RegQueryValueExW, GetLengthSid, OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges, RegOpenKeyExW, RegCloseKey

CreateEventW, CloseHandle, DeleteCriticalSection, GetOverlappedResult, WriteFile, ResetEvent, CancelIo, WaitForSingleObject, ReadFile, WaitForMultipleObjects, LeaveCriticalSection, DeviceIoControl, EnterCriticalSection, GetVersionExW, HeapFree, MultiByteToWideChar, HeapAlloc, GetProcessHeap, ExitProcess, GetCurrentThreadId, GetCommandLineA, GetVersionExA, TlsAlloc, GetCurrentThread, TlsFree, TlsSetValue, TlsGetValue, GetProcAddress, GetModuleHandleA, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, GetModuleFileNameA, TerminateProcess, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, FreeEnvironmentStringsA, InitializeCriticalSection, FreeEnvironmentStringsW, GetEnvironmentStringsW, HeapDestroy, HeapCreate, VirtualFree, UnhandledExceptionFilter, GetTimeFormatA, GetDateFormatA, GetCPInfo, FatalAppExitA, GetUserDefaultLCID, GetLocaleInfoA, EnumSystemLocalesA, IsValidLocale, IsValidCodePage, GetStringTypeA, GetStringTypeW, RtlUnwind, GetACP, GetOEMCP, LoadLibraryA, InterlockedExchange, VirtualQuery, VirtualProtect, VirtualAlloc, GetSystemInfo, HeapReAlloc, IsBadWritePtr, GetTimeZoneInformation, LCMapStringA, LCMapStringW, HeapSize, GetLocaleInfoW, SetFilePointer, SetStdHandle, FlushFileBuffers, CompareStringA, CompareStringW, SetEnvironmentVariableA, WideCharToMultiByte, LocalAlloc, SetLastError, LocalFree, GetCurrentProcess, GetLastError, GetEnvironmentStrings, GetProfileIntW

NetServerEnum, NetUserGetInfo, NetApiBufferFree

RegDefaultUserConfigQueryW, RegUserConfigSet, RegUserConfigQuery

ExitWindowsEx

WinStationCloseServer, WinStationFreeMemory, WinStationEnumerateProcesses, WinStationFreeGAPMemory, WinStationGetAllProcesses, WinStationTerminateProcess, WinStationOpenServerA, WinStationQueryInformationW, WinStationEnumerateW, WinStationEnumerateA, WinStationSendMessageW, WinStationSendMessageA, WinStationDisconnect, WinStationReset, WinStationShadow, WinStationNameFromLogonIdW, WinStationQueryInformationA, WinStationOpenServerW, WinStationWaitSystemEvent, WinStationShutdownSystem, WinStationVirtualOpen