GetModuleHandleA, GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, GetLocaleInfoA, InitializeCriticalSectionAndSpinCount, LoadLibraryA, VirtualAlloc, EnterCriticalSection, LeaveCriticalSection, MultiByteToWideChar, IsValidCodePage, GetOEMCP, GetACP, GetCPInfo, WriteFile, GetSystemTimeAsFileTime, GetCurrentProcessId, GetTickCount, QueryPerformanceCounter, VirtualFree, HeapDestroy, HeapCreate, GetEnvironmentStringsW, WideCharToMultiByte, FreeEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsA, GetModuleFileNameA, DeleteCriticalSection, GetStartupInfoA, GetFileType, GetStdHandle, SetHandleCount, RtlUnwind, RaiseException, ExitProcess, HeapSize, Sleep, InterlockedDecrement, SetLastError, InterlockedIncrement, TlsFree, TlsSetValue, TlsAlloc, TlsGetValue, GetProcAddress, GetModuleHandleW, IsDebuggerPresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, HeapReAlloc, HeapAlloc, HeapFree, GetCommandLineA, GetCurrentThreadId, GetLastError, GetVersionExW

ZwQueryInformationThread, RtlCreateUserThread, ZwDelayExecution, RtlGetFullPathName_U, RtlAddAccessDeniedAceEx, RtlCopySid, ZwSetSecurityObject, RtlGetCurrentDirectory_U, ZwReadFile, ZwFlushVirtualMemory, ZwQuerySystemInformation, ZwSetInformationFile, ZwCreateSection, ZwQueryInformationFile, ZwWriteFile, ZwCreateFile, ZwAllocateUuids, LdrUnloadDll, ZwTerminateProcess, LdrGetProcedureAddress, LdrLoadDll, ZwCreateEvent, ZwSetEvent, RtlQueryEnvironmentVariable_U, ZwResetEvent, RtlExpandEnvironmentStrings_U, RtlCreateUnicodeString, RtlDosPathNameToNtPathName_U, ZwQuerySymbolicLinkObject, ZwOpenSymbolicLinkObject, LdrGetDllHandle, RtlIsDosDeviceName_U, ZwQueryDirectoryFile, RtlDeleteCriticalSection, RtlInitializeCriticalSection, LdrShutdownThread, ZwResumeThread, CsrClientCallServer, ZwTerminateThread, ZwWaitForSingleObject, RtlSystemTimeToLocalTime, ZwReleaseMutant, RtlUpcaseUnicodeString, RtlxUnicodeStringToOemSize, NlsMbOemCodePageTag, RtlxUnicodeStringToAnsiSize, RtlOemStringToUnicodeString, RtlxAnsiStringToUnicodeSize, RtlxOemStringToUnicodeSize, RtlUnicodeStringToOemString, RtlUnicodeStringToAnsiString, RtlAnsiStringToUnicodeString, RtlLeaveCriticalSection, RtlEnterCriticalSection, RtlSetOwnerSecurityDescriptor, ZwOpenKey, ZwQueryKey, RtlCreateSecurityDescriptor, ZwEnumerateKey, ZwDeleteKey, RtlGetOwnerSecurityDescriptor, ZwOpenFile, RtlAddAccessAllowedAceEx, RtlGetDaclSecurityDescriptor, ZwQueryValueKey, RtlFreeUnicodeString, RtlSetSaclSecurityDescriptor, RtlGetGroupSecurityDescriptor, RtlSetGroupSecurityDescriptor, RtlGetSaclSecurityDescriptor, ZwSetValueKey, ZwQuerySecurityObject, RtlEqualSid, RtlSetDaclSecurityDescriptor, RtlValidSecurityDescriptor, RtlCreateAcl, ZwCreateKey, RtlGetAce, ZwQueryVirtualMemory, ZwReadVirtualMemory, ZwQueryInformationToken, ZwQueryInformationProcess, ZwOpenProcess, RtlOpenCurrentUser, NtClose, RtlNtStatusToDosError, RtlAllocateHeap, RtlReAllocateHeap, RtlFreeHeap, ZwOpenSection, ZwClose, ZwUnmapViewOfSection, RtlInitUnicodeString, RtlInitAnsiString, ZwMapViewOfSection

HttpOpenRequestW, HttpQueryInfoW, InternetSetOptionW, HttpSendRequestW, InternetConnectW, InternetReadFile, InternetOpenW, InternetCloseHandle