ImageList_Create ImageList_Destroy ord413 ord410 ord412 ord411 InitCommonControlsEx ImageList_Draw ImageList_GetImageCount ImageList_ReplaceIcon

ShellExecuteW ShellExecuteExW SHGetKnownFolderPath SHGetFileInfoW SHGetFolderPathW

AllocateAndInitializeSid FreeSid CheckTokenMembership CryptAcquireContextW CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptReleaseContext SetNamedSecurityInfoW GetSidSubAuthorityCount GetSidSubAuthority LookupPrivilegeDisplayNameW RegGetKeySecurity GetAce RegCopyTreeW RegQueryValueExW RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegCloseKey QueryServiceStatusEx OpenServiceW ChangeServiceConfigW StartServiceW ControlService OpenSCManagerW CloseServiceHandle CreateServiceW GetTokenInformation DuplicateTokenEx CreateProcessAsUserW OpenProcessToken ImpersonateLoggedOnUser CreateWellKnownSid SetTokenInformation EqualSid RevertToSelf AdjustTokenPrivileges LookupPrivilegeValueW LookupPrivilegeNameW LookupAccountSidW RegGetValueW EnableTraceEx2 OpenTraceW ControlTraceW CloseTrace ProcessTrace StartTraceW QueryServiceConfig2W QueryServiceConfigW EnumServicesStatusExW EnumDependentServicesW DeleteService ChangeServiceConfig2W RegEnumValueW RegEnumKeyExW RegQueryInfoKeyW RegDeleteValueW RegDeleteTreeW ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityInfo RegSetKeySecurity RegFlushKey GetSecurityDescriptorDacl ConvertSidToStringSidW IsValidSid

CertGetNameStringW

WTHelperProvDataFromStateData WinVerifyTrust WTHelperGetProvSignerFromChain

RmGetList RmEndSession RmStartSession RmRegisterResources

GetClipboardOwner GetOpenClipboardWindow CountClipboardFormats EnumClipboardFormats GetClipboardFormatNameW IsClipboardFormatAvailable GetWindowDisplayAffinity GetWindowInfo IsWindowUnicode GetMenuItemInfoW MapVirtualKeyW GetMenu SendMessageTimeoutW EnumWindows GetMenuStringW EnumThreadWindows GetKeyNameTextW GetGuiResources GetDesktopWindow EmptyClipboard SetClipboardData BringWindowToTop FrameRect GetClipboardSequenceNumber AdjustWindowRectEx SetActiveWindow DeferWindowPos BeginDeferWindowPos RedrawWindow GetDlgCtrlID EndDeferWindowPos GetParent GetWindowThreadProcessId WindowFromPoint GetAsyncKeyState DrawFocusRect DrawTextW SetWindowDisplayAffinity GetAncestor RegisterClassExW IsDialogMessageW OpenClipboard CloseClipboard GetSysColor GetClipboardData SetCursor GetSysColorBrush PtInRect GetClassInfoExW GetSystemMetrics DestroyIcon MapWindowPoints IsWindowVisible InflateRect GetDC EqualRect TrackPopupMenu GetCapture ClientToScreen DestroyMenu SetLayeredWindowAttributes SetParent SetCapture SetRectEmpty ReleaseCapture SetForegroundWindow ReleaseDC GetCursorPos GetWindowTextLengthW GetMessageW DefWindowProcW ModifyMenuW GetKeyState CallWindowProcW PostMessageW GetWindowRect GetMenuItemID GetFocus InsertMenuItemW DestroyWindow SetWindowPos MonitorFromRect MonitorFromWindow GetMenuItemCount EnumChildWindows SetWindowLongPtrW FillRect CreateWindowExW ScreenToClient SendMessageW SetWindowTextW CreatePopupMenu GetWindowLongPtrW ShowWindow IsWindow DispatchMessageW SetTimer GetMonitorInfoW SetMenuItemInfoW IsChild RegisterClassW IsWindowEnabled MoveWindow SetMenu SetFocus TranslateMessage LoadIconW LoadCursorW GetClassNameW DrawMenuBar CheckMenuItem GetClientRect IsZoomed AppendMenuW GetMenuItemRect KillTimer PostQuitMessage EnableMenuItem SystemParametersInfoW CreateMenu UpdateWindow InvalidateRect IsIconic BeginPaint EndPaint EnableWindow GetWindowTextW MessageBoxW GetTopWindow GetLayeredWindowAttributes GetClassLongPtrW GetWindow RegisterHotKey GetClipboardViewer UnregisterHotKey GetDlgItem

