Import table
advapi32.dll
CreateServiceW, RegisterEventSourceW, CloseServiceHandle, OpenProcessToken, DeleteService, OpenThreadToken, OpenSCManagerW, StartServiceCtrlDispatcherW, SetThreadToken, OpenServiceW, RegCreateKeyExW, RegQueryValueExW, CreateProcessAsUserW, RegQueryInfoKeyW, DeregisterEventSource, RegDeleteKeyW, LookupPrivilegeValueW, ChangeServiceConfig2W, DuplicateTokenEx, ImpersonateLoggedOnUser, RegDeleteValueW, SetServiceStatus, RevertToSelf, RegOpenKeyExW, RegisterServiceCtrlHandlerW, ReportEventW, ControlService, RegEnumKeyExW, AdjustTokenPrivileges, RegCloseKey, RegSetValueExW
kernel32.dll
GetCommandLineW, FindResourceW, FreeLibrary, LoadResource, LoadLibraryExW, InterlockedDecrement, GetCurrentProcess, WaitForSingleObject, SetEvent, GetModuleHandleW, GetCurrentThread, InitializeCriticalSectionAndSpinCount, SizeofResource, LeaveCriticalSection, GetModuleFileNameW, MultiByteToWideChar, lstrlenW, RaiseException, GetLastError, GetProcAddress, EnterCriticalSection, CreateEventW, lstrcmpiW, OpenEventW, DeleteCriticalSection, GetCurrentThreadId, CloseHandle, GetProcessHeap, SetEndOfFile, CreateFileW, SetEnvironmentVariableA, CompareStringW, CreateFileA, SetStdHandle, WriteConsoleW, GetStringTypeW, LoadLibraryW, SetFilePointer, FlushFileBuffers, GetConsoleMode, GetConsoleCP, IsValidCodePage, GetOEMCP, ReadFile, GetACP, CreateProcessW, GetTickCount, InitializeCriticalSection, WideCharToMultiByte, TerminateProcess, GetModuleFileNameA, IsDebuggerPresent, OutputDebugStringA, GetCurrentProcessId, DebugBreak, GetTempPathA, InterlockedIncrement, InterlockedExchange, EncodePointer, DecodePointer, Sleep, UnhandledExceptionFilter, SetUnhandledExceptionFilter, HeapFree, HeapAlloc, VirtualProtect, VirtualAlloc, GetSystemInfo, VirtualQuery, HeapSetInformation, GetStartupInfoW, GetSystemTimeAsFileTime, ExitProcess, GetCPInfo, RtlUnwind, LCMapStringW, IsProcessorFeaturePresent, HeapCreate, WriteFile, GetStdHandle, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, SetLastError, HeapSize, HeapReAlloc, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, GetFileType, QueryPerformanceCounter
ole32.dll
CoTaskMemRealloc, CoAddRefServerProcess, CoReleaseServerProcess, CoTaskMemFree, CoTaskMemAlloc, CoCreateInstance
user32.dll
CharUpperW, CharNextW, MessageBoxW, PostThreadMessageW, LoadStringW
userenv.dll
DestroyEnvironmentBlock, CreateEnvironmentBlock, UnloadUserProfile
wtsapi32.dll
WTSEnumerateSessionsW, WTSFreeMemory, WTSQueryUserToken