AllocateLocallyUniqueId, RegOpenKeyExW, TraceEvent, GetTraceEnableFlags, GetTraceEnableLevel, RegOpenCurrentUser, RegEnumKeyExW, RegQueryInfoKeyW, RegEnumValueW, RegCloseKey, RegQueryValueExW, OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges, UnregisterTraceGuids, RegisterTraceGuidsW, GetTraceLoggerHandle, RegSetValueExW

CryptVerifyMessageSignature, CertCreateCertificateContext, CertFreeCertificateContext, CertVerifySubjectCertificateContext

EnterCriticalSection, QueryPerformanceFrequency, ExpandEnvironmentStringsW, LeaveCriticalSection, InterlockedIncrement, InterlockedDecrement, LoadLibraryExW, GetCurrentProcessId, QueryPerformanceCounter, IsDebuggerPresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, TerminateProcess, InterlockedCompareExchange, Sleep, InterlockedExchange, SetFilePointerEx, GetDriveTypeW, GetDiskFreeSpaceExW, GetTempPathW, GetTempFileNameW, WriteFile, SetEndOfFile, GetFileSizeEx, VirtualAlloc, SetFilePointer, FreeLibrary, VirtualFree, GetFileTime, SetFileAttributesW, MoveFileExW, MoveFileW, OpenProcess, IsWow64Process, GetEnvironmentVariableW, GetFileAttributesW, CreateFileW, CreateDirectoryW, DeleteCriticalSection, InitializeCriticalSection, GetModuleFileNameW, GetCurrentThread, GetCurrentThreadId, SetThreadPriority, GetThreadPriority, GetThreadTimes, GetTickCount, FindNextFileW, FindClose, GetSystemTimeAsFileTime, GetVersionExW, GetProcAddress, GetCurrentProcess, WideCharToMultiByte, MultiByteToWideChar, RemoveDirectoryW, FindFirstFileA, FindFirstFileW, DeleteFileW, CreateEventW, SetWaitableTimer, CancelWaitableTimer, SignalObjectAndWait, WaitForSingleObject, CloseHandle, CreateWaitableTimerW, WaitForSingleObjectEx, SetEvent, GetLastError, LocalFree, LocalAlloc, LoadLibraryW, ReadFile, DeviceIoControl

_GEN_7a85517af819bbb7bae839dd8e026ed6, _GEN_06638a9ce2344123e5268129397a6169, _GEN_b038098bd47777c90de1b691db4b16c1, _GEN_26b4dfe2956e44f39ffdb6788436ef11, _GEN_c4786410fab28a03169f10f1f30f4938, _GEN_ebf31f17fc794a6efe36325af426838e, _GEN_ebaaa433b77136a40343429f6e453abd, _GEN_21a06064baf3239dfc43eb872e944eba, _GEN_a0c7f3253d1575f5976af95f6787eff9, _GEN_40570742163ebb0c74132864ba95ffeb, _GEN_1ab918171d5003f60115916e1b1b7f9c, _GEN_aa2d247dd009f1111afd935a90d557c6, _GEN_1ce3cd4ca52f68627bcec75006c0ece6, _GEN_2ab4e3b1646cc16873ac5dccb1021fcf, _GEN_e4f14ea841887b6dd3d4da6c84d20033, _GEN_ff238350a409dae5445eed0bb1f7cd08, _GEN_88ce99429cdc64af711e94fdf6948d7e, _GEN_f005c1cd5daacc15030f18206be6a160, _GEN_d547ce5de1b3fa5d92bb130c5b5240ec, _GEN_1ccf577be6d2aeb8139c5a393a00b544, _GEN_b45f0bce314da455269405013073dfaa, _GEN_93b86fbc2e8988c430e6126ec022a467, _GEN_6fd80b7c86c10f04a6731e5a384c323c, _GEN_ab3a77a6fd137043517645c8ff60b70b, _GEN_7273f418df42cf6deb0c1f69e73400c4, _GEN_437a56643bac3af0b32aec824f65e314, _GEN_98ce6461dd808cd8447b3be8060a1ab4, _GEN_b52b2bf1f8aea1f4643ffc55e504dae0, _GEN_8414e8e4a53f2c35063f0133d3f67660, _GEN_7d6cd930ed7bd94f3b8af5894dd842c1, _GEN_22082618372f44c14179881ff248e6c8, _GEN_c529d087e0f8f49673854450902e276c, _GEN_bc0db22cb92513bafb709338643c3476, _GEN_1188c418ce92f1b1b73d3f3b820cbcb2, _GEN_dcecd362116e7027ffa2441ff29820da, _GEN_9eeb198c045c0436659a6401a06318eb, _GEN_a7625fff027d4b131f5ba9b42fc4f0ab, _GEN_c4148204911652ba9f147ec773097246, _GEN_8627bd7ba0bef2f5847d947918558fe7, _GEN_eb8e633c3ab4c927bba1d52e54fb33c3, _GEN_65b0389add541f065fa9e4651d01e5ca, _GEN_bf3974fbc9ae168db51f67e0b94c1527, _GEN_96694474696b989db5327bc6cb97eac3, _GEN_f9e7fcb99d23d1fb068ea34053aa92ab, _GEN_0e5f4fbbe60e6bae8e247b83925c9195, _GEN_07d714de1ceb4aa34c380e8a30326c95, _GEN_9c7c970d6bde134f0747181faaf69261

DllMain

DllMain

CoTaskMemFree, StringFromCLSID, CLSIDFromString

EnumProcesses, GetModuleFileNameExW, EnumProcessModules

SHGetFolderPathW

CharUpperBuffA, CharLowerBuffA, CharLowerBuffW, wsprintfW, CharUpperBuffW