MapGenericMask, CreateProcessAsUserW, CreateRestrictedToken, IsValidSid, GetLengthSid, GetSecurityDescriptorOwner, GetSecurityDescriptorGroup, GetSecurityDescriptorDacl, GetSecurityDescriptorSacl, GetSecurityDescriptorControl, SetNamedSecurityInfoW, GetSecurityInfo, LookupPrivilegeValueW, AdjustTokenPrivileges, ConvertStringSidToSidW, LookupAccountSidW, EventUnregister, EventRegister, EventActivityIdControl, EventWriteTransfer, EventEnabled, EventWrite, RevertToSelf, IsTokenRestricted, RegOpenKeyExW, RegSetValueExW, RegCloseKey, RegQueryValueExW, QueryAllTracesW, ConvertSidToStringSidW, RegDeleteValueW, StartTraceW, EnableTrace, ControlTraceW, UnregisterTraceGuids, RegisterTraceGuidsW, GetTraceLoggerHandle, GetTraceEnableLevel, GetTraceEnableFlags, RegCreateKeyExW, CopySid, TraceEvent, ChangeServiceConfigW, RegOpenKeyW, TraceMessage, SetServiceStatus, CloseServiceHandle, QueryServiceConfigW, OpenServiceW, OpenSCManagerW, RegisterServiceCtrlHandlerExW, GetSidSubAuthority, GetSidSubAuthorityCount, SetThreadToken, ImpersonateLoggedOnUser, GetTokenInformation, OpenThreadToken, OpenProcessToken, GetWindowsAccountDomainSid, CreateWellKnownSid, SetTokenInformation, FreeSid, AllocateAndInitializeSid, DuplicateTokenEx, EqualSid, ImpersonateSelf, CheckTokenMembership, LookupAccountNameW, AddMandatoryAce, InitializeAcl, SetSecurityDescriptorSacl, SetSecurityDescriptorDacl, SetEntriesInAclW, SetSecurityDescriptorGroup, SetSecurityDescriptorOwner, InitializeSecurityDescriptor, AccessCheck, MakeAbsoluteSD, MakeSelfRelativeSD, LogonUserW

OutputDebugStringA

OutputDebugStringA

DelayLoadFailureHook, ResolveDelayLoadedAPI

GetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, SetLastError

GetLastError, SetUnhandledExceptionFilter, UnhandledExceptionFilter, SetLastError

ReadFile, GetFileSizeEx, SetFilePointerEx, WriteFile, CreateFileW, GetLongPathNameW, FlushFileBuffers, FileTimeToSystemTime, SetFileInformationByHandle, DeleteFileW, GetFileInformationByHandle, GetFileAttributesExW, SetFileTime, GetFileType, GetFileTime, GetDiskFreeSpaceW, LocalFileTimeToFileTime, SetFilePointer, SetFileAttributesW, GetVolumeInformationW, GetFileAttributesW, GetVolumePathNameW, GetTempFileNameW, GetFullPathNameW, GetDriveTypeW, SetEndOfFile, CreateDirectoryW

DeleteFileW, SetFileAttributesW, GetFileAttributesW, GetDriveTypeW, GetTempFileNameW, GetVolumeInformationW, GetVolumeNameForVolumeMountPointW, CreateDirectoryW, FlushFileBuffers, CreateFileW, GetLongPathNameW, SetEndOfFile, SetFilePointerEx, GetFileSizeEx, ReadFile, WriteFile, GetDiskFreeSpaceW, SetFileTime, GetFileType, GetFileTime, SetFileInformationByHandle, GetVolumePathNameW, GetFileAttributesExW, GetFileInformationByHandle, LocalFileTimeToFileTime, GetFullPathNameW

CloseHandle, DuplicateHandle

HeapFree, HeapCreate, HeapDestroy, HeapAlloc

HeapAlloc, HeapFree, HeapDestroy, HeapCreate

InterlockedCompareExchange, InterlockedIncrement, InterlockedDecrement, InterlockedExchange

InterlockedIncrement, InterlockedExchange, InterlockedCompareExchange, InterlockedDecrement

DisableThreadLibraryCalls, GetModuleFileNameW, GetProcAddress, FreeLibrary, LoadLibraryExA, LoadLibraryExW, LoadStringW

LoadLibraryExW, GetProcAddress, FreeLibrary, LoadStringW, DisableThreadLibraryCalls, GetModuleFileNameW

