GetProcessAffinityMask GetSystemTimeAsFileTime QueryDosDeviceW PostQueuedCompletionStatus WriteFile ReadFile SetProcessAffinityMask IsProcessorFeaturePresent GetSystemInfo GetOverlappedResult GetLogicalProcessorInformation TlsAlloc GetQueuedCompletionStatusEx K32GetProcessImageFileNameW GetProcessTimes GetSystemTimes GetProcessIoCounters VirtualQueryEx OpenProcess ResetEvent LocalFree TlsGetValue SetThreadAffinityMask TlsSetValue TlsFree CreateIoCompletionPort FreeLibrary SetFileCompletionNotificationModes SetLastError GetFinalPathNameByHandleW CancelIoEx GetTickCount64 DeviceIoControl QueryFullProcessImageNameW GetProcessHeap CreateFileW EncodePointer IsDebuggerPresent GetProcAddress RtlPcToFileHeader RaiseException IsWow64Process2 LoadLibraryExA LoadLibraryExW CreateWaitableTimerExW FormatMessageW QueryPerformanceCounter FindNextFileW FindClose GetCurrentThreadId GetModuleHandleA RtlLookupFunctionEntry LoadLibraryA lstrlenW WideCharToMultiByte MultiByteToWideChar GetModuleHandleW CompareStringOrdinal GetModuleFileNameW LoadLibraryW ReadProcessMemory GetStdHandle GetConsoleMode SetConsoleMode SetConsoleTextAttribute GetConsoleScreenBufferInfo WaitForSingleObjectEx GetSystemTimePreciseAsFileTime GetProcessId GetLastError GetCurrentThread GetFileType MoveFileExW DeleteFileW GetTempPathW DuplicateHandle GetFileAttributesW CreateProcessW GetConsoleOutputCP GetWindowsDirectoryW WriteConsoleW GetSystemDirectoryW SetThreadStackGuarantee TerminateProcess CancelIo CreateEventW WaitForMultipleObjects GetExitCodeProcess ExitProcess CreateDirectoryW SwitchToThread GetFileInformationByHandleEx Sleep QueryPerformanceFrequency CloseHandle WaitForSingleObject SetWaitableTimer GetFileInformationByHandle FindFirstFileExW SetFileInformationByHandle SetFileTime GetFullPathNameW CreateThread SetHandleInformation HeapReAlloc HeapFree ReadFileEx SleepEx WriteFileEx HeapAlloc ReleaseMutex CreateMutexA GetCurrentProcessId GetCurrentProcess InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeSListHead AddVectoredExceptionHandler FreeEnvironmentStringsW GetEnvironmentStringsW GetEnvironmentVariableW GetCurrentDirectoryW GetCommandLineW

WakeByAddressSingle WakeByAddressAll WaitOnAddress

socket WSASend WSADuplicateSocketW WSAStartup getsockname WSAGetLastError recvfrom bind closesocket setsockopt send WSASocketW ioctlsocket WSAIoctl getpeername connect getsockopt recv freeaddrinfo getaddrinfo sendto WSACleanup shutdown

RtlUnwindEx NtQueryInformationProcess NtQuerySystemInformation NtCreateNamedPipeFile RtlVirtualUnwind RtlCaptureContext NtOpenFile NtReadFile NtWriteFile NtCreateFile NtDeviceIoControlFile NtCancelIoFileEx RtlGetVersion RtlNtStatusToDosError

SHGetKnownFolderPath CommandLineToArgvW

SystemFunction036 CopySid GetLengthSid IsValidSid RegSetValueExW RegDeleteValueW RegCreateKeyExW RegQueryValueExA RegEnumKeyExW RegCloseKey RegOpenKeyExW StartServiceW ChangeServiceConfigW QueryServiceStatus CreateServiceW QueryServiceConfigW CloseServiceHandle DeleteService ControlService OpenServiceW OpenSCManagerW RegQueryValueExW GetTokenInformation OpenProcessToken CloseTrace ProcessTrace OpenTraceW EnableTraceEx2 StartTraceW ControlTraceW

GetExtendedTcpTable IcmpCloseHandle IcmpSendEcho IcmpCreateFile ConvertInterfaceGuidToLuid ConvertInterfaceLuidToIndex GetAdaptersInfo ConvertInterfaceLuidToGuid ConvertInterfaceIndexToLuid GetAdaptersAddresses GetIpForwardTable GetIpInterfaceEntry GetIfEntry2 GetBestInterfaceEx GetExtendedUdpTable ConvertInterfaceAliasToLuid

EnumProcesses GetProcessImageFileNameW GetModuleFileNameExW

FwpmFreeMemory0 FwpmFilterAdd0 FwpmSubLayerAdd0 FwpmFilterDestroyEnumHandle0 FwpmSubLayerDeleteByKey0 FwpmEngineClose0 FwpmEngineOpen0 FwpmFilterCreateEnumHandle0 FwpmGetAppIdFromFileName0 FwpmFilterEnum0 FwpmFilterDeleteById0

PdhCloseQuery PdhRemoveCounter

SysStringLen GetErrorInfo SysFreeString

CoIncrementMTAUsage CoTaskMemFree

RoGetActivationFactory

ProcessPrng

BCryptGenRandom

CertDuplicateCertificateContext CertEnumCertificatesInStore CertFreeCertificateContext CertGetEnhancedKeyUsage CertVerifyTimeValidity CertCloseStore CertOpenStore

CallNtPowerInformation

strcpy_s wcslen strlen strcmp wcsncmp

pow __setusermatherr floor round

_cexit _register_thread_local_exe_atexit_callback __p___argv _initialize_narrow_environment _get_initial_narrow_environment __p___argc _seh_filter_exe _initterm_e _set_app_type exit abort _configure_narrow_argv _exit _initterm _initialize_onexit_table _register_onexit_function _crt_atexit terminate _c_exit

_set_fmode __p__commode

_configthreadlocale

calloc _set_new_mode malloc free