DeregisterEventSource, RegisterEventSourceW, RegEnumValueW, RegCreateKeyW, RegOpenKeyExA, DuplicateTokenEx, CreateProcessAsUserW, RegSetValueExA, RegQueryValueExA, RegCreateKeyExA, RegQueryValueA, AllocateAndInitializeSid, FreeSid, SetKernelObjectSecurity, AccessCheck, DestroyPrivateObjectSecurity, CreatePrivateObjectSecurity, GetSidSubAuthorityCount, GetSidSubAuthority, RegCloseKey, RegCreateKeyExW, RegEnumKeyW, RegOpenKeyExW, RegQueryInfoKeyW, RegQueryValueExW, RegSetValueExW, CloseServiceHandle, QueryServiceConfigW, OpenServiceW, OpenSCManagerW, ConvertStringSecurityDescriptorToSecurityDescriptorW, RegDeleteKeyW, RegEnumKeyExW, RegOpenKeyW, OpenThreadToken, InitializeSecurityDescriptor, CopySid, GetLengthSid, SetSecurityDescriptorOwner, SetSecurityDescriptorGroup, OpenProcessToken, AddAce, GetAce, GetAclInformation, InitializeAcl, AddAccessAllowedAce, SetSecurityDescriptorDacl, SetSecurityDescriptorSacl, GetSecurityDescriptorDacl, GetKernelObjectSecurity, RegDeleteValueW, RegQueryValueW, SetServiceStatus, RegisterServiceCtrlHandlerExW, DeleteService, QueryServiceStatus, ControlService, InitializeSid, GetSidLengthRequired, GetTokenInformation, LookupAccountSidW, StartServiceW, EventRegister, EventWrite, EventUnregister, RegDeleteKeyExW

CM_Reenumerate_DevNode, CM_Open_DevNode_Key_Ex, CM_Get_DevNode_Registry_PropertyA, CM_Open_DevNode_Key, CM_Locate_DevNodeW, CM_Get_Device_ID_Size_Ex, CM_Get_Device_IDW, CM_Get_DevNode_Registry_PropertyW, CM_Set_DevNode_Registry_PropertyW, CM_Get_DevNode_Status

GetFileTitleA

PurgeComm, SetCommMask, LocalFree, LocalAlloc, GetCurrentThreadId, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, GetVolumeInformationW, GetDriveTypeW, lstrcmpiW, GetLastError, lstrlenW, lstrcpynW, SetEvent, ResetEvent, CloseHandle, CreateMutexW, FreeLibrary, InterlockedIncrement, IsBadWritePtr, CreateEventW, InterlockedExchange, WaitForSingleObject, InterlockedCompareExchange, GetModuleFileNameW, CreateThread, MapViewOfFileEx, DuplicateHandle, OpenProcess, GetCurrentProcess, GetCurrentThread, UnmapViewOfFile, IsBadReadPtr, MulDiv, CreateFileMappingW, GetFileType, SetupComm, DeleteFileW, lstrcmpW, lstrcpyW, InitializeCriticalSection, MultiByteToWideChar, WideCharToMultiByte, lstrlenA, HeapDestroy, GetModuleHandleW, FormatMessageW, GetTickCount, SetLastError, DisableThreadLibraryCalls, Sleep, GetCurrentProcessId, WaitForSingleObjectEx, GetLocalTime, GetVersionExA, HeapFree, HeapAlloc, GetProcessHeap, lstrcpyA, WaitForMultipleObjects, SystemTimeToFileTime, GetSystemTime, lstrcpynA, IsBadStringPtrW, WriteFile, SetFilePointer, QueryPerformanceCounter, GetSystemTimeAsFileTime, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, SetCommTimeouts, EscapeCommFunction, ClearCommError, IsBadCodePtr, GetModuleHandleA, CreateFileW, GetTimeFormatW, CreateMutexA, ReleaseMutex, FlushFileBuffers, SetFilePointerEx, CreateFileA, ExpandEnvironmentStringsA, GetModuleFileNameA, ReadFile, GetProcAddress, LoadLibraryW, LoadLibraryA, lstrcmpiA, ExpandEnvironmentStringsW, OutputDebugStringW, GetFileInformationByHandle, GetDateFormatW, GetWindowsDirectoryW, SetEndOfFile, RaiseException, FormatMessageA, GetSystemDirectoryA, CreateDirectoryW, lstrcmpA, GetSystemDirectoryW, CompareStringW, GetTempFileNameW, GetTempPathW, GetFileSize, IsWow64Process, PowerClearRequest, PowerSetRequest, PowerCreateRequest, GetThreadId, LoadLibraryExA, IsProcessorFeaturePresent

GetStandardColorSpaceProfileW

DllMain

NtDuplicateToken, NtClose, WinSqmIncrementDWORD

StringFromCLSID, CoRegisterClassObject, CoRevokeClassObject, CoSuspendClassObjects, CoAddRefServerProcess, CoTaskMemFree, CoCreateInstance, StgCreatePropStg, CreateStreamOnHGlobal, StgOpenPropStg, CoUninitialize, CoInitializeSecurity, CoCreateInstanceEx, CLSIDFromString, StringFromGUID2, MkParseDisplayName, CreateBindCtx, CoInitializeEx, CoRevertToSelf, CoImpersonateClient, FreePropVariantArray, PropVariantClear, CoTaskMemAlloc, CoInitialize, PropVariantCopy, CoGetCallContext, CoResumeClassObjects, CoDisconnectObject

RpcServerRegisterIfEx, RpcServerListen, RpcBindingInqAuthClientW, RpcBindingToStringBindingW, RpcStringBindingParseW, RpcImpersonateClient, RpcRevertToSelf, UuidToStringW, NdrServerCall2, RpcStringFreeW, RpcServerUseProtseqEpW, RpcMgmtWaitServerListen, UuidToStringA, RpcStringFreeA, UuidCreateNil, UuidCreate, RpcServerUnregisterIf, RpcMgmtStopServerListening, RpcAsyncCompleteCall, RpcAsyncAbortCall, RpcServerRegisterAuthInfoW, RpcServerInqDefaultPrincNameW, NdrAsyncServerCall, RpcServerUnsubscribeForNotification, RpcServerTestCancel, RpcServerSubscribeForNotification

SetupDiDestroyDeviceInfoList, SetupDiGetClassDevsExW, SetupDiOpenDevRegKey, SetupDiOpenDeviceInterfaceRegKey, SetupDiGetDeviceInterfaceDetailW, SetupDiEnumDeviceInterfaces, SetupDiOpenDeviceInterfaceW, SetupDiEnumDeviceInfo, SetupDiGetClassDevsW, SetupDiDeleteDeviceInterfaceData, SetupDiCreateDeviceInfoList

SHDeleteKeyW

CharNextW, SendMessageTimeoutW, UnregisterDeviceNotification, RegisterDeviceNotificationW, wsprintfW, ShowWindow, IsWindow, PostQuitMessage, DestroyWindow, AllowSetForegroundWindow, CharUpperW, wvsprintfA, GetSystemMetrics, DefWindowProcW, BroadcastSystemMessageW, LoadStringW, CharUpperBuffW, CharUpperA, CharNextA, PostMessageW, UnregisterPowerSettingNotification, RegisterPowerSettingNotification, wvsprintfW

CreateEnvironmentBlock, DestroyEnvironmentBlock

GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

WinStationQueryInformationW