|  | ; | 
|  | ; Definition file of ntdll.dll | 
|  | ; Automatic generated by gendef | 
|  | ; written by Kai Tietz 2008-2014 | 
|  | ; | 
|  | LIBRARY "ntdll.dll" | 
|  | EXPORTS | 
|  | ord_1 @1 | 
|  | ord_2 @2 | 
|  | ord_3 @3 | 
|  | ord_4 @4 | 
|  | ord_5 @5 | 
|  | ord_6 @6 | 
|  | ord_7 @7 | 
|  | ord_8 @8 | 
|  | A_SHAFinal | 
|  | A_SHAInit | 
|  | A_SHAUpdate | 
|  | AlpcAdjustCompletionListConcurrencyCount | 
|  | AlpcFreeCompletionListMessage | 
|  | AlpcGetCompletionListLastMessageInformation | 
|  | AlpcGetCompletionListMessageAttributes | 
|  | AlpcGetHeaderSize | 
|  | AlpcGetMessageAttribute | 
|  | AlpcGetMessageFromCompletionList | 
|  | AlpcGetOutstandingCompletionListMessageCount | 
|  | AlpcInitializeMessageAttribute | 
|  | AlpcMaxAllowedMessageLength | 
|  | AlpcRegisterCompletionList | 
|  | AlpcRegisterCompletionListWorkerThread | 
|  | AlpcRundownCompletionList | 
|  | AlpcUnregisterCompletionList | 
|  | AlpcUnregisterCompletionListWorkerThread | 
|  | ApiSetQueryApiSetPresence | 
|  | CsrAllocateCaptureBuffer | 
|  | CsrAllocateMessagePointer | 
|  | CsrCaptureMessageBuffer | 
|  | CsrCaptureMessageMultiUnicodeStringsInPlace | 
|  | CsrCaptureMessageString | 
|  | CsrCaptureTimeout | 
|  | CsrClientCallServer | 
|  | CsrClientConnectToServer | 
|  | CsrFreeCaptureBuffer | 
|  | CsrGetProcessId | 
|  | CsrIdentifyAlertableThread | 
|  | CsrSetPriorityClass | 
|  | CsrVerifyRegion | 
|  | DbgBreakPoint | 
|  | DbgPrint | 
|  | DbgPrintEx | 
|  | DbgPrintReturnControlC | 
|  | DbgPrompt | 
|  | DbgQueryDebugFilterState | 
|  | DbgSetDebugFilterState | 
|  | DbgUiConnectToDbg | 
|  | DbgUiContinue | 
|  | DbgUiConvertStateChangeStructure | 
|  | DbgUiDebugActiveProcess | 
|  | DbgUiGetThreadDebugObject | 
|  | DbgUiIssueRemoteBreakin | 
|  | DbgUiRemoteBreakin | 
|  | DbgUiSetThreadDebugObject | 
|  | DbgUiStopDebugging | 
|  | DbgUiWaitStateChange | 
|  | DbgUserBreakPoint | 
|  | EtwCreateTraceInstanceId | 
|  | EtwDeliverDataBlock | 
|  | EtwEnumerateProcessRegGuids | 
|  | EtwEventActivityIdControl | 
|  | EtwEventEnabled | 
|  | EtwEventProviderEnabled | 
|  | EtwEventRegister | 
|  | EtwEventSetInformation | 
|  | EtwEventUnregister | 
|  | EtwEventWrite | 
|  | EtwEventWriteEndScenario | 
|  | EtwEventWriteEx | 
|  | EtwEventWriteFull | 
|  | EtwEventWriteNoRegistration | 
|  | EtwEventWriteStartScenario | 
|  | EtwEventWriteString | 
|  | EtwEventWriteTransfer | 
|  | EtwGetTraceEnableFlags | 
|  | EtwGetTraceEnableLevel | 
|  | EtwGetTraceLoggerHandle | 
|  | EtwLogTraceEvent | 
|  | EtwNotificationRegister | 
|  | EtwNotificationUnregister | 
|  | EtwProcessPrivateLoggerRequest | 
|  | EtwRegisterSecurityProvider | 
|  | EtwRegisterTraceGuidsA | 
|  | EtwRegisterTraceGuidsW | 
|  | EtwReplyNotification | 
|  | EtwSendNotification | 
|  | EtwSetMark | 
|  | EtwTraceEventInstance | 
|  | EtwTraceMessage | 
|  | EtwTraceMessageVa | 
|  | EtwUnregisterTraceGuids | 
|  | EtwWriteUMSecurityEvent | 
|  | EtwpCreateEtwThread | 
|  | EtwpGetCpuSpeed | 
|  | EvtIntReportAuthzEventAndSourceAsync | 
|  | EvtIntReportEventAndSourceAsync | 
|  | ExpInterlockedPopEntrySListEnd | 
|  | ExpInterlockedPopEntrySListFault | 
|  | ExpInterlockedPopEntrySListResume | 
|  | KiRaiseUserExceptionDispatcher | 
|  | KiUserApcDispatcher | 
|  | KiUserCallbackDispatcher | 
|  | KiUserExceptionDispatcher | 
|  | KiUserInvertedFunctionTable DATA | 
|  | LdrAccessResource | 
|  | LdrAddDllDirectory | 
|  | LdrAddLoadAsDataTable | 
|  | LdrAddRefDll | 
|  | LdrAppxHandleIntegrityFailure | 
|  | LdrDisableThreadCalloutsForDll | 
|  | LdrEnumResources | 
|  | LdrEnumerateLoadedModules | 
|  | LdrFindEntryForAddress | 
|  | LdrFindResourceDirectory_U | 
|  | LdrFindResourceEx_U | 
|  | LdrFindResource_U | 
|  | LdrFlushAlternateResourceModules | 
|  | LdrGetDllDirectory | 
|  | LdrGetDllFullName | 
|  | LdrGetDllHandle | 
|  | LdrGetDllHandleByMapping | 
|  | LdrGetDllHandleByName | 
|  | LdrGetDllHandleEx | 
|  | LdrGetDllPath | 
|  | LdrGetFailureData | 
|  | LdrGetFileNameFromLoadAsDataTable | 
|  | LdrGetProcedureAddress | 
|  | LdrGetProcedureAddressEx | 
|  | LdrGetProcedureAddressForCaller | 
|  | LdrInitShimEngineDynamic | 
|  | LdrInitializeThunk | 
|  | LdrLoadAlternateResourceModule | 
|  | LdrLoadAlternateResourceModuleEx | 
|  | LdrLoadDll | 
|  | LdrLockLoaderLock | 
|  | LdrOpenImageFileOptionsKey | 
|  | LdrProcessRelocationBlock | 
|  | LdrProcessRelocationBlockEx | 
|  | LdrQueryImageFileExecutionOptions | 
|  | LdrQueryImageFileExecutionOptionsEx | 
|  | LdrQueryImageFileKeyOption | 
|  | LdrQueryModuleServiceTags | 
|  | LdrQueryOptionalDelayLoadedAPI | 
|  | LdrQueryProcessModuleInformation | 
|  | LdrRegisterDllNotification | 
|  | LdrRemoveDllDirectory | 
|  | LdrRemoveLoadAsDataTable | 
|  | LdrResFindResource | 
|  | LdrResFindResourceDirectory | 
|  | LdrResGetRCConfig | 
|  | LdrResRelease | 
|  | LdrResSearchResource | 
|  | LdrResolveDelayLoadedAPI | 
|  | LdrResolveDelayLoadsFromDll | 
|  | LdrRscIsTypeExist | 
|  | LdrSetAppCompatDllRedirectionCallback | 
|  | LdrSetDefaultDllDirectories | 
|  | LdrSetDllDirectory | 
|  | LdrSetDllManifestProber | 
|  | LdrSetImplicitPathOptions | 
|  | LdrSetMUICacheType | 
|  | LdrShutdownProcess | 
|  | LdrShutdownThread | 
|  | LdrStandardizeSystemPath | 
|  | LdrSystemDllInitBlock DATA | 
|  | LdrUnloadAlternateResourceModule | 
|  | LdrUnloadAlternateResourceModuleEx | 
|  | LdrUnloadDll | 
|  | LdrUnlockLoaderLock | 
|  | LdrUnregisterDllNotification | 
|  | LdrVerifyImageMatchesChecksum | 
|  | LdrVerifyImageMatchesChecksumEx | 
|  | LdrpResGetMappingSize | 
|  | LdrpResGetResourceDirectory | 
|  | MD4Final | 
|  | MD4Init | 
|  | MD4Update | 
|  | MD5Final | 
|  | MD5Init | 
|  | MD5Update | 
|  | NlsAnsiCodePage DATA | 
|  | NlsMbCodePageTag DATA | 
|  | NlsMbOemCodePageTag DATA | 
|  | NtAcceptConnectPort | 
|  | NtAccessCheck | 
|  | NtAccessCheckAndAuditAlarm | 
|  | NtAccessCheckByType | 
|  | NtAccessCheckByTypeAndAuditAlarm | 
|  | NtAccessCheckByTypeResultList | 
|  | NtAccessCheckByTypeResultListAndAuditAlarm | 