SetTextColor GetObjectW LineTo SelectObject MoveToEx SetBkColor DeleteObject CreateSolidBrush Rectangle GetTextExtentPoint32W DeleteDC GetStockObject CreateCompatibleDC CreateCompatibleBitmap BitBlt CreatePen CreateFontIndirectW SetBkMode

GetSaveFileNameW GetOpenFileNameW CommDlgExtendedError

CoInitializeEx CoTaskMemFree CoCreateInstance CoUninitialize CoSetProxyBlanket

SysStringLen VariantInit SysFreeString VariantClear SysAllocString

SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW SetupDiGetDevicePropertyW SetupDiEnumDeviceInfo CM_Get_Device_IDW CM_Get_Device_ID_Size SetupDiOpenDevRegKey CM_Get_DevNode_Status SetupDiDestroyDeviceInfoList CM_Get_Res_Des_Data CM_Get_First_Log_Conf CM_Free_Res_Des_Handle CM_Get_Next_Res_Des CM_Free_Log_Conf_Handle CM_Get_Res_Des_Data_Size SetupDiOpenDeviceInfoW SetupDiOpenClassRegKeyExW CM_Get_Parent

EvtRender EvtNext EvtQuery EvtOpenPublisherMetadata EvtFormatMessage EvtCreateRenderContext EvtClose

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

GetFullPathNameW FindFirstFileExW IsDebuggerPresent QueryPerformanceFrequency QueryPerformanceCounter WaitForSingleObjectEx TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetStringTypeW RaiseException SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitThread FreeLibraryAndExitThread ExitProcess HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CopyFileW CreateHardLinkW CreateSymbolicLinkW GetLocaleInfoEx InitOnceComplete GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale InitOnceBeginInitialize EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo GetStdHandle GetCurrentThread GlobalGetAtomNameW GetSystemTime SystemTimeToFileTime GetTimeZoneInformation GetDynamicTimeZoneInformation GetFileType SetEvent GlobalSize GetACP GlobalMemoryStatusEx GetActiveProcessorGroupCount Sleep K32GetDeviceDriverBaseNameW K32GetDeviceDriverFileNameW K32EnumDeviceDrivers EnumResourceNamesW VirtualQueryEx K32GetMappedFileNameW GetSystemInfo SetProcessAffinityMask IsWow64Process2 GetModuleHandleExW SetThreadGroupAffinity GetProcessAffinityMask SetFilePointer GetShortPathNameW FindClose FindNextFileW FindFirstFileW GetLogicalDrives GetCurrentDirectoryW DeleteProcThreadAttributeList SetFileInformationByHandle UpdateProcThreadAttribute GetSystemDirectoryW PeekNamedPipe CreatePipe InitializeProcThreadAttributeList RemoveDirectoryW ExpandEnvironmentStringsW SetHandleInformation CreateDirectoryW GetExitCodeProcess DebugSetProcessKillOnExit LoadLibraryExW IsWow64Process GetProcessHandleCount UnhandledExceptionFilter SetStdHandle HeapSize WriteConsoleW SetEndOfFile IsProcessorFeaturePresent SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA TerminateJobObject QueryFullProcessImageNameW Module32NextW CreateRemoteThread FreeLibrary ReadProcessMemory DebugActiveProcess GetPriorityClass Module32FirstW CreateThread K32GetModuleInformation GetProcessIoCounters TerminateThread K32GetProcessMemoryInfo GetExitCodeThread IsProcessInJob DuplicateHandle ResumeThread SuspendThread DebugActiveProcessStop CreateJobObjectW GetOEMCP IsValidCodePage ReadConsoleW GetConsoleMode GetConsoleOutputCP HeapReAlloc EnumSystemLocalesW K32GetModuleFileNameExW TerminateProcess AssignProcessToJobObject GetUserDefaultLCID GetTickCount64 OutputDebugStringW Thread32Next Thread32First CreateToolhelp32Snapshot GetLastError CloseHandle CreateProcessW lstrcmpiW GetCurrentProcess CreateMutexW WaitForSingleObject ReleaseMutex UnmapViewOfFile OpenProcess GetCurrentProcessId CreateFileMappingW MapViewOfFile GetProcessTimes ReadFile SizeofResource GetFileSizeEx WriteFile CreateFileW LockResource DeleteFileW LoadResource FindResourceW MoveFileExW GetModuleHandleW FlushFileBuffers GetFileAttributesW SetLastError ProcessIdToSessionId Process32NextW Process32FirstW FormatMessageW LocalFree MultiByteToWideChar LoadLibraryW GetProcAddress QueryDosDeviceW GetVolumeInformationW GetVolumePathNameW GetVolumeNameForVolumeMountPointW FileTimeToSystemTime GetDiskFreeSpaceExW FileTimeToLocalFileTime GetWindowsDirectoryW GetVolumePathNamesForVolumeNameW CompareStringOrdinal CreateEventW CancelIoEx GetOverlappedResult GetModuleFileNameW GetEnvironmentVariableW GetSystemTimeAsFileTime GetLogicalDriveStringsW GetFileAttributesExW GlobalFindAtomW GlobalLock GlobalUnlock GetProcessIdOfThread GetCurrentThreadId GetActiveProcessorCount GetThreadTimes GetThreadGroupAffinity OpenThread GetLocalTime GlobalAlloc GlobalFree WideCharToMultiByte MulDiv lstrcpynW DeviceIoControl FormatMessageA GetFileInformationByHandleEx GetFinalPathNameByHandleW GetFileInformationByHandle SetFilePointerEx SetPriorityClass

FilterVolumeFindClose FilterFindFirst FilterVolumeFindNext FilterInstanceFindFirst FilterVolumeFindFirst FilterInstanceFindClose FilterFindClose FilterInstanceFindNext FilterFindNext

InetNtopW ntohs WSAStartup

SetTcpEntry GetExtendedUdpTable GetExtendedTcpTable

PdhAddEnglishCounterW PdhGetFormattedCounterValue PdhOpenQueryW PdhCloseQuery PdhAddCounterW PdhCollectQueryData PdhGetFormattedCounterArrayW PdhMakeCounterPathW PdhLookupPerfNameByIndexW

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwindEx RtlUnwind RtlPcToFileHeader

ObReferenceObjectByName IoDriverObjectType CmRegisterCallbackEx CmCallbackGetKeyObjectIDEx CmCallbackReleaseKeyObjectIDEx PsSetCreateThreadNotifyRoutine PsLookupProcessByProcessId PsSetLoadImageNotifyRoutine ObRegisterCallbacks PsGetProcessId PsGetThreadId PsGetThreadProcess IoQueryFullDriverPath ObQueryNameString IoStartTimer IoStopTimer ZwOpenKey ExAcquireResourceSharedLite ExReleaseResourceLite RtlEnumerateGenericTableWithoutSplayingAvl KeSetSystemGroupAffinityThread KeRevertToUserGroupAffinityThread KeQueryActiveProcessorCountEx KeQueryActiveGroupCount KeGetProcessorNumberFromIndex KeGetProcessorIndexFromNumber ExAcquireResourceExclusiveLite RtlDeleteElementGenericTableAvl RtlNumberGenericTableElementsAvl KeLowerIrql KfRaiseIrql KeClearEvent KeDelayExecutionThread KeInitializeSpinLock KeAcquireSpinLockRaiseToDpc KeReleaseSpinLock KeBugCheckEx KeQueryGroupAffinity KeGetCurrentProcessorNumberEx KeRegisterProcessorChangeCallback KeDeregisterProcessorChangeCallback ExRegisterCallback MmAllocateContiguousMemorySpecifyCache MmFreeContiguousMemory MmGetPhysicalAddress KeGenericCallDpc KeStackAttachProcess KeUnstackDetachProcess KeSignalCallDpcSynchronize KeSignalCallDpcDone PsInitialSystemProcess MmGetPhysicalMemoryRanges PsCreateSystemThread PsTerminateSystemThread ObReferenceObjectByHandle RtlCaptureContext RtlRestoreContext MmCopyMemory MmProbeAndLockPages MmUnlockPages IoAllocateMdl IoFreeMdl PsGetThreadProcessId PsLookupThreadByThreadId PsIsThreadTerminating MmHighestUserAddress ObfReferenceObject PsGetProcessCreateTimeQuadPart PsGetProcessExitStatus PsGetThreadCreateTime IoGetRequestorProcessId ObOpenObjectByPointer ZwQueryObject ZwDuplicateObject ZwAllocateVirtualMemory ZwFreeVirtualMemory IoGetRequestorProcess ObDereferenceObjectDeferDelete IoThreadToProcess MmMapLockedPagesSpecifyCache PsAcquireProcessExitSynchronization PsReleaseProcessExitSynchronization ZwQueryVirtualMemory KeIpiGenericCall MmUnmapIoSpace MmMapIoSpaceEx HalDispatchTable RtlGetVersion KeInitializeDpc KeFlushQueuedDpcs KeInitializeTimerEx KeCancelTimer KeSetTimerEx MmMapIoSpace IofCompleteRequest IoDeleteDevice IoDetachDevice ZwUnloadDriver IoGetLowerDeviceObject ObMakeTemporaryObject ExAcquireFastMutex ExReleaseFastMutex IoGetAttachedDeviceReference RtlFindExportedRoutineByName ObGetObjectType IoFileObjectType RtlPcToFileHeader MmProtectMdlSystemAddress MmUnmapLockedPages ZwCreateFile ZwQueryInformationFile ZwSetInformationFile ZwQueryFullAttributesFile RtlValidSid RtlInitializeSid RtlSubAuthoritySid RtlLengthSid RtlCopySid IoEnumerateDeviceObjectList RtlAddAce ZwSetSecurityObject ZwQueryDirectoryFile ZwQueryVolumeInformationFile MmBuildMdlForNonPagedPool SeCaptureSubjectContext SeReleaseSubjectContext IoAllocateIrp IofCallDriver IoCancelIrp IoFreeIrp ZwQuerySystemInformation PoCallDriver PoStartNextPowerIrp ZwOpenFile IoAcquireVpbSpinLock IoGetBaseFileSystemDeviceObject IoReleaseVpbSpinLock ObCreateObject MmFlushImageSection ZwCreateKey ZwSetValueKey DbgPrintEx KeRegisterBugCheckCallback KeRegisterBugCheckReasonCallback ZwQueryValueKey RtlCaptureStackBackTrace ExReInitializeRundownProtection strchr strlen PsGetVersion ZwWriteFile KeInvalidateRangeAllCaches ZwOpenProcess RtlSubAuthorityCountSid PsReferencePrimaryToken PsDereferencePrimaryToken ZwOpenProcessTokenEx ZwSetInformationToken PsGetProcessInheritedFromUniqueProcessId ZwTerminateProcess MmCopyVirtualMemory ZwWaitForSingleObject ZwQueryInformationToken ZwAdjustPrivilegesToken ZwDeleteKey ZwDeleteValueKey ZwEnumerateKey ZwEnumerateValueKey ZwRenameKey IoWMIRegistrationControl RtlEqualSid SeQueryInformationToken ExInitializeResourceLite ExDeleteResourceLite KeWaitForMultipleObjects ExQueueWorkItem KeQueryHighestNodeNumber ExEnumHandleTable ExfUnblockPushLock ObCloseHandle ExAcquireSpinLockShared ExReleaseSpinLockShared RtlInitAnsiString RtlAnsiStringToUnicodeString RtlFreeUnicodeString ZwReadFile IoAllocateWorkItem IoFreeWorkItem IoQueueWorkItem RtlUpcaseUnicodeChar CmKeyObjectType _wcsnicmp ZwOpenSymbolicLinkObject ZwQuerySymbolicLinkObject IoReplaceFileObjectName IoGetDeviceObjectPointer IoGetDeviceInterfaces RtlDowncaseUnicodeChar IoGetBootDiskInformation IoBuildSynchronousFsdRequest ZwDeviceIoControlFile ZwCancelIoFileEx KeAreAllApcsDisabled KeQueryTimeIncrement IoGetDeviceProperty IoGetDeviceAttachmentBaseRef ProbeForWrite RtlRandomEx MmAllocatePagesForMdlEx MmFreePagesFromMdl IoGetStackLimits KeQueryMaximumProcessorCountEx MmAllocateContiguousMemory IoBuildDeviceIoControlRequest KdDebuggerEnabled KeInsertQueueDpc KeRemoveQueueDpc KeSetTargetProcessorDpcEx KeInitializeEvent KeGetCurrentIrql __chkstk __C_specific_handler IoEnumerateRegisteredFiltersList ZwQueryDirectoryObject ZwOpenDirectoryObject ZwClose ObfDereferenceObject ExCreateCallback MmUserProbeAddress ExDesktopObjectType PsThreadType PsProcessType MmIsAddressValid IoUnregisterFsRegistrationChange SeUnregisterLogonSessionTerminatedRoutineEx SeUnregisterLogonSessionTerminatedRoutine PsSetCreateProcessNotifyRoutineEx PsSetCreateProcessNotifyRoutine PoUnregisterPowerSettingCallback IoUnregisterPlugPlayNotificationEx IoUnregisterShutdownNotification SeUnregisterImageVerificationCallback CmUnRegisterCallback ExUnregisterCallback KeDeregisterNmiCallback KeDeregisterBugCheckReasonCallback KeDeregisterBugCheckCallback DbgSetDebugPrintCallback KeSetEvent MmSystemRangeStart FsRtlIsNameInExpression RtlPrefixUnicodeString ExReleaseRundownProtection ExAcquireRundownProtection ExInitializeRundownProtection RtlEqualUnicodeString PsGetProcessSessionId PsGetProcessImageFileName _vsnwprintf _vsnprintf SeLocateProcessImageName PsGetCurrentThreadId PsGetCurrentProcessId IoGetCurrentProcess ExReleasePushLockSharedEx ExReleasePushLockExclusiveEx ExAcquirePushLockSharedEx ExAcquirePushLockExclusiveEx ExInitializePushLock ExWaitForRundownProtectionRelease ExFreePoolWithTag ExAllocatePoolWithTag KeQuerySystemTimePrecise KeLeaveCriticalRegion PsRemoveLoadImageNotifyRoutine PsRemoveCreateThreadNotifyRoutine ObUnRegisterCallbacks IoGetRelatedDeviceObject KeWaitForSingleObject RtlCopyUnicodeString KiBugCheckData ExAllocatePoolWithQuotaTag KeEnterCriticalRegion RtlCompareMemory MmGetSystemRoutineAddress RtlCreateAcl RtlInitUnicodeString

KeStallExecutionProcessor KeQueryPerformanceCounter

FwpmFilterDeleteById0 FwpmFilterAdd0 FwpmCalloutDeleteByKey0 FwpmCalloutAdd0 FwpmSubLayerDeleteByKey0 FwpmSubLayerAdd0 FwpmTransactionAbort0 FwpmTransactionCommit0 FwpmTransactionBegin0 FwpsCalloutUnregisterById0 FwpsCalloutRegister0 FwpmFilterDestroyEnumHandle0 FwpmFilterEnum0 FwpmFilterCreateEnumHandle0 FwpmCalloutDestroyEnumHandle0 FwpmCalloutEnum0 FwpmCalloutCreateEnumHandle0 FwpmLayerGetByKey0 FwpmSubLayerDestroyEnumHandle0 FwpmSubLayerEnum0 FwpmSubLayerCreateEnumHandle0 FwpmProviderDestroyEnumHandle0 FwpmProviderEnum0 FwpmProviderCreateEnumHandle0 FwpmEngineClose0 FwpmEngineOpen0 FwpmFreeMemory0

NdisRetreatNetBufferDataStart NdisAdvanceNetBufferDataStart NdisGetDataBuffer

NsiFreeTable NsiAllocateAndGetTable

FltReleaseFileNameInformation FltGetFilterInformation FltEnumerateFilters FltObjectDereference FltGetFileNameInformation FltParseFileNameInformation FltUnloadFilter FltSetCallbackDataDirty FltStartFiltering FltUnregisterFilter FltRegisterFilter FltEnumerateInstances FltEnumerateVolumes FltGetVolumeName FltGetRequestorProcessId

WppAutoLogStop WppAutoLogStart WppAutoLogTrace imp_WppRecorderReplay

WdfVersionUnbind WdfVersionBindClass WdfLdrQueryInterface WdfVersionBind WdfVersionUnbindClass