79579124
GetStartupInfoA
0x79579214
GetSystemDirectoryW
0x795790d4
GetSystemFirmwareTable
0x795791f0
GetSystemTimeAsFileTime
0x79579088
GetTempFileNameA
0x795790bc
GetTempFileNameW
0x795790b8
GetTempPathA
0x795790c0
GetTempPathW
0x79579154
GetTickCount
0x79579084
GetVersion
0x79579228
GetVersionExW
0x79579138
GetVolumeNameForVolumeMountPointW
0x795790d0
GetWindowsDirectoryW
0x795790dc
HeapAlloc
0x795791a4
HeapFree
0x79579198
HeapReAlloc
0x79579190
InitializeCriticalSection
0x7957904c
InitializeCriticalSectionAndSpinCount
0x79579104
InitializeProcThreadAttributeList
0x795791c0
InitializeSRWLock
0x79579068
IsBadReadPtr
0x79579204
IsDebuggerPresent
0x79579078
IsNLSDefinedString
0x7957918c
IsWow64Process
0x7957907c
LCIDToLocaleName
0x795791b0
LCMapStringEx
0x79579194
LeaveCriticalSection
0x79579108
LoadLibraryA
0x79579218
LoadLibraryW
0x7957916c
LocalAlloc
0x795791dc
LocalFree
0x795791d8
lstrcmpA
0x79579110
lstrcmpiA
0x79579130
MapViewOfFile
0x79579064
MultiByteToWideChar
0x7957919c
OpenMutexW
0x795790b0
OutputDebugStringA
0x79579048
ProcessIdToSessionId
0x79579080
QueryActCtxW
0x795791d0
QueryFullProcessImageNameW
0x79579168
QueryPerformanceCounter
0x795790ec
QueryPerformanceFrequency
0x795790e8
ReadFile
0x79579040
ReadProcessMemory
0x79579230
RegisterApplicationRestart
0x79579114
ReleaseActCtx
0x795791cc
ReleaseSRWLockExclusive
0x79579170
ReleaseSRWLockShared
0x79579178
ResetEvent
0x795790f8
ResolveDelayLoadedAPI
0x7957909c
ResumeThread
0x795791c4
SearchPathW
0x795790a0
SetEnvironmentVariableA
0x7957920c
SetEvent
0x795790fc
SetFilePointer
0x795790c8
SetLastError
0x795791c8
SetNamedPipeHandleState
0x79579058
SetUnhandledExceptionFilter
0x79579090
Sleep
0x795791fc
TerminateProcess
0x7957908c
TlsAlloc
0x79579120
TlsGetValue
0x79579134
TlsSetValue
0x79579128
UnhandledExceptionFilter
0x79579094
UnmapViewOfFile
0x7957905c
WaitForDebugEvent
0x7957922c
WaitForSingleObject
0x79579038
WaitForSingleObjectEx
0x795790f0
WerRegisterMemoryBlock
0x79579070
WideCharToMultiByte
0x795791b4
WriteFile
0x79579210
WriteProcessMemory
0x79579234
MPR.dll
1
WNetGetConnectionW
0x7957923c
msvcrt.dll
39
__CxxFrameHandler3
0x79579438
_amsg_exit
0x795794a4
_CxxThrowException
0x79579430
_except_handler4_common
0x795794bc
_initterm
0x795794b0
_scwprintf
0x7957946c
_stricmp
0x7957944c
_vscprintf
0x79579498
_vscwprintf
0x79579440
_vsnprintf
0x79579448
_vsnwprintf
0x79579444
_wcsicmp
0x7957943c
_wcslwr
0x79579490
_wcsnicmp
0x79579468
_XcptFilter
0x795794a0
??1type_info@@UAE@XZ
0x795794b8
?terminate@@YAXXZ
0x795794b4
atol
0x79579450
free
0x795794a8
iswctype
0x79579478
iswspace
0x7957949c
malloc
0x795794ac
memcmp
0x7957942c
memcpy
0x79579428
memmove
0x79579434
memset
0x795794c0
sprintf_s
0x79579458
sscanf_s
0x79579460
strstr
0x79579454
towlower
0x7957947c
vsprintf_s
0x7957945c
wcscat_s
0x79579484
wcschr
0x79579488
wcscpy_s
0x79579480
wcsncmp
0x79579464
wcspbrk
0x7957948c
wcsrchr
0x79579470
wcsspn
0x79579474
wcsstr
0x79579494
ntdll.dll
42
LdrAccessResource
0x79579514
NtClose
0x795794e4
NtOpenFile
0x7957950c
NtOpenKey
0x79579540
NtQueryInformationProcess
0x795794f4
NtQueryInformationToken
0x79579524
NtQueryKey
0x795794d0
NtQueryObject
0x79579510
NtQuerySecurityObject
0x7957956c
NtQuerySystemInformation
0x79579518
NtQueryValueKey
0x79579544
NtTerminateProcess
0x795794ec
RtlAllocateHeap
0x795794c8
RtlAppendUnicodeToString
0x79579550
RtlCaptureContext
0x79579504
RtlCaptureStackBackTrace
0x79579500
RtlCreateServiceSid
0x79579560
RtlCreateUnicodeStringFromAsciiz
0x7957952c
RtlDosPathNameToNtPathName_U
0x79579568
RtlEqualSid
0x7957954c
RtlEqualUnicodeString
0x795794dc
RtlFormatCurrentUserKeyPath
0x79579554
RtlFreeHeap
0x795794cc
RtlFreeUnicodeString
0x79579530
RtlGetLastNtStatus
0x79579558
RtlGetNtSystemRoot
0x79579564
RtlGetOwnerSecurityDescriptor
0x79579548
RtlImageNtHeader
0x795794e0
RtlInitializeSid
0x79579520
RtlInitUnicodeString
0x795794d8
RtlLengthRequiredSid
0x7957951c
RtlMultiByteToUnicodeN
0x79579534
RtlNtStatusToDosError
0x795794d4
RtlRaiseException
0x795794f0
RtlReportException
0x795794e8
RtlSetLastWin32ErrorAndNtStatusFromNtStatus
0x7957955c
RtlSubAuthoritySid
0x79579528
RtlUnicodeToMultiByteN
0x7957953c
RtlUnicodeToMultiByteSize
0x79579538
RtlUniform
0x795794f8
RtlValidateHeap
0x795794fc
WinSqmAddToStream
0x79579508
SysReAllocString
0x79579244
RPCRT4.dll
10
I_RpcExceptionFilter
0x79579254
NdrAsyncClientCall
0x79579270
RpcAsyncCancelCall
0x79579264
RpcAsyncCompleteCall
0x79579258
RpcAsyncInitializeHandle
0x7957925c
RpcBindingFree
0x79579268
RpcBindingFromStringBindingW
0x7957924c
RpcBindingSetAuthInfoExW
0x7957926c
RpcStringBindingComposeW
0x79579250
RpcStringFreeW
0x79579260
PnpIsFilePnpDriver
0x79579278
SHLWAPI.dll
33
0x7957929c
0x795792a0
0x795792a4
0x795792c0
0x795792c8
IntlStrEqWorkerA
0x795792f4
IntlStrEqWorkerW
0x795792f8
PathFindFileNameW
0x795792fc
StrChrA
0x79579290
StrChrIA
0x795792d4
StrChrIW
0x795792d8
StrChrW
0x795792b4
StrCmpNA
0x79579298
StrCmpNIA
0x7957930c
StrCmpNIW
0x79579300
StrCmpNW
0x795792bc
StrCSpnA
0x795792ac
StrCSpnIA
0x795792ec
StrCSpnIW
0x795792f0
StrCSpnW
0x795792cc
StrRChrA
0x79579294
StrRChrIA
0x795792dc
StrRChrIW
0x795792e0
StrRChrW
0x795792b8
StrRetToBufW
0x79579304
StrRStrIA
0x795792e4
StrRStrIW
0x795792e8
StrStrA
0x79579308
StrStrIA
0x795792a8
StrStrIW
0x79579310
StrStrW
0x795792c4
StrToIntA
0x795792b0
StrToIntW
0x795792d0
USER32.dll
34
AllowSetForegroundWindow
0x79579318
BeginPaint
0x79579364
ChangeDisplaySettingsA
0x79579378
CharUpperW
0x79579320
CreateWindowExW
0x7957934c
DefWindowProcW
0x79579368
DestroyWindow
0x7957933c
DispatchMessageW
0x79579340
EnableWindow
0x79579398
EndPaint
0x79579360
EnumDisplaySettingsA
0x7957937c
EnumDisplaySettingsW
0x79579324
GetAncestor
0x79579330
GetCapture
0x79579328
GetClassInfoExW
0x79579358
GetDesktopWindow
0x79579388
GetGUIThreadInfo
0x79579384
GetMessageW
0x79579348
GetMonitorInfoW
0x7957938c
GetSystemMetrics
0x7957936c
GetWindowThreadProcessId
0x79579380
InvalidateRect
0x79579338
KillTimer
0x7957935c
LoadCursorW
0x79579354
MsgWaitForMultipleObjects
0x7957931c
PeekMessageW
0x79579390
PostQuitMessage
0x79579370
RegisterClassExW
0x79579350
ScreenToClient
0x7957932c
SetCursor
0x79579394
SetLayeredWindowAttributes
0x7957939c
SetWindowPos
0x79579374
TranslateMessage
0x79579344
WindowFromPoint
0x79579334
0x795793a4
No function matches your filter.