ntdll
ZwOpenProcessToken
ZwQueryInformationToken
NtUnmapViewOfSection
ZwCreateFile
ZwQueryInformationProcess
_allmul
ZwOpenFile
ZwWriteFile
ZwReadFile
ZwClose
RtlInitUnicodeString
memcpy
memset
RtlUnwind
NtGetContextThread
NtSetContextThread
ZwDeviceIoControlFile
RtlNtStatusToDosError
NtCreateSection
NtMapViewOfSection
ZwOpenProcess
_strupr
RtlAdjustPrivilege
RtlRandom
NtQueryVirtualMemory
shlwapi
StrToIntA
StrChrA
StrStrIA
StrRChrA
kernel32
SetEvent
OpenEventA
SleepEx
FindFirstFileA
CreateEventA
GetLastError
GetModuleFileNameA
lstrcmpiA
FindNextFileA
CopyFileA
GetModuleHandleA
GetTickCount
lstrlenA
CreateProcessA
MoveFileExA
FindClose
GetWindowsDirectoryA
TerminateProcess
ResetEvent
GetSystemDirectoryA
GetCommandLineA
Sleep
ExitProcess
GetTempPathA
lstrcatA
LocalAlloc
LocalFree
OpenProcess
DeleteFileA
GetProcAddress
GetVolumeInformationA
GetCurrentProcess
GetVersion
CreateMutexA
VirtualFree
VirtualAlloc
GetFileSize
WaitForSingleObject
lstrcpyA
VirtualProtectEx
SwitchToThread
GetThreadContext
CloseHandle
lstrcpynA
GetCurrentProcessId
WriteFile
CreateFileA
SetEndOfFile
lstrcmpA
VirtualAllocEx
ResumeThread
SuspendThread
WriteProcessMemory
ReadFile
SetFilePointer
ReadProcessMemory
user32
wsprintfA
GetWindowThreadProcessId
ExitWindowsEx
wsprintfW
GetShellWindow
advapi32
ConvertStringSecurityDescriptorToSecurityDescriptorA
OpenProcessToken
GetTokenInformation
RegCreateKeyA
RegQueryValueExA
RegCloseKey
RegSetValueExA
RegOpenKeyExA
RegOpenKeyA
shell32
ShellExecuteExA
ShellExecuteA
psapi
GetModuleFileNameExA
EnumProcessModules
generic
count=1,
id=125,
productName=VS2005 build 50727,
version=50727,
count=1,
id=149,
productName=VS2008 SP1 build 30729,
version=30729,
count=6,
id=109,
productName=VS2005 build 50727,
version=50727,
count=14,
id=147,
productName=VS2008 SP1 build 30729,
version=30729,
count=134,
id=1,
productName=Unmarked objects,
count=3,
id=93,
productName=Windows Server 2003 SP1 DDK build 4035,
version=4035,
count=1,
id=95,
productName=Windows Server 2003 SP1 DDK build 4035,
version=4035,
count=3,
id=15,
productName=Windows Server 2003 SP1 DDK build 4035,
version=4035,
count=19,
id=113,
version=50727,
count=1,
id=124,
productName=VS2005 build 50727,
version=50727,
count=1,
id=120,
productName=VS2005 build 50727,
version=50727,
