AppVEntSubsystems64.dll

v10.0.19041.5794 64-bit Windows NT Analyzed
Download
Description
Client Virtualization Subsystems
Authors
© Microsoft Corporation. All rights reserved.
File size
1.9 MB
Uploaded
2025-12-01 07:22
Views
129
SHA-256
8ee567231413ddc6bd0c2fe7123e4275

Exported functions 6

APIExportForDetours #1 · 0x7fb0
RequestUnhookedFunctionList #2 · 0x6bd0
VirtualizeCurrentThread #3 · 0x9720
CurrentThreadIsVirtualized #4 · 0x9660
VirtualizeCurrentProcess #5 · 0x9790
IsProcessHooked #6 · 0x9650

Imported DLLs & functions 316

ADVAPI32.dll 7
EventRegister 0x180159b68
EventSetInformation 0x180159b70
EventUnregister 0x180159b80
EventWriteTransfer 0x180159b60
RegCloseKey 0x180159b90
RegOpenKeyExW 0x180159b78
RegQueryValueExW 0x180159b88
api-ms-win-core-com-l1-1-0.dll 14
CLSIDFromString 0x18015a020
CoCreateGuid 0x180159ff0
CoCreateInstance 0x18015a018
CoGetTreatAsClass 0x18015a010
CoInitializeEx 0x18015a008
CoMarshalInterface 0x18015a040
CoTaskMemAlloc 0x18015a048
CoTaskMemFree 0x18015a000
CoUninitialize 0x180159ff8
CoUnmarshalInterface 0x18015a038
CreateStreamOnHGlobal 0x18015a030
PropVariantClear 0x18015a050
StringFromCLSID 0x18015a028
StringFromGUID2 0x180159fe8
api-ms-win-core-console-l3-2-0.dll 1
GetConsoleWindow 0x18015a060
api-ms-win-core-errorhandling-l1-1-2.dll 1
RaiseFailFastException 0x18015a070
api-ms-win-core-file-l1-1-0.dll 12
FindClose 0x18015a0a8
FindFirstFileW 0x18015a0c8
FindFirstVolumeW 0x18015a080
FindNextFileW 0x18015a0d0
FindNextVolumeW 0x18015a090
FindVolumeClose 0x18015a088
GetFileAttributesW 0x18015a0b8
GetFinalPathNameByHandleW 0x18015a0c0
GetLogicalDriveStringsW 0x18015a0b0
GetShortPathNameW 0x18015a098
GetVolumePathNameW 0x18015a0a0
QueryDosDeviceW 0x18015a0d8
api-ms-win-core-file-l1-2-0.dll 1
GetVolumePathNamesForVolumeNameW 0x18015a0e8
api-ms-win-core-file-l1-2-2.dll 2
FindFirstFileNameW 0x18015a0f8
FindNextFileNameW 0x18015a100
api-ms-win-core-handle-l1-1-0.dll 1
DuplicateHandle 0x18015a110
api-ms-win-core-heap-l2-1-0.dll 1
LocalFree 0x18015a120
api-ms-win-core-io-l1-1-0.dll 2
DeviceIoControl 0x18015a130
GetOverlappedResult 0x18015a138
api-ms-win-core-libraryloader-l1-2-0.dll 1
LoadLibraryExA 0x18015a148
api-ms-win-core-libraryloader-l1-2-1.dll 1
LoadLibraryA 0x18015a158
api-ms-win-core-localization-l1-2-0.dll 1
GetUserDefaultLangID 0x18015a168
api-ms-win-core-memory-l1-1-0.dll 6
CreateFileMappingW 0x18015a198
MapViewOfFile 0x18015a190
UnmapViewOfFile 0x18015a1a0
VirtualFree 0x18015a178
VirtualProtect 0x18015a180
VirtualQuery 0x18015a188
api-ms-win-core-memory-l1-1-4.dll 1
QueryVirtualMemoryInformation 0x18015a1b0
api-ms-win-core-namedpipe-l1-1-0.dll 4
ConnectNamedPipe 0x18015a1d8
CreateNamedPipeW 0x18015a1c8
DisconnectNamedPipe 0x18015a1c0
PeekNamedPipe 0x18015a1d0
api-ms-win-core-processenvironment-l1-1-0.dll 5
ExpandEnvironmentStringsW 0x18015a200
GetCurrentDirectoryW 0x18015a1f0
