IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

IMAGE_FILE_RELOCS_STRIPPED

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LINE_NUMS_STRIPPED

IMAGE_FILE_LOCAL_SYMS_STRIPPED

IMAGE_FILE_AGGRESIVE_WS_TRIM

IMAGE_FILE_32BIT_MACHINE

ConvertStringSecurityDescriptorToSecurityDescriptorA

A_SHAInit

A_SHAUpdate

A_SHAFinal

LsaStorePrivateData

LsaRetrievePrivateData

LsaNtStatusToWinError

CryptGetUserKey

CryptGetKeyParam

CryptEncrypt

CryptSetProvParam

CryptSignHashW

CryptDeriveKey

CryptGetProvParam

RegOpenCurrentUser

RegDeleteKeyW

AddAccessAllowedAceEx

RegSetKeySecurity

I_ScSendTSMessage

MD5Init

MD5Update

MD5Final

SetFileSecurityA

AllocateLocallyUniqueId

LsaOpenPolicy

LsaQueryInformationPolicy

LsaFreeMemory

LsaClose

RegNotifyChangeKeyValue

QueryServiceConfigW

SetKernelObjectSecurity

ConvertStringSecurityDescriptorToSecurityDescriptorW

RegEnumKeyExW

GetCurrentHwProfileW

RegCloseKey

RegQueryValueExW

RegOpenKeyW

FreeSid

SetSecurityDescriptorDacl

InitializeSecurityDescriptor

AddAccessAllowedAce

InitializeAcl

GetLengthSid

AllocateAndInitializeSid

RegOpenKeyExW

CreateProcessAsUserW

DuplicateTokenEx

CloseServiceHandle

ControlService

StartServiceW

QueryServiceStatus

OpenServiceW

OpenSCManagerW

EqualSid

GetTokenInformation

RegSetValueExW

RegCreateKeyExW

CryptGenRandom

CryptDestroyHash

CryptVerifySignatureW

CryptSetHashParam

CryptGetHashParam

CryptHashData

CryptCreateHash

CryptDecrypt

ReportEventW

RegisterEventSourceW

CryptImportKey

CryptAcquireContextW

CryptReleaseContext

CryptDestroyKey

RegEnumValueW

RegQueryInfoKeyW

RegDeleteValueW

CredFree

CredDeleteW

CredEnumerateW

CopySid

GetSidLengthRequired

GetSidSubAuthority

GetSidSubAuthorityCount

GetUserNameW

OpenThreadToken

EnumServicesStatusW

ImpersonateLoggedOnUser

RegQueryValueExA

CheckTokenMembership

DeregisterEventSource

LsaGetUserName

RevertToSelf

LookupAccountSidW

IsValidSid

SetTokenInformation

LogonUserW

LookupAccountNameW

OpenProcessToken

SynchronizeWindows31FilesAndWindowsNTRegistry

QueryWindows31FilesMigration

AdjustTokenPrivileges

RegQueryInfoKeyA

AuthzInitializeResourceManager

AuthzAccessCheck

AuthziFreeAuditEventType

AuthziInitializeAuditEvent

AuthziInitializeAuditParams

AuthziInitializeAuditEventType

AuthziLogAuditEvent

AuthzFreeAuditEvent

AuthzFreeResourceManager

AuthzFreeHandle

CryptImportPublicKeyInfo

CryptVerifyMessageSignature

CertCreateCertificateContext

CertSetCertificateContextProperty

CertVerifyCertificateChainPolicy

CryptSignMessage

CertCloseStore

CertComparePublicKeyInfo

CryptExportPublicKeyInfo

CertFindExtension

CryptDecryptMessage

CertGetCertificateContextProperty

CertAddCertificateContextToStore

CertOpenStore

CertVerifySubjectCertificateContext

CertGetIssuerCertificateFromStore

CertDuplicateCertificateContext

CertFreeCertificateContext

CertEnumCertificatesInStore

CryptImportPublicKeyInfoEx

RemoveFontResourceW

AddFontResourceW

WTSGetActiveConsoleSessionId

GetTimeFormatW

GetUserDefaultLCID

