TraceMessage, GetTraceEnableFlags, GetTraceEnableLevel, GetTraceLoggerHandle, RegisterTraceGuidsW, UnregisterTraceGuids, RegCloseKey, RegQueryValueExW, RegOpenKeyExW, SetSecurityDescriptorDacl, SetEntriesInAclW, SetSecurityDescriptorGroup, SetSecurityDescriptorOwner, InitializeSecurityDescriptor, GetTokenInformation, OpenProcessToken, OpenThreadToken, RegNotifyChangeKeyValue, AdjustTokenPrivileges, CloseServiceHandle, OpenSCManagerW, RevertToSelf, ImpersonateLoggedOnUser, LogonUserW, OpenServiceW, RegSetValueExW, NotifyServiceStatusChangeW, AccessCheckAndAuditAlarmW, SetThreadToken, DuplicateTokenEx, AuditFree, AuditQuerySystemPolicy, QueryServiceStatus, CreateWellKnownSid, MakeSelfRelativeSD, MakeAbsoluteSD, CheckTokenMembership, QueryServiceConfigW, StartServiceW, DuplicateToken, LookupAccountSidW, AddAce, GetAce, InitializeAcl, CopySid, GetLengthSid, GetAclInformation, GetSecurityDescriptorDacl, LsaFreeMemory, LsaGetUserName, ControlTraceW, StartTraceW, EnableTrace, QueryTraceW, ReportEventW, DeregisterEventSource, RegisterEventSourceW, IsValidSecurityDescriptor, RegCreateKeyExW, RegConnectRegistryW, RegOpenCurrentUser, I_ScSendTSMessage, RegEnumKeyExW, RegDeleteKeyW, GetSecurityDescriptorLength, PerfSetCounterRefValue, PerfCreateInstance, PerfStopProvider, PerfSetCounterSetInfo, PerfStartProvider

SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetLastError

CloseHandle, DuplicateHandle

HeapSetInformation

InterlockedIncrement, InterlockedDecrement, InterlockedExchange, InterlockedCompareExchange

LoadStringW, GetModuleHandleW, GetProcAddress, FreeLibrary, GetModuleHandleA, LoadLibraryExA

RegNotifyChangeKeyValue, RegQueryValueExW, RegOpenKeyExW, RegSetValueExW, RegCloseKey

LocalAlloc, Sleep, LocalFree

OpenProcessToken, OpenThreadToken, GetCurrentThread, ProcessIdToSessionId, SetThreadToken, GetCurrentProcess, GetProcessId, GetCurrentThreadId, GetCurrentProcessId, TerminateProcess

QueryPerformanceCounter

WaitForSingleObject, OpenEventW, SetEvent, InitializeCriticalSection, OpenProcess, CreateEventW, WaitForMultipleObjectsEx, ResetEvent, DeleteCriticalSection

GetTickCount, GetSystemTimeAsFileTime, GetTickCount64

UnregisterWaitEx

SetSecurityDescriptorGroup, CopySid, InitializeSecurityDescriptor, GetTokenInformation, AdjustTokenPrivileges, SetSecurityDescriptorDacl, GetLengthSid, IsValidSid, DuplicateTokenEx, GetSecurityDescriptorLength, CreateWellKnownSid, MakeSelfRelativeSD, MakeAbsoluteSD, CheckTokenMembership, DuplicateToken, AddAce, GetAce, InitializeAcl, GetAclInformation, GetSecurityDescriptorDacl, RevertToSelf, ImpersonateLoggedOnUser, AccessCheckAndAuditAlarmW, IsValidSecurityDescriptor, EqualSid, SetSecurityDescriptorOwner

OpenSCManagerW, OpenServiceW, StartServiceW, CloseServiceHandle

QueryServiceConfigW, NotifyServiceStatusChangeW

QueryServiceStatus, I_ScSendTSMessage

QueueUserWorkItem, GetComputerNameW, WaitForMultipleObjects, RegisterWaitForSingleObject, LoadLibraryW, DelayLoadFailureHook, HeapAlloc, GetProcessHeap, HeapFree, ExpandEnvironmentStringsW, SetLastError, OutputDebugStringA, RtlCaptureStackBackTrace, LocalSize, SleepEx, GetVersionExW, CreateProcessW, DebugBreak, IsDebuggerPresent, GetSystemDirectoryW, RegCreateKeyExW, RegOpenCurrentUser, RegEnumKeyExW, VerifyVersionInfoW, VerSetConditionMask, LocalAlloc, UnhandledExceptionFilter, TerminateProcess, GetSystemTimeAsFileTime, GetCurrentProcessId, GetCurrentThreadId, GetTickCount, QueryPerformanceCounter, GetModuleHandleA, FormatMessageW, DeleteCriticalSection, GetProcAddress, InitializeCriticalSection, InterlockedCompareExchange, GetProcessId, UnregisterWaitEx, OpenProcess, DuplicateHandle, InterlockedExchange, ProcessIdToSessionId, HeapSetInformation, SetUnhandledExceptionFilter, CreateEventW, WaitForSingleObject, Sleep, InterlockedDecrement, InterlockedIncrement, WaitForMultipleObjectsEx, GetCurrentThread, GetCurrentProcess, CloseHandle, LocalFree, ResetEvent, OpenEventW, GetLastError, SetEvent, FreeLibrary

DllMain

NtDelayExecution, RtlUnhandledExceptionFilter, EtwUnregisterTraceGuids, EtwRegisterTraceGuidsW, EtwGetTraceLoggerHandle, EtwGetTraceEnableLevel, EtwGetTraceEnableFlags, EtwTraceMessage, EtwEventWrite, RtlInitializeResource, EtwEventUnregister, RtlDeleteResource, NtNotifyChangeSession, RtlInsertElementGenericTable, RtlLookupElementGenericTable, RtlDeleteElementGenericTable, NtOpenEvent, RtlInitUnicodeString, RtlInitializeGenericTable, RtlEnumerateGenericTable, NtOpenSession, NtSetSystemInformation, NtQuerySystemTime, NtFreeVirtualMemory, NtAllocateVirtualMemory, RtlConnectToSm, RtlSendMsgToSm, NtDuplicateToken, RtlRaiseException, RtlAcquireResourceExclusive, RtlAcquireResourceShared, RtlReleaseResource, NtQuerySystemInformation, RtlEqualSid, NtSetSecurityObject, NtQuerySecurityObject, NtOpenSymbolicLinkObject, NtQueryDirectoryObject, NtCreateDirectoryObject, NtQueryValueKey, NtOpenKey, NtDuplicateObject, NtQueryInformationProcess, RtlMapGenericMask, RtlGetAce, RtlQueryInformationAcl, RtlGetDaclSecurityDescriptor, RtlCreateUserSecurityObject, RtlGetOwnerSecurityDescriptor, RtlDeleteAce, RtlSetGroupSecurityDescriptor, RtlCopySecurityDescriptor, RtlGetGroupSecurityDescriptor, NtTerminateProcess, NtWaitForSingleObject, RtlPrefixUnicodeString, NtClose, NtCreateEvent, RtlNumberGenericTableElements, RtlFreeSid, RtlSetDaclSecurityDescriptor, RtlAddAccessAllowedAce, RtlCreateAcl, RtlCreateSecurityDescriptor, RtlLengthSid, RtlAllocateAndInitializeSid, NtCreatePort, NtCompleteConnectPort, NtAcceptConnectPort, NtReplyPort, DbgPrint, NtOpenProcess, NtCreateSection, NtReplyWaitReceivePort, RtlNtStatusToDosError, NtQueryLicenseValue, RtlLeaveCriticalSection, RtlEnterCriticalSection, RtlAdjustPrivilege, NtQueryInformationToken, EtwEventRegister, DbgBreakPoint

RpcServerTestCancel, NdrAsyncServerCall, NdrServerCall2, RpcImpersonateClient, RpcRevertToSelf, I_RpcMapWin32Status, UuidCreate, UuidToStringW, RpcAsyncCompleteCall, RpcServerSubscribeForNotification, RpcServerInqCallAttributesW, RpcServerInqDefaultPrincNameW, RpcServerRegisterAuthInfoW, RpcServerUnsubscribeForNotification, I_RpcBindingIsClientLocal, I_RpcBindingInqLocalClientPID, RpcServerUseProtseqEpW, RpcServerRegisterIfEx, RpcServerListen, RpcBindingToStringBindingW, RpcStringBindingParseW, RpcMgmtWaitServerListen, RpcStringFreeW, UuidFromStringW

SysNotifyStartServer

WmsgSendMessage