Import table
advapi32.dll
FreeSid, AllocateAndInitializeSid, GetSecurityDescriptorDacl, AccessCheck, AddAccessDeniedAce, DuplicateToken, GetLengthSid, InitializeSecurityDescriptor, SetSecurityDescriptorOwner, SetSecurityDescriptorGroup, InitializeAcl, AddAccessAllowedAce, SetSecurityDescriptorDacl, RegisterServiceCtrlHandlerExW, SetServiceStatus, RegOpenKeyExW, RegQueryValueExW, RegCloseKey, CreateProcessAsUserW, GetSecurityInfo, ImpersonateNamedPipeClient, OpenThreadToken, RevertToSelf, SetNamedSecurityInfoW
kernel32.dll
CreateDirectoryW, GetSystemWindowsDirectoryW, LoadLibraryExW, GetSystemDirectoryW, CloseHandle, GetCurrentThreadId, GetCurrentProcessId, LocalFree, GetCurrentThread, HeapFree, GetProcessHeap, DuplicateHandle, GetCurrentProcess, ProcessIdToSessionId, GetVersionExW, OpenProcess, FreeLibrary, GetLastError, GetProcAddress, DisconnectNamedPipe, WriteFile, GetOverlappedResult, WaitForMultipleObjects, ReadFile, ResetEvent, CreateEventW, SetEvent, ConnectNamedPipe, WaitForSingleObject, CreateNamedPipeW, HeapAlloc, LeaveCriticalSection, EnterCriticalSection, CreateThread, DeleteCriticalSection, InitializeCriticalSection, CreateMutexW, QueryPerformanceCounter, GetTickCount, GetSystemTimeAsFileTime, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, SetLastError, LocalAlloc, GetTempPathW, DisableThreadLibraryCalls
ntdll.dll
memmove, _wcsicmp, wcslen, RtlUnwind, _vsnwprintf, NtQueryVirtualMemory, _chkstk, swprintf, _alloca_probe, wcscpy, wcscat
rpcrt4.dll
RpcBindingFree, NdrClientCall2, RpcBindingFromStringBindingW, RpcBindingSetAuthInfoExW
user32.dll
GetUserObjectInformationW, OpenWindowStationW, CloseWindowStation
userenv.dll
CreateEnvironmentBlock, DestroyEnvironmentBlock, ExpandEnvironmentStringsForUserW
winsta.dll
WinStationFreeMemory, WinStationEnumerateW, WinStationQueryInformationW
