Import table
advapi32.dll
RegCreateKeyExW, ConvertSidToStringSidW, ConvertStringSidToSidW, OpenThreadToken, ChangeServiceConfigW, QueryServiceConfigW, RegOpenKeyW, ConvertStringSecurityDescriptorToSecurityDescriptorW, RevertToSelf, RegOpenCurrentUser, ImpersonateLoggedOnUser, RegEnumKeyW, RegNotifyChangeKeyValue, CryptAcquireContextW, CryptCreateHash, CryptHashData, CryptGetHashParam, CryptDestroyHash, CryptReleaseContext, CheckTokenMembership, ChangeServiceConfig2W, RegisterServiceCtrlHandlerExW, StartServiceCtrlDispatcherW, RegQueryValueExW, SetServiceStatus, DeregisterEventSource, ReportEventW, RegisterEventSourceW, QueryServiceStatusEx, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, RegDeleteValueW, RegSetValueExW, RegEnumKeyExW, RegQueryInfoKeyW, RegDeleteKeyW, OpenSCManagerW, DeleteService, ControlService, StartServiceW, OpenServiceW, CloseServiceHandle, CreateServiceW, LookupAccountNameW, RegCloseKey, RegEnumValueW, RegOpenKeyExW, EqualSid, IsValidSid, FreeSid, AllocateAndInitializeSid, CreateProcessAsUserW, DuplicateTokenEx, GetTokenInformation, EnumServicesStatusExW, EnumDependentServicesW
kernel32.dll
DllMain
ntdll.dll
NtQueryObject, RtlUnwind
ole32.dll
CoCreateInstance, CoUninitialize, CoInitialize, CoTaskMemAlloc, CoInitializeSecurity, CoInitializeEx, StringFromGUID2, CoRevokeClassObject, CoRegisterClassObject, CoSuspendClassObjects, CoCreateFreeThreadedMarshaler, StringFromCLSID, CoRevertToSelf, CoImpersonateClient, CoTaskMemFree, CoResumeClassObjects, CoTaskMemRealloc, CLSIDFromString
psapi.dll
GetModuleBaseNameW, GetProcessImageFileNameW, GetModuleFileNameExW, EnumProcesses
shell32.dll
SHGetPathFromIDListW, SHGetFolderPathW, SHGetMalloc, SHGetFolderLocation, SHGetSpecialFolderLocation
shlwapi.dll
PathFindExtensionW, PathIsRelativeW, PathRemoveArgsW, PathSearchAndQualifyW, PathFileExistsW, PathIsRootW, PathCanonicalizeW, PathGetArgsW, PathStripPathW, PathRemoveBlanksW, StrCmpNIW, PathRemoveExtensionW, PathFindFileNameW, PathAppendW, PathRemoveFileSpecW, PathFindOnPathW, StrStrIW, PathAddBackslashW
user32.dll
LoadStringW, CharUpperW, CharNextW, wsprintfW, DispatchMessageW, TranslateMessage, GetMessageW, PostThreadMessageW
userenv.dll
DestroyEnvironmentBlock, CreateEnvironmentBlock
version.dll
GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
wtsapi32.dll
WTSQuerySessionInformationW, WTSCloseServer, WTSEnumerateSessionsW, WTSOpenServerW, WTSFreeMemory, WTSQueryUserToken