RegEnumKeyExW, RegEnumValueW, RegCloseKey, RegQueryInfoKeyW, OpenProcessToken, GetTokenInformation, RevertToSelf, UnregisterTraceGuids, RegisterTraceGuidsW, GetTraceLoggerHandle, GetTraceEnableLevel, GetTraceEnableFlags, TraceEvent, RegDeleteValueW, RegOpenKeyExW, OpenThreadToken, ImpersonateLoggedOnUser, RegQueryValueExW, RegOpenCurrentUser, RegSetValueExW

SetUnhandledExceptionFilter, UnhandledExceptionFilter, TerminateProcess, InterlockedCompareExchange, InterlockedExchange, GetEnvironmentVariableW, ExpandEnvironmentStringsW, QueryPerformanceFrequency, QueryPerformanceCounter, LoadLibraryExW, FindNextFileW, FindClose, GetModuleHandleW, FindFirstFileW, SetWaitableTimer, CancelWaitableTimer, CreateWaitableTimerW, GetCurrentThread, IsDebuggerPresent, WaitForSingleObjectEx, SignalObjectAndWait, InterlockedDecrement, LeaveCriticalSection, EnterCriticalSection, DeleteCriticalSection, GetVersionExW, InitializeCriticalSection, GetModuleFileNameW, GetTempPathW, GetTempFileNameW, OpenThread, MoveFileExW, GetCurrentThreadId, GetCurrentProcessId, CreateEventW, GetSystemTimeAsFileTime, WaitForSingleObject, SetEvent, ResetEvent, InterlockedIncrement, MultiByteToWideChar, OpenProcess, CloseHandle, GetCurrentProcess, SetProcessWorkingSetSize, GlobalMemoryStatusEx, GetTickCount, WideCharToMultiByte, GetLastError, LoadLibraryW, GetProcAddress, FreeLibrary, LocalAlloc, LocalFree, Sleep

_GEN_eb8e633c3ab4c927bba1d52e54fb33c3, _GEN_8627bd7ba0bef2f5847d947918558fe7, _GEN_c4148204911652ba9f147ec773097246, _GEN_a7625fff027d4b131f5ba9b42fc4f0ab, _GEN_9eeb198c045c0436659a6401a06318eb, _GEN_dcecd362116e7027ffa2441ff29820da, _GEN_9c7c970d6bde134f0747181faaf69261, _GEN_07d714de1ceb4aa34c380e8a30326c95, _GEN_0e5f4fbbe60e6bae8e247b83925c9195, _GEN_f9e7fcb99d23d1fb068ea34053aa92ab, _GEN_96694474696b989db5327bc6cb97eac3, _GEN_bf3974fbc9ae168db51f67e0b94c1527, _GEN_65b0389add541f065fa9e4651d01e5ca, _GEN_98ce6461dd808cd8447b3be8060a1ab4, _GEN_981256b9611116cd9972bc4fd0e0ec51, _GEN_7a85517af819bbb7bae839dd8e026ed6, _GEN_06638a9ce2344123e5268129397a6169, _GEN_b038098bd47777c90de1b691db4b16c1, _GEN_26b4dfe2956e44f39ffdb6788436ef11, _GEN_c4786410fab28a03169f10f1f30f4938, _GEN_ebf31f17fc794a6efe36325af426838e, _GEN_ebaaa433b77136a40343429f6e453abd, _GEN_21a06064baf3239dfc43eb872e944eba, _GEN_a0c7f3253d1575f5976af95f6787eff9, _GEN_40570742163ebb0c74132864ba95ffeb, _GEN_58d6db86486af9e43762ae9d88ff1029, _GEN_1ab918171d5003f60115916e1b1b7f9c, _GEN_aa2d247dd009f1111afd935a90d557c6, _GEN_2ab4e3b1646cc16873ac5dccb1021fcf, _GEN_e4f14ea841887b6dd3d4da6c84d20033, _GEN_ff238350a409dae5445eed0bb1f7cd08, _GEN_88ce99429cdc64af711e94fdf6948d7e, _GEN_d547ce5de1b3fa5d92bb130c5b5240ec, _GEN_1ccf577be6d2aeb8139c5a393a00b544, _GEN_b45f0bce314da455269405013073dfaa, _GEN_93b86fbc2e8988c430e6126ec022a467, _GEN_6fd80b7c86c10f04a6731e5a384c323c, _GEN_ab3a77a6fd137043517645c8ff60b70b, _GEN_7273f418df42cf6deb0c1f69e73400c4, _GEN_b52b2bf1f8aea1f4643ffc55e504dae0, _GEN_8414e8e4a53f2c35063f0133d3f67660, _GEN_7d6cd930ed7bd94f3b8af5894dd842c1, _GEN_eaa20b07f1d5d62ae8f2b3be1496f1e9, _GEN_6dee4d7e80910ea310c3c2c377c7ba93, _GEN_22082618372f44c14179881ff248e6c8, _GEN_c529d087e0f8f49673854450902e276c, _GEN_bc0db22cb92513bafb709338643c3476, _GEN_1188c418ce92f1b1b73d3f3b820cbcb2

DllMain

DllMain

StringFromCLSID, CoTaskMemFree, CLSIDFromString

SHGetFolderPathW

SHDeleteKeyW

CharUpperBuffW, CharUpperBuffA, CharLowerBuffW, CharLowerBuffA

WTSQueryUserToken