MpProvider.dll

v4.18.1907.16384 64-bit Windows NT Analyzed
Description
Microsoft Security Client Antimalware Provider
Authors
© Microsoft Corporation. All rights reserved.
File size
189.0 KB
Uploaded
2025-12-01 08:30
Views
42
SHA-256
b3ed873d535abbe0995a36541a33147d

Exported functions 4

DllCanUnloadNow #1 · 0x17d0
DllGetClassObject #2 · 0x1870
DllRegisterServer #3 · 0x1a00
DllUnregisterServer #4 · 0x1b50

Imported DLLs & functions 267

ADVAPI32.dll 43
AdjustTokenPrivileges 0x18001e880
AllocateAndInitializeSid 0x18001e930
ChangeServiceConfigW 0x18001e8a8
CheckTokenMembership 0x18001e928
CloseServiceHandle 0x18001e860
ControlService 0x18001e8a0
ControlTraceW 0x18001e828
ConvertStringSecurityDescriptorToSecurityDescriptorW 0x18001e950
CreateProcessAsUserW 0x18001e868
DeregisterEventSource 0x18001e810
DuplicateTokenEx 0x18001e940
EnableTrace 0x18001e820
FreeSid 0x18001e858
GetSidSubAuthority 0x18001e938
GetSidSubAuthorityCount 0x18001e948
GetTokenInformation 0x18001e848
GetTraceEnableFlags 0x18001e900
GetTraceEnableLevel 0x18001e908
GetTraceLoggerHandle 0x18001e910
GetUserNameW 0x18001e840
InitiateSystemShutdownExW 0x18001e878
LookupPrivilegeNameW 0x18001e870
LookupPrivilegeValueW 0x18001e890
OpenProcessToken 0x18001e800
OpenSCManagerW 0x18001e920
OpenServiceW 0x18001e8b0
OpenThreadToken 0x18001e850
PrivilegeCheck 0x18001e888
QueryServiceStatus 0x18001e898
RegCloseKey 0x18001e8e8
RegCreateKeyExW 0x18001e8c0
RegDeleteKeyW 0x18001e830
RegDeleteValueW 0x18001e8b8
RegEnumKeyExW 0x18001e8d0
RegisterEventSourceW 0x18001e818
RegisterTraceGuidsW 0x18001e8f8
RegOpenKeyExW 0x18001e8d8
RegQueryInfoKeyW 0x18001e8e0
RegQueryValueExW 0x18001e838
RegSetValueExW 0x18001e8c8
ReportEventW 0x18001e808
TraceMessage 0x18001e918
UnregisterTraceGuids 0x18001e8f0
CRYPT32.dll 1
CertVerifyCertificateChainPolicy 0x18001e960
KERNEL32.dll 108
AcquireSRWLockExclusive 0x18001eb90
CloseHandle 0x18001ea50
CompareStringW 0x18001ea08
CopyFileW 0x18001ebf0
CreateDirectoryW 0x18001ea80
CreateEventW 0x18001eaf8
CreateFileW 0x18001ead8
CreateMutexW 0x18001ec00
CreateProcessW 0x18001eb28
CreateThread 0x18001ec78
CreateToolhelp32Snapshot 0x18001ec28
DecodePointer 0x18001ea38
DeleteCriticalSection 0x18001ebd0
DeleteFileW 0x18001eb08
DisableThreadLibraryCalls 0x18001eb40
EncodePointer 0x18001ea40
EnterCriticalSection 0x18001ea18
ExpandEnvironmentStringsW 0x18001eab0
FileTimeToSystemTime 0x18001ea60
FindClose 0x18001eac8
FindFirstFileW 0x18001ea90
FindNextFileW 0x18001eaa0
FindResourceExW 0x18001e9d8
FindResourceW 0x18001ec40
FreeLibrary 0x18001ea00
FreeResource 0x18001ec48
GetCurrentProcess 0x18001e990
GetCurrentProcessId 0x18001e978
GetCurrentThread 0x18001ea48
GetCurrentThreadId 0x18001e970
GetDiskFreeSpaceExW 0x18001ec20
GetDriveTypeW 0x18001ecc0
GetExitCodeProcess 0x18001eb30
GetExitCodeThread 0x18001ec80
GetFileAttributesW 0x18001eae0
GetFileSize 0x18001ec60
GetFileSizeEx 0x18001ea98
GetLastError 0x18001ebb0
GetLocaleInfoW 0x18001ebf8
GetLocalTime 0x18001eb50
GetLongPathNameW 0x18001ec68
GetModuleFileNameW 0x18001eba8
GetModuleHandleW 0x18001ea20
GetNativeSystemInfo 0x18001eb10
GetPrivateProfileIntW 0x18001ec90
GetPrivateProfileStringW 0x18001ec88
GetProcAddress 0x18001ea30
GetProcessHeap 0x18001eb78
GetSystemDefaultUILanguage 0x18001eca0
GetSystemDirectoryW 0x18001eae8
GetSystemTimeAsFileTime 0x18001e9b0
GetTempFileNameW 0x18001ebe8
GetTempPathW 0x18001eac0
GetThreadLocale 0x18001ebc0
GetTickCount 0x18001e9c8
GetUserDefaultUILanguage 0x18001eca8
GetVersionExW 0x18001ecb8
GetWindowsDirectoryW 0x18001ec18
GlobalFindAtomW 0x18001ecc8
HeapAlloc 0x18001eb70
HeapDestroy 0x18001eb80
HeapFree 0x18001eb68
HeapReAlloc 0x18001eb60
HeapSize 0x18001eb58
InitializeCriticalSection 0x18001e9c0
InitializeCriticalSectionAndSpinCount 0x18001eb38
IsWow64Process 0x18001ec10
K32GetModuleFileNameExW 0x18001ec50
LeaveCriticalSection 0x18001ea10
LoadLibraryExW 0x18001ea28
LoadResource 0x18001e9e0
LocalFree 0x18001eb20
LockResource 0x18001ea70
lstrcmpiW 0x18001e9f8
MoveFileW 0x18001ec70
MultiByteToWideChar 0x18001e9f0
OpenProcess 0x18001eaf0
OutputDebugStringA 0x18001ebe0
Process32FirstW 0x18001ec30
Process32NextW 0x18001ec38
ProcessIdToSessionId 0x18001ecb0
QueryPerformanceCounter 0x18001e980
RaiseException 0x18001ebc8
ReadFile 0x18001ea88
ReleaseMutex 0x18001ec08
ReleaseSRWLockExclusive 0x18001eb88
RemoveDirectoryW 0x18001eab8
ResetEvent 0x18001eb18
RtlCaptureContext 0x18001e9b8
RtlLookupFunctionEntry 0x18001e9d0
RtlVirtualUnwind 0x18001e9a8
SetEvent 0x18001eb00
SetLastError 0x18001ea78
SetThreadLocale 0x18001ebb8
SetUnhandledExceptionFilter 0x18001e998
SizeofResource 0x18001e9e8
Sleep 0x18001ebd8
SleepConditionVariableSRW 0x18001eba0
SwitchToThread 0x18001ea68
SystemTimeToFileTime 0x18001ea58
TerminateProcess 0x18001e988
UnhandledExceptionFilter 0x18001e9a0
VerifyVersionInfoW 0x18001ec58
VirtualLock 0x18001eb48
WaitForSingleObject 0x18001ead0
WakeAllConditionVariable 0x18001eb98
WriteFile 0x18001eaa8
WritePrivateProfileStringW 0x18001ec98
msvcrt.dll 39
__C_specific_handler 0x18001f000
__CxxFrameHandler3 0x18001ef20
__dllonexit 0x18001ef60
_amsg_exit 0x18001ef90
_CxxThrowException 0x18001efc0
_errno 0x18001ef50
_initterm 0x18001ef88
_lock 0x18001ef70
_onexit 0x18001ef58
_purecall 0x18001f008
_unlock 0x18001ef68
_vscwprintf 0x18001ef38
_vsnprintf 0x18001ef28
_vsnwprintf 0x18001f038
_wchmod 0x18001ef30
_XcptFilter 0x18001ef98
??0exception@@QEAA@AEBQEBD@Z 0x18001efa0
??0exception@@QEAA@AEBQEBDH@Z 0x18001efd8
??0exception@@QEAA@AEBV0@@Z 0x18001efd0
??0exception@@QEAA@XZ 0x18001efa8
??1exception@@UEAA@XZ 0x18001efe0
??1type_info@@UEAA@XZ 0x18001ef78
