itch.io

HEUR means the threat assessment is heuristic-based: some code in the game looks like something that has been used in viruses, or is very rarely used in legitimate programs, so it gets flagged, even if it’s harmless. Heuristic-based threat assessment generates a lot of false positives, so this isn’t super surprising.

APC means Asynchronous Procedure Calling - it’s a method of having one thread call a function that executes on another thread. This is a very common tool to use in multi-threaded programs, especially game engines. Malware that obtains kernel access (the highest level of code execution privilege) can use APC to force legitimate software to run malware code, which can help hide the malware from an antivirus by making the other software look like the source of the malware code.