https://bugs.winehq.org/show_bug.cgi?id=48023
--- Comment #15 from Nikolay Sivov bunglehead@gmail.com --- Maybe with CreateActCtx(), if not that, hopefully they use something public to create it. Another possibility is intercepting some Rtl functions, but I don't think there is a reason for that.