RegCloseKey, RegSetValueExW, RegOpenKeyExW, RegCreateKeyExW, RegQueryValueExW

Sleep, LocalFree, LocalAlloc, GlobalFree, FormatMessageW, lstrlenW

ExpandEnvironmentStringsW

ExpandEnvironmentStringsW

SetThreadToken, OpenThreadToken, OpenProcessToken, GetCurrentProcess, SetThreadPriority, GetThreadPriority, GetCurrentThreadId, TlsFree, TlsGetValue, TlsSetValue, TlsAlloc, GetExitCodeThread, CreateThread, GetExitCodeProcess, CreateProcessAsUserW, GetCurrentProcessId, TerminateProcess, GetCurrentThread

TlsAlloc, TlsFree, TlsSetValue, CreateThread, GetCurrentThreadId, CreateProcessAsUserW, GetExitCodeProcess, GetCurrentProcessId, TerminateProcess, GetExitCodeThread, SetThreadPriority, TlsGetValue, GetThreadPriority, GetCurrentProcess, OpenProcessToken, GetCurrentThread, OpenThreadToken, SetThreadToken

QueryPerformanceFrequency, QueryPerformanceCounter

RegCreateKeyExW, RegOpenKeyExW, RegQueryValueExW, RegSetValueExW, RegCloseKey

WideCharToMultiByte

WaitForSingleObject, OpenEventW, LeaveCriticalSection, SetEvent, EnterCriticalSection, CreateEventW, SetWaitableTimer, CancelWaitableTimer, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, ReleaseMutex, ReleaseSemaphore, WaitForMultipleObjectsEx, CreateMutexW, WaitForSingleObjectEx, SleepEx, InitializeCriticalSection, ResetEvent

Sleep, WaitForSingleObjectEx, SleepEx, InitializeCriticalSection, WaitForMultipleObjectsEx, ResetEvent, ReleaseSemaphore, WaitForSingleObject, SetEvent, ReleaseMutex, LeaveCriticalSection, EnterCriticalSection, CreateEventW, OpenEventW, SetWaitableTimer, CancelWaitableTimer, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, CreateMutexW

GetTickCount, GetSystemTimeAsFileTime, SystemTimeToFileTime, GetTimeZoneInformation, GetVersionExW, GetSystemDirectoryW, GetLocalTime

GetVersionExW, GetLocalTime, GetTickCount64, GetSystemTimeAsFileTime, GetTickCount, GetSystemDirectoryW

CloseThreadpoolWait, SetThreadpoolWait, CreateThreadpoolWait, CreateThreadpoolCleanupGroup, CloseThreadpoolCleanupGroup, CloseThreadpoolCleanupGroupMembers, CreateThreadpoolWork, SubmitThreadpoolWork, CloseThreadpoolWork, WaitForThreadpoolWorkCallbacks, WaitForThreadpoolWaitCallbacks, CancelThreadpoolIo, StartThreadpoolIo, WaitForThreadpoolIoCallbacks, CreateThreadpoolIo, CloseThreadpoolIo

WaitForThreadpoolIoCallbacks, CloseThreadpoolIo, CreateThreadpoolIo, StartThreadpoolIo, CancelThreadpoolIo, SubmitThreadpoolWork, WaitForThreadpoolWorkCallbacks, SetThreadpoolWait, CreateThreadpoolWait, CloseThreadpoolWait, WaitForThreadpoolWaitCallbacks, CloseThreadpoolCleanupGroup, CloseThreadpoolCleanupGroupMembers, CreateThreadpoolCleanupGroup, CreateThreadpoolWork, CloseThreadpoolWork

AllocateAndInitializeSid, FreeSid, SetTokenInformation, DuplicateTokenEx, ImpersonateLoggedOnUser, GetSidSubAuthorityCount, GetSidSubAuthority, ImpersonateSelf, CheckTokenMembership, AddMandatoryAce, InitializeAcl, SetSecurityDescriptorSacl, SetSecurityDescriptorDacl, SetSecurityDescriptorGroup, SetSecurityDescriptorOwner, InitializeSecurityDescriptor, AccessCheck, MapGenericMask, MakeSelfRelativeSD, MakeAbsoluteSD, EqualSid, IsTokenRestricted, RevertToSelf, GetLengthSid, IsValidSid, AdjustTokenPrivileges, GetSecurityDescriptorControl, GetSecurityDescriptorSacl, GetSecurityDescriptorDacl, GetSecurityDescriptorGroup, GetSecurityDescriptorOwner, CreateRestrictedToken, CopySid, GetTokenInformation

