GetExitCodeProcess CallNamedPipeW GetPrivateProfileStringW GetUserDefaultUILanguage CopyFileW GetTimeFormatW GetDateFormatW SystemTimeToFileTime FileTimeToLocalFileTime TerminateThread GetPhysicallyInstalledSystemMemory GlobalFree WaitForMultipleObjects GetComputerNameW SetErrorMode GetVolumeInformationW GetLogicalDrives FileTimeToSystemTime IsWow64Process ReadProcessMemory CheckRemoteDebuggerPresent WriteFile FindResourceW SizeofResource LockResource WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW SetEnvironmentVariableW HeapQueryInformation HeapSize EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LCMapStringW SetStdHandle GetConsoleOutputCP ReadConsoleW GetModuleHandleExW FreeLibraryAndExitThread ExitThread TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwind CompareStringEx GetLocaleInfoEx LCMapStringEx EncodePointer SleepConditionVariableCS AcquireSRWLockShared GetStringTypeW FindFirstFileExW FormatMessageA LoadResource GetLocaleInfoW GetModuleHandleA VirtualFree ProcessIdToSessionId DeleteCriticalSection GetStartupInfoW InitializeSListHead InitializeCriticalSectionAndSpinCount IsProcessorFeaturePresent UnhandledExceptionFilter CreateNamedPipeA SetFileCompletionNotificationModes PostQueuedCompletionStatus GetQueuedCompletionStatusEx SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable InitOnceExecuteOnce InitializeSRWLock IsDebuggerPresent GetProcessAffinityMask GetExitCodeThread CancelIo VerifyVersionInfoA GetConsoleMode GetStdHandle SetFileTime SetThreadExecutionState FoldStringW TzSpecificLocalTimeToSystemTime IsDBCSLeadByte GetCPInfo CompareStringW GetVersionExW FormatMessageW GetComputerNameExA VerLanguageNameW GetFileType LeaveCriticalSection EnterCriticalSection InitializeCriticalSection SetUnhandledExceptionFilter GetFileAttributesW CreateFileW GetCommandLineA LocalFileTimeToFileTime GetCurrentThreadId GetDiskFreeSpaceExW IsValidCodePage GetACP PeekNamedPipe GetFullPathNameW GetOEMCP AreFileApisANSI GetModuleFileNameA SystemTimeToTzSpecificLocalTime GetTimeZoneInformation GetVolumePathNameW GetDiskFreeSpaceW InitializeCriticalSectionEx DecodePointer OpenThread CreateToolhelp32Snapshot Thread32First Thread32Next ReadDirectoryChangesW GetOverlappedResult CancelIoEx K32GetModuleInformation K32GetProcessMemoryInfo OutputDebugStringW GetEnvironmentVariableA K32EnumProcessModules GetProcessIoCounters GetFileInformationByHandleEx GetShortPathNameW SetLastError CreateDirectoryA CreateFileA GetFileAttributesA GetTempPathA GetFileAttributesExW CreateHardLinkW GetEnvironmentVariableW FindNextVolumeW FindVolumeClose FindNextVolumeMountPointW GetLogicalDriveStringsW GetSystemTimeAsFileTime MultiByteToWideChar GetTickCount ResetEvent GetSystemDefaultUILanguage SleepEx RemoveDirectoryW GetDriveTypeW GetTempPathW CreateDirectoryW MoveFileA GetModuleHandleW OpenProcess TerminateProcess GetCurrentProcessId GetCurrentProcess OpenEventW CreateEventW ReleaseMutex DuplicateHandle DeleteFileW DeleteFileA GetCommandLineW ExitProcess CreateMutexW GetLastError SetEvent GlobalAlloc GetTickCount64 GetVolumeNameForVolumeMountPointW GetLongPathNameW FindVolumeMountPointClose FindFirstVolumeW SearchPathW FindFirstVolumeMountPointW VirtualQueryEx CopyFileExW VirtualProtectEx CreateIoCompletionPort GetQueuedCompletionStatus VirtualAllocEx WriteProcessMemory GetSystemTimePreciseAsFileTime QueryPerformanceFrequency TryEnterCriticalSection WaitForSingleObject CloseHandle Sleep GetLocalTime OutputDebugStringA ReleaseSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockExclusive TryAcquireSRWLockShared GetVolumePathNamesForVolumeNameW GetFinalPathNameByHandleW QueryDosDeviceW WritePrivateProfileStringA LoadLibraryExW CreateSemaphoreA ReleaseSemaphore ConnectNamedPipe DisconnectNamedPipe GetNamedPipeClientProcessId CreateNamedPipeW QueueUserAPC WaitForSingleObjectEx GetCurrentThread GlobalLock GlobalUnlock HeapFree HeapReAlloc HeapAlloc GetProcessHeap DeviceIoControl GetSystemPowerStatus LocalAlloc GetSystemInfo LocalFree CreateProcessW QueryFullProcessImageNameW GetSystemTime QueryPerformanceCounter MoveFileExA LoadLibraryA SwitchToThread GetProcAddress FreeLibrary GetProductInfo GetNativeSystemInfo VerifyVersionInfoW ReadFile FindFirstFileW GetFileSizeEx SetHandleInformation Wow64DisableWow64FsRedirection FindClose UnmapViewOfFile SetFileAttributesW GetFileInformationByHandle Wow64RevertWow64FsRedirection SetFileAttributesA SetFilePointerEx CreateFileMappingA MoveFileExW GetFileSize MapViewOfFile MoveFileW GetFileTime FlushFileBuffers MulDiv RaiseException WideCharToMultiByte LoadLibraryW GetCurrentDirectoryW SetCurrentDirectoryW GetModuleFileNameW WTSGetActiveConsoleSessionId InitializeProcThreadAttributeList K32GetModuleFileNameExW K32GetProcessImageFileNameW UpdateProcThreadAttribute DeleteProcThreadAttributeList K32EnumProcesses GetProcessTimes CreateEventA GetSystemWow64DirectoryW GetVersionExA GetComputerNameExW SetFilePointer SetEndOfFile CreateSemaphoreW ExpandEnvironmentStringsW CreateFileMappingW SetInformationJobObject AssignProcessToJobObject CreateJobObjectW ResumeThread FindNextFileW SetThreadPriority GetSystemDirectoryW GetSystemDirectoryA GetWindowsDirectoryW GetSystemTimes GlobalMemoryStatusEx FindResourceA CreateThread

DefWindowProcW PostQuitMessage TranslateMessage GetMessageW SetForegroundWindow TrackPopupMenu AppendMenuW EnableMenuItem DestroyMenu CreatePopupMenu RegisterClassExW CreateWindowExW DestroyWindow GetWindowLongW SetWindowLongW GetDesktopWindow FindWindowW GetWindowThreadProcessId InvalidateRect IsIconic EnableWindow CheckMenuItem GetWindowRect SetWindowPos SetWindowRgn GetClientRect SetTimer LoadImageW LoadImageA PostMessageW IsWindow SwitchToThisWindow GetWindowTextW GetKeyboardLayout GetAsyncKeyState keybd_event GetForegroundWindow GetAncestor MessageBeep MessageBoxW PtInRect GetWindowDC ReleaseDC GetGuiResources EnumDisplayDevicesW IsWindowVisible GetDC EnumWindows wsprintfW LockWorkStation PostThreadMessageW GetMessageExtraInfo SetMessageExtraInfo SetWinEventHook UnhookWinEvent GetWindowTextA ChangeWindowMessageFilter RegisterWindowMessageA GetSystemMetrics UpdateWindow EmptyClipboard SetClipboardData CloseClipboard OpenClipboard DispatchMessageW CharToOemBuffW OemToCharA OemToCharBuffA CharLowerW CharUpperW CharToOemA MsgWaitForMultipleObjectsEx CloseDesktop CreateDesktopW MapVirtualKeyExW SetWindowsHookExW GetGUIThreadInfo SendInput GetMessagePos GetFocus MapWindowPoints CallNextHookEx KillTimer ShowWindow SetFocus SendMessageW SetWindowTextA ScreenToClient GetCursorPos DestroyIcon UnregisterClassW WaitForInputIdle UnhookWindowsHookEx FindWindowExA OffsetRect RegisterClassW SystemParametersInfoW FindWindowExW EqualRect MonitorFromRect GetShellWindow GetMonitorInfoW ExitWindowsEx InflateRect SetWindowTextW GetClassNameA DrawTextA ClientToScreen AttachThreadInput MoveWindow EndPaint BeginPaint FillRect DrawTextW DrawIcon DrawFrameControl FindWindowA SetRect SetCursor LoadCursorW SetLayeredWindowAttributes

CreateCompatibleDC SelectObject SetTextColor BitBlt DeleteDC CreateDIBSection GetDeviceCaps GetPixel CreateSolidBrush CreatePen SetWorldTransform SetDCPenColor RoundRect SetStretchBltMode SetDCBrushColor DeleteObject StretchBlt SetGraphicsMode PatBlt SetPixel IntersectClipRect ExtTextOutW SetBkColor ExcludeClipRect SelectClipRgn MoveToEx LineTo CreateFontA GetObjectW SetBrushOrgEx CombineRgn CreateRoundRectRgn CreateCompatibleBitmap GetStockObject SetBkMode CreateRectRgn Rectangle

EnumPrintersW

GetSidSubAuthorityCount GetLengthSid SetThreadToken OpenProcessToken ConvertStringSidToSidW SetTokenInformation RegQueryValueExW QueryServiceStatusEx OpenServiceW OpenSCManagerW CloseServiceHandle RegGetValueW RegOpenKeyExW GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle UnregisterTraceGuids RegisterTraceGuidsW RegSetValueExW RegCreateKeyExW RegCloseKey GetUserNameW StartServiceCtrlDispatcherW SetServiceStatus TraceMessage GetTokenInformation AddMandatoryAce SetSecurityInfo InitializeAcl CheckTokenMembership FreeSid CreateWellKnownSid OpenSCManagerA AllocateAndInitializeSid ImpersonateLoggedOnUser RevertToSelf RegFlushKey RegEnumValueW RegDeleteValueW RegOpenKeyExA RegSetKeySecurity RegEnumKeyExW RegQueryInfoKeyW RegDeleteKeyExW RegNotifyChangeKeyValue InitializeSecurityDescriptor SetSecurityDescriptorDacl RegisterServiceCtrlHandlerExW StartServiceW EnumDependentServicesW ControlService DeleteService ChangeServiceConfig2W QueryServiceStatus CreateServiceW AdjustTokenPrivileges LookupPrivilegeValueW GetUserNameA CreateProcessAsUserW InitiateSystemShutdownExW SaferComputeTokenFromLevel SaferCreateLevel SaferCloseLevel ConvertSidToStringSidW QueryServiceConfig2A SetEntriesInAclW RegOpenKeyW SetNamedSecurityInfoW GetFileSecurityW BuildExplicitAccessWithNameW GetAce GetAclInformation GetSecurityDescriptorDacl LookupAccountSidW RegDeleteKeyW LookupAccountNameW IsValidSid LookupAccountNameA CryptImportKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptDestroyKey SetFileSecurityW CryptAcquireContextW CryptReleaseContext RegSaveKeyExW QueryServiceConfigW CreateRestrictedToken DuplicateTokenEx GetSidSubAuthority RegSaveKeyW RegRestoreKeyW

SHBrowseForFolderW ShellExecuteExW SHLoadNonloadedIconOverlayIdentifiers DragFinish SHEmptyRecycleBinA CommandLineToArgvW Shell_NotifyIconW SHGetPathFromIDListW SHGetFolderPathW DragQueryFileW

GetAdaptersInfo GetNetworkParams GetExtendedUdpTable GetExtendedTcpTable SetTcpEntry

CoInitializeEx CoUninitialize CoSetProxyBlanket CoCreateInstance CreateStreamOnHGlobal CoInitializeSecurity CoCreateGuid CoTaskMemFree

SysAllocString SysFreeString VariantTimeToSystemTime VariantClear

GetUserNameExW DecryptMessage InitializeSecurityContextA EncryptMessage FreeContextBuffer QueryContextAttributesA ApplyControlToken DeleteSecurityContext AcceptSecurityContext GetComputerObjectNameW AcquireCredentialsHandleA

inet_pton WSARecv shutdown ioctlsocket sendto inet_ntop FreeAddrInfoW getaddrinfo WSAAddressToStringA gethostname GetAddrInfoW freeaddrinfo WSCSetApplicationCategory WSCGetApplicationCategory closesocket gethostbyname inet_addr send socket connect htons WSAAddressToStringW WSACleanup WSAStartup recvfrom listen htonl accept select __WSAFDIsSet WSAIoctl WSASetLastError setsockopt ntohs getsockopt getsockname getpeername bind recv WSAGetLastError WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACloseEvent WSACreateEvent

BCryptHashData BCryptCreateHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptGenRandom NCryptOpenStorageProvider BCryptVerifySignature NCryptImportKey BCryptSignHash BCryptDestroyKey BCryptOpenAlgorithmProvider NCryptFreeObject BCryptImportKeyPair BCryptExportKey BCryptDestroyHash BCryptGetProperty

ord410 ord412 ImageList_Create ord413 ImageList_Destroy

MiniDumpWriteDump

VerSetConditionMask NtDeleteKey NtSetInformationProcess RtlGetVersion NtRemoveProcessDebug NtQueryInformationProcess RtlCaptureStackBackTrace NtQueryObject RtlDecompressBufferEx NtQueryInformationThread NtQuerySystemInformation NtReadFile NtWriteFile NtQueryInformationFile NtOpenFile NtSetInformationFile NtQuerySymbolicLinkObject NtOpenSymbolicLinkObject NtWriteVirtualMemory NtClose NtAllocateVirtualMemory NtOpenProcess NtFreeVirtualMemory NtCreateThreadEx NtCreateFile NtShutdownSystem NtFsControlFile RtlCompressBuffer RtlDecompressBuffer RtlGetCompressionWorkSpaceSize NtProtectVirtualMemory

CM_Locate_DevNode_ExW CM_Get_Sibling_Ex CM_Get_DevNode_Status_Ex CM_Disconnect_Machine CM_Get_DevNode_Registry_Property_ExW CM_Get_Child_Ex CM_Connect_MachineW

DirectDrawCreateEx

InternetQueryOptionW

NetUserEnum NetQueryDisplayInformation NetShareEnum NetApiBufferFree NetWkstaGetInfo

EvtNext EvtQuery EvtClose EvtCreateRenderContext EvtRender

PathFileExistsA ord437 PathRemoveArgsW PathFileExistsW SHAutoComplete PathUnquoteSpacesW

WTSQuerySessionInformationW WTSFreeMemory WTSQueryUserToken WTSQuerySessionInformationA WTSEnumerateSessionsW

ExpandEnvironmentStringsForUserW DestroyEnvironmentBlock CreateEnvironmentBlock

WinHttpQueryOption WinHttpSetTimeouts WinHttpSetCredentials WinHttpCrackUrl WinHttpGetProxyForUrl WinHttpAddRequestHeaders WinHttpQueryHeaders WinHttpConnect WinHttpSendRequest WinHttpOpen WinHttpReceiveResponse WinHttpReadData WinHttpGetIEProxyConfigForCurrentUser WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest

CertVerifyCertificateChainPolicy CertFreeCertificateChain CertGetCertificateChain CertGetEnhancedKeyUsage CertGetCertificateContextProperty CertOpenStore CertGetNameStringW CryptMsgUpdate CertFindCertificateInStore CryptMsgGetParam CertCloseStore CryptMsgOpenToDecode CryptHashCertificate2 CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertEnumCertificatesInStore CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertSetCertificateContextProperty CertAddCertificateContextToStore CryptStringToBinaryA CertFindExtension CryptHashToBeSigned CertCreateCertificateContext CryptQueryObject CertFreeCertificateContext CryptMsgClose

CryptCATAdminAcquireContext CryptCATCatalogInfoFromContext CryptCATAdminReleaseContext WinVerifyTrust CryptCATAdminEnumCatalogFromHash CryptCATAdminCalcHashFromFileHandle CryptCATAdminReleaseCatalogContext

ord160 ord91 ord8 ord158 ord32 ord159 ord117

FilterGetMessage FilterReplyMessage FilterConnectCommunicationPort

FwpmSubLayerDeleteByKey0 FwpmEngineOpen0 FwpmFilterDeleteByKey0 FwpmCalloutDeleteByKey0 FwpmTransactionAbort0 FwpmCalloutAdd0 FwpmFilterAdd0 FwpmEngineClose0 FwpmTransactionCommit0 FwpmTransactionBegin0 FwpmSubLayerAdd0

PowerRegisterSuspendResumeNotification GetPwrCapabilities PowerSettingUnregisterNotification PowerUnregisterSuspendResumeNotification PowerSettingRegisterNotification

GetOpenFileNameW GetSaveFileNameW

GetFileVersionInfoW GetFileVersionInfoSizeA VerQueryValueA GetFileVersionInfoSizeW GetFileVersionInfoA VerQueryValueW

GdiplusShutdown GdipGetImageHeight GdipGetImageWidth GdipDrawImageRect GdipDisposeImage GdiplusStartup GdipDeleteGraphics GdipCreateFromHDC GdipLoadImageFromStream

AlphaBlend TransparentBlt