ReportEventA, RegisterEventSourceW, OpenThreadToken, SetThreadToken, OpenProcessToken, SetServiceStatus, RegisterServiceCtrlHandlerA, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, GetLengthSid, RevertToSelf, StartTraceW, QueryTraceW, RegOpenKeyExW, TraceEvent, ReportEventW, GetUserNameW, RegCloseKey, DeregisterEventSource, RegSetValueExW, RegDeleteValueW, AddAccessAllowedAceEx, InitializeAcl, GetTokenInformation

SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetLastError

CloseHandle

InterlockedCompareExchange, InterlockedExchange

LoadLibraryExA, GetProcAddress, FreeLibrary

Sleep

GetCurrentProcessId, GetCurrentThreadId, TerminateProcess, GetCurrentProcess

QueryPerformanceCounter

SetEvent, CreateEventA

GetTickCount, GetSystemTimeAsFileTime

UnregisterWaitEx

InitializeSecurityDescriptor, SetSecurityDescriptorDacl

SetServiceStatus

RegisterServiceCtrlHandlerA

SetUnhandledExceptionFilter, TerminateProcess, UnhandledExceptionFilter, CreateEventA, GetLastError, DisableThreadLibraryCalls, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, GetSystemWindowsDirectoryW, CloseHandle, GetPrivateProfileIntW, lstrcatW, GetSystemDirectoryW, InterlockedCompareExchange, SetLastError, SetEvent, MapViewOfFile, CreateFileMappingW, CreateFileW, ExpandEnvironmentStringsW, lstrcpyW, CreateEventW, GetComputerNameW, ReleaseMutex, InterlockedDecrement, CreateMutexW, GetUserDefaultUILanguage, WaitForSingleObject, GetModuleFileNameW, UnmapViewOfFile, InterlockedIncrement, lstrlenW, GetSystemTime, ResetEvent, GetFileSize, GetFileTime, SearchPathW, CreateThread, GetCurrentProcess, lstrcpynW, GetCurrentThread, lstrlenA, lstrcpyA, FindClose, FindNextFileW, lstrcmpiW, FindFirstFileExW, MoveFileW, DeleteFileW, CopyFileW, FreeLibrary, GetProcAddress, LoadLibraryExW, SetErrorMode, LocalAlloc, LocalFree, lstrcmpiA, SetFileInformationByHandle, RegKrnGetGlobalState, UnregisterWait, DelayLoadFailureHook, HeapFree, HeapSize, GetProcessHeap, HeapAlloc, RegCloseKey, RegOpenKeyExW, InitializeCriticalSection, RegSetValueExW, CreateMutexA, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, Wow64RevertWow64FsRedirection, LockResource, LoadResource, SizeofResource, FindResourceExW, Wow64DisableWow64FsRedirection, IsWow64Process, HeapReAlloc, DosDateTimeToFileTime, FileTimeToDosDateTime

DllMain

RtlFreeHeap, RtlSetGroupSecurityDescriptor, RtlGetGroupSecurityDescriptor, RtlSetOwnerSecurityDescriptor, RtlLengthSid, RtlGetOwnerSecurityDescriptor, RtlGetAce, RtlQueryInformationAcl, RtlGetDaclSecurityDescriptor, RtlAllocateHeap, NtQuerySecurityObject, NtQueryKey, RtlReleaseResource, RtlAcquireResourceExclusive, NtClose, NtOpenKey, NtSetInformationThread, NtOpenThreadToken, RtlInitUnicodeStringEx, NtQueryValueKey, RtlInitializeResource, NtAccessCheck, RtlAcquireResourceShared, RtlCompareUnicodeString, RtlNtStatusToDosError, NtCreateKey, RtlAllocateAndInitializeSid, RtlValidRelativeSecurityDescriptor, RtlCreateSecurityDescriptor, RtlOpenCurrentUser, RtlLengthRequiredSid, NtOpenFile, RtlDosPathNameToNtPathName_U, NtSaveKey, NtCreateFile, NtSaveKeyEx, NtQueryMultipleValueKey, NtLoadKey, NtUnloadKey, NtReplaceKey, NtSetValueKey, RtlInitUnicodeString, NtSetSecurityObject, NtEnumerateValueKey, NtEnumerateKey, NtDeleteValueKey, NtDeleteKey, RtlGetVersion, NtWaitForSingleObject, RtlFreeUnicodeString, NtQueryInformationThread, RtlCreateUnicodeString, RtlCopyUnicodeString, RtlReAllocateHeap, NtQueryPerformanceCounter, RtlUnicodeToMultiByteN, RtlCreateUnicodeStringFromAsciiz, NtWaitForMultipleObjects, RtlAppendUnicodeStringToString, NtReadFile, NtQueryInformationFile, NtWriteFile, RtlMakeSelfRelativeSD, RtlLengthSecurityDescriptor, RtlValidSecurityDescriptor, RtlCreateAcl, RtlAddAccessAllowedAce, RtlSetDaclSecurityDescriptor, RtlFreeSid, NtRestoreKey, NtFlushKey, DbgPrint, RtlDeleteResource, NtCreateKeyTransacted, NtOpenKeyEx, NtOpenKeyTransactedEx, NtOpenKeyTransacted, RtlReleaseRelativeName, RtlDosPathNameToRelativeNtPathName_U, EtwLogTraceEvent, RtlGetThreadPreferredUILanguages, RtlInitializeCriticalSection, RtlDeleteCriticalSection, RtlLeaveCriticalSection, RtlEnterCriticalSection, RtlIntegerToUnicodeString, RtlDllShutdownInProgress, NtQueryInformationProcess, RtlAddAccessAllowedAceEx, NtQueryInformationToken, NtOpenProcessToken

RpcImpersonateClient, RpcRevertToSelf, NdrServerCall2, NdrClientCall2, RpcBindingFree, RpcStringBindingComposeW, RpcBindingFromStringBindingW, RpcStringFreeW, RpcServerRegisterAuthInfoA, RpcServerUnregisterIf, RpcServerUseProtseqEpW, RpcServerRegisterIfEx