LoadLibraryExA QueryFullProcessImageNameW GlobalFindAtomA GetPrivateProfileStringA WritePrivateProfileStringA SystemTimeToFileTime SetConsoleTextAttribute SetConsoleTitleA AddVectoredExceptionHandler HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection CreateThread CreateFileMappingW MapViewOfFile UnmapViewOfFile GetModuleFileNameA GetModuleFileNameW SetLastError FormatMessageW ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSection EnterCriticalSection LeaveCriticalSection LocalFree GetSystemDirectoryW SleepEx GetSystemInfo GetTickCount MoveFileExW GetWindowsDirectoryW GetEnvironmentVariableA GetFileType PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW GetFileSizeEx OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter WakeAllConditionVariable GetFileInformationByHandleEx AreFileApisANSI SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetCurrentDirectoryW GetLocaleInfoEx FormatMessageA GetCurrentThreadId SleepConditionVariableSRW GetTickCount64 GetSystemTime WaitForSingleObject GetLastError Beep SetFileTime GetLogicalDrives GetDriveTypeA DeleteFileW DeleteFileA GetStdHandle K32GetModuleFileNameExW K32EnumProcessModules Module32NextW Module32FirstW Thread32Next Thread32First LoadLibraryW CreateProcessA ResumeThread OpenThread GetCurrentProcessId GetCurrentProcess CreatePipe CheckRemoteDebuggerPresent IsDebuggerPresent WriteFile ReadFile GetFileAttributesW CreateFileA GetEnvironmentVariableW Process32NextW Process32FirstW CreateToolhelp32Snapshot VirtualFreeEx VirtualFree OpenProcess CreateRemoteThread GetExitCodeProcess RtlAddFunctionTable LoadLibraryA FreeLibrary QueryPerformanceFrequency QueryPerformanceCounter VerSetConditionMask WideCharToMultiByte MultiByteToWideChar DeviceIoControl CreateFileW GetProcAddress GetModuleHandleW GetModuleHandleA WriteProcessMemory ReadProcessMemory VirtualProtectEx VirtualAllocEx VirtualAlloc FlushInstructionCache SetThreadContext GetThreadContext CreateProcessW VirtualProtect TerminateProcess Sleep WaitForSingleObjectEx CloseHandle

GetWindow SetWindowsHookExW UnhookWindowsHookEx MessageBoxA MessageBoxW FindWindowExW ShowWindow GetSystemMetrics EnumWindows GetClassNameA GetWindowThreadProcessId PostThreadMessageW IsWindowVisible

RegDeleteKeyA OpenProcessToken AddAccessAllowedAce GetLengthSid GetTokenInformation InitializeAcl IsValidSid RegCreateKeyExA SetSecurityInfo CopySid ConvertSidToStringSidA CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptEncrypt CryptImportKey CryptDestroyKey SystemFunction036 CryptDestroyHash CryptHashData CryptCreateHash

ShellExecuteA ShellExecuteW

?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xbad_alloc@std@@YAXXZ ?uncaught_exceptions@std@@YAHXZ _Query_perf_counter _Query_perf_frequency ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A _Xtime_get_ticks _Thrd_detach _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ?is@?$ctype@D@std@@QEBA_NFD@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Random_device@std@@YAIXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?id@?$ctype@D@std@@2V0locale@2@A ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xinvalid_argument@std@@YAXPEBD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?_Xbad_function_call@std@@YAXXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ??0_Lockit@std@@QEAA@H@Z ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1_Lockit@std@@QEAA@XZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??7ios_base@std@@QEBA_NXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ

GetModuleInformation

RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlGetVersion RtlImageNtHeader

PathFindFileNameW

URLDownloadToFileA

CertCloseStore CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CertEnumCertificatesInStore CryptQueryObject CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertOpenStore

WSASetLastError getsockname gethostname ioctlsocket sendto recvfrom freeaddrinfo getaddrinfo listen htonl accept select __WSAFDIsSet WSAIoctl socket setsockopt getpeername getsockopt send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents closesocket WSAGetLastError inet_pton recv connect ntohs bind inet_ntop WSAStartup WSACleanup htons

UnloadUserProfile

BCryptGenRandom

memcmp memmove __current_exception_context __current_exception __C_specific_handler wcschr strrchr memset memcpy __std_terminate wcsrchr strchr memchr __std_exception_copy __std_exception_destroy _CxxThrowException strstr

__CxxFrameHandler4

_errno _get_initial_narrow_environment _initterm _initterm_e _exit terminate __p___argc __sys_errlist __sys_nerr __p___argv _c_exit _set_app_type _beginthreadex _invalid_parameter_noinfo _register_thread_local_exe_atexit_callback _resetstkoflw _seh_filter_exe _cexit system _crt_atexit _register_onexit_function exit _initialize_onexit_table abort _initialize_narrow_environment _configure_narrow_argv _invoke_watson _invalid_parameter_noinfo_noreturn

_lseeki64 ungetc __acrt_iob_func _get_stream_buffer_pointers _wopen _wfopen fseek feof fputs ftell __stdio_common_vfprintf __stdio_common_vsprintf fclose fflush fgetc fgetpos _set_fmode _popen _pclose fgets __stdio_common_vsscanf fputc __p__commode fwrite _read setvbuf _fseeki64 fsetpos _fileno _close _write fread

remove _stat64i32 _unlink _fstat64 _unlock_file _lock_file _wstat64

_wcsicmp _stricmp strncmp strlen wcslen _strdup strcpy_s tolower _wcsdup strcspn wcspbrk strspn wcsncmp strcmp strpbrk wcsncpy

free _set_new_mode _callnewh calloc malloc realloc

qsort rand

_fdopen _dsign __setusermatherr

strtoul atoi wcstombs strtoull strtoll strtod strtol

_configthreadlocale ___lc_codepage_func localeconv

_dupenv_s getenv

_time64 _gmtime64 strftime _localtime64_s _localtime64