FileTimeToSystemTime

FileTimeToLocalFileTime

GetProcAddress

LoadLibraryW

GetModuleHandleW

SystemTimeToFileTime

GetSystemTime

SetLastError

TerminateProcess

GetCurrentProcess

CreateTimerQueueTimer

CreateThread

lstrcpynW

GetShortPathNameW

GetProfileStringW

FreeLibrary

ReleaseSemaphore

CreateSemaphoreW

GetSystemInfo

GetComputerNameW

GetEnvironmentVariableW

WaitForSingleObjectEx

LoadResource

FindResourceW

SetThreadExecutionState

DeleteTimerQueueTimer

ResetEvent

GetSystemDirectoryW

TransactNamedPipe

SetNamedPipeHandleState

GetTickCount

CreateFileW

GlobalGetAtomNameW

VirtualLock

VirtualQuery

GetDriveTypeW

Beep

OpenMutexW

QueueUserWorkItem

LeaveCriticalSection

EnterCriticalSection

DisconnectNamedPipe

SearchPathW

lstrcatW

LocalReAlloc

ExpandEnvironmentStringsW

TerminateThread

ResumeThread

GetDiskFreeSpaceExW

GlobalMemoryStatusEx

DeleteFileW

WriteProfileStringW

ReadFile

FindVolumeClose

FindNextVolumeW

FindFirstVolumeW

FormatMessageW

SetPriorityClass

MoveFileExW

WaitForMultipleObjectsEx

GetExitCodeProcess

SleepEx

InterlockedExchange

FindClose

FindFirstFileW

GetWindowsDirectoryW

SetTimerQueueTimer

GetComputerNameA

GetVersionExW

VerSetConditionMask

WriteFile

WaitNamedPipeW

WaitForMultipleObjects

ConnectNamedPipe

DuplicateHandle

OpenProcess

GetOverlappedResult

GetVersionExA

lstrcmpW

SetEnvironmentVariableW

UnregisterWait

CreateNamedPipeW

CreateRemoteThread

CreateActCtxW

GetModuleFileNameW

ExitProcess

LoadLibraryExW

SetErrorMode

SetUnhandledExceptionFilter

GetPrivateProfileStringW

LocalSize

VirtualAlloc

VirtualQueryEx

DebugBreak

CreateFileA

InitializeCriticalSection

ProcessIdToSessionId

SetInformationJobObject

AssignProcessToJobObject

TerminateJobObject

PostQueuedCompletionStatus

PulseEvent

GetQueuedCompletionStatus

CreateIoCompletionPort

CreateJobObjectW

ActivateActCtx

DeactivateActCtx

InterlockedCompareExchange

LoadLibraryA

QueryPerformanceCounter

GetSystemTimeAsFileTime

UnhandledExceptionFilter

GetModuleHandleA

GetStartupInfoA

GetCurrentProcessId

SetThreadPriority

GetCurrentThreadId

lstrcmpiW

GetProfileIntW

LoadLibraryExA

lstrcpyW

lstrlenW

Sleep

LocalAlloc

CreateEventW

GetExitCodeThread

SetThreadAffinityMask

GetProcessAffinityMask

CreateWaitableTimerW

CreateMutexW

OpenEventW

RegisterWaitForSingleObject

WaitForSingleObject

CreateProcessW

SetWaitableTimer

ReleaseMutex

SetEvent

UnregisterWaitEx

CloseHandle

lstrlenA

lstrcpyA

MultiByteToWideChar

GetACP

WideCharToMultiByte

HeapAlloc

GetProcessHeap

HeapFree

lstrcpynA

UnmapViewOfFile

MapViewOfFile

CreateFileMappingW

lstrcmpiA

GetFileSize

SetFilePointer

GlobalAlloc

GlobalFree

GetLastError

LocalFree

lstrcatA

lstrcmpA

GetLogicalDriveStringsA

GetDriveTypeA

GetVolumeInformationW

GlobalMemoryStatus

CreateMutexA

FindResourceExW

LockResource

SizeofResource

VerifyVersionInfoW

GetSystemDirectoryA

GetCurrentThread

DelayLoadFailureHook

BaseInitAppcompatCacheSupport

OpenProfileUserMapping

CloseProfileUserMapping

BaseCleanupAppcompatCacheSupport

InitializeCriticalSectionAndSpinCount

VirtualProtect

CreateEventA

TlsSetValue

DeleteCriticalSection

TlsGetValue

TlsAlloc

VirtualFree

TlsFree

_vsnwprintf

wcslen

wcsncpy

wcsstr

atoi

wcstok

memmove

wcschr

swprintf

swscanf

_local_unwind2

_wcslwr

wcscmp

_snwprintf

malloc

_c_exit

_exit

_XcptFilter

_cexit

exit

_acmdln

__getmainargs

_initterm

__setusermatherr

_adjust_fdiv

__p__commode

__p__fmode

??3@YAXPAX@Z

??2@YAPAXI@Z

__CxxFrameHandler

_itow

_snprintf

_wtol

_strnicmp

sscanf

wcstombs

sprintf

strchr

strncmp

atof

_ftol

isspace

__set_app_type

wcscpy

_controlfp

wcsncmp

_wcsupr

ceil

wcscat

_except_handler3

free

_wcsicmp

ord603

ord612

ord613

ord611

RtlAllocateHeap

NtPowerInformation

NtSetSystemPowerState

NtRaiseHardError

RtlDeleteCriticalSection

NtOpenSymbolicLinkObject

NtReplyPort

NtCompleteConnectPort

NtReplyWaitReceivePort

NtAcceptConnectPort

NtCreatePort

RtlConvertSidToUnicodeString

RtlFreeUnicodeString

NtLockProductActivationKeys

RtlTimeToTimeFields

NtUnmapViewOfSection

NtMapViewOfSection

NtOpenSection

NtQuerySymbolicLinkObject

NtQueryVolumeInformationFile

NtSetSecurityObject

RtlAdjustPrivilege

NtOpenFile

NtFsControlFile

RtlAllocateAndInitializeSid

RtlDestroyEnvironment

RtlFreeHeap

NtQueryInformationToken

NtShutdownSystem

RtlEnterCriticalSection

RtlLeaveCriticalSection

RtlInitializeCriticalSection

RtlCreateEnvironment

RtlQueryEnvironmentVariable_U

RtlSetEnvironmentVariable

RtlInitUnicodeString

NtOpenKey

NtQueryValueKey

RtlSubAuthoritySid

RtlInitializeSid

RtlLengthRequiredSid

NtAllocateLocallyUniqueId

RtlGetDaclSecurityDescriptor

RtlCopySid

RtlLengthSid

NtSetInformationThread

NtDuplicateToken

NtDuplicateObject

RtlEqualSid

RtlSetDaclSecurityDescriptor

NtClose

RtlOpenCurrentUser

RtlCreateSecurityDescriptor

RtlAddAce

RtlCreateAcl

RtlNtStatusToDosError

NtOpenDirectoryObject

NtQuerySystemInformation

NtCreateEvent

NtCreatePagingFile

RtlDosPathNameToNtPathName_U

RtlRegisterWait

NtSetValueKey

NtCreateKey

RtlTimeToSecondsSince1980

NtQuerySystemTime

NtPrivilegeObjectAuditAlarm

NtPrivilegeCheck

NtOpenThreadToken

NtOpenProcessToken

RtlUnhandledExceptionFilter

NtQueryInformationProcess

DbgBreakPoint

RtlCheckProcessParameters

RtlSetThreadIsCritical

RtlSetProcessIsCritical

RtlInitString

NtInitiatePowerAction

DbgPrint

NtFilterToken

NtQueryInformationJobObject

NtOpenEvent

RtlGetAce

RtlQueryInformationAcl

NtQuerySecurityObject

RtlCompareUnicodeString

NtSetInformationProcess

InitializeProfileMappingApi

RemapAndMoveUserW

EnumProcesses

EnumProcessModules

GetModuleBaseNameW

RegDefaultUserConfigQueryW

RegUserConfigQuery

RpcServerRegisterIfEx

RpcServerUseProtseqEpW

RpcImpersonateClient

I_RpcMapWin32Status

RpcServerRegisterIf

RpcGetAuthorizationContextForClient

RpcFreeAuthorizationContext

RpcServerListen

RpcRevertToSelf

NdrServerCall2

UuidCreate

GetUserNameExW

LsaLookupAuthenticationPackage

LsaRegisterLogonProcess

LsaCallAuthenticationPackage

SetupDiDestroyDeviceInfoList

SetupDiEnumDeviceInfo

SetupDiGetClassDevsW

SetupDiGetDeviceRegistryPropertyW

SetFocus

EnumWindows

CreateWindowStationW

RegisterLogonProcess

RecordShutdownReason

LoadLocalFonts

UnhookWindowsHook

SetWindowsHookW

GetWindowTextW

CallNextHookEx

DialogBoxParamW

GetWindowPlacement

GetSystemMenu

DeleteMenu

SetWindowPlacement

SetUserObjectInformationW

GetAsyncKeyState

PostThreadMessageW

SetUserObjectSecurity

CreateDesktopW

KillTimer

GetMessageTime

SetLogonNotifyWindow

UnlockWindowStation

SetTimer

ReplyMessage

UnregisterHotKey

RegisterHotKey

OpenInputDesktop

GetUserObjectInformationW

CloseDesktop

RegisterDeviceNotificationW

SetThreadDesktop

CreateWindowExW

GetMessageW

TranslateMessage

RegisterWindowMessageW

SetCursor

DefWindowProcW

FindWindowW

MessageBoxW

SendNotifyMessageW

PostQuitMessage

MsgWaitForMultipleObjects

GetWindowRect

GetSystemMetrics

PeekMessageW

DispatchMessageW

SetProcessWindowStation

UpdateWindow

ShowWindow

SetWindowPos

PostMessageW

ExitWindowsEx

EnumDisplayMonitors

SystemParametersInfoW

GetDlgItem

SendMessageW

CreateDialogParamW

DestroyWindow

GetWindowLongW

GetDlgItemTextW

EndDialog

SetWindowLongW

LoadStringW

SetWindowTextW

SetDlgItemTextW

wsprintfW

wsprintfA

LockWindowStation

MBToWCSEx

SetWindowStationUser

UpdatePerUserSystemParameters

DialogBoxIndirectParamW

wvsprintfW

SetLastErrorEx

LoadCursorW

CheckDlgButton

IsDlgButtonChecked

RegisterClassW

CloseWindowStation

LoadImageW

GetParent

GetKeyState

GetDesktopWindow

SetForegroundWindow

SwitchDesktop

OpenDesktopW

WaitForUserPolicyForegroundProcessing

GetAllUsersProfileDirectoryW

ord118

ord117

ord131

ord151

WaitForMachinePolicyForegroundProcessing

ord140

ord150

ord152

UnloadUserProfile

LoadUserProfileW

GetUserProfileDirectoryW

RegisterGPNotification

CreateEnvironmentBlock

DestroyEnvironmentBlock

UnregisterGPNotification

ord130

GetFileVersionInfoSizeW

GetFileVersionInfoW

VerQueryValueW

WinStationRequestSessionsList

WinStationQueryLogonCredentialsW

WinStationIsHelpAssistantSession

WinStationAutoReconnect

_WinStationWaitForConnect

WinStationDisconnect

_WinStationCallback

WinStationNameFromLogonIdW

_WinStationFUSCanRemoteUserDisconnect

WinStationEnumerate_IndexedW

WinStationGetMachinePolicy

WinStationQueryInformationW

WinStationFreeMemory

WinStationReset

_WinStationNotifyDisconnectPipe

WinStationConnectW

WinStationSetInformationW

WinStationShutdownSystem

WinStationCheckLoopBack

_WinStationNotifyLogon

_WinStationNotifyLogoff

CryptCATCatalogInfoFromContext

CryptCATAdminCalcHashFromFileHandle

CryptCATAdminAcquireContext

CryptCATAdminEnumCatalogFromHash

CryptCATAdminReleaseCatalogContext

WTHelperProvDataFromStateData

WinVerifyTrust

WTHelperGetProvSignerFromChain

CryptCATAdminReleaseContext

WSACleanup

getaddrinfo

WSAStartup

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_CNT_CODE

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE