SHGetValueW SHDeleteKeyW PathAddBackslashW SHDeleteValueW SHSetValueW PathAppendW StrStrIW SHGetValueA

FindClose lstrcpyW FindNextFileW GetFileSize WriteFile ReadFile FileTimeToSystemTime GetTempPathW SetFileAttributesW GetFileAttributesExW DeleteFileW CopyFileW MoveFileExW GetCurrentProcessId GetLogicalDriveStringsW GetEnvironmentVariableW GetDriveTypeW RemoveDirectoryW CreateFileA WTSGetActiveConsoleSessionId GlobalAlloc GlobalFree LocalAlloc LocalFree OpenProcess TerminateProcess GetExitCodeProcess WaitForSingleObject CreateProcessW CreateToolhelp32Snapshot Process32FirstW Process32NextW VirtualAlloc VirtualFree GetCurrentThreadId lstrcmpiW MultiByteToWideChar GetModuleHandleW QueryDosDeviceW GetTickCount GetSystemInfo FormatMessageW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW GetLongPathNameW GetTimeZoneInformation FlushFileBuffers SetStdHandle GetFullPathNameW GetCurrentDirectoryW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetConsoleCP GetACP DeleteCriticalSection InitializeCriticalSectionAndSpinCount RaiseException GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc DecodePointer DeleteFileA Sleep LeaveCriticalSection EnterCriticalSection FindFirstFileW CreateDirectoryW CreateThread WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW GetModuleFileNameW lstrlenW GetVolumeInformationW GetSystemDirectoryW CreateMutexW ReleaseMutex LoadLibraryW GetProcAddress FreeLibrary GetVersionExW SetPriorityClass CreateFileW OutputDebugStringA CloseHandle SetConsoleCtrlHandler ExitProcess SetFilePointerEx ExitThread SystemTimeToTzSpecificLocalTime RtlUnwind WideCharToMultiByte DeviceIoControl GetLastError GetCurrentProcess SetEnvironmentVariableA WriteConsoleW SetEndOfFile GetFileType WaitForMultipleObjects SleepEx InitializeCriticalSection FormatMessageA LoadLibraryExW FreeLibraryAndExitThread GetThreadTimes FindNextFileA FindFirstFileA FindResourceW SizeofResource LoadResource LockResource GetSystemWindowsDirectoryW OutputDebugStringW InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter ResetEvent SetEvent SystemTimeToFileTime GetSystemTime ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode ConvertThreadToFiber ConvertFiberToThread CreateFiber DeleteFiber SwitchToFiber GetModuleHandleExW VerifyVersionInfoA GetSystemDirectoryA GetModuleHandleA LoadLibraryA VerSetConditionMask ExpandEnvironmentStringsA PeekNamedPipe WaitForSingleObjectEx GetCurrentThread QueryPerformanceCounter QueryPerformanceFrequency EncodePointer SetLastError CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo GetStdHandle

LoadStringW wsprintfW GetProcessWindowStation GetUserObjectInformationW MessageBoxW

OpenProcessToken ReportEventW RegisterEventSourceW DeregisterEventSource CryptGenRandom CryptReleaseContext CryptAcquireContextW RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW RevertToSelf ImpersonateLoggedOnUser RegEnumKeyW RegDeleteKeyExW StartServiceW QueryServiceStatus OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle RegDeleteValueW RegDeleteKeyW RegCreateKeyExA DuplicateTokenEx LookupAccountSidW SetSecurityDescriptorDacl InitializeSecurityDescriptor GetTokenInformation RegOpenKeyW RegCloseKey

SHGetFolderPathW SHChangeNotify SHGetSpecialFolderPathA SHGetSpecialFolderPathW

CoCreateInstance CoUninitialize CoInitialize

CertCloseStore CertFindCertificateInStore CertFreeCertificateContext CertGetNameStringW CryptQueryObject CryptMsgGetParam CryptMsgClose

GetModuleFileNameExW EnumProcessModules GetProcessImageFileNameW

ord143 ord22 ord46 ord211 ord41 ord50 ord60 ord26 ord27 ord32 ord33 ord35 ord79 ord30 ord200 ord301

WSAStartup WSACleanup WSAGetLastError __WSAFDIsSet select WSASetLastError recv bind closesocket connect getpeername getsockname getsockopt htons ntohs setsockopt socket WSAIoctl getaddrinfo freeaddrinfo recvfrom sendto accept listen ioctlsocket gethostname send

WTSQueryUserToken