OpenProcessToken, DuplicateTokenEx, CreateProcessAsUserW

Server

GetModuleHandleW, WritePrivateProfileStringW, TerminateProcess, OutputDebugStringW, OpenProcess, LoadLibraryW, GetProcAddress, GetLastError, GetCurrentProcessId, FreeLibrary, CloseHandle, Sleep, ProcessIdToSessionId, UnmapViewOfFile, OpenFileMappingW, MapViewOfFile, CreateFileMappingW

@Madstrings@initialization$qqrv, @Madstrings@Finalization$qqrv, @Madtools@initialization$qqrv, @Madtools@Finalization$qqrv

@Maddisasm@initialization$qqrv, @Maddisasm@Finalization$qqrv

@Madexcept@initialization$qqrv, @Madexcept@Finalization$qqrv, @Madmapfile@initialization$qqrv, @Madmapfile@Finalization$qqrv, @Madstacktrace@initialization$qqrv, @Madstacktrace@Finalization$qqrv, @Madlinkdisasm@initialization$qqrv, @Madlinkdisasm@Finalization$qqrv, @Madlisthardware@initialization$qqrv, @Madlisthardware@Finalization$qqrv, @Madlistprocesses@initialization$qqrv, @Madlistprocesses@Finalization$qqrv, @Madlistmodules@initialization$qqrv, @Madlistmodules@Finalization$qqrv

@System@initialization$qqrv, @System@Finalization$qqrv, @System@RegisterModule$qqrp17System@TLibModule, @System@@UStrEqual$qqrv, @System@@UStrCatN$qqrv, @System@@UStrCat3$qqrr20System@UnicodeStringx20System@UnicodeStringt2, @System@@UStrCat$qqrr20System@UnicodeStringx20System@UnicodeString, @System@@WStrFromUStr$qqrr17System@WideStringx20System@UnicodeString, @System@@UStrFromWStr$qqrr20System@UnicodeStringx17System@WideString, @System@@UStrFromWArray$qqrr20System@UnicodeStringpbi, @System@@UStrFromPWChar$qqrr20System@UnicodeStringpb, @System@@UStrToPWChar$qqrx20System@UnicodeString, @System@@UStrAsg$qqrr20System@UnicodeStringx20System@UnicodeString, @System@@UStrArrayClr$qqrpvi, @System@@UStrClr$qqrpv, @System@@UStrAddRef$qqrpv, @System@@WStrArrayClr$qqrpvi, @System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%, @System@@LStrFromPWChar$qqrr27System@%AnsiStringT$us$i0$%pbus, @System@@LStrClr$qqrpv, @System@BeginThread$qqrpvuipqqrpv$it1uirui, @System@@Halt0$qqrv, @System@@StartExe$qqrp23System@PackageInfoTablep17System@TLibModule, @System@@DoneExcept$qqrv, @System@@HandleFinally$qqrv, @System@@HandleAnyException$qqrv, @System@@AfterConstruction$qqrp14System@TObject, @System@@ClassCreate$qqrp17System@TMetaClasso, @System@TObject@Dispatch$qqrpv, @System@TObject@BeforeDestruction$qqrv, @System@TObject@AfterConstruction$qqrv, @System@TObject@DefaultHandler$qqrpv, @System@TObject@ToString$qqrv, @System@TObject@SafeCallException$qqrp14System@TObjectpv, @System@TObject@GetHashCode$qqrv, @System@TObject@Equals$qqrp14System@TObject, @System@TObject@Free$qqrv, @System@TObject@FreeInstance$qqrv, @System@TObject@NewInstance$qqrv, @System@@FillChar$qqrpvib, @System@ParamStr$qqri, @Classes@initialization$qqrv, @Classes@Finalization$qqrv, @Classes@TDataModule@ReadState$qqrp15Classes@TReader, @Classes@TDataModule@DefineProperties$qqrp14Classes@TFiler, @Classes@TDataModule@DoDestroy$qqrv, @Classes@TDataModule@DoCreate$qqrv, @Classes@TDataModule@BeforeDestruction$qqrv, @Classes@TDataModule@AfterConstruction$qqrv, @Classes@TDataModule@$bctr$qqrp18Classes@TComponent, @Classes@TComponent@QueryInterface$qqsrx5_GUIDpv, @Classes@TComponent@UpdateRegistry$qqrox20System@UnicodeStringt2, @Classes@TComponent@SafeCallException$qqrp14System@TObjectpv, @Classes@TComponent@SetName$qqrx20System@UnicodeString, @Classes@TComponent@ValidateRename$qqrp18Classes@TComponentx20System@UnicodeStringt2, @Classes@TComponent@WriteState$qqrp15Classes@TWriter, @Classes@TComponent@Loaded$qqrv, @Classes@TComponent@Notification$qqrp18Classes@TComponent18Classes@TOperation, @Classes@TStringList@$bctr$qqrv, @Classes@TPersistent@AssignTo$qqrp19Classes@TPersistent, @Classes@TPersistent@Assign$qqrp19Classes@TPersistent, @Classes@TStringList@, @Typinfo@initialization$qqrv, @Typinfo@Finalization$qqrv, @Sysutils@initialization$qqrv, @Sysutils@Finalization$qqrv, @Sysutils@IncludeTrailingPathDelimiter$qqrx20System@UnicodeString, @Sysutils@ExtractFileName$qqrx20System@UnicodeString, @Sysutils@ExtractFileDir$qqrx20System@UnicodeString, @Sysutils@ExtractFilePath$qqrx20System@UnicodeString, @Sysutils@FileIsReadOnly$qqrx20System@UnicodeString, @Sysutils@FileSetAttr$qqrx20System@UnicodeStringi, @Sysutils@ForceDirectories$qqr20System@UnicodeString, @Sysutils@DirectoryExists$qqrx20System