execution;actctx;kernel32.dll!CreateActCtx;928
execution;actctx;kernel32.dll!DeactivateActCtx;927
execution;actctx;kernel32.dll!ReleaseActCtx;922
execution;args;kernel32.dll!GetCommandLine;45
execution;args;kernel32.dll!GetStartupInfo;85
execution;args;msvcrt.dll!_acmdln;331
execution;args;msvcrt.dll!__getmainargs;263
execution;com_object;ole32.dll!CoCreateInstance;105
execution;com_object;ole32.dll!CoCreateInstanceEx;547
execution;com_object;ole32.dll!CoGetClassObject;644
execution;com_object;ole32.dll!CoGetObject;625
execution;com_object;ole32.dll!CoInitialize;133
execution;com_object;ole32.dll!CoInitializeEx;218
execution;com_object;ole32.dll!CoResumeClassObjects;597
execution;com_object;ole32.dll!CoSuspendClassObjects;596
execution;com_object;ole32.dll!CoUninitialize;132
execution;com_object;ole32.dll!OleCreate;970
execution;com_object;ole32.dll!OleInitialize;429
execution;com_object;ole32.dll!OleRun;808
execution;com_object;ole32.dll!OleSetContainedObject;708
execution;com_object;ole32.dll!OleUninitialize;535
execution;dde;user32.dll!DdeConnect;965
execution;dde;user32.dll!DdeDisconnect;964
execution;dde;user32.dll!DdeInitialize;963
execution;dde;user32.dll!DdeUninitialize;961
execution;dde;user32.dll!DdeAccessData;967
execution;dde;user32.dll!DdeUnaccessData;962
execution;dde;user32.dll!DdeClientTransaction;966
execution;debug;kernel32.dll!IsDebuggerPresent;68
execution;debug;kernel32.dll!CheckRemoteDebuggerPresent;929
execution;debug;kernel32.dll!OutputDebugString;230
execution;errors;kernel32.dll!SetErrorMode;146
execution;errors;kernel32.dll!GetLastError;276
execution;errors;kernel32.dll!SetLastError;332
execution;errors;kernel32.dll!SetUnhandledExceptionFilter;30
execution;errors;kernel32.dll!UnhandledExceptionFilter;27
execution;errors;kernel32.dll!RaiseException;61
execution;errors;kernel32.dll!IsBadCodePtr;467
execution;errors;kernel32.dll!IsBadReadPtr;210
execution;errors;kernel32.dll!IsBadWritePtr;395
execution;errors;kernel32.dll!IsValidCodePage;87
execution;errors;kernel32.dll!IsValidLocale;270
execution;errors;kernel32.dll!FormatMessage;247
execution;errors;kernel32.dll!RtlUnwind;366
execution;errors;msvcrt.dll!_errno;527
execution;errors;msvcrt.dll!_CxxThrowException;478
execution;errors;msvcrt.dll!_except_handler3;234
execution;errors;msvcrt.dll!_XcptFilter;290
execution;errors;ntdll.dll!RtlGetLastWin32Error;7
execution;errors;ntdll.dll!RtlSetLastWin32Error;48
execution;errors;ntdll.dll!RtlAddVectoredExceptionHandler;649
execution;errors;ntdll.dll!RtlRemoveVectoredExceptionHandler;714
execution;errors;ntdll.dll!RtlUnwind;43
execution;handles;kernel32.dll!GetModuleHandle;22
execution;handles;kernel32.dll!GetModuleHandleEx;238
execution;handles;kernel32.dll!GetStdHandle;34
execution;handles;kernel32.dll!SetStdHandle;75
execution;handles;kernel32.dll!GlobalHandle;411
execution;handles;kernel32.dll!GetHandleInformation;659
execution;handles;kernel32.dll!DuplicateHandle;212
execution;handles;kernel32.dll!CloseHandle;1
execution;handles;kernel32.dll!SetHandleCount;66
execution;handles;kernel32.dll!SetHandleInformation;495
execution;handles;ntdll.dll!LdrGetDllHandle;628
execution;handles;ntdll.dll!ZwClose;419
execution;message;user32.dll!GetMessage;224
execution;message;user32.dll!WaitMessage;671
execution;message;user32.dll!PeekMessage;319
execution;message;user32.dll!SendMessage;225
execution;message;user32.dll!SendMessageTimeout;620
execution;message;user32.dll!PostMessage;287
execution;message;user32.dll!PostQuitMessage;183
execution;message;user32.dll!DispatchMessage;185
execution;message;user32.dll!TranslateMessage;103
execution;message;user32.dll!RegisterWindowMessage;480
execution;modules;kernel32.dll!GetProcAddress;3
execution;modules;ntdll.dll!LdrGetProcedureAddress;682
execution;modules;kernel32.dll!LoadLibrary;12
execution;modules;kernel32.dll!LoadLibraryEx;191
execution;modules;kernel32.dll!FreeLibrary;41
execution;modules;ntdll.dll!LdrLoadDll;536
execution;modules;ntdll.dll!LdrUnloadDll;975
execution;modules;ntdll.dll!RtlImageNtHeader;780
execution;modules;kernel32.dll!Module32First;445
execution;modules;kernel32.dll!Module32Next;560
execution;modules;ntdll.dll!LdrEnumerateLoadedModules;908
execution;modules;kernel32.dll!GetModuleFileName;15
execution;modules;psapi.dll!GetModuleBaseName;643
execution;modules;psapi.dll!GetModuleFileNameEx;506
execution;modules;psapi.dll!GetModuleInformation;902
execution;pipe;kernel32.dll!CreatePipe;145
execution;pipe;kernel32.dll!CreateNamedPipe;529
execution;pipe;kernel32.dll!ConnectNamedPipe;396
execution;pipe;kernel32.dll!DisconnectNamedPipe;368
execution;pipe;kernel32.dll!PeekNamedPipe;202
execution;pipe;kernel32.dll!WaitNamedPipe;687
execution;pipe;kernel32.dll!SetNamedPipeHandleState;607
execution;process;kernel32.dll!CreateProcess;74
execution;process;kernel32.dll!CreateProcessInternal;987
execution;process;advapi32.dll!CreateProcessAsUser;413
execution;process;advapi32.dll!CreateProcessWithLogon;759
execution;process;ntdll.dll!ZwCreateProcess;973
execution;process;ntdll.dll!ZwCreateProcessEx;972
execution;process;kernel32.dll!WinExec;233
execution;process;shell32.dll!ShellExecute;195
execution;process;shell32.dll!ShellExecuteEx;303
execution;process;msvcrt.dll!system;819
execution;process;ntdll.dll!ZwSuspendProcess;863
execution;process;kernel32.dll!ExitProcess;4
execution;process;kernel32.dll!TerminateProcess;14
execution;process;ntdll.dll!ZwTerminateProcess;736
execution;process;msvcrt.dll!exit;236
execution;process;msvcrt.dll!_exit;292
execution;process;msvcrt.dll!_initterm;180
execution;process;kernel32.dll!Process32First;161
execution;process;kernel32.dll!Process32Next;160
execution;process;psapi.dll!EnumProcesses;595
execution;process;psapi.dll!EnumProcessModules;474
execution;process;kernel32.dll!OpenProcess;50
execution;process;ntdll.dll!ZwOpenProcess;526
execution;process;advapi32.dll!OpenProcessToken;63
execution;process;ntdll.dll!ZwOpenProcessToken;677
execution;process;kernel32.dll!GetCurrentProcess;6
execution;process;kernel32.dll!GetCurrentProcessId;19
execution;process;kernel32.dll!GetExitCodeProcess;187
execution;process;kernel32.dll!GetProcessId;433
execution;process;kernel32.dll!GetProcessTimes;432
execution;process;kernel32.dll!GetProcessVersion;752
execution;process;ntdll.dll!RtlGetCurrentPeb;907
execution;process;psapi.dll!GetProcessImageFileName;771
execution;process;kernel32.dll!ProcessIdToSessionId;578
execution;process;kernel32.dll!IsWow64Process;367
execution;process;ntdll.dll!ZwQueryInformationProcess;322
execution;process;ntdll.dll!ZwSetInformationProcess;905
execution;process;kernel32.dll!SetPriorityClass;382
execution;process;kernel32.dll!SetProcessAffinityMask;783
execution;process;kernel32.dll!SetProcessPriorityBoost;654
execution;process;ole32.dll!CoAddRefServerProcess;599
execution;process;ole32.dll!CoReleaseServerProcess;598
execution;process;msvcrt.dll!longjmp;821
execution;service;advapi32.dll!LockServiceDatabase;798
execution;service;advapi32.dll!UnlockServiceDatabase;793
execution;service;advapi32.dll!CreateService;360
execution;service;advapi32.dll!DeleteService;299
execution;service;advapi32.dll!OpenSCManager;272
execution;service;advapi32.dll!OpenService;283
execution;service;advapi32.dll!CloseServiceHandle;182
execution;service;advapi32.dll!StartService;355
execution;service;advapi32.dll!ControlService;273
execution;service;advapi32.dll!SetServiceStatus;282
execution;service;advapi32.dll!QueryServiceConfig;796
execution;service;advapi32.dll!QueryServiceStatus;385
execution;service;advapi32.dll!QueryServiceStatusEx;795
execution;service;advapi32.dll!ChangeServiceConfig;696
execution;service;advapi32.dll!ChangeServiceConfig2;531
execution;service;advapi32.dll!EnumServicesStatus;517
execution;service;advapi32.dll!RegisterServiceCtrlHandler;369
execution;service;advapi32.dll!StartServiceCtrlDispatcher;515
execution;synchronization;kernel32.dll!Sleep;0
execution;synchronization;kernel32.dll!SleepEx;444
execution;synchronization;ntdll.dll!ZwDelayExecution;812
execution;synchronization;kernel32.dll!CreateMutex;94
execution;synchronization;kernel32.dll!OpenMutex;298
execution;synchronization;kernel32.dll!ReleaseMutex;149
execution;synchronization;kernel32.dll!CreateSemaphore;612
execution;synchronization;kernel32.dll!ReleaseSemaphore;528
execution;synchronization;kernel32.dll!GlobalLock;169
execution;synchronization;kernel32.dll!GlobalUnlock;177
execution;synchronization;kernel32.dll!InitializeCriticalSection;72
execution;synchronization;kernel32.dll!InitializeCriticalSectionAndSpinCount;88
execution;synchronization;ntdll.dll!RtlInitializeCriticalSection;476
execution;synchronization;ntdll.dll!RtlDeleteCriticalSection;28
execution;synchronization;ntdll.dll!RtlTryEnterCriticalSection;443
execution;synchronization;ntdll.dll!RtlEnterCriticalSection;18
execution;synchronization;ntdll.dll!RtlLeaveCriticalSection;17
execution;synchronization;kernel32.dll!InterlockedCompareExchange;250
execution;synchronization;kernel32.dll!InterlockedDecrement;69
execution;synchronization;kernel32.dll!InterlockedExchange;151
execution;synchronization;kernel32.dll!InterlockedIncrement;71
execution;synchronization;ntdll.dll!RtlInterlockedFlushSList;779
execution;synchronization;kernel32.dll!QueryPerformanceCounter;37
execution;synchronization;kernel32.dll!QueryPerformanceFrequency;401
execution;synchronization;kernel32.dll!CreateWaitableTimer;633
execution;synchronization;kernel32.dll!SetWaitableTimer;511
execution;synchronization;user32.dll!SetTimer;301
execution;synchronization;user32.dll!KillTimer;380
execution;synchronization;kernel32.dll!RegisterWaitForSingleObject;655
execution;synchronization;kernel32.dll!UnregisterWait;653
execution;synchronization;kernel32.dll!WaitForMultipleObjects;134
execution;synchronization;kernel32.dll!WaitForSingleObject;16
execution;synchronization;user32.dll!MsgWaitForMultipleObjects;362
execution;synchronization;user32.dll!MsgWaitForMultipleObjectsEx;767
execution;synchronization;msvcrt.dll!signal;650
execution;thread;kernel32.dll!CreateThread;13
execution;thread;kernel32.dll!CreateRemoteThread;200
execution;thread;ntdll.dll!ZwCreateThread;713
execution;thread;ntdll.dll!RtlCreateUserThread;715
execution;thread;kernel32.dll!QueueUserAPC;657
execution;thread;ntdll.dll!ZwQueueApcThread;774
execution;thread;kernel32.dll!ResumeThread;109
execution;thread;ntdll.dll!ZwResumeThread;573
execution;thread;kernel32.dll!SuspendThread;296
execution;thread;ntdll.dll!ZwSuspendThread;862
execution;thread;ntdll.dll!RtlExitUserThread;509
execution;thread;kernel32.dll!ExitThread;131
execution;thread;kernel32.dll!TerminateThread;129
execution;thread;kernel32.dll!SwitchToThread;577
execution;thread;kernel32.dll!Thread32First;352
execution;thread;kernel32.dll!Thread32Next;347
execution;thread;kernel32.dll!OpenThread;394
execution;thread;advapi32.dll!OpenThreadToken;316
execution;thread;user32.dll!PostThreadMessage;544
execution;thread;kernel32.dll!GetCurrentThread;142
execution;thread;kernel32.dll!GetCurrentThreadId;20
execution;thread;user32.dll!GetWindowThreadProcessId;175
execution;thread;kernel32.dll!GetExitCodeThread;265
execution;thread;kernel32.dll!GetThreadLocale;318
execution;thread;kernel32.dll!GetThreadContext;242
execution;thread;kernel32.dll!SetThreadContext;269
execution;thread;kernel32.dll!GetThreadPriority;498
execution;thread;kernel32.dll!SetThreadPriority;207
execution;thread;kernel32.dll!Wow64GetThreadContext;920
execution;thread;kernel32.dll!Wow64SetThreadContext;919
execution;thread;ntdll.dll!ZwGetContextThread;776
execution;thread;ntdll.dll!ZwSetContextThread;710
execution;thread;ntdll.dll!ZwQueryInformationThread;600
execution;thread;ntdll.dll!ZwSetInformationThread;904
execution;thread;user32.dll!GetThreadDesktop;406
execution;thread;user32.dll!SetThreadDesktop;379
gui;desktop;user32.dll!EnumDesktops;896
gui;desktop;user32.dll!EnumDesktopWindows;897
gui;desktop;user32.dll!EnumWindowStations;895
gui;desktop;user32.dll!GetDesktopWindow;206
gui;desktop;user32.dll!GetProcessWindowStation;363
gui;dialog;user32.dll!LoadCursor;330
gui;dialog;user32.dll!LoadIcon;329
gui;dialog;user32.dll!MessageBox;137
gui;dialog;user32.dll!RegisterClass;343
gui;dialog;user32.dll!WinHelp;618
gui;draw;gdi32.dll!BitBlt;192
gui;draw;user32.dll!BeginPaint;260
gui;draw;user32.dll!FillRect;357
gui;gdi;GdiPlus.dll!GdipCreateBitmapFromScan0;697
gui;gdi;GdiPlus.dll!GdipDeleteGraphics;665
gui;gdi;GdiPlus.dll!GdiplusShutdown;470
gui;gdi;GdiPlus.dll!GdiplusStartup;386
gui;gdi;GdiPlus.dll!GdipSaveImageToFile;565
gui;gdi;GdiPlus.dll!GdipSaveImageToStream;564
gui;window;user32.dll!CreateWindowEx;232
gui;window;user32.dll!EnumWindows;294
gui;window;user32.dll!FindWindow;344
gui;window;user32.dll!GetWindowRect;205
gui;window;user32.dll!PrintWindow;702
gui;window;user32.dll!SetForegroundWindow;286
gui;window;user32.dll!SetWindowLong;342
gui;window;user32.dll!ShowWindow;144
file;mgmt;kernel32.dll!CreateFile;25
file;mgmt;ntdll.dll!ZwCreateFile;679
file;mgmt;kernel32.dll!CreateFileMapping;213
file;mgmt;kernel32.dll!DeleteFile;81
file;mgmt;ntdll.dll!ZwDeleteFile;741
file;mgmt;kernel32.dll!CreateDirectory;147
file;mgmt;kernel32.dll!RemoveDirectory;280
file;mgmt;kernel32.dll!LockFile;512
file;mgmt;kernel32.dll!LockFileEx;785
file;mgmt;kernel32.dll!UnlockFile;549
file;mgmt;kernel32.dll!GetFileAttributes;125
file;mgmt;kernel32.dll!GetFileAttributesEx;479
file;mgmt;kernel32.dll!SetFileAttributes;159
file;mgmt;kernel32.dll!GetFileSize;35
file;mgmt;kernel32.dll!GetFileSizeEx;243
file;mgmt;msvcrt.dll!_filelengthi64;823
file;mgmt;kernel32.dll!GetFileTime;219
file;mgmt;kernel32.dll!SetFileTime;184
file;mgmt;kernel32.dll!GetFileType;47
file;mgmt;kernel32.dll!GetFileInformationByHandle;326
file;mgmt;version.dll!GetFileVersionInfo;436
file;mgmt;version.dll!GetFileVersionInfoSize;437
file;mgmt;version.dll!VerQueryValue;450
file;mgmt;ntdll.dll!ZwQueryInformationFile;676
file;mgmt;ntdll.dll!ZwSetInformationFile;773
file;mgmt;shell32.dll!SHGetFileInfo;642
file;mgmt;kernel32.dll!SetEndOfFile;80
file;mgmt;kernel32.dll!SetFilePointer;24
file;mgmt;kernel32.dll!SetFilePointerEx;158
file;mgmt;kernel32.dll!MapViewOfFile;138
file;mgmt;kernel32.dll!MapViewOfFileEx;750
file;mgmt;kernel32.dll!UnmapViewOfFile;135
file;mgmt;kernel32.dll!GetTempFileName;251
file;mgmt;kernel32.dll!GetTempPath;102
file;mgmt;kernel32.dll!GetCurrentDirectory;271
file;mgmt;kernel32.dll!SetCurrentDirectory;297
file;mgmt;kernel32.dll!GetSystemDirectory;173
file;mgmt;kernel32.dll!GetWindowsDirectory;222
file;mgmt;kernel32.dll!GetSystemWindowsDirectory;872
file;mgmt;userenv.dll!GetUserProfileDirectory;892
file;mgmt;shell32.dll!SHGetSpecialFolderLocation;594
file;mgmt;shell32.dll!SHGetSpecialFolderPath;288
file;mgmt;shell32.dll!SHGetFolderPath;186
file;mgmt;kernel32.dll!SetDllDirectory;921
file;mgmt;kernel32.dll!QueryDosDevice;559
file;mgmt;kernel32.dll!GetDiskFreeSpace;404
file;mgmt;kernel32.dll!GetDiskFreeSpaceEx;421
file;mgmt;kernel32.dll!GetDriveType;188
file;mgmt;kernel32.dll!GetLogicalDrives;228
file;mgmt;kernel32.dll!GetLogicalDriveStrings;325
file;mgmt;ntdll.dll!ZwQueryDirectoryFile;739
file;mgmt;shell32.dll!FindExecutable;900
file;path;kernel32.dll!GetFullPathName;306
file;path;kernel32.dll!GetLongPathName;658
file;path;kernel32.dll!GetShortPathName;324
file;path;shlwapi.dll!PathFileExists;491
file;path;shlwapi.dll!PathFindFileName;358
file;path;shlwapi.dll!PathIsDirectory;641
file;path;shlwapi.dll!PathIsURL;592
file;path;shlwapi.dll!PathMatchSpec;490
file;path;shlwapi.dll!PathAppend;523
file;path;shlwapi.dll!PathCombine;418
file;path;shlwapi.dll!PathSkipRoot;558
file;path;shlwapi.dll!PathRemoveBackslash;522
file;path;shlwapi.dll!PathFindExtension;593
file;path;shlwapi.dll!PathAddExtension;624
file;path;shlwapi.dll!PathRenameExtension;591
file;path;shlwapi.dll!PathRemoveExtension;705
file;path;shlwapi.dll!PathRemoveFileSpec;417
file;open;kernel32.dll!OpenFile;923
file;open;kernel32.dll!OpenFileMapping;496
file;open;ntdll.dll!ZwOpenFile;775
file;open;msvcrt.dll!fopen;289
file;mgmt;msvcrt.dll!fclose;267
file;mgmt;msvcrt.dll!fseek;431
file;mgmt;msvcrt.dll!ftell;538
file;read;kernel32.dll!ReadFile;5
file;read;msvcrt.dll!fgets;652
file;read;msvcrt.dll!fread;350
file;read;ntdll.dll!ZwReadFile;737
file;resource;kernel32.dll!EnumResourceLanguages;925
file;resource;kernel32.dll!EnumResourceNames;832
file;resource;kernel32.dll!FindResource;253
file;resource;kernel32.dll!FindResourceEx;753
file;resource;kernel32.dll!LoadResource;155
file;resource;kernel32.dll!LockResource;751
file;resource;kernel32.dll!SizeofResource;172
file;resource;kernel32.dll!UpdateResource;824
file;resource;kernel32.dll!FreeResource;353
file;resource;user32.dll!LoadString;328
file;read;kernel32.dll!GetPrivateProfileSectionNames;689
file;read;kernel32.dll!GetPrivateProfileString;390
file;write;kernel32.dll!WritePrivateProfileString;576
file;search;kernel32.dll!SearchPath;871
file;search;kernel32.dll!FindFirstFile;101
file;search;kernel32.dll!FindFirstFileEx;562
file;search;kernel32.dll!FindNextFile;100
file;search;kernel32.dll!FindClose;36
file;search;kernel32.dll!FindFirstVolume;986
file;volume;kernel32.dll!FindNextVolume;985
file;volume;kernel32.dll!GetVolumeInformation;223
file;volume;ntdll.dll!ZwQueryVolumeInformationFile;864
file;volume;kernel32.dll!SetVolumeLabel;1013
file;write;kernel32.dll!WriteFile;2
file;write;ntdll.dll!ZwWriteFile;675
file;write;msvcrt.dll!fflush;510
file;write;msvcrt.dll!fprintf;539
file;write;msvcrt.dll!fputs;748
file;write;msvcrt.dll!fwrite;315
file;write;kernel32.dll!CopyFile;156
file;write;kernel32.dll!MoveFile;237
file;write;kernel32.dll!MoveFileEx;227
file;write;kernel32.dll!FlushFileBuffers;42
file;write;kernel32.dll!FlushViewOfFile;717
time;read;msvcrt.dll!clock;869
time;read;msvcrt.dll!gmtime;822
time;read;msvcrt.dll!localtime;685
time;read;msvcrt.dll!time;345
time;read;msvcrt.dll!_time64;749
time;read;user32.dll!GetMessageTime;557
time;read;kernel32.dll!GetLocalTime;97
time;read;kernel32.dll!GetTimeFormat;550
time;read;kernel32.dll!GetTimeZoneInformation;165
time;read;kernel32.dll!CompareFileTime;718
time;read;kernel32.dll!GetSystemTimes;830
time;read;kernel32.dll!GetSystemTimeAsFileTime;44
time;read;kernel32.dll!GetSystemTime;139
time;control;kernel32.dll!SetSystemTime;1014
time;convert;kernel32.dll!FileTimeToSystemTime;163
time;convert;kernel32.dll!SystemTimeToFileTime;176
time;convert;kernel32.dll!SystemTimeToTzSpecificLocalTime;606
time;convert;kernel32.dll!FileTimeToLocalFileTime;170
time;convert;kernel32.dll!LocalFileTimeToFileTime;608
time;convert;kernel32.dll!FileTimeToDosDateTime;354
time;convert;kernel32.dll!DosDateTimeToFileTime;833
time;convert;ntdll.dll!RtlTimeToSecondsSince1970;814
memory;alloc;kernel32.dll!VirtualAlloc;29
memory;alloc;kernel32.dll!VirtualAllocEx;154
memory;alloc;ntdll.dll!ZwAllocateVirtualMemory;574
memory;search;kernel32.dll!VirtualQuery;150
memory;search;kernel32.dll!VirtualQueryEx;351
memory;search;ntdll.dll!ZwQueryVirtualMemory;626
memory;mgmt;kernel32.dll!VirtualProtect;99
memory;mgmt;kernel32.dll!VirtualProtectEx;295
memory;mgmt;ntdll.dll!ZwProtectVirtualMemory;647
memory;read;kernel32.dll!Toolhelp32ReadProcessMemory;825
memory;read;kernel32.dll!ReadProcessMemory;208
memory;write;kernel32.dll!WriteProcessMemory;140
memory;read;ntdll.dll!ZwReadVirtualMemory;646
memory;write;ntdll.dll!ZwWriteVirtualMemory;645
memory;write;ntdll.dll!RtlMoveMemory;601
memory;write;ntdll.dll!RtlZeroMemory;627
memory;mgmt;kernel32.dll!VirtualLock;982
memory;mgmt;kernel32.dll!VirtualUnlock;981
memory;free;kernel32.dll!VirtualFree;33
memory;free;kernel32.dll!VirtualFreeEx;268
memory;free;ntdll.dll!ZwFreeVirtualMemory;678
memory;alloc;kernel32.dll!GlobalAlloc;136
memory;alloc;kernel32.dll!GlobalReAlloc;384
memory;mgmt;kernel32.dll!GlobalSize;540
memory;mgmt;kernel32.dll!GlobalMemoryStatus;376
memory;mgmt;kernel32.dll!GlobalMemoryStatusEx;402
memory;free;kernel32.dll!GlobalFree;124
memory;alloc;kernel32.dll!LocalAlloc;89
memory;alloc;kernel32.dll!LocalReAlloc;497
memory;free;kernel32.dll!LocalFree;49
memory;alloc;kernel32.dll!HeapCreate;73
memory;alloc;ntdll.dll!RtlAllocateHeap;10
memory;alloc;ntdll.dll!RtlReAllocateHeap;26
memory;mgmt;kernel32.dll!GetProcessHeap;31
memory;search;kernel32.dll!Heap32First;829
memory;search;kernel32.dll!Heap32ListFirst;828
memory;search;kernel32.dll!Heap32ListNext;827
memory;search;kernel32.dll!Heap32Next;826
memory;mgmt;ntdll.dll!RtlSizeHeap;64
memory;mgmt;kernel32.dll!HeapQueryInformation;983
memory;mgmt;kernel32.dll!HeapSetInformation;305
memory;mgmt;kernel32.dll!HeapValidate;688
memory;free;kernel32.dll!HeapFree;333
memory;free;ntdll.dll!RtlFreeHeap;23
memory;free;kernel32.dll!HeapDestroy;128
memory;alloc;msvcrt.dll!malloc;179
memory;alloc;msvcrt.dll!realloc;375
memory;alloc;msvcrt.dll!calloc;466
memory;search;msvcrt.dll!memcmp;387
memory;search;ntdll.dll!memcmp;861
memory;search;msvcrt.dll!memchr;604
memory;write;msvcrt.dll!memcpy;198
memory;write;ntdll.dll!memcpy;507
memory;write;msvcrt.dll!memmove;311
memory;write;ntdll.dll!memmove;810
memory;write;msvcrt.dll!memset;168
memory;write;ntdll.dll!memset;441
memory;free;msvcrt.dll!free;171
memory;alloc;kernel32.dll!TlsAlloc;52
memory;read;kernel32.dll!TlsGetValue;38
memory;write;kernel32.dll!TlsSetValue;39
memory;free;kernel32.dll!TlsFree;57
memory;alloc;ntdll.dll!ZwCreateSection;508
memory;alloc;ntdll.dll!ZwMapViewOfSection;475
memory;free;ntdll.dll!ZwUnmapViewOfSection;409
memory;mgmt;psapi.dll!GetProcessMemoryInfo;735
memory;mgmt;ntdll.dll!RtlDecodePointer;118
memory;mgmt;ntdll.dll!RtlEncodePointer;126
string;convert;kernel32.dll!LCMapString;62
string;format;kernel32.dll!MultiByteToWideChar;11
string;format;kernel32.dll!WideCharToMultiByte;9
string;format;ntdll.dll!RtlAnsiStringToUnicodeString;743
string;format;shlwapi.dll!StrToInt;534
string;format;user32.dll!ToAscii;727
string;format;user32.dll!ToUnicode;619
string;format;user32.dll!CharToOem;452
string;format;msvcrt.dll!atoi;241
string;format;msvcrt.dll!printf;465
string;format;msvcrt.dll!sprintf;226
string;format;ntdll.dll!sprintf;772
string;format;user32.dll!wsprintf;107
string;format;shlwapi.dll!wvnsprintf;521
string;format;msvcrt.dll!putc;651
string;format;msvcrt.dll!puts;820
string;format;msvcrt.dll!strftime;746
string;format;shlwapi.dll!UrlUnescape;571
string;format;user32.dll!CharNext;392
string;search;kernel32.dll!CompareString;164
string;search;msvcrt.dll!strcmp;365
string;search;msvcrt.dll!strncmp;364
string;search;shlwapi.dll!StrCmpNI;428
string;search;kernel32.dll!lstrcmp;162
string;search;msvcrt.dll!wcscmp;629
string;search;ntdll.dll!strlen;859
string;search;msvcrt.dll!strlen;255
string;search;kernel32.dll!lstrlen;53
string;search;msvcrt.dll!wcslen;464
string;search;msvcrt.dll!strstr;261
string;search;shlwapi.dll!StrStr;407
string;search;msvcrt.dll!wcsstr;602
string;search;msvcrt.dll!strchr;304
string;search;msvcrt.dll!wcschr;745
string;search;msvcrt.dll!strrchr;323
string;mgmt;kernel32.dll!GetStringType;58
string;mgmt;kernel32.dll!GetStringTypeEx;389
string;modify;msvcrt.dll!getc;747
string;modify;msvcrt.dll!sscanf;482
string;modify;ntdll.dll!sscanf;809
string;modify;msvcrt.dll!strcpy;346
string;modify;ntdll.dll!strcpy;860
string;modify;msvcrt.dll!strncpy;275
string;modify;kernel32.dll!lstrcpy;91
string;modify;kernel32.dll!lstrcpyn;199
string;modify;msvcrt.dll!wcscpy;537
string;modify;msvcrt.dll!wcsncpy;744
string;modify;msvcrt.dll!strcat;374
string;modify;msvcrt.dll!strncat;548
string;modify;kernel32.dll!lstrcat;114
string;modify;msvcrt.dll!wcscat;603
string;modify;ntdll.dll!RtlFreeUnicodeString;648
network;inet;sensapi.dll!IsNetworkAlive;969
network;inet;urlmon.dll!URLDownloadToFile;440
network;inet;urlmon.dll!URLDownloadToCacheFile;968
network;inet;wininet.dll!FindCloseUrlCache;670
network;inet;wininet.dll!FindFirstUrlCacheEntry;701
network;inet;wininet.dll!FindNextUrlCacheEntry;700
network;inet;wininet.dll!GetUrlCacheEntryInfo;726
network;inet;wininet.dll!DeleteUrlCacheEntry;553
network;inet;urlmon.dll!ObtainUserAgentString;520
network;inet;shlwapi.dll!GetAcceptLanguages;854
network;inet;wininet.dll!InternetOpen;98
network;inet;wininet.dll!InternetConnect;113
network;inet;wininet.dll!InternetAttemptConnect;848
network;inet;wininet.dll!InternetCheckConnection;803
network;inet;wininet.dll!InternetCreateUrl;950
network;inet;wininet.dll!InternetOpenUrl;278
network;inet;wininet.dll!InternetCrackUrl;300
network;inet;wininet.dll!InternetCanonicalizeUrl;725
network;inet;wininet.dll!InternetGetConnectedState;487
network;inet;wininet.dll!InternetGetConnectedStateEx;888
network;inet;wininet.dll!InternetQueryDataAvailable;356
network;inet;wininet.dll!InternetQueryOption;258
network;inet;wininet.dll!InternetSetOption;217
network;inet;wininet.dll!InternetReadFile;84
network;inet;wininet.dll!InternetReadFileEx;669
network;inet;wininet.dll!InternetWriteFile;370
network;inet;wininet.dll!InternetWriteFileEx;949
network;inet;wininet.dll!InternetGetCookie;887
network;inet;wininet.dll!InternetSetCookie;724
network;inet;wininet.dll!InternetSetFilePointer;802
network;inet;wininet.dll!InternetSetStatusCallback;639
network;inet;wininet.dll!InternetTimeToSystemTime;1004
network;inet;wininet.dll!InternetCloseHandle;76
network;http;winhttp.dll!WinHttpDetectAutoProxyConfigUrl;955
network;http;winhttp.dll!WinHttpGetDefaultProxyConfiguration;1006
network;http;winhttp.dll!WinHttpGetIEProxyConfigForCurrentUser;532
network;http;winhttp.dll!WinHttpGetProxyForUrl;588
network;http;winhttp.dll!WinHttpCheckPlatform;956
network;http;winhttp.dll!WinHttpOpen;339
network;http;wininet.dll!HttpOpenRequest;116
network;http;winhttp.dll!WinHttpOpenRequest;338
network;http;winhttp.dll!WinHttpConnect;340
network;http;winhttp.dll!WinHttpCrackUrl;533
network;http;winhttp.dll!WinHttpAddRequestHeaders;554
network;http;wininet.dll!HttpAddRequestHeaders;259
network;http;winhttp.dll!WinHttpSetCredentials;889
network;http;winhttp.dll!WinHttpSetTimeouts;543
network;http;wininet.dll!HttpQueryInfo;174
network;http;winhttp.dll!WinHttpQueryAuthSchemes;890
network;http;winhttp.dll!WinHttpQueryHeaders;424
network;http;winhttp.dll!WinHttpQueryOption;804
network;http;winhttp.dll!WinHttpSetOption;405
network;http;winhttp.dll!WinHttpQueryDataAvailable;391
network;http;winhttp.dll!WinHttpSendRequest;335
network;http;wininet.dll!HttpSendRequest;143
network;http;wininet.dll!HttpSendRequestEx;371
network;http;winhttp.dll!WinHttpReceiveResponse;336
network;http;wininet.dll!HttpEndRequest;414
network;http;winhttp.dll!WinHttpReadData;337
network;http;winhttp.dll!WinHttpWriteData;587
network;http;winhttp.dll!WinHttpCloseHandle;349
network;ftp;wininet.dll!FtpGetCurrentDirectory;1005
network;ftp;wininet.dll!FtpSetCurrentDirectory;951
network;ftp;wininet.dll!FtpOpenFile;952
network;ftp;wininet.dll!FtpGetFile;954
network;ftp;wininet.dll!FtpGetFileSize;953
network;ftp;wininet.dll!FtpPutFile;849
network;ldap;Wldap32.dll!ldap_init;995
network;ldap;Wldap32.dll!ldap_first_attribute;997
network;ldap;Wldap32.dll!ldap_next_attribute;994
network;ldap;Wldap32.dll!ldap_first_entry;996
network;ldap;Wldap32.dll!ldap_next_entry;993
network;ldap;Wldap32.dll!ldap_search_s;992
network;ldap;Wldap32.dll!ldap_set_option;991
network;mgmt;iphlpapi.dll!GetIpAddrTable;755
network;mgmt;iphlpapi.dll!GetIpNetTable;835
network;mgmt;iphlpapi.dll!GetIpForwardTable;875
network;mgmt;iphlpapi.dll!GetTcpTable;754
network;mgmt;iphlpapi.dll!GetUdpTable;874
network;mgmt;iphlpapi.dll!SendARP;1017
network;mgmt;iphlpapi.dll!IcmpCreateFile;788
network;mgmt;iphlpapi.dll!IcmpSendEcho;834
network;mgmt;iphlpapi.dll!IcmpSendEcho2;1018
network;mgmt;iphlpapi.dll!Icmp6CreateFile;1021
network;mgmt;iphlpapi.dll!Icmp6SendEcho2;1020
network;mgmt;iphlpapi.dll!IcmpParseReplies;1019
network;mgmt;iphlpapi.dll!IcmpCloseHandle;789
network;mgmt;iphlpapi.dll!GetNetworkParams;790
network;mgmt;netapi32.dll!Netbios;976
network;mgmt;netapi32.dll!NetApiBufferFree;291
network;mgmt;netapi32.dll!NetGetJoinInformation;915
network;mgmt;netapi32.dll!NetLocalGroupAddMembers;818
network;mgmt;netapi32.dll!NetLocalGroupGetMembers;980
network;mgmt;netapi32.dll!NetMessageBufferSend;979
network;mgmt;netapi32.dll!NetRemoteTOD;914
network;mgmt;netapi32.dll!NetServerEnum;868
network;mgmt;netapi32.dll!NetServerGetInfo;912
network;mgmt;netapi32.dll!NetScheduleJobAdd;913
network;name;dnsapi.dll!DnsQuery_;563
network;name;dnsapi.dll!DnsFree;541
network;name;dnsapi.dll!DnsRecordListFree;792
network;name;dnsapi.dll!DnsFlushResolverCache;876
network;name;ws2_32.dll!gethostbyname;70
network;name;ws2_32.dll!gethostname;167
network;name;ws2_32.dll!getnameinfo;567
network;name;ws2_32.dll!GetNameInfo;943
network;share;mpr.dll!WNetEnumResource;493
network;share;mpr.dll!WNetOpenEnum;492
network;share;mpr.dll!WNetCloseEnum;388
network;share;mpr.dll!WNetGetConnection;918
network;share;mpr.dll!WNetAddConnection2;605
network;share;mpr.dll!WNetCancelConnection2;686
network;share;netapi32.dll!NetShareEnum;684
network;share;netapi32.dll!NetShareGetInfo;978
network;share;netapi32.dll!NetShareAdd;911
network;share;netapi32.dll!NetShareDel;910
network;sock;ws2_32.dll!socket;54
network;sock;ws2_32.dll!bind;153
network;sock;ws2_32.dll!listen;204
network;sock;ws2_32.dll!accept;221
network;sock;ws2_32.dll!connect;56
network;sock;ws2_32.dll!select;111
network;sock;ws2_32.dll!ioctlsocket;166
network;sock;ws2_32.dll!send;67
network;sock;ws2_32.dll!sendto;216
network;sock;ws2_32.dll!recv;86
network;sock;ws2_32.dll!recvfrom;266
network;sock;wsock32.dll!recv;471
network;sock;wsock32.dll!recvfrom;886
network;sock;ws2_32.dll!setsockopt;112
network;sock;wsock32.dll!setsockopt;843
network;sock;ws2_32.dll!shutdown;148
network;sock;ws2_32.dll!closesocket;51
network;sock;ws2_32.dll!freeaddrinfo;240
network;sock;ws2_32.dll!getaddrinfo;239
network;sock;ws2_32.dll!GetAddrInfo;722
network;sock;ws2_32.dll!gethostbyaddr;398
network;sock;ws2_32.dll!getpeername;235
network;sock;ws2_32.dll!getprotobyname;698
network;sock;ws2_32.dll!getprotobynumber;667
network;sock;ws2_32.dll!getservbyname;472
network;sock;ws2_32.dll!getservbyport;566
network;sock;ws2_32.dll!getsockname;201
network;sock;ws2_32.dll!getsockopt;313
network;sock;ws2_32.dll!inet_addr;95
network;sock;ws2_32.dll!inet_ntoa;117
network;sock;ws2_32.dll!ntohl;203
network;sock;ws2_32.dll!ntohs;65
network;user;netapi32.dll!NetUserEnum;477
network;user;netapi32.dll!NetUserAdd;817
network;user;netapi32.dll!NetUserDel;909
network;user;netapi32.dll!NetWkstaGetInfo;683
network;user;netapi32.dll!NetUserGetInfo;463
network;user;netapi32.dll!NetUserSetInfo;977
network;user;netapi32.dll!NetUserGetLocalGroups;816
network;winsock;ws2_32.dll!WSAStartup;32
network;winsock;ws2_32.dll!WSASocket;485
network;winsock;ws2_32.dll!WSAConnect;845
network;winsock;ws2_32.dll!WSAAsyncSelect;668
network;winsock;ws2_32.dll!WSACancelAsyncRequest;942
network;winsock;ws2_32.dll!WSAIoctl;257
network;winsock;ws2_32.dll!WSARecv;486
network;winsock;ws2_32.dll!WSARecvFrom;721
network;winsock;ws2_32.dll!WSASend;423
network;winsock;ws2_32.dll!WSASendTo;844
network;winsock;ws2_32.dll!WSACleanup;104
network;winsock;ws2_32.dll!WSACreateEvent;568
network;winsock;ws2_32.dll!WSAEventSelect;503
network;winsock;ws2_32.dll!WSAResetEvent;760
network;winsock;ws2_32.dll!WSACloseEvent;586
network;winsock;ws2_32.dll!WSAEnumNetworkEvents;585
network;winsock;ws2_32.dll!WSAWaitForMultipleEvents;720
network;winsock;ws2_32.dll!WSAAddressToString;617
network;winsock;ws2_32.dll!WSAGetOverlappedResult;699
network;winsock;ws2_32.dll!WSAStringToAddress;801
network;winsock;ws2_32.dll!WSAGetLastError;115
network;winsock;ws2_32.dll!WSASetLastError;327
network;winsock;ws2_32.dll!__WSAFDIsSet;194
network;wts;wtsapi32.dll!WTSEnumerateServers;1002
network;wts;wtsapi32.dll!WTSEnumerateSessions;842
network;wts;wtsapi32.dll!WTSQuerySessionInformation;841
network;wts;wtsapi32.dll!WTSSetSessionInformation;1000
network;wts;wtsapi32.dll!WTSRegisterSessionNotification;939
network;wts;kernel32.dll!WTSGetActiveConsoleSessionId;494
network;wts;wtsapi32.dll!WTSLogoffSession;940
network;wts;wtsapi32.dll!WTSDisconnectSession;1003
network;wts;wtsapi32.dll!WTSEnumerateProcesses;941
network;wts;wtsapi32.dll!WTSSendMessage;1001
network;wts;wtsapi32.dll!WTSVirtualChannelOpen;999
network;wts;wtsapi32.dll!WTSVirtualChannelWrite;998
network;wts;wtsapi32.dll!WTSQueryUserToken;638
network;wts;wtsapi32.dll!WTSFreeMemory;666
crypto;certificate;crypt32.dll!CertOpenStore;877
crypto;certificate;crypt32.dll!CertOpenSystemStore;580
crypto;certificate;crypt32.dll!CertCloseStore;469
crypto;certificate;crypt32.dll!PFXExportCertStoreEx;660
crypto;certificate;crypt32.dll!PFXImportCertStore;613
crypto;certificate;crypt32.dll!CertEnumCertificatesInStore;542
crypto;certificate;crypt32.dll!CertFindCertificateInStore;880
crypto;certificate;crypt32.dll!CertDeleteCertificateFromStore;662
crypto;certificate;crypt32.dll!CertDuplicateCertificateContext;614
crypto;certificate;crypt32.dll!CertGetCertificateChain;878
crypto;certificate;crypt32.dll!CertFreeCertificateChain;879
crypto;certificate;crypt32.dll!CertFreeCertificateContext;634
crypto;certificate;crypt32.dll!CertVerifyCertificateChainPolicy;836
crypto;certificate;crypt32.dll!CryptAcquireCertificatePrivateKey;989
crypto;crypt;advapi32.dll!CryptAcquireContext;215
crypto;crypt;advapi32.dll!CryptReleaseContext;120
crypto;crypt;crypt32.dll!CryptImportPublicKeyInfo;661
crypto;crypt;advapi32.dll!CryptImportKey;285
crypto;crypt;advapi32.dll!CryptGetUserKey;840
crypto;crypt;advapi32.dll!CryptGenKey;530
crypto;crypt;advapi32.dll!CryptDeriveKey;484
crypto;crypt;advapi32.dll!CryptDestroyKey;231
crypto;crypt;advapi32.dll!CryptDuplicateKey;937
crypto;crypt;advapi32.dll!CryptExportKey;502
crypto;crypt;advapi32.dll!CryptGetKeyParam;636
crypto;crypt;advapi32.dll!CryptSetKeyParam;501
crypto;crypt;advapi32.dll!CryptEncrypt;252
crypto;crypt;advapi32.dll!CryptDecrypt;378
crypto;crypt;advapi32.dll!CryptGenRandom;293
crypto;crypt;advapi32.dll!CryptVerifySignature;695
crypto;crypt;crypt32.dll!CryptStringToBinary;434
crypto;crypt;crypt32.dll!CryptBinaryToString;514
crypto;crypt;crypt32.dll!CryptDecodeObjectEx;551
crypto;crypt;crypt32.dll!CryptProtectData;988
crypto;crypt;crypt32.dll!CryptUnprotectData;397
crypto;crypt;secur32.dll!SealMessage;733
crypto;crypt;secur32.dll!UnsealMessage;732
crypto;hash;advapi32.dll!CryptCreateHash;193
crypto;hash;advapi32.dll!CryptDestroyHash;189
crypto;hash;advapi32.dll!CryptHashData;196
crypto;hash;advapi32.dll!CryptGetHashParam;245
crypto;hash;advapi32.dll!CryptSetHashParam;885
crypto;hash;imagehlp.dll!CheckSumMappedFile;934
crypto;hash;ntdll.dll!RtlComputeCrc32;815
crypto;random;msvcrt.dll!rand;246
crypto;random;msvcrt.dll!srand;262
crypto;random;ntdll.dll!RtlRandom;742
crypto;random;ntdll.dll!RtlRandomEx;906
other;compression;ntdll.dll!RtlGetCompressionWorkSpaceSize;781
other;compression;ntdll.dll!RtlCompressBuffer;782
other;compression;ntdll.dll!RtlDecompressBuffer;680
other;math;kernel32.dll!MulDiv;410
other;uid;ole32.dll!CoCreateGuid;430
other;uid;rpcrt4.dll!UuidCreate;707
other;uid;rpcrt4.dll!UuidFromString;901
other;uid;rpcrt4.dll!UuidToString;770
other;variants;oleaut32.dll!VariantInit;197
other;variants;oleaut32.dll!VarR4FromStr;454
other;variants;oleaut32.dll!VarR8FromStr;453
other;variants;oleaut32.dll!VarBoolFromStr;462
other;variants;oleaut32.dll!VarBstrFromBool;461
other;variants;oleaut32.dll!VarBstrFromCy;460
other;variants;oleaut32.dll!VarBstrFromDate;459
other;variants;oleaut32.dll!VarCyFromStr;457
other;variants;oleaut32.dll!VarDateFromStr;456
other;variants;oleaut32.dll!VarI4FromStr;455
other;variants;oleaut32.dll!SystemTimeToVariantTime;856
other;variants;oleaut32.dll!VariantChangeType;373
other;variants;oleaut32.dll!VariantChangeTypeEx;408
other;variants;oleaut32.dll!VariantCopy;393
other;variants;oleaut32.dll!VarCmp;458
other;variants;oleaut32.dll!VariantClear;157
device;audio;kernel32.dll!Beep;930
device;audio;user32.dll!MessageBeep;488
device;audio;msacm32.dll!acmStreamOpen;916
device;audio;msacm32.dll!acmStreamClose;917
device;audio;winmm.dll!timeSetEvent;847
device;audio;winmm.dll!waveInOpen;765
device;audio;winmm.dll!waveInClose;766
device;audio;winmm.dll!waveInStart;763
device;audio;winmm.dll!waveInPrepareHeader;764
device;audio;winmm.dll!waveInUnprepareHeader;762
device;audio;winmm.dll!waveOutOpen;947
device;audio;winmm.dll!waveOutClose;948
device;audio;winmm.dll!waveOutWrite;946
device;audio;winmm.dll!waveOutSetVolume;846
device;display;user32.dll!EnumDisplayDevices;768
device;display;user32.dll!EnumDisplayMonitors;570
device;display;user32.dll!MonitorFromPoint;806
device;display;user32.dll!MonitorFromWindow;703
device;display;user32.dll!GetMonitorInfo;621
device;display;user32.dll!GetSystemMetrics;108
device;driver;kernel32.dll!DeviceIoControl;308
device;driver;ntdll.dll!ZwDeviceIoControlFile;811
device;keyboard;imm32.dll!ImmGetContext;933
device;keyboard;imm32.dll!ImmReleaseContext;932
device;keyboard;user32.dll!BlockInput;730
device;keyboard;user32.dll!SendInput;728
device;keyboard;user32.dll!GetAsyncKeyState;451
device;keyboard;user32.dll!GetKeyState;249
device;keyboard;user32.dll!GetLastInputInfo;489
device;keyboard;user32.dll!GetRawInputData;959
device;keyboard;user32.dll!GetInputState;852
device;keyboard;user32.dll!VkKeyScan;805
device;keyboard;user32.dll!keybd_event;519
device;keyboard;user32.dll!LoadKeyboardLayout;704
device;keyboard;user32.dll!ActivateKeyboardLayout;640
device;keyboard;user32.dll!GetKeyboardLayout;372
device;keyboard;user32.dll!GetKeyboardLayoutList;505
device;keyboard;user32.dll!GetKeyboardLayoutName;851
device;keyboard;user32.dll!GetKeyboardState;314
device;keyboard;user32.dll!SetKeyboardState;672
device;keyboard;user32.dll!GetKeyboardType;426
device;keyboard;user32.dll!GetKeyNameText;622
device;keyboard;user32.dll!MapVirtualKey;504
device;keyboard;user32.dll!MapVirtualKeyEx;894
device;keyboard;user32.dll!RegisterRawInputDevices;957
device;mouse;comctl32.dll!_TrackMouseEvent;881
device;mouse;user32.dll!GetCapture;381
device;mouse;user32.dll!SetCapture;416
device;mouse;user32.dll!ReleaseCapture;473
device;mouse;user32.dll!GetCursor;623
device;mouse;user32.dll!SetCursor;425
device;mouse;user32.dll!GetCursorPos;274
device;mouse;user32.dll!SetCursorPos;415
device;mouse;user32.dll!GetCursorInfo;729
device;mouse;user32.dll!GetDoubleClickTime;853
device;mouse;user32.dll!GetMessagePos;439
device;mouse;user32.dll!mouse_event;556
device;mouse;user32.dll!TrackMouseEvent;893
device;network;iphlpapi.dll!GetAdaptersAddresses;756
device;network;iphlpapi.dll!GetAdaptersInfo;359
device;network;iphlpapi.dll!GetIfTable;791
device;printer;winspool.drv!EnumPrinters;945
device;printer;winspool.drv!OpenPrinter;723
device;printer;winspool.drv!ClosePrinter;569
device;printer;winspool.drv!GetDefaultPrinter;944
device;printer;winspool.drv!DocumentProperties;761
system;authorization;advapi32.dll!GetSecurityInfo;884
system;authorization;advapi32.dll!AllocateAndInitializeSid;220
system;authorization;advapi32.dll!LookupAccountSid;449
system;authorization;advapi32.dll!GetSidIdentifierAuthority;694
system;authorization;advapi32.dll!GetSidSubAuthority;284
system;authorization;advapi32.dll!GetSidSubAuthorityCount;310
system;authorization;advapi32.dll!CreateWellKnownSid;758
system;authorization;advapi32.dll!IsWellKnownSid;693
system;authorization;advapi32.dll!ConvertSidToStringSid;518
system;authorization;advapi32.dll!GetLengthSid;412
system;authorization;advapi32.dll!IsValidSid;635
system;authorization;advapi32.dll!EqualSid;312
system;authorization;advapi32.dll!FreeSid;214
system;authorization;advapi32.dll!InitializeAcl;664
system;authorization;advapi32.dll!InitializeSecurityDescriptor;248
system;authorization;advapi32.dll!SetEntriesInAcl;719
system;authorization;advapi32.dll!GetSecurityDescriptorDacl;839
system;authorization;advapi32.dll!SetSecurityDescriptorDacl;244
system;authorization;advapi32.dll!GetSecurityDescriptorSacl;422
system;authorization;advapi32.dll!SetSecurityDescriptorSacl;448
system;authorization;advapi32.dll!SetSecurityDescriptorGroup;837
system;authorization;secur32.dll!InitializeSecurityContext;855
system;authorization;secur32.dll!DeleteSecurityContext;734
system;authorization;advapi32.dll!GetTokenInformation;106
system;authorization;advapi32.dll!DuplicateTokenEx;500
system;authorization;ntdll.dll!RtlAdjustPrivilege;681
system;authorization;advapi32.dll!AdjustTokenPrivileges;121
system;authorization;ntdll.dll!ZwAdjustPrivilegesToken;974
system;authorization;advapi32.dll!LookupPrivilegeValue;209
system;authorization;advapi32.dll!CheckTokenMembership;361
system;authorization;ntdll.dll!ZwQueryInformationToken;712
system;authorization;advapi32.dll!SetTokenInformation;692
system;authorization;advapi32.dll!SetSecurityInfo;663
system;authorization;advapi32.dll!SetNamedSecurityInfo;581
system;clipboard;ole32.dll!OleGetClipboard;1009
system;clipboard;ole32.dll!OleSetClipboard;1008
system;clipboard;ole32.dll!OleIsCurrentClipboard;857
system;clipboard;ole32.dll!OleFlushClipboard;858
system;clipboard;user32.dll!OpenClipboard;320
system;clipboard;user32.dll!EnumClipboardFormats;898
system;clipboard;user32.dll!CountClipboardFormats;899
system;clipboard;user32.dll!IsClipboardFormatAvailable;590
system;clipboard;user32.dll!GetOpenClipboardWindow;960
system;clipboard;user32.dll!ChangeClipboardChain;807
system;clipboard;user32.dll!EmptyClipboard;427
system;clipboard;user32.dll!GetClipboardData;302
system;clipboard;user32.dll!SetClipboardData;438
system;clipboard;user32.dll!GetClipboardViewer;1007
system;clipboard;user32.dll!SetClipboardViewer;673
system;clipboard;user32.dll!CloseClipboard;321
system;console;shell32.dll!CommandLineToArgv;317
system;console;kernel32.dll!AllocConsole;579
system;console;kernel32.dll!GetConsoleMode;92
system;console;kernel32.dll!SetConsoleMode;631
system;console;kernel32.dll!GetConsoleWindow;611
system;console;kernel32.dll!GetConsoleCP;93
system;console;kernel32.dll!GetConsoleOutputCP;307
system;console;kernel32.dll!GetConsoleScreenBufferInfo;787
system;console;kernel32.dll!ReadConsole;400
system;console;kernel32.dll!WriteConsole;96
system;console;kernel32.dll!ReadConsoleInput;656
system;console;kernel32.dll!WriteConsoleInput;870
system;console;kernel32.dll!SetConsoleCtrlHandler;420
system;console;kernel32.dll!FlushConsoleInputBuffer;691
system;console;kernel32.dll!FreeConsole;499
system;control;powrprof.dll!CallNtPowerInformation;903
system;control;kernel32.dll!SetSystemPowerState;1015
system;control;user32.dll!LockWorkStation;958
system;control;advapi32.dll!InitiateSystemShutdown;1022
system;control;advapi32.dll!InitiateSystemShutdownEx;584
system;control;user32.dll!ExitWindowsEx;279
system;control;ntdll.dll!KiFastSystemCall;1012
system;control;ntdll.dll!KiFastSystemCallRet;1011
system;control;ntdll.dll!KiIntSystemCall;1010
system;control;ntdll.dll!ZwQueryObject;738
system;control;kernel32.dll!CreateToolhelp32Snapshot;77
system;env;kernel32.dll!GetSystemInfo;127
system;env;kernel32.dll!GetNativeSystemInfo;281
system;env;ntdll.dll!ZwQuerySystemInformation;399
system;env;kernel32.dll!GetSystemPowerStatus;831
system;env;user32.dll!SystemParametersInfo;341
system;env;advapi32.dll!GetCurrentHwProfile;799
system;env;kernel32.dll!GetLogicalProcessorInformation;786
system;env;kernel32.dll!IsProcessorFeaturePresent;110
system;env;kernel32.dll!GetOEMCP;55
system;env;kernel32.dll!GetVersion;130
system;env;ntdll.dll!RtlGetVersion;867
system;env;kernel32.dll!GetVersionEx;79
system;env;kernel32.dll!VerifyVersionInfo;630
system;env;ntdll.dll!VerSetConditionMask;442
system;env;kernel32.dll!GetACP;40
system;env;kernel32.dll!GetComputerName;119
system;env;kernel32.dll!GetComputerNameEx;690
system;env;kernel32.dll!GetCPInfo;46
system;env;kernel32.dll!GetGeoInfo;1016
system;env;kernel32.dll!GetUserGeoID;984
system;env;kernel32.dll!EnumSystemLocales;447
system;env;kernel32.dll!GetUserDefaultLCID;264
system;env;kernel32.dll!GetLocaleInfo;123
system;env;kernel32.dll!GetUserDefaultLangID;632
system;env;kernel32.dll!GetSystemDefaultLangID;446
system;env;kernel32.dll!GetUserDefaultUILanguage;403
system;env;kernel32.dll!GetSystemDefaultUILanguage;610
system;env;kernel32.dll!EnumCalendarInfo;483
system;env;kernel32.dll!GetDateFormat;377
system;env;kernel32.dll!GetTickCount;8
system;env;msvcrt.dll!getenv;575
system;env;userenv.dll!CreateEnvironmentBlock;555
system;env;userenv.dll!DestroyEnvironmentBlock;589
system;env;kernel32.dll!ExpandEnvironmentStrings;211
system;env;kernel32.dll!GetEnvironmentStrings;59
system;env;kernel32.dll!FreeEnvironmentStrings;60
system;env;kernel32.dll!GetEnvironmentVariable;152
system;env;kernel32.dll!SetEnvironmentVariable;190
system;env;kernel32.dll!GlobalFlags;609
system;env;kernel32.dll!FindAtom;924
system;env;kernel32.dll!AddAtom;931
system;env;kernel32.dll!GetAtomName;873
system;env;kernel32.dll!DeleteAtom;926
system;env;kernel32.dll!GlobalFindAtom;561
system;env;kernel32.dll!GlobalAddAtom;513
system;env;kernel32.dll!GlobalGetAtomName;716
system;env;kernel32.dll!GlobalDeleteAtom;468
system;events;kernel32.dll!CreateEvent;122
system;events;kernel32.dll!OpenEvent;383
system;events;ntdll.dll!ZwOpenEvent;866
system;events;advapi32.dll!RegisterEventSource;616
system;events;kernel32.dll!PulseEvent;784
system;events;advapi32.dll!ReportEvent;615
system;events;kernel32.dll!ResetEvent;141
system;events;kernel32.dll!SetEvent;82
system;events;advapi32.dll!OpenEventLog;936
system;events;advapi32.dll!BackupEventLog;1023
system;events;advapi32.dll!ClearEventLog;938
system;events;advapi32.dll!CloseEventLog;800
system;shell;shell32.dll!SHFileOperation;674
system;shell;shell32.dll!SHChangeNotify;524
system;shell;shell32.dll!SHGetMalloc;706
system;user;advapi32.dll!GetUserName;181
system;user;secur32.dll!GetUserNameEx;546
system;user;userenv.dll!LoadUserProfile;891
system;user;userenv.dll!UnloadUserProfile;850
system;user;advapi32.dll!LookupAccountName;797
system;user;user32.dll!GetUserObjectInformation;481
system;user;shell32.dll!IsUserAnAdmin;525
system;user;advapi32.dll!LogonUser;883
system;user;advapi32.dll!ImpersonateLoggedOnUser;516
system;user;advapi32.dll!RevertToSelf;552
system;user;advapi32.dll!CredEnumerate;757
system;user;advapi32.dll!CredFree;637
registry;mgmt;advapi32.dll!RegConnectRegistry;882
registry;mgmt;advapi32.dll!RegOpenKey;254
registry;mgmt;advapi32.dll!RegOpenKeyEx;78
registry;mgmt;ntdll.dll!ZwOpenKey;740
registry;mgmt;advapi32.dll!RegOpenCurrentUser;838
registry;mgmt;advapi32.dll!RegCloseKey;21
registry;mgmt;advapi32.dll!RegNotifyChangeKeyValue;582
registry;read;advapi32.dll!RegEnumKey;583
registry;read;advapi32.dll!RegEnumKeyEx;256
registry;read;advapi32.dll!RegEnumValue;334
registry;read;advapi32.dll!RegQueryInfoKey;435
registry;read;advapi32.dll!RegQueryValue;794
registry;read;advapi32.dll!RegQueryValueEx;83
registry;read;ntdll.dll!ZwEnumerateValueKey;777
registry;read;ntdll.dll!ZwQueryKey;865
registry;read;ntdll.dll!ZwQueryValueKey;711
registry;read;shlwapi.dll!SHGetValue;731
registry;write;advapi32.dll!RegCreateKey;277
registry;write;advapi32.dll!RegCreateKeyEx;178
registry;write;ntdll.dll!ZwCreateKey;813
registry;write;advapi32.dll!RegFlushKey;348
registry;write;advapi32.dll!RegSaveKey;935
registry;write;advapi32.dll!RegSetValue;990
registry;write;shlwapi.dll!SHSetValue;769
registry;write;advapi32.dll!RegSetValueEx;90
registry;write;ntdll.dll!ZwSetValueKey;709
registry;delete;advapi32.dll!RegDeleteKey;309
registry;delete;ntdll.dll!ZwDeleteKey;971
registry;delete;shlwapi.dll!SHDeleteKey;545
registry;delete;advapi32.dll!RegDeleteValue;229
registry;delete;shlwapi.dll!SHDeleteValue;572
registry;delete;ntdll.dll!ZwDeleteValueKey;778
