select setsockopt WSAStartup gethostbyname getprotobyname ioctlsocket WSACloseEvent WSACreateEvent WSAEnumNetworkEvents inet_addr WSAIoctl WSAResetEvent WSASetEvent WSAWaitForMultipleEvents accept listen gethostname socket WSAEventSelect getsockopt connect send recv WSAGetLastError ntohs htons getsockname closesocket bind shutdown freeaddrinfo getaddrinfo WSACleanup

InternetSetOptionA InternetCloseHandle InternetOpenA HttpSendRequestA HttpOpenRequestA InternetConnectA InternetReadFile

GdiplusShutdown GdipSaveImageToStream GdipFree GdipGetImageHorizontalResolution GdipGetImageHeight GdipBitmapSetResolution GdipCreateBitmapFromScan0 GdipDeleteGraphics GdipGetImageGraphicsContext GdipDrawImageRectI GdipGraphicsClear GdipGetImageVerticalResolution GdipAlloc GdipGetImageEncodersSize GdipDisposeImage GdipGetImageEncoders GdipSetInterpolationMode GdipCloneImage GdiplusStartup GdipGetImageWidth GdipCreateBitmapFromHBITMAP

RpcBindingFromStringBindingW RpcAsyncInitializeHandle RpcStringBindingComposeW RpcBindingSetAuthInfoExW NdrAsyncClientCall RpcRaiseException RpcAsyncCompleteCall RpcBindingFree RpcStringFreeW

WaitForDebugEvent InitializeProcThreadAttributeList SetFilePointer SetFilePointerEx UpdateProcThreadAttribute DeleteProcThreadAttributeList CreatePipe ReadFile TerminateProcess WriteFile WaitForSingleObject SetHandleInformation PeekNamedPipe GetCurrentThreadId WriteProcessMemory OpenProcess GetProcAddress LoadLibraryW ExpandEnvironmentStringsW GetWindowsDirectoryW CloseHandle CreateFileW GlobalUnlock GetProcessHeap GetModuleHandleW GlobalLock HeapFree HeapAlloc DeleteFileW GetTempPathW GetCurrentDirectoryW GetLastError CopyFileW MoveFileExW CreateThread GetCurrentProcessId VirtualProtect GetModuleHandleA GetModuleFileNameA SetCurrentDirectoryW VirtualAlloc ExitThread GetEnvironmentVariableA GetTimeZoneInformation GetModuleFileNameW Wow64RevertWow64FsRedirection Wow64DisableWow64FsRedirection Sleep GetSystemDirectoryW VirtualFree GetCurrentProcess SetErrorMode GetCommandLineW ExitProcess GetThreadContext SetThreadContext Thread32First HeapCreate Thread32Next SetThreadPriority OpenThread GetThreadPriority TryEnterCriticalSection MapViewOfFile UnmapViewOfFile UnlockFile LockFile FormatMessageW FindNextFileA FindFirstFileA InitializeCriticalSection QueryPerformanceFrequency SetEnvironmentVariableA SetEndOfFile WriteConsoleW GetFullPathNameW GetFileInformationByHandle FileTimeToLocalFileTime OutputDebugStringW SetStdHandle GetConsoleCP FlushFileBuffers FileTimeToSystemTime SystemTimeToTzSpecificLocalTime FindFirstFileExW ReadConsoleW GetConsoleMode FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetStdHandle HeapSize AreFileApisANSI GetOEMCP GetACP IsValidCodePage EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc SetLastError SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext LoadLibraryExW GetCPInfo RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader HeapReAlloc GetCommandLineA GetSystemTimeAsFileTime IsProcessorFeaturePresent IsDebuggerPresent DecodePointer EncodePointer GetStringTypeW SetNamedPipeHandleState CancelIoEx DisconnectNamedPipe GetOverlappedResult CreateNamedPipeW ConnectNamedPipe CreateEventW GetSystemTime FreeLibrary ResumeThread SuspendThread GetExitCodeThread TerminateThread CreateProcessW GlobalFree GetTickCount DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount LockFileEx GetDiskFreeSpaceW CreateFileMappingW GetFileAttributesExW ContinueDebugEvent GetVolumeInformationW GetDiskFreeSpaceExW GetFileTime FindNextFileW Process32NextW RemoveDirectoryW GetFileType GetCurrentThread LocalAlloc LocalFree GetTickCount64 GetModuleHandleExW Module32FirstW CreateToolhelp32Snapshot Module32NextW LoadLibraryA DuplicateHandle IsBadReadPtr SetEvent WaitForMultipleObjects OpenEventW WideCharToMultiByte MultiByteToWideChar OpenMutexA CreateMutexA GetEnvironmentVariableW GetFileSize GetUserDefaultLocaleName FindFirstFileW GetNativeSystemInfo GetDriveTypeW VirtualQuery K32GetProcessImageFileNameW GetLogicalDriveStringsW SetEnvironmentVariableW CreateDirectoryW GetComputerNameW GetFileAttributesW GetPhysicallyInstalledSystemMemory GetFileSizeEx FindClose Process32FirstW GetProcessId IsWow64Process

MapVirtualKeyW SetTimer GetMessageW GetRawInputData UnregisterClassW TranslateMessage wsprintfW EnumDisplayMonitors SetProcessWindowStation SetProcessDPIAware GetThreadDesktop GetKeyboardState GetForegroundWindow EnumWindows GetClassNameW IsWindowVisible RegisterClassExW GetClipboardData GetWindowTextW RegisterRawInputDevices CreateWindowExW OpenClipboard CloseWindow ToUnicode DefWindowProcW GetWindowThreadProcessId DispatchMessageW MonitorFromWindow CloseWindowStation GetProcessWindowStation OpenInputDesktop CloseDesktop GetDC OpenWindowStationA ReleaseDC CloseClipboard GetDesktopWindow SetThreadDesktop KillTimer

DeleteDC CreateCompatibleBitmap CreateCompatibleDC SelectObject DeleteObject BitBlt

DuplicateToken RegUnLoadKeyW CloseServiceHandle OpenProcessToken OpenSCManagerW OpenServiceW GetTokenInformation LookupPrivilegeValueW StartServiceW DuplicateTokenEx QueryServiceStatusEx IsValidSid ConvertSidToStringSidW QueryServiceStatus CreateProcessAsUserW CryptGenRandom CryptReleaseContext CryptAcquireContextW ConvertStringSecurityDescriptorToSecurityDescriptorW GetSidSubAuthority IsWellKnownSid RegSetValueExW RegCloseKey RegLoadKeyW RegOpenKeyExW GetUserNameW SetThreadToken InitializeSecurityDescriptor PrivilegeCheck ConvertStringSidToSidW CreateProcessWithTokenW SetSecurityDescriptorDacl LookupAccountSidW CheckTokenMembership AdjustTokenPrivileges CreateWellKnownSid RegDeleteKeyExW RegEnumKeyW RegCreateKeyExW RegQueryValueExW RegOpenKeyW RegQueryInfoKeyW RegDeleteValueW

CoGetObject CoInitializeEx CoUninitialize CoCreateInstance

SysAllocString VariantInit VariantClear

NtRemoveProcessDebug NtQueryObject NtQueryInformationToken NtClose NtDuplicateObject DbgUiSetThreadDebugObject NtReadVirtualMemory RtlAddFunctionTable NtQueryInformationProcess RtlCreateUnicodeString

MiniDumpWriteDump

ord176

BCryptGenerateSymmetricKey BCryptDecrypt BCryptSetProperty BCryptOpenAlgorithmProvider

CheckSumMappedFile

WinHttpGetProxyForUrl WinHttpConnect WinHttpOpen WinHttpCloseHandle WinHttpSendRequest WinHttpReceiveResponse WinHttpGetIEProxyConfigForCurrentUser WinHttpReadData WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders

DsRoleFreeMemory DsRoleGetPrimaryDomainInformation

GetIpForwardTable GetAdaptersAddresses