CryptDestroyKey, OpenSCManagerW, OpenServiceW, QueryServiceStatus, ControlService, DeleteService, CloseServiceHandle, OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges, CryptEncrypt, CryptDecrypt, CryptDeriveKey, CryptReleaseContext, CryptHashData, CryptDestroyHash, CryptCreateHash, OpenThreadToken, SetThreadToken, SetKernelObjectSecurity, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, MakeSelfRelativeSD, GetLengthSid, InitializeAcl, AddAccessAllowedAce, AllocateAndInitializeSid, FreeSid, RegCloseKey

GetCurrentThread, GetCurrentThreadId, GetLocalTime, GetFileSizeEx, GetFileSize, FlushFileBuffers, FindClose, lstrlenA, GetUserDefaultLangID, MapViewOfFile, UnmapViewOfFile, GetCurrentProcess, GetCommandLineW, TerminateProcess, LocalAlloc, HeapAlloc, GetProcessHeap, GetVersion, GetSystemInfo, FileTimeToSystemTime, FileTimeToLocalFileTime, InterlockedExchange, GetModuleHandleA, SetEnvironmentVariableA, LocalFree, InitializeCriticalSectionAndSpinCount, MoveFileExW, FreeLibrary, VirtualAlloc, OpenProcess, ReadProcessMemory, VirtualFree, GetCurrentProcessId, DeviceIoControl, IsBadWritePtr, CreateThread, Sleep, SetLastError, InterlockedDecrement, TlsSetValue, InitializeCriticalSection, TlsGetValue, TlsAlloc, TlsFree, LoadLibraryA, IsBadReadPtr, SetFilePointer, WriteFile, SetEndOfFile, CloseHandle, EnterCriticalSection, ReadFile, GetLastError, LeaveCriticalSection, DeleteCriticalSection, HeapFree, SetStdHandle, HeapReAlloc, GetTickCount, QueryPerformanceCounter, GetModuleFileNameA, GetTimeZoneInformation, GetConsoleMode, GetConsoleCP, HeapDestroy, HeapCreate, PeekNamedPipe, GetFileInformationByHandle, GetFileType, SetHandleCount, GetStdHandle, ExitProcess, HeapSize, IsDebuggerPresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, VirtualQuery, IsProcessorFeaturePresent, GetOEMCP, GetACP, RtlUnwind, RaiseException, EncodePointer, DecodePointer, FindFirstFileExW, GetSystemTimeAsFileTime, GetCommandLineA, InterlockedIncrement, BackupSeek, BackupRead, Process32NextW, Process32FirstW, CreateToolhelp32Snapshot

CoGetClassObject, CoCreateInstance, CoInitializeEx, CoUninitialize, StringFromIID, StringFromGUID2, CoCreateGuid, CoTaskMemFree

EnumProcessModules, GetModuleFileNameExW, GetModuleInformation, EnumProcesses

SfcIsFileProtected

SHGetDesktopFolder, SHGetMalloc, SHGetSpecialFolderPathW, SHGetFolderPathW

PathFindFileNameW, PathIsFileSpecW, PathRemoveFileSpecW, PathIsNetworkPathW, PathAppendW, PathCombineW