decode.txt

psapi.dll:
EnumProcesses(out ptr, in uint, out dword_ptr)
EnumProcessModules(in ptr, out ptr, in uint, out dword_ptr)
GetModuleBaseNameA(in ptr, in ptr, out string, in uint)
GetModuleBaseNameW(in ptr, in ptr, out ustring, in uint)
GetModuleFileNameExA(in ptr, in ptr, out string, in uint)
GetModuleFileNameExW(in ptr, in ptr, out ustring, in uint)
GetModuleInformation(in ptr, in ptr, out ptr, in uint)
EmptyWorkingSet(in ptr)
QueryWorkingSet(in ptr, out ptr, in uint)
InitializeProcessForWsWatch(in ptr)
GetWsChanges(in ptr, out ptr, in uint)
GetMappedFileNameW(in ptr, in ptr, out ustring, in uint)
GetMappedFileNameA(in ptr, in ptr, out string, in uint)
EnumDeviceDrivers(out ptr, in uint, out dword_ptr)
GetDeviceDriverBaseNameA(in ptr, out string, in uint)
GetDeviceDriverBaseNameW(in ptr, out ustring, in uint)
GetDeviceDriverFileNameA(in ptr, out string, in uint)
GetDeviceDriverFileNameW(in ptr, out ustring, in uint)
GetProcessMemoryInfo(in ptr, out ptr, in uint)

kernel32.dll:
CreateFileA(in string, in uint, in uint, in ptr, in uint, in uint, in ptr)
LoadLibraryA(in string)
GetProcAddress(in ptr, in string)
CallNamedPipeW(in ustring, in buffer, in uint, out ptr, in uint, out dword_ptr, in uint)
TlsGetValue(in uint)
CloseHandle(in ptr)
EnterCriticalSection(in ptr)
LeaveCriticalSection(in ptr)
TlsSetValue(in uint, in ptr)
ResetEvent(in ptr)
ReadFile(in ptr, out buffer, in uint, out dword_ptr, in ptr)
GetLastError()
SetLastError(in uint)
InitializeCriticalSection(in ptr)
HeapAlloc(in ptr, in uint, in uint)
InterlockedCompareExchange(out ptr, in ptr, in ptr)
InterlockedDecrement(in ptr)
InterlockedIncrement(in ptr)
GlobalAlloc(in uint, in uint)
GetSystemTimeAsFileTime(in ptr)
LocalAlloc(in uint, in uint)
LocalFree(in ptr)
ConnectNamedPipe(in ptr, in ptr)
DisconnectNamedPipe(in ptr)
PulseEvent(in ptr)
SetEvent(in ptr)
WaitForMultipleObjects(in uint, in ptr, in int, in uint)
WriteFile(in ptr, in buffer, in uint, out dword_ptr, in ptr)

MSVCRT.DLL:
printf(in string)
putchar(in int)
exit(in int)
sprintf(out string, in string)
fprintf(in ptr, in string)
_wcsicmp(in ustring, in ustring)
time(in ptr)
rand()
wcscat(inout ustring, in ustring)
wcschr(in ustring, in int)
wcscpy(out ustring, in ustring)
wcslen(in ustring)
wcsncpy(out ustring, in ustring, in uint)

advapi32.dll:
AbortSystemShutdownA(in string)
AbortSystemShutdownW(in ustring)
AccessCheck(in ptr, in ptr, in uint, in ptr, in ptr, out dword_ptr, out dword_ptr, out dword_ptr)
AccessCheckAndAuditAlarmA(in string, in ptr, in string, in string, in ptr, in uint, in ptr, in int, out dword_ptr, out dword_ptr, out dword_ptr)
AccessCheckAndAuditAlarmW(in ustring, in ptr, in ustring, in ustring, in ptr, in uint, in ptr, in int, out dword_ptr, out dword_ptr, out dword_ptr)
AddAccessAllowedAce(in ptr, in uint, in uint, in ptr)
AddAccessDeniedAce(in ptr, in uint, in uint, in ptr)
AddAce(in ptr, in uint, in uint, in ptr, in uint)
AddAuditAccessAce(in ptr, in uint, in uint, in ptr, in int, in int)
AdjustTokenGroups(in ptr, in int, in ptr, in uint, in ptr, out dword_ptr)
AdjustTokenPrivileges(in ptr, in int, in ptr, in uint, in ptr, out dword_ptr)
AllocateAndInitializeSid(in ptr, in int, in uint, in uint, in uint, in uint, in uint, in uint, in uint, in uint, out ptr)
AllocateLocallyUniqueId(in ptr)
AreAllAccessesGranted(in uint, in uint)
AreAnyAccessesGranted(in uint, in uint)
BackupEventLogA(in ptr, in string)
BackupEventLogW(in ptr, in ustring)
BuildExplicitAccessWithNameA(in ptr, in string, in uint, in uint, in uint)
BuildExplicitAccessWithNameW(in ptr, in ustring, in uint, in uint, in uint)
BuildImpersonateExplicitAccessWithNameA()
BuildImpersonateExplicitAccessWithNameW()
BuildImpersonateTrusteeA()
BuildImpersonateTrusteeW()
BuildSecurityDescriptorA(in ptr, in ptr, in uint, in ptr, in uint, in ptr, in ptr, in dword_ptr, out ptr)
BuildSecurityDescriptorW(in ptr, in ptr, in uint, in ptr, in uint, in ptr, in ptr, in dword_ptr, out ptr)
BuildTrusteeWithNameA(in ptr, in string)
BuildTrusteeWithNameW(in ptr, in ustring)
BuildTrusteeWithSidA(in ptr, in ptr)
BuildTrusteeWithSidW(in ptr, in ptr)
CancelOverlappedAccess(in ptr)
ChangeServiceConfigA(in ptr, in uint, in uint, in uint, in string, in string, out dword_ptr, in string, in string, in string, in string)
ChangeServiceConfigW(in ptr, in uint, in uint, in uint, in ustring, in ustring, out dword_ptr, in ustring, in ustring, in ustring, in ustring)
ClearEventLogA(in ptr, in string)
ClearEventLogW(in ptr, in ustring)
CloseEventLog(in ptr)
CloseServiceHandle(in ptr)
ControlService(in ptr, in uint, in ptr)
ConvertAccessToSecurityDescriptorA(in ptr, in ptr, in string, in string, in ptr)
ConvertAccessToSecurityDescriptorW(in ptr, in ptr, in ustring, in ustring, in ptr)
RegCloseKey(in ptr)
RegOpenKeyA(in ptr, in string, out dword_ptr)
RegOpenKeyW(in ptr, in ustring, out dword_ptr)
RegOpenKeyExA(in ptr, in string, in uint, in ptr, in ptr)
RegOpenKeyExW(in ptr, in ustring, in uint, in ptr, in ptr)
RegQueryValueExA(in ptr, in string, in ptr, out dword_ptr, in ptr, out dword_ptr)
RegQueryValueExW(in ptr, in ustring, in ptr, out dword_ptr, in ptr, out dword_ptr)
RegSetValueExA(in ptr, in string, in uint, in uint, in buffer, in uint)
RegSetValueExW(in ptr, in ustring, in uint, in uint, in buffer, in uint)

ntdll.dll:
strncpy(out string, in string, in int)
sprintf(out string, in string)
_stricmp(in string, in string)
NtClose(in ptr)
NtCreateFile(out pptr, in flags, in pobject_attributes, out ptr, in ptr, in flags, in flags, in flags, in flags, in ptr, in uint)
NtDeviceIoControlFile(in ptr, in ptr, in ptr, in ptr, in ptr, in uint, in buffer, in uint, out buffer, in uint)
NtOpenFile(out pptr, in flags, in pobject_attributes, out ptr, in uint, in uint)

inetmib1.dll:
SnmpExtensionInit(in uint, out dword_ptr, out dword_ptr)
SnmpExtensionQuery(in snmpop, inout snmpvarbindlist, out ptr, out ptr)

snmpapi.dll:
SnmpUtilMemAlloc(in uint)

ws2_32.dll:
recvfrom(in int, out buffer, in int, in int, out ptr, inout dword_ptr)
setsockopt(in uint, in int, in int, inout buffer, in int)

wsock32.dll:
socket(in uint, in uint, in uint)
setsockopt(in uint, in int, in int, inout buffer, in int)
htons(in int)
bind(in int, in sockaddr_in, in int)
ntohs(in int)
sendto(in uint, in buffer, in int, in ptr, in sockaddr_in, in int)
select(in int, in ptr, in ptr, in ptr, in ptr)
recvfrom(in uint, in buffer, in ptr, out sockaddr_in, in dword_ptr)

ws2help.dll:
WahReferenceContextByHandle()
WahInsertHandleContext()