@UnicodeString, @Sysutils@IntToStr$qqrj, @Sysutils@WideUpperCase$qqrx17System@WideString, @Sysutils@SameText$qqrx20System@UnicodeStringt1, @Sysutils@LowerCase$qqrx20System@UnicodeString, @Sysutils@UpperCase$qqrx20System@UnicodeString, @Variants@initialization$qqrv, @Variants@Finalization$qqrv, @Varutils@initialization$qqrv, @Varutils@Finalization$qqrv, @Registry@initialization$qqrv, @Registry@Finalization$qqrv, @Inifiles@initialization$qqrv, @Inifiles@Finalization$qqrv, @Inifiles@TIniFile@UpdateFile$qqrv, @Inifiles@TIniFile@DeleteKey$qqrx20System@UnicodeStringt1, @Inifiles@TIniFile@EraseSection$qqrx20System@UnicodeString, @Inifiles@TIniFile@ReadSectionValues$qqrx20System@UnicodeStringp16Classes@TStrings, @Inifiles@TIniFile@ReadSection$qqrx20System@UnicodeStringp16Classes@TStrings, @Inifiles@TIniFile@ReadSections$qqrp16Classes@TStrings, @Inifiles@TIniFile@ReadString$qqrx20System@UnicodeStringt1t1, @Inifiles@TIniFile@$bdtr$qqrv, @Inifiles@TCustomIniFile@ReadSections$qqrx20System@UnicodeStringp16Classes@TStrings, @Inifiles@TCustomIniFile@WriteBinaryStream$qqrx20System@UnicodeStringt1p15Classes@TStream, @Inifiles@TCustomIniFile@ReadBinaryStream$qqrx20System@UnicodeStringt1p15Classes@TStream, @Inifiles@TCustomIniFile@ValueExists$qqrx20System@UnicodeStringt1, @Inifiles@TCustomIniFile@WriteBool$qqrx20System@UnicodeStringt1o, @Inifiles@TCustomIniFile@WriteTime$qqrx20System@UnicodeStringt116System@TDateTime, @Inifiles@TCustomIniFile@WriteFloat$qqrx20System@UnicodeStringt1d, @Inifiles@TCustomIniFile@WriteDateTime$qqrx20System@UnicodeStringt116System@TDateTime, @Inifiles@TCustomIniFile@WriteDate$qqrx20System@UnicodeStringt116System@TDateTime, @Inifiles@TCustomIniFile@ReadTime$qqrx20System@UnicodeStringt116System@TDateTime, @Inifiles@TCustomIniFile@ReadFloat$qqrx20System@UnicodeStringt1d, @Inifiles@TCustomIniFile@ReadDateTime$qqrx20System@UnicodeStringt116System@TDateTime, @Inifiles@TCustomIniFile@ReadDate$qqrx20System@UnicodeStringt116System@TDateTime, @Inifiles@TCustomIniFile@ReadBool$qqrx20System@UnicodeStringt1o, @Inifiles@TCustomIniFile@WriteInteger$qqrx20System@UnicodeStringt1i, @Inifiles@TCustomIniFile@ReadInteger$qqrx20System@UnicodeStringt1i, @Inifiles@TCustomIniFile@$bctr$qqrx20System@UnicodeString, @Inifiles@TIniFile@, @Syncobjs@initialization$qqrv, @Syncobjs@Finalization$qqrv, @Uxtheme@initialization$qqrv, @Uxtheme@Finalization$qqrv, @Multimon@initialization$qqrv, @Multimon@Finalization$qqrv, @Dwmapi@initialization$qqrv, @Dwmapi@Finalization$qqrv, @Helpintfs@initialization$qqrv, @Helpintfs@Finalization$qqrv, @Mapi@initialization$qqrv, @Mapi@Finalization$qqrv, @Flatsb@initialization$qqrv, @Flatsb@Finalization$qqrv, @System@Pos$qqrx20System@UnicodeStringt1, @System@@UStrCopy$qqrx20System@UnicodeStringii, @System@@UStrLen$qqrx20System@UnicodeString, @System@@UStrLAsg$qqrr20System@UnicodeStringx20System@UnicodeString, @System@@EnsureUnicodeString$qqrr20System@UnicodeString, @System@TObject@$bctr$qqrv, @System@Move$qqrpxvpvi, @Classes@TMemoryStream@LoadFromFile$qqrx20System@UnicodeString, @Classes@TCustomMemoryStream@SaveToFile$qqrx20System@UnicodeString, @Classes@TMemoryStream@, @Sysutils@ChangeFileExt$qqrx20System@UnicodeStringt1, @Sysutils@FileExists$qqrx20System@UnicodeString, @Sysutils@StrToInt$qqrx20System@UnicodeString

SHGetFolderLocation, SHGetPathFromIDListW

DestroyEnvironmentBlock, CreateEnvironmentBlock

@Svcmgr@initialization$qqrv, @Svcmgr@Finalization$qqrv, @Svcmgr@TServiceApplication@Installing$qqrv, @Svcmgr@TService@DoCustomControl$qqrui, @Svcmgr@TService@DoShutdown$qqrv, @Svcmgr@TService@DoInterrogate$qqrv, @Svcmgr@TService@DoContinue$qqrv, @Svcmgr@TService@DoPause$qqrv, @Svcmgr@TService@DoStop$qqrv, @Svcmgr@TService@DoStart$qqrv, @Svcmgr@TService@Controller$qqrui, @Svcmgr@TService@GetTerminated$qqrv, @Svcmgr@TService@$bdtr$qqrv, @Svcmgr@TService@$bctr$qqrp18Classes@TComponenti, @Svcmgr@TServiceThread@ProcessRequests$qqro, @Svcmgr@Application, @$xp$15Svcmgr@TService, @Svcmgr@TService@, @Dialogs@initialization$qqrv, @Dialogs@Finalization$qqrv, @Comctrls@initialization$qqrv, @Comctrls@Finalization$qqrv, @Actnlist@initialization$qqrv, @Actnlist@Finalization$qqrv, @Graphics@initialization$qqrv, @Graphics@Finalization$qqrv, @Themes@initialization$qqrv, @Themes@Finalization$qqrv, @Controls@initialization$qqrv, @Controls@Finalization$qqrv, @Controls@TWinControl@UpdateControlOriginalParentSize$qqrp17Controls@TControlr12Types@TPoint, @Controls@TWinControl@DockReplaceDockClient$qqrp17Controls@TControlp20Controls@TWinControlt115Controls@TAlignt1, @Controls@TWinControl@SetParentBackground$qqro, @Controls@TWinControl@CanAutoSize$qqrrit1, @Controls@TWinControl@AssignTo$qqrp19Classes@TPersistent, @Controls@TWinControl@ConstrainedResize$qqrrit1t1t1, @Controls@TWinControl@CanResize$qqrrit1, @Controls@TWinControl@GetClientOrigin$qqrv, @Controls@TWinControl@GetControlExtents$qqrv, @Controls@TWinControl@GetHandle$qqrv, @Controls@TWinControl@Repaint$qqrv, @Controls@TWinControl@Update$qqrv, @Controls@TWinControl@Invalidate$qqrv, @Controls@TWinControl@GetDeviceContext$qqrrp6HWND__, @Controls@TWinControl@ShowControl$qqrp17Controls@TControl, @Controls@TWinControl@SetBounds$qqriiii, @Controls@TWinControl@SetParentDoubleBuffered$qqro, @Controls@TWinControl@CustomAlignPosition$qqrp17Controls@TControlrit2t2t2r11Types@TRectrx19Controls@TAlignInfo, @Controls@TWinControl@CustomAlignInsertBefore$qqrp17Controls@TControlt1, @Controls@TWinControl@CreateHandle$qqrv, @Controls@TWinControl@DestroyWnd$qqrv, @Controls@TControl@InitiateAction$qqrv, @Controls@TControl@GetFloatingDockSiteClass$qqrv, @Controls@TControl@SetBiDiMode$qqr17Classes@TBiDiMode, @Controls@TControl@SetEnabled$qqro, @Controls@TControl@SetName$qqrx20System@UnicodeString, @Controls@TControl@SetAutoSize$qqro, @Controls@TControl@SetDragMode$qqr18Controls@TDragMode, @Controls@TControl@GetAction$qqrv, @Controls@TControl@GetEnabled$qqrv, @Controls@TControl@GetDragImages$qqrv, @Menus@initialization$qqrv, @Menus@Finalization$qqrv, @Forms@initialization$qqrv, @Forms@Finalization$qqrv, @Forms@TApplication@ProcessMessages$qqrv, @Forms@TCustomForm@QueryInterface$qqsrx5_GUIDpv, @Forms@TCustomForm@RequestAlign$qqrv, @Forms@TCustomForm@UpdateActions$qqrv, @Forms@TCustomForm@ShowModal$qqrv, @Forms@TCustomForm@SetFocus$qqrv, @Forms@TCustomForm@CloseQuery$qqrv, @Forms@TCustomForm@Resizing$qqr18Forms@TWindowState, @Forms@TCustomForm@PaintWindow$qqrp5HDC__, @Forms@TCustomForm@SetFocusedControl$qqrp20Controls@TWinControl, @Forms@TCustomForm@DefaultHandler$qqrpv, @Forms@TCustomForm@DestroyWindowHandle$qqrv, @Forms@TCustomForm@DestroyHandle$qqrv, @Forms@TCustomForm@CreateWindowHandle$qqrrx22Controls@TCreateParams, @Forms@TCustomForm@CreateWnd$qqrv, @Forms@TCustomForm@CreateParams$qqrr22Controls@TCreateParams, @Forms@TCustomForm@AlignControls$qqrp17Controls@TControlr11Types@TRect, @Forms@TCustomForm@WndProc$qqrr17Messages@TMessage, @Forms@TCustomForm@ValidateRename$qqrp18Classes@TComponentx20System@UnicodeStringt2, @Forms@TCustomForm@SetParent$qqrp20Controls@TWinControl, @Forms@TCustomForm@WantChildKey$qqrp17Controls@TControlr17Messages@TMessage, @Forms@TCustomForm@SetParentBiDiMode$qqro, @Forms@TCustomForm@GetFloating$qqrv, @Forms@TCustomForm@GetClientRect$qqrv, @Forms@TCustomForm@DefineProperties$qqrp14Classes@TFiler, @Forms@TCustomForm@ReadState$qqrp15Classes@TReader, @Forms@TCustomForm@Notification$qqrp18Classes@TComponent18Classes@TOperation, @Forms@TCustomForm@Loaded$qqrv, @Forms@TCustomForm@DoDestroy$qqrv, @Forms@TCustomForm@DoCreate$qqrv, @Forms@TCustomForm@$bdtr$qqrv, @Forms@TCustomForm@BeforeDestruction$qqrv, @Forms@TCustomForm@$bctr$qqrp18Classes@TComponenti, @Forms@TCustomForm@AfterConstruction$qqrv, @Forms@TCustomForm@$bctr$qqrp18Classes@TComponent, @Forms@TScrollingWinControl@AdjustClientRect$qqrr11Types@TRect, @Forms@TScrollingWinControl@AutoScrollInView$qqrp17Controls@TControl, @Forms@TScrollingWinControl@AutoScrollEnabled$qqrv, @Forms@Application, @$xp$11Forms@TForm, @Forms@TForm@, @Graphutil@initialization$qqrv, @Graphutil@Finalization$qqrv, @Extctrls@initialization$qqrv, @Extctrls@Finalization$qqrv, @Printers@initialization$qqrv, @Printers@Finalization$qqrv, @Clipbrd@initialization$qqrv, @Clipbrd@Finalization$qqrv, @Extactns@initialization$qqrv, @Extactns@Finalization$qqrv, @Extdlgs@initialization$qqrv, @Extdlgs@Finalization$qqrv, @Buttons@initialization$qqrv, @Buttons@Finalization$qqrv