SessEnv.dll

v10.0.19041.6456 32-bit Windows NT Analyzed
Description
Remote Desktop Configuration service
Authors
© Microsoft Corporation. All rights reserved.
File size
435.0 KB
Uploaded
2025-12-01 08:04
Views
61
SHA-256
620b2c84869fb1f1497133a63c19c4ea

Exported functions 2

ServiceMain #1 · 0x1caf0
SvchostPushServiceGlobals #2 · 0x22f80

Imported DLLs & functions 322

api-ms-win-core-apiquery-l1-1-0.dll 1
ApiSetQueryApiSetPresence 0x10068090
api-ms-win-core-com-l1-1-0.dll 10
CoCreateGuid 0x100680b0
CoCreateInstance 0x1006809c
CoCreateInstanceEx 0x100680b4
CoInitializeEx 0x10068098
CoSetProxyBlanket 0x100680a0
CoTaskMemAlloc 0x100680b8
CoTaskMemFree 0x100680bc
CoUninitialize 0x100680a4
CoWaitForMultipleHandles 0x100680ac
StringFromCLSID 0x100680a8
api-ms-win-core-debug-l1-1-0.dll 4
DebugBreak 0x100680c8
IsDebuggerPresent 0x100680d0
OutputDebugStringA 0x100680c4
OutputDebugStringW 0x100680cc
api-ms-win-core-delayload-l1-1-0.dll 1
DelayLoadFailureHook 0x100680d8
api-ms-win-core-delayload-l1-1-1.dll 1
ResolveDelayLoadedAPI 0x100680e0
api-ms-win-core-errorhandling-l1-1-0.dll 4
GetLastError 0x100680f4
SetLastError 0x100680f0
SetUnhandledExceptionFilter 0x100680ec
UnhandledExceptionFilter 0x100680e8
api-ms-win-core-file-l1-1-0.dll 20
CompareFileTime 0x10068140
CreateDirectoryW 0x10068104
CreateFileW 0x10068138
DeleteFileW 0x10068108
DeleteVolumeMountPointW 0x10068124
FileTimeToLocalFileTime 0x1006813c
FindClose 0x100680fc
FindFirstFileW 0x1006810c
FindFirstVolumeW 0x10068114
FindNextFileW 0x10068100
FindNextVolumeW 0x10068118
FindVolumeClose 0x1006811c
GetFileAttributesW 0x10068134
GetFileSizeEx 0x10068130
GetFileTime 0x10068148
ReadFile 0x1006812c
RemoveDirectoryW 0x10068120
SetFileAttributesW 0x10068144
SetFilePointer 0x10068110
WriteFile 0x10068128
api-ms-win-core-file-l1-2-0.dll 3
GetTempPathW 0x10068150
GetVolumeNameForVolumeMountPointW 0x10068154
GetVolumePathNamesForVolumeNameW 0x10068158
api-ms-win-core-file-l2-1-0.dll 4
CopyFileExW 0x1006816c
CreateSymbolicLinkW 0x10068168
GetFileInformationByHandleEx 0x10068160
MoveFileWithProgressW 0x10068164
api-ms-win-core-handle-l1-1-0.dll 2
CloseHandle 0x10068174
DuplicateHandle 0x10068178
api-ms-win-core-heap-l1-1-0.dll 4
GetProcessHeap 0x10068184
HeapAlloc 0x10068188
HeapFree 0x10068180
HeapReAlloc 0x1006818c
api-ms-win-core-heap-l2-1-0.dll 2
LocalAlloc 0x10068194
LocalFree 0x10068198
api-ms-win-core-heap-obsolete-l1-1-0.dll 1
LocalSize 0x100681a0
api-ms-win-core-io-l1-1-0.dll 1
DeviceIoControl 0x100681a8
api-ms-win-core-kernel32-legacy-l1-1-0.dll 3
GetComputerNameW 0x100681b8
MoveFileW 0x100681b0
WTSGetActiveConsoleSessionId 0x100681b4
api-ms-win-core-kernel32-legacy-l1-1-1.dll 2
SetVolumeMountPointW 0x100681c4
VerifyVersionInfoW 0x100681c0
api-ms-win-core-libraryloader-l1-2-0.dll 9
DisableThreadLibraryCalls 0x100681cc
FreeLibrary 0x100681d8
GetModuleFileNameA 0x100681e0
GetModuleFileNameW 0x100681d4
GetModuleHandleExW 0x100681d0
