CreateProcessAsUserW, ConvertSecurityDescriptorToStringSecurityDescriptorW, DuplicateTokenEx, RegisterServiceCtrlHandlerExW, SetServiceStatus, RegDeleteKeyExW, GetSecurityDescriptorDacl, GetExplicitEntriesFromAclW, GetSecurityDescriptorControl, CheckTokenMembership, GetTokenInformation, CopySid, RegGetKeySecurity, RegSetKeySecurity, RegQueryInfoKeyW, AllocateAndInitializeSid, IsValidSid, FreeSid, SetEntriesInAclW, SetSecurityDescriptorOwner, SetSecurityDescriptorGroup, SetSecurityDescriptorControl, MakeSelfRelativeSD, RegDeleteTreeW, IsValidSecurityDescriptor, GetSecurityDescriptorLength, ConvertStringSecurityDescriptorToSecurityDescriptorW, ImpersonateLoggedOnUser, RevertToSelf, I_ScValidatePnPService, GetTraceEnableFlags, TraceMessage, GetLengthSid, InitializeAcl, AddAccessAllowedAceEx, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, RegisterEventSourceW, ReportEventW, DeregisterEventSource, I_ScSendPnPMessage, RegEnumValueW, RegEnumKeyExW, RegDeleteKeyW, AdjustTokenPrivileges, ConvertStringSidToSidW, OpenThreadToken, PrivilegeCheck, PrivilegedServiceAuditAlarmW, MapGenericMask, AccessCheckAndAuditAlarmW, RegSetValueExW, RegDeleteValueW, RegQueryValueExW, RegCloseKey, RegOpenKeyExW, RegCreateKeyExW, UnregisterTraceGuids, RegisterTraceGuidsW, GetTraceLoggerHandle, GetTraceEnableLevel

ResolveDelayLoadedAPI, DelayLoadFailureHook

UnhandledExceptionFilter, SetUnhandledExceptionFilter, SetLastError, GetLastError, RaiseException, SetErrorMode

RaiseException, SetLastError, GetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter

FindFirstFileW, WriteFile, ReadFile, GetLogicalDrives, FindClose, FileTimeToSystemTime, FileTimeToLocalFileTime, CreateFileW, FlushFileBuffers, SetFilePointer, GetFileSize, DeleteFileW, GetFileInformationByHandle, FindNextFileW, CompareFileTime, SetEndOfFile, CreateDirectoryW, GetFileAttributesW, GetFullPathNameW, SetFileAttributesW

CreateDirectoryW, GetFileAttributesW, GetFullPathNameW, FindNextFileW, SetEndOfFile, FileTimeToSystemTime, FileTimeToLocalFileTime, CreateFileW, FindFirstFileW, FindClose, WriteFile, GetFileSize, FlushFileBuffers, SetFilePointer, GetFileInformationByHandle, DeleteFileW, SetFileAttributesW

CreateFileW, FileTimeToLocalFileTime, SetEndOfFile, GetFullPathNameW, GetFileAttributesW, CreateDirectoryW, FlushFileBuffers, FindFirstFileW, FindClose, WriteFile, GetFileSize, FindNextFileW, SetFilePointer, GetFileInformationByHandle, DeleteFileW, SetFileAttributesW

SetEndOfFile, CreateDirectoryW, FindFirstFileW, FindClose, FileTimeToLocalFileTime, WriteFile, GetFileSize, FlushFileBuffers, SetFilePointer, GetFileInformationByHandle, DeleteFileW, GetFileAttributesW, GetFullPathNameW, SetFileAttributesW, FindNextFileW, CreateFileW

MoveFileExW, CreateHardLinkW

DuplicateHandle, CloseHandle

HeapAlloc, HeapReAlloc, HeapFree, GetProcessHeap

HeapAlloc, HeapReAlloc, HeapFree, GetProcessHeap

InterlockedCompareExchange, InterlockedExchange

InterlockedExchange, InterlockedCompareExchange

InterlockedCompareExchange, InterlockedExchange

DeviceIoControl, GetOverlappedResult

DeviceIoControl, GetOverlappedResult, CancelIo

GetProcAddress, FreeLibrary, DisableThreadLibraryCalls, LoadLibraryExA, GetModuleFileNameA, LoadLibraryExW, LoadStringW

GetProcAddress, GetModuleFileNameA, DisableThreadLibraryCalls

GetModuleFileNameA, DisableThreadLibraryCalls

LCMapStringW

LCMapStringW

LCMapStringW

LCMapStringW

RegSetValueExW, RegDeleteTreeW, RegDeleteValueW, RegEnumKeyExW, RegEnumValueW, RegQueryInfoKeyW, RegSetKeySecurity, RegGetKeySecurity, RegCloseKey, RegQueryValueExW, RegCreateKeyExW, RegDeleteKeyExW, RegOpenKeyExW

MapViewOfFile, UnmapViewOfFile, CreateFileMappingW

CreateFileMappingW, MapViewOfFile, UnmapViewOfFile

UnmapViewOfFile, MapViewOfFile, CreateFileMappingW

lstrlenW, Sleep, LocalFree, lstrcmpiW, lstrlenA, lstrcmpW, FormatMessageW, LocalAlloc

ConnectNamedPipe, PeekNamedPipe, CreateNamedPipeW, CreatePipe

ExpandEnvironmentStringsW, GetCommandLineA

GetCommandLineA

GetCommandLineA

CreateProcessW, QueueUserAPC, GetCurrentProcess, GetCurrentThreadId, CreateProcessAsUserW, GetExitCodeProcess, CreateThread, OpenThreadToken, GetCurrentThread, ProcessIdToSessionId, SetThreadPriority, GetCurrentProcessId, TerminateProcess

TerminateProcess, GetCurrentThread, OpenThreadToken, ProcessIdToSessionId, QueueUserAPC, GetCurrentProcess, CreateThread, GetExitCodeProcess, GetCurrentThreadId, CreateProcessW, GetCurrentProcessId, IsProcessorFeaturePresent, CreateProcessAsUserW

GetCurrentThreadId, CreateProcessW, GetExitCodeProcess, TerminateProcess, GetCurrentProcessId, GetCurrentThread, OpenThreadToken, ProcessIdToSessionId, QueueUserAPC, CreateThread, GetCurrentProcess

QueryPerformanceCounter

RegCloseKey, RegOpenKeyExW, RegSetValueExW, RegQueryValueExW, RegDeleteTreeW, RegCreateKeyExW, RegGetKeySecurity, RegSetKeySecurity, RegDeleteKeyExW, RegQueryInfoKeyW, RegEnumKeyExW, RegEnumValueW

WideCharToMultiByte, CompareStringOrdinal, CompareStringW

lstrcmpW, lstrlenA, lstrlenW

InitializeCriticalSection, DeleteCriticalSection, WaitForSingleObjectEx, CreateEventW, InitializeSRWLock, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, ReleaseSRWLockShared, AcquireSRWLockShared, OpenEventW, SetEvent, WaitForMultipleObjectsEx, ReleaseMutex, ResetEvent, LeaveCriticalSection, EnterCriticalSection, OpenProcess, CreateMutexW

SetEvent, Sleep, WaitForSingleObjectEx, OpenEventW, CreateMutexW, CreateEventW, LeaveCriticalSection, EnterCriticalSection, ReleaseMutex, ResetEvent, WaitForMultipleObjectsEx, InitializeCriticalSection, DeleteCriticalSection, AcquireSRWLockExclusive, ReleaseSRWLockExclusive, InitializeSRWLock

EnterCriticalSection, CreateMutexW, OpenEventW, ResetEvent, Sleep, SetEvent, WaitForSingleObjectEx, CreateEventW, LeaveCriticalSection, InitializeCriticalSection, DeleteCriticalSection, WaitForMultipleObjectsEx, ReleaseMutex, SleepEx

GetSystemDirectoryW, GetSystemInfo, SystemTimeToFileTime, GetSystemTime, GetTickCount, GetSystemWindowsDirectoryW, GetVersionExW, GetLocalTime, GetSystemTimeAsFileTime

GetTickCount, GetSystemTimeAsFileTime, GetLocalTime, GetVersionExW, GetSystemWindowsDirectoryW, SystemTimeToFileTime, GetSystemTime, GetSystemDirectoryW, GetSystemInfo

GetSystemTimeAsFileTime, GetTickCount, GetLocalTime, GetVersionExW, GetSystemWindowsDirectoryW, GetSystemTime, GetSystemDirectoryW, GetSystemInfo

GetSystemInfo, GetSystemDirectoryW, GetSystemTime, GetSystemWindowsDirectoryW, GetLocalTime, GetTickCount, GetSystemTimeAsFileTime

CreateTimerQueue, DeleteTimerQueueTimer, DeleteTimerQueueEx, CreateTimerQueueTimer, RegisterWaitForSingleObjectEx, UnregisterWaitEx

UnregisterWaitEx, CreateThreadpoolTimer, CloseThreadpoolTimer, WaitForThreadpoolTimerCallbacks, SetThreadpoolTimer, QueueUserWorkItem, RegisterWaitForSingleObjectEx

CloseThreadpoolTimer, WaitForThreadpoolTimerCallbacks, SetThreadpoolTimer, CreateThreadpoolTimer

UnregisterWaitEx, QueueUserWorkItem

RegisterWaitForSingleObjectEx

SystemTimeToFileTime, FileTimeToSystemTime

lstrlenA, LocalFree, lstrlenW, lstrcmpW

DuplicateTokenEx, CheckTokenMembership, AllocateAndInitializeSid, GetTokenInformation, CopySid, GetSecurityDescriptorControl, IsValidSid, MakeSelfRelativeSD, IsValidSecurityDescriptor, GetSecurityDescriptorLength, AdjustTokenPrivileges, PrivilegeCheck, PrivilegedServiceAuditAlarmW, MapGenericMask, AccessCheckAndAuditAlarmW, FreeSid, SetSecurityDescriptorOwner, SetSecurityDescriptorGroup, GetSecurityDescriptorDacl, SetSecurityDescriptorControl, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, AddAccessAllowedAceEx, InitializeAcl, GetLengthSid

MapGenericMask, AccessCheckAndAuditAlarmW, GetTokenInformation, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, AddAccessAllowedAceEx, InitializeAcl, DuplicateTokenEx, GetLengthSid

RegisterServiceCtrlHandlerExW, SetServiceStatus

SetServiceStatus, RegisterServiceCtrlHandlerExW

OpenServiceW, OpenSCManagerW, CloseServiceHandle

QueryServiceStatusEx

I_ScSendPnPMessage, I_ScValidatePnPService

CM_Locate_DevNodeW, CM_Register_Notification, CM_Unregister_Notification, CM_Get_DevNode_PropertyW, CM_Set_DevNode_PropertyW, CM_Get_DevNode_Registry_PropertyW, CM_Set_DevNode_Registry_PropertyW, CM_Get_Device_ID_ListW, CM_Get_Device_ID_List_SizeW, CM_Get_Depth, CM_Get_DevNode_Status, CM_Set_DevNode_Problem, CM_Get_Class_PropertyW, CM_Get_Device_Interface_PropertyW, CM_Get_Class_Property_Keys, CM_Get_Device_Interface_Property_KeysW, CM_Get_DevNode_Property_Keys, CM_Get_Log_Conf_Priority, CM_Get_Next_Log_Conf, CM_Get_First_Log_Conf, CM_Free_Log_Conf, CM_Free_Log_Conf_Handle, CM_Add_Empty_Log_Conf, CM_Get_Hardware_Profile_InfoW, CM_Set_HW_Prof_FlagsW, CM_Get_HW_Prof_FlagsW, CM_Request_Eject_PC, CM_Is_Dock_Station_Present, CM_Request_Device_EjectW, CM_Disable_DevNode, CM_Query_And_Remove_SubTreeW, CM_Register_Device_Driver, CM_Add_IDW, CM_Get_Device_IDW, CM_Create_DevNodeW, CM_Uninstall_DevNode, CM_Reenumerate_DevNode, CM_Enable_DevNode, CM_Set_Device_Interface_PropertyW, CM_Set_Class_PropertyW, CM_Enumerate_EnumeratorsW, CM_Enumerate_Classes, CM_Get_Device_ID_Size, CM_Get_Sibling, CM_Get_Child, CM_Get_Parent, CM_Modify_Res_Des, CM_Get_Res_Des_Data_Size, CM_Get_Res_Des_Data, CM_Get_Next_Res_Des, CM_Free_Res_Des, CM_Free_Res_Des_Handle, CM_Add_Res_Des, CM_Get_Device_Interface_List_SizeW, CM_Get_Device_Interface_ListW, CM_Get_Device_Interface_AliasW, CM_Delete_Class_Key, CM_Get_Class_NameW, CM_Get_DevNode_Custom_PropertyW, CM_Unregister_Device_InterfaceW, CM_Register_Device_InterfaceW, CM_Open_DevNode_Key, CM_Set_Class_Registry_PropertyW, CM_Get_Class_Registry_PropertyW, CM_Setup_DevNode

NdxTableClose, NdxTableSetTypeDefinition, NdxTableOpen, NdxTableGetPropertyValue, NdxTableSetPropertyValue, NdxTableAddObject, NdxTableObjectFromName, NdxTableRemoveObject, NdxTableNextObject, NdxTableGetObjectName, NdxTableFirstObject, DevRtlSetThreadLogToken, DevRtlWriteTextLog

MoveFileExW, CreateHardLinkW, DelayLoadFailureHook, WTSGetActiveConsoleSessionId, CancelIo, QueueUserWorkItem, VerifyVersionInfoW, WideCharToMultiByte, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetCurrentProcessId, QueryPerformanceCounter, InterlockedExchange, InitializeCriticalSection, DeleteCriticalSection, SetLastError, GetLastError, CloseHandle, UnregisterWaitEx, RegisterWaitForSingleObjectEx, CreateEventW, LeaveCriticalSection, EnterCriticalSection, lstrlenW, TerminateProcess, GetExitCodeProcess, CheckRemoteDebuggerPresent, WaitForSingleObject, CreateProcessW, FindClose, FindFirstFileW, GetSystemDirectoryW, Sleep, CreateTimerQueueTimer, DeleteTimerQueueTimer, CreateTimerQueue, DeleteTimerQueueEx, GetCurrentThread, LocalFree, CompareStringOrdinal, WaitForSingleObjectEx, QueueUserAPC, DuplicateHandle, GetCurrentProcess, GetCurrentThreadId, SetEvent, OpenEventW, WaitForMultipleObjectsEx, CreateNamedPipeW, GetLogicalDrives, WriteFile, GetOverlappedResult, ConnectNamedPipe, ResetEvent, GetTickCount, OpenProcess, CreateThread, CompareFileTime, ProcessIdToSessionId, SetThreadPriority, UnmapViewOfFile, MapViewOfFile, CreateFileMappingW, GetProcAddress, FreeLibrary, InterlockedCompareExchange, LoadLibraryA, lstrcmpiW, CreateMutexW, WaitForMultipleObjects, ReleaseMutex, FileTimeToSystemTime, InterlockedIncrement, GetSystemWindowsDirectoryW, RaiseException, GetModuleFileNameA, lstrlenA, CreateFileW, FlushFileBuffers, SetFilePointer, GetFileAttributesW, GetVersionExW, GetLocalTime, GetFileSize, GetCommandLineA, HeapAlloc, HeapReAlloc, HeapFree, GetProcessHeap, GetSystemTimeAsFileTime, SetEndOfFile, CreateDirectoryW, GetFullPathNameW, SystemTimeToFileTime, lstrcmpW, LoadLibraryExW, ResolveDelayLoadedAPI

DllMain

NtSetInformationThread, RtlNtStatusToDosError, RtlDeleteSecurityObject, RtlDestroyHeap, RtlCreateHeap, RtlFreeHeap, RtlReAllocateHeap, RtlAllocateHeap, WinSqmStartSession, WinSqmEndSession, NtClose, WinSqmSetDWORD, RtlInitUnicodeString, RtlHashUnicodeString, VerSetConditionMask, RtlDeleteResource, RtlInitializeResource, EtwUnregisterTraceGuids, EtwRegisterTraceGuidsW, EtwGetTraceLoggerHandle, EtwGetTraceEnableLevel, EtwGetTraceEnableFlags, EtwTraceMessage, RtlNewSecurityObject, RtlCreateAndSetSD, NtOpenThreadToken, RtlImpersonateSelf, RtlAdjustPrivilege, NtPlugPlayControl, RtlUpcaseUnicodeString, EtwEventUnregister, EtwEventRegister, NtGetPlugPlayEvent, RtlUnicodeStringToInteger, RtlGUIDFromString, RtlCultureNameToLCID, RtlInitUnicodeStringEx, RtlReleaseResource, RtlAcquireResourceShared, RtlAcquireResourceExclusive, RtlCmEncodeMemIoResource, RtlIoEncodeMemIoResource, RtlCmDecodeMemIoResource, RtlIoDecodeMemIoResource, RtlPrefixUnicodeString, RtlRandomEx, RtlCompareUnicodeString, RtlFreeUnicodeString, RtlStringFromGUID, NtQuerySystemInformation, NtSetInformationFile, NtQueryInformationFile, EtwEventWrite, NtDuplicateToken, RtlMultiByteToUnicodeN, RtlUnicodeToMultiByteN, RtlNtStatusToDosErrorNoTeb, NtPowerInformation, WinSqmEventEnabled, WinSqmEventWrite, NtSetValueKey, NtQueryValueKey, NtCreateKey, NtOpenKey, RtlFormatCurrentUserKeyPath, RtlGetVersion, RtlPublishWnfStateData, DbgPrintEx, RtlFreeSid, RtlAllocateAndInitializeSid

UuidCreate, RpcAsyncCompleteCall, RpcRevertToSelf, RpcStringFreeW, UuidToStringW, UuidFromStringW, UuidEqual, I_RpcBindingIsClientLocal, I_RpcMapWin32Status, I_RpcBindingInqLocalClientPID, RpcStringBindingParseW, RpcBindingToStringBindingW, RpcServerRegisterIfEx, RpcServerUseProtseqEpW, RpcServerUnregisterIfEx, NdrAsyncServerCall, NdrServerCall2, RpcImpersonateClient, I_RpcExceptionFilter, RpcServerInterfaceGroupDeactivate, RpcServerInterfaceGroupCreateW, RpcServerInterfaceGroupActivate, RpcServerInterfaceGroupClose, RpcServerUseProtseqW, RpcServerRegisterIf3, RpcServerInqBindings, RpcEpUnregister, RpcBindingVectorFree, RpcEpRegisterW

SpInfIsIndirectString, SpInfGetIndirectString

CloseDesktop, DeviceEventWorker, BroadcastSystemMessageExW, CreateDesktopW, CharUpperW, BroadcastSystemMessageW, LoadStringW, CharNextW, CharPrevW

CreateEnvironmentBlock, UnregisterGPNotification, DestroyEnvironmentBlock, RegisterGPNotification