TsPsUtil.dll

Description: TS PowerShell Native Utility DLL

Version: 10.0.19041.5965

Architecture: 64-bit

Operating System: Windows NT

SHA256: 649d8605e471218a1f425bbda30e3bb6

File Size: 133.5 KB

Uploaded At: Dec. 1, 2025, 8:28 a.m.

Views: 22

Exported Functions

SetUserDesktopConfiguration (Ordinal: 1, Address: 0x1f50)
TsPsGetVMsAssignedToUser (Ordinal: 2, Address: 0x1c50)
AddAllowedUser (Ordinal: 3, Address: 0x23d0)
DeleteAllowedUser (Ordinal: 4, Address: 0x2740)
GetAssignedUsers (Ordinal: 5, Address: 0x2230)
IsValidSD (Ordinal: 6, Address: 0x2070)
TsPsGetCertificateContents (Ordinal: 7, Address: 0x1970)
TsPsGetNumberOfVMsAssignedToUser (Ordinal: 8, Address: 0x1e20)
TsPsGetVMDetails (Ordinal: 9, Address: 0x1b30)
TsPsSignRdpContents (Ordinal: 10, Address: 0x16c0)

Imported DLLs & Functions

ACTIVEDS.dll

(Address: 0x18001a560)
(Address: 0x18001a558)
(Address: 0x18001a550)
(Address: 0x18001a548)

ADVAPI32.dll

ConvertSidToStringSidW (Address: 0x18001a5a0)
ConvertStringSecurityDescriptorToSecurityDescriptorW (Address: 0x18001a5a8)
EventActivityIdControl (Address: 0x18001a5d8)
GetExplicitEntriesFromAclW (Address: 0x18001a5b0)
GetSecurityDescriptorDacl (Address: 0x18001a5b8)
ImpersonateLoggedOnUser (Address: 0x18001a5f0)
LogonUserW (Address: 0x18001a5f8)
LookupAccountNameW (Address: 0x18001a600)
LookupAccountSidW (Address: 0x18001a598)
RegCloseKey (Address: 0x18001a5c0)
RegCreateKeyExW (Address: 0x18001a570)
RegDeleteValueW (Address: 0x18001a588)
RegEnumKeyExW (Address: 0x18001a590)
RegEnumValueW (Address: 0x18001a578)
RegOpenKeyExW (Address: 0x18001a5c8)
RegQueryValueExW (Address: 0x18001a5d0)
RegSetValueExW (Address: 0x18001a580)
RevertToSelf (Address: 0x18001a5e8)
TraceMessage (Address: 0x18001a5e0)

api-ms-win-core-debug-l1-1-0.dll

DebugBreak (Address: 0x18001a730)
IsDebuggerPresent (Address: 0x18001a728)
OutputDebugStringW (Address: 0x18001a738)

api-ms-win-core-errorhandling-l1-1-0.dll

GetLastError (Address: 0x18001a748)
SetLastError (Address: 0x18001a758)
SetUnhandledExceptionFilter (Address: 0x18001a760)
UnhandledExceptionFilter (Address: 0x18001a750)

api-ms-win-core-featurestaging-l1-1-0.dll

RecordFeatureUsage (Address: 0x18001a780)
SubscribeFeatureStateChangeNotification (Address: 0x18001a770)
UnsubscribeFeatureStateChangeNotification (Address: 0x18001a778)

api-ms-win-core-handle-l1-1-0.dll

CloseHandle (Address: 0x18001a790)

api-ms-win-core-heap-l1-1-0.dll

GetProcessHeap (Address: 0x18001a7b0)
HeapAlloc (Address: 0x18001a7a8)
HeapFree (Address: 0x18001a7a0)

api-ms-win-core-heap-l2-1-0.dll

LocalAlloc (Address: 0x18001a7c0)
LocalFree (Address: 0x18001a7c8)

api-ms-win-core-libraryloader-l1-2-0.dll

FreeLibrary (Address: 0x18001a7d8)
GetModuleFileNameA (Address: 0x18001a7f8)
GetModuleHandleExA (Address: 0x18001a7e0)
GetModuleHandleExW (Address: 0x18001a800)
GetModuleHandleW (Address: 0x18001a7e8)
GetProcAddress (Address: 0x18001a808)
LoadLibraryExW (Address: 0x18001a7f0)

api-ms-win-core-libraryloader-l1-2-1.dll

LoadLibraryW (Address: 0x18001a818)

api-ms-win-core-localization-l1-2-0.dll

FormatMessageW (Address: 0x18001a828)
GetACP (Address: 0x18001a830)

api-ms-win-core-processenvironment-l1-1-0.dll

ExpandEnvironmentStringsW (Address: 0x18001a840)

api-ms-win-core-processthreads-l1-1-0.dll

GetCurrentProcess (Address: 0x18001a868)
GetCurrentProcessId (Address: 0x18001a860)
GetCurrentThreadId (Address: 0x18001a850)
TerminateProcess (Address: 0x18001a858)

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter (Address: 0x18001a878)

api-ms-win-core-rtlsupport-l1-1-0.dll

RtlCaptureContext (Address: 0x18001a888)
RtlLookupFunctionEntry (Address: 0x18001a890)
RtlVirtualUnwind (Address: 0x18001a898)

api-ms-win-core-string-l1-1-0.dll

CompareStringW (Address: 0x18001a8a8)

api-ms-win-core-string-obsolete-l1-1-0.dll

lstrcmpW (Address: 0x18001a8b8)

api-ms-win-core-synch-l1-1-0.dll

CreateMutexExW (Address: 0x18001a8f8)
CreateSemaphoreExW (Address: 0x18001a8c8)
OpenSemaphoreW (Address: 0x18001a8e8)
ReleaseMutex (Address: 0x18001a8f0)
ReleaseSemaphore (Address: 0x18001a8d8)
WaitForSingleObject (Address: 0x18001a8d0)
WaitForSingleObjectEx (Address: 0x18001a8e0)

api-ms-win-core-synch-l1-2-0.dll

Sleep (Address: 0x18001a908)

api-ms-win-core-sysinfo-l1-1-0.dll

GetSystemTime (Address: 0x18001a918)
GetSystemTimeAsFileTime (Address: 0x18001a920)
GetTickCount (Address: 0x18001a928)

api-ms-win-core-timezone-l1-1-0.dll

SystemTimeToFileTime (Address: 0x18001a938)

CRYPT32.dll

CertCloseStore (Address: 0x18001a630)
CertDuplicateCertificateChain (Address: 0x18001a688)
CertDuplicateCertificateContext (Address: 0x18001a638)
CertFindCertificateInStore (Address: 0x18001a648)
CertFindExtension (Address: 0x18001a668)
CertFreeCertificateChain (Address: 0x18001a640)
CertFreeCertificateContext (Address: 0x18001a618)
CertGetCertificateChain (Address: 0x18001a628)
CertGetCertificateContextProperty (Address: 0x18001a660)
CertGetNameStringW (Address: 0x18001a650)
CertOpenStore (Address: 0x18001a658)
CertVerifyCertificateChainPolicy (Address: 0x18001a6a8)
CertVerifyTimeValidity (Address: 0x18001a610)
CryptBinaryToStringW (Address: 0x18001a670)
CryptDecodeObject (Address: 0x18001a620)
CryptMsgClose (Address: 0x18001a690)
CryptMsgOpenToDecode (Address: 0x18001a6a0)
CryptMsgUpdate (Address: 0x18001a698)
CryptSignMessage (Address: 0x18001a6b0)
CryptStringToBinaryW (Address: 0x18001a678)
CryptVerifyDetachedMessageSignature (Address: 0x18001a680)

IPHLPAPI.DLL

ParseNetworkString (Address: 0x18001a6c0)

msvcrt.dll

__C_specific_handler (Address: 0x18001a970)
__CxxFrameHandler3 (Address: 0x18001aa78)
__dllonexit (Address: 0x18001a960)
_amsg_exit (Address: 0x18001a9f0)
_callnewh (Address: 0x18001aa40)
_CxxThrowException (Address: 0x18001aa10)
_initterm (Address: 0x18001a9e0)
_lock (Address: 0x18001a950)
_onexit (Address: 0x18001a958)
_purecall (Address: 0x18001aa50)
_unlock (Address: 0x18001a968)
_vsnwprintf (Address: 0x18001a9d0)
_wcsicmp (Address: 0x18001a9b8)
_wcslwr (Address: 0x18001a9b0)
_wcsnicmp (Address: 0x18001a9c0)
_wtoi (Address: 0x18001a978)
_XcptFilter (Address: 0x18001a9f8)
??_V@YAXPEAX@Z (Address: 0x18001aa70)
??0exception@@QEAA@AEBQEBD@Z (Address: 0x18001aa38)
??0exception@@QEAA@AEBQEBDH@Z (Address: 0x18001aa30)
??0exception@@QEAA@AEBV0@@Z (Address: 0x18001aa28)
??1exception@@UEAA@XZ (Address: 0x18001aa20)
??1type_info@@UEAA@XZ (Address: 0x18001a948)
??3@YAXPEAX@Z (Address: 0x18001aa58)
?what@exception@@UEBAPEBDXZ (Address: 0x18001aa18)
free (Address: 0x18001a9e8)
malloc (Address: 0x18001aa48)
memcpy (Address: 0x18001aa08)
memcpy_s (Address: 0x18001a9c8)
memmove (Address: 0x18001aa00)
memset (Address: 0x18001aa80)
toupper (Address: 0x18001aa68)
towlower (Address: 0x18001a9a8)
wcscat_s (Address: 0x18001a998)
wcscpy_s (Address: 0x18001aa60)
wcsstr (Address: 0x18001a980)
wcstok (Address: 0x18001a9d8)
wcstok_s (Address: 0x18001a990)
wcstol (Address: 0x18001a9a0)
wcstombs_s (Address: 0x18001a988)

NTDSAPI.dll

DsBindW (Address: 0x18001a6e8)
DsCrackNamesW (Address: 0x18001a6d0)
DsFreeNameResultW (Address: 0x18001a6d8)
DsUnBindW (Address: 0x18001a6e0)

ole32.dll

CoInitializeEx (Address: 0x18001aa98)
CoUninitialize (Address: 0x18001aa90)

OLEAUT32.dll

SafeArrayGetElement (Address: 0x18001a700)
SafeArrayGetLBound (Address: 0x18001a6f8)
SafeArrayGetUBound (Address: 0x18001a708)
VariantClear (Address: 0x18001a718)
VariantInit (Address: 0x18001a710)