ImpersonateNamedPipeClient, RevertToSelf

SetUnhandledExceptionFilter, GetDiskFreeSpaceExW, DeviceIoControl, GetDriveTypeW, QueryDosDeviceW, GetLastError, CloseHandle, QueryPerformanceCounter, IsDebuggerPresent, UnhandledExceptionFilter, TerminateProcess, GetStartupInfoW, CreateProcessW, GetOverlappedResult, CancelIo, ReleaseMutex, CreateMutexW, SetNamedPipeHandleState, WaitNamedPipeW, CreateNamedPipeW, ConnectNamedPipe, DisconnectNamedPipe, GetModuleFileNameW, GetCurrentProcessId, GetComputerNameW, GetWindowsDirectoryW, ProcessIdToSessionId, GetVersionExW, GetCurrentThreadId, GetSystemDirectoryW, GetCurrentDirectoryW, GetTempPathW, FindNextFileW, FindFirstFileW, GetFileAttributesW, FindClose, GetSystemDefaultLCID, GetACP, CompareStringW, WideCharToMultiByte, LoadLibraryA, CreateFileW, Sleep, GetSystemTimeAsFileTime, GetTickCount, GetLocalTime, SystemTimeToFileTime, WaitForMultipleObjects, SetLastError, WaitForSingleObject, InterlockedIncrement, InterlockedDecrement, InterlockedCompareExchange, InterlockedExchange, FreeLibrary, LoadLibraryW, GetProcAddress, ResetEvent, CreateEventW, SetEvent, GetModuleHandleW, LoadLibraryExW, GetCurrentProcess, GetSystemInfo, WriteFile, GetFileSize, SetFilePointer, ReadFile, MapViewOfFile, UnmapViewOfFile, SetEndOfFile, FlushFileBuffers, CreateFileMappingW, ResumeThread, TerminateThread, SetThreadPriority, GetExitCodeThread, LocalAlloc, LocalFree, CreateEventA, CreateProcessA, MultiByteToWideChar, GetThreadPriority, OpenThread

DllMain

memcpy, memmove, memset, _aulldiv, ZwClose, _alldiv, RtlNtStatusToDosError, ZwSetInformationProcess, ZwQueryVolumeInformationFile, ZwOpenFile, RtlEqualUnicodeString, _chkstk, ZwFsControlFile, LdrUnloadDll, LdrLoadDll, RtlInitUnicodeString, ZwWaitForSingleObject, ZwReadFile, _allmul, RtlFreeUnicodeString, ZwCreateKey, RtlOpenCurrentUser, ZwDuplicateToken, RtlCreateSecurityDescriptor, RtlGetDaclSecurityDescriptor, RtlGetGroupSecurityDescriptor, RtlGetOwnerSecurityDescriptor, RtlGetSaclSecurityDescriptor, RtlValidSecurityDescriptor, RtlSetDaclSecurityDescriptor, RtlSetGroupSecurityDescriptor, RtlSetOwnerSecurityDescriptor, RtlSetSaclSecurityDescriptor, RtlCreateAcl, RtlAddAccessAllowedAceEx, ZwQueryInformationToken, RtlEqualSid, RtlGetAce, ZwDeleteValueKey, ZwQueryValueKey, ZwSetValueKey, ZwOpenKey, ZwEnumerateKey, ZwQueryKey, ZwDeleteKey, LdrGetProcedureAddress, RtlInitAnsiString, LdrGetDllHandle, ZwWaitForMultipleObjects, RtlAllocateHeap, RtlReAllocateHeap, RtlFreeHeap, ZwFlushBuffersFile, ZwSetInformationThread, ZwWriteFile, ZwCreateNamedPipeFile, ZwSetInformationFile, RtlCreateUnicodeString, ZwQueryInformationProcess, ZwOpenProcess, ZwCreateEvent, ZwCancelIoFile, ZwQueryInformationFile, ZwOpenThreadToken, ZwCreateFile, RtlTimeToTimeFields, _aullrem, RtlTimeFieldsToTime, ZwQueryVirtualMemory, ZwReadVirtualMemory, DbgPrint, _allrem, _stricmp, _strnicmp, _ftol, ZwTerminateProcess, ZwQueryInformationThread, ZwDelayExecution, ZwResumeThread, ZwTerminateThread, RtlRaiseException, ZwDuplicateObject, LdrShutdownThread, CsrClientCallServer, RtlCreateUserThread, RtlUpcaseUnicodeString, RtlxAnsiStringToUnicodeSize, RtlxOemStringToUnicodeSize, NlsMbOemCodePageTag, RtlAnsiStringToUnicodeString, RtlOemStringToUnicodeString, RtlxUnicodeStringToAnsiSize, RtlxUnicodeStringToOemSize, RtlUnicodeStringToAnsiString, RtlUnicodeStringToOemString, _aullshr, ZwSetEvent, ZwResetEvent, RtlSystemTimeToLocalTime, RtlInitializeCriticalSection, RtlEnterCriticalSection, RtlLeaveCriticalSection, RtlDeleteCriticalSection, ZwReleaseMutant, ZwQuerySymbolicLinkObject, ZwOpenSymbolicLinkObject, ZwDeviceIoControlFile, RtlGetFullPathName_U, RtlQueryEnvironmentVariable_U, ZwQuerySystemInformation, RtlCopySid, RtlAddAccessDeniedAceEx, RtlAdjustPrivilege, RtlImpersonateSelf, RtlDestroyProcessParameters, RtlCreateUserProcess, RtlCreateProcessParameters, RtlGetCurrentDirectory_U, ZwQueryObject, ZwUnmapViewOfSection, ZwMapViewOfSection, ZwCreateSection, RtlUpcaseUnicodeChar, RtlDosPathNameToNtPathName_U, RtlDestroyEnvironment, RtlSetEnvironmentVariable, RtlCreateEnvironment, ZwQueryDirectoryFile, RtlIsDosDeviceName_U, ZwDisplayString, RtlUnwind, RtlReleasePebLock, RtlClearBits, RtlFindClearBitsAndSet, RtlAcquirePebLock, RtlAreBitsSet, _allshl, NtRaiseException, RtlCompareUnicodeString, NtTerminateThread, NtResumeThread, DbgBreakPoint, RtlExpandEnvironmentStrings_U, ZwCreateSemaphore, ZwReleaseSemaphore, DllMain, RtlRemoveVectoredExceptionHandler, RtlAddVectoredExceptionHandler, NtClose, ZwQuerySecurityObject, ZwFreeVirtualMemory, ZwAllocateVirtualMemory, ZwSetSecurityObject, _strcmpi, towupper, ZwFlushVirtualMemory, LdrShutdownProcess