DllMain

QueryDosDeviceW, GetDriveTypeW, GetDiskFreeSpaceExW, DeviceIoControl, CreateSemaphoreW, ReleaseSemaphore, GetModuleHandleA, DuplicateHandle, QueryPerformanceCounter, IsDebuggerPresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, TerminateProcess, SetEvent, CreateEventW, TerminateThread, ResumeThread, WriteFile, UnmapViewOfFile, MapViewOfFile, CreateFileMappingW, GetFileSize, ReadFile, WaitForSingleObject, WideCharToMultiByte, GetSystemDefaultLCID, MultiByteToWideChar, GetACP, CompareStringW, SetEndOfFile, SetFilePointer, GetCurrentProcessId, GetModuleFileNameW, GetWindowsDirectoryW, GetCurrentThreadId, GetComputerNameW, GetVersionExW, GetSystemDirectoryW, SetThreadPriority, GetModuleHandleW, FreeLibrary, LoadLibraryExW, GetLastError, GetProcAddress, SetLastError, ReleaseMutex, CreateMutexW, InterlockedCompareExchange, InterlockedExchange, InterlockedIncrement, InterlockedDecrement, LocalAlloc, LocalFree, SystemTimeToFileTime, GetTickCount, GetSystemTimeAsFileTime, Sleep, LoadLibraryW, GetSystemInfo, LoadLibraryA, GetCurrentProcess, CreateFileW, FindFirstFileW, GetFileAttributesW, GetTempPathW, FindNextFileW, GetCurrentDirectoryW, CloseHandle, FindClose

DllMain

ZwCreateSection, ZwMapViewOfSection, ZwUnmapViewOfSection, ZwQuerySystemInformation, ZwFlushVirtualMemory, ZwWriteFile, ZwReadFile, RtlUnwind, ZwTerminateProcess, RtlDeleteCriticalSection, RtlInitializeCriticalSection, RtlEnterCriticalSection, RtlLeaveCriticalSection, ZwSetEvent, ZwWaitForSingleObject, ZwCreateEvent, ZwQueryInformationFile, ZwCreateFile, ZwSetInformationFile, RtlFreeUnicodeString, towupper, _strcmpi, _strnicmp, _stricmp, ZwCancelIoFile, ZwDeviceIoControlFile, ZwWaitForMultipleObjects, _aulldvrm, DbgPrint, ZwClose, ZwQueryVirtualMemory, RtlFreeHeap, RtlReAllocateHeap, RtlAllocateHeap, RtlInitUnicodeString, LdrLoadDll, RtlInitAnsiString, LdrGetProcedureAddress, LdrUnloadDll, RtlNtStatusToDosError, memset, memmove, memcpy, LdrGetDllHandle, _aulldiv, _allmul, ZwDelayExecution, LdrShutdownThread, NtTerminateThread, NtResumeThread, CsrClientCallServer, RtlCreateUserThread, RtlCompareUnicodeString, RtlUpcaseUnicodeString, RtlCreateUnicodeString, RtlOemStringToUnicodeString, RtlUnicodeStringToOemString, RtlxOemStringToUnicodeSize, NlsMbOemCodePageTag, RtlxUnicodeStringToOemSize, RtlxAnsiStringToUnicodeSize, RtlAnsiStringToUnicodeString, RtlxUnicodeStringToAnsiSize, RtlUnicodeStringToAnsiString, _aullshr, RtlClearBits, RtlAreBitsSet, _allshl, DbgBreakPoint, _aullrem, _ftol, RtlRaiseException, ZwDisplayString, NtRaiseException, RtlAcquirePebLock, RtlFindClearBitsAndSet, RtlReleasePebLock, ZwOpenSymbolicLinkObject, ZwQuerySymbolicLinkObject, ZwResetEvent, ZwTerminateThread, ZwResumeThread, ZwSetInformationThread, ZwReleaseMutant, ZwQueryInformationProcess, ZwQueryKey, ZwOpenKey, ZwQueryValueKey, RtlOpenCurrentUser, ZwCreateKey, ZwDuplicateObject, ZwQueryInformationToken