RegCloseKey, GetSecurityDescriptorSacl, ConvertStringSecurityDescriptorToSecurityDescriptorW, RegQueryValueExW, RegOpenKeyExW, RegSetValueExW, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, SetNamedSecurityInfoW, RegCreateKeyExW, LookupAccountNameW, GetFileSecurityW, GetSecurityDescriptorDacl, GetAclInformation, GetLengthSid, InitializeAcl, GetAce, EqualSid, AddAce, AddAccessAllowedAce, GetSecurityDescriptorControl, SetFileSecurityW, SetSecurityDescriptorSacl, ReportEventW, DeregisterEventSource, RegisterEventSourceW

BitBlt, GetDeviceCaps, CreateDCW, DeleteObject, SelectObject, CreateCompatibleDC, CreateCompatibleBitmap, GetObjectW, GetBitmapBits, DeleteDC

GetStdHandle, PeekNamedPipe, GetVersionExA, SleepEx, GetSystemDirectoryA, LoadLibraryW, ReleaseMutex, OpenFileMappingW, UnmapViewOfFile, MapViewOfFile, CreateMutexW, GetCurrentProcessId, GetVersion, QueryPerformanceFrequency, GetFileType, QueryPerformanceCounter, GetWindowsDirectoryW, GetFileAttributesW, GetFullPathNameW, CreateFileW, ReadFile, Sleep, WriteFile, SetEndOfFile, MultiByteToWideChar, WideCharToMultiByte, SetFilePointer, GetFileSize, DeleteFileW, GetTempPathW, CopyFileW, CompareFileTime, GetTempFileNameW, WaitForSingleObject, WaitForMultipleObjects, ExpandEnvironmentStringsA, FormatMessageA, GetVersionExW, WaitForMultipleObjectsEx, GetLocaleInfoW, SetLastError, GetDiskFreeSpaceExW, GetModuleFileNameW, ExpandEnvironmentStringsW, GetSystemTimeAsFileTime, GetCurrentThreadId, IsDebuggerPresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, InterlockedCompareExchange, LocalFree, GetProcAddress, FreeLibrary, InterlockedExchange, GetLastError, LoadLibraryA, RaiseException, SystemTimeToFileTime, GetSystemTime, OutputDebugStringW, CreateEventW, OpenEventW, CloseHandle, FileTimeToLocalFileTime, lstrlenW, GetTickCount, LocalAlloc, DecodePointer, EncodePointer, IsProcessorFeaturePresent, FlushConsoleInputBuffer, GlobalMemoryStatus, GetProcessHeap, HeapAlloc, GetModuleHandleW, HeapFree, CreateFileMappingW, FileTimeToSystemTime, CreateDirectoryW, GetFileTime, DeleteCriticalSection, InitializeCriticalSection, LeaveCriticalSection, EnterCriticalSection, FindNextFileW, FindFirstFileW

DllMain

DllMain

DllMain

DllMain

DllMain

DllMain

ZwDelayExecution, RtlCreateUserThread, ZwQueryInformationThread, ZwTerminateProcess, ZwQueryInformationProcess, ZwSetInformationThread, LdrShutdownThread, CsrClientCallServer, ZwResumeThread, ZwTerminateThread, ZwCreateFile, RtlFreeUnicodeString, ZwWriteFile, ZwQueryInformationFile, ZwCreateSection, ZwFlushBuffersFile, ZwClose, RtlNtStatusToDosError, ZwUnmapViewOfSection, ZwWaitForSingleObject, ZwSetInformationFile, ZwQuerySystemInformation, ZwMapViewOfSection, ZwReadFile, ZwFsControlFile, strncmp, memmove, wcschr, ZwReleaseMutant, RtlInitUnicodeString, RtlFreeHeap, RtlAllocateHeap, ZwCreateEvent, ZwOpenFile, ZwSetEvent, ZwResetEvent, ZwQueryVirtualMemory, ZwOpenSymbolicLinkObject, ZwQuerySymbolicLinkObject, strtoul, RtlReAllocateHeap, ZwQueryKey, RtlOpenCurrentUser, ZwCreateKey, ZwOpenKey, LdrLoadDll, RtlLeaveCriticalSection, RtlFreeAnsiString, RtlAppendUnicodeStringToString, ZwQueryValueKey, RtlCreateUnicodeString, ZwCreateNamedPipeFile, ZwCancelIoFile, _strnicmp, LdrGetDllHandle, RtlUnicodeStringToAnsiString, RtlAppendUnicodeToString, RtlEnterCriticalSection, memcpy, _allmul, memset, _alldiv, _allshr, _chkstk, _aulldiv, _allrem, ZwFlushVirtualMemory, islower, isupper, isprint, isgraph, isalpha, isalnum, strrchr, strncpy, strtol, sscanf, _aulldvrm, RtlxUnicodeStringToOemSize, NlsMbOemCodePageTag, RtlxUnicodeStringToAnsiSize, RtlOemStringToUnicodeString, RtlxAnsiStringToUnicodeSize, RtlxOemStringToUnicodeSize, RtlUnicodeStringToOemString, RtlAnsiStringToUnicodeString, NtTerminateThread, NtResumeThread, RtlCompareUnicodeString, RtlDowncaseUnicodeString, RtlUpcaseUnicodeString, LdrGetProcedureAddress, RtlInitAnsiString, LdrUnloadDll, qsort, strcmp, strstr, strchr, strlen, atoi, _wtoi, sprintf, _wcsnicmp, _wcsicmp, wcslen, wcscmp, memcmp, _aullshr, _aullrem

SHGetFolderPathW

MsgWaitForMultipleObjectsEx, MessageBoxW, GetDesktopWindow, GetProcessWindowStation, MsgWaitForMultipleObjects, GetUserObjectInformationW

GetProfilesDirectoryW

GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW

InternetCrackUrlW