RegEnumKeyExW, RegQueryValueExW, RegCloseKey, InitializeSecurityDescriptor, AllocateAndInitializeSid, GetLengthSid, InitializeAcl, AddAce, SetSecurityDescriptorDacl, FreeSid, RegCreateKeyExW, RegSetKeySecurity, RegEnumValueW, RegSetValueExW, OpenProcessToken, ImpersonateLoggedOnUser, LogonUserW, OpenSCManagerW, OpenServiceW, CloseServiceHandle, QueryServiceStatus, CreateServiceW, DeleteService, QueryServiceConfigW, StartServiceCtrlDispatcherW, ControlService, StartServiceW, RegisterServiceCtrlHandlerExW, SetServiceStatus, GetSecurityDescriptorControl, MakeSelfRelativeSD, GetTokenInformation, RegOpenKeyExW

LzmaDec_DecodeToBuf, Lzma2Dec_DecodeToBuf, LzmaDec_Free, LzmaDec_Init, Lzma2Dec_Init, LzmaDec_Allocate, LzmaProps_Decode, Lzma2Dec_GetOldProps, LzmaDecode, deflateInit2_, deflate, deflateParams, inflateEnd, inflate, inflateReset, inflateInit2_, deflateEnd, inflatePatch, crcGenerate16c, crcGenerate16, BZ2_bzCompressInit, crcUpdate32, md2_done, md2_process, md2_init, sha1Final, sha1Update, sha1Init, GetKeyData, sha256Final, sha256Update, sha256Init, sha256GenerateHash, MD5Final, MD5Update, MD5Init, mdaGenerate, GetCriticalSystemFiles, cyphSimpleCode, crcGenerate32, BZ2_bzCompress, BZ2_bzCompressEnd, BZ2_bzDecompressInit, BZ2_bzDecompressEnd, BZ2_bzDecompress, crcUpdate32c, sha384Init, sha384Update, sha384Final, sha512Init, sha512Update, sha512Final

dep_osSuspendThread, dep_osCloseThread, dep_osWaitForThread, dep_osTerminateThread, dep_osBeginThread, dep_osEndThread, dep_osSetThreadPriority, dep_secSetPrivilege, dep_osIsWinXPOrBetter, dep_osGetCurrentProcessID, dep_osGetModName, dep_memGetMemoryInfo, dep_memCloseProcess, dep_memReadProcessMemory, dep_memOpenProcess, dep_fsGetHandleFlags, dep_osRand, dep_strHasAnsiForm, dep_fsRemapFile, dep_memVirtualFree, dep_fsSetEndOfFile, dep_fsUnlockFile, dep_fsLockFile, dep_fsSeekWriteFile, dep_memVirtualAlloc, dep_fsDuplicateFile, dep_fsRemoveFolderRecursiveX, dep_fsRemoveFolderX, dep_fsCreateFolderX, dep_fsDeleteFileLaterX, dep_fsDeleteFileX, dep_fsExistFileX, dep_fsMoveFileX, dep_fsCopyFileX, dep_fsSetFileAttributesX, dep_fsGetFileAttributes, dep_fsGetNTLongPath, dep_fsUseNTLongPath, dep_osRegistryClose, dep_osRegistryOpen, dep_fsWriteFile, dep_fsGetFullPathName, dep_strGetEnvVar, dep_strNormalToUnicode, dep_strUnicodeToNormal, dep_strCurrToNewUtf8, dep_secGetPublicDirSecurity, cmnosFree, dep_osGetCpuFeatures, cmnosInit, aswcmnosDllMain, dep_fsCreateFolder, dep_osGetTickCount, dep_fsGetVolumeInfoByHandle, dep_fsGetFileId, dep_fsGetFileAttributesX, dep_osSleep, dep_osGetSystemDir, dep_fsGetFileInfoHandle, dep_fsFindClose, dep_fsFindNextFile, dep_fsFindFirstFile, dep_osCallOpenedDriver, dep_osCloseDrvDevice, dep_osOpenDrvDevice, dep_fsDeleteFile, dep_fsExtractDriveRoot, dep_strConvert, dep_secGetPublicSecurity, dep_fsGetObjectNameByHandle, dep_memCloseSharedMemory, dep_memCreateSharedMemory, dep_osIsWinVistaOrBetter, dep_fsGetDriveType, dep_fsGetVolumeNames, dep_osIsWin64, dep_osGetID, dep_fsSetFilePointer, dep_fsReadFile, dep_fsGetFilePointer, dep_fsSeekReadFile, dep_fsCloseMap, dep_fsGetFileSizeHandle, dep_fsMapFile, dep_fsOpenFile, dep_fsExistFile, dep_osIsWow64, dep_osIsWin2kOrBetter, dep_fsEnableWow64FsRedirection, dep_fsCloseFile, dep_fsOpenFileX, dep_strFreeString, dep_strUnicodeToNewNormal, dep_csRelease, dep_csWait, dep_csDelete, dep_csCreate, dep_mutexRelease, dep_mutexWait, dep_mutexDelete, dep_mutexCreate, dep_eventRelease, dep_eventWait, dep_eventPulse, dep_eventDelete, dep_eventCreate, dep_fsGetAPIHandle, dep_osGetGranularity, dep_strGetTime, dep_strGetDate, dep_osRegistryReadString, dep_strConvertErrorToString, dep_osGetUserFullName, dep_fsGetCurFol, dep_osExpandEnvironment

MapViewOfFile, GetFileSize, SetLastError, GetModuleHandleW, CreateEventW, WaitForSingleObject, InterlockedIncrement, ResetEvent, InterlockedDecrement, SetEvent, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, GetWindowsDirectoryW, QueryDosDeviceW, FindFirstFileW, FindClose, OutputDebugStringW, CreateProcessW, GetSystemInfo, CreateEventA, CreateFileMappingA, InterlockedExchange, GetPrivateProfileIntW, CreateFileMappingW, WritePrivateProfileStringW, OpenProcess, LoadLibraryExW, InitializeCriticalSectionAndSpinCount, GetFileAttributesW, lstrcmpiA, WriteProcessMemory, VirtualProtect, DeviceIoControl, CreateMutexW, OpenMutexW, OpenEventW, CreateSemaphoreW, OpenSemaphoreW, OpenFileMappingW, GetVolumeInformationW, GetLogicalDrives, GetDriveTypeW, DisableThreadLibraryCalls, ExpandEnvironmentStringsW, SetEnvironmentVariableW, GetModuleFileNameW, UnmapViewOfFile, CreateFileW, GetLastError, LocalAlloc, FileTimeToLocalFileTime, FileTimeToSystemTime, LocalFree, LoadLibraryW, GetProcAddress, FreeLibrary, GetShortPathNameW, GetSystemDirectoryW, QueryPerformanceFrequency, SetThreadAffinityMask, GetCurrentThread, GetThreadPriority, ResumeThread, SetThreadPriority, QueryPerformanceCounter, GetThreadTimes, Sleep, SuspendThread, CloseHandle, DuplicateHandle, IsDebuggerPresent, IsProcessorFeaturePresent, EncodePointer, DecodePointer, GetSystemTimeAsFileTime, GetCurrentProcess, CreateThread, GetCurrentProcessId, GetCurrentThreadId, GetPrivateProfileStringW, SetFileTime, GetTickCount, ReadDirectoryChangesW, GetOverlappedResult, RaiseException, GetVersion, GetVolumeNameForVolumeMountPointW, GetProcessHeap, HeapSize, HeapFree, GetVolumePathNameW, WideCharToMultiByte, MultiByteToWideChar, HeapReAlloc, HeapAlloc, HeapDestroy

DllMain

DllMain

CoInitialize, CoInitializeSecurity, CoInitializeEx

wsprintfA, FindWindowW, GetWindowThreadProcessId, RegisterDeviceNotificationW, UnregisterDeviceNotification, wsprintfW