GetEnvironmentVariableW 0x18015a208
SearchPathW 0x18015a1f8
SetCurrentDirectoryW 0x18015a1e8
api-ms-win-core-processthreads-l1-1-0.dll 8
CreateProcessAsUserW 0x18015a230
CreateProcessW 0x18015a250
GetProcessId 0x18015a220
OpenProcessToken 0x18015a248
OpenThreadToken 0x18015a240
ResumeThread 0x18015a228
SetThreadToken 0x18015a238
SuspendThread 0x18015a218
api-ms-win-core-processthreads-l1-1-1.dll 4
FlushInstructionCache 0x18015a268
GetProcessMitigationPolicy 0x18015a278
GetThreadContext 0x18015a260
SetThreadContext 0x18015a270
api-ms-win-core-psapi-l1-1-0.dll 1
K32GetMappedFileNameW 0x18015a288
api-ms-win-core-registry-l1-1-0.dll 4
RegCreateKeyExW 0x18015a2a8
RegEnumKeyExW 0x18015a2b0
RegEnumValueW 0x18015a2a0
RegSetValueExW 0x18015a298
api-ms-win-core-registry-l2-1-0.dll 1
RegDeleteKeyW 0x18015a2c0
api-ms-win-core-synch-l1-1-0.dll 10
AcquireSRWLockExclusive 0x18015a2d0
AcquireSRWLockShared 0x18015a308
CreateMutexExW 0x18015a2f8
CreateSemaphoreExW 0x18015a310
InitializeSRWLock 0x18015a2f0
OpenEventW 0x18015a2d8
OpenSemaphoreW 0x18015a2e8
ReleaseSemaphore 0x18015a318
ReleaseSRWLockExclusive 0x18015a2e0
ReleaseSRWLockShared 0x18015a300
api-ms-win-core-synch-l1-2-0.dll 1
Sleep 0x18015a328
api-ms-win-core-synch-l1-2-1.dll 1
WaitForMultipleObjects 0x18015a338
api-ms-win-core-sysinfo-l1-1-0.dll 4
GetSystemDirectoryW 0x18015a358
GetVersion 0x18015a348
GetVersionExW 0x18015a360
GetWindowsDirectoryW 0x18015a350
api-ms-win-core-sysinfo-l1-2-0.dll 1
GetNativeSystemInfo 0x18015a370
api-ms-win-core-threadpool-l1-2-0.dll 4
CloseThreadpoolTimer 0x18015a390
CreateThreadpoolTimer 0x18015a398
SetThreadpoolTimer 0x18015a380
WaitForThreadpoolTimerCallbacks 0x18015a388
api-ms-win-core-threadpool-legacy-l1-1-0.dll 1
QueueUserWorkItem 0x18015a3a8
api-ms-win-core-url-l1-1-0.dll 2
PathCreateFromUrlW 0x18015a3c0
UrlCreateFromPathW 0x18015a3b8
api-ms-win-core-version-l1-1-0.dll 1
VerQueryValueW 0x18015a3d0
api-ms-win-core-version-l1-1-1.dll 2
GetFileVersionInfoSizeW 0x18015a3e0
GetFileVersionInfoW 0x18015a3e8
api-ms-win-core-wow64-l1-1-0.dll 1
IsWow64Process 0x18015a3f8
api-ms-win-security-base-l1-1-0.dll 25
AddAce 0x18015a4a8
CopySid 0x18015a458
DuplicateToken 0x18015a478
DuplicateTokenEx 0x18015a420
EqualSid 0x18015a480
GetAclInformation 0x18015a490
GetLengthSid 0x18015a410
GetSecurityDescriptorControl 0x18015a460
GetSecurityDescriptorDacl 0x18015a430
GetSecurityDescriptorGroup 0x18015a4c8
GetSecurityDescriptorLength 0x18015a4c0
GetSecurityDescriptorOwner 0x18015a418
GetSecurityDescriptorSacl 0x18015a428
GetSidLengthRequired 0x18015a468
GetSidSubAuthority 0x18015a470
GetTokenInformation 0x18015a450
InitializeAcl 0x18015a438
InitializeSecurityDescriptor 0x18015a4b8
InitializeSid 0x18015a448
IsValidSid 0x18015a440
MakeAbsoluteSD 0x18015a4a0
MakeSelfRelativeSD 0x18015a4b0
SetSecurityDescriptorDacl 0x18015a488
SetSecurityDescriptorGroup 0x18015a408
SetSecurityDescriptorOwner 0x18015a498
api-ms-win-security-lsalookup-l2-1-0.dll 1
LookupAccountSidW 0x18015a4d8
api-ms-win-security-sddl-l1-1-0.dll 2
ConvertSidToStringSidW 0x18015a4e8
ConvertStringSecurityDescriptorToSecurityDescriptorW 0x18015a4f0
api-ms-win-shcore-sysinfo-l1-1-0.dll 1
GetCurrentProcessExplicitAppUserModelID 0x18015a500
GDI32.dll 2
AddFontResourceExW 0x180159ba8
CreateScalableFontResourceW 0x180159ba0
KERNEL32.dll 101
CheckRemoteDebuggerPresent 0x180159c68
CloseHandle 0x180159c58
CompareStringEx 0x180159cc8
CreateEventW 0x180159e38
CreateFileW 0x180159e10
CreateMutexW 0x180159c38
CreateThread 0x180159c78
DebugBreak 0x180159c28
DecodePointer 0x180159cb0
DeleteCriticalSection 0x180159c08
DisableThreadLibraryCalls 0x180159c50
EncodePointer 0x180159ca8
EnterCriticalSection 0x180159ea0
EnumSystemLocalesW 0x180159d78
ExitProcess 0x180159d80
ExitThread 0x180159e40
FindFirstFileExW 0x180159e90
FlsAlloc 0x180159e60
FlsFree 0x180159e78
FlsGetValue 0x180159e68
FlsSetValue 0x180159e70
FlushFileBuffers 0x180159dd0
FormatMessageW 0x180159be0
FreeEnvironmentStringsW 0x180159e00
FreeLibrary 0x180159c20
FreeLibraryAndExitThread 0x180159e88
GetACP 0x180159d90
GetCommandLineA 0x180159e98
GetCommandLineW 0x180159ed8
GetConsoleMode 0x180159dc8
GetConsoleOutputCP 0x180159dc0
GetCPInfo 0x180159cc0
GetCurrentProcess 0x180159bb8
GetCurrentProcessId 0x180159e48
GetCurrentThread 0x180159cf8
GetCurrentThreadId 0x180159bd8
GetEnvironmentStringsW 0x180159df8
GetFileSizeEx 0x180159da0
GetFileType 0x180159d08
GetLastError 0x180159be8
GetLocaleInfoW 0x180159d60
GetModuleFileNameA 0x180159d20
GetModuleFileNameW 0x180159c30
GetModuleHandleExW 0x180159bc0
GetModuleHandleW 0x180159c18
GetOEMCP 0x180159d98
GetProcAddress 0x180159c00
GetProcessHeap 0x180159c10
GetStartupInfoW 0x180159d10
GetStdHandle 0x180159d00
GetStringTypeW 0x180159c98
GetSystemInfo 0x180159ec8
GetSystemTimeAsFileTime 0x180159d48
GetUserDefaultLCID 0x180159d70
HeapAlloc 0x180159bf8
HeapDestroy 0x180159ed0
HeapFree 0x180159eb0
HeapReAlloc 0x180159cf0
HeapSize 0x180159df0
InitializeCriticalSection 0x180159bd0
InitializeCriticalSectionAndSpinCount 0x180159eb8
InitializeCriticalSectionEx 0x180159ca0
InitializeSListHead 0x180159e50
InitOnceExecuteOnce 0x180159c88
InterlockedFlushSList 0x180159e58
IsDebuggerPresent 0x180159c60
IsProcessorFeaturePresent 0x180159ce8
IsValidCodePage 0x180159d88
IsValidLocale 0x180159d68
K32GetModuleInformation 0x180159bf0
LCMapStringEx 0x180159cb8
LCMapStringW 0x180159d58
LeaveCriticalSection 0x180159bc8
LoadLibraryExW 0x180159d50
LoadLibraryW 0x180159c70
MultiByteToWideChar 0x180159c80
OutputDebugStringW 0x180159de8
QueryPerformanceCounter 0x180159ec0
RaiseException 0x180159d18
ReadConsoleW 0x180159de0
ReadFile 0x180159dd8
ReleaseMutex 0x180159c48
ResetEvent 0x180159e28
SetEnvironmentVariableW 0x180159e08
SetEvent 0x180159e20
SetFilePointerEx 0x180159da8
SetLastError 0x180159d38
SetStdHandle 0x180159db0
SetUnhandledExceptionFilter 0x180159cd8
TerminateProcess 0x180159ce0
TlsAlloc 0x180159d28
TlsFree 0x180159d40
TlsGetValue 0x180159d30
TlsSetValue 0x180159ea8
UnhandledExceptionFilter 0x180159cd0
VirtualAlloc 0x180159e80
WaitForSingleObject 0x180159c40
WaitForSingleObjectEx 0x180159e30
WideCharToMultiByte 0x180159c90
WriteConsoleW 0x180159e18
WriteFile 0x180159db8
ntdll.dll 46
NtClose 0x18015a520
NtCreateKey 0x18015a518
NtDeleteKey 0x18015a648
NtDeleteValueKey 0x18015a580
NtDuplicateObject 0x18015a5a8
NtEnumerateKey 0x18015a650
NtEnumerateValueKey 0x18015a658
NtFlushKey 0x18015a670
NtNotifyChangeMultipleKeys 0x18015a668
NtOpenKey 0x18015a660
NtQueryInformationProcess 0x18015a610
NtQueryKey 0x18015a528
NtQueryObject 0x18015a568
NtQuerySecurityObject 0x18015a570
NtQueryValueKey 0x18015a678
NtReadFile 0x18015a540
NtRenameKey 0x18015a530
NtSetEvent 0x18015a558
NtSetInformationThread 0x18015a590
NtSetSecurityObject 0x18015a550
NtSetValueKey 0x18015a560
NtWriteFile 0x18015a538
RtlAllocateHeap 0x18015a600
RtlCaptureContext 0x18015a510
RtlCompareUnicodeString 0x18015a578
RtlCopyUnicodeString 0x18015a5c8
RtlDeleteElementGenericTableAvl 0x18015a5b8
RtlEnumerateGenericTableAvl 0x18015a5d8
RtlEnumerateGenericTableWithoutSplayingAvl 0x18015a5e8
RtlEqualUnicodeString 0x18015a588
RtlFreeHeap 0x18015a608
RtlInitAnsiString 0x18015a548
RtlInitializeGenericTableAvl 0x18015a5b0
RtlInitUnicodeString 0x18015a598
RtlInsertElementGenericTableAvl 0x18015a5d0
RtlIntegerToUnicodeString 0x18015a618
RtlIsGenericTableEmptyAvl 0x18015a5e0
RtlIsNameInExpression 0x18015a5f0
RtlLookupElementGenericTableAvl 0x18015a5c0
RtlLookupFunctionEntry 0x18015a638
RtlNtStatusToDosError 0x18015a640
RtlPcToFileHeader 0x18015a5a0
RtlPrefixUnicodeString 0x18015a5f8
RtlUnwind 0x18015a620
RtlUnwindEx 0x18015a628
RtlVirtualUnwind 0x18015a630
ole32.dll 3
CreateFileMoniker 0x18015a690
GetClassFile 0x18015a688
GetRunningObjectTable 0x18015a698
RPCRT4.dll 16
NdrClientCall2 0x180159ef8
NdrServerCall2 0x180159f20
RpcBindingFree 0x180159f60
RpcBindingFromStringBindingW 0x180159f00
RpcBindingInqAuthClientW 0x180159f58
RpcBindingSetAuthInfoExW 0x180159f10
RpcImpersonateClient 0x180159f48
RpcRevertToSelf 0x180159f30
RpcServerListen 0x180159f08
RpcServerRegisterAuthInfoW 0x180159ee8
RpcServerRegisterIf2 0x180159f38
RpcServerUnregisterIf 0x180159f40
RpcServerUseProtseqEpW 0x180159f50
RpcStringBindingComposeW 0x180159ef0
RpcStringFreeW 0x180159f18
UuidCreate 0x180159f28
SHELL32.dll 3
SHCreateItemFromParsingName 0x180159f78
SHGetPathFromIDListW 0x180159f70
SHParseDisplayName 0x180159f80
USER32.dll 8
CallWindowProcW 0x180159fc8
DispatchMessageW 0x180159f98
FindWindowW 0x180159fa8
GetParent 0x180159fc0
GetWindowLongW 0x180159fb0
IsWindowVisible 0x180159fb8
PeekMessageW 0x180159fa0
WaitForInputIdle 0x180159f90
USERENV.dll 1
UnloadUserProfile 0x180159fd8