GetModuleHandleW 0x100681e8
GetProcAddress 0x100681e4
LoadLibraryExW 0x100681dc
LoadStringW 0x100681ec
api-ms-win-core-libraryloader-l1-2-1.dll 1
LoadLibraryW 0x100681f4
api-ms-win-core-localization-l1-2-0.dll 1
FormatMessageW 0x100681fc
api-ms-win-core-path-l1-1-0.dll 1
PathCchCombine 0x10068204
api-ms-win-core-processenvironment-l1-1-0.dll 1
ExpandEnvironmentStringsW 0x1006820c
api-ms-win-core-processthreads-l1-1-0.dll 13
CreateProcessAsUserW 0x10068230
CreateProcessW 0x10068240
CreateThread 0x10068234
GetCurrentProcess 0x10068244
GetCurrentProcessId 0x10068220
GetCurrentThread 0x10068218
GetCurrentThreadId 0x1006823c
GetThreadId 0x10068228
OpenProcessToken 0x10068238
OpenThreadToken 0x1006821c
ProcessIdToSessionId 0x10068214
TerminateProcess 0x10068224
TerminateThread 0x1006822c
api-ms-win-core-processthreads-l1-1-1.dll 2
GetProcessMitigationPolicy 0x1006824c
OpenProcess 0x10068250
api-ms-win-core-profile-l1-1-0.dll 2
QueryPerformanceCounter 0x1006825c
QueryPerformanceFrequency 0x10068258
api-ms-win-core-psapi-l1-1-0.dll 1
QueryFullProcessImageNameW 0x10068264
api-ms-win-core-registry-l1-1-0.dll 15
RegCloseKey 0x10068288
RegCreateKeyExW 0x100682a4
RegDeleteTreeW 0x1006827c
RegDeleteValueW 0x1006828c
RegEnumKeyExW 0x1006829c
RegEnumValueW 0x10068280
RegGetValueW 0x10068290
RegLoadKeyW 0x1006826c
RegNotifyChangeKeyValue 0x10068270
RegOpenCurrentUser 0x100682a0
RegOpenKeyExW 0x10068274
RegQueryInfoKeyW 0x10068284
RegQueryValueExW 0x10068298
RegSetValueExW 0x10068294
RegUnLoadKeyW 0x10068278
api-ms-win-core-registry-l2-1-0.dll 2
RegDeleteKeyW 0x100682ac
RegEnumKeyW 0x100682b0
api-ms-win-core-shlwapi-obsolete-l1-1-0.dll 1
StrToIntExW 0x100682b8
api-ms-win-core-shutdown-l1-1-0.dll 1
InitiateSystemShutdownExW 0x100682c0
api-ms-win-core-string-l1-1-0.dll 2
MultiByteToWideChar 0x100682c8
WideCharToMultiByte 0x100682cc
api-ms-win-core-string-obsolete-l1-1-0.dll 1
lstrcmpiW 0x100682d4
api-ms-win-core-synch-l1-1-0.dll 21
AcquireSRWLockExclusive 0x100682fc
AcquireSRWLockShared 0x10068310
CreateEventW 0x1006830c
CreateMutexExW 0x10068314
CreateSemaphoreExW 0x100682f4
DeleteCriticalSection 0x10068308
EnterCriticalSection 0x100682f0
InitializeCriticalSection 0x10068300
InitializeCriticalSectionAndSpinCount 0x100682e8
InitializeCriticalSectionEx 0x1006832c
LeaveCriticalSection 0x100682e0
OpenSemaphoreW 0x10068318
ReleaseMutex 0x100682dc
ReleaseSemaphore 0x100682e4
ReleaseSRWLockExclusive 0x100682ec
ReleaseSRWLockShared 0x10068324
ResetEvent 0x10068328
SetEvent 0x100682f8
WaitForMultipleObjectsEx 0x10068320
WaitForSingleObject 0x1006831c
WaitForSingleObjectEx 0x10068304
api-ms-win-core-synch-l1-2-0.dll 2
InitOnceExecuteOnce 0x10068338
Sleep 0x10068334
api-ms-win-core-synch-l1-2-1.dll 1
WaitForMultipleObjects 0x10068340
api-ms-win-core-sysinfo-l1-1-0.dll 7
GetComputerNameExW 0x1006834c
GetLocalTime 0x10068354
GetSystemDirectoryW 0x10068358
GetSystemTime 0x10068350
GetSystemTimeAsFileTime 0x1006835c
GetTickCount 0x10068348
GetVersionExW 0x10068360
api-ms-win-core-threadpool-l1-2-0.dll 4
CloseThreadpoolTimer 0x10068370
CreateThreadpoolTimer 0x10068374
SetThreadpoolTimer 0x10068368
WaitForThreadpoolTimerCallbacks 0x1006836c
api-ms-win-core-threadpool-legacy-l1-1-0.dll 5
CreateTimerQueue 0x1006837c
CreateTimerQueueTimer 0x1006838c
DeleteTimerQueueEx 0x10068380
DeleteTimerQueueTimer 0x10068384
UnregisterWaitEx 0x10068388
api-ms-win-core-timezone-l1-1-0.dll 2
FileTimeToSystemTime 0x10068398
SystemTimeToFileTime 0x10068394
api-ms-win-eventing-classicprovider-l1-1-0.dll 1
TraceMessage 0x100683a0
api-ms-win-eventing-controller-l1-1-0.dll 3
ControlTraceW 0x100683b0
EnableTraceEx2 0x100683ac
StartTraceW 0x100683a8
api-ms-win-eventing-provider-l1-1-0.dll 6
EventActivityIdControl 0x100683c0
EventProviderEnabled 0x100683b8
EventRegister 0x100683bc
EventSetInformation 0x100683c8
EventUnregister 0x100683cc
EventWriteTransfer 0x100683c4
api-ms-win-eventlog-legacy-l1-1-0.dll 3
DeregisterEventSource 0x100683d8
RegisterEventSourceW 0x100683dc
ReportEventW 0x100683d4
api-ms-win-security-base-l1-1-0.dll 27
AdjustTokenPrivileges 0x100683e8
AllocateAndInitializeSid 0x1006840c
CheckTokenMembership 0x100683fc
CopySid 0x100683f0
CreateWellKnownSid 0x100683ec
DeleteAce 0x10068434
DuplicateToken 0x100683f4
DuplicateTokenEx 0x10068404
EqualSid 0x10068424
FreeSid 0x10068410
GetAce 0x1006841c
GetAclInformation 0x1006843c
GetFileSecurityW 0x10068440
GetLengthSid 0x10068400
GetSecurityDescriptorControl 0x10068438
GetSecurityDescriptorDacl 0x10068420
GetSecurityDescriptorLength 0x100683e4
GetTokenInformation 0x10068418
ImpersonateLoggedOnUser 0x10068448
InitializeSecurityDescriptor 0x1006842c
IsValidSid 0x10068430
MakeAbsoluteSD 0x10068408
RevertToSelf 0x1006844c
SetFileSecurityW 0x10068444
SetSecurityDescriptorControl 0x10068428
SetSecurityDescriptorDacl 0x100683f8
SetTokenInformation 0x10068414
api-ms-win-security-credentials-l1-1-0.dll 1
CredUnprotectW 0x10068454
api-ms-win-security-lsalookup-l1-1-0.dll 1
LookupAccountSidLocalW 0x1006845c
api-ms-win-security-lsapolicy-l1-1-0.dll 1
LsaFreeMemory 0x10068464
api-ms-win-security-provider-l1-1-0.dll 1
SetEntriesInAclW 0x1006846c
api-ms-win-security-sddl-l1-1-0.dll 3
ConvertSidToStringSidW 0x1006847c
ConvertStringSecurityDescriptorToSecurityDescriptorW 0x10068478
ConvertStringSidToSidW 0x10068474
api-ms-win-service-core-l1-1-0.dll 2
RegisterServiceCtrlHandlerExW 0x10068488
SetServiceStatus 0x10068484
DismApi.DLL 5
DismDisableFeature 0x1006800c
DismEnableFeature 0x10068004
DismInitialize 0x10068000
DismOpenSession 0x10068008
DismShutdown 0x10068010
msvcrt.dll 42
__CxxFrameHandler3 0x10068500
__dllonexit 0x100684a8
_amsg_exit 0x100684b4
_callnewh 0x100684c4
_CxxThrowException 0x100684f4
_except_handler4_common 0x100684c0
_initterm 0x100684cc
_lock 0x10068530
_onexit 0x100684d4
_purecall 0x10068518
_unlock 0x1006850c
_vsnprintf 0x100684ac
_vsnwprintf 0x100684d0
_wcsicmp 0x100684a4
_wcsnicmp 0x1006851c
_wtol 0x100684a0
_XcptFilter 0x10068514
??_V@YAXPAX@Z 0x100684c8
??0exception@@QAE@ABQBD@Z 0x100684e0
??0exception@@QAE@ABQBDH@Z 0x100684e4
??0exception@@QAE@ABV0@@Z 0x100684e8
??1exception@@UAE@XZ 0x100684ec
??1type_info@@UAE@XZ 0x10068508
??3@YAXPAX@Z 0x1006852c
?terminate@@YAXXZ 0x10068504
?what@exception@@UBEPBDXZ 0x100684f0
free 0x100684b0
iswalpha 0x10068528
malloc 0x100684d8
memcmp 0x100684bc
memcpy 0x100684f8
memcpy_s 0x1006849c
memmove 0x100684fc
memmove_s 0x10068490
memset 0x10068534
swprintf_s 0x10068510
toupper 0x100684b8
wcscat_s 0x10068498
wcschr 0x100684dc
wcscpy_s 0x10068494
wcsncmp 0x10068520
wcsrchr 0x10068524
ntdll.dll 38
DbgPrint 0x100685ac
EtwEventRegister 0x1006856c
EtwEventUnregister 0x10068570
EtwEventWriteFull 0x10068568
NtDuplicateToken 0x1006853c
NtQueryInformationProcess 0x10068540
NtQuerySystemInformation 0x100685cc
NtQueryWnfStateData 0x1006857c
RtlAcquireResourceExclusive 0x100685a0
RtlAcquireResourceShared 0x100685a8
RtlAllocateAndInitializeSid 0x1006859c
RtlAllocateHeap 0x10068548
RtlCaptureStackBackTrace 0x100685c4
RtlDeleteElementGenericTable 0x10068594
RtlDeleteResource 0x100685c8
RtlEnumerateGenericTable 0x10068598
RtlEqualSid 0x100685b0
RtlFreeHeap 0x100685d0
RtlFreeSid 0x100685b8
RtlGetActiveConsoleId 0x10068564
RtlInitializeGenericTable 0x10068590
RtlInitializeResource 0x100685bc
RtlInitUnicodeStringEx 0x1006858c
RtlInsertElementGenericTable 0x10068580
RtlLengthSid 0x10068544
RtlLookupElementGenericTable 0x10068584
RtlNtStatusToDosError 0x1006854c
RtlQueryEnvironmentVariable_U 0x10068588
RtlReleaseResource 0x100685a4
RtlSubscribeWnfStateChangeNotification 0x10068578
RtlUnsubscribeWnfStateChangeNotification 0x10068574
RtlVerifyVersionInfo 0x100685c0
VerSetConditionMask 0x100685b4
WinSqmAddToStream 0x10068558
WinSqmEndSession 0x1006855c
WinSqmIsOptedIn 0x10068560
WinSqmSetDWORD 0x10068550
WinSqmStartSession 0x10068554
RPCRT4.dll 24
I_RpcBindingInqLocalClientPID 0x10068018
NdrServerCall2 0x10068074
RpcBindingFree 0x10068030
RpcBindingInqAuthClientW 0x10068034
RpcBindingServerFromClient 0x1006803c
RpcBindingToStringBindingW 0x1006806c
RpcBindingVectorFree 0x10068020
RpcEpRegisterW 0x10068050
RpcFreeAuthorizationContext 0x10068040
RpcGetAuthorizationContextForClient 0x10068060
RpcImpersonateClient 0x10068058
RpcRevertToSelf 0x10068054
RpcServerInqBindings 0x10068028
RpcServerInqCallAttributesW 0x10068064
RpcServerInqDefaultPrincNameW 0x10068044
RpcServerRegisterAuthInfoW 0x10068024
RpcServerRegisterIfEx 0x1006805c
RpcServerUnregisterIfEx 0x10068070
RpcServerUseProtseqEpW 0x1006801c
RpcServerUseProtseqExW 0x1006802c
RpcStringBindingParseW 0x10068068
RpcStringFreeW 0x1006804c
UuidCreate 0x10068038
UuidToStringW 0x10068048
samcli.dll 3
NetLocalGroupAddMembers 0x100685dc
NetLocalGroupDelMembers 0x100685d8
NetUserGetInfo 0x100685e0
SCECLI.dll 1
SceSetupSystemByInfName 0x1006807c
SYSNTFY.dll 2
SysNotifyStartServer 0x10068084
SysNotifyStopServer 0x10068088