GetSecurityDescriptorDacl, GetSecurityDescriptorSacl, GetSecurityDescriptorControl, CreateRestrictedToken, CopySid, IsValidSid, GetSecurityDescriptorGroup, GetSecurityDescriptorOwner, AdjustTokenPrivileges, GetLengthSid, MapGenericMask, IsTokenRestricted, RevertToSelf, EqualSid, ImpersonateLoggedOnUser, ImpersonateSelf, GetTokenInformation, InitializeSecurityDescriptor, SetSecurityDescriptorOwner, SetSecurityDescriptorGroup, SetSecurityDescriptorDacl, SetSecurityDescriptorSacl, DuplicateTokenEx, AccessCheck, MakeSelfRelativeSD, MakeAbsoluteSD, CheckTokenMembership, InitializeAcl, AddMandatoryAce, GetSidSubAuthorityCount, GetSidSubAuthority, SetTokenInformation, AllocateAndInitializeSid, FreeSid

SetServiceStatus, RegisterServiceCtrlHandlerExW

RegisterServiceCtrlHandlerExW, SetServiceStatus

CloseServiceHandle, OpenSCManagerW, OpenServiceW

QueryServiceConfigW, QueryServiceConfig2W, ChangeServiceConfigW, ChangeServiceConfig2W

CryptProtectData, CryptUnprotectData, CertFreeCertificateContext, CertDeleteCertificateFromStore, CertFindCertificateInStore, CertSetCertificateContextProperty, CertCompareCertificateName, CertGetSubjectCertificateFromStore, CertAddSerializedElementToStore, CertCloseStore, CertSerializeCertificateStoreElement, CertAddCertificateContextToStore, CertOpenStore, CertGetCertificateContextProperty, CertDuplicateCertificateContext, CertEnumCertificatesInStore, CryptDecodeObjectEx, CertStrToNameW, CertVerifyTimeValidity, CertAddEnhancedKeyUsageIdentifier, CertCreateSelfSignCertificate, CryptEncodeObjectEx, CertNameToStrW

GetIfTable, GetBestInterfaceEx, GetIfEntry, GetIfEntry2, GetAdaptersAddresses

DelayLoadFailureHook, CopyFileW, CreateWaitableTimerW, GetFileInformationByHandleEx, WaitForMultipleObjects, PostQueuedCompletionStatus, SwitchToThread, CreateIoCompletionPort, GetModuleHandleExW, GetQueuedCompletionStatus, FreeLibraryAndExitThread, GlobalMemoryStatus, RaiseFailFastException, GetVolumeNameForVolumeMountPointW, CreateSemaphoreW, LoadLibraryW, MoveFileExW, RegGetValueW, SetFilePointer, MultiByteToWideChar, GetComputerNameExW, GetVolumeInformationW, SetFileAttributesW, GetFileAttributesW, GetVolumePathNameW, GetFullPathNameW, GetTempFileNameW, GetDriveTypeW, FindClose, FindNextFileW, FindFirstFileW, VirtualFree, VirtualAlloc, RaiseException, UnhandledExceptionFilter, lstrlenW, QueryPerformanceFrequency, RemoveDirectoryW, GetFileSize, WaitForSingleObjectEx, InterlockedExchange, OutputDebugStringA, GetCurrentProcessId, TerminateProcess, SetUnhandledExceptionFilter, DeleteFileW, GetLastError, GetProcAddress, GetVersionExW, LoadLibraryExW, GetSystemDirectoryW, SetLastError, FreeLibrary, Sleep, CloseHandle, WaitForSingleObject, OpenEventW, DisableThreadLibraryCalls, SetEvent, GetTickCount, GetModuleFileNameW, EnterCriticalSection, CreateEventW, GetSystemTimeAsFileTime, GetCurrentThreadId, LeaveCriticalSection, HeapAlloc, HeapFree, HeapCreate, InterlockedCompareExchange, LoadLibraryA, InterlockedDecrement, InterlockedIncrement, LocalFree, GetCurrentThread, GetCurrentProcess, LocalAlloc, GlobalFree, UnregisterWait, SetThreadPriority, GetThreadPriority, SetWaitableTimer, CancelWaitableTimer, GetDiskFreeSpaceW, RegisterWaitForSingleObject, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, FormatMessageW, DuplicateHandle, ExpandEnvironmentStringsW, GetLongPathNameW, CreateFileW, SetEndOfFile, SetFilePointerEx, GetFileSizeEx, FlushFileBuffers, WriteFile, ReadFile, SetFileInformationByHandle, DeleteFileA, GetFileAttributesExW, GetFileInformationByHandle, SetFileTime, BindIoCompletionCallback, GetFileTime, GetFileType, SystemTimeToFileTime, FileTimeToSystemTime, WideCharToMultiByte, QueueUserWorkItem, QueryPerformanceCounter, GetSystemTime, TlsSetValue, ReleaseMutex, ReleaseSemaphore, TlsGetValue, TlsFree, WaitForMultipleObjectsEx, CreateMutexW, TlsAlloc, GetExitCodeThread, CreateThread, ResetEvent, InitializeCriticalSection, SleepEx, GetExitCodeProcess, GetTimeZoneInformation, LocalFileTimeToFileTime, GetLocalTime, GetComputerNameW, GetDiskFreeSpaceExW, CreateDirectoryW, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, InitializeSRWLock