?terminate@@YAXXZ 0x18001ef80
?what@exception@@UEBAPEBDXZ 0x18001efe8
free 0x18001f020
iswalpha 0x18001f040
malloc 0x18001eff0
memcpy 0x18001efb8
memcpy_s 0x18001eff8
memmove 0x18001efb0
memmove_s 0x18001efc8
memset 0x18001f050
realloc 0x18001ef48
vswprintf_s 0x18001ef40
wcscat_s 0x18001f018
wcschr 0x18001f030
wcscpy_s 0x18001f028
wcsncpy_s 0x18001f010
wcsrchr 0x18001f048
ntdll.dll 2
RtlGetVersion 0x18001f060
RtlNtStatusToDosError 0x18001f068
ole32.dll 9
CoCreateGuid 0x18001f080
CoCreateInstance 0x18001f0a8
CoGetClassObject 0x18001f088
CoImpersonateClient 0x18001f078
CoRevertToSelf 0x18001f0b8
CoTaskMemAlloc 0x18001f090
CoTaskMemFree 0x18001f0a0
CoTaskMemRealloc 0x18001f098
StringFromGUID2 0x18001f0b0
OLEAUT32.dll 16
SafeArrayCreate 0x18001ecf8
SafeArrayDestroy 0x18001ed18
SafeArrayGetLBound 0x18001ed08
SafeArrayGetUBound 0x18001ed10
SafeArrayGetVartype 0x18001ed20
SafeArrayLock 0x18001ece8
SafeArrayUnlock 0x18001ed00
SysAllocString 0x18001ed48
SysAllocStringLen 0x18001ed50
SysFreeString 0x18001ed40
SysStringByteLen 0x18001ecd8
SysStringLen 0x18001ed38
VarBstrCat 0x18001ecf0
VariantClear 0x18001ed30
VariantInit 0x18001ed28
VarUI4FromStr 0x18001ece0
SHELL32.dll 3
SHGetFolderPathW 0x18001ed70
SHGetPathFromIDListW 0x18001ed68
SHGetSpecialFolderLocation 0x18001ed60
SHLWAPI.dll 8
PathAppendW 0x18001eda0
PathCombineW 0x18001eda8
PathFileExistsW 0x18001ed88
PathFindFileNameW 0x18001ed80
PathIsDirectoryW 0x18001edb8
PathIsRelativeW 0x18001ed90
PathMatchSpecW 0x18001edb0
PathRemoveFileSpecW 0x18001ed98
USER32.dll 20
AdjustWindowRectEx 0x18001ee50
CharNextW 0x18001ee00
CreateDialogParamW 0x18001edc8
DestroyWindow 0x18001edd8
FindWindowW 0x18001ee10
GetSystemMetrics 0x18001ee08
GetWindowThreadProcessId 0x18001ee18
IsDialogMessageW 0x18001ee40
KillTimer 0x18001ee38
LoadIconW 0x18001edd0
LoadStringW 0x18001edf0
MessageBoxW 0x18001ee20
PostMessageW 0x18001edf8
PostThreadMessageW 0x18001ee48
SendMessageW 0x18001ede0
SetForegroundWindow 0x18001ee28
SetTimer 0x18001ee30
SetWindowTextW 0x18001ee60
ShowWindow 0x18001ede8
UnregisterClassA 0x18001ee58
USERENV.dll 2
CreateEnvironmentBlock 0x18001ee70
DestroyEnvironmentBlock 0x18001ee78
VERSION.dll 3
GetFileVersionInfoSizeW 0x18001ee98
GetFileVersionInfoW 0x18001ee88
VerQueryValueW 0x18001ee90
WINTRUST.dll 9
CryptCATAdminAcquireContext 0x18001eed8
CryptCATAdminCalcHashFromFileHandle 0x18001eee0
CryptCATAdminEnumCatalogFromHash 0x18001eed0
CryptCATAdminReleaseCatalogContext 0x18001eec0
CryptCATAdminReleaseContext 0x18001eeb8
CryptCATCatalogInfoFromContext 0x18001eec8
WinVerifyTrust 0x18001eee8
WTHelperGetProvSignerFromChain 0x18001eeb0
WTHelperProvDataFromStateData 0x18001eea8
WTSAPI32.dll 4
WTSEnumerateSessionsW 0x18001ef00
WTSFreeMemory 0x18001ef08
WTSQuerySessionInformationW 0x18001eef8
WTSQueryUserToken 0x18001ef10