grouptrusteeai.dll
Description: CSI GroupTrustee plug-in
Authors: © Microsoft Corporation. All rights reserved.
Version: 10.0.19041.1940
Architecture: 32-bit
Operating System: Windows NT
SHA256: 4ed5fa5a683cb61d8f3c0fc1399abf9e
File Size: 38.8 KB
Uploaded At: Dec. 1, 2025, 8:34 a.m.
Views: 16
Exported Functions
- DllCanUnloadNow (Ordinal: 1, Address: 0x4a30)
- DllCsiGetHandler (Ordinal: 2, Address: 0x4a50)
Imported DLLs & Functions
api-ms-win-core-errorhandling-l1-1-0.dll
- GetLastError (Address: 0x10008064)
- RaiseException (Address: 0x10008068)
- SetUnhandledExceptionFilter (Address: 0x10008060)
- UnhandledExceptionFilter (Address: 0x1000805c)
api-ms-win-core-heap-l1-1-0.dll
- GetProcessHeap (Address: 0x10008074)
- HeapAlloc (Address: 0x10008070)
- HeapDestroy (Address: 0x10008078)
api-ms-win-core-heap-obsolete-l1-1-0.dll
- LocalFree (Address: 0x10008080)
api-ms-win-core-libraryloader-l1-1-0.dll
- DisableThreadLibraryCalls (Address: 0x10008090)
- FreeLibrary (Address: 0x10008094)
- GetProcAddress (Address: 0x10008088)
- LoadLibraryExA (Address: 0x1000808c)
api-ms-win-core-memory-l1-1-0.dll
- VirtualProtect (Address: 0x100080a0)
- VirtualQuery (Address: 0x1000809c)
api-ms-win-core-processthreads-l1-1-0.dll
- GetCurrentProcess (Address: 0x100080b0)
- GetCurrentProcessId (Address: 0x100080a8)
- GetCurrentThreadId (Address: 0x100080ac)
- TerminateProcess (Address: 0x100080b4)
api-ms-win-core-profile-l1-1-0.dll
- QueryPerformanceCounter (Address: 0x100080bc)
api-ms-win-core-synch-l1-1-0.dll
- AcquireSRWLockExclusive (Address: 0x100080c8)
- DeleteCriticalSection (Address: 0x100080d0)
- InitializeCriticalSection (Address: 0x100080c4)
- ReleaseSRWLockExclusive (Address: 0x100080cc)
api-ms-win-core-synch-l1-2-0.dll
- Sleep (Address: 0x100080d8)
api-ms-win-core-sysinfo-l1-1-0.dll
- GetSystemInfo (Address: 0x100080e0)
- GetSystemTimeAsFileTime (Address: 0x100080e8)
- GetTickCount (Address: 0x100080e4)
api-ms-win-security-base-l1-1-0.dll
- CreateWellKnownSid (Address: 0x100080f0)
api-ms-win-security-lsapolicy-l1-1-0.dll
- LsaAddAccountRights (Address: 0x10008104)
- LsaClose (Address: 0x100080f8)
- LsaFreeMemory (Address: 0x100080fc)
- LsaOpenPolicy (Address: 0x10008108)
- LsaQueryInformationPolicy (Address: 0x1000810c)
- LsaRemoveAccountRights (Address: 0x10008100)
api-ms-win-security-sddl-l1-1-0.dll
- ConvertSidToStringSidW (Address: 0x10008114)
msvcrt.dll
- _amsg_exit (Address: 0x10008128)
- _callnewh (Address: 0x10008130)
- _except_handler4_common (Address: 0x10008120)
- _initterm (Address: 0x10008124)
- _itow_s (Address: 0x10008140)
- _purecall (Address: 0x1000813c)
- _XcptFilter (Address: 0x1000812c)
- free (Address: 0x10008138)
- malloc (Address: 0x10008134)
- memcpy (Address: 0x1000811c)
- memset (Address: 0x10008144)
ntdll.dll
- RtlCompareUnicodeString (Address: 0x10008150)
- RtlCopySid (Address: 0x1000815c)
- RtlCreateServiceSid (Address: 0x10008154)
- RtlEqualUnicodeString (Address: 0x10008160)
- RtlInitUnicodeString (Address: 0x10008158)
- RtlSubAuthorityCountSid (Address: 0x1000814c)
- RtlSubAuthoritySid (Address: 0x10008164)
WCP.dll
- ?RtlGetFacilityTracingFlags@Rtl@WCP@Windows@@YIKPAU_RTL_TRACING_FACILITY@123@@Z (Address: 0x10008050)
- ?RtlTraceFormat_PCLUNICODE_STRING_AsLiteralString@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z (Address: 0x10008014)
- ?RtlTraceFormat_PCULONG_AsDecimalOnly@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z (Address: 0x10008038)
- ?RtlTraceFormat_PCUNICODE_STRING@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z (Address: 0x1000803c)
- ?RtlTraceVa@Rtl@WCP@Windows@@YIXKKPAU_RTL_TRACING_FACILITY@123@QBDKPAD@Z (Address: 0x10008044)
- AddTrusteeCapabilities (Address: 0x10008034)
- ConvertHResultToNtStatus (Address: 0x10008020)
- ConvertNtStatusToHResult (Address: 0x10008018)
- DeleteTrusteeCapabilities (Address: 0x10008024)
- DeleteTrusteeData (Address: 0x10008040)
- GetGroupTrusteeDataCountFromManifest (Address: 0x1000804c)
- GetGroupTrusteeDataFromManifest (Address: 0x10008048)
- MapToPrivilegeName (Address: 0x10008028)
- MapToWellKnownSidType (Address: 0x1000802c)
- RtlCompareLUnicodeStrings (Address: 0x10008008)
- RtlDowncaseUCSCharacter (Address: 0x10008010)
- RtlFreeLUnicodeString (Address: 0x10008000)
- RtlHashLUnicodeString (Address: 0x10008054)
- RtlInitLUnicodeStringFromNullTerminatedString (Address: 0x10008004)
- RtlInitLUnicodeStringFromUnicodeString (Address: 0x10008030)
- RtlReallocateLUnicodeString (Address: 0x1000800c)
- RtlReportErrorOrigination (Address: 0x1000801c)