RegCloseKey RegCreateKeyExW EventWrite EventRegister EventUnregister RegQueryValueExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegQueryInfoKeyW RegSetValueExW RegDeleteTreeW RegGetValueW OpenProcessToken GetTokenInformation RegOpenKeyExW CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash RevertToSelf EventWriteTransfer OpenThreadToken CopySid GetLengthSid GetSidSubAuthority IsValidSid AddAccessAllowedAce AddAccessDeniedAce AllocateAndInitializeSid CheckTokenMembership CreateWellKnownSid EqualSid FreeSid GetSecurityDescriptorDacl InitializeAcl InitializeSecurityDescriptor SetSecurityDescriptorDacl ConvertSidToStringSidA ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW RegNotifyChangeKeyValue LookupAccountNameW GetSidSubAuthorityCount CredWriteW StartServiceW SetServiceObjectSecurity QueryServiceStatusEx QueryServiceConfigW OpenServiceW OpenSCManagerW EnumDependentServicesW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W CreateProcessAsUserW

K32GetModuleFileNameExW FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryExW LoadResource SizeofResource FindResourceW OpenProcess GetDiskFreeSpaceExW GetComputerNameW GetSystemDirectoryW GetLogicalProcessorInformation GetNativeSystemInfo LocalFree MulDiv FormatMessageW OutputDebugStringA CreateThread GetModuleHandleA LoadLibraryW FlsGetValue FlsSetValue ReleaseSemaphore WaitForSingleObjectEx DuplicateHandle MapViewOfFile UnmapViewOfFile ReleaseMutex CreateEventW GetTickCount QueryFullProcessImageNameW WerRegisterMemoryBlock WerUnregisterMemoryBlock GetCurrentThread GetProcessAffinityMask SetThreadAffinityMask WaitForMultipleObjectsEx InterlockedPopEntrySList IsProcessorFeaturePresent CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus Sleep GetThreadIOPendingFlag RtlCaptureStackBackTrace ResetEvent IsDebuggerPresent WaitForSingleObject WaitForMultipleObjects CreateMemoryResourceNotification IsSystemResumeAutomatic GetSystemPowerStatus GetModuleHandleExW CreateMutexA CreateEventA OpenEventA OpenMutexA CreateSemaphoreA OpenSemaphoreA CreateFileMappingA OpenFileMappingA GlobalAlloc GlobalFree HeapAlloc HeapFree GetProcessHeap LocalAlloc CreateMutexW ExpandEnvironmentStringsW CreateDirectoryW VirtualAlloc VirtualFree SignalObjectAndWait SetWaitableTimerEx CancelWaitableTimer CreateWaitableTimerW QueryDepthSList TryEnterCriticalSection InitializeSListHead InterlockedPushEntrySList K32GetProcessMemoryInfo GetTempPathW GetLongPathNameW ReadFile SetEndOfFile SetFilePointerEx WriteFile GetOverlappedResult DeviceIoControl FlushFileBuffers CancelIoEx CreateFileW GetFileSizeEx GetFileType CopyFileW MoveFileExW GetTempFileNameW SetFileAttributesW SetFileInformationByHandle GetFileInformationByHandleEx RemoveDirectoryW GetDriveTypeW GetLocaleInfoEx LockResource GetShortPathNameA LocaleNameToLCID IsValidLocale GetSystemDefaultLCID GetUserDefaultLCID SystemTimeToTzSpecificLocalTime GetProductInfo GetLastError FlsAlloc FlsFree InitializeCriticalSectionEx DeleteCriticalSection GetCurrentProcess IsWow64Process GetLocalTime GetCurrentDirectoryW K32EnumProcesses GetPriorityClass GetExitCodeProcess GetThreadLocale GetTempPathA DeleteFileA GetFullPathNameW lstrcmpW FindFirstFileW ProcessIdToSessionId CompareStringEx GetModuleFileNameW MultiByteToWideChar ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared GetCurrentThreadId CloseHandle QueryPerformanceFrequency EnterCriticalSection LeaveCriticalSection SetEvent GetModuleFileNameA CreateProcessW TerminateProcess GetVersionExW RaiseException GlobalMemoryStatusEx GetStringTypeW GetCPInfoExW GetStringTypeExW FileTimeToSystemTime IsValidCodePage WideCharToMultiByte SetLastError GetTickCount64 GetFileAttributesExW QueryPerformanceCounter QueryUnbiasedInterruptTime CreateEventExW DeleteFileW FindClose FindFirstFileExW FindNextFileW GetCurrentProcessId GetSystemTimeAsFileTime LoadLibraryExA VirtualQuery GetSystemInfo LoadLibraryA OpenThread K32GetProcessImageFileNameW AllocConsole AttachConsole FreeConsole GetUserGeoID VerifyVersionInfoW VerSetConditionMask FreeEnvironmentStringsW SystemTimeToFileTime InitializeSRWLock GetExitCodeThread EncodePointer DecodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW RtlUnwind InterlockedFlushSList CreateTimerQueue SwitchToThread SetThreadPriority GetThreadPriority CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread VirtualProtect UnregisterWaitEx HeapSize GetConsoleMode ReadConsoleW GetConsoleCP HeapReAlloc GetStdHandle ExitProcess GetACP SetStdHandle WriteConsoleW EnumSystemLocalesW GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW

CoRevokeInitializeSpy CoRegisterInitializeSpy CoCreateInstance CoSetProxyBlanket CreateStreamOnHGlobal CoCreateGuid CoTaskMemFree StringFromIID CLSIDFromString StringFromGUID2 IIDFromString CoTaskMemAlloc CoInitializeEx CoUninitialize

SysFreeString SysAllocString VariantInit VariantClear

FreeAddrInfoW GetAddrInfoW WSAStartup

SetDCBrushColor GetTextExtentPoint32W GetTextMetricsW SetDCPenColor SelectObject Rectangle CreatePen CreateFontW SetTextColor SetBkColor GetStockObject CreateSolidBrush DeleteObject GetDeviceCaps

GdiplusStartup GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCreateFromHDC GdipCloneImage GdipDisposeImage GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight GdipDeleteGraphics GdipDrawImageRectRectI GdipAlloc GdipLoadImageFromStream GdipCreateBitmapFromScan0 GdipFillRectangleI GdipDrawImageRectI GdipFree

ord13 ord14 ord10

WTHelperGetProvSignerFromChain WTHelperProvDataFromStateData WinVerifyTrust

SetupIterateCabinetW

FreeMibTable CreateSortedAddressPairs