OpenFileMappingW, MapViewOfFile, GetWindowsDirectoryW, HeapDestroy, QueueUserWorkItem, GetTempPathW, WriteFile, CreateFileA, CreateFileMappingW, SizeofResource, ReadFile, EnumResourceNamesW, LoadLibraryExW, GetVersionExW, FormatMessageW, SetLocaleInfoW, SetLocaleInfoA, PostQueuedCompletionStatus, GetLongPathNameW, GetFullPathNameW, GetProcessId, OpenMutexW, CreateMutexW, ReleaseMutex, WinExec, TerminateProcess, CreateProcessA, SetThreadPriority, ResumeThread, GetExitCodeProcess, OpenEventW, HeapFree, GetProcessHeap, HeapAlloc, VirtualAlloc, CreateThread, WaitForMultipleObjects, GetConsoleWindow, AllocConsole, SetConsoleTitleA, GetConsoleTitleA, GetConsoleTitleW, SetConsoleTitleW, GetStartupInfoW, FindResourceW, FindResourceA, LoadResource, LockResource, GetThreadTimes, MapViewOfFileEx, UnmapViewOfFile, GlobalFree, OpenThread, GlobalAddAtomW, GlobalSize, GlobalAlloc, GlobalLock, GlobalUnlock, GetCurrentThreadId, WideCharToMultiByte, GetSystemInfo, OpenProcess, Sleep, InitializeCriticalSection, MoveFileWithProgressW, ReplaceFileW, MoveFileExW, TryEnterCriticalSection, CreateFileW, DeleteFileW, GetCurrentThread, QueueUserAPC, GetEnvironmentStringsW, GetEnvironmentVariableW, GetSystemWindowsDirectoryW, GetFileAttributesW, CreateDirectoryW, SetEvent, InterlockedExchange, InterlockedCompareExchange, GetTickCount, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, TlsGetValue, TlsSetValue, TlsAlloc, VirtualFree, GetCurrentProcessId, VirtualProtect, GetCommandLineW, GetModuleFileNameW, SetEnvironmentVariableW, ExitProcess, CreateProcessW, WaitForSingleObject, LocalAlloc, LocalFree, GetSystemTimeAsFileTime, FreeLibrary, InterlockedDecrement, LoadLibraryW, ExpandEnvironmentStringsW, RaiseException, OutputDebugStringW, GetModuleHandleW, CreateEventW, CloseHandle, InterlockedIncrement, GetCurrentProcess, GetProcAddress, SetLastError, GetLastError, HeapCreate

NtOpenProcess, NtSetInformationJobObject, NtAssignProcessToJobObject, NtCreateJobObject, NtDuplicateObject, NtUnmapViewOfSection, NtMapViewOfSection, _strlwr, RtlUnwind, NtQuerySecurityObject, NtSetSecurityObject, NtSetInformationToken, NtAdjustPrivilegesToken, RtlConvertSidToUnicodeString, RtlCreateAcl, RtlAddAccessAllowedAceEx, RtlCreateSecurityDescriptor, RtlSetDaclSecurityDescriptor, RtlSetSaclSecurityDescriptor, sprintf, _vsnprintf, RtlNtStatusToDosError, NtQueryVirtualMemory, iswctype, NtYieldExecution, LdrLoadDll, LdrUnloadDll, LdrQueryImageFileExecutionOptions, NtLoadDriver, tolower, LdrQueryProcessModuleInformation, NtDeleteKey, NtEnumerateValueKey, NtQueryMultipleValueKey, NtNotifyChangeKey, NtNotifyChangeMultipleKeys, NtSaveKey, NtLoadKey, NtSetInformationKey, NtDeleteValueKey, NtQueryKey, NtCreatePort, NtSecureConnectPort, NtImpersonateClientOfPort, NtCreateEvent, NtOpenEvent, NtCreateMutant, NtOpenMutant, NtCreateSemaphore, NtOpenSemaphore, NtCreateSection, NtOpenSection, NtImpersonateAnonymousToken, NtImpersonateThread, NtOpenThreadToken, NtDuplicateToken, NtQueryInformationToken, NtOpenProcessToken, NtOpenThread, NtQueryInformationThread, RtlUnicodeStringToAnsiString, wcstoul, strchr, strncmp, RtlInitString, RtlAnsiStringToUnicodeString, RtlFreeUnicodeString, NtQueryInformationProcess, NtSetInformationThread, NtQueryAttributesFile, NtQueryFullAttributesFile, NtQueryInformationFile, NtSetInformationFile, NtCreateNamedPipeFile, NtCreateMailslotFile, NtFsControlFile, RtlGetFullPathName_U, RtlGetCurrentDirectory_U, RtlSetCurrentDirectory_U, NtQueryVolumeInformationFile, wcscmp, NtQuerySystemInformation, NtDeleteFile, NtReadFile, NtWriteFile, NtDeviceIoControlFile, NtCreateFile, NtOpenSymbolicLinkObject, NtQuerySymbolicLinkObject, NtOpenDirectoryObject, NtSetInformationProcess, NtQueryObject, _wtoi, NtOpenFile, NtQueryDirectoryFile, RtlCompareUnicodeString, wcsncpy, wcsrchr, wcstol, _wcslwr, NtEnumerateKey, wcsstr, LdrGetProcedureAddress, NtOpenKey, NtCreateKey, NtSetValueKey, wcsncmp, _wcsicmp, wcscat, wcschr, swprintf, _itow, memmove, NtQueryValueKey, towlower, wcslen, wcscpy, NtRequestWaitReplyPort, NtClose, RtlInitUnicodeString, NtConnectPort, NtRegisterThreadTerminatePort, strstr, _wcsnicmp