AppvIsvSubsystems64.dll

v16.0.19822.20012 64-bit Windows NT Analyzed
Download
Description
Client Virtualization Subsystems
Authors
Microsoft Corporation
File size
1.4 MB
Uploaded
2026-07-20 08:30
Views
56
SHA-256
88fd193f36bfb0bfb3f4c0dbf4ae72d2

Exported functions 7

APIExportForDetours #1 · 0x98a0
RequestUnhookedFunctionList #2 · 0x87e0
VirtualizeCurrentThread #3 · 0xa170
CurrentThreadIsVirtualized #4 · 0xa150
VirtualizeCurrentProcess #5 · 0xa210
GetPhysicalPath #6 · 0xa380
IsProcessHooked #7 · 0xa140

Imported DLLs & functions 327

api-ms-win-crt-convert-l1-1-0.dll 2
_wtoi 0x1800dc7b0
wcstol 0x1800dc7a8
api-ms-win-crt-filesystem-l1-1-0.dll 1
_wsplitpath_s 0x1800dc7c0
api-ms-win-crt-heap-l1-1-0.dll 5
_get_heap_handle 0x1800dc7e8
calloc 0x1800dc7e0
free 0x1800dc7d8
malloc 0x1800dc7d0
realloc 0x1800dc7f0
api-ms-win-crt-locale-l1-1-0.dll 1
__initialize_lconv_for_unsigned_char 0x1800dc800
api-ms-win-crt-math-l1-1-0.dll 1
ceilf 0x1800dc810
api-ms-win-crt-runtime-l1-1-0.dll 15
_cexit 0x1800dc890
_configure_narrow_argv 0x1800dc848
_crt_atexit 0x1800dc880
_errno 0x1800dc878
_execute_onexit_table 0x1800dc888
_initialize_narrow_environment 0x1800dc820
_initialize_onexit_table 0x1800dc850
_initterm 0x1800dc840
_initterm_e 0x1800dc838
_invalid_parameter_noinfo 0x1800dc870
_invoke_watson 0x1800dc868
_register_onexit_function 0x1800dc828
_resetstkoflw 0x1800dc860
_seh_filter_dll 0x1800dc830
terminate 0x1800dc858
api-ms-win-crt-stdio-l1-1-0.dll 1
__stdio_common_vswprintf_s 0x1800dc8a0
api-ms-win-crt-string-l1-1-0.dll 17
_stricmp 0x1800dc8b8
_strnicmp 0x1800dc8f0
_wcsicmp 0x1800dc920
_wcslwr_s 0x1800dc8f8
_wcsnicmp 0x1800dc8c0
_wcsupr_s 0x1800dc900
iswalpha 0x1800dc908
iswctype 0x1800dc8e0
iswdigit 0x1800dc910
iswspace 0x1800dc918
strcpy_s 0x1800dc8e8
strnlen 0x1800dc928
wcscpy_s 0x1800dc8d0
wcsncmp 0x1800dc8b0
wcsncpy_s 0x1800dc930
wcsnlen 0x1800dc8d8
wmemcpy_s 0x1800dc8c8
api-ms-win-crt-time-l1-1-0.dll 1
_time64 0x1800dc940
api-ms-win-crt-utility-l1-1-0.dll 2
rand 0x1800dc958
srand 0x1800dc950
c2r64.dll 1
0x18016116e
KERNEL32.dll 130
AcquireSRWLockExclusive 0x1800dc1e0
AcquireSRWLockShared 0x1800dc1d0
ActivateActCtx 0x1800dc008
CheckRemoteDebuggerPresent 0x1800dc110
CloseHandle 0x1800dc058
CompareStringOrdinal 0x1800dc3d8
CompareStringW 0x1800dc178
CreateActCtxW 0x1800dc000
CreateEventW 0x1800dc190
CreateFileMappingW 0x1800dc268
CreateFileW 0x1800dc2a8
CreateMutexW 0x1800dc0e8
CreateProcessW 0x1800dc150
DeactivateActCtx 0x1800dc040
DebugBreak 0x1800dc0e0
DeleteCriticalSection 0x1800dc070
DeviceIoControl 0x1800dc170
DisableThreadLibraryCalls 0x1800dc100
DuplicateHandle 0x1800dc180
EnterCriticalSection 0x1800dc088
ExpandEnvironmentStringsW 0x1800dc2c8
FindActCtxSectionStringW 0x1800dc030
FindClose 0x1800dc2b0
FindFirstFileNameW 0x1800dc240
FindFirstFileW 0x1800dc2d8
FindFirstVolumeW 0x1800dc140
FindNextFileNameW 0x1800dc218
FindNextFileW 0x1800dc238
FindNextVolumeW 0x1800dc300
FindVolumeClose 0x1800dc3f8
FlushFileBuffers 0x1800dc158
FlushInstructionCache 0x1800dc360
FlushViewOfFile 0x1800dc160
FreeEnvironmentStringsW 0x1800dc318
FreeLibrary 0x1800dc080
GetCurrentDirectoryW 0x1800dc288
GetCurrentProcess 0x1800dc0c0
GetCurrentProcessId 0x1800dc0b0
GetCurrentThread 0x1800dc290
GetCurrentThreadId 0x1800dc0a0
GetEnvironmentStringsW 0x1800dc328
GetEnvironmentVariableW 0x1800dc2b8
GetFileAttributesW 0x1800dc228
GetFinalPathNameByHandleW 0x1800dc230
GetLastError 0x1800dc050
GetLogicalDriveStringsW 0x1800dc220
GetModuleFileNameW 0x1800dc028
GetModuleHandleExW 0x1800dc018
GetModuleHandleW 0x1800dc078
GetNativeSystemInfo 0x1800dc250
GetProcAddress 0x1800dc068
GetProcessHeap 0x1800dc0d8
GetProcessId 0x1800dc3d0
GetShortPathNameW 0x1800dc2c0
GetSystemDirectoryW 0x1800dc2a0
GetSystemInfo 0x1800dc3c8
GetSystemTimeAsFileTime 0x1800dc210
GetThreadContext 0x1800dc358
GetVersion 0x1800dc3e0
GetVersionExW 0x1800dc258
GetVolumePathNamesForVolumeNameW 0x1800dc2f8
GetVolumePathNameW 0x1800dc308
GetWindowsDirectoryW 0x1800dc278
HeapAlloc 0x1800dc0d0
HeapCreate 0x1800dc118
HeapDestroy 0x1800dc280
HeapFree 0x1800dc0b8
HeapReAlloc 0x1800dc128
HeapSize 0x1800dc120
InitializeCriticalSection 0x1800dc098
InitializeCriticalSectionAndSpinCount 0x1800dc1a0
InitializeCriticalSectionEx 0x1800dc038
InitializeSListHead 0x1800dc3c0
InitializeSRWLock 0x1800dc1f0
IsDebuggerPresent 0x1800dc108
IsProcessorFeaturePresent 0x1800dc3a0
IsWow64Process 0x1800dc188
K32GetMappedFileNameW 0x1800dc208
K32GetModuleInformation 0x1800dc0c8
LeaveCriticalSection 0x1800dc090
LoadLibraryA 0x1800dc200
LoadLibraryExA 0x1800dc338
LoadLibraryExW 0x1800dc340
LoadLibraryW 0x1800dc060
LocalFree 0x1800dc270
MapViewOfFile 0x1800dc260
MultiByteToWideChar 0x1800dc2e0
OpenEventW 0x1800dc198
OpenFileMappingW 0x1800dc168
OutputDebugStringA 0x1800dc020
OutputDebugStringW 0x1800dc130
QueryActCtxW 0x1800dc048
QueryDosDeviceW 0x1800dc248
QueryPerformanceCounter 0x1800dc3b8
QueueUserWorkItem 0x1800dc3f0
RaiseException 0x1800dc138
RaiseFailFastException 0x1800dc2e8
ReleaseMutex 0x1800dc0f8
ReleaseSRWLockExclusive 0x1800dc1e8
ReleaseSRWLockShared 0x1800dc1d8
ResetEvent 0x1800dc408
ResumeThread 0x1800dc320
RtlCaptureContext 0x1800dc370
RtlLookupFunctionEntry 0x1800dc378
RtlVirtualUnwind 0x1800dc380
SearchPathW 0x1800dc2d0
SetCurrentDirectoryW 0x1800dc148
SetEnvironmentVariableW 0x1800dc310
SetEvent 0x1800dc400
SetLastError 0x1800dc010
SetThreadContext 0x1800dc368
SetUnhandledExceptionFilter 0x1800dc390
Sleep 0x1800dc0a8
SleepConditionVariableSRW 0x1800dc3b0
SuspendThread 0x1800dc350
TerminateProcess 0x1800dc398
TlsAlloc 0x1800dc1c0
TlsFree 0x1800dc1b0
TlsGetValue 0x1800dc1b8
TlsSetValue 0x1800dc1c8
UnhandledExceptionFilter 0x1800dc388
UnmapViewOfFile 0x1800dc298
VirtualAlloc 0x1800dc348
VirtualFree 0x1800dc330
VirtualProtect 0x1800dc2f0
VirtualQuery 0x1800dc1a8
WaitForMultipleObjects 0x1800dc3e8
WaitForSingleObject 0x1800dc0f0
WakeAllConditionVariable 0x1800dc3a8
WideCharToMultiByte 0x1800dc1f8
MSVCP140.dll 90
_Wcscoll 0x1800dc530
_Wcsxfrm 0x1800dc4f0
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ 0x1800dc440
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z 0x1800dc4b0
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ 0x1800dc450
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ 0x1800dc518
?_Id_cnt@id@locale@std@@0HA 0x1800dc500
?_Incref@facet@locale@std@@UEAAXXZ 0x1800dc448
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z 0x1800dc510
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ 0x1800dc6c0
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ 0x1800dc5a8
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ 0x1800dc658
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ 0x1800dc5f0
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ 0x1800dc6b8
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ 0x1800dc5a0
?_Xbad_alloc@std@@YAXXZ 0x1800dc4b8
?_Xbad_function_call@std@@YAXXZ 0x1800dc4a0
?_Xlength_error@std@@YAXPEBD@Z 0x1800dc4c8
?_Xout_of_range@std@@YAXPEBD@Z 0x1800dc4c0
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z 0x1800dc4f8
??0_Locinfo@std@@QEAA@PEBD@Z 0x1800dc460
??0_Lockit@std@@QEAA@H@Z 0x1800dc520
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ 0x1800dc588
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ 0x1800dc5d8
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z 0x1800dc6d8
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z 0x1800dc5c0
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z 0x1800dc4e8
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z 0x1800dc618
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ 0x1800dc580
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ 0x1800dc5f8
??0facet@locale@std@@IEAA@_K@Z 0x1800dc438
??1_Locinfo@std@@QEAA@XZ 0x1800dc458
??1_Lockit@std@@QEAA@XZ 0x1800dc528
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ 0x1800dc6d0
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ 0x1800dc5b8
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ 0x1800dc670
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ 0x1800dc540
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ 0x1800dc4e0
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ 0x1800dc610
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ 0x1800dc6c8
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ 0x1800dc5b0
??1facet@locale@std@@MEAA@XZ 0x1800dc430
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAH@Z 0x1800dc4d8
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z 0x1800dc4a8
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_N@Z 0x1800dc480
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z 0x1800dc628
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z 0x1800dc668
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z 0x1800dc538
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z 0x1800dc678
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z 0x1800dc498
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z 0x1800dc608
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z 0x1800dc600
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z 0x1800dc550
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z 0x1800dc548
?exceptions@ios_base@std@@QEAAXH@Z 0x1800dc4d0
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ 0x1800dc650
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ 0x1800dc5e8
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ 0x1800dc468
?good@ios_base@std@@QEBA_NXZ 0x1800dc630
?id@?$collate@_W@std@@2V0locale@2@A 0x1800dc6e0
?id@?$ctype@_W@std@@2V0locale@2@A 0x1800dc508
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z 0x1800dc680
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z 0x1800dc558
?is@?$ctype@_W@std@@QEBA_NF_W@Z 0x1800dc428
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z 0x1800dc490
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z 0x1800dc690
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z 0x1800dc568
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z 0x1800dc648
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z 0x1800dc5e0
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z 0x1800dc620
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ 0x1800dc6b0
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ 0x1800dc598
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z 0x1800dc640
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z 0x1800dc5d0
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z 0x1800dc638
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z 0x1800dc5c8
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ 0x1800dc688
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ 0x1800dc560
?tolower@?$ctype@_W@std@@QEBA_W_W@Z 0x1800dc420
?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z 0x1800dc418
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ 0x1800dc6a8
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ 0x1800dc590
?uncaught_exceptions@std@@YAHXZ 0x1800dc660
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A 0x1800dc478
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z 0x1800dc488
?widen@?$ctype@_W@std@@QEBA_WD@Z 0x1800dc470
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z 0x1800dc6a0
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z 0x1800dc578
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z 0x1800dc698
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z 0x1800dc570
ntdll.dll 39
NtClose 0x1800dca58
NtCreateKey 0x1800dca60
NtDeleteKey 0x1800dca20
NtDeleteValueKey 0x1800dca50
NtDuplicateObject 0x1800dc970
NtEnumerateKey 0x1800dca28
NtEnumerateValueKey 0x1800dca30
NtFlushKey 0x1800dca48
NtNotifyChangeMultipleKeys 0x1800dca40
NtOpenKey 0x1800dca38
NtQueryInformationProcess 0x1800dc9d8
NtQueryKey 0x1800dca18
NtQueryObject 0x1800dc9b0
NtQuerySecurityObject 0x1800dca88
NtQueryValueKey 0x1800dca78
NtReadFile 0x1800dca98
NtRenameKey 0x1800dca68
NtSetEvent 0x1800dca90
NtSetInformationThread 0x1800dc9f8
NtSetSecurityObject 0x1800dca00
NtSetValueKey 0x1800dca70
NtWriteFile 0x1800dc980
RtlAllocateHeap 0x1800dc9e8
RtlCompareUnicodeString 0x1800dca80
RtlCopyUnicodeString 0x1800dc9a0
RtlDeleteElementGenericTableAvl 0x1800dc990
RtlEnumerateGenericTableAvl 0x1800dca10
RtlEnumerateGenericTableWithoutSplayingAvl 0x1800dc9c0
RtlEqualUnicodeString 0x1800dca08
RtlFreeHeap 0x1800dc9f0
RtlInitializeGenericTableAvl 0x1800dc988
RtlInitUnicodeString 0x1800dc978
RtlInsertElementGenericTableAvl 0x1800dc9a8
RtlIntegerToUnicodeString 0x1800dc9e0
RtlIsGenericTableEmptyAvl 0x1800dc9b8
RtlIsNameInExpression 0x1800dc9c8
RtlLookupElementGenericTableAvl 0x1800dc998
RtlNtStatusToDosError 0x1800dc968
RtlPrefixUnicodeString 0x1800dc9d0
VCRUNTIME140_1.dll 1
__CxxFrameHandler4 0x1800dc798
VCRUNTIME140.dll 20
__C_specific_handler 0x1800dc6f8
__C_specific_handler_noexcept 0x1800dc728
__current_exception 0x1800dc738
__current_exception_context 0x1800dc750
__RTDynamicCast 0x1800dc730
__std_exception_copy 0x1800dc710
__std_exception_destroy 0x1800dc700
__std_terminate 0x1800dc740
__std_type_info_compare 0x1800dc760
__std_type_info_destroy_list 0x1800dc758
_CxxThrowException 0x1800dc720
_purecall 0x1800dc788
memcmp 0x1800dc6f0
memcpy 0x1800dc708
memmove 0x1800dc780
memset 0x1800dc778
strchr 0x1800dc770
strrchr 0x1800dc748
wcsrchr 0x1800dc768
wcsstr 0x1800dc718