|  | NtAccessCheckByTypeResultListAndAuditAlarmByHandle | 
|  | NtAddAtom | 
|  | NtAddAtomEx | 
|  | NtAddBootEntry | 
|  | NtAddDriverEntry | 
|  | NtAdjustGroupsToken | 
|  | NtAdjustPrivilegesToken | 
|  | NtAdjustTokenClaimsAndDeviceGroups | 
|  | NtAlertResumeThread | 
|  | NtAlertThread | 
|  | NtAlertThreadByThreadId | 
|  | NtAllocateLocallyUniqueId | 
|  | NtAllocateReserveObject | 
|  | NtAllocateUserPhysicalPages | 
|  | NtAllocateUuids | 
|  | NtAllocateVirtualMemory | 
|  | NtAlpcAcceptConnectPort | 
|  | NtAlpcCancelMessage | 
|  | NtAlpcConnectPort | 
|  | NtAlpcConnectPortEx | 
|  | NtAlpcCreatePort | 
|  | NtAlpcCreatePortSection | 
|  | NtAlpcCreateResourceReserve | 
|  | NtAlpcCreateSectionView | 
|  | NtAlpcCreateSecurityContext | 
|  | NtAlpcDeletePortSection | 
|  | NtAlpcDeleteResourceReserve | 
|  | NtAlpcDeleteSectionView | 
|  | NtAlpcDeleteSecurityContext | 
|  | NtAlpcDisconnectPort | 
|  | NtAlpcImpersonateClientOfPort | 
|  | NtAlpcOpenSenderProcess | 
|  | NtAlpcOpenSenderThread | 
|  | NtAlpcQueryInformation | 
|  | NtAlpcQueryInformationMessage | 
|  | NtAlpcRevokeSecurityContext | 
|  | NtAlpcSendWaitReceivePort | 
|  | NtAlpcSetInformation | 
|  | NtApphelpCacheControl | 
|  | NtAreMappedFilesTheSame | 
|  | NtAssignProcessToJobObject | 
|  | NtAssociateWaitCompletionPacket | 
|  | NtCallbackReturn | 
|  | NtCancelIoFile | 
|  | NtCancelIoFileEx | 
|  | NtCancelSynchronousIoFile | 
|  | NtCancelTimer | 
|  | NtCancelTimer2 | 
|  | NtCancelWaitCompletionPacket | 
|  | NtClearEvent | 
|  | NtClose | 
|  | NtCloseObjectAuditAlarm | 
|  | NtCommitComplete | 
|  | NtCommitEnlistment | 
|  | NtCommitTransaction | 
|  | NtCompactKeys | 
|  | NtCompareTokens | 
|  | NtCompleteConnectPort | 
|  | NtCompressKey | 
|  | NtConnectPort | 
|  | NtContinue | 
|  | NtCreateDebugObject | 
|  | NtCreateDirectoryObject | 
|  | NtCreateDirectoryObjectEx | 
|  | NtCreateEnlistment | 
|  | NtCreateEvent | 
|  | NtCreateEventPair | 
|  | NtCreateFile | 
|  | NtCreateIRTimer | 
|  | NtCreateIoCompletion | 
|  | NtCreateJobObject | 
|  | NtCreateJobSet | 
|  | NtCreateKey | 
|  | NtCreateKeyTransacted | 
|  | NtCreateKeyedEvent | 
|  | NtCreateLowBoxToken | 
|  | NtCreateMailslotFile | 
|  | NtCreateMutant | 
|  | NtCreateNamedPipeFile | 
|  | NtCreatePagingFile | 
|  | NtCreatePort | 
|  | NtCreatePrivateNamespace | 
|  | NtCreateProcess | 
|  | NtCreateProcessEx | 
|  | NtCreateProfile | 
|  | NtCreateProfileEx | 
|  | NtCreateResourceManager | 
|  | NtCreateSection | 
|  | NtCreateSemaphore | 
|  | NtCreateSymbolicLinkObject | 
|  | NtCreateThread | 
|  | NtCreateThreadEx | 
|  | NtCreateTimer | 
|  | NtCreateTimer2 | 
|  | NtCreateToken | 
|  | NtCreateTokenEx | 
|  | NtCreateTransaction | 
|  | NtCreateTransactionManager | 
|  | NtCreateUserProcess | 
|  | NtCreateWaitCompletionPacket | 
|  | NtCreateWaitablePort | 
|  | NtCreateWnfStateName | 
|  | NtCreateWorkerFactory | 
|  | NtDebugActiveProcess | 
|  | NtDebugContinue | 
|  | NtDelayExecution | 
|  | NtDeleteAtom | 
|  | NtDeleteBootEntry | 
|  | NtDeleteDriverEntry | 
|  | NtDeleteFile | 
|  | NtDeleteKey | 
|  | NtDeleteObjectAuditAlarm | 
|  | NtDeletePrivateNamespace | 
|  | NtDeleteValueKey | 
|  | NtDeleteWnfStateData | 
|  | NtDeleteWnfStateName | 
|  | NtDeviceIoControlFile | 
|  | NtDisableLastKnownGood | 
|  | NtDisplayString | 
|  | NtDrawText | 
|  | NtDuplicateObject | 
|  | NtDuplicateToken | 
|  | NtEnableLastKnownGood | 
|  | NtEnumerateBootEntries | 
|  | NtEnumerateDriverEntries | 
|  | NtEnumerateKey | 
|  | NtEnumerateSystemEnvironmentValuesEx | 
|  | NtEnumerateTransactionObject | 
|  | NtEnumerateValueKey | 
|  | NtExtendSection | 
|  | NtFilterBootOption | 
|  | NtFilterToken | 
|  | NtFilterTokenEx | 
|  | NtFindAtom | 
|  | NtFlushBuffersFile | 
|  | NtFlushBuffersFileEx | 
|  | NtFlushInstallUILanguage | 
|  | NtFlushInstructionCache | 
|  | NtFlushKey | 
|  | NtFlushProcessWriteBuffers | 
|  | NtFlushVirtualMemory | 
|  | NtFlushWriteBuffer | 
|  | NtFreeUserPhysicalPages | 
|  | NtFreeVirtualMemory | 
|  | NtFreezeRegistry | 
|  | NtFreezeTransactions | 
|  | NtFsControlFile | 
|  | NtGetCachedSigningLevel | 
|  | NtGetCompleteWnfStateSubscription | 
|  | NtGetContextThread | 
|  | NtGetCurrentProcessorNumber | 
|  | NtGetDevicePowerState | 
|  | NtGetMUIRegistryInfo | 
|  | NtGetNextProcess | 
|  | NtGetNextThread | 
|  | NtGetNlsSectionPtr | 
|  | NtGetNotificationResourceManager | 
|  | NtGetTickCount | 
|  | NtGetWriteWatch | 
|  | NtImpersonateAnonymousToken | 
|  | NtImpersonateClientOfPort | 
|  | NtImpersonateThread | 
|  | NtInitializeNlsFiles | 
|  | NtInitializeRegistry | 
|  | NtInitiatePowerAction | 
|  | NtIsProcessInJob | 
|  | NtIsSystemResumeAutomatic | 
|  | NtIsUILanguageComitted | 
|  | NtListenPort | 
|  | NtLoadDriver | 
|  | NtLoadKey | 
|  | NtLoadKey2 | 
|  | NtLoadKeyEx | 
|  | NtLockFile | 
|  | NtLockProductActivationKeys | 
|  | NtLockRegistryKey | 
|  | NtLockVirtualMemory | 
|  | NtMakePermanentObject | 
|  | NtMakeTemporaryObject | 
|  | NtMapCMFModule | 
|  | NtMapUserPhysicalPages | 
|  | NtMapUserPhysicalPagesScatter | 
|  | NtMapViewOfSection | 
|  | NtModifyBootEntry | 
|  | NtModifyDriverEntry | 
|  | NtNotifyChangeDirectoryFile | 
|  | NtNotifyChangeKey | 
|  | NtNotifyChangeMultipleKeys | 
|  | NtNotifyChangeSession | 
|  | NtOpenDirectoryObject | 
|  | NtOpenEnlistment | 
|  | NtOpenEvent | 
|  | NtOpenEventPair | 
|  | NtOpenFile | 
|  | NtOpenIoCompletion | 
|  | NtOpenJobObject | 
|  | NtOpenKey | 
|  | NtOpenKeyEx | 
|  | NtOpenKeyTransacted | 
|  | NtOpenKeyTransactedEx | 
|  | NtOpenKeyedEvent | 
|  | NtOpenMutant | 
|  | NtOpenObjectAuditAlarm | 
|  | NtOpenPrivateNamespace | 
|  | NtOpenProcess | 
|  | NtOpenProcessToken | 
|  | NtOpenProcessTokenEx | 
|  | NtOpenResourceManager | 
|  | NtOpenSection | 
|  | NtOpenSemaphore | 
|  | NtOpenSession | 
|  | NtOpenSymbolicLinkObject | 
|  | NtOpenThread | 
|  | NtOpenThreadToken | 
|  | NtOpenThreadTokenEx | 
|  | NtOpenTimer | 
|  | NtOpenTransaction | 
|  | NtOpenTransactionManager | 
