Import table
advapi32.dll
RevertToSelf, RegOpenKeyW, ImpersonateLoggedOnUser, GetTokenInformation, RegOpenKeyExW, RegCloseKey, RegEnumKeyExW, CopySid, GetLengthSid, OpenProcessToken, ConvertSidToStringSidW, RegQueryValueExW, OpenThreadToken
fltlib.dll
FilterSendMessage
kernel32.dll
ReleaseSemaphore, InterlockedExchange, WaitForSingleObject, Sleep, GetCurrentProcess, GetCurrentThread, GetModuleHandleA, GetProcAddress, GetFileAttributesW, CreateSemaphoreW, LocalFree, GetModuleHandleW, SearchPathW, GetLocaleInfoW, GetSystemDefaultLCID, InterlockedDecrement, OpenProcess, CreateToolhelp32Snapshot, Process32NextW, Process32FirstW, GetSystemTimeAsFileTime, GetVersionExW, GetLongPathNameW, GetExitCodeProcess, GetProcessTimes, GetProcessIoCounters, ExpandEnvironmentStringsW, TerminateProcess, GetCurrentProcessId, InterlockedIncrement, LeaveCriticalSection, EnterCriticalSection, DeleteCriticalSection, InitializeCriticalSection, CloseHandle, HeapAlloc, HeapFree, GetProcessHeap, GetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetSystemDefaultLangID, DecodePointer, InterlockedCompareExchange, DisableThreadLibraryCalls, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, EncodePointer
msvcp100.dll
DllMain
msvcr100.dll
DllMain
psapi.dll
GetModuleFileNameExW, GetProcessMemoryInfo
user32.dll
CharLowerBuffW
userenv.dll
UnloadUserProfile
version.dll
VerQueryValueW
Export table
ekaCanUnloadModule
ekaGetObjectFactory
LastReferenceReleased
ResetReferenceControl
