WriteConsoleW LocalFree LoadLibraryA GetLastError RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedFlushSList SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW HeapFree HeapAlloc GetStdHandle GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW GetProcessHeap GetStringTypeW SetFilePointerEx SetStdHandle HeapSize HeapReAlloc FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode CloseHandle CreateFileW

EqualSid

AuthzInitializeContextFromSid AuthzFreeResourceManager AuthzInitializeResourceManager AuthzFreeContext AuthzAccessCheck

PathFileExistsW PathRemoveFileSpecW PathIsUNCW PathUnquoteSpacesW PathAppendW

VerQueryValueA GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW GetFileVersionInfoA GetFileVersionInfoSizeA

ord173 ord217

WNetGetConnectionW

DestroyEnvironmentBlock CreateEnvironmentBlock

WTSEnumerateSessionsW WTSQueryUserToken WTSQuerySessionInformationW WTSFreeMemory

LsaFreeReturnBuffer LsaEnumerateLogonSessions LsaGetLogonSessionData

gethostname WSAStartup WSACleanup accept bind closesocket connect ioctlsocket ntohs ntohl htons htonl FreeAddrInfoW GetAddrInfoW WSAWaitForMultipleEvents WSASocketW WSASetEvent WSASend WSAResetEvent WSAEventSelect WSACreateEvent WSACloseEvent WSAGetLastError WSASetLastError shutdown setsockopt send recv listen

getsockname getsockopt select gethostbyname ioctlsocket inet_addr gethostbyaddr getpeername recvfrom sendto getservbyname getservbyport socket

CertEnumCertificatesInStore CertOpenSystemStoreW CryptQueryObject CertFreeCertificateContext CertDuplicateCertificateContext CertOpenStore CertGetCertificateContextProperty CertFindCertificateInStore CertCloseStore CryptMsgClose

RtlPcToFileHeader RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx VerSetConditionMask RtlVirtualUnwind RtlUnwind

SetFileInformationByHandle GetStringTypeW GetNativeSystemInfo WakeAllConditionVariable GetLocaleInfoEx QueryPerformanceCounter QueryPerformanceFrequency TryAcquireSRWLockExclusive TryAcquireSRWLockShared SleepConditionVariableSRW GetTickCount64 FindFirstFileExW CopyFileW CreateHardLinkW GetFileInformationByHandleEx GetLastError FormatMessageA FormatMessageW WideCharToMultiByte LocalFree DecodePointer HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection GetModuleFileNameW GetProcAddress LoadLibraryExW FreeLibrary SetDllDirectoryW ExpandEnvironmentStringsW CloseHandle WaitForSingleObject MultiByteToWideChar AreFileApisANSI TerminateProcess GetExitCodeProcess CreateProcessA GetSystemDirectoryW FindResourceExW LoadResource LockResource SizeofResource FindResourceW ReleaseMutex CreateMutexA OpenProcess OpenMutexA CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentProcess GetModuleHandleW GlobalAlloc GlobalFree Sleep GetCurrentThreadId LocalAlloc GetSystemInfo CreateFileW GetFileAttributesExW GetFileSize ReadFile MoveFileExW GetDiskFreeSpaceExW GetDriveTypeW GetLogicalDriveStringsW GetVolumeInformationW QueryDosDeviceW GetVolumeNameForVolumeMountPointW LoadLibraryW GetEnvironmentStringsW FreeEnvironmentStringsW WriteFile SetHandleInformation CreatePipe CreateProcessW GetFileAttributesW GetFullPathNameW GetCurrentProcessId ProcessIdToSessionId GetWindowsDirectoryW CreateFileMappingW MapViewOfFile CreateSymbolicLinkW AddDllDirectory lstrcpyW QueryFullProcessImageNameW WTSGetActiveConsoleSessionId Module32FirstW Module32NextW K32EnumProcessModules K32GetModuleFileNameExW GetTempPathW RaiseException SetUnhandledExceptionFilter SetErrorMode GetProcessTimes GetSystemTime WriteProcessMemory SystemTimeToFileTime LocaleNameToLCID GetSystemDefaultLocaleName CreateMutexW OpenMutexW GetFileInformationByHandle GetEnvironmentVariableW SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW DeleteFileW FlushFileBuffers GetFinalPathNameByHandleW GetFileTime RemoveDirectoryW SetEndOfFile SetFileAttributesW SetFilePointerEx SetFileTime DeviceIoControl CreateDirectoryExW CopyFileExW CreateEventA SetEvent WaitForSingleObjectEx GetLocaleInfoA EnumSystemLocalesA IsValidCodePage FoldStringW LCMapStringW CompareStringW GetDateFormatW GetTimeFormatW GetLocaleInfoW GetCurrencyFormatW IsDBCSLeadByteEx GetStdHandle IsDebuggerPresent OutputDebugStringA OutputDebugStringW AddVectoredExceptionHandler RemoveVectoredExceptionHandler SetThreadStackGuarantee GetConsoleScreenBufferInfo SetConsoleTextAttribute VerifyVersionInfoW SwitchToThread LockFileEx UnlockFile GetFileType AllocConsole GetConsoleMode WriteConsoleW CreateFileA ConnectNamedPipe DisconnectNamedPipe GetOverlappedResult CancelIo CreateEventW CreateNamedPipeA WaitNamedPipeA UnlockFileEx PeekNamedPipe SetLastError InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemDirectoryA LoadLibraryA VirtualAlloc VirtualProtect VirtualFree VirtualLock InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection ReleaseSemaphore GetExitCodeThread CreateSemaphoreA GetModuleHandleExW GetACP GetSystemTimeAsFileTime SwitchToFiber DeleteFiber CreateFiberEx ConvertFiberToThread ConvertThreadToFiberEx SetConsoleMode ReadConsoleA ReadConsoleW FindClose FindFirstFileW FindNextFileW EncodePointer InitOnceExecuteOnce CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber FreeLibraryWhenCallbackReturns CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait LCMapStringEx CompareStringEx GetCPInfo InitializeSListHead UnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW InterlockedPushEntrySList InterlockedFlushSList InitializeCriticalSectionAndSpinCount CreateThread ExitThread ResumeThread FreeLibraryAndExitThread SetConsoleCtrlHandler DuplicateHandle GetConsoleOutputCP SetStdHandle SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitProcess GetCommandLineA GetCommandLineW GetCurrentThread FlsAlloc FlsGetValue FlsSetValue FlsFree IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileSizeEx GetTimeZoneInformation SetEnvironmentVariableW GetOEMCP WakeConditionVariable UnmapViewOfFile

CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW PostThreadMessageW DispatchMessageW GetMessageW CallNextHookEx GetWindowLongW SetWindowsHookExW PostMessageW SendMessageW MessageBoxW GetDesktopWindow UnregisterClassW GetWindowThreadProcessId GetProcessWindowStation SetWindowLongW GetUserObjectInformationW EnumWindows ExitWindowsEx UnhookWindowsHookEx GetShellWindow LoadIconW

SHGetSpecialFolderLocation SHCreateDirectoryExW ShellExecuteExW ord51 SHGetKnownFolderPath SHGetFileInfoW SHBindToParent SHBrowseForFolderW CommandLineToArgvW SHGetPathFromIDListW SHGetMalloc

CoTaskMemFree CoUninitialize CoCreateInstance CoInitialize CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoTaskMemAlloc

SetErrorInfo SysFreeString VariantInit VariantClear GetErrorInfo CreateErrorInfo SysAllocString VariantChangeType

OpenProcessToken CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash AllocateAndInitializeSid EqualSid FreeSid GetTokenInformation RegCloseKey RegCreateKeyExW RegOpenKeyExW RegSetValueExW RegGetValueW LookupAccountNameW CreateWellKnownSid SetEntriesInAclW GetNamedSecurityInfoW SetNamedSecurityInfoW RegDeleteKeyExW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegQueryInfoKeyW RegQueryValueExW RegRenameKey RegDeleteTreeW CreateProcessAsUserW AdjustTokenPrivileges CheckTokenMembership DuplicateTokenEx ImpersonateLoggedOnUser RevertToSelf LookupAccountSidW LookupPrivilegeValueW CreateProcessWithTokenW ConvertSidToStringSidW GetUserNameW RegCreateKeyExA RegOpenKeyExA RegQueryValueExA RegSetValueExA CopySid GetLengthSid DeregisterEventSource RegisterEventSourceW ReportEventW InitializeSecurityDescriptor SetSecurityDescriptorDacl CryptAcquireContextW CryptReleaseContext CryptGenRandom CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptDecrypt CryptGetUserKey CryptExportKey

ord345

WinVerifyTrust

BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptGenRandom