库 KERNEL32.dll:
• 0x1400530f8 - TerminateThread
• 0x140053100 - LoadLibraryA
• 0x140053108 - CloseHandle
• 0x140053110 - GetNativeSystemInfo
• 0x140053118 - CreateThread
• 0x140053120 - SetVolumeMountPointW
• 0x140053128 - GetProcAddress
• 0x140053130 - LocalFree
• 0x140053138 - DeleteCriticalSection
• 0x140053140 - ExitProcess
• 0x140053148 - GetCurrentProcessId
• 0x140053150 - GetModuleHandleW
• 0x140053158 - CopyFileW
• 0x140053160 - GetVolumePathNamesForVolumeNameW
• 0x140053168 - lstrcpyW
• 0x140053170 - SleepEx
• 0x140053178 - GetDiskFreeSpaceExA
• 0x140053180 - CreateEventA
• 0x140053188 - FindNextVolumeW
• 0x140053190 - lstrcmpiW
• 0x140053198 - CreateIoCompletionPort
• 0x1400531a0 - GetTickCount
• 0x1400531a8 - lstrcmpW
• 0x1400531b0 - GetDriveTypeW
• 0x1400531b8 - GetComputerNameA
• 0x1400531c0 - TerminateProcess
• 0x1400531c8 - OpenProcess
• 0x1400531d0 - CreateToolhelp32Snapshot
• 0x1400531d8 - Process32NextW
• 0x1400531e0 - QueryDosDeviceW
• 0x1400531e8 - GetFinalPathNameByHandleW
• 0x1400531f0 - K32GetModuleFileNameExW
• 0x1400531f8 - DuplicateHandle
• 0x140053200 - CreateEventW
• 0x140053208 - GetWindowsDirectoryW
• 0x140053210 - FindVolumeClose
• 0x140053218 - GetFileType
• 0x140053220 - GetTickCount64
• 0x140053228 - GetCurrentThread
• 0x140053230 - GetSystemTimeAsFileTime
• 0x140053238 - ReadFile
• 0x140053240 - GetFileSizeEx
• 0x140053248 - SetEndOfFile
• 0x140053250 - SetFileAttributesW
• 0x140053258 - SetFilePointerEx
• 0x140053260 - SleepConditionVariableCS
• 0x140053268 - WakeConditionVariable
• 0x140053270 - InitializeConditionVariable
• 0x140053278 - GetSystemInfo
• 0x140053280 - GlobalMemoryStatusEx
• 0x140053288 - WriteConsoleW
• 0x140053290 - ReadConsoleW
• 0x140053298 - HeapSize
• 0x1400532a0 - GetConsoleMode
• 0x1400532a8 - GetConsoleOutputCP
• 0x1400532b0 - FlushFileBuffers
• 0x1400532b8 - GetDiskFreeSpaceExW
• 0x1400532c0 - SetEvent
• 0x1400532c8 - GetLastError
• 0x1400532d0 - Sleep
• 0x1400532d8 - MultiByteToWideChar
• 0x1400532e0 - PostQueuedCompletionStatus
• 0x1400532e8 - GetLocaleInfoA
• 0x1400532f0 - GetModuleHandleA
• 0x1400532f8 - GetCurrentThreadId
• 0x140053300 - GetFileAttributesW
• 0x140053308 - CreateFileW
• 0x140053310 - WaitForSingleObject
• 0x140053318 - FindClose
• 0x140053320 - lstrlenA
• 0x140053328 - GetQueuedCompletionStatus
• 0x140053330 - SetErrorMode
• 0x140053338 - InitializeCriticalSection
• 0x140053340 - LeaveCriticalSection
• 0x140053348 - WaitForMultipleObjects
• 0x140053350 - GetModuleFileNameW
• 0x140053358 - GetUserDefaultLangID
• 0x140053360 - WriteFile
• 0x140053368 - lstrlenW
• 0x140053370 - GetCurrentProcess
• 0x140053378 - FindNextFileW
• 0x140053380 - GetCommandLineW
• 0x140053388 - EnterCriticalSection
• 0x140053390 - FindFirstVolumeW
• 0x140053398 - FindFirstFileExW
• 0x1400533a0 - GetLogicalDrives
• 0x1400533a8 - MoveFileW
• 0x1400533b0 - OutputDebugStringW
• 0x1400533b8 - SetStdHandle
• 0x1400533c0 - GetProcessHeap
• 0x1400533c8 - FreeEnvironmentStringsW
• 0x1400533d0 - GetEnvironmentStringsW
• 0x1400533d8 - GetCommandLineA
• 0x1400533e0 - GetOEMCP
• 0x1400533e8 - GetACP
• 0x1400533f0 - IsValidCodePage
• 0x1400533f8 - EnumSystemLocalesW
• 0x140053400 - GetUserDefaultLCID
• 0x140053408 - IsValidLocale
• 0x140053410 - GetLocaleInfoW
• 0x140053418 - LCMapStringW
• 0x140053420 - FlsFree
• 0x140053428 - QueryPerformanceCounter
• 0x140053430 - lstrcatW
• 0x140053438 - FlsSetValue
• 0x140053440 - FlsGetValue
• 0x140053448 - FlsAlloc
• 0x140053450 - HeapAlloc
• 0x140053458 - HeapFree
• 0x140053460 - HeapReAlloc
• 0x140053468 - GetStdHandle
• 0x140053470 - GetModuleHandleExW
• 0x140053478 - LoadLibraryExW
• 0x140053480 - FreeLibrary
• 0x140053488 - TlsFree
• 0x140053490 - TlsSetValue
• 0x140053498 - RtlCaptureContext
• 0x1400534a0 - RtlLookupFunctionEntry
• 0x1400534a8 - RtlVirtualUnwind
• 0x1400534b0 - UnhandledExceptionFilter
• 0x1400534b8 - SetUnhandledExceptionFilter
• 0x1400534c0 - IsProcessorFeaturePresent
• 0x1400534c8 - ReleaseSRWLockExclusive
• 0x1400534d0 - AcquireSRWLockExclusive
• 0x1400534d8 - WakeAllConditionVariable
• 0x1400534e0 - SleepConditionVariableSRW
• 0x1400534e8 - IsDebuggerPresent
• 0x1400534f0 - GetStartupInfoW
• 0x1400534f8 - InitializeSListHead
• 0x140053500 - GetStringTypeW
• 0x140053508 - WideCharToMultiByte
• 0x140053510 - InitializeCriticalSectionEx
• 0x140053518 - EncodePointer
• 0x140053520 - DecodePointer
• 0x140053528 - LCMapStringEx
• 0x140053530 - GetCPInfo
• 0x140053538 - RtlUnwindEx
• 0x140053540 - RtlPcToFileHeader
• 0x140053548 - RaiseException
• 0x140053550 - SetLastError
• 0x140053558 - InitializeCriticalSectionAndSpinCount
• 0x140053560 - TlsAlloc
• 0x140053568 - TlsGetValue
库 ADVAPI32.dll:
• 0x140053000 - OpenServiceW
• 0x140053008 - CryptReleaseContext
• 0x140053010 - OpenThreadToken
• 0x140053018 - AllocateAndInitializeSid
• 0x140053020 - SetEntriesInAclW
• 0x140053028 - SetNamedSecurityInfoW
• 0x140053030 - FreeSid
• 0x140053038 - ControlService
• 0x140053040 - EnumDependentServicesW
• 0x140053048 - QueryServiceConfigW
• 0x140053050 - ChangeServiceConfigW
• 0x140053058 - EnumServicesStatusW
• 0x140053060 - QueryServiceStatusEx
• 0x140053068 - LookupPrivilegeValueW
• 0x140053070 - AdjustTokenPrivileges
• 0x140053078 - CreateServiceW
• 0x140053080 - RegCloseKey
• 0x140053088 - CryptAcquireContextW
• 0x140053090 - CloseServiceHandle
• 0x140053098 - RegQueryValueExA
• 0x1400530a0 - CryptGenRandom
• 0x1400530a8 - OpenSCManagerW
• 0x1400530b0 - RegSetValueExW
• 0x1400530b8 - OpenProcessToken
• 0x1400530c0 - StartServiceW
• 0x1400530c8 - RegOpenKeyExA
• 0x1400530d0 - RegOpenKeyExW
• 0x1400530d8 - GetTokenInformation