WNetGetConnectionW

DllMain

NetApiBufferFree, NetWkstaGetInfo, NetGetJoinInformation

EtwUnregisterTraceGuids, EtwRegisterTraceGuidsW, EtwGetTraceLoggerHandle, EtwGetTraceEnableLevel, EtwGetTraceEnableFlags, WinSqmSetDWORD, WinSqmIncrementDWORD, WinSqmIsOptedIn, NtQueryInformationThread, RtlLengthSecurityDescriptor, EtwEventEnabled, EtwEventWrite, EtwEventUnregister, EtwEventRegister, EtwEventActivityIdControl, DbgPrint, EtwTraceMessage

StringFromGUID2, CoRegisterClassObject, CoTaskMemAlloc, CoTaskMemFree, CoRevokeClassObject, CoCreateInstance, CoImpersonateClient, CoRevertToSelf, CoInitializeEx, CoInitializeSecurity, CoUninitialize, CoCreateGuid, IIDFromString, StringFromIID, CoDisconnectContext

RpcImpersonateClient, RpcBindingSetAuthInfoExW, UuidCreate, RpcBindingFromStringBindingW, RpcStringBindingComposeW, RpcBindingVectorFree, RpcEpUnregister, RpcServerInqBindings, RpcServerUnregisterIfEx, RpcServerRegisterIf2, RpcAsyncCancelCall, RpcBindingFree, RpcAsyncInitializeHandle, RpcAsyncCompleteCall, RpcStringFreeW, RpcRevertToSelfEx, RpcServerRegisterAuthInfoW, RpcServerInqDefaultPrincNameW, RpcEpRegisterW, RpcServerUseProtseqW, NdrAsyncClientCall, NdrAsyncServerCall, RpcBindingSetOption

SHGetFolderPathW

SHGetFolderPathW

UrlCombineW, PathFindExtensionW

MsgWaitForMultipleObjectsEx, UnregisterClassW, DestroyWindow, PostMessageW, DefWindowProcW, RegisterDeviceNotificationW, UnregisterDeviceNotification, RegisterClassExW, GetWindowLongW, SetWindowLongW, CreateWindowExW, TranslateMessage, DispatchMessageW, PeekMessageW, LoadStringW, CharNextW, RegisterPowerSettingNotification, UnregisterPowerSettingNotification

WinHttpQueryAuthSchemes, WinHttpSetCredentials, WinHttpOpenRequest, WinHttpTimeFromSystemTime, WinHttpReadData, WinHttpQueryDataAvailable, WinHttpWriteData, WinHttpReceiveResponse, WinHttpSetStatusCallback, WinHttpCrackUrl, WinHttpQueryOption, WinHttpCloseHandle, WinHttpAddRequestHeaders, WinHttpGetProxyForUrl, WinHttpGetIEProxyConfigForCurrentUser, WinHttpSetOption, WinHttpConnect, WinHttpOpen, WinHttpQueryHeaders, WinHttpSendRequest

GetAddrInfoW, FreeAddrInfoW, WSASocketW, WSAIoctl, WSAStringToAddressW

WTSFreeMemory, WTSEnumerateSessionsW