Geoff Chappell - Software Analyst
The table below lists all the functions that are first exported from ADVAPI32 by name in version 5.2, i.e., for Windows Server 2003.
| Function | Remarks |
|---|---|
| CreateProcessWithTokenW | |
| ElfReportEventAndSourceW | begins from SP1 |
| I_QueryTagInformation | begins from SP1; forwarded to API-MS-WIN-Service-winsvc-L1-1-0 in 6.1 and higher |
| RegConnectRegistryExA | begins from SP1 |
| RegConnectRegistryExW | begins from SP1 |
| RegDeleteKeyExA | begins from SP1; implemented as jump to API-MS-Win-Core-LocalRegistry-L1-1-0 in 6.1 and higher |
| RegDeleteKeyExW | begins from SP1; implemented as jump to API-MS-Win-Core-LocalRegistry-L1-1-0 in 6.1 and higher |
| RegDisableReflectionKey | begins from SP1 |
| RegEnableReflectionKey | begins from SP1 |
| RegGetValueA | begins from SP1; implemented as jump to API-MS-Win-Core-LocalRegistry-L1-1-0 in 6.1 and higher |
| RegGetValueW | begins from SP1; implemented as jump to API-MS-Win-Core-LocalRegistry-L1-1-0 in 6.1 and higher |
| RegQueryReflectionKey | begins from SP1 |