IAT
| # | rva | value | meaning |
|---|---|---|---|
| 0 | 0x82000 | 0x8fa46 | ADVAPI32.dll!RegDeleteValueW |
| 1 | 0x82004 | 0x8fa34 | ADVAPI32.dll!RegDeleteKeyW |
| 2 | 0x82008 | 0x8fa24 | ADVAPI32.dll!RegEnumKeyExW |
| 3 | 0x8200c | 0x8fa14 | ADVAPI32.dll!RegSetValueExW |
| 4 | 0x82010 | 0x8fa02 | ADVAPI32.dll!RegCreateKeyExW |
| 5 | 0x82014 | 0x8f9f0 | ADVAPI32.dll!GetUserNameW |
| 6 | 0x82018 | 0x8f9e0 | ADVAPI32.dll!RegConnectRegistryW |
| 7 | 0x8201c | 0x8f9ca | ADVAPI32.dll!CloseServiceHandle |
| 8 | 0x82020 | 0x8f9b4 | ADVAPI32.dll!UnlockServiceDatabase |
| 9 | 0x82024 | 0x8f99c | ADVAPI32.dll!OpenThreadToken |
| 10 | 0x82028 | 0x8f7bc | ADVAPI32.dll!OpenProcessToken |
| 11 | 0x8202c | 0x8f7ce | ADVAPI32.dll!LookupPrivilegeValueW |
| 12 | 0x82030 | 0x8f7e2 | ADVAPI32.dll!DuplicateTokenEx |
| 13 | 0x82034 | 0x8f7fa | ADVAPI32.dll!CreateProcessAsUserW |
| 14 | 0x82038 | 0x8f80e | ADVAPI32.dll!CreateProcessWithLogonW |
| 15 | 0x8203c | 0x8f826 | ADVAPI32.dll!InitializeSecurityDescriptor |
| 16 | 0x82040 | 0x8f840 | ADVAPI32.dll!InitializeAcl |
| 17 | 0x82044 | 0x8f860 | ADVAPI32.dll!GetLengthSid |
| 18 | 0x82048 | 0x8f870 | ADVAPI32.dll!CopySid |
| 19 | 0x8204c | 0x8f880 | ADVAPI32.dll!LogonUserW |