OpenFileMappingW, MapViewOfFile, GetWindowsDirectoryW, HeapDestroy, QueueUserWorkItem, GlobalSize, GetTempPathW, CreateDirectoryW, WriteFile, CreateFileA, GlobalAlloc, LoadLibraryExW, GetVersionExW, FormatMessageW, SetLocaleInfoW, SetLocaleInfoA, GetLongPathNameW, GetFileAttributesW, OpenMutexW, CreateMutexW, ReleaseMutex, WinExec, CreateProcessA, GetCurrentDirectoryW, GetEnvironmentStringsW, SetThreadPriority, ResumeThread, GetExitCodeProcess, OpenEventW, CreateThread, GetConsoleWindow, SetConsoleTitleA, SetConsoleTitleW, GetConsoleTitleA, GetConsoleTitleW, WaitForMultipleObjects, MoveFileWithProgressW, ReplaceFileW, MoveFileExW, TryEnterCriticalSection, DeleteFileW, GetCurrentThread, QueueUserAPC, GetEnvironmentVariableW, SetEnvironmentVariableW, InterlockedCompareExchange, GetTickCount, GetCurrentProcessId, GetCurrentProcess, CreateFileMappingW, UnmapViewOfFile, MapViewOfFileEx, SizeofResource, ReadFile, EnumResourceNamesW, SetEvent, HeapFree, GetProcessHeap, HeapAlloc, VirtualFree, VirtualAlloc, FindResourceW, FindResourceA, LoadResource, LockResource, GetCurrentThreadId, OpenThread, GetThreadTimes, GlobalAddAtomW, WideCharToMultiByte, GetSystemInfo, InterlockedExchange, OpenProcess, InitializeCriticalSection, CreateFileW, GetSystemWindowsDirectoryW, VirtualProtect, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, TlsGetValue, TlsSetValue, TlsAlloc, GetCommandLineW, Sleep, ExitProcess, GlobalLock, GlobalUnlock, GlobalFree, GetModuleFileNameW, SetCurrentDirectoryW, GetFullPathNameW, GetPrivateProfileStringW, CreateProcessW, WaitForSingleObject, LocalAlloc, LocalFree, GetSystemTimeAsFileTime, FreeLibrary, InterlockedDecrement, ExpandEnvironmentStringsW, RaiseException, OutputDebugStringW, GetModuleHandleW, CreateEventW, CloseHandle, InterlockedIncrement, GetProcAddress, SetLastError, LoadLibraryW, GetLastError, HeapCreate, DefineDosDeviceW, DefineDosDeviceA

NtOpenThread, NtOpenProcess, RtlConvertSidToUnicodeString, NtDuplicateObject, wcscmp, RtlUnwind, NtQuerySecurityObject, NtSetSecurityObject, NtSetInformationToken, NtAdjustPrivilegesToken, RtlCreateAcl, RtlAddAccessAllowedAceEx, RtlCreateSecurityDescriptor, RtlSetDaclSecurityDescriptor, RtlSetSaclSecurityDescriptor, RtlCreateProcessParameters, LdrGetProcedureAddress, RtlFreeAnsiString, NtQueryObject, NtQueryVirtualMemory, LdrLoadDll, LdrUnloadDll, NtLoadDriver, NtTestAlert, NtFlushInstructionCache, LdrQueryProcessModuleInformation, NtRaiseHardError, NtProtectVirtualMemory, NtDeleteKey, NtEnumerateValueKey, NtQueryMultipleValueKey, NtNotifyChangeKey, NtNotifyChangeMultipleKeys, NtSaveKey, NtSetInformationKey, NtDeleteValueKey, NtQueryKey, NtCreatePort, NtImpersonateClientOfPort, NtCreateEvent, NtOpenEvent, NtCreateMutant, NtOpenMutant, NtCreateSemaphore, NtOpenSemaphore, NtOpenSection, NtOpenThreadToken, NtSetInformationThread, NtDuplicateToken, NtOpenDirectoryObject, NtQueryAttributesFile, NtSetInformationFile, NtCreateNamedPipeFile, NtCreateMailslotFile, NtFsControlFile, RtlGetCurrentDirectory_U, RtlSetCurrentDirectory_U, NtQueryVolumeInformationFile, RtlGetFullPathName_U, NtQuerySystemInformation, NtDeleteFile, NtCreateFile, NtQueryFullAttributesFile, NtOpenSymbolicLinkObject, NtQuerySymbolicLinkObject, NtQueryDirectoryFile, RtlCompareUnicodeString, NtQueryInformationToken, NtOpenProcessToken, NtLoadKey, NtQueryInformationFile, _strlwr, NtCreateSection, NtMapViewOfSection, NtUnmapViewOfSection, RtlNtStatusToDosError, strstr, _wtoi, sprintf, _vsnprintf, NtOpenFile, NtDeviceIoControlFile, NtWriteFile, NtReadFile, wcsncpy, RtlUnicodeStringToAnsiString, RtlInitString, RtlAnsiStringToUnicodeString, RtlFreeUnicodeString, NtQueryInformationProcess, strncmp, strchr, wcstol, _wcslwr, wcsstr, wcsrchr, iswctype, NtEnumerateKey, NtOpenKey, NtCreateKey, NtSetValueKey, wcsncmp, _wcsicmp, wcscat, wcschr, swprintf, _itow, memmove, NtQueryValueKey, towlower, wcslen, wcscpy, NtRequestWaitReplyPort, NtClose, RtlInitUnicodeString, NtConnectPort, NtRegisterThreadTerminatePort, NtSetInformationProcess, _wcsnicmp, NtYieldExecution, tolower