|  | NtPlugPlayControl | 
|  | NtPowerInformation | 
|  | NtPrePrepareComplete | 
|  | NtPrePrepareEnlistment | 
|  | NtPrepareComplete | 
|  | NtPrepareEnlistment | 
|  | NtPrivilegeCheck | 
|  | NtPrivilegeObjectAuditAlarm | 
|  | NtPrivilegedServiceAuditAlarm | 
|  | NtPropagationComplete | 
|  | NtPropagationFailed | 
|  | NtProtectVirtualMemory | 
|  | NtPulseEvent | 
|  | NtQueryAttributesFile | 
|  | NtQueryBootEntryOrder | 
|  | NtQueryBootOptions | 
|  | NtQueryDebugFilterState | 
|  | NtQueryDefaultLocale | 
|  | NtQueryDefaultUILanguage | 
|  | NtQueryDirectoryFile | 
|  | NtQueryDirectoryObject | 
|  | NtQueryDriverEntryOrder | 
|  | NtQueryEaFile | 
|  | NtQueryEvent | 
|  | NtQueryFullAttributesFile | 
|  | NtQueryInformationAtom | 
|  | NtQueryInformationEnlistment | 
|  | NtQueryInformationFile | 
|  | NtQueryInformationJobObject | 
|  | NtQueryInformationPort | 
|  | NtQueryInformationProcess | 
|  | NtQueryInformationResourceManager | 
|  | NtQueryInformationThread | 
|  | NtQueryInformationToken | 
|  | NtQueryInformationTransaction | 
|  | NtQueryInformationTransactionManager | 
|  | NtQueryInformationWorkerFactory | 
|  | NtQueryInstallUILanguage | 
|  | NtQueryIntervalProfile | 
|  | NtQueryIoCompletion | 
|  | NtQueryKey | 
|  | NtQueryLicenseValue | 
|  | NtQueryMultipleValueKey | 
|  | NtQueryMutant | 
|  | NtQueryObject | 
|  | NtQueryOpenSubKeys | 
|  | NtQueryOpenSubKeysEx | 
|  | NtQueryPerformanceCounter | 
|  | NtQueryPortInformationProcess | 
|  | NtQueryQuotaInformationFile | 
|  | NtQuerySection | 
|  | NtQuerySecurityAttributesToken | 
|  | NtQuerySecurityObject | 
|  | NtQuerySemaphore | 
|  | NtQuerySymbolicLinkObject | 
|  | NtQuerySystemEnvironmentValue | 
|  | NtQuerySystemEnvironmentValueEx | 
|  | NtQuerySystemInformation | 
|  | NtQuerySystemInformationEx | 
|  | NtQuerySystemTime | 
|  | NtQueryTimer | 
|  | NtQueryTimerResolution | 
|  | NtQueryValueKey | 
|  | NtQueryVirtualMemory | 
|  | NtQueryVolumeInformationFile | 
|  | NtQueryWnfStateData | 
|  | NtQueryWnfStateNameInformation | 
|  | NtQueueApcThread | 
|  | NtQueueApcThreadEx | 
|  | NtRaiseException | 
|  | NtRaiseHardError | 
|  | NtReadFile | 
|  | NtReadFileScatter | 
|  | NtReadOnlyEnlistment | 
|  | NtReadRequestData | 
|  | NtReadVirtualMemory | 
|  | NtRecoverEnlistment | 
|  | NtRecoverResourceManager | 
|  | NtRecoverTransactionManager | 
|  | NtRegisterProtocolAddressInformation | 
|  | NtRegisterThreadTerminatePort | 
|  | NtReleaseKeyedEvent | 
|  | NtReleaseMutant | 
|  | NtReleaseSemaphore | 
|  | NtReleaseWorkerFactoryWorker | 
|  | NtRemoveIoCompletion | 
|  | NtRemoveIoCompletionEx | 
|  | NtRemoveProcessDebug | 
|  | NtRenameKey | 
|  | NtRenameTransactionManager | 
|  | NtReplaceKey | 
|  | NtReplacePartitionUnit | 
|  | NtReplyPort | 
|  | NtReplyWaitReceivePort | 
|  | NtReplyWaitReceivePortEx | 
|  | NtReplyWaitReplyPort | 
|  | NtRequestPort | 
|  | NtRequestWaitReplyPort | 
|  | NtResetEvent | 
|  | NtResetWriteWatch | 
|  | NtRestoreKey | 
|  | NtResumeProcess | 
|  | NtResumeThread | 
|  | NtRollbackComplete | 
|  | NtRollbackEnlistment | 
|  | NtRollbackTransaction | 
|  | NtRollforwardTransactionManager | 
|  | NtSaveKey | 
|  | NtSaveKeyEx | 
|  | NtSaveMergedKeys | 
|  | NtSecureConnectPort | 
|  | NtSerializeBoot | 
|  | NtSetBootEntryOrder | 
|  | NtSetBootOptions | 
|  | NtSetCachedSigningLevel | 
|  | NtSetContextThread | 
|  | NtSetDebugFilterState | 
|  | NtSetDefaultHardErrorPort | 
|  | NtSetDefaultLocale | 
|  | NtSetDefaultUILanguage | 
|  | NtSetDriverEntryOrder | 
|  | NtSetEaFile | 
|  | NtSetEvent | 
|  | NtSetEventBoostPriority | 
|  | NtSetHighEventPair | 
|  | NtSetHighWaitLowEventPair | 
|  | NtSetIRTimer | 
|  | NtSetInformationDebugObject | 
|  | NtSetInformationEnlistment | 
|  | NtSetInformationFile | 
|  | NtSetInformationJobObject | 
|  | NtSetInformationKey | 
|  | NtSetInformationObject | 
|  | NtSetInformationProcess | 
|  | NtSetInformationResourceManager | 
|  | NtSetInformationThread | 
|  | NtSetInformationToken | 
|  | NtSetInformationTransaction | 
|  | NtSetInformationTransactionManager | 
|  | NtSetInformationVirtualMemory | 
|  | NtSetInformationWorkerFactory | 
|  | NtSetIntervalProfile | 
|  | NtSetIoCompletion | 
|  | NtSetIoCompletionEx | 
|  | NtSetLdtEntries | 
|  | NtSetLowEventPair | 
|  | NtSetLowWaitHighEventPair | 
|  | NtSetQuotaInformationFile | 
|  | NtSetSecurityObject | 
|  | NtSetSystemEnvironmentValue | 
|  | NtSetSystemEnvironmentValueEx | 
|  | NtSetSystemInformation | 
|  | NtSetSystemPowerState | 
|  | NtSetSystemTime | 
|  | NtSetThreadExecutionState | 
|  | NtSetTimer | 
|  | NtSetTimer2 | 
|  | NtSetTimerEx | 
|  | NtSetTimerResolution | 
|  | NtSetUuidSeed | 
|  | NtSetValueKey | 
|  | NtSetVolumeInformationFile | 
|  | NtSetWnfProcessNotificationEvent | 
|  | NtShutdownSystem | 
|  | NtShutdownWorkerFactory | 
|  | NtSignalAndWaitForSingleObject | 
|  | NtSinglePhaseReject | 
|  | NtStartProfile | 
|  | NtStopProfile | 
|  | NtSubscribeWnfStateChange | 
|  | NtSuspendProcess | 
|  | NtSuspendThread | 
|  | NtSystemDebugControl | 
|  | NtTerminateJobObject | 
|  | NtTerminateProcess | 
|  | NtTerminateThread | 
|  | NtTestAlert | 
|  | NtThawRegistry | 
|  | NtThawTransactions | 
|  | NtTraceControl | 
|  | NtTraceEvent | 
|  | NtTranslateFilePath | 
|  | NtUmsThreadYield | 
|  | NtUnloadDriver | 
|  | NtUnloadKey | 
|  | NtUnloadKey2 | 
|  | NtUnloadKeyEx | 
|  | NtUnlockFile | 
|  | NtUnlockVirtualMemory | 
|  | NtUnmapViewOfSection | 
|  | NtUnmapViewOfSectionEx | 
|  | NtUnsubscribeWnfStateChange | 
|  | NtUpdateWnfStateData | 
|  | NtVdmControl | 
|  | NtWaitForAlertByThreadId | 
|  | NtWaitForDebugEvent | 
|  | NtWaitForKeyedEvent | 
|  | NtWaitForMultipleObjects | 
|  | NtWaitForMultipleObjects32 | 
|  | NtWaitForSingleObject | 
|  | NtWaitForWorkViaWorkerFactory | 
|  | NtWaitHighEventPair | 
|  | NtWaitLowEventPair | 
|  | NtWorkerFactoryWorkerReady | 
|  | NtWriteFile | 
|  | NtWriteFileGather | 
|  | NtWriteRequestData | 
|  | NtWriteVirtualMemory | 
|  | NtYieldExecution | 
|  | NtdllDefWindowProc_A | 
