PackageStateRoaming.dll
v10.0.19041.4355
32-bit
Windows NT
Analyzed
Security warning
This file has been flagged as potentially dangerous, and downloads are disabled.
Reason: Detected potentially dangerous functions used for process injection: OpenProcess
Exported functions 2
DllCanUnloadNow
#1 · 0xf540
DllGetClassObject
#2 · 0xba10
No function matches your filter.
Imported DLLs & functions 155
GetPackageStatus
0x1002804c
GetApplicationUserModelId
0x10028054
GetPackagesByPackageFamily
0x10028058
GetStagedPackageOrigin
0x10028060
DebugBreak
0x10028070
IsDebuggerPresent
0x1002806c
OutputDebugStringW
0x10028068
DelayLoadFailureHook
0x10028078
ResolveDelayLoadedAPI
0x10028080
GetLastError
0x1002808c
SetLastError
0x10028090
SetUnhandledExceptionFilter
0x10028088
UnhandledExceptionFilter
0x10028094
CompareFileTime
0x1002809c
FindClose
0x100280a4
FindFirstFileW
0x100280a0
FindNextFileW
0x100280a8
GetFileAttributesW
0x100280ac
CloseHandle
0x100280b4
GetProcessHeap
0x100280bc
HeapAlloc
0x100280c4
HeapFree
0x100280c0
DisableThreadLibraryCalls
0x100280d8
FreeLibrary
0x100280e8
GetModuleFileNameA
0x100280e0
GetModuleHandleExW
0x100280e4
GetModuleHandleW
0x100280dc
GetProcAddress
0x100280ec
FormatMessageW
0x100280f4
ExpandEnvironmentStringsW
0x10028108
GetCurrentProcess
0x10028118
GetCurrentProcessId
0x10028128
GetCurrentThread
0x10028120
GetCurrentThreadId
0x1002811c
ProcessIdToSessionId
0x10028114
SetThreadPriority
0x10028124
TerminateProcess
0x10028110
OpenProcess
0x10028130
QueryPerformanceCounter
0x10028138
RegCloseKey
0x10028154
RegCreateKeyExW
0x1002814c
RegDeleteValueW
0x10028150
RegGetValueW
0x10028158
RegOpenCurrentUser
0x10028144
RegOpenKeyExW
0x10028140
RegQueryValueExW
0x1002815c
RegSetValueExW
0x10028148
PathFindFileNameW
0x10028168
PathRemoveBackslashW
0x10028164
QISearch
0x10028178
StrRChrW
0x10028174
StrStrIW
0x10028170
CompareStringOrdinal
0x10028180
AcquireSRWLockExclusive
0x100281cc
AcquireSRWLockShared
0x10028190
CreateEventExW
0x10028194
CreateMutexExW
0x10028198
CreateSemaphoreExW
0x100281a0
DeleteCriticalSection
0x100281a8
EnterCriticalSection
0x100281b0
InitializeCriticalSectionEx
0x100281ac
InitializeSRWLock
0x1002818c
LeaveCriticalSection
0x100281b4
OpenSemaphoreW
0x1002819c
ReleaseMutex
0x100281d0
ReleaseSemaphore
0x100281c4
ReleaseSRWLockExclusive
0x100281c0
ReleaseSRWLockShared
0x100281bc
ResetEvent
0x100281b8
SetEvent
0x100281c8
WaitForSingleObject
0x10028188
WaitForSingleObjectEx
0x100281a4
QueueUserWorkItem
0x100281f0
DecodePointer
0x100281f8
WindowsCreateString
0x1002820c
EventProviderEnabled
0x1002821c
EventRegister
0x10028214
EventSetInformation
0x10028224
EventUnregister
0x10028220
EventWriteTransfer
0x10028218
CopySid
0x10028230
GetLengthSid
0x10028234
GetTokenInformation
0x1002823c
IsValidSecurityDescriptor
0x10028238
IsValidSid
0x1002822c
IStream_Read
0x10028244
IStream_Reset
0x10028254
IStream_Size
0x10028250
IStream_Write
0x1002824c
SHCreateMemStream
0x10028248
msvcrt.dll
21
__CxxFrameHandler3
0x10028264
__dllonexit
0x10028270
_amsg_exit
0x10028288
_callnewh
0x10028290
_except_handler4_common
0x10028260
_initterm
0x10028284
_lock
0x10028278
_onexit
0x100282a8
_purecall
0x100282a4
_unlock
0x10028274
_vsnwprintf
0x10028280
_XcptFilter
0x1002828c
free
0x10028298
malloc
0x1002829c
memcpy
0x1002827c
memcpy_s
0x1002826c
memmove
0x1002825c
memmove_s
0x100282a0
memset
0x100282ac
realloc
0x10028294
toupper
0x10028268
ntdll.dll
16
EtwEventEnabled
0x100282bc
EtwEventRegister
0x100282d4
EtwEventUnregister
0x100282c8
EtwEventWrite
0x100282b8
RtlAcquireSRWLockExclusive
0x100282d0
RtlAcquireSRWLockShared
0x100282cc
RtlAllocateHeap
0x100282c0
RtlDeleteCriticalSection
0x100282dc
RtlEnterCriticalSection
0x100282ec
RtlFreeHeap
0x100282f0
RtlInitializeCriticalSection
0x100282e4
RtlLeaveCriticalSection
0x100282e8
RtlReleaseSRWLockExclusive
0x100282c4
RtlReleaseSRWLockShared
0x100282b4
RtlTryEnterCriticalSection
0x100282e0
WinSqmIncrementDWORD
0x100282d8
RPCRT4.dll
18
I_RpcExceptionFilter
0x1002801c
NdrClientCall4
0x10028028
NdrServerCall2
0x10028020
RpcBindingFromStringBindingW
0x10028018
RpcBindingSetAuthInfoExW
0x10028014
RpcBindingVectorFree
0x10028010
RpcEpRegisterW
0x1002802c
RpcEpUnregister
0x1002800c
RpcImpersonateClient
0x10028008
RpcRevertToSelf
0x10028004
RpcServerInqBindings
0x10028038
RpcServerInqCallAttributesW
0x10028044
RpcServerRegisterIf3
0x10028034
RpcServerUnregisterIf
0x10028040
RpcServerUseProtseqW
0x1002803c
RpcStringBindingComposeW
0x10028024
RpcStringFreeW
0x10028000
UuidFromStringW
0x10028030
No function matches your filter.