EnterCriticalSection LeaveCriticalSection QueryPerformanceFrequency GetSystemDirectoryW FreeLibrary SleepEx QueryPerformanceCounter WideCharToMultiByte MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects VerSetConditionMask VerifyVersionInfoW GetFileSizeEx SetThreadPriority GetThreadPriority IsDebuggerPresent GlobalGetAtomNameA GetBinaryTypeW GetWriteWatch ResetWriteWatch GetThreadContext HeapQueryInformation ReadProcessMemory RtlCaptureContext RaiseException SetThreadContext RemoveVectoredExceptionHandler K32GetModuleInformation GetLocalTime SystemTimeToFileTime CheckRemoteDebuggerPresent GetSystemFirmwareTable VirtualProtect DuplicateHandle DebugBreak K32GetProcessImageFileNameW LoadLibraryExA CreateMutexA GetModuleHandleExA WriteProcessMemory Thread32Next Thread32First SuspendThread ResumeThread OpenThread InitializeSListHead IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry SleepConditionVariableSRW WakeAllConditionVariable GetFileInformationByHandleEx AcquireSRWLockExclusive CreateThread DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy AddVectoredExceptionHandler GetModuleFileNameW GetCurrentProcessId GetModuleHandleA GetCurrentThreadId VirtualAlloc DeviceIoControl VirtualFree GetExitCodeProcess SetUnhandledExceptionFilter VirtualQuery GetTickCount K32EnumProcessModules GetSystemTimeAsFileTime GetModuleHandleW CreateProcessW GetFileSize LocalFree GetProcAddress GetWindowsDirectoryW LoadLibraryW GetSystemInfo CloseHandle Process32FirstW DeleteFileW Process32NextW GetLastError GetTickCount64 Sleep MultiByteToWideChar CreateToolhelp32Snapshot OpenProcess SetComputerNameExW CreateFileW WaitForSingleObject AreFileApisANSI SetFileInformationByHandle GetFileAttributesExW FindFirstFileExW GetCurrentDirectoryW GetLocaleInfoEx FormatMessageA InitializeCriticalSection ReleaseSRWLockExclusive FormatMessageW SetLastError QueryFullProcessImageNameW GetModuleFileNameA UnmapViewOfFile MapViewOfFile CreateFileMappingW FindClose GetTempPathW GetEnvironmentVariableW SetFilePointer K32GetModuleFileNameExW TerminateProcess WriteFile GetCurrentProcess FindNextFileW SetConsoleTitleA FindFirstFileW GetLogicalDrives ReadFile EnumSystemFirmwareTables CreateDirectoryW OutputDebugStringW

wsprintfW FindWindowA GetForegroundWindow GetWindowTextA EnumWindows MessageBoxA CloseWindow

IsValidSid RegQueryValueExW QueryServiceStatusEx GetLengthSid OpenServiceW RegDeleteValueW RegOpenKeyExW StartServiceW OpenProcessToken RegSetValueExW RegDeleteTreeW RegEnumKeyExW ControlService CopySid CryptEncrypt CryptImportKey CryptDestroyKey SystemFunction036 CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW ConvertSidToStringSidA SetSecurityInfo RegDeleteKeyA RegCreateKeyExA GetTokenInformation InitializeAcl AddAccessAllowedAce RegSetKeyValueW RegOpenKeyW RegCreateKeyExW RegCopyTreeW RegCreateKeyW LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey CloseServiceHandle OpenSCManagerW

ShellExecuteA SHGetFolderPathW

?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z ?_Xinvalid_argument@std@@YAXPEBD@Z _Xtime_get_ticks _Query_perf_counter _Query_perf_frequency _Thrd_detach ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?_Xbad_function_call@std@@YAXXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?id@?$ctype@_W@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?wcerr@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Random_device@std@@YAIXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z _Thrd_sleep

NtLoadDriver NtQuerySystemInformation RtlInitUnicodeString RtlAdjustPrivilege NtUnloadDriver

PathFindFileNameW SHDeleteValueW StrStrIW StrStrW SHDeleteKeyW

URLDownloadToFileW

CM_Locate_DevNodeW SetupDiSetClassInstallParamsW CM_Reenumerate_DevNode CM_Get_Device_IDW SetupDiGetClassDevsW CM_Get_Parent SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInfo SetupDiCreateDeviceInfoList SetupDiGetDeviceInstanceIdW SetupDiOpenDeviceInfoW SetupDiDestroyDeviceInfoList CM_Get_DevNode_Status SetupDiOpenDevRegKey SetupDiCallClassInstaller

NCryptFreeObject BCryptGenRandom NCryptOpenKey NCryptDeleteKey NCryptOpenStorageProvider

CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertOpenStore CertCloseStore

WSAEnumNetworkEvents WSAEventSelect WSACreateEvent WSAResetEvent WSAWaitForMultipleEvents gethostname ioctlsocket sendto recvfrom WSACloseEvent getaddrinfo listen htonl accept select closesocket __WSAFDIsSet WSAIoctl socket setsockopt recv freeaddrinfo send htons getsockname getpeername connect bind WSACleanup WSAStartup inet_ntop WSASetLastError ntohs inet_pton WSAGetLastError getsockopt

GetModuleInformation

UnloadUserProfile

__CxxFrameHandler4

__current_exception_context strchr memset memmove memcpy memcmp __C_specific_handler _CxxThrowException __std_terminate wcsstr __std_exception_copy __std_exception_destroy wcschr memchr __current_exception strstr strrchr

_c_exit __p___argv _errno __p___argc __sys_errlist __sys_nerr _invalid_parameter_noinfo_noreturn _exit _initterm_e abort _invalid_parameter_noinfo _initterm _resetstkoflw _get_initial_narrow_environment exit _invoke_watson _set_app_type _seh_filter_exe _cexit _crt_atexit terminate _register_onexit_function _initialize_onexit_table system _initialize_narrow_environment _configure_narrow_argv _register_thread_local_exe_atexit_callback _beginthreadex

_lseeki64 _close __stdio_common_vfprintf fclose fflush __stdio_common_vfwprintf _wfopen _wopen __stdio_common_vsscanf __stdio_common_vsnwprintf_s fwrite ftell fseek feof __stdio_common_vsprintf fputs fgetpos setvbuf ungetc _fseeki64 _get_stream_buffer_pointers _set_fmode fsetpos fgets _pclose fgetc __acrt_iob_func fputc __p__commode _fileno _read _write _popen fread

malloc calloc _set_new_mode _callnewh realloc free

qsort srand rand

strpbrk wcsncpy _strdup towlower strcmp _wcsicmp strspn wcspbrk strncmp strcspn tolower _wcsdup wcsncmp iswxdigit _stricmp

_unlock_file _unlink _fstat64 _lock_file _wstat64 _wremove

getenv _wdupenv_s

strftime _localtime64 _gmtime64 _time64

__setusermatherr _dclass _fdopen _dsign

wcstombs strtod strtol strtoll strtoull atoi strtoul

_configthreadlocale localeconv ___lc_codepage_func