|  | NtdllDefWindowProc_W | 
|  | NtdllDialogWndProc_A | 
|  | NtdllDialogWndProc_W | 
|  | PfxFindPrefix | 
|  | PfxInitialize | 
|  | PfxInsertPrefix | 
|  | PfxRemovePrefix | 
|  | PssNtCaptureSnapshot | 
|  | PssNtDuplicateSnapshot | 
|  | PssNtFreeRemoteSnapshot | 
|  | PssNtFreeSnapshot | 
|  | PssNtFreeWalkMarker | 
|  | PssNtQuerySnapshot | 
|  | PssNtValidateDescriptor | 
|  | PssNtWalkSnapshot | 
|  | ReadTimeStampCounter | 
|  | RtlAbortRXact | 
|  | RtlAbsoluteToSelfRelativeSD | 
|  | RtlAcquirePebLock | 
|  | RtlAcquirePrivilege | 
|  | RtlAcquireReleaseSRWLockExclusive | 
|  | RtlAcquireResourceExclusive | 
|  | RtlAcquireResourceShared | 
|  | RtlAcquireSRWLockExclusive | 
|  | RtlAcquireSRWLockShared | 
|  | RtlActivateActivationContext | 
|  | RtlActivateActivationContextEx | 
|  | RtlActivateActivationContextUnsafeFast | 
|  | RtlAddAccessAllowedAce | 
|  | RtlAddAccessAllowedAceEx | 
|  | RtlAddAccessAllowedObjectAce | 
|  | RtlAddAccessDeniedAce | 
|  | RtlAddAccessDeniedAceEx | 
|  | RtlAddAccessDeniedObjectAce | 
|  | RtlAddAce | 
|  | RtlAddActionToRXact | 
|  | RtlAddAtomToAtomTable | 
|  | RtlAddAttributeActionToRXact | 
|  | RtlAddAuditAccessAce | 
|  | RtlAddAuditAccessAceEx | 
|  | RtlAddAuditAccessObjectAce | 
|  | RtlAddCompoundAce | 
|  | RtlAddFunctionTable | 
|  | RtlAddGrowableFunctionTable | 
|  | RtlAddIntegrityLabelToBoundaryDescriptor | 
|  | RtlAddMandatoryAce | 
|  | RtlAddProcessTrustLabelAce | 
|  | RtlAddRefActivationContext | 
|  | RtlAddRefMemoryStream | 
|  | RtlAddResourceAttributeAce | 
|  | RtlAddSIDToBoundaryDescriptor | 
|  | RtlAddScopedPolicyIDAce | 
|  | RtlAddVectoredContinueHandler | 
|  | RtlAddVectoredExceptionHandler | 
|  | RtlAddressInSectionTable | 
|  | RtlAdjustPrivilege | 
|  | RtlAllocateActivationContextStack | 
|  | RtlAllocateAndInitializeSid | 
|  | RtlAllocateAndInitializeSidEx | 
|  | RtlAllocateHandle | 
|  | RtlAllocateHeap | 
|  | RtlAllocateMemoryBlockLookaside | 
|  | RtlAllocateMemoryZone | 
|  | RtlAllocateWnfSerializationGroup | 
|  | RtlAnsiCharToUnicodeChar | 
|  | RtlAnsiStringToUnicodeSize | 
|  | RtlAnsiStringToUnicodeString | 
|  | RtlAppendAsciizToString | 
|  | RtlAppendPathElement | 
|  | RtlAppendStringToString | 
|  | RtlAppendUnicodeStringToString | 
|  | RtlAppendUnicodeToString | 
|  | RtlApplicationVerifierStop | 
|  | RtlApplyRXact | 
|  | RtlApplyRXactNoFlush | 
|  | RtlAppxIsFileOwnedByTrustedInstaller | 
|  | RtlAreAllAccessesGranted | 
|  | RtlAreAnyAccessesGranted | 
|  | RtlAreBitsClear | 
|  | RtlAreBitsSet | 
|  | RtlAssert | 
|  | RtlAvlInsertNodeEx | 
|  | RtlAvlRemoveNode | 
|  | RtlBarrier | 
|  | RtlBarrierForDelete | 
|  | RtlCancelTimer | 
|  | RtlCanonicalizeDomainName | 
|  | RtlCaptureContext | 
|  | RtlCaptureStackBackTrace | 
|  | RtlCharToInteger | 
|  | RtlCheckForOrphanedCriticalSections | 
|  | RtlCheckPortableOperatingSystem | 
|  | RtlCheckRegistryKey | 
|  | RtlCheckTokenCapability | 
|  | RtlCheckTokenMembership | 
|  | RtlCheckTokenMembershipEx | 
|  | RtlCleanUpTEBLangLists | 
|  | RtlClearAllBits | 
|  | RtlClearBit | 
|  | RtlClearBits | 
|  | RtlCloneMemoryStream | 
|  | RtlCloneUserProcess | 
|  | RtlCmDecodeMemIoResource | 
|  | RtlCmEncodeMemIoResource | 
|  | RtlCommitDebugInfo | 
|  | RtlCommitMemoryStream | 
|  | RtlCompactHeap | 
|  | RtlCompareAltitudes | 
|  | RtlCompareMemory | 
|  | RtlCompareMemoryUlong | 
|  | RtlCompareString | 
|  | RtlCompareUnicodeString | 
|  | RtlCompareUnicodeStrings | 
|  | RtlCompressBuffer | 
|  | RtlComputeCrc32 | 
|  | RtlComputeImportTableHash | 
|  | RtlComputePrivatizedDllName_U | 
|  | RtlConnectToSm | 
|  | RtlConsoleMultiByteToUnicodeN | 
|  | RtlContractHashTable | 
|  | RtlConvertExclusiveToShared | 
|  | RtlConvertLCIDToString | 
|  | RtlConvertSharedToExclusive | 
|  | RtlConvertSidToUnicodeString | 
|  | RtlConvertToAutoInheritSecurityObject | 
|  | RtlCopyBitMap | 
|  | RtlCopyContext | 
|  | RtlCopyExtendedContext | 
|  | RtlCopyLuid | 
|  | RtlCopyLuidAndAttributesArray | 
|  | RtlCopyMappedMemory | 
|  | RtlCopyMemory | 
|  | RtlCopyMemoryStreamTo | 
|  | RtlCopyOutOfProcessMemoryStreamTo | 
|  | RtlCopySecurityDescriptor | 
|  | RtlCopySid | 
|  | RtlCopySidAndAttributesArray | 
|  | RtlCopyString | 
|  | RtlCopyUnicodeString | 
|  | RtlCrc32 | 
|  | RtlCrc64 | 
|  | RtlCreateAcl | 
|  | RtlCreateActivationContext | 
|  | RtlCreateAndSetSD | 
|  | RtlCreateAtomTable | 
|  | RtlCreateBootStatusDataFile | 
|  | RtlCreateBoundaryDescriptor | 
|  | RtlCreateEnvironment | 
|  | RtlCreateEnvironmentEx | 
|  | RtlCreateHashTable | 
|  | RtlCreateHashTableEx | 
|  | RtlCreateHeap | 
|  | RtlCreateMemoryBlockLookaside | 
|  | RtlCreateMemoryZone | 
|  | RtlCreateProcessParameters | 
|  | RtlCreateProcessParametersEx | 
|  | RtlCreateProcessReflection | 
|  | RtlCreateQueryDebugBuffer | 
|  | RtlCreateRegistryKey | 
|  | RtlCreateSecurityDescriptor | 
|  | RtlCreateServiceSid | 
|  | RtlCreateSystemVolumeInformationFolder | 
|  | RtlCreateTagHeap | 
|  | RtlCreateTimer | 
|  | RtlCreateTimerQueue | 
|  | RtlCreateUnicodeString | 
|  | RtlCreateUnicodeStringFromAsciiz | 
|  | RtlCreateUserProcess | 
|  | RtlCreateUserSecurityObject | 
|  | RtlCreateUserStack | 
|  | RtlCreateUserThread | 
|  | RtlCreateVirtualAccountSid | 
|  | RtlCultureNameToLCID | 
|  | RtlCustomCPToUnicodeN | 
|  | RtlCutoverTimeToSystemTime | 
|  | RtlDeCommitDebugInfo | 
|  | RtlDeNormalizeProcessParams | 
|  | RtlDeactivateActivationContext | 
|  | RtlDeactivateActivationContextUnsafeFast | 
|  | RtlDebugPrintTimes | 
|  | RtlDecodePointer | 
|  | RtlDecodeSystemPointer | 
|  | RtlDecompressBuffer | 
|  | RtlDecompressBufferEx | 
|  | RtlDecompressFragment | 
|  | RtlDefaultNpAcl | 
|  | RtlDelete | 
|  | RtlDeleteAce | 
|  | RtlDeleteAtomFromAtomTable | 
|  | RtlDeleteBarrier | 
|  | RtlDeleteBoundaryDescriptor | 
|  | RtlDeleteCriticalSection | 
|  | RtlDeleteElementGenericTable | 
|  | RtlDeleteElementGenericTableAvl | 
|  | RtlDeleteElementGenericTableAvlEx | 
|  | RtlDeleteFunctionTable | 
|  | RtlDeleteGrowableFunctionTable | 
|  | RtlDeleteHashTable | 
|  | RtlDeleteNoSplay | 
|  | RtlDeleteRegistryValue | 
|  | RtlDeleteResource | 
|  | RtlDeleteSecurityObject | 
|  | RtlDeleteTimer | 
|  | RtlDeleteTimerQueue | 
|  | RtlDeleteTimerQueueEx | 
|  | RtlDeregisterSecureMemoryCacheCallback | 
|  | RtlDeregisterWait | 
|  | RtlDeregisterWaitEx | 
|  | RtlDestroyAtomTable | 
|  | RtlDestroyEnvironment | 
|  | RtlDestroyHandleTable | 
|  | RtlDestroyHeap | 
|  | RtlDestroyMemoryBlockLookaside | 
|  | RtlDestroyMemoryZone | 
|  | RtlDestroyProcessParameters | 
|  | RtlDestroyQueryDebugBuffer | 
|  | RtlDetectHeapLeaks | 
|  | RtlDetermineDosPathNameType_U | 
|  | RtlDisableThreadProfiling | 
|  | RtlDllShutdownInProgress | 
|  | RtlDnsHostNameToComputerName | 
|  | RtlDoesFileExists_U | 
|  | RtlDosApplyFileIsolationRedirection_Ustr | 
|  | RtlDosPathNameToNtPathName_U | 
|  | RtlDosPathNameToNtPathName_U_WithStatus | 
|  | RtlDosPathNameToRelativeNtPathName_U | 
|  | RtlDosPathNameToRelativeNtPathName_U_WithStatus | 
|  | RtlDosSearchPath_U | 
|  | RtlDosSearchPath_Ustr | 
|  | RtlDowncaseUnicodeChar | 
|  | RtlDowncaseUnicodeString | 
|  | RtlDumpResource | 
|  | RtlDuplicateUnicodeString | 
|  | RtlEmptyAtomTable | 
|  | RtlEnableEarlyCriticalSectionEventCreation | 
|  | RtlEnableThreadProfiling | 
|  | RtlEncodePointer | 
|  | RtlEncodeSystemPointer | 
|  | RtlEndEnumerationHashTable | 
|  | RtlEndWeakEnumerationHashTable | 
|  | RtlEnterCriticalSection | 
|  | RtlEnumProcessHeaps | 
|  | RtlEnumerateEntryHashTable | 
|  | RtlEnumerateGenericTable | 
|  | RtlEnumerateGenericTableAvl | 
|  | RtlEnumerateGenericTableLikeADirectory | 
|  | RtlEnumerateGenericTableWithoutSplaying | 
|  | RtlEnumerateGenericTableWithoutSplayingAvl | 
|  | RtlEqualComputerName | 
|  | RtlEqualDomainName | 
|  | RtlEqualLuid | 
|  | RtlEqualPrefixSid | 
|  | RtlEqualSid | 
|  | RtlEqualString | 
|  | RtlEqualUnicodeString | 
|  | RtlEqualWnfChangeStamps | 
|  | RtlEraseUnicodeString | 
|  | RtlEthernetAddressToStringA | 
|  | RtlEthernetAddressToStringW | 
|  | RtlEthernetStringToAddressA | 
|  | RtlEthernetStringToAddressW | 
|  | RtlExitUserProcess | 
|  | RtlExitUserThread | 
|  | RtlExpandEnvironmentStrings | 
|  | RtlExpandEnvironmentStrings_U | 
|  | RtlExpandHashTable | 
|  | RtlExtendMemoryBlockLookaside | 
|  | RtlExtendMemoryZone | 
|  | RtlExtendedMagicDivide | 
|  | RtlExtractBitMap | 
|  | RtlFillMemory | 
|  | RtlFillMemoryUlong | 
|  | RtlFillMemoryUlonglong | 
|  | RtlFinalReleaseOutOfProcessMemoryStream | 
|  | RtlFindAceByType | 
|  | RtlFindActivationContextSectionGuid | 
|  | RtlFindActivationContextSectionString | 
|  | RtlFindCharInUnicodeString | 
|  | RtlFindClearBits | 
|  | RtlFindClearBitsAndSet | 
|  | RtlFindClearRuns | 
|  | RtlFindClosestEncodableLength | 
|  | RtlFindLastBackwardRunClear | 
|  | RtlFindLeastSignificantBit | 
|  | RtlFindLongestRunClear | 
|  | RtlFindMessage | 
|  | RtlFindMostSignificantBit | 
|  | RtlFindNextForwardRunClear | 
|  | RtlFindSetBits | 
|  | RtlFindSetBitsAndClear | 
|  | RtlFirstEntrySList | 
|  | RtlFirstFreeAce | 
|  | RtlFlsAlloc | 
|  | RtlFlsFree | 
|  | RtlFlushHeaps | 
|  | RtlFlushSecureMemoryCache | 
|  | RtlFormatCurrentUserKeyPath | 
|  | RtlFormatMessage | 
|  | RtlFormatMessageEx | 
|  | RtlFreeActivationContextStack | 
|  | RtlFreeAnsiString | 
|  | RtlFreeHandle | 
|  | RtlFreeHeap | 
|  | RtlFreeMemoryBlockLookaside | 
|  | RtlFreeOemString | 
|  | RtlFreeSid | 
|  | RtlFreeThreadActivationContextStack | 
|  | RtlFreeUnicodeString | 
|  | RtlFreeUserStack | 
|  | RtlGUIDFromString | 
|  | RtlGenerate8dot3Name | 
|  | RtlGetAce | 
|  | RtlGetActiveActivationContext | 
|  | RtlGetAppContainerNamedObjectPath | 
|  | RtlGetAppContainerParent | 
|  | RtlGetAppContainerSidType | 
|  | RtlGetCallersAddress | 
|  | RtlGetCompressionWorkSpaceSize | 
|  | RtlGetControlSecurityDescriptor | 
|  | RtlGetCriticalSectionRecursionCount | 
|  | RtlGetCurrentDirectory_U | 
|  | RtlGetCurrentPeb | 
|  | RtlGetCurrentProcessorNumber | 
|  | RtlGetCurrentProcessorNumberEx | 
|  | RtlGetCurrentTransaction | 
|  | RtlGetDaclSecurityDescriptor | 
|  | RtlGetElementGenericTable | 
|  | RtlGetElementGenericTableAvl | 
|  | RtlGetEnabledExtendedFeatures | 
|  | RtlGetExePath | 
|  | RtlGetExtendedContextLength | 
|  | RtlGetExtendedFeaturesMask | 
|  | RtlGetFileMUIPath | 
|  | RtlGetFrame | 
|  | RtlGetFullPathName_U | 
|  | RtlGetFullPathName_UEx | 
|  | RtlGetFullPathName_UstrEx | 
|  | RtlGetFunctionTableListHead | 
|  | RtlGetGroupSecurityDescriptor | 
|  | RtlGetIntegerAtom | 
|  | RtlGetLastNtStatus | 
|  | RtlGetLastWin32Error | 
|  | RtlGetLengthWithoutLastFullDosOrNtPathElement | 
|  | RtlGetLengthWithoutTrailingPathSeperators | 
|  | RtlGetLocaleFileMappingAddress | 
|  | RtlGetLongestNtPathLength | 
|  | RtlGetNativeSystemInformation | 
|  | RtlGetNextEntryHashTable | 
|  | RtlGetNtGlobalFlags | 
|  | RtlGetNtProductType | 
|  | RtlGetNtVersionNumbers | 
|  | RtlGetOwnerSecurityDescriptor | 
|  | RtlGetParentLocaleName | 
|  | RtlGetProcessHeaps | 
|  | RtlGetProcessPreferredUILanguages | 
|  | RtlGetProductInfo | 
|  | RtlGetSaclSecurityDescriptor | 
|  | RtlGetSearchPath | 
|  | RtlGetSecurityDescriptorRMControl | 
|  | RtlGetSetBootStatusData | 
|  | RtlGetSystemPreferredUILanguages | 
|  | RtlGetSystemTimePrecise | 
|  | RtlGetThreadErrorMode | 
|  | RtlGetThreadLangIdByIndex | 
|  | RtlGetThreadPreferredUILanguages | 
|  | RtlGetUILanguageInfo | 
|  | RtlGetUnloadEventTrace | 
|  | RtlGetUnloadEventTraceEx | 
|  | RtlGetUserInfoHeap | 
|  | RtlGetUserPreferredUILanguages | 
|  | RtlGetVersion | 
|  | RtlGrowFunctionTable | 
|  | RtlHashUnicodeString | 
|  | RtlHeapTrkInitialize | 
|  | RtlIdentifierAuthoritySid | 
|  | RtlIdnToAscii | 
|  | RtlIdnToNameprepUnicode | 
|  | RtlIdnToUnicode | 
|  | RtlImageDirectoryEntryToData | 
|  | RtlImageNtHeader | 
|  | RtlImageNtHeaderEx | 
|  | RtlImageRvaToSection | 
|  | RtlImageRvaToVa | 
|  | RtlImpersonateSelf | 
|  | RtlImpersonateSelfEx | 
|  | RtlInitAnsiString | 
|  | RtlInitAnsiStringEx | 
|  | RtlInitBarrier | 
|  | RtlInitCodePageTable | 
|  | RtlInitEnumerationHashTable | 
|  | RtlInitMemoryStream | 
|  | RtlInitNlsTables | 
|  | RtlInitOutOfProcessMemoryStream | 
|  | RtlInitString | 
|  | RtlInitUnicodeString | 
|  | RtlInitUnicodeStringEx | 
|  | RtlInitWeakEnumerationHashTable | 
|  | RtlInitializeAtomPackage | 
|  | RtlInitializeBitMap | 
|  | RtlInitializeConditionVariable | 
|  | RtlInitializeContext | 
|  | RtlInitializeCriticalSection | 
|  | RtlInitializeCriticalSectionAndSpinCount | 
|  | RtlInitializeCriticalSectionEx | 
|  | RtlInitializeExtendedContext | 
|  | RtlInitializeGenericTable | 
|  | RtlInitializeGenericTableAvl | 
|  | RtlInitializeHandleTable | 
|  | RtlInitializeNtUserPfn | 
|  | RtlInitializeRXact | 
|  | RtlInitializeResource | 
|  | RtlInitializeSListHead | 
|  | RtlInitializeSRWLock | 
|  | RtlInitializeSid | 
|  | RtlInsertElementGenericTable | 
|  | RtlInsertElementGenericTableAvl | 
|  | RtlInsertElementGenericTableFull | 
|  | RtlInsertElementGenericTableFullAvl | 
|  | RtlInsertEntryHashTable | 
|  | RtlInstallFunctionTableCallback | 
|  | RtlInt64ToUnicodeString | 
|  | RtlIntegerToChar | 
|  | RtlIntegerToUnicodeString | 
|  | RtlInterlockedClearBitRun | 
|  | RtlInterlockedFlushSList | 
|  | RtlInterlockedPopEntrySList | 
|  | RtlInterlockedPushEntrySList | 
|  | RtlInterlockedPushListSList | 
|  | RtlInterlockedPushListSListEx | 
|  | RtlInterlockedSetBitRun | 
|  | RtlIoDecodeMemIoResource | 
|  | RtlIoEncodeMemIoResource | 
|  | RtlIpv4AddressToStringA | 
|  | RtlIpv4AddressToStringExA | 
|  | RtlIpv4AddressToStringExW | 
|  | RtlIpv4AddressToStringW | 
|  | RtlIpv4StringToAddressA | 
|  | RtlIpv4StringToAddressExA | 
|  | RtlIpv4StringToAddressExW | 
|  | RtlIpv4StringToAddressW | 
|  | RtlIpv6AddressToStringA | 
|  | RtlIpv6AddressToStringExA | 
|  | RtlIpv6AddressToStringExW | 
|  | RtlIpv6AddressToStringW | 
|  | RtlIpv6StringToAddressA | 
|  | RtlIpv6StringToAddressExA | 
|  | RtlIpv6StringToAddressExW | 
|  | RtlIpv6StringToAddressW | 
|  | RtlIsActivationContextActive | 
|  | RtlIsCapabilitySid | 
|  | RtlIsCriticalSectionLocked | 
|  | RtlIsCriticalSectionLockedByThread | 
|  | RtlIsCurrentThreadAttachExempt | 
|  | RtlIsDosDeviceName_U | 
|  | RtlIsGenericTableEmpty | 
|  | RtlIsGenericTableEmptyAvl | 
|  | RtlIsNameInExpression | 
|  | RtlIsNameLegalDOS8Dot3 | 
|  | RtlIsNormalizedString | 
|  | RtlIsPackageSid | 
|  | RtlIsParentOfChildAppContainer | 
|  | RtlIsTextUnicode | 
|  | RtlIsThreadWithinLoaderCallout | 
|  | RtlIsUntrustedObject | 
|  | RtlIsValidHandle | 
|  | RtlIsValidIndexHandle | 
|  | RtlIsValidLocaleName | 
|  | RtlIsValidProcessTrustLabelSid | 
|  | RtlKnownExceptionFilter | 
|  | RtlLCIDToCultureName | 
|  | RtlLargeIntegerToChar | 
|  | RtlLcidToLocaleName | 
|  | RtlLeaveCriticalSection | 
|  | RtlLengthRequiredSid | 
|  | RtlLengthSecurityDescriptor | 
|  | RtlLengthSid | 
|  | RtlLengthSidAsUnicodeString | 
|  | RtlLoadString | 
|  | RtlLocalTimeToSystemTime | 
|  | RtlLocaleNameToLcid | 
|  | RtlLocateExtendedFeature | 
|  | RtlLocateLegacyContext | 
|  | RtlLockBootStatusData | 
|  | RtlLockCurrentThread | 
|  | RtlLockHeap | 
|  | RtlLockMemoryBlockLookaside | 
|  | RtlLockMemoryStreamRegion | 
|  | RtlLockMemoryZone | 
|  | RtlLockModuleSection | 
|  | RtlLogStackBackTrace | 
|  | RtlLookupAtomInAtomTable | 
|  | RtlLookupElementGenericTable | 
|  | RtlLookupElementGenericTableAvl | 
|  | RtlLookupElementGenericTableFull | 
|  | RtlLookupElementGenericTableFullAvl | 
|  | RtlLookupEntryHashTable | 
|  | RtlLookupFunctionEntry | 
|  | RtlLookupFunctionTable | 
|  | RtlMakeSelfRelativeSD | 
|  | RtlMapGenericMask | 
|  | RtlMapSecurityErrorToNtStatus | 
|  | RtlMoveMemory | 
|  | RtlMultiAppendUnicodeStringBuffer | 
|  | RtlMultiByteToUnicodeN | 
|  | RtlMultiByteToUnicodeSize | 
|  | RtlMultipleAllocateHeap | 
|  | RtlMultipleFreeHeap | 
|  | RtlNewInstanceSecurityObject | 
|  | RtlNewSecurityGrantedAccess | 
|  | RtlNewSecurityObject | 
|  | RtlNewSecurityObjectEx | 
|  | RtlNewSecurityObjectWithMultipleInheritance | 
|  | RtlNormalizeProcessParams | 
|  | RtlNormalizeString | 
|  | RtlNtPathNameToDosPathName | 
|  | RtlNtStatusToDosError | 
|  | RtlNtStatusToDosErrorNoTeb | 
|  | RtlNumberGenericTableElements | 
|  | RtlNumberGenericTableElementsAvl | 
|  | RtlNumberOfClearBits | 
|  | RtlNumberOfClearBitsInRange | 
|  | RtlNumberOfSetBits | 
|  | RtlNumberOfSetBitsInRange | 
|  | RtlNumberOfSetBitsUlongPtr | 
|  | RtlOemStringToUnicodeSize | 
|  | RtlOemStringToUnicodeString | 
|  | RtlOemToUnicodeN | 
|  | RtlOpenCurrentUser | 
|  | RtlOwnerAcesPresent | 
|  | RtlPcToFileHeader | 
|  | RtlPinAtomInAtomTable | 
|  | RtlPopFrame | 
|  | RtlPrefixString | 
|  | RtlPrefixUnicodeString | 
|  | RtlProcessFlsData | 
|  | RtlProtectHeap | 
|  | RtlPublishWnfStateData | 
|  | RtlPushFrame | 
|  | RtlQueryActivationContextApplicationSettings | 
|  | RtlQueryAtomInAtomTable | 
|  | RtlQueryCriticalSectionOwner | 
|  | RtlQueryDepthSList | 
|  | RtlQueryDynamicTimeZoneInformation | 
|  | RtlQueryElevationFlags | 
|  | RtlQueryEnvironmentVariable | 
|  | RtlQueryEnvironmentVariable_U | 
|  | RtlQueryHeapInformation | 
|  | RtlQueryInformationAcl | 
|  | RtlQueryInformationActivationContext | 
|  | RtlQueryInformationActiveActivationContext | 
|  | RtlQueryInterfaceMemoryStream | 
|  | RtlQueryModuleInformation | 
|  | RtlQueryPackageIdentity | 
|  | RtlQueryPackageIdentityEx | 
|  | RtlQueryPerformanceCounter | 
|  | RtlQueryPerformanceFrequency | 
|  | RtlQueryProcessBackTraceInformation | 
|  | RtlQueryProcessDebugInformation | 
|  | RtlQueryProcessHeapInformation | 
|  | RtlQueryProcessLockInformation | 
|  | RtlQueryRegistryValues | 
|  | RtlQueryRegistryValuesEx | 
|  | RtlQueryResourcePolicy | 
|  | RtlQuerySecurityObject | 
|  | RtlQueryTagHeap | 
|  | RtlQueryThreadProfiling | 
|  | RtlQueryTimeZoneInformation | 
|  | RtlQueryUnbiasedInterruptTime | 
|  | RtlQueryValidationRunlevel | 
|  | RtlQueryWnfMetaNotification | 
|  | RtlQueryWnfStateData | 
|  | RtlQueryWnfStateDataWithExplicitScope | 
|  | RtlQueueApcWow64Thread | 
|  | RtlQueueWorkItem | 
|  | RtlRaiseException | 
|  | RtlRaiseStatus | 
|  | RtlRandom | 
|  | RtlRandomEx | 
|  | RtlRbInsertNodeEx | 
|  | RtlRbRemoveNode | 
|  | RtlReAllocateHeap | 
|  | RtlReadMemoryStream | 
|  | RtlReadOutOfProcessMemoryStream | 
|  | RtlReadThreadProfilingData | 
|  | RtlRealPredecessor | 
|  | RtlRealSuccessor | 
|  | RtlRegisterForWnfMetaNotification | 
|  | RtlRegisterSecureMemoryCacheCallback | 
|  | RtlRegisterThreadWithCsrss | 
|  | RtlRegisterWait | 
|  | RtlReleaseActivationContext | 
|  | RtlReleaseMemoryStream | 
|  | RtlReleasePath | 
|  | RtlReleasePebLock | 
|  | RtlReleasePrivilege | 
|  | RtlReleaseRelativeName | 
|  | RtlReleaseResource | 
|  | RtlReleaseSRWLockExclusive | 
|  | RtlReleaseSRWLockShared | 
|  | RtlRemoteCall | 
|  | RtlRemoveEntryHashTable | 
|  | RtlRemovePrivileges | 
|  | RtlRemoveVectoredContinueHandler | 
|  | RtlRemoveVectoredExceptionHandler | 
|  | RtlReplaceSidInSd | 
|  | RtlReportException | 
|  | RtlReportSilentProcessExit | 
|  | RtlReportSqmEscalation | 
|  | RtlResetMemoryBlockLookaside | 
|  | RtlResetMemoryZone | 
|  | RtlResetNtUserPfn | 
|  | RtlResetRtlTranslations | 
|  | RtlRestoreContext | 
|  | RtlRestoreLastWin32Error | 
|  | RtlRetrieveNtUserPfn | 
|  | RtlRevertMemoryStream | 
|  | RtlRunDecodeUnicodeString | 
|  | RtlRunEncodeUnicodeString | 
|  | RtlRunOnceBeginInitialize | 
|  | RtlRunOnceComplete | 
|  | RtlRunOnceExecuteOnce | 
|  | RtlRunOnceInitialize | 
|  | RtlSecondsSince1970ToTime | 
|  | RtlSecondsSince1980ToTime | 
|  | RtlSeekMemoryStream | 
|  | RtlSelfRelativeToAbsoluteSD | 
|  | RtlSelfRelativeToAbsoluteSD2 | 
|  | RtlSendMsgToSm | 
|  | RtlSetAllBits | 
|  | RtlSetAttributesSecurityDescriptor | 
|  | RtlSetBit | 
|  | RtlSetBits | 
|  | RtlSetControlSecurityDescriptor | 
|  | RtlSetCriticalSectionSpinCount | 
|  | RtlSetCurrentDirectory_U | 
|  | RtlSetCurrentEnvironment | 
|  | RtlSetCurrentTransaction | 
|  | RtlSetDaclSecurityDescriptor | 
|  | RtlSetDynamicTimeZoneInformation | 
|  | RtlSetEnvironmentStrings | 
|  | RtlSetEnvironmentVar | 
|  | RtlSetEnvironmentVariable | 
|  | RtlSetExtendedFeaturesMask | 
|  | RtlSetGroupSecurityDescriptor | 
|  | RtlSetHeapInformation | 
|  | RtlSetInformationAcl | 
|  | RtlSetIoCompletionCallback | 
|  | RtlSetLastWin32Error | 
|  | RtlSetLastWin32ErrorAndNtStatusFromNtStatus | 
|  | RtlSetMemoryStreamSize | 
|  | RtlSetOwnerSecurityDescriptor | 
|  | RtlSetPortableOperatingSystem | 
|  | RtlSetProcessDebugInformation | 
|  | RtlSetProcessIsCritical | 
|  | RtlSetProcessPreferredUILanguages | 
|  | RtlSetSaclSecurityDescriptor | 
|  | RtlSetSearchPathMode | 
|  | RtlSetSecurityDescriptorRMControl | 
|  | RtlSetSecurityObject | 
|  | RtlSetSecurityObjectEx | 
|  | RtlSetThreadErrorMode | 
|  | RtlSetThreadIsCritical | 
|  | RtlSetThreadPoolStartFunc | 
|  | RtlSetThreadPreferredUILanguages | 
|  | RtlSetTimeZoneInformation | 
|  | RtlSetTimer | 
|  | RtlSetUnhandledExceptionFilter | 
|  | RtlSetUserFlagsHeap | 
|  | RtlSetUserValueHeap | 
|  | RtlSidDominates | 
|  | RtlSidDominatesForTrust | 
|  | RtlSidEqualLevel | 
|  | RtlSidHashInitialize | 
|  | RtlSidHashLookup | 
|  | RtlSidIsHigherLevel | 
|  | RtlSizeHeap | 
|  | RtlSleepConditionVariableCS | 
|  | RtlSleepConditionVariableSRW | 
|  | RtlSplay | 
|  | RtlStartRXact | 
|  | RtlStatMemoryStream | 
|  | RtlStringFromGUID | 
|  | RtlStringFromGUIDEx | 
|  | RtlSubAuthorityCountSid | 
|  | RtlSubAuthoritySid | 
|  | RtlSubscribeWnfStateChangeNotification | 
|  | RtlSubtreePredecessor | 
|  | RtlSubtreeSuccessor | 
|  | RtlSystemTimeToLocalTime | 
|  | RtlTestAndPublishWnfStateData | 
|  | RtlTestBit | 
|  | RtlTestProtectedAccess | 
|  | RtlTimeFieldsToTime | 
|  | RtlTimeToElapsedTimeFields | 
|  | RtlTimeToSecondsSince1970 | 
|  | RtlTimeToSecondsSince1980 | 
|  | RtlTimeToTimeFields | 
|  | RtlTraceDatabaseAdd | 
|  | RtlTraceDatabaseCreate | 
|  | RtlTraceDatabaseDestroy | 
|  | RtlTraceDatabaseEnumerate | 
|  | RtlTraceDatabaseFind | 
|  | RtlTraceDatabaseLock | 
|  | RtlTraceDatabaseUnlock | 
|  | RtlTraceDatabaseValidate | 
|  | RtlTryAcquirePebLock | 
|  | RtlTryAcquireSRWLockExclusive | 
|  | RtlTryAcquireSRWLockShared | 
|  | RtlTryConvertSRWLockSharedToExclusiveOrRelease | 
|  | RtlTryEnterCriticalSection | 
|  | RtlUTF8ToUnicodeN | 
|  | RtlUlongByteSwap | 
|  | RtlUlonglongByteSwap | 
|  | RtlUnhandledExceptionFilter | 
|  | RtlUnhandledExceptionFilter2 | 
|  | RtlUnicodeStringToAnsiSize | 
|  | RtlUnicodeStringToAnsiString | 
|  | RtlUnicodeStringToCountedOemString | 
|  | RtlUnicodeStringToInteger | 
|  | RtlUnicodeStringToOemSize | 
|  | RtlUnicodeStringToOemString | 
|  | RtlUnicodeToCustomCPN | 
|  | RtlUnicodeToMultiByteN | 
|  | RtlUnicodeToMultiByteSize | 
|  | RtlUnicodeToOemN | 
|  | RtlUnicodeToUTF8N | 
|  | RtlUniform | 
|  | RtlUnlockBootStatusData | 
|  | RtlUnlockCurrentThread | 
|  | RtlUnlockHeap | 
|  | RtlUnlockMemoryBlockLookaside | 
|  | RtlUnlockMemoryStreamRegion | 
|  | RtlUnlockMemoryZone | 
|  | RtlUnlockModuleSection | 
|  | RtlUnsubscribeWnfNotificationWaitForCompletion | 
|  | RtlUnsubscribeWnfNotificationWithCompletionCallback | 
|  | RtlUnsubscribeWnfStateChangeNotification | 
|  | RtlUnwind | 
|  | RtlUnwindEx | 
|  | RtlUpcaseUnicodeChar | 
|  | RtlUpcaseUnicodeString | 
|  | RtlUpcaseUnicodeStringToAnsiString | 
|  | RtlUpcaseUnicodeStringToCountedOemString | 
|  | RtlUpcaseUnicodeStringToOemString | 
|  | RtlUpcaseUnicodeToCustomCPN | 
|  | RtlUpcaseUnicodeToMultiByteN | 
|  | RtlUpcaseUnicodeToOemN | 
|  | RtlUpdateClonedCriticalSection | 
|  | RtlUpdateClonedSRWLock | 
|  | RtlUpdateTimer | 
|  | RtlUpperChar | 
|  | RtlUpperString | 
|  | RtlUserThreadStart | 
|  | RtlUshortByteSwap | 
|  | RtlValidAcl | 
|  | RtlValidProcessProtection | 
|  | RtlValidRelativeSecurityDescriptor | 
|  | RtlValidSecurityDescriptor | 
|  | RtlValidSid | 
|  | RtlValidateHeap | 
|  | RtlValidateProcessHeaps | 
|  | RtlValidateUnicodeString | 
|  | RtlVerifyVersionInfo | 
|  | RtlVirtualUnwind | 
|  | RtlWaitForWnfMetaNotification | 
|  | RtlWaitOnAddress | 
|  | RtlWakeAddressAll | 
|  | RtlWakeAddressAllNoFence | 
|  | RtlWakeAddressSingle | 
|  | RtlWakeAddressSingleNoFence | 
|  | RtlWakeAllConditionVariable | 
|  | RtlWakeConditionVariable | 
|  | RtlWalkFrameChain | 
|  | RtlWalkHeap | 
|  | RtlWeaklyEnumerateEntryHashTable | 
|  | RtlWerpReportException | 
|  | RtlWnfCompareChangeStamp | 
|  | RtlWnfDllUnloadCallback | 
|  | RtlWow64CallFunction64 | 
|  | RtlWow64EnableFsRedirection | 
|  | RtlWow64EnableFsRedirectionEx | 
|  | RtlWriteMemoryStream | 
|  | RtlWriteRegistryValue | 
|  | RtlZeroHeap | 
|  | RtlZeroMemory | 
|  | RtlZombifyActivationContext | 
|  | RtlpApplyLengthFunction | 
|  | RtlpCheckDynamicTimeZoneInformation | 
|  | RtlpCleanupRegistryKeys | 
|  | RtlpConvertAbsoluteToRelativeSecurityAttribute | 
|  | RtlpConvertCultureNamesToLCIDs | 
|  | RtlpConvertLCIDsToCultureNames | 
|  | RtlpConvertRelativeToAbsoluteSecurityAttribute | 
|  | RtlpCreateProcessRegistryInfo | 
|  | RtlpEnsureBufferSize | 
|  | RtlpFreezeTimeBias DATA | 
|  | RtlpGetLCIDFromLangInfoNode | 
|  | RtlpGetNameFromLangInfoNode | 
|  | RtlpGetSystemDefaultUILanguage | 
|  | RtlpGetUserOrMachineUILanguage4NLS | 
|  | RtlpInitializeLangRegistryInfo | 
|  | RtlpIsQualifiedLanguage | 
|  | RtlpLoadMachineUIByPolicy | 
|  | RtlpLoadUserUIByPolicy | 
|  | RtlpMergeSecurityAttributeInformation | 
|  | RtlpMuiFreeLangRegistryInfo | 
|  | RtlpMuiRegCreateRegistryInfo | 
|  | RtlpMuiRegFreeRegistryInfo | 
|  | RtlpMuiRegLoadRegistryInfo | 
|  | RtlpNotOwnerCriticalSection | 
|  | RtlpNtCreateKey | 
|  | RtlpNtEnumerateSubKey | 
|  | RtlpNtMakeTemporaryKey | 
|  | RtlpNtOpenKey | 
|  | RtlpNtQueryValueKey | 
|  | RtlpNtSetValueKey | 
|  | RtlpQueryDefaultUILanguage | 
|  | RtlpRefreshCachedUILanguage | 
|  | RtlpSetInstallLanguage | 
|  | RtlpSetPreferredUILanguages | 
|  | RtlpSetUserPreferredUILanguages | 
|  | RtlpUnWaitCriticalSection | 
|  | RtlpVerifyAndCommitUILanguageSettings | 
|  | RtlpWaitForCriticalSection | 
|  | RtlxAnsiStringToUnicodeSize | 
|  | RtlxOemStringToUnicodeSize | 
|  | RtlxUnicodeStringToAnsiSize | 
|  | RtlxUnicodeStringToOemSize | 
|  | SbExecuteProcedure | 
|  | SbSelectProcedure | 
|  | ShipAssert | 
|  | ShipAssertGetBufferInfo | 
|  | ShipAssertMsgA | 
|  | ShipAssertMsgW | 
|  | TpAllocAlpcCompletion | 
|  | TpAllocAlpcCompletionEx | 
|  | TpAllocCleanupGroup | 
|  | TpAllocIoCompletion | 
|  | TpAllocJobNotification | 
|  | TpAllocPool | 
|  | TpAllocTimer | 
|  | TpAllocWait | 
|  | TpAllocWork | 
|  | TpAlpcRegisterCompletionList | 
|  | TpAlpcUnregisterCompletionList | 
|  | TpCallbackDetectedUnrecoverableError | 
|  | TpCallbackIndependent | 
|  | TpCallbackLeaveCriticalSectionOnCompletion | 
|  | TpCallbackMayRunLong | 
|  | TpCallbackReleaseMutexOnCompletion | 
|  | TpCallbackReleaseSemaphoreOnCompletion | 
|  | TpCallbackSendAlpcMessageOnCompletion | 
|  | TpCallbackSendPendingAlpcMessage | 
|  | TpCallbackSetEventOnCompletion | 
|  | TpCallbackUnloadDllOnCompletion | 
|  | TpCancelAsyncIoOperation | 
|  | TpCaptureCaller | 
|  | TpCheckTerminateWorker | 
|  | TpDbgDumpHeapUsage | 
|  | TpDbgSetLogRoutine | 
|  | TpDisablePoolCallbackChecks | 
|  | TpDisassociateCallback | 
|  | TpIsTimerSet | 
|  | TpPostWork | 
|  | TpQueryPoolStackInformation | 
|  | TpReleaseAlpcCompletion | 
|  | TpReleaseCleanupGroup | 
|  | TpReleaseCleanupGroupMembers | 
|  | TpReleaseIoCompletion | 
|  | TpReleaseJobNotification | 
|  | TpReleasePool | 
|  | TpReleaseTimer | 
|  | TpReleaseWait | 
|  | TpReleaseWork | 
|  | TpSetDefaultPoolMaxThreads | 
|  | TpSetDefaultPoolStackInformation | 
|  | TpSetPoolMaxThreads | 
|  | TpSetPoolMinThreads | 
|  | TpSetPoolStackInformation | 
|  | TpSetPoolThreadBasePriority | 
|  | TpSetTimer | 
|  | TpSetTimerEx | 
|  | TpSetWait | 
|  | TpSetWaitEx | 
|  | TpSimpleTryPost | 
|  | TpStartAsyncIoOperation | 
|  | TpTimerOutstandingCallbackCount | 
|  | TpTrimPools | 
|  | TpWaitForAlpcCompletion | 
|  | TpWaitForIoCompletion | 
|  | TpWaitForJobNotification | 
|  | TpWaitForTimer | 
|  | TpWaitForWait | 
|  | TpWaitForWork | 
|  | VerSetConditionMask | 
|  | WerReportSQMEvent | 
|  | WinSqmAddToAverageDWORD | 
|  | WinSqmAddToStream | 
|  | WinSqmAddToStreamEx | 
|  | WinSqmCheckEscalationAddToStreamEx | 
|  | WinSqmCheckEscalationSetDWORD | 
|  | WinSqmCheckEscalationSetDWORD64 | 
|  | WinSqmCheckEscalationSetString | 
|  | WinSqmCommonDatapointDelete | 
|  | WinSqmCommonDatapointSetDWORD | 
|  | WinSqmCommonDatapointSetDWORD64 | 
|  | WinSqmCommonDatapointSetStreamEx | 
|  | WinSqmCommonDatapointSetString | 
|  | WinSqmEndSession | 
|  | WinSqmEventEnabled | 
|  | WinSqmEventWrite | 
|  | WinSqmGetEscalationRuleStatus | 
|  | WinSqmGetInstrumentationProperty | 
|  | WinSqmIncrementDWORD | 
|  | WinSqmIsOptedIn | 
|  | WinSqmIsOptedInEx | 
|  | WinSqmIsSessionDisabled | 
|  | WinSqmSetDWORD | 
|  | WinSqmSetDWORD64 | 
|  | WinSqmSetEscalationInfo | 
|  | WinSqmSetIfMaxDWORD | 
|  | WinSqmSetIfMinDWORD | 
|  | WinSqmSetString | 
|  | WinSqmStartSession | 
|  | WinSqmStartSessionForPartner | 
|  | ZwAcceptConnectPort | 
|  | ZwAccessCheck | 
|  | ZwAccessCheckAndAuditAlarm | 
|  | ZwAccessCheckByType | 
|  | ZwAccessCheckByTypeAndAuditAlarm | 
|  | ZwAccessCheckByTypeResultList | 
|  | ZwAccessCheckByTypeResultListAndAuditAlarm | 
|  | ZwAccessCheckByTypeResultListAndAuditAlarmByHandle | 
|  | ZwAddAtom | 
|  | ZwAddAtomEx | 
|  | ZwAddBootEntry | 
|  | ZwAddDriverEntry | 
|  | ZwAdjustGroupsToken | 
|  | ZwAdjustPrivilegesToken | 
|  | ZwAdjustTokenClaimsAndDeviceGroups | 
|  | ZwAlertResumeThread | 
|  | ZwAlertThread | 
|  | ZwAlertThreadByThreadId | 
|  | ZwAllocateLocallyUniqueId | 
|  | ZwAllocateReserveObject | 
|  | ZwAllocateUserPhysicalPages | 
|  | ZwAllocateUuids | 
|  | ZwAllocateVirtualMemory | 
|  | ZwAlpcAcceptConnectPort | 
|  | ZwAlpcCancelMessage | 
|  | ZwAlpcConnectPort | 
|  | ZwAlpcConnectPortEx | 
|  | ZwAlpcCreatePort | 
|  | ZwAlpcCreatePortSection | 
|  | ZwAlpcCreateResourceReserve | 
|  | ZwAlpcCreateSectionView | 
|  | ZwAlpcCreateSecurityContext | 
|  | ZwAlpcDeletePortSection | 
|  | ZwAlpcDeleteResourