AppVEntSubsystems32.dll

v10.0.19041.5794 32-bit Windows NT Analyzed
Download
Description
Client Virtualization Subsystems
Authors
© Microsoft Corporation. All rights reserved.
File size
1.4 MB
Uploaded
2025-12-01 07:53
Views
69
SHA-256
213ff7b83cf6548738d2839f6ed70e9b

Exported functions 6

APIExportForDetours #1 · 0x4f320
RequestUnhookedFunctionList #2 · 0x4e490
VirtualizeCurrentThread #3 · 0x50280
CurrentThreadIsVirtualized #4 · 0x50260
VirtualizeCurrentProcess #5 · 0x502e0
_IsProcessHooked@0 #6 · 0x50250

Imported DLLs & functions 313

ADVAPI32.dll 7
EventRegister 0x10158000
EventSetInformation 0x10158018
EventUnregister 0x10158004
EventWriteTransfer 0x10158010
RegCloseKey 0x1015800c
RegOpenKeyExW 0x10158008
RegQueryValueExW 0x10158014
api-ms-win-core-com-l1-1-0.dll 14
CLSIDFromString 0x10158270
CoCreateGuid 0x1015825c
CoCreateInstance 0x10158248
CoGetTreatAsClass 0x10158250
CoInitializeEx 0x1015826c
CoMarshalInterface 0x1015827c
CoTaskMemAlloc 0x10158278
CoTaskMemFree 0x10158260
CoUninitialize 0x10158264
CoUnmarshalInterface 0x10158254
CreateStreamOnHGlobal 0x10158268
PropVariantClear 0x1015824c
StringFromCLSID 0x10158274
StringFromGUID2 0x10158258
api-ms-win-core-console-l3-2-0.dll 1
GetConsoleWindow 0x10158284
api-ms-win-core-errorhandling-l1-1-2.dll 1
RaiseFailFastException 0x1015828c
api-ms-win-core-file-l1-1-0.dll 12
FindClose 0x101582ac
FindFirstFileW 0x101582a8
FindFirstVolumeW 0x101582a4
FindNextFileW 0x101582b0
FindNextVolumeW 0x10158294
FindVolumeClose 0x1015829c
GetFileAttributesW 0x101582bc
GetFinalPathNameByHandleW 0x101582b8
GetLogicalDriveStringsW 0x101582c0
GetShortPathNameW 0x101582b4
GetVolumePathNameW 0x10158298
QueryDosDeviceW 0x101582a0
api-ms-win-core-file-l1-2-0.dll 1
GetVolumePathNamesForVolumeNameW 0x101582c8
api-ms-win-core-file-l1-2-2.dll 2
FindFirstFileNameW 0x101582d4
FindNextFileNameW 0x101582d0
api-ms-win-core-handle-l1-1-0.dll 1
DuplicateHandle 0x101582dc
api-ms-win-core-heap-l2-1-0.dll 1
LocalFree 0x101582e4
api-ms-win-core-io-l1-1-0.dll 2
DeviceIoControl 0x101582f0
GetOverlappedResult 0x101582ec
api-ms-win-core-libraryloader-l1-2-0.dll 1
LoadLibraryExA 0x101582f8
api-ms-win-core-libraryloader-l1-2-1.dll 1
LoadLibraryA 0x10158300
api-ms-win-core-localization-l1-2-0.dll 1
GetUserDefaultLangID 0x10158308
api-ms-win-core-memory-l1-1-0.dll 6
CreateFileMappingW 0x1015831c
MapViewOfFile 0x10158318
UnmapViewOfFile 0x10158314
VirtualFree 0x10158310
VirtualProtect 0x10158324
VirtualQuery 0x10158320
api-ms-win-core-memory-l1-1-4.dll 1
QueryVirtualMemoryInformation 0x1015832c
api-ms-win-core-namedpipe-l1-1-0.dll 4
ConnectNamedPipe 0x10158340
CreateNamedPipeW 0x10158338
DisconnectNamedPipe 0x1015833c
PeekNamedPipe 0x10158334
api-ms-win-core-processenvironment-l1-1-0.dll 5
ExpandEnvironmentStringsW 0x10158354
GetCurrentDirectoryW 0x10158348
GetEnvironmentVariableW 0x10158358
SearchPathW 0x1015834c
SetCurrentDirectoryW 0x10158350
api-ms-win-core-processthreads-l1-1-0.dll 8
CreateProcessAsUserW 0x10158370
CreateProcessW 0x1015836c
GetProcessId 0x10158374
OpenProcessToken 0x10158378
OpenThreadToken 0x10158360
ResumeThread 0x1015837c
SetThreadToken 0x10158364
SuspendThread 0x10158368
api-ms-win-core-processthreads-l1-1-1.dll 4
FlushInstructionCache 0x1015838c
GetProcessMitigationPolicy 0x10158384
GetThreadContext 0x10158390
SetThreadContext 0x10158388
api-ms-win-core-psapi-l1-1-0.dll 1
K32GetMappedFileNameW 0x10158398
api-ms-win-core-registry-l1-1-0.dll 4
RegCreateKeyExW 0x101583ac
RegEnumKeyExW 0x101583a8
RegEnumValueW 0x101583a0
RegSetValueExW 0x101583a4
api-ms-win-core-registry-l2-1-0.dll 1
RegDeleteKeyW 0x101583b4
api-ms-win-core-synch-l1-1-0.dll 10
AcquireSRWLockExclusive 0x101583cc
AcquireSRWLockShared 0x101583e0
CreateMutexExW 0x101583dc
CreateSemaphoreExW 0x101583c0
InitializeSRWLock 0x101583bc
OpenEventW 0x101583d8
OpenSemaphoreW 0x101583d0
ReleaseSemaphore 0x101583c4
ReleaseSRWLockExclusive 0x101583c8
ReleaseSRWLockShared 0x101583d4
api-ms-win-core-synch-l1-2-0.dll 1
Sleep 0x101583e8
api-ms-win-core-synch-l1-2-1.dll 1
WaitForMultipleObjects 0x101583f0
api-ms-win-core-sysinfo-l1-1-0.dll 4
GetSystemDirectoryW 0x101583f8
GetVersion 0x10158404
GetVersionExW 0x101583fc
GetWindowsDirectoryW 0x10158400
api-ms-win-core-sysinfo-l1-2-0.dll 1
GetNativeSystemInfo 0x1015840c
api-ms-win-core-threadpool-l1-2-0.dll 4
CloseThreadpoolTimer 0x10158420
CreateThreadpoolTimer 0x1015841c
SetThreadpoolTimer 0x10158414
WaitForThreadpoolTimerCallbacks 0x10158418
api-ms-win-core-threadpool-legacy-l1-1-0.dll 1
QueueUserWorkItem 0x10158428
api-ms-win-core-url-l1-1-0.dll 2
PathCreateFromUrlW 0x10158430
UrlCreateFromPathW 0x10158434
api-ms-win-core-version-l1-1-0.dll 1
VerQueryValueW 0x1015843c
api-ms-win-core-version-l1-1-1.dll 2
GetFileVersionInfoSizeW 0x10158444
GetFileVersionInfoW 0x10158448
api-ms-win-core-wow64-l1-1-0.dll 1
IsWow64Process 0x10158450
api-ms-win-core-wow64-l1-1-1.dll 1
GetSystemWow64DirectoryW 0x10158458
api-ms-win-security-base-l1-1-0.dll 25
AddAce 0x101584b0
CopySid 0x101584b8
DuplicateToken 0x10158490
DuplicateTokenEx 0x10158494
EqualSid 0x1015847c
GetAclInformation 0x1015849c
GetLengthSid 0x101584a4
GetSecurityDescriptorControl 0x10158474
GetSecurityDescriptorDacl 0x101584c0
GetSecurityDescriptorGroup 0x10158484
GetSecurityDescriptorLength 0x1015846c
GetSecurityDescriptorOwner 0x10158470
GetSecurityDescriptorSacl 0x10158488
GetSidLengthRequired 0x10158464
GetSidSubAuthority 0x10158460
GetTokenInformation 0x101584b4
InitializeAcl 0x101584ac
InitializeSecurityDescriptor 0x101584bc
InitializeSid 0x10158480
IsValidSid 0x10158468
MakeAbsoluteSD 0x10158478
MakeSelfRelativeSD 0x1015848c
SetSecurityDescriptorDacl 0x10158498
SetSecurityDescriptorGroup 0x101584a8
SetSecurityDescriptorOwner 0x101584a0
api-ms-win-security-lsalookup-l2-1-0.dll 1
LookupAccountSidW 0x101584c8
api-ms-win-security-sddl-l1-1-0.dll 2
ConvertSidToStringSidW 0x101584d4
ConvertStringSecurityDescriptorToSecurityDescriptorW 0x101584d0
api-ms-win-shcore-sysinfo-l1-1-0.dll 1
GetCurrentProcessExplicitAppUserModelID 0x101584dc
GDI32.dll 2
AddFontResourceExW 0x10158020
CreateScalableFontResourceW 0x10158024
KERNEL32.dll 101
CheckRemoteDebuggerPresent 0x10158070
CloseHandle 0x10158068
CompareStringEx 0x101580a0
CreateEventW 0x10158158
CreateFileW 0x10158144
CreateMutexW 0x10158058
CreateThread 0x10158078
DebugBreak 0x10158050
DecodePointer 0x10158094
DeleteCriticalSection 0x10158040
DisableThreadLibraryCalls 0x10158064
EncodePointer 0x10158090
EnterCriticalSection 0x10158190
EnumSystemLocalesW 0x101580f8
ExitProcess 0x101580fc
ExitThread 0x101581a4
FindFirstFileExW 0x1015817c
FlsAlloc 0x1015816c
FlsFree 0x10158178
FlsGetValue 0x10158170
FlsSetValue 0x10158174
FlushFileBuffers 0x10158124
FormatMessageW 0x1015802c
FreeEnvironmentStringsW 0x1015813c
FreeLibrary 0x1015804c
FreeLibraryAndExitThread 0x101581a0
GetACP 0x10158104
GetCommandLineA 0x101581b0
GetCommandLineW 0x10158130
GetConsoleMode 0x10158120
GetConsoleOutputCP 0x1015811c
GetCPInfo 0x1015809c
GetCurrentProcess 0x1015818c
GetCurrentProcessId 0x10158160
GetCurrentThread 0x101580b8
GetCurrentThreadId 0x101580e8
GetEnvironmentStringsW 0x10158138
GetFileSizeEx 0x1015810c
GetFileType 0x101580c0
GetLastError 0x10158030
GetLocaleInfoW 0x101580ec
GetModuleFileNameA 0x1015819c
GetModuleFileNameW 0x10158054
GetModuleHandleExW 0x10158188
GetModuleHandleW 0x10158048
GetOEMCP 0x10158108
GetProcAddress 0x1015803c
GetProcessHeap 0x10158044
GetStartupInfoW 0x101580c4
GetStdHandle 0x101580bc
GetStringTypeW 0x10158088
GetSystemInfo 0x101581ac
GetSystemTimeAsFileTime 0x101580e0
GetUserDefaultLCID 0x101580f4
HeapAlloc 0x10158038
HeapDestroy 0x101581b4
HeapFree 0x10158198
HeapReAlloc 0x101580b4
HeapSize 0x10158134
InitializeCriticalSection 0x10158180
InitializeCriticalSectionAndSpinCount 0x101580cc
InitializeCriticalSectionEx 0x1015808c
InitializeSListHead 0x10158164
InitOnceExecuteOnce 0x10158080
InterlockedFlushSList 0x10158168
IsDebuggerPresent 0x1015806c
IsProcessorFeaturePresent 0x101580b0
IsValidCodePage 0x10158100
IsValidLocale 0x101580f0
K32GetModuleInformation 0x10158034
LCMapStringEx 0x10158098
LCMapStringW 0x101581b8
LeaveCriticalSection 0x10158184
LoadLibraryExW 0x101580e4
LoadLibraryW 0x10158074
MultiByteToWideChar 0x1015807c
OutputDebugStringW 0x101581bc
QueryPerformanceCounter 0x1015815c
RaiseException 0x101580c8
ReadConsoleW 0x1015812c
ReadFile 0x10158128
ReleaseMutex 0x10158060
ResetEvent 0x10158150
SetEnvironmentVariableW 0x10158140
SetEvent 0x1015814c
SetFilePointerEx 0x10158110
SetLastError 0x10158194
SetStdHandle 0x10158114
SetUnhandledExceptionFilter 0x101580a8
TerminateProcess 0x101580ac
TlsAlloc 0x101580d0
TlsFree 0x101580dc
TlsGetValue 0x101580d4
TlsSetValue 0x101580d8
UnhandledExceptionFilter 0x101580a4
VirtualAlloc 0x101581a8
WaitForSingleObject 0x1015805c
WaitForSingleObjectEx 0x10158154
WideCharToMultiByte 0x10158084
WriteConsoleW 0x10158148
WriteFile 0x10158118
ntdll.dll 41
NtClose 0x1015855c
NtCreateKey 0x1015851c
NtDeleteKey 0x1015856c
NtDeleteValueKey 0x10158568
NtDuplicateObject 0x1015850c
NtEnumerateKey 0x10158570
NtEnumerateValueKey 0x10158574
NtFlushKey 0x10158580
NtNotifyChangeMultipleKeys 0x1015857c
NtOpenKey 0x10158578
NtQueryInformationProcess 0x10158550
NtQueryKey 0x101584f8
NtQueryObject 0x101584e4
NtQuerySecurityObject 0x101584f0
NtQueryValueKey 0x10158584
NtReadFile 0x101584e8
NtRenameKey 0x10158518
NtSetEvent 0x10158558
NtSetInformationThread 0x101584ec
NtSetSecurityObject 0x101584f4
NtSetValueKey 0x10158564
NtWriteFile 0x101584fc
RtlAllocateHeap 0x10158548
RtlCompareUnicodeString 0x10158500
RtlCopyUnicodeString 0x1015852c
RtlDeleteElementGenericTableAvl 0x10158524
RtlEnumerateGenericTableAvl 0x10158534
RtlEnumerateGenericTableWithoutSplayingAvl 0x1015853c
RtlEqualUnicodeString 0x10158504
RtlFreeHeap 0x1015854c
RtlInitAnsiString 0x10158560
RtlInitializeGenericTableAvl 0x10158520
RtlInitUnicodeString 0x10158508
RtlInsertElementGenericTableAvl 0x10158530
RtlIntegerToUnicodeString 0x10158554
RtlIsGenericTableEmptyAvl 0x10158538
RtlIsNameInExpression 0x10158540
RtlLookupElementGenericTableAvl 0x10158528
RtlNtStatusToDosError 0x10158510
RtlPrefixUnicodeString 0x10158544
RtlUnwind 0x10158514
ole32.dll 3
CreateFileMoniker 0x10158590
GetClassFile 0x1015858c
GetRunningObjectTable 0x10158594
RPCRT4.dll 17
NdrClientCall2 0x101581f4
NdrClientCall4 0x101581fc
NdrServerCall2 0x101581e8
RpcBindingFree 0x10158204
RpcBindingFromStringBindingW 0x101581e4
RpcBindingInqAuthClientW 0x101581ec
RpcBindingSetAuthInfoExW 0x101581d0
RpcImpersonateClient 0x10158200
RpcRevertToSelf 0x101581d8
RpcServerListen 0x101581dc
RpcServerRegisterAuthInfoW 0x101581e0
RpcServerRegisterIf2 0x101581cc
RpcServerUnregisterIf 0x101581c8
RpcServerUseProtseqEpW 0x101581d4
RpcStringBindingComposeW 0x101581c4
RpcStringFreeW 0x101581f0
UuidCreate 0x101581f8
SHELL32.dll 3
SHCreateItemFromParsingName 0x10158210
SHGetPathFromIDListW 0x1015820c
SHParseDisplayName 0x10158214
USER32.dll 8
CallWindowProcW 0x10158234
DispatchMessageW 0x10158230
FindWindowW 0x1015821c
GetParent 0x10158228
GetWindowLongW 0x10158220
IsWindowVisible 0x10158224
PeekMessageW 0x1015822c
WaitForInputIdle 0x10158238
USERENV.dll 1
UnloadUserProfile 0x10158240