RegCreateKeyExW, FreeSid, SetSecurityDescriptorDacl, AddAce, InitializeAcl, MakeSelfRelativeSD, GetSecurityDescriptorControl, SetServiceStatus, RegisterServiceCtrlHandlerExW, StartServiceW, ControlService, GetLengthSid, AllocateAndInitializeSid, InitializeSecurityDescriptor, RegOpenKeyExW, RegSetKeySecurity, RegCloseKey, RegEnumValueW, RegSetValueExW, RegQueryValueExW, OpenProcessToken, ImpersonateLoggedOnUser, StartServiceCtrlDispatcherW, QueryServiceConfigW, DeleteService, CreateServiceW, QueryServiceStatus, CloseServiceHandle, OpenServiceW, OpenSCManagerW, RegEnumKeyExW, LogonUserW, GetTokenInformation

LzmaDec_DecodeToBuf, Lzma2Dec_DecodeToBuf, LzmaDec_Free, LzmaDec_Init, Lzma2Dec_Init, LzmaDec_Allocate, LzmaProps_Decode, Lzma2Dec_GetOldProps, LzmaDecode, deflateInit2_, deflate, deflateParams, inflateEnd, inflate, inflateReset, inflateInit2_, deflateEnd, inflatePatch, crcGenerate16c, crcGenerate16, crcUpdate32c, crcUpdate32, md2_done, md2_process, md2_init, sha1Final, sha1Update, sha1Init, RSAPublicDecrypt, GetKeyData, sha256Final, sha256Update, sha256Init, sha256GenerateHash, MD5Final, MD5Update, MD5Init, mdaGenerate, GetCriticalSystemFiles, cyphSimpleCode, crcGenerate32

dep_osTerminateThread, dep_osWaitForThread, dep_osCloseThread, dep_osSuspendThread, dep_osBeginThread, dep_osEndThread, dep_osSetThreadPriority, dep_secSetPrivilege, dep_osGetCurrentProcessID, dep_osGetModName, dep_memGetMemoryInfo, dep_memCloseProcess, dep_memReadProcessMemory, dep_memOpenProcess, dep_fsGetHandleFlags, dep_osRand, dep_strHasAnsiForm, dep_fsRemapFile, dep_memVirtualFree, dep_fsSetEndOfFile, dep_fsUnlockFile, dep_fsLockFile, dep_memVirtualAlloc, dep_fsDuplicateFile, dep_fsRemoveFolderRecursiveX, dep_fsRemoveFolderX, dep_fsCreateFolderX, dep_fsDeleteFileLaterX, dep_fsDeleteFileX, dep_fsExistFileX, dep_fsMoveFileX, dep_fsCopyFileX, dep_fsSetFileAttributesX, dep_fsGetFileAttributes, dep_fsGetNTLongPath, dep_fsUseNTLongPath, dep_osRegistryClose, dep_osRegistryOpen, dep_strCurrToNewUtf8, dep_secGetPublicDirSecurity, cmnosFree, dep_osGetCpuFeatures, cmnosInit, aswcmnosDllMain, dep_osGetTickCount, dep_fsCreateFolder, dep_fsExistFile, dep_semaphoreRelease, dep_osSleep, dep_semaphoreDelete, dep_semaphoreWait, dep_semaphoreCreate, dep_timeSystemToFile, dep_timeFileToSystem, dep_timeCompareFile, dep_timeGetSystemTime, dep_fsFindFirstFileX, dep_osGetSystemDir, dep_fsGetFileInfoHandle, dep_fsFindClose, dep_fsFindNextFile, dep_fsFindFirstFile, dep_osCallOpenedDriver, dep_osCloseDrvDevice, dep_osOpenDrvDevice, dep_fsExtractDriveRoot, dep_strConvert, dep_secGetPublicSecurity, dep_fsGetObjectNameByHandle, dep_memCloseSharedMemory, dep_memCreateSharedMemory, dep_fsGetDriveType, dep_fsGetVolumeNames, dep_osIsWin8OrBetter, dep_osIsWin7OrBetter, dep_osIsWinVistaOrBetter, dep_osIsWinXPOrBetter, dep_osIsWin64, dep_fsSetFilePointer, dep_fsReadFile, dep_fsGetFilePointer, dep_fsSeekReadFile, dep_fsCloseMap, dep_fsGetFileSizeHandle, dep_fsMapFile, dep_fsOpenFile, dep_osIsWow64, dep_osIsWin2kOrBetter, dep_fsEnableWow64FsRedirection, dep_fsCloseFile, dep_fsOpenFileX, dep_strFreeString, dep_strUnicodeToNewNormal, dep_csRelease, dep_csWait, dep_csDelete, dep_csCreate, dep_mutexRelease, dep_mutexWait, dep_mutexDelete, dep_mutexCreate, dep_eventRelease, dep_eventWait, dep_eventPulse, dep_eventDelete, dep_eventCreate, dep_fsGetAPIHandle, dep_osGetGranularity, dep_strGetTime, dep_strGetDate, dep_osRegistryReadString, dep_strConvertErrorToString, dep_osGetUserFullName, dep_fsGetCurFol, dep_strUnicodeToNormal, dep_strNormalToUnicode, dep_strGetEnvVar, dep_fsGetFullPathName, dep_fsWriteFile, dep_osExpandEnvironment, dep_fsSeekWriteFile, dep_fsGetVolumeInfoByHandle, dep_fsDeleteFile, dep_fsGetFileId, dep_fsGetFileAttributesX

OpenFileMappingW, OpenSemaphoreW, CreateSemaphoreW, OpenEventW, OpenMutexW, CreateMutexW, DeviceIoControl, VirtualProtect, WriteProcessMemory, lstrcmpiA, GetFileAttributesW, GetSystemDirectoryW, InitializeCriticalSectionAndSpinCount, LoadLibraryExW, OpenProcess, WritePrivateProfileStringW, GetPrivateProfileStringW, InterlockedExchange, CreateFileMappingA, CreateEventA, GetSystemInfo, CreateProcessW, OutputDebugStringW, FindClose, FindFirstFileW, QueryDosDeviceW, GetVolumeInformationW, GetWindowsDirectoryW, LeaveCriticalSection, EnterCriticalSection, DeleteCriticalSection, InitializeCriticalSection, SetEvent, InterlockedDecrement, ResetEvent, InterlockedIncrement, WaitForSingleObject, CreateEventW, SetLastError, GetFileSize, MapViewOfFile, CreateFileMappingW, UnmapViewOfFile, CreateFileW, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, CreateThread, GetCurrentProcess, DuplicateHandle, CloseHandle, ResumeThread, SuspendThread, Sleep, GetThreadTimes, QueryPerformanceCounter, SetThreadPriority, GetThreadPriority, GetCurrentThread, SetThreadAffinityMask, QueryPerformanceFrequency, FreeLibrary, GetProcAddress, LoadLibraryW, LocalFree, FileTimeToSystemTime, FileTimeToLocalFileTime, LocalAlloc, GetLastError, GetLogicalDrives, GetDriveTypeW, ReadDirectoryChangesW, GetOverlappedResult, DisableThreadLibraryCalls, ExpandEnvironmentStringsW, SetEnvironmentVariableW, GetModuleFileNameW, SetFileTime, InterlockedCompareExchange, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetSystemTimeAsFileTime, GetModuleHandleW, GetPrivateProfileIntW, RaiseException, GetShortPathNameW

DllMain

DllMain

CoInitializeSecurity, CoInitializeEx, CoInitialize

UnregisterDeviceNotification, RegisterDeviceNotificationW, GetWindowThreadProcessId, FindWindowW, wsprintfA, wsprintfW