Import table
api-ms-win-core-errorhandling-l1-1-0.dll
SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetLastError
api-ms-win-core-handle-l1-1-0.dll
CloseHandle, DuplicateHandle
api-ms-win-core-heap-l1-1-0.dll
HeapSetInformation
api-ms-win-core-interlocked-l1-1-0.dll
InterlockedIncrement, InterlockedDecrement, InterlockedExchange, InterlockedCompareExchange
api-ms-win-core-libraryloader-l1-1-0.dll
LoadStringW, GetModuleHandleW, GetProcAddress, FreeLibrary, GetModuleHandleA, LoadLibraryExA
api-ms-win-core-localregistry-l1-1-0.dll
RegNotifyChangeKeyValue, RegQueryValueExW, RegOpenKeyExW, RegSetValueExW, RegCloseKey
api-ms-win-core-misc-l1-1-0.dll
LocalAlloc, Sleep, LocalFree
api-ms-win-core-processthreads-l1-1-0.dll
OpenProcessToken, OpenThreadToken, GetCurrentThread, ProcessIdToSessionId, SetThreadToken, GetCurrentProcess, GetProcessId, GetCurrentThreadId, GetCurrentProcessId, TerminateProcess
api-ms-win-core-profile-l1-1-0.dll
QueryPerformanceCounter
api-ms-win-core-synch-l1-1-0.dll
WaitForSingleObject, OpenEventW, SetEvent, InitializeCriticalSection, OpenProcess, CreateEventW, WaitForMultipleObjectsEx, ResetEvent, DeleteCriticalSection
api-ms-win-core-sysinfo-l1-1-0.dll
GetTickCount, GetSystemTimeAsFileTime, GetTickCount64
api-ms-win-core-threadpool-l1-1-0.dll
UnregisterWaitEx
api-ms-win-security-base-l1-1-0.dll
SetSecurityDescriptorGroup, CopySid, InitializeSecurityDescriptor, GetTokenInformation, AdjustTokenPrivileges, SetSecurityDescriptorDacl, GetLengthSid, IsValidSid, DuplicateTokenEx, GetSecurityDescriptorLength, CreateWellKnownSid, MakeSelfRelativeSD, MakeAbsoluteSD, CheckTokenMembership, DuplicateToken, AddAce, GetAce, InitializeAcl, GetAclInformation, GetSecurityDescriptorDacl, RevertToSelf, ImpersonateLoggedOnUser, AccessCheckAndAuditAlarmW, IsValidSecurityDescriptor, EqualSid, SetSecurityDescriptorOwner
api-ms-win-service-management-l1-1-0.dll
OpenSCManagerW, OpenServiceW, StartServiceW, CloseServiceHandle
api-ms-win-service-management-l2-1-0.dll
QueryServiceConfigW, NotifyServiceStatusChangeW
api-ms-win-service-winsvc-l1-1-0.dll
QueryServiceStatus, I_ScSendTSMessage
kernel32.dll
QueueUserWorkItem, GetComputerNameW, WaitForMultipleObjects, RegisterWaitForSingleObject, LoadLibraryW, DelayLoadFailureHook, HeapAlloc, GetProcessHeap, HeapFree, ExpandEnvironmentStringsW, SetLastError, OutputDebugStringA, RtlCaptureStackBackTrace, LocalSize, SleepEx, GetVersionExW, CreateProcessW, DebugBreak, IsDebuggerPresent, GetSystemDirectoryW, RegCreateKeyExW, RegOpenCurrentUser, RegEnumKeyExW, VerifyVersionInfoW, VerSetConditionMask
msvcrt.dll
DllMain
ntdll.dll
NtDelayExecution, RtlUnhandledExceptionFilter, EtwUnregisterTraceGuids, EtwRegisterTraceGuidsW, EtwGetTraceLoggerHandle, EtwGetTraceEnableLevel, EtwGetTraceEnableFlags, EtwTraceMessage, EtwEventWrite, RtlInitializeResource, EtwEventUnregister, RtlDeleteResource, NtNotifyChangeSession, RtlInsertElementGenericTable, RtlLookupElementGenericTable, RtlDeleteElementGenericTable, NtOpenEvent, RtlInitUnicodeString, RtlInitializeGenericTable, RtlEnumerateGenericTable, NtOpenSession, NtSetSystemInformation, NtQuerySystemTime, NtFreeVirtualMemory, NtAllocateVirtualMemory, RtlConnectToSm, RtlSendMsgToSm, NtDuplicateToken, RtlRaiseException, RtlAcquireResourceExclusive, RtlAcquireResourceShared, RtlReleaseResource, NtQuerySystemInformation, RtlEqualSid, NtSetSecurityObject, NtQuerySecurityObject, NtOpenSymbolicLinkObject, NtQueryDirectoryObject, NtCreateDirectoryObject, NtQueryValueKey, NtOpenKey, NtDuplicateObject, NtQueryInformationProcess, RtlMapGenericMask, RtlGetAce, RtlQueryInformationAcl, RtlGetDaclSecurityDescriptor, RtlCreateUserSecurityObject, RtlGetOwnerSecurityDescriptor, RtlDeleteAce, RtlSetGroupSecurityDescriptor, RtlCopySecurityDescriptor, RtlGetGroupSecurityDescriptor, NtTerminateProcess, NtWaitForSingleObject, RtlPrefixUnicodeString, NtClose, NtCreateEvent, RtlNumberGenericTableElements, RtlFreeSid, RtlSetDaclSecurityDescriptor, RtlAddAccessAllowedAce, RtlCreateAcl, RtlCreateSecurityDescriptor, RtlLengthSid, RtlAllocateAndInitializeSid, NtCreatePort, NtCompleteConnectPort, NtAcceptConnectPort, NtReplyPort, DbgPrint, NtOpenProcess, NtCreateSection, NtReplyWaitReceivePort, RtlNtStatusToDosError, NtQueryLicenseValue, RtlLeaveCriticalSection, RtlEnterCriticalSection, RtlAdjustPrivilege, NtQueryInformationToken, EtwEventRegister
rpcrt4.dll
RpcServerTestCancel, NdrAsyncServerCall, NdrServerCall2, RpcImpersonateClient, RpcRevertToSelf, I_RpcMapWin32Status, UuidCreate, UuidToStringW, RpcAsyncCompleteCall, RpcServerSubscribeForNotification, RpcServerInqCallAttributesW, RpcServerInqDefaultPrincNameW, RpcServerRegisterAuthInfoW, RpcServerUnsubscribeForNotification, I_RpcBindingIsClientLocal, I_RpcBindingInqLocalClientPID, RpcServerUseProtseqEpW, RpcServerRegisterIfEx, RpcServerListen, RpcBindingToStringBindingW, RpcStringBindingParseW, RpcMgmtWaitServerListen, RpcStringFreeW
sysntfy.dll
SysNotifyStartServer
wmsgapi.dll
WmsgSendMessage
