Emotet

Reserves, commits or both a region of virtual memory in a target process.

Creates a new thread in a target process, optionally suspended, with rich attribute list support.

Decrements the suspend count of a thread, resuming execution when the count reaches zero.

Returns the zero-based logical-processor index the calling thread is currently executing on.

Creates a named or unnamed event synchronization object and returns a handle to it.

Opens a handle to an existing named event object.

Sets an event object to the signaled state, releasing waiting threads.

Creates or opens a named or unnamed mutant (mutex) object and optionally takes initial ownership.

Returns the current system time as a 64-bit count of 100-ns intervals since 1601-01-01 UTC.

Creates or opens a registry key — the kernel-level primitive behind every persistence beacon written to the registry.

Writes a named value into an open registry key — the workhorse for Run-key and IFEO persistence.

Creates or opens a file, directory, device, or named pipe — every dropper's first call to disk.

Enumerates the entries (name + type) inside an object-manager directory.