list of handy dll functions

Put simple Tips and Tricks that are not entire Tutorials in this forum
User avatar
jeeswg
Posts: 5430
Joined: 19 Dec 2016, 01:58
Location: UK

list of handy dll functions

04 Jul 2017, 12:32

See also:
list of dll functions with parameter types for DllCall - AutoHotkey Community
https://autohotkey.com/boards/viewtopic.php?f=7&t=30832

A list of handy dll functions based on DllCall lines found in multiple scripts and libraries, and from functions inside the AutoHotkey source code.

The full list is in the post below.
list of handy dll functions - AutoHotkey Community
https://autohotkey.com/boards/viewtopic ... 81#p157581

==================================================

LINKS:
list of dll functions with parameter types for DllCall - AutoHotkey Community
https://autohotkey.com/boards/viewtopic.php?f=7&t=30832
WinApi
https://hotkeyit.github.io/v2/docs/commands/WinApi.htm
GitHub - Lexikos/AutoHotkey_L: AutoHotkey - macro-creation and automation-oriented scripting utility for Windows.
https://github.com/Lexikos/AutoHotkey_L
WinApi, DllCalls & AHK - AutoHotkey Community
https://autohotkey.com/boards/viewtopic.php?f=7&t=406

==================================================

NOTES:
- For each dll, I used the lowercase version of the dll name. All of the dll files (in the system32 folder) had lowercase names except for 'Magnification' and 'IPHLPAPI'.
- I added 'gui dc' for any function whose definition in https://hotkeyit.github.io/v2/docs/commands/WinApi.htm contained 'hDC' (handle to a device context).

POSSIBLE FUTURE IMPROVEMENTS:
- To add 'deprecated'/'no MSDN page' where appropriate or as separate lists.
- A separate list, AHK commands/functions/variables and related dll functions.

SUFFIXES:
- The suffixes 'A/W' indicate ANSI/wide (Unicode).
- The suffix 'Ex' indicates extended (e.g. RegisterClassEx is similar to RegisterClass, but has more functionality).

CASE DIFFERS (FUNCTION NAMES): 'A' v. 'W' versions:
freeaddrinfo/FreeAddrInfoW
getaddrinfo/GetAddrInfoW
socket/SocketA
socket/SocketW

CASE DIFFERS (FUNCTION NAMES): MSDN V. DLL EXPORT:
(note: in the list above I used the case as exported by the dll, except for the following functions where I used the MSDN version:)
dll: (from MSDN)/(from dll)
msvcrt: strftime/Strftime
user32: EndMenuA/endMenuA
user32: EndMenuW/endMenuW
user32: RegisterShellHookWindow/registerShellHookWindow
user32: SetRect/setRect
user32: ValidateRect/validateRect
ws2_32: accept/Accept
ws2_32: connect/Connect
ws2_32: gethostbyname/GetHostByName
ws2_32: htons/Htons
ws2_32: recv/Recv
ws2_32: select/Select
ws2_32: send/Send

DLLS WITH VARIATIONS:
C:\WINDOWS\system32\atl.dll
C:\WINDOWS\system32\atl100.dll
C:\WINDOWS\system32\atl110.dll

FUNCTIONS THAT APPEAR IN MORE THAN ONE DLL:
GetModuleBaseName: kernel32/psapi
GetProcessImageFileName: kernel32/psapi

==================================================

DLL LISTS: GUI (CREATE WINDOWS/CONTROLS):
- RegisterClassEx
- CreateWindowEx

DLL LISTS: GUI (GET/SET EXTERNAL CONTROL TEXT):
- OpenProcess
- VirtualAllocEx
- WriteProcessMemory
- ReadProcessMemory
- VirtualFreeEx
- CloseHandle

DLL LISTS: DATE/TIME:
- GetLocalTime (time now: local SYSTEMTIME)
- GetSystemTime (time now: UTC SYSTEMTIME)
- (no handy function?) (time now: local FILETIME)
- GetSystemTimeAsFileTime (time now: UTC FILETIME)
- FileTimeToLocalFileTime (convert UTC FILETIME to local FILETIME)
- LocalFileTimeToFileTime (convert local FILETIME to UTC FILETIME)
- SystemTimeToFileTime (convert SYSTEMTIME TO FILETIME)
- FileTimeToSystemTime (convert FILETIME TO SYSTEMTIME)

DLL LISTS: TEXT:
- CryptBinaryToString/CryptStringToBinary (convert between binary data/hex/base64)
- GetPrivateProfileString/WritePrivateProfileString (ini read/write)
- IsTextUnicode ('Bush hid the facts' bug)
- LCMapString (convert between UTF-16 little endian/big endian)
- MultiByteToWideChar/WideCharToMultiByte (convert between ANSI/UTF-8/UTF-16 little endian)

==================================================

Code: Select all

q:: ;list a dll's functions
;[list of 30 dlls from the AutoHotkey_H documentation]
;[28 if remove duplicate of Kernel32 and if remove Winspool]
;list converted to lowercase from: https://hotkeyit.github.io/v2/docs/commands/WinApi.htm
vListDll := "advapi32,comctl32,comdlg32,crypt32,gdi32,gdiplus,glu32,hid,kernel32,ole32,oleacc,oleaut32,opengl32,psapi,rasapi32,rasdlg,rasman,shell32,shlwapi,tapi32,user32,userenv,uxtheme,version,winhttp,wininet,winmm,ws2_32"
;list converted to lowercase from: AHK exe list of memory regions via process hacker
;vListDll := "advapi32,apisetschema,comctl32,comdlg32,cryptbase,dwmapi,gdi32,imm32,kernel32,kernelbase,lpk,msctf,msvcrt,nsi,ntdll,ole32,oleaut32,psapi,rpcrt4,sechost,shell32,shlwapi,sspicli,user32,usp10,uxtheme,version,winmm,wow64,wow64cpu,wow64win,ws2_32,wsock32"
vOutput := ""
VarSetCapacity(vOutput, 1000000*2)
Loop, Parse, vListDll, % ","
{
	vTemp := "[" A_LoopField "]`n" DllListExports(A_LoopField ".dll")
	vTemp := StrReplace(vTemp, "`n", "`n" A_LoopField "\")
	vOutput .= vTemp "`n"
}
vOutput := StrReplace(vOutput, "`n", "`r`n")
Clipboard := vOutput
MsgBox, % "done"
return

;==================================================

;DllListExports() - List of Function exports of a DLL - AutoHotkey Community
;https://autohotkey.com/boards/viewtopic.php?f=6&t=4563

DllListExports( DLL, Hdr := 0 ) {   ;   By SKAN,  http://goo.gl/DsMqa6 ,  CD:26/Aug/2010 | MD:14/Sep/2014

Local LOADED_IMAGE, nSize := VarSetCapacity( LOADED_IMAGE, 84, 0 ), pMappedAddress, pFileHeader
    , pIMGDIR_EN_EXP, IMAGE_DIRECTORY_ENTRY_EXPORT := 0, RVA, VA, LIST := ""
    , hModule := DllCall( "LoadLibrary", "Str","ImageHlp.dll", "Ptr" )

  If ! DllCall( "ImageHlp\MapAndLoad", "AStr",DLL, "Int",0, "Ptr",&LOADED_IMAGE, "Int",True, "Int",True )
    Return

  pMappedAddress := NumGet( LOADED_IMAGE, ( A_PtrSize = 4 ) ?  8 : 16 )
  pFileHeader    := NumGet( LOADED_IMAGE, ( A_PtrSize = 4 ) ? 12 : 24 )

  pIMGDIR_EN_EXP := DllCall( "ImageHlp\ImageDirectoryEntryToData", "Ptr",pMappedAddress
                           , "Int",False, "UShort",IMAGE_DIRECTORY_ENTRY_EXPORT, "PtrP",nSize, "Ptr" )

  VA  := DllCall( "ImageHlp\ImageRvaToVa", "Ptr",pFileHeader, "Ptr",pMappedAddress, "UInt"
, RVA := NumGet( pIMGDIR_EN_EXP + 12 ), "Ptr",0, "Ptr" )

  If ( VA ) {
     VarSetCapacity( LIST, nSize, 0 )
     Loop % NumGet( pIMGDIR_EN_EXP + 24, "UInt" ) + 1
        LIST .= StrGet( Va + StrLen( LIST ), "" ) "`n"
             ,  ( Hdr = 0 and A_Index = 1 and ( Va := Va + StrLen( LIST ) ) ? LIST := "" : "" )
  }

  DllCall( "ImageHlp\UnMapAndLoad", "Ptr",&LOADED_IMAGE ),   DllCall( "FreeLibrary", "Ptr",hModule )

Return RTrim( List, "`n" )
}
==================================================

Code: Select all

q:: ;an attempt to retrieve custom and dll functions from the AHK source code (these can then be filtered by checking if the functions exist in a dll)
;[download AHK source code from:]
;GitHub - Lexikos/AutoHotkey_L: AutoHotkey - macro-creation and automation-oriented scripting utility for Windows.
;https://github.com/Lexikos/AutoHotkey_L

vDir1 = %A_Desktop%\AutoHotkey_L-master
if !FileExist(vDir1)
{
	MsgBox, % "error: folder not found"
	return
}
vOutput := ""
VarSetCapacity(vOutput, 1000000*2)
vIsV1 := !!SubStr(1,0)
Loop, Files, % vDir1 "\*.cpp", FR
{
	vPath := A_LoopFileFullPath
	SplitPath, vPath, vName, vDir, vExt, vNameNoExt, vDrive
	FileRead, vText, % vPath
	vList := "`r`n!)*,."">;[]:/`t#$%&-+='~|{}<?@\^``"
	Loop, Parse, vList
		vText := StrReplace(vText, A_LoopField, "")
	Loop, Parse, vText, % " "
	{
		vTemp := A_LoopField
		while (SubStr(vTemp, 1, 1) = "(")
			vTemp := SubStr(vTemp, 2)
		if (vPos := InStr(vTemp, "(", 0, vIsV1-1))
			vOutput .= SubStr(vTemp, 1, vPos-1) "`n"
	}
}

while InStr(vOutput, "((")
	vOutput := StrReplace(vOutput, "((", "(")
vOutput := StrReplace(vOutput, "(`n", "`n")
vOutput := StrReplace(vOutput, "(", "`n")

Sort, vOutput, U
vOutput := StrReplace(vOutput, "`n", "`r`n")
Clipboard := vOutput
MsgBox, % "done"
return
Last edited by jeeswg on 21 Aug 2017, 17:48, edited 2 times in total.
User avatar
jeeswg
Posts: 5430
Joined: 19 Dec 2016, 01:58
Location: UK

Re: list of handy dll functions

04 Jul 2017, 12:33

Code: Select all

[List Dlls Referenced]
C:\Windows\System32\advapi32.dll=
C:\Windows\System32\atl.dll=
C:\Windows\System32\bcrypt.dll=
C:\Windows\System32\comctl32.dll=
C:\Windows\System32\comdlg32.dll=
C:\Windows\System32\crypt32.dll=
C:\Windows\System32\dwmapi.dll=
C:\Windows\System32\gdi32.dll=
C:\Windows\System32\ieframe.dll=
C:\Windows\System32\imagehlp.dll=
C:\Windows\System32\IPHLPAPI.DLL=
C:\Windows\System32\kernel32.dll=
C:\Windows\System32\Magnification.dll=
C:\Windows\System32\msvcrt.dll=
C:\Windows\System32\ntdll.dll=
C:\Windows\System32\ole32.dll=
C:\Windows\System32\oleacc.dll=
C:\Windows\System32\oleaut32.dll=
C:\Windows\System32\powrprof.dll=
C:\Windows\System32\propsys.dll=
C:\Windows\System32\psapi.dll=
C:\Windows\System32\secur32.dll=
C:\Windows\System32\shell32.dll=
C:\Windows\System32\shlwapi.dll=
C:\Windows\System32\urlmon.dll=
C:\Windows\System32\user32.dll=
C:\Windows\System32\uxtheme.dll=
C:\Windows\System32\version.dll=
C:\Windows\System32\wininet.dll=
C:\Windows\System32\winmm.dll=
C:\Windows\System32\ws2_32.dll=
gdiplus.dll=

[List]
advapi32\AdjustTokenPrivileges=process
advapi32\CloseServiceHandle=? service
advapi32\CreateProcessWithLogon=process run
advapi32\CryptAcquireContext=hash
advapi32\CryptCreateHash=hash
advapi32\CryptDestroyHash=hash
advapi32\CryptGetHashParam=hash
advapi32\CryptHashData=hash
advapi32\CryptReleaseContext=hash
advapi32\GetTokenInformation=? process
advapi32\GetUserName=system envvar
advapi32\IsTextUnicode=string encoding
advapi32\LockServiceDatabase=? service
advapi32\LookupPrivilegeValue=process
advapi32\OpenProcessToken=process
advapi32\OpenSCManager=? service
advapi32\RegCloseKey=registry
advapi32\RegConnectRegistry=registry/system drive/remote
advapi32\RegCreateKey=registry write
advapi32\RegCreateKeyEx=registry write
advapi32\RegDeleteKey=registry delete
advapi32\RegDeleteKeyEx=registry delete
advapi32\RegDeleteValue=registry delete
advapi32\RegEnumKey=registry list
advapi32\RegEnumKeyEx=registry list
advapi32\RegEnumValue=registry list
advapi32\RegOpenKey=registry
advapi32\RegOpenKeyEx=registry
advapi32\RegQueryInfoKey=registry
advapi32\RegQueryValue=registry read
advapi32\RegQueryValueEx=registry read
advapi32\RegSetValue=registry write
advapi32\RegSetValueEx=registry write
advapi32\UnlockServiceDatabase=? service
atl\AtlAxAttachControl=gui control
atl\AtlAxCreateControl=gui control
atl\AtlAxGetControl=gui control/interface
atl\AtlAxGetHost=interface
atl\AtlAxWinInit=gui control
bcrypt\BCryptCloseAlgorithmProvider=hash
bcrypt\BCryptCreateHash=hash
bcrypt\BCryptDestroyHash=hash
bcrypt\BCryptFinishHash=hash
bcrypt\BCryptGetProperty=hash
bcrypt\BCryptHashData=hash
bcrypt\BCryptOpenAlgorithmProvider=hash
comctl32\CreateStatusWindow=?
comctl32\DllGetVersion=dll/file version
comctl32\ImageList_Add=gui image list
comctl32\ImageList_AddIcon=gui image list/gui icon
comctl32\ImageList_AddMasked=gui image list
comctl32\ImageList_Create=gui image list
comctl32\ImageList_Destroy=gui image list
comctl32\ImageList_GetIcon=gui image list/gui icon
comctl32\ImageList_GetIconSize=gui image list/gui icon
comctl32\ImageList_GetImageInfo=gui image list
comctl32\ImageList_Replace=gui image list
comctl32\ImageList_ReplaceIcon=gui image list
comctl32\InitCommonControls=gui control
comctl32\InitCommonControlsEx=gui control
comctl32\PropertySheet=? property sheet
comdlg32\CommDlgExtendedError=gui dialog
comdlg32\GetOpenFileName=gui dialog
comdlg32\GetSaveFileName=gui dialog
crypt32\CryptBinaryToString=binary/string convert/string base64/string hex
crypt32\CryptStringToBinary=binary/string convert/string base64/string hex
dwmapi\DwmGetWindowAttribute=gui position
dwmapi\DwmIsCompositionEnabled=system aero mode
gdi32\BitBlt=gui image/gui dc
gdi32\CreateBitmap=gui image
gdi32\CreateCompatibleBitmap=gui image/gui dc
gdi32\CreateCompatibleDC=gui dc
gdi32\CreateDC=gui dc
gdi32\CreateDIBSection=gui image/gui dc
gdi32\CreateEllipticRgn=gui image region
gdi32\CreateFont=gui font
gdi32\CreateFontIndirect=gui font
gdi32\CreateIC=? gui dc
gdi32\CreatePatternBrush=gui brush
gdi32\CreatePen=gui pen
gdi32\CreatePolygonRgn=gui image region
gdi32\CreateRectRgn=gui image region
gdi32\CreateRectRgnIndirect=gui image region
gdi32\CreateRoundRectRgn=gui image region
gdi32\CreateSolidBrush=gui brush
gdi32\DeleteDC=gui dc
gdi32\DeleteEnhMetaFile=clipboard
gdi32\DeleteObject=gui object
gdi32\EnumFontFamilies=font list/gui dc
gdi32\EnumFontFamiliesEx=font list/gui dc
gdi32\ExcludeClipRect=gui image region/gui dc
gdi32\FillRgn=gui image region/gui dc
gdi32\GdiFlush=gui image draw
gdi32\GetCharABCWidths=gui dc/gui font
gdi32\GetClipBox=gui dc
gdi32\GetClipRgn=gui image region/gui dc
gdi32\GetCurrentObject=gui dc
gdi32\GetDeviceCaps=gui image/gui dc
gdi32\GetDIBColorTable=gui dc
gdi32\GetDIBits=gui image/gui dc
gdi32\GetEnhMetaFileBits=clipboard
gdi32\GetFontUnicodeRanges=gui font/gui dc
gdi32\GetLayout=gui dc
gdi32\GetObject=gui object
gdi32\GetPaletteEntries=gui palette
gdi32\GetPath=gui dc
gdi32\GetPixel=gui dc
gdi32\GetStockObject=gui object
gdi32\GetSystemPaletteEntries=gui dc/gui palette
gdi32\GetTextExtentPoint32=gui font/gui dc
gdi32\GetTextFace=gui font/gui dc
gdi32\GetTextMetrics=font/gui dc
gdi32\RealizePalette=gui image/gui dc
gdi32\Rectangle=gui image/gui dc
gdi32\RoundRect=gui dc
gdi32\SelectObject=gui object/gui dc
gdi32\SelectPalette=gui image/gui dc
gdi32\SetBkColor=gui colour/gui dc
gdi32\SetBkMode=gui dc
gdi32\SetEnhMetaFileBits=clipboard
gdi32\SetStretchBltMode=gui image/gui dc
gdi32\SetTextColor=gui colour/gui dc
gdi32\StretchBlt=gui image/gui dc
gdi32\TextOut=gui dc/gui image/string
gdiplus\GdipAddPathEllipse=gdip
gdiplus\GdipAddPathPolygon=gdip
gdiplus\GdipBitmapGetPixel=gdip
gdiplus\GdipBitmapLockBits=gdip
gdiplus\GdipBitmapSetPixel=gdip
gdiplus\GdipBitmapSetResolution=gdip
gdiplus\GdipBitmapUnlockBits=gdip
gdiplus\GdipCloneBitmapArea=gdip
gdiplus\GdipCloneBrush=gdip
gdiplus\GdipCreateBitmapFromFile=gdip
gdiplus\GdipCreateBitmapFromFileICM=gdip
gdiplus\GdipCreateBitmapFromGdiDib=gdip
gdiplus\GdipCreateBitmapFromHBITMAP=gdip
gdiplus\GdipCreateBitmapFromHICON=gdip
gdiplus\GdipCreateBitmapFromScan0=gdip
gdiplus\GdipCreateBitmapFromStream=gdip
gdiplus\GdipCreateFont=gdip
gdiplus\GdipCreateFontFamilyFromName=gdip
gdiplus\GdipCreateFromHDC=gdip/gui dc
gdiplus\GdipCreateHatchBrush=gdip
gdiplus\GdipCreateHBITMAPFromBitmap=gdip
gdiplus\GdipCreateHICONFromBitmap=gdip
gdiplus\GdipCreateImageAttributes=gdip
gdiplus\GdipCreateLineBrush=gdip
gdiplus\GdipCreateLineBrushFromRect=gdip
gdiplus\GdipCreateMatrix2=gdip
gdiplus\GdipCreateMatrix=gdip
gdiplus\GdipCreatePath=gdip
gdiplus\GdipCreatePen1=gdip
gdiplus\GdipCreatePen2=gdip
gdiplus\GdipCreateRegion=gdip
gdiplus\GdipCreateSolidFill=gdip
gdiplus\GdipCreateStringFormat=gdip
gdiplus\GdipCreateTexture2=gdip
gdiplus\GdipCreateTexture=gdip
gdiplus\GdipDeleteBrush=gdip
gdiplus\GdipDeleteFont=gdip
gdiplus\GdipDeleteFontFamily=gdip
gdiplus\GdipDeleteGraphics=gdip
gdiplus\GdipDeleteMatrix=gdip
gdiplus\GdipDeletePath=gdip
gdiplus\GdipDeletePen=gdip
gdiplus\GdipDeleteRegion=gdip
gdiplus\GdipDeleteStringFormat=gdip
gdiplus\GdipDisposeImage=gdip
gdiplus\GdipDisposeImageAttributes=gdip
gdiplus\GdipDrawArc=gdip
gdiplus\GdipDrawBezier=gdip
gdiplus\GdipDrawEllipse=gdip
gdiplus\GdipDrawImagePointsRect=gdip
gdiplus\GdipDrawImageRectRect=gdip
gdiplus\GdipDrawLine=gdip
gdiplus\GdipDrawLines=gdip
gdiplus\GdipDrawPie=gdip
gdiplus\GdipDrawRectangle=gdip
gdiplus\GdipDrawString=gdip
gdiplus\GdipFillEllipse=gdip
gdiplus\GdipFillPath=gdip
gdiplus\GdipFillPie=gdip
gdiplus\GdipFillPolygon=gdip
gdiplus\GdipFillRectangle=gdip
gdiplus\GdipFillRegion=gdip
gdiplus\GdipGetClip=gdip
gdiplus\GdipGetDC=gdip/gui dc
gdiplus\GdipGetDpiX=gdip
gdiplus\GdipGetDpiY=gdip
gdiplus\GdipGetEncoderParameterList=gdip
gdiplus\GdipGetEncoderParameterListSize=gdip
gdiplus\GdipGetImageEncoders=gdip
gdiplus\GdipGetImageEncodersSize=gdip
gdiplus\GdipGetImageGraphicsContext=gdip
gdiplus\GdipGetImageHeight=gdip
gdiplus\GdipGetImageHorizontalResolution=gdip
gdiplus\GdipGetImagePixelFormat=gdip
gdiplus\GdipGetImageVerticalResolution=gdip
gdiplus\GdipGetImageWidth=gdip
gdiplus\GdipGraphicsClear=gdip
gdiplus\GdipImageRotateFlip=gdip
gdiplus\GdiplusShutdown=gdip
gdiplus\GdiplusStartup=gdip
gdiplus\GdipMeasureString=gdip
gdiplus\GdipReleaseDC=gdip/gui dc
gdiplus\GdipResetClip=gdip
gdiplus\GdipResetWorldTransform=gdip
gdiplus\GdipRotateWorldTransform=gdip
gdiplus\GdipSaveImageToFile=gdip
gdiplus\GdipScaleWorldTransform=gdip
gdiplus\GdipSetClipPath=gdip
gdiplus\GdipSetClipRect=gdip
gdiplus\GdipSetClipRegion=gdip
gdiplus\GdipSetCompositingMode=gdip
gdiplus\GdipSetImageAttributesColorMatrix=gdip
gdiplus\GdipSetInterpolationMode=gdip
gdiplus\GdipSetSmoothingMode=gdip
gdiplus\GdipSetStringFormatAlign=gdip
gdiplus\GdipSetTextRenderingHint=gdip
gdiplus\GdipTranslateWorldTransform=gdip
ieframe\OpenURL=?
imagehlp\ImageDirectoryEntryToData=dll
imagehlp\ImageRvaToVa=dll
imagehlp\MapAndLoad=dll
imagehlp\UnMapAndLoad=dll
iphlpapi\GetIpStatistics=ip
iphlpapi\GetIpStatisticsEx=ip
iphlpapi\GetTcpStatistics=ip
iphlpapi\GetTcpStatisticsEx=ip
iphlpapi\GetUdpStatistics=ip
iphlpapi\GetUdpStatisticsEx=ip
kernel32\AddConsoleAlias=process console
kernel32\AllocConsole=process console
kernel32\AttachConsole=process console
kernel32\Beep=sound/beep
kernel32\CloseHandle=process
kernel32\CompareString=string compare/locale
kernel32\CopyFile=file copy
kernel32\CreateDirectory=file create
kernel32\CreateFile=file create/file empty
kernel32\CreateFileMapping=file
kernel32\CreateMutex=? mutex
kernel32\CreateProcess=process run
kernel32\CreateRemoteThread=thread
kernel32\CreateThread=thread
kernel32\CreateToolhelp32Snapshot=process module
kernel32\DecodePointer=? pointer
kernel32\DeleteCriticalSection=? section object
kernel32\DeleteFile=file delete
kernel32\DeviceIoControl=system drive
kernel32\DuplicateHandle=process
kernel32\EncodePointer=? pointer
kernel32\EnterCriticalSection=? section object
kernel32\EnumResourceNames=gui resource
kernel32\ExitProcess=process
kernel32\ExitThread=thread
kernel32\ExpandEnvironmentStrings=file path/system envvar
kernel32\FileTimeToLocalFileTime=time convert
kernel32\FileTimeToSystemTime=time convert
kernel32\FillConsoleOutputAttribute=process console
kernel32\FillConsoleOutputCharacter=process console
kernel32\FindClose=file list/file search
kernel32\FindFirstFile=file list/file search
kernel32\FindNextFile=file list/file search
kernel32\FindResource=gui resource
kernel32\FindResourceEx=gui resource
kernel32\FlushConsoleInputBuffer=process console
kernel32\FlushFileBuffers=file
kernel32\FormatMessage=gui message
kernel32\FreeConsole=process console
kernel32\FreeEnvironmentStrings=process envvar
kernel32\FreeLibrary=dll
kernel32\FreeResource=gui resource
kernel32\GetACP=string encoding
kernel32\GetActiveProcessorCount=processor
kernel32\GetActiveProcessorGroupCount=processor
kernel32\GetCommandLine=process command line
kernel32\GetComputerName=system envvar
kernel32\GetConsoleCP=process console
kernel32\GetConsoleCursorInfo=process console
kernel32\GetConsoleFontSize=process console
kernel32\GetConsoleMode=process console
kernel32\GetConsoleOriginalTitle=process console
kernel32\GetConsoleOutputCP=process console
kernel32\GetConsoleScreenBufferInfo=process console
kernel32\GetConsoleTitle=process console
kernel32\GetConsoleWindow=process console
kernel32\GetCPInfo=string encoding
kernel32\GetCPInfoEx=string encoding
kernel32\GetCurrentConsoleFont=process console
kernel32\GetCurrentDirectory=process path
kernel32\GetCurrentProcess=process
kernel32\GetCurrentProcessId=gui pid/process pid
kernel32\GetCurrentProcessorNumber=processor
kernel32\GetCurrentThread=thread
kernel32\GetCurrentThreadId=thread
kernel32\GetDateFormat=time
kernel32\GetDiskFreeSpace=file
kernel32\GetDiskFreeSpaceEx=file/system drive
kernel32\GetDriveType=system drive
kernel32\GetDurationFormat=time/convert string
kernel32\GetEnvironmentStrings=process envvar
kernel32\GetEnvironmentVariable=system envvar
kernel32\GetExitCodeProcess=process
kernel32\GetExitCodeThread=thread
kernel32\GetFileAttributes=file attrib
kernel32\GetFileSize=file size
kernel32\GetFileSizeEx=file size
kernel32\GetFileTime=file date
kernel32\GetFileType=file
kernel32\GetFullPathName=file path
kernel32\GetLastError=system error
kernel32\GetLocaleInfo=system
kernel32\GetLocaleInfoEx=system
kernel32\GetLocalTime=time now
kernel32\GetLogicalDrives=system drive
kernel32\GetLogicalDriveStrings=system drive
kernel32\GetMaximumProcessorCount=processor
kernel32\GetMaximumProcessorGroupCount=processor
kernel32\GetModuleFileName=process path
kernel32\GetModuleHandle=process module/dll/exe
kernel32\GetOEMCP=string encoding
kernel32\GetPhysicallyInstalledSystemMemory=system memory
kernel32\GetPriorityClass=process priority
kernel32\GetPrivateProfileSection=ini read
kernel32\GetPrivateProfileSectionNames=ini read
kernel32\GetPrivateProfileString=ini read
kernel32\GetProcAddress=dll/process
kernel32\GetProcessId=process pid
kernel32\GetProcessTimes=time/process time
kernel32\GetProcessVersion=process/system os
kernel32\GetProductInfo=system os
kernel32\GetShortPathName=file path
kernel32\GetStartupInfo=process
kernel32\GetStdHandle=process console
kernel32\GetStringType=string type
kernel32\GetStringTypeEx=string type
kernel32\GetSystemDefaultUILanguage=system/lang
kernel32\GetSystemDirectory=system dir
kernel32\GetSystemInfo=system
kernel32\GetSystemRegistryQuota=registry
kernel32\GetSystemTime=time now
kernel32\GetSystemTimeAsFileTime=time now
kernel32\GetSystemWindowsDirectory=system dir
kernel32\GetSystemWow64Directory=system dir
kernel32\GetTempFileName=file path
kernel32\GetTempPath=gui envvar
kernel32\GetTickCount64=time
kernel32\GetTickCount=time
kernel32\GetTimeFormat=time
kernel32\GetTimeZoneInformationForYear=time
kernel32\GetVersion=system os
kernel32\GetVersionEx=system os
kernel32\GetVolumeInformation=system drive
kernel32\GetVolumeNameForVolumeMountPoint=system drive
kernel32\GetWindowsDirectory=gui envvar
kernel32\GlobalAlloc=address space
kernel32\GlobalFree=address space
kernel32\GlobalLock=address space
kernel32\GlobalMemoryStatusEx=system memory/address space
kernel32\GlobalSize=address space
kernel32\GlobalUnlock=address space
kernel32\HeapAlloc=address space
kernel32\HeapCreate=address space
kernel32\HeapDestroy=address space
kernel32\HeapFree=address space
kernel32\HeapReAlloc=address space
kernel32\HeapSize=address space
kernel32\InitializeCriticalSection=? section object
kernel32\IsBadReadPtr=address space
kernel32\IsBadWritePtr=address space
kernel32\IsValidCodePage=string encoding
kernel32\IsWow64Process=process bitness
kernel32\LCMapString=string encoding
kernel32\LeaveCriticalSection=? section object
kernel32\LoadLibrary=dll
kernel32\LoadLibraryEx=dll
kernel32\LoadResource=gui resource
kernel32\LocalAlloc=address space
kernel32\LocalFileTimeToFileTime=time convert
kernel32\LocalSize=address space
kernel32\LockResource=gui resource
kernel32\lstrcmp=string compare
kernel32\lstrcmpi=string compare
kernel32\lstrcpy=string copy
kernel32\lstrcpyn=string copy
kernel32\lstrlen=string length
kernel32\MapViewOfFile=address space/file
kernel32\MapViewOfFileEx=address space/file
kernel32\Module32First=process module
kernel32\Module32Next=process module
kernel32\MoveFile=file move
kernel32\MoveFileEx=file move
kernel32\MulDiv=mathematics/binary copy
kernel32\MultiByteToWideChar=string encoding
kernel32\OpenFile=file
kernel32\OpenProcess=process
kernel32\OutputDebugString=? process console
kernel32\Process32First=process
kernel32\Process32Next=process
kernel32\QueryDosDevice=system drive
kernel32\QueryPerformanceCounter=time now
kernel32\QueryPerformanceFrequency=time
kernel32\ReadConsole=process console
kernel32\ReadConsoleInput=process console
kernel32\ReadConsoleOutputAttribute=process console
kernel32\ReadConsoleOutputCharacter=process console
kernel32\ReadFile=file read
kernel32\ReadFileEx=file read
kernel32\ReadProcessMemory=address space
kernel32\ReleaseMutex=? mutex
kernel32\RemoveDirectory=file delete
kernel32\RtlFillMemory=binary write
kernel32\RtlMoveMemory=binary copy
kernel32\RtlUnwind=?
kernel32\RtlZeroMemory=binary write
kernel32\SetConsoleCP=process console
kernel32\SetConsoleCursorInfo=process console
kernel32\SetConsoleCursorPosition=process console
kernel32\SetConsoleIcon=process console
kernel32\SetConsoleMode=process console
kernel32\SetConsoleOutputCP=process console
kernel32\SetConsoleScreenBufferSize=process console
kernel32\SetConsoleTextAttribute=process console
kernel32\SetConsoleTitle=process console
kernel32\SetCurrentDirectory=process path
kernel32\SetEndOfFile=file
kernel32\SetEnvironmentVariable=system envvar
kernel32\SetErrorMode=process
kernel32\SetFileAttributes=file attrib
kernel32\SetFilePointer=file read
kernel32\SetFilePointerEx=file read
kernel32\SetFileTime=file date
kernel32\SetHandleCount=process
kernel32\SetLastError=system error
kernel32\SetLocalTime=time now
kernel32\SetPriorityClass=process priority
kernel32\SetProcessShutdownParameters=process shutdown priority
kernel32\SetStdHandle=process console
kernel32\SetSystemTime=time now
kernel32\SetThreadPriority=thread
kernel32\SetVolumeLabel=system drive
kernel32\SizeofResource=gui resource
kernel32\Sleep=time/process/sleep/wait
kernel32\SleepEx=time/process/sleep/wait
kernel32\SystemTimeToFileTime=time convert
kernel32\SystemTimeToTzSpecificLocalTime=time convert
kernel32\TerminateProcess=process
kernel32\TzSpecificLocalTimeToSystemTime=time convert
kernel32\UnhandledExceptionFilter=process
kernel32\UnmapViewOfFile=address space/file
kernel32\VirtualAlloc=address space
kernel32\VirtualAllocEx=address space
kernel32\VirtualFree=address space
kernel32\VirtualFreeEx=address space
kernel32\VirtualProtect=address space
kernel32\VirtualProtectEx=address space
kernel32\VirtualQuery=address space
kernel32\VirtualQueryEx=address space/address space list regions
kernel32\WaitForMultipleObjects=?
kernel32\WaitForSingleObject=thread
kernel32\WideCharToMultiByte=string encoding
kernel32\Wow64DisableWow64FsRedirection=file/process bitness
kernel32\WriteConsole=process console
kernel32\WriteFile=file write
kernel32\WritePrivateProfileSection=ini write
kernel32\WritePrivateProfileString=ini write
kernel32\WriteProcessMemory=address space
magnification\MagInitialize=magnification
magnification\MagSetImageScalingCallback=magnification
magnification\MagSetWindowSource=magnification
magnification\MagSetWindowTransform=magnification
magnification\MagUninitialize=magnification
msvcrt\_atoi64=string convert
msvcrt\_beginthread=thread
msvcrt\_exit=process
msvcrt\_expand=address space
msvcrt\_ftime=time
msvcrt\_getch=process console
msvcrt\_getwch=process console
msvcrt\_itoa=string convert
msvcrt\_msize=address space
msvcrt\_open=file open
msvcrt\_read=file read
msvcrt\_snprintf=string write
msvcrt\_splitpath=string split
msvcrt\_sprintf_l=string write
msvcrt\_strdup=string copy
msvcrt\_strrev=string reverse
msvcrt\_strtoi64=string convert
msvcrt\_ultoa=string convert
msvcrt\_ungetch=process console
msvcrt\_ungetwch=process console
msvcrt\_vsnprintf=string write
msvcrt\_wcsrev=string reverse
msvcrt\_write=file write
msvcrt\abs=mathematics
msvcrt\atan2=mathematics
msvcrt\atof=string convert
msvcrt\atoi=string convert
msvcrt\ceil=mathematics
msvcrt\exit=process
msvcrt\fclose=file close
msvcrt\fgets=file read
msvcrt\floor=mathematics
msvcrt\fopen=file open
msvcrt\fread=file read
msvcrt\free=address space
msvcrt\fseek=file read
msvcrt\ftell=file read
msvcrt\getenv=system envvar
msvcrt\isdigit=string type
msvcrt\isleadbyte=string type
msvcrt\ispunct=string type
msvcrt\isspace=string type
msvcrt\malloc=address space
msvcrt\memcmp=binary compare
msvcrt\memcpy=binary copy
msvcrt\memmove=binary copy
msvcrt\pow=mathematics
msvcrt\printf=string stdout
msvcrt\qsort=string sort
msvcrt\realloc=address space
msvcrt\remove=file delete
msvcrt\setlocale=system/locale
msvcrt\setvbuf=address space/stream
msvcrt\sprintf=string write
msvcrt\sscanf=string write
msvcrt\strcat=string append/string copy
msvcrt\strchr=string search
msvcrt\strcmp=string compare
msvcrt\strcpy=string copy
msvcrt\strcspn=string search
msvcrt\strftime=time
msvcrt\strlen=string length
msvcrt\strncmp=string compare
msvcrt\strncpy=string copy
msvcrt\strpbrk=string search
msvcrt\strrchr=string search
msvcrt\strspn=string search
msvcrt\strstr=string search
msvcrt\strtol=string convert
msvcrt\strtoul=string convert
msvcrt\swprintf=string write
msvcrt\tolower=string case
msvcrt\toupper=string case
msvcrt\vsnprintf=string write
msvcrt\wcslen=string length
msvcrt\wcsrchr=string search
ntdll\NtQueryInformationProcess=process
ntdll\NtReadFile=file read
ntdll\RtlAllocateHeap=address space
ntdll\RtlComputeCrc32=hash
ntdll\ZwDelayExecution=time/process/sleep/wait
ole32\CLSIDFromProgID=com
ole32\CLSIDFromString=com
ole32\CoCreateGuid=com
ole32\CoCreateInstance=com
ole32\CoGetObject=com
ole32\CoInitialize=com
ole32\CoTaskMemAlloc=com
ole32\CoTaskMemFree=com
ole32\CoUninitialize=com
ole32\CreateStreamOnHGlobal=com
ole32\IsEqualGUID=com
ole32\OleGetClipboard=com/interface
ole32\OleInitialize=com
ole32\OleLoad=com
ole32\OleUninitialize=com
ole32\ProgIDFromCLSID=com
ole32\StringFromCLSID=com/object
ole32\StringFromGUID2=com
oleacc\AccessibleChildren=com
oleacc\AccessibleObjectFromEvent=com
oleacc\AccessibleObjectFromPoint=com
oleacc\AccessibleObjectFromWindow=com
oleacc\GetRoleText=com
oleacc\GetStateText=com
oleacc\ObjectFromLresult=com
oleacc\WindowFromAccessibleObject=com
oleaut32\DispGetParam=com
oleaut32\GetActiveObject=com
oleaut32\OleLoadPicture=com
oleaut32\RegisterActiveObject=? com/object
oleaut32\RevokeActiveObject=? com/object
oleaut32\SafeArrayAccessData=com
oleaut32\SafeArrayCopy=com
oleaut32\SafeArrayCreate=com
oleaut32\SafeArrayDestroy=com
oleaut32\SafeArrayGetDim=com
oleaut32\SafeArrayGetElemsize=com
oleaut32\SafeArrayGetLBound=com
oleaut32\SafeArrayGetUBound=com
oleaut32\SafeArrayLock=com
oleaut32\SafeArrayPtrOfIndex=com
oleaut32\SafeArrayUnaccessData=com
oleaut32\SafeArrayUnlock=com
oleaut32\SysAllocString=com
oleaut32\SysFreeString=com
oleaut32\SysStringLen=com
oleaut32\VariantChangeType=com
oleaut32\VariantChangeTypeEx=com
oleaut32\VariantClear=com
oleaut32\VariantCopy=com
oleaut32\VariantCopyInd=com
oleaut32\VarInt=com
powrprof\PowerGetActiveScheme=system
powrprof\PowerReadACValueIndex=system
powrprof\PowerReadDCValueIndex=system
powrprof\PowerSetActiveScheme=system
powrprof\PowerWriteACValueIndex=system
powrprof\PowerWriteDCValueIndex=system
powrprof\SetSuspendState=system suspend/system hibernate
propsys\PSGetNameFromPropertyKey=shell
propsys\PSGetPropertyKeyFromName=shell
psapi\EnumProcesses=process list
psapi\EnumProcessModules=process
psapi\EnumProcessModulesEx=process
psapi\GetMappedFileName=address space
psapi\GetModuleBaseName=file path/process path
psapi\GetModuleFileNameEx=file path/process path
psapi\GetProcessImageFileName=file path/process path
psapi\GetProcessMemoryInfo=address space
secur32\GetUserNameEx=system envvar
shell32\DragFinish=gui drop/address space
shell32\DragQueryFile=gui drop
shell32\DragQueryPoint=gui drop/mouse
shell32\DriveType=system drive
shell32\ExtractIcon=gui icon
shell32\ExtractIconEx=gui icon
shell32\ILFree=file pidl
shell32\ILGetSize=file pidl
shell32\SHAddToRecentDocs=system recent items
shell32\SHBindToParent=file interface
shell32\SHBrowseForFolder=gui dialog
shell32\SHChangeNotify=system refresh
shell32\Shell_NotifyIcon=system systray/gui icon
shell32\ShellExecute=process run
shell32\ShellExecuteEx=process run
shell32\SHEmptyRecycleBin=system recycle bin
shell32\SHFileOperation=file
shell32\SHGetDesktopFolder=interface
shell32\SHGetFileInfo=file attrib/file icon/file extension/file display name
shell32\SHGetFolderLocation=file pidl
shell32\SHGetFolderPath=file csidl/system dir
shell32\SHGetMalloc=interface
shell32\SHGetPathFromIDList=file pidl
shell32\SHGetSetSettings=system/file attrib/file extension
shell32\SHParseDisplayName=file pidl
shell32\SHQueryRecycleBin=system recycle bin
shell32\StrRStr=string search
shlwapi\AssocQueryString=file extension
shlwapi\IsOS=system
shlwapi\PathCreateFromUrl=file path/url
shlwapi\SHGetViewStatePropertyBag=file dir
shlwapi\StrCmpI=string compare
shlwapi\StrCmpLogical=file sort/string compare
shlwapi\StrCmpN=string compare
shlwapi\StrCmpNI=string compare
shlwapi\StrDup=string copy
shlwapi\StrRetToBuf=shell
shlwapi\StrStrI=string search
shlwapi\UrlCreateFromPath=file path/url
urlmon\URLDownload=internet download
urlmon\URLDownloadToFile=internet download
user32\AddClipboardFormatListener=gui clipboard
user32\AdjustWindowRect=gui window
user32\AdjustWindowRectEx=gui window
user32\AnimateWindow=gui window
user32\AppendMenu=gui menu
user32\AttachThreadInput=thread
user32\BlockInput=keyboard/mouse
user32\BringWindowToTop=gui window/gui active/gui z-order
user32\CallNextHookEx=gui event
user32\CallWindowProc=gui wndproc
user32\ChangeClipboardChain=clipboard
user32\CharLower=string case
user32\CharLowerBuff=string case
user32\CharUpper=string case
user32\CharUpperBuff=string case
user32\CheckMenuItem=gui menu
user32\CheckRadioButton=gui dialog
user32\ChildWindowFromPoint=gui control/mouse
user32\ClientToScreen=gui position
user32\ClipCursor=gui cursor/mouse
user32\CloseClipboard=clipboard
user32\CopyIcon=gui icon
user32\CopyImage=gui image/gui icon/gui cursor
user32\CountClipboardFormats=clipboard
user32\CreateAcceleratorTable=gui accel
user32\CreateCaret=gui caret
user32\CreateCursor=gui cursor
user32\CreateDialogParam=gui dialog
user32\CreateIcon=gui icon
user32\CreateIconFromResource=gui icon
user32\CreateIconFromResourceEx=gui icon
user32\CreateIconIndirect=gui icon
user32\CreateMenu=gui menu
user32\CreatePopupMenu=gui menu
user32\CreateWindowEx=gui create/gui control
user32\DefDlgProc=gui wndproc
user32\DefWindowProc=gui wndproc
user32\DeleteMenu=gui menu
user32\DeregisterShellHookWindow=gui event
user32\DestroyAcceleratorTable=gui accel
user32\DestroyCursor=gui cursor
user32\DestroyIcon=gui icon
user32\DestroyMenu=gui menu
user32\DestroyWindow=gui window
user32\DialogBoxParam=gui dialog
user32\DispatchMessage=gui message
user32\DrawFrame=?
user32\DrawIcon=gui icon/gui dc
user32\DrawIconEx=gui icon/gui dc
user32\DrawText=gui font/gui dc
user32\DrawTextEx=gui font/gui dc
user32\EmptyClipboard=clipboard
user32\EnableMenuItem=gui menu
user32\EnableWindow=gui style/gui enabled
user32\EndDialog=gui dialog
user32\EndMenu=gui menu
user32\EnumChildWindows=gui list/gui ancestry/gui control
user32\EnumClipboardFormats=clipboard
user32\EnumDisplayDevices=system display
user32\EnumDisplayMonitors=system monitor/gui dc
user32\EnumWindows=gui list/gui hwnd
user32\ExitWindowsEx=system
user32\FillRect=gui image/gui dc
user32\FindWindow=gui search
user32\FindWindowEx=gui search
user32\FlashWindow=gui window
user32\FlashWindowEx=gui window
user32\GetActiveWindow=gui list
user32\GetAncestor=gui ancestry/gui parent
user32\GetAsyncKeyState=keyboard
user32\GetCapture=gui cursor/mouse
user32\GetCaretBlinkTime=gui caret/system
user32\GetCaretPos=gui caret
user32\GetClassInfo=gui class
user32\GetClassInfoEx=gui class
user32\GetClassLong=gui class
user32\GetClassName=gui class
user32\GetClientRect=gui position
user32\GetClipboardData=clipboard
user32\GetClipboardFormatName=clipboard
user32\GetClipboardOwner=clipboard
user32\GetClipboardSequenceNumber=clipboard
user32\GetComboBoxInfo=gui control
user32\GetCursor=gui cursor
user32\GetCursorInfo=gui cursor
user32\GetCursorPos=gui cursor/gui position
user32\GetDC=gui dc
user32\GetDCEx=gui dc
user32\GetDesktopWindow=gui window
user32\GetDlgCtrlID=gui window/gui dialog/gui control
user32\GetDlgItem=gui window/gui dialog
user32\GetDoubleClickTime=mouse/system
user32\GetFocus=gui list/gui active
user32\GetForegroundWindow=gui list/gui active
user32\GetGUIThreadInfo=thread
user32\GetIconInfo=gui icon
user32\GetKBCodePage=string encoding
user32\GetKeyboardLayout=keyboard
user32\GetKeyboardState=keyboard
user32\GetKeyNameText=keyboard
user32\GetKeyState=keyboard
user32\GetLastInputInfo=keyboard/idle
user32\GetLayeredWindowAttributes=gui window
user32\GetMenu=gui menu
user32\GetMenuBarInfo=gui menu
user32\GetMenuItemCount=gui menu
user32\GetMenuItemID=gui menu
user32\GetMenuItemInfo=gui menu
user32\GetMenuItemRect=gui menu
user32\GetMenuState=gui menu
user32\GetMenuString=gui menu
user32\GetMessage=gui message
user32\GetMessagePos=gui message/mouse
user32\GetMonitorInfo=system monitor
user32\GetOpenClipboardWindow=clipboard
user32\GetParent=gui ancestry
user32\GetPhysicalCursorPos=gui cursor/mouse
user32\GetQueueStatus=gui message
user32\GetRawInputDeviceList=system
user32\GetScrollInfo=gui scroll
user32\GetScrollPos=gui scroll
user32\GetShellWindow=gui window
user32\GetSubMenu=gui menu
user32\GetSysColor=system colour
user32\GetSysColorBrush=gui brush
user32\GetSystemMenu=gui menu
user32\GetSystemMetrics=system/monitor
user32\GetTopWindow=gui window/gui z-order
user32\GetWindow=gui ancestry/gui owner/gui child
user32\GetWindowInfo=gui position/gui style
user32\GetWindowLong=gui style/gui wndproc/gui info
user32\GetWindowRect=gui position
user32\GetWindowRgnBox=gui position
user32\GetWindowText=gui text/gui window title
user32\GetWindowTextLength=gui text/gui title bar
user32\GetWindowThreadProcessId=gui pid/process pid
user32\HideCaret=gui caret
user32\InsertMenu=gui menu
user32\InsertMenuItem=gui menu
user32\IntersectRect=gui rect/mathematics
user32\InvalidateRect=gui image/gui redraw
user32\IsCharAlpha=string type
user32\IsCharAlphaNumeric=string type
user32\IsCharLower=string case
user32\IsCharUpper=string case
user32\IsChild=gui ancestry
user32\IsClipboardFormatAvailable=clipboard
user32\IsDialogMessage=gui message
user32\IsHungAppWindow=gui/process hung/process close
user32\IsIconic=gui window/gui minmax
user32\IsMenu=gui menu
user32\IsWindow=gui existence
user32\IsWindowEnabled=gui style/gui enabled
user32\IsWindowUnicode=gui
user32\IsWindowVisible=gui visibility
user32\IsZoomed=gui window/gui minmax
user32\keybd_event=keyboard
user32\KillTimer=? timer
user32\LoadAccelerators=gui accel
user32\LoadCursor=gui cursor
user32\LoadCursorFromFile=gui cursor
user32\LoadIcon=gui icon
user32\LoadImage=gui image/gui icon/gui cursor
user32\LoadString=gui resource/gui text
user32\LockSetForegroundWindow=gui active
user32\LockWorkStation=system/gui password prompt
user32\LookupIconIdFromDirectory=gui icon
user32\LookupIconIdFromDirectoryEx=gui icon
user32\MapVirtualKey=keyboard
user32\MapVirtualKeyEx=keyboard
user32\MapWindowPoints=gui position
user32\MessageBeep=? gui message/sound
user32\MessageBox=gui dialog
user32\ModifyMenu=gui menu
user32\mouse_event=mouse
user32\MoveWindow=gui position/gui size
user32\MsgWaitForMultipleObjects=? gui message
user32\OpenClipboard=clipboard
user32\PaintDesktop=gui dc/gui image
user32\PeekMessage=gui message
user32\PostMessage=gui message
user32\PostQuitMessage=gui message/thread
user32\PostThreadMessage=gui message
user32\PrintWindow=gui image/gui dc
user32\PrivateExtractIcons=gui icon
user32\PtInRect=gui rect/mouse/mathematics
user32\RedrawWindow=gui image
user32\RegisterClass=gui create/gui window
user32\RegisterClassEx=gui create/gui window
user32\RegisterClipboardFormat=clipboard
user32\RegisterHotKey=gui hotkey
user32\RegisterShellHookWindow=gui event
user32\RegisterWindowMessage=gui message
user32\ReleaseCapture=mouse
user32\ReleaseDC=gui dc
user32\RemoveClipboardFormatListener=clipboard
user32\RemoveMenu=gui menu
user32\ReplyMessage=gui message
user32\ScreenToClient=gui position
user32\SendDlgItemMessage=gui message
user32\SendInput=keyboard/mouse
user32\SendMessage=gui message
user32\SendMessageTimeout=gui message
user32\SetActiveWindow=gui window/gui z-order/gui active
user32\SetCapture=gui window/mouse
user32\SetCaretBlinkTime=gui caret/system
user32\SetClassLong=gui icon/gui info
user32\SetClipboardData=clipboard
user32\SetClipboardViewer=clipboard
user32\SetCursor=gui cursor
user32\SetCursorPos=gui cursor/gui position
user32\SetDlgItemText=gui text/gui title bar
user32\SetDoubleClickTime=mouse/system
user32\SetFocus=gui window/gui active
user32\SetForegroundWindow=gui list/gui active
user32\SetKeyboardState=keyboard
user32\SetLayeredWindowAttributes=gui window
user32\SetMenu=gui menu
user32\SetMenuDefaultItem=gui menu
user32\SetMenuInfo=gui menu
user32\SetMenuItemBitmaps=gui menu
user32\SetMenuItemInfo=gui menu
user32\SetParent=gui ancestry
user32\SetPhysicalCursorPos=gui cursor/mouse
user32\SetProp=?
user32\SetRect=gui position
user32\SetSysColors=system colour
user32\SetSystemCursor=gui cursor
user32\SetTimer=? timer
user32\SetWindowLong=gui style/gui wndproc/gui info
user32\SetWindowPos=gui position/gui z-order/gui on top
user32\SetWindowRgn=gui window
user32\SetWindowsHook=gui event
user32\SetWindowsHookEx=gui event
user32\SetWindowText=gui text/gui title bar
user32\SetWinEventHook=gui event
user32\ShowCaret=gui caret
user32\ShowCursor=gui cursor
user32\ShowWindow=gui visibility/gui minmax
user32\ShowWindowAsync=gui show
user32\SwapMouseButton=system/mouse
user32\SystemParametersInfo=system
user32\ToAscii=keyboard/string encoding
user32\ToAsciiEx=keyboard/string encoding
user32\ToUnicode=keyboard/string encoding
user32\ToUnicodeEx=keyboard/string encoding
user32\TrackPopupMenu=gui menu
user32\TrackPopupMenuEx=gui menu
user32\TranslateAccelerator=gui accel
user32\TranslateMessage=gui message
user32\UnhookWindowsHook=gui event
user32\UnhookWindowsHookEx=gui event
user32\UnhookWinEvent=gui event
user32\UnregisterHotKey=gui hotkey
user32\UpdateLayeredWindow=gui dc/gui image/gui position
user32\UpdateWindow=gui window
user32\ValidateRect=gui window
user32\VkKeyScan=keyboard
user32\VkKeyScanEx=keyboard
user32\WindowFromPoint=gui window/mouse
user32\wsprintf=string write
uxtheme\EnableThemeDialogTexture=gui dialog
uxtheme\SetWindowTheme=gui dialog
uxtheme\SetWindowThemeAttribute=gui theme
version\GetFileVersionInfo=file version
version\GetFileVersionInfoSize=file version
version\VerQueryValue=file version
wininet\FtpCreateDirectory=internet ftp
wininet\FtpDeleteFile=internet ftp
wininet\FtpFindFirstFile=internet ftp
wininet\FtpGetCurrentDirectory=internet ftp
wininet\FtpGetFile=internet ftp
wininet\FtpGetFileSize=internet ftp
wininet\FtpOpenFile=internet ftp
wininet\FtpPutFile=internet ftp
wininet\FtpRemoveDirectory=internet ftp
wininet\FtpRenameFile=internet ftp
wininet\FtpSetCurrentDirectory=internet ftp
wininet\InternetCloseHandle=internet
wininet\InternetConnect=internet/ftp
wininet\InternetFindNextFile=internet/ftp
wininet\InternetGetLastResponseInfo=internet/ftp
wininet\InternetOpen=internet
wininet\InternetOpenUrl=internet
wininet\InternetQueryDataAvailable=internet
wininet\InternetReadFile=internet download
wininet\InternetReadFileEx=internet download
wininet\InternetSetStatusCallback=internet/ftp
wininet\InternetWriteFile=internet/ftp
winmm\joyGetDevCaps=joystick
winmm\joyGetPos=joystick
winmm\joyGetPosEx=joystick
winmm\joySetCapture=joystick
winmm\mciSendString=? mci device
winmm\mixerClose=sound
winmm\mixerGetControlDetails=sound
winmm\mixerGetDevCaps=sound
winmm\mixerGetLineControls=sound
winmm\mixerGetLineInfo=sound
winmm\mixerOpen=sound
winmm\mixerSetControlDetails=sound
winmm\timeBeginPeriod=system
winmm\timeEndPeriod=system
winmm\timeGetTime=time
winmm\waveOutGetVolume=sound
winmm\waveOutSetVolume=sound
ws2_32\accept=winsock
ws2_32\bind=winsock
ws2_32\closesocket=winsock
ws2_32\connect=winsock
ws2_32\freeaddrinfo=winsock
ws2_32\getaddrinfo=winsock
ws2_32\gethostbyname=winsock
ws2_32\gethostname=winsock
ws2_32\htons=winsock
ws2_32\inet_addr=winsock
ws2_32\inet_ntoa=winsock
ws2_32\ioctlsocket=winsock
ws2_32\listen=winsock
ws2_32\recv=winsock
ws2_32\select=winsock
ws2_32\send=winsock
ws2_32\shutdown=winsock
ws2_32\socket=winsock
ws2_32\WSAAsyncSelect=winsock
ws2_32\WSACleanup=winsock
ws2_32\WSAGetLastError=winsock
ws2_32\WSAStartup=winsock

[List AW]
advapi32\CreateProcessWithLogonW=
advapi32\CryptAcquireContextA=
advapi32\CryptAcquireContextW=
advapi32\GetUserNameA=
advapi32\GetUserNameW=
advapi32\LookupPrivilegeValueA=
advapi32\LookupPrivilegeValueW=
advapi32\OpenSCManagerA=
advapi32\OpenSCManagerW=
advapi32\RegConnectRegistryA=
advapi32\RegConnectRegistryW=
advapi32\RegCreateKeyA=
advapi32\RegCreateKeyExA=
advapi32\RegCreateKeyExW=
advapi32\RegCreateKeyW=
advapi32\RegDeleteKeyA=
advapi32\RegDeleteKeyExA=
advapi32\RegDeleteKeyExW=
advapi32\RegDeleteKeyW=
advapi32\RegDeleteValueA=
advapi32\RegDeleteValueW=
advapi32\RegEnumKeyA=
advapi32\RegEnumKeyExA=
advapi32\RegEnumKeyExW=
advapi32\RegEnumKeyW=
advapi32\RegEnumValueA=
advapi32\RegEnumValueW=
advapi32\RegOpenKeyA=
advapi32\RegOpenKeyExA=
advapi32\RegOpenKeyExW=
advapi32\RegOpenKeyW=
advapi32\RegQueryInfoKeyA=
advapi32\RegQueryInfoKeyW=
advapi32\RegQueryValueA=
advapi32\RegQueryValueExA=
advapi32\RegQueryValueExW=
advapi32\RegQueryValueW=
advapi32\RegSetValueA=
advapi32\RegSetValueExA=
advapi32\RegSetValueExW=
advapi32\RegSetValueW=
comctl32\CreateStatusWindowA=
comctl32\CreateStatusWindowW=
comctl32\PropertySheetA=
comctl32\PropertySheetW=
comdlg32\GetOpenFileNameA=
comdlg32\GetOpenFileNameW=
comdlg32\GetSaveFileNameA=
comdlg32\GetSaveFileNameW=
crypt32\CryptBinaryToStringA=
crypt32\CryptBinaryToStringW=
crypt32\CryptStringToBinaryA=
crypt32\CryptStringToBinaryW=
gdi32\CreateDCA=
gdi32\CreateDCW=
gdi32\CreateFontA=
gdi32\CreateFontIndirectA=
gdi32\CreateFontIndirectW=
gdi32\CreateFontW=
gdi32\CreateICA=
gdi32\CreateICW=
gdi32\EnumFontFamiliesA=
gdi32\EnumFontFamiliesExA=
gdi32\EnumFontFamiliesExW=
gdi32\EnumFontFamiliesW=
gdi32\GetCharABCWidthsA=
gdi32\GetCharABCWidthsW=
gdi32\GetObjectA=
gdi32\GetObjectW=
gdi32\GetTextExtentPoint32A=
gdi32\GetTextExtentPoint32W=
gdi32\GetTextFaceA=
gdi32\GetTextFaceW=
gdi32\GetTextMetricsA=
gdi32\GetTextMetricsW=
gdi32\TextOutA=
gdi32\TextOutW=
kernel32\AddConsoleAliasA=
kernel32\AddConsoleAliasW=
kernel32\CompareStringA=
kernel32\CompareStringW=
kernel32\CopyFileA=
kernel32\CopyFileW=
kernel32\CreateDirectoryA=
kernel32\CreateDirectoryW=
kernel32\CreateFileA=
kernel32\CreateFileMappingA=
kernel32\CreateFileMappingW=
kernel32\CreateFileW=
kernel32\CreateMutexA=
kernel32\CreateMutexW=
kernel32\CreateProcessA=
kernel32\CreateProcessW=
kernel32\DeleteFileA=
kernel32\DeleteFileW=
kernel32\EnumResourceNamesA=
kernel32\EnumResourceNamesW=
kernel32\ExpandEnvironmentStringsA=
kernel32\ExpandEnvironmentStringsW=
kernel32\FillConsoleOutputCharacterA=
kernel32\FillConsoleOutputCharacterW=
kernel32\FindFirstFileA=
kernel32\FindFirstFileW=
kernel32\FindNextFileA=
kernel32\FindNextFileW=
kernel32\FindResourceA=
kernel32\FindResourceExA=
kernel32\FindResourceExW=
kernel32\FindResourceW=
kernel32\FormatMessageA=
kernel32\FormatMessageW=
kernel32\FreeEnvironmentStringsA=
kernel32\FreeEnvironmentStringsW=
kernel32\GetCommandLineA=
kernel32\GetCommandLineW=
kernel32\GetComputerNameA=
kernel32\GetComputerNameW=
kernel32\GetConsoleOriginalTitleA=
kernel32\GetConsoleOriginalTitleW=
kernel32\GetConsoleTitleA=
kernel32\GetConsoleTitleW=
kernel32\GetCPInfoExA=
kernel32\GetCPInfoExW=
kernel32\GetCurrentDirectoryA=
kernel32\GetCurrentDirectoryW=
kernel32\GetDateFormatA=
kernel32\GetDateFormatW=
kernel32\GetDiskFreeSpaceA=
kernel32\GetDiskFreeSpaceExA=
kernel32\GetDiskFreeSpaceExW=
kernel32\GetDiskFreeSpaceW=
kernel32\GetDriveTypeA=
kernel32\GetDriveTypeW=
kernel32\GetEnvironmentStringsA=
kernel32\GetEnvironmentStringsW=
kernel32\GetEnvironmentVariableA=
kernel32\GetEnvironmentVariableW=
kernel32\GetFileAttributesA=
kernel32\GetFileAttributesW=
kernel32\GetFullPathNameA=
kernel32\GetFullPathNameW=
kernel32\GetLocaleInfoA=
kernel32\GetLocaleInfoW=
kernel32\GetLogicalDriveStringsA=
kernel32\GetLogicalDriveStringsW=
kernel32\GetModuleFileNameA=
kernel32\GetModuleFileNameW=
kernel32\GetModuleHandleA=
kernel32\GetModuleHandleW=
kernel32\GetPrivateProfileSectionA=
kernel32\GetPrivateProfileSectionNamesA=
kernel32\GetPrivateProfileSectionNamesW=
kernel32\GetPrivateProfileSectionW=
kernel32\GetPrivateProfileStringA=
kernel32\GetPrivateProfileStringW=
kernel32\GetShortPathNameA=
kernel32\GetShortPathNameW=
kernel32\GetStartupInfoA=
kernel32\GetStartupInfoW=
kernel32\GetStringTypeA=
kernel32\GetStringTypeExA=
kernel32\GetStringTypeExW=
kernel32\GetStringTypeW=
kernel32\GetSystemDirectoryA=
kernel32\GetSystemDirectoryW=
kernel32\GetSystemWindowsDirectoryA=
kernel32\GetSystemWindowsDirectoryW=
kernel32\GetSystemWow64DirectoryA=
kernel32\GetSystemWow64DirectoryW=
kernel32\GetTempFileNameA=
kernel32\GetTempFileNameW=
kernel32\GetTempPathA=
kernel32\GetTempPathW=
kernel32\GetTimeFormatA=
kernel32\GetTimeFormatW=
kernel32\GetVersionExA=
kernel32\GetVersionExW=
kernel32\GetVolumeInformationA=
kernel32\GetVolumeInformationW=
kernel32\GetVolumeNameForVolumeMountPointA=
kernel32\GetVolumeNameForVolumeMountPointW=
kernel32\GetWindowsDirectoryA=
kernel32\GetWindowsDirectoryW=
kernel32\LCMapStringA=
kernel32\LCMapStringW=
kernel32\LoadLibraryA=
kernel32\LoadLibraryExA=
kernel32\LoadLibraryExW=
kernel32\LoadLibraryW=
kernel32\lstrcmpA=
kernel32\lstrcmpiA=
kernel32\lstrcmpiW=
kernel32\lstrcmpW=
kernel32\lstrcpyA=
kernel32\lstrcpynA=
kernel32\lstrcpynW=
kernel32\lstrcpyW=
kernel32\lstrlenA=
kernel32\lstrlenW=
kernel32\Module32FirstW=
kernel32\Module32NextW=
kernel32\MoveFileA=
kernel32\MoveFileExA=
kernel32\MoveFileExW=
kernel32\MoveFileW=
kernel32\OpenFileA=
kernel32\OpenFileW=
kernel32\OutputDebugStringA=
kernel32\OutputDebugStringW=
kernel32\Process32FirstW=
kernel32\Process32NextW=
kernel32\QueryDosDeviceA=
kernel32\QueryDosDeviceW=
kernel32\ReadConsoleA=
kernel32\ReadConsoleInputA=
kernel32\ReadConsoleInputW=
kernel32\ReadConsoleOutputCharacterA=
kernel32\ReadConsoleOutputCharacterW=
kernel32\ReadConsoleW=
kernel32\RemoveDirectoryA=
kernel32\RemoveDirectoryW=
kernel32\SetConsoleTitleA=
kernel32\SetConsoleTitleW=
kernel32\SetCurrentDirectoryA=
kernel32\SetCurrentDirectoryW=
kernel32\SetEnvironmentVariableA=
kernel32\SetEnvironmentVariableW=
kernel32\SetFileAttributesA=
kernel32\SetFileAttributesW=
kernel32\SetVolumeLabelA=
kernel32\SetVolumeLabelW=
kernel32\WriteConsoleA=
kernel32\WriteConsoleW=
kernel32\WritePrivateProfileSectionA=
kernel32\WritePrivateProfileSectionW=
kernel32\WritePrivateProfileStringA=
kernel32\WritePrivateProfileStringW=
oleacc\GetRoleTextA=
oleacc\GetRoleTextW=
oleacc\GetStateTextA=
oleacc\GetStateTextW=
psapi\GetMappedFileNameA=
psapi\GetMappedFileNameW=
psapi\GetModuleBaseNameA=
psapi\GetModuleBaseNameW=
psapi\GetModuleFileNameExA=
psapi\GetModuleFileNameExW=
psapi\GetProcessImageFileNameA=
psapi\GetProcessImageFileNameW=
secur32\GetUserNameExA=
secur32\GetUserNameExW=
shell32\DragQueryFileA=
shell32\DragQueryFileW=
shell32\ExtractIconA=
shell32\ExtractIconExA=
shell32\ExtractIconExW=
shell32\ExtractIconW=
shell32\SHBrowseForFolderA=
shell32\SHBrowseForFolderW=
shell32\Shell_NotifyIconA=
shell32\Shell_NotifyIconW=
shell32\ShellExecuteA=
shell32\ShellExecuteExA=
shell32\ShellExecuteExW=
shell32\ShellExecuteW=
shell32\SHEmptyRecycleBinA=
shell32\SHEmptyRecycleBinW=
shell32\SHFileOperationA=
shell32\SHFileOperationW=
shell32\SHGetFileInfoA=
shell32\SHGetFileInfoW=
shell32\SHGetFolderPathA=
shell32\SHGetFolderPathW=
shell32\SHGetPathFromIDListA=
shell32\SHGetPathFromIDListW=
shell32\SHQueryRecycleBinA=
shell32\SHQueryRecycleBinW=
shell32\StrRStrA=
shell32\StrRStrW=
shlwapi\AssocQueryStringA=
shlwapi\AssocQueryStringW=
shlwapi\PathCreateFromUrlA=
shlwapi\PathCreateFromUrlW=
shlwapi\StrCmpIW=
shlwapi\StrCmpLogicalW=
shlwapi\StrCmpNA=
shlwapi\StrCmpNIA=
shlwapi\StrCmpNIW=
shlwapi\StrCmpNW=
shlwapi\StrDupA=
shlwapi\StrDupW=
shlwapi\StrRetToBufA=
shlwapi\StrRetToBufW=
shlwapi\StrStrIA=
shlwapi\StrStrIW=
shlwapi\UrlCreateFromPathA=
shlwapi\UrlCreateFromPathW=
urlmon\URLDownloadA=
urlmon\URLDownloadToFileA=
urlmon\URLDownloadToFileW=
urlmon\URLDownloadW=
user32\AppendMenuA=
user32\AppendMenuW=
user32\CallWindowProcA=
user32\CallWindowProcW=
user32\CharLowerA=
user32\CharLowerBuffA=
user32\CharLowerBuffW=
user32\CharLowerW=
user32\CharUpperA=
user32\CharUpperBuffA=
user32\CharUpperBuffW=
user32\CharUpperW=
user32\CreateAcceleratorTableA=
user32\CreateAcceleratorTableW=
user32\CreateDialogParamA=
user32\CreateDialogParamW=
user32\CreateWindowExA=
user32\CreateWindowExW=
user32\DefDlgProcA=
user32\DefDlgProcW=
user32\DefWindowProcA=
user32\DefWindowProcW=
user32\DialogBoxParamA=
user32\DialogBoxParamW=
user32\DispatchMessageA=
user32\DispatchMessageW=
user32\DrawTextA=
user32\DrawTextExA=
user32\DrawTextExW=
user32\DrawTextW=
user32\EndMenuA=
user32\EndMenuW=
user32\EnumDisplayDevicesA=
user32\EnumDisplayDevicesW=
user32\FindWindowA=
user32\FindWindowExA=
user32\FindWindowExW=
user32\FindWindowW=
user32\GetClassInfoA=
user32\GetClassInfoExA=
user32\GetClassInfoExW=
user32\GetClassInfoW=
user32\GetClassLongA=
user32\GetClassLongW=
user32\GetClassNameA=
user32\GetClassNameW=
user32\GetClipboardFormatNameA=
user32\GetClipboardFormatNameW=
user32\GetKeyNameTextA=
user32\GetKeyNameTextW=
user32\GetMenuItemInfoA=
user32\GetMenuItemInfoW=
user32\GetMenuStringA=
user32\GetMenuStringW=
user32\GetMessageA=
user32\GetMessageW=
user32\GetMonitorInfoA=
user32\GetMonitorInfoW=
user32\GetWindowLongA=
user32\GetWindowLongW=
user32\GetWindowTextA=
user32\GetWindowTextLengthA=
user32\GetWindowTextLengthW=
user32\GetWindowTextW=
user32\InsertMenuA=
user32\InsertMenuItemA=
user32\InsertMenuItemW=
user32\InsertMenuW=
user32\IsCharAlphaA=
user32\IsCharAlphaNumericA=
user32\IsCharAlphaNumericW=
user32\IsCharAlphaW=
user32\IsCharLowerA=
user32\IsCharLowerW=
user32\IsCharUpperA=
user32\IsCharUpperW=
user32\IsDialogMessageA=
user32\IsDialogMessageW=
user32\LoadAcceleratorsA=
user32\LoadAcceleratorsW=
user32\LoadCursorA=
user32\LoadCursorFromFileA=
user32\LoadCursorFromFileW=
user32\LoadCursorW=
user32\LoadIconA=
user32\LoadIconW=
user32\LoadImageA=
user32\LoadImageW=
user32\LoadStringA=
user32\LoadStringW=
user32\MapVirtualKeyA=
user32\MapVirtualKeyExA=
user32\MapVirtualKeyExW=
user32\MapVirtualKeyW=
user32\MessageBoxA=
user32\MessageBoxW=
user32\ModifyMenuA=
user32\ModifyMenuW=
user32\PeekMessageA=
user32\PeekMessageW=
user32\PostMessageA=
user32\PostMessageW=
user32\PostThreadMessageA=
user32\PostThreadMessageW=
user32\PrivateExtractIconsA=
user32\PrivateExtractIconsW=
user32\RegisterClassA=
user32\RegisterClassExA=
user32\RegisterClassExW=
user32\RegisterClassW=
user32\RegisterClipboardFormatA=
user32\RegisterClipboardFormatW=
user32\RegisterWindowMessageA=
user32\RegisterWindowMessageW=
user32\SendDlgItemMessageA=
user32\SendDlgItemMessageW=
user32\SendMessageA=
user32\SendMessageTimeoutA=
user32\SendMessageTimeoutW=
user32\SendMessageW=
user32\SetClassLongA=
user32\SetClassLongW=
user32\SetDlgItemTextA=
user32\SetDlgItemTextW=
user32\SetMenuItemInfoA=
user32\SetMenuItemInfoW=
user32\SetPropA=
user32\SetPropW=
user32\SetWindowLongA=
user32\SetWindowLongW=
user32\SetWindowsHookA=
user32\SetWindowsHookExA=
user32\SetWindowsHookExW=
user32\SetWindowsHookW=
user32\SetWindowTextA=
user32\SetWindowTextW=
user32\SystemParametersInfoA=
user32\SystemParametersInfoW=
user32\TranslateAcceleratorA=
user32\TranslateAcceleratorW=
user32\VkKeyScanA=
user32\VkKeyScanExA=
user32\VkKeyScanExW=
user32\VkKeyScanW=
user32\wsprintfA=
user32\wsprintfW=
version\GetFileVersionInfoA=
version\GetFileVersionInfoSizeA=
version\GetFileVersionInfoSizeW=
version\GetFileVersionInfoW=
version\VerQueryValueA=
version\VerQueryValueW=
wininet\FtpCreateDirectoryA=
wininet\FtpCreateDirectoryW=
wininet\FtpDeleteFileA=
wininet\FtpDeleteFileW=
wininet\FtpFindFirstFileA=
wininet\FtpFindFirstFileW=
wininet\FtpGetCurrentDirectoryA=
wininet\FtpGetCurrentDirectoryW=
wininet\FtpGetFileA=
wininet\FtpGetFileW=
wininet\FtpOpenFileA=
wininet\FtpOpenFileW=
wininet\FtpPutFileA=
wininet\FtpPutFileW=
wininet\FtpRemoveDirectoryA=
wininet\FtpRemoveDirectoryW=
wininet\FtpRenameFileA=
wininet\FtpRenameFileW=
wininet\FtpSetCurrentDirectoryA=
wininet\FtpSetCurrentDirectoryW=
wininet\InternetConnectA=
wininet\InternetConnectW=
wininet\InternetFindNextFileA=
wininet\InternetFindNextFileW=
wininet\InternetGetLastResponseInfoA=
wininet\InternetGetLastResponseInfoW=
wininet\InternetOpenA=
wininet\InternetOpenUrlA=
wininet\InternetOpenUrlW=
wininet\InternetOpenW=
wininet\InternetReadFileExA=
wininet\InternetReadFileExW=
wininet\InternetSetStatusCallbackA=
wininet\InternetSetStatusCallbackW=
winmm\joyGetDevCapsA=
winmm\joyGetDevCapsW=
winmm\mciSendStringA=
winmm\mciSendStringW=
winmm\mixerGetControlDetailsA=
winmm\mixerGetControlDetailsW=
winmm\mixerGetDevCapsA=
winmm\mixerGetDevCapsW=
winmm\mixerGetLineControlsA=
winmm\mixerGetLineControlsW=
winmm\mixerGetLineInfoA=
winmm\mixerGetLineInfoW=
ws2_32\FreeAddrInfoW=
ws2_32\GetAddrInfoW=
ws2_32\SocketA=
ws2_32\SocketW=

[List Not Exported By ImageRvaToVa]
bcrypt\BCryptHash=hash
ntdll\RtlCopyMemory=binary copy
shell32\SHGetNameFromPropertyKey=shell
user32\DialogBox=gui dialog
user32\GetClassLongPtr=gui class
user32\GetWindowLongPtr=gui style/gui wndproc/gui info
user32\SetClassLongPtr=gui icon/gui info
user32\SetWindowLongPtr=gui style/gui wndproc/gui info

[List Exclude]
CallNextHook=gui event
CreateWindow=gui create/gui control
ExitWindows=system

[List AW Don't Exist]
advapi32\CreateProcessWithLogonA=
kernel32\Module32FirstA=
kernel32\Module32NextA=
kernel32\Process32FirstA=
kernel32\Process32NextA=
shlwapi\StrCmpIA=
shlwapi\StrCmpLogicalA=
ws2_32\FreeAddrInfoA=
ws2_32\GetAddrInfoA=

[List AW Not Exported By ImageRvaToVa]
user32\GetClassLongPtrA=
user32\GetClassLongPtrW=
user32\SetWindowLongPtrA=
user32\SetWindowLongPtrW=

Return to “Tips and Tricks”

Who is online

Users browsing this forum: No registered users and 0 guests