ntdll.dll
      LdrLoadDll (0x64033f83)
      NtClose (0xfd507add)
      NtTerminateProcess (0xf779110f)
      RtlInitUnicodeString (0x60a350a9)
      RtlMoveMemory (0x845136e7)
      RtlZeroMemory (0x8a3d4cb0)
  kernel32.dll
      CopyFileW (0x306cceb7)
      CreateEventW (0xfd4027f2)
      CreateFileMappingW (0x5b3f901c)
      CreateThread (0x60277e71)
      DeleteFileW (0xb7e96d0f)
      ExpandEnvironmentStringsW (0x057074bb)
      GetModuleFileNameA (0x8acccaed)
      GetModuleFileNameW (0x8acccdc3)
      GetModuleHandleA (0x9cbd2a58)
      GetSystemDirectoryA (0xaebc5060)
      GetTempFileNameW (0x9a376a33)
      GetTempPathW (0x7e28b9df)
      GetVolumeInformationA (0xf25ce6a4)
      LocalAlloc (0xeda647bb)
      LocalFree (0x742c61b2)
      MapViewOfFile (0x4db4c713)
      Sleep (0xd156a5be)
      WaitForSingleObject (0x8681d8fa)
      lstrcatW (0x2ab51a99)
      lstrcmpA (0x2abb9b4b)
  user32.dll
      EnumChildWindows (0x9a8897c9)
      EnumPropsA (0x8f0f57cf)
      GetForegroundWindow (0x5a6c9878)
      GetKeyboardLayoutList (0x04e9de30)
      GetShellWindow (0xd454e895)
      GetWindowThreadProcessId (0x576a5801)
      SendMessageA (0x41ecd315)
      SendNotifyMessageA (0xc6123bae)
      SetPropA (0x90bc10d3)
      wsprintfW (0x0bafd3f9)
  advapi32.dll
      GetTokenInformation (0x696464ac)
      OpenProcessToken (0x74f5e377)
  shell32.dll
      ShellExecuteExW (0xf8e40384)