RunPsScript.dll

v10.8804.27858.1000 64-bit Windows NT Analyzed
Description
Run PS Script
Authors
© Microsoft Corporation. All rights reserved.
File size
1.3 MB
Uploaded
2025-12-01 08:31
Views
49
SHA-256
20abe0dc926481b849d72a9ff745045f

Exported functions 1

RunPsScript #1 · 0x31660

Imported DLLs & functions 289

ADVAPI32.dll 27
AdjustTokenPrivileges 0x1800db038
ConvertStringSecurityDescriptorToSecurityDescriptorW 0x1800db050
ConvertStringSidToSidW 0x1800db058
CreateProcessAsUserW 0x1800db000
CreateRestrictedToken 0x1800db0a8
DuplicateTokenEx 0x1800db0a0
EqualSid 0x1800db098
EventRegister 0x1800db0d0
EventSetInformation 0x1800db0c0
EventUnregister 0x1800db0c8
EventWriteTransfer 0x1800db0b8
FreeSid 0x1800db090
GetLengthSid 0x1800db088
GetTokenInformation 0x1800db080
ImpersonateLoggedOnUser 0x1800db078
IsValidSid 0x1800db070
LogonUserW 0x1800db060
LookupPrivilegeValueW 0x1800db030
OpenProcessToken 0x1800db0b0
RegCloseKey 0x1800db048
RegCreateKeyExW 0x1800db028
RegDeleteKeyValueW 0x1800db010
RegGetValueW 0x1800db008
RegOpenKeyExW 0x1800db020
RegQueryValueExW 0x1800db040
RegSetValueExW 0x1800db018
RevertToSelf 0x1800db068
api-ms-win-core-featurestaging-l1-1-0.dll 5
GetFeatureEnabledState 0x1800db8b8
RecordFeatureError 0x1800db8a8
RecordFeatureUsage 0x1800db8b0
SubscribeFeatureStateChangeNotification 0x1800db8c0
UnsubscribeFeatureStateChangeNotification 0x1800db8c8
api-ms-win-core-featurestaging-l1-1-1.dll 1
GetFeatureVariant 0x1800db8d8
api-ms-win-core-winrt-l1-1-0.dll 1
RoGetActivationFactory 0x1800db8e8
api-ms-win-core-winrt-string-l1-1-0.dll 3
WindowsCreateStringReference 0x1800db8f8
WindowsDeleteString 0x1800db900
WindowsGetStringRawBuffer 0x1800db908
api-ms-win-core-xstate-l2-1-0.dll 1
GetEnabledXStateFeatures 0x1800db918
bcrypt.dll 7
BCryptCloseAlgorithmProvider 0x1800db928
BCryptCreateHash 0x1800db958
BCryptDestroyHash 0x1800db950
BCryptFinishHash 0x1800db938
BCryptGetProperty 0x1800db948
BCryptHashData 0x1800db940
BCryptOpenAlgorithmProvider 0x1800db930
CRYPT32.dll 11
CertCloseStore 0x1800db0e8
CertDuplicateCertificateContext 0x1800db100
CertFindCertificateInStore 0x1800db130
CertFindExtension 0x1800db110
CertFreeCertificateContext 0x1800db0f0
CertGetCertificateContextProperty 0x1800db108
CertGetNameStringW 0x1800db118
CertOpenStore 0x1800db128
CertVerifyCertificateChainPolicy 0x1800db120
CryptBinaryToStringA 0x1800db0e0
CryptDecodeObjectEx 0x1800db0f8
IPHLPAPI.DLL 4
FreeMibTable 0x1800db148
GetIfEntry2 0x1800db150
GetUnicastIpAddressEntry 0x1800db158
GetUnicastIpAddressTable 0x1800db140
KERNEL32.dll 180
AcquireSRWLockExclusive 0x1800db410
AcquireSRWLockShared 0x1800db418
AssignProcessToJobObject 0x1800db5e8
CancelIo 0x1800db588
CloseHandle 0x1800db2f0
CloseThreadpoolTimer 0x1800db3f0
CompareFileTime 0x1800db3f8
CompareStringEx 0x1800db6a0
CompareStringW 0x1800db6e0
CreateEventA 0x1800db2b0
CreateEventExW 0x1800db558
CreateEventW 0x1800db550
CreateFileW 0x1800db390
CreateIoCompletionPort 0x1800db5c8
CreateJobObjectW 0x1800db2d0
CreateMutexExW 0x1800db340
CreatePipe 0x1800db298
CreateSemaphoreExW 0x1800db348
CreateThread 0x1800db198
CreateThreadpoolTimer 0x1800db3d8
CreateToolhelp32Snapshot 0x1800db4a0
DebugBreak 0x1800db2e0
DecodePointer 0x1800db478
DeleteCriticalSection 0x1800db3d0
DeleteProcThreadAttributeList 0x1800db1a8
DeviceIoControl 0x1800db500
EncodePointer 0x1800db6b0
EnterCriticalSection 0x1800db3b8
EnumSystemLocalesW 0x1800db220
ExitProcess 0x1800db178
ExitThread 0x1800db190
FindClose 0x1800db510
FindFirstFileExW 0x1800db258
FindFirstVolumeW 0x1800db4b8
FindNextFileW 0x1800db518
FindNextVolumeW 0x1800db4c0
FindVolumeClose 0x1800db4c8
FlsAlloc 0x1800db1e0
FlsFree 0x1800db1f8
FlsGetValue 0x1800db1e8
FlsSetValue 0x1800db1f0
FlushFileBuffers 0x1800db520
FormatMessageW 0x1800db380
FreeEnvironmentStringsW 0x1800db278
FreeLibrary 0x1800db5b0
FreeLibraryAndExitThread 0x1800db180
GetACP 0x1800db248
GetCommandLineA 0x1800db260
GetCommandLineW 0x1800db268
GetComputerNameExW 0x1800db570
GetConsoleMode 0x1800db230
GetConsoleOutputCP 0x1800db228
GetCPInfo 0x1800db698
GetCurrentProcess 0x1800db420
GetCurrentProcessId 0x1800db350
GetCurrentThreadId 0x1800db358
GetDriveTypeW 0x1800db4d0
GetEnvironmentStringsW 0x1800db270
GetEnvironmentVariableW 0x1800db468
GetExitCodeProcess 0x1800db398
GetExitCodeThread 0x1800db6b8
GetFileSizeEx 0x1800db528
GetFileType 0x1800db168
GetLastError 0x1800db2f8
GetLocaleInfoW 0x1800db208
GetLogicalDrives 0x1800db4d8
GetModuleFileNameA 0x1800db360
GetModuleFileNameW 0x1800db458
GetModuleHandleExA 0x1800db658
GetModuleHandleExW 0x1800db370
GetModuleHandleW 0x1800db368
GetOEMCP 0x1800db250
GetOverlappedResultEx 0x1800db590
GetProcAddress 0x1800db378
GetProcessHeap 0x1800db310
GetProductInfo 0x1800db450
GetQueuedCompletionStatus 0x1800db5d0
GetStartupInfoW 0x1800db648
GetStdHandle 0x1800db170
GetStringTypeW 0x1800db6e8
GetSystemInfo 0x1800db2c8
GetSystemTimeAsFileTime 0x1800db470
GetSystemTimePreciseAsFileTime 0x1800db5b8
GetTickCount 0x1800db560
GetUserDefaultLCID 0x1800db218
GetVersionExW 0x1800db448
GetVolumeInformationW 0x1800db4e0
GetVolumeNameForVolumeMountPointW 0x1800db4f0
GetVolumePathNamesForVolumeNameW 0x1800db4f8
GetWindowsDirectoryW 0x1800db568
GlobalAlloc 0x1800db578
GlobalFree 0x1800db580
HeapAlloc 0x1800db308
HeapFree 0x1800db6d8
HeapReAlloc 0x1800db480
HeapSize 0x1800db488
InitializeCriticalSectionAndSpinCount 0x1800db628
InitializeCriticalSectionEx 0x1800db3c8
InitializeProcThreadAttributeList 0x1800db1a0
InitializeSListHead 0x1800db688
InitOnceBeginInitialize 0x1800db690
InitOnceComplete 0x1800db3a0
InterlockedFlushSList 0x1800db630
InterlockedPushEntrySList 0x1800db638
IsDebuggerPresent 0x1800db2d8
IsProcessInJob 0x1800db5e0
IsProcessorFeaturePresent 0x1800db650
IsValidCodePage 0x1800db240
IsValidLocale 0x1800db210
K32GetPerformanceInfo 0x1800db1d0
LCMapStringEx 0x1800db6a8
LCMapStringW 0x1800db200
LeaveCriticalSection 0x1800db3c0
LoadLibraryExA 0x1800db1c8
LoadLibraryExW 0x1800db600
LocalFree 0x1800db430
MultiByteToWideChar 0x1800db508
OpenEventA 0x1800db2b8
OpenProcess 0x1800db428
OpenSemaphoreW 0x1800db338
OutputDebugStringW 0x1800db2e8
PostQueuedCompletionStatus 0x1800db5d8
Process32FirstW 0x1800db4a8
Process32NextW 0x1800db4b0
QueryDosDeviceW 0x1800db4e8
QueryFullProcessImageNameW 0x1800db498
QueryInformationJobObject 0x1800db5f8
QueryPerformanceCounter 0x1800db3a8
QueryPerformanceFrequency 0x1800db3b0
RaiseException 0x1800db6f8
ReadConsoleW 0x1800db238
ReadFile 0x1800db530
RegisterWaitForSingleObject 0x1800db5a0
ReleaseMutex 0x1800db320
ReleaseSemaphore 0x1800db318
ReleaseSRWLockExclusive 0x1800db400
ReleaseSRWLockShared 0x1800db408
ResetEvent 0x1800db1d8
ResumeThread 0x1800db188
RtlCaptureContext 0x1800db680
RtlLookupFunctionEntry 0x1800db678
RtlPcToFileHeader 0x1800db6f0
RtlUnwind 0x1800db6d0
RtlUnwindEx 0x1800db640
RtlVirtualUnwind 0x1800db670
SetEndOfFile 0x1800db538
SetEvent 0x1800db2a0
SetFilePointer 0x1800db5c0
SetFilePointerEx 0x1800db540
SetHandleInformation 0x1800db290
SetInformationJobObject 0x1800db5f0
SetLastError 0x1800db300
SetStdHandle 0x1800db280
SetThreadpoolTimer 0x1800db3e0
SetUnhandledExceptionFilter 0x1800db660
Sleep 0x1800db440
SleepConditionVariableSRW 0x1800db6c0
TerminateProcess 0x1800db490
TlsAlloc 0x1800db620
TlsFree 0x1800db608
TlsGetValue 0x1800db618
TlsSetValue 0x1800db610
TryAcquireSRWLockExclusive 0x1800db700
UnhandledExceptionFilter 0x1800db668
UnregisterWaitEx 0x1800db598
UpdateProcThreadAttribute 0x1800db1b0
VerifyVersionInfoW 0x1800db460
VerSetConditionMask 0x1800db438
VirtualProtect 0x1800db1b8
VirtualQuery 0x1800db1c0
WaitForMultipleObjectsEx 0x1800db2a8
WaitForSingleObject 0x1800db328
WaitForSingleObjectEx 0x1800db330
WaitForThreadpoolTimerCallbacks 0x1800db3e8
WakeAllConditionVariable 0x1800db6c8
WerRegisterCustomMetadata 0x1800db2c0
WideCharToMultiByte 0x1800db388
WriteConsoleW 0x1800db288
WriteFile 0x1800db548
WTSGetActiveConsoleSessionId 0x1800db5a8
ntdll.dll 4
NtOpenFile 0x1800db980
NtQuerySystemInformation 0x1800db968
RtlInitUnicodeString 0x1800db978
ZwQueryEaFile 0x1800db970
ole32.dll 4
CoCreateFreeThreadedMarshaler 0x1800db998
CoGetApartmentType 0x1800db990
CoTaskMemFree 0x1800db9a8
CoWaitForMultipleHandles 0x1800db9a0
RPCRT4.dll 3
RpcStringFreeW 0x1800db720
UuidCreate 0x1800db718
UuidToStringW 0x1800db710
Secur32.dll 1
GetUserNameExW 0x1800db788
SETUPAPI.dll 7
SetupDiDestroyDeviceInfoList 0x1800db748
SetupDiEnumDeviceInfo 0x1800db740
SetupDiEnumDeviceInterfaces 0x1800db760
SetupDiGetClassDevsW 0x1800db758
SetupDiGetDeviceInterfaceDetailW 0x1800db738
SetupDiGetDevicePropertyW 0x1800db750
SetupDiGetDeviceRegistryPropertyW 0x1800db730
SHELL32.dll 2
CommandLineToArgvW 0x1800db770
SHGetKnownFolderPath 0x1800db778
USER32.dll 7
DispatchMessageW 0x1800db7b0
LoadCursorW 0x1800db7a8
MsgWaitForMultipleObjectsEx 0x1800db7b8
PeekMessageW 0x1800db798
PostQuitMessage 0x1800db7a0
SetCursor 0x1800db7c8
TranslateMessage 0x1800db7c0
USERENV.dll 2
CreateEnvironmentBlock 0x1800db7e0
DestroyEnvironmentBlock 0x1800db7d8
VERSION.dll 3
GetFileVersionInfoSizeW 0x1800db800
GetFileVersionInfoW 0x1800db7f0
VerQueryValueW 0x1800db7f8
WINTRUST.dll 10
CryptCATAdminAcquireContext2 0x1800db848
CryptCATAdminCalcHashFromFileHandle2 0x1800db818
CryptCATAdminEnumCatalogFromHash 0x1800db820
CryptCATAdminReleaseContext 0x1800db810
CryptCATCatalogInfoFromContext 0x1800db828
WinVerifyTrust 0x1800db830
WinVerifyTrustEx 0x1800db858
WTHelperGetProvCertFromChain 0x1800db840
WTHelperGetProvSignerFromChain 0x1800db850
WTHelperProvDataFromStateData 0x1800db838
WS2_32.dll 1
InetNtopW 0x1800db868
WTSAPI32.dll 5
WTSCloseServer 0x1800db878
WTSEnumerateSessionsExW 0x1800db898
WTSFreeMemoryExW 0x1800db890
WTSOpenServerExW 0x1800db880
WTSQueryUserToken 0x1800db888