cldapi.dll

Description: Cloud API user mode API

Version: 10.0.19041.3636

Architecture: 64-bit

Operating System: Windows NT

SHA256: 6285f95ae8555a0503486c63e8b261f8

File Size: 112.5 KB

Uploaded At: Dec. 1, 2025, 7:24 a.m.

Views: 14

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

CfAbortOperation (Ordinal: 1, Address: 0x1de0)
CfCloseAppPolicy (Ordinal: 2, Address: 0x24c0)
CfCloseHandle (Ordinal: 3, Address: 0x32e0)
CfConnectSyncRoot (Ordinal: 4, Address: 0x7440)
CfConvertToPlaceholder (Ordinal: 5, Address: 0xc3b0)
CfCreatePlaceholders (Ordinal: 6, Address: 0xc130)
CfDehydratePlaceholder (Ordinal: 7, Address: 0xcd80)
CfDehydratePlaceholderEx (Ordinal: 8, Address: 0xcbe0)
CfDisconnectSyncRoot (Ordinal: 9, Address: 0x8070)
CfEnumAppPolicy (Ordinal: 10, Address: 0x24f0)
CfExecute (Ordinal: 11, Address: 0xaf60)
CfGetCorrelationVector (Ordinal: 12, Address: 0xd260)
CfGetLastSyncStatus (Ordinal: 13, Address: 0x2380)
CfGetPlaceholderInfo (Ordinal: 14, Address: 0xd370)
CfGetPlaceholderRangeInfo (Ordinal: 15, Address: 0xd770)
CfGetPlaceholderStateFromAttributeTag (Ordinal: 16, Address: 0x13500)
CfGetPlaceholderStateFromFileInfo (Ordinal: 17, Address: 0x13510)
CfGetPlaceholderStateFromFindData (Ordinal: 18, Address: 0x135d0)
CfGetPlatformInfo (Ordinal: 19, Address: 0xd330)
CfGetSyncRootInfoByHandle (Ordinal: 20, Address: 0xd500)
CfGetSyncRootInfoByPath (Ordinal: 21, Address: 0xd690)
CfGetTransferKey (Ordinal: 22, Address: 0xd070)
CfGetWin32HandleFromProtectedHandle (Ordinal: 23, Address: 0x32b0)
CfHydratePlaceholder (Ordinal: 24, Address: 0xcad0)
CfLockProperties (Ordinal: 25, Address: 0xd990)
CfOpenAppPolicy (Ordinal: 26, Address: 0x2410)
CfOpenFileWithOplock (Ordinal: 27, Address: 0x2c30)
CfOpenProgressEvent (Ordinal: 28, Address: 0x13b0)
CfQueryProgress (Ordinal: 29, Address: 0x1470)
CfQuerySyncProviderStatus (Ordinal: 30, Address: 0xbaa0)
CfReferenceProtectedHandle (Ordinal: 31, Address: 0x3280)
CfRegisterSyncRoot (Ordinal: 32, Address: 0x5f70)
CfReleaseProtectedHandle (Ordinal: 33, Address: 0x32d0)
CfReleaseTransferKey (Ordinal: 34, Address: 0x32d0)
CfReportProviderProgress (Ordinal: 35, Address: 0x1840)
CfReportProviderProgress2 (Ordinal: 36, Address: 0x1870)
CfReportSyncStatus (Ordinal: 37, Address: 0xbb90)
CfRetrieveProperties (Ordinal: 38, Address: 0xdbd0)
CfRevertPlaceholder (Ordinal: 39, Address: 0xc9d0)
CfSetAppPolicy (Ordinal: 40, Address: 0x2740)
CfSetCorrelationVector (Ordinal: 41, Address: 0xd110)
CfSetInSyncState (Ordinal: 42, Address: 0xcf20)
CfSetPinState (Ordinal: 43, Address: 0xcdb0)
CfStoreProperties (Ordinal: 44, Address: 0xdb20)
CfUnlockProperties (Ordinal: 45, Address: 0xda70)
CfUnregisterSyncRoot (Ordinal: 46, Address: 0x7130)
CfUpdatePlaceholder (Ordinal: 47, Address: 0xc5d0)
CfUpdateSyncProviderStatus (Ordinal: 48, Address: 0xb340)

Imported DLLs & Functions

api-ms-win-core-debug-l1-1-0.dll

IsDebuggerPresent (Address: 0x180016168)

api-ms-win-core-delayload-l1-1-0.dll

DelayLoadFailureHook (Address: 0x180016178)

api-ms-win-core-delayload-l1-1-1.dll

ResolveDelayLoadedAPI (Address: 0x180016188)

api-ms-win-core-errorhandling-l1-1-0.dll

GetLastError (Address: 0x1800161a0)
SetLastError (Address: 0x1800161b0)
SetUnhandledExceptionFilter (Address: 0x1800161a8)
UnhandledExceptionFilter (Address: 0x180016198)

api-ms-win-core-file-l1-1-0.dll

CreateFileW (Address: 0x1800161d8)
GetFileSizeEx (Address: 0x1800161c8)
GetVolumeInformationW (Address: 0x1800161c0)
GetVolumePathNameW (Address: 0x1800161d0)

api-ms-win-core-file-l1-2-0.dll

GetVolumeNameForVolumeMountPointW (Address: 0x1800161e8)

api-ms-win-core-file-l2-1-0.dll

GetFileInformationByHandleEx (Address: 0x1800161f8)

api-ms-win-core-handle-l1-1-0.dll

CloseHandle (Address: 0x180016208)

api-ms-win-core-heap-l1-1-0.dll

GetProcessHeap (Address: 0x180016218)
HeapAlloc (Address: 0x180016220)
HeapFree (Address: 0x180016228)

api-ms-win-core-heap-l2-1-0.dll

LocalAlloc (Address: 0x180016238)

api-ms-win-core-interlocked-l1-1-0.dll

InitializeSListHead (Address: 0x180016248)

api-ms-win-core-io-l1-1-0.dll

CreateIoCompletionPort (Address: 0x180016270)
DeviceIoControl (Address: 0x180016260)
GetOverlappedResult (Address: 0x180016258)
GetQueuedCompletionStatus (Address: 0x180016268)

api-ms-win-core-libraryloader-l1-2-0.dll

DisableThreadLibraryCalls (Address: 0x180016280)
GetModuleFileNameA (Address: 0x180016288)
GetModuleHandleExW (Address: 0x180016290)

api-ms-win-core-processthreads-l1-1-0.dll

CreateThread (Address: 0x1800162e8)
GetCurrentProcess (Address: 0x1800162a8)
GetCurrentProcessId (Address: 0x1800162b0)
GetCurrentThread (Address: 0x1800162a0)
GetCurrentThreadId (Address: 0x1800162c8)
GetExitCodeThread (Address: 0x1800162f0)
OpenThread (Address: 0x1800162d8)
ResumeThread (Address: 0x1800162c0)
SetThreadPriority (Address: 0x1800162d0)
TerminateProcess (Address: 0x1800162e0)
TerminateThread (Address: 0x1800162b8)

api-ms-win-core-processthreads-l1-1-1.dll

IsProcessorFeaturePresent (Address: 0x180016308)
OpenProcess (Address: 0x180016300)

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter (Address: 0x180016318)

api-ms-win-core-psapi-l1-1-0.dll

QueryFullProcessImageNameW (Address: 0x180016328)

api-ms-win-core-realtime-l1-1-0.dll

QueryUnbiasedInterruptTime (Address: 0x180016338)

api-ms-win-core-registry-l1-1-0.dll

RegCloseKey (Address: 0x180016348)
RegEnumKeyExW (Address: 0x180016360)
RegOpenKeyExW (Address: 0x180016358)
RegQueryValueExW (Address: 0x180016350)
RegSetValueExW (Address: 0x180016368)

api-ms-win-core-string-l2-1-0.dll

CharLowerW (Address: 0x180016378)

api-ms-win-core-synch-l1-1-0.dll

AcquireSRWLockExclusive (Address: 0x1800163f0)
AcquireSRWLockShared (Address: 0x1800163c8)
CreateEventW (Address: 0x180016398)
DeleteCriticalSection (Address: 0x1800163c0)
EnterCriticalSection (Address: 0x1800163a0)
InitializeCriticalSection (Address: 0x180016390)
InitializeSRWLock (Address: 0x1800163d8)
LeaveCriticalSection (Address: 0x180016400)
OpenEventW (Address: 0x1800163d0)
ReleaseSRWLockExclusive (Address: 0x1800163e8)
ReleaseSRWLockShared (Address: 0x1800163f8)
ResetEvent (Address: 0x1800163b0)
SetEvent (Address: 0x180016388)
SetWaitableTimer (Address: 0x1800163a8)
TryAcquireSRWLockExclusive (Address: 0x1800163e0)
WaitForSingleObject (Address: 0x1800163b8)

api-ms-win-core-synch-l1-2-0.dll

Sleep (Address: 0x180016410)

api-ms-win-core-synch-l1-2-1.dll

CreateWaitableTimerW (Address: 0x180016420)

api-ms-win-core-sysinfo-l1-1-0.dll

GetSystemInfo (Address: 0x180016430)
GetSystemTimeAsFileTime (Address: 0x180016448)
GetTickCount (Address: 0x180016438)
GetWindowsDirectoryW (Address: 0x180016440)
GlobalMemoryStatusEx (Address: 0x180016450)

api-ms-win-core-sysinfo-l2-1-0.dll

GetUserNameW (Address: 0x180016460)

api-ms-win-core-threadpool-l1-2-0.dll

CloseThreadpoolTimer (Address: 0x180016478)
CloseThreadpoolWork (Address: 0x180016490)
CreateThreadpoolTimer (Address: 0x180016488)
CreateThreadpoolWork (Address: 0x180016498)
SetThreadpoolTimer (Address: 0x180016480)
SubmitThreadpoolWork (Address: 0x1800164a0)
WaitForThreadpoolTimerCallbacks (Address: 0x180016470)

api-ms-win-crt-private-l1-1-0.dll

__C_specific_handler (Address: 0x1800164f0)
_o___std_type_info_destroy_list (Address: 0x180016508)
_o__cexit (Address: 0x180016500)
_o__configure_narrow_argv (Address: 0x1800164f8)
_o__execute_onexit_table (Address: 0x1800164b0)
_o__initialize_narrow_environment (Address: 0x1800164b8)
_o__initialize_onexit_table (Address: 0x1800164c0)
_o__seh_filter_dll (Address: 0x1800164c8)
_o__wcsnicmp (Address: 0x1800164d8)
_o_toupper (Address: 0x1800164e0)
_o_wcscpy_s (Address: 0x1800164e8)
memcmp (Address: 0x180016510)
memcpy (Address: 0x180016518)
memmove (Address: 0x1800164d0)

api-ms-win-crt-runtime-l1-1-0.dll

_initterm (Address: 0x180016530)
_initterm_e (Address: 0x180016528)

api-ms-win-crt-string-l1-1-0.dll

memset (Address: 0x180016540)
wcsncmp (Address: 0x180016548)
wcsnlen (Address: 0x180016550)

api-ms-win-eventing-provider-l1-1-0.dll

EventProviderEnabled (Address: 0x180016568)
EventRegister (Address: 0x180016570)
EventSetInformation (Address: 0x180016578)
EventUnregister (Address: 0x180016580)
EventWriteTransfer (Address: 0x180016560)

bcrypt.dll

BCryptCloseAlgorithmProvider (Address: 0x180016598)
BCryptCreateHash (Address: 0x180016590)
BCryptDestroyHash (Address: 0x1800165c0)
BCryptFinishHash (Address: 0x1800165a0)
BCryptGetProperty (Address: 0x1800165b0)
BCryptHashData (Address: 0x1800165b8)
BCryptOpenAlgorithmProvider (Address: 0x1800165a8)

FLTLIB.DLL

FilterConnectCommunicationPort (Address: 0x180016158)
FilterGetMessage (Address: 0x180016150)
FilterSendMessage (Address: 0x180016148)

ntdll.dll

NtClose (Address: 0x1800166b0)
NtCreateFile (Address: 0x180016610)
NtQueryDirectoryFile (Address: 0x1800166c0)
NtQuerySystemTime (Address: 0x1800165f8)
NtSetInformationFile (Address: 0x1800165f0)
RtlAcquireSRWLockExclusive (Address: 0x180016620)
RtlAcquireSRWLockShared (Address: 0x1800165e0)
RtlCaptureContext (Address: 0x180016690)
RtlComputeCrc32 (Address: 0x180016628)
RtlDeleteElementGenericTableAvl (Address: 0x180016640)
RtlDosLongPathNameToNtPathName_U_WithStatus (Address: 0x180016660)
RtlEnumerateGenericTableAvl (Address: 0x180016668)
RtlEqualUnicodeString (Address: 0x1800166a8)
RtlExtendCorrelationVector (Address: 0x1800165d0)
RtlFreeUnicodeString (Address: 0x180016638)
RtlIncrementCorrelationVector (Address: 0x180016698)
RtlInitializeGenericTableAvl (Address: 0x180016658)
RtlInitializeSRWLock (Address: 0x180016648)
RtlInitUnicodeString (Address: 0x180016600)
RtlInsertElementGenericTableAvl (Address: 0x180016618)
RtlIsPartialPlaceholder (Address: 0x180016670)
RtlLookupElementGenericTableAvl (Address: 0x1800165d8)
RtlLookupFunctionEntry (Address: 0x180016688)
RtlNtStatusToDosError (Address: 0x180016678)
RtlNumberGenericTableElementsAvl (Address: 0x180016650)
RtlPrefixUnicodeString (Address: 0x180016630)
RtlReleaseSRWLockExclusive (Address: 0x1800166b8)
RtlReleaseSRWLockShared (Address: 0x1800165e8)
RtlSetThreadPlaceholderCompatibilityMode (Address: 0x180016608)
RtlValidateCorrelationVector (Address: 0x1800166a0)
RtlVirtualUnwind (Address: 0x180016680)