Import table
advapi32.dll
RegisterEventSourceA, RegNotifyChangeKeyValue, RegCreateKeyExW, RegSetValueExW, RegDeleteValueW, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, ConvertStringSecurityDescriptorToSecurityDescriptorA, GetSecurityDescriptorSacl, SetSecurityDescriptorSacl, RegQueryValueExW, RegCloseKey, RegOpenKeyExW, RegEnumKeyExW, RegDeleteKeyW, RegEnumValueW, RegEnumKeyW, SetSecurityInfo, DeleteAce, GetAce, GetAclInformation, GetSecurityInfo, OpenProcessToken, OpenThreadToken, AddAce, InitializeAcl, GetLengthSid, GetTokenInformation, DeregisterEventSource, ReportEventA
imagehlp.dll
ImageDirectoryEntryToData
kernel32.dll
DllMain
ole32.dll
CoInitialize, CoCreateInstance, CoUninitialize, CLSIDFromString
psapi.dll
GetModuleInformation, EnumProcessModules
rpcrt4.dll
UuidToStringW, RpcStringFreeW
shell32.dll
SHGetSpecialFolderPathW
shlwapi.dll
PathAddExtensionW, PathAppendW, PathFileExistsW, PathRemoveExtensionW, PathStripToRootW, PathFindExtensionW, PathStripPathW, StrCmpW, PathFindFileNameW, PathIsDirectoryW, PathRemoveFileSpecW, PathStripPathA
user32.dll
GetWindowLongW, GetWindowTextW, FindWindowW, SendMessageW, GetUserObjectInformationW, GetProcessWindowStation, GetDlgItem, MessageBoxA, UnregisterClassA, LoadStringA, EndDialog, SetWindowLongW, GetDesktopWindow, IsWindow, GetClassNameA, KillTimer, GetClassNameW, RegisterWindowMessageW, CallNextHookEx, LoadStringW
version.dll
GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
winhttp.dll
WinHttpSendRequest, WinHttpOpenRequest, WinHttpQueryHeaders, WinHttpOpen, WinHttpGetProxyForUrl, WinHttpCloseHandle, WinHttpSetStatusCallback, WinHttpReadData, WinHttpSetOption, WinHttpQueryDataAvailable, WinHttpGetIEProxyConfigForCurrentUser, WinHttpAddRequestHeaders, WinHttpConnect, WinHttpReceiveResponse
Export table
InitMonitor
ProtectedDebugProc
ProtectedShellProc
RunChMonitor
StopChMonitor
TrackFile