RegCreateKeyA, RegEnumKeyExA, RegEnumValueW, RegQueryValueExA, RegOpenKeyExA, RegQueryValueExW, RegEnumKeyExW, RegQueryInfoKeyW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, RegCreateKeyExW, RegOpenKeyExW, EqualSid, AllocateAndInitializeSid, GetTokenInformation, OpenProcessToken, RegSetValueExA, RegCreateKeyExA, SetServiceStatus, RegisterServiceCtrlHandlerExW, RegCreateKeyW, ConvertSidToStringSidW, LookupAccountNameW, GetLengthSid, IsValidSid, AddAccessAllowedAce, AddAccessDeniedAce, InitializeAcl, SetSecurityInfo, LookupAccountSidW, FreeSid

WideCharToMultiByte, GetACP, GetLocaleInfoA, GetVersionExW, GetCurrentThreadId, SetProcessWorkingSetSize, GetCurrentProcess, CloseHandle, WaitForSingleObject, SetEvent, OpenEventW, GetSystemDirectoryW, LocalFree, LocalAlloc, IsBadReadPtr, FindClose, FindNextFileW, FindFirstFileW, GlobalFree, GlobalAlloc, SetConsoleCtrlHandler, OpenProcess, GetTickCount, GetShortPathNameW, CreateEventW, WaitForMultipleObjects, TerminateThread, OpenThread, GetFileAttributesW, GetPrivateProfileStringA, GetPrivateProfileStructA, WritePrivateProfileStringA, WritePrivateProfileStructA, WriteFile, SetFilePointer, ReadFile, GetFileSize, CreateFileA, GetWindowsDirectoryA, CreateThread, GetThreadLocale, GetTempFileNameW, MoveFileExW, SetFileAttributesW, GetCurrentProcessId, CreateMutexW, RemoveDirectoryW, DeleteFileW, CreateDirectoryW, GetCurrentDirectoryW, CreateFileW, OutputDebugStringW, GetLocalTime, ReleaseMutex, CreateProcessW, HeapFree, GetProcessHeap, HeapAlloc, GetSystemPowerStatus, ResetEvent, SystemTimeToFileTime, FileTimeToLocalFileTime, FileTimeToSystemTime, CancelWaitableTimer, SetWaitableTimer, CreateWaitableTimerW, VerifyVersionInfoW, VerSetConditionMask, GetVersionExA, LoadLibraryA, GetSystemDirectoryA, GetShortPathNameA, Module32Next, Module32First, CreateToolhelp32Snapshot, FindFirstFileA, IsBadWritePtr, HeapReAlloc, HeapDestroy, SetThreadLocale, GetSystemTimeAsFileTime, LoadLibraryW, LoadLibraryExW, FindResourceW, LoadResource, SizeofResource, FreeLibrary, GetModuleFileNameW, lstrlenA, MultiByteToWideChar, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, lstrcmpiW, InterlockedDecrement, InterlockedIncrement, GetModuleHandleW, GetProcAddress, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, GetLastError, RaiseException, lstrlenW, HeapSize, EncodePointer, DecodePointer, InterlockedExchange, Sleep, InterlockedCompareExchange, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, IsProcessorFeaturePresent, QueryPerformanceCounter, CopyFileW

DllMain

DllMain

CoCreateInstance, CoInitializeEx, CoInitialize, CoCreateGuid, StringFromCLSID, CoGetClassObject, CoRegisterClassObject, CoRevokeClassObject, StringFromGUID2, CoTaskMemFree, CoTaskMemRealloc, CoTaskMemAlloc, CoUninitialize

CallNtPowerInformation

EnumProcesses, EnumProcessModules, GetModuleBaseNameW

NdrDllGetClassObject, NdrCStdStubBuffer_Release, NdrCStdStubBuffer2_Release, NdrDllRegisterProxy, NdrDllUnregisterProxy, NdrOleAllocate, NdrOleFree, IUnknown_QueryInterface_Proxy, IUnknown_AddRef_Proxy, IUnknown_Release_Proxy, CStdStubBuffer_QueryInterface, CStdStubBuffer_AddRef, CStdStubBuffer_Connect, CStdStubBuffer_Disconnect, CStdStubBuffer_Invoke, CStdStubBuffer_IsIIDSupported, CStdStubBuffer_CountRefs, CStdStubBuffer_DebugServerQueryInterface, NdrStubCall2, NdrStubForwardingFunction, CStdStubBuffer_DebugServerRelease, NdrDllCanUnloadNow

SHGetFolderPathW

SHCopyKeyW, PathAppendW, SHSetValueW, SHDeleteKeyW

GetWindowLongW, PostQuitMessage, UnregisterClassW, DestroyWindow, DefWindowProcW, GetSystemMetrics, CreateWindowExW, RegisterClassW, SetWindowLongW, PostMessageW, PostThreadMessageW, GetMessageW, TranslateMessage, DispatchMessageW, SetTimer, wsprintfW, RegisterWindowMessageW, PeekMessageW, MsgWaitForMultipleObjects, RegisterClassExW, CharNextW, KillTimer

LoadUserProfileW, CreateEnvironmentBlock, DestroyEnvironmentBlock

WinVerifyTrust

WTSEnumerateSessionsW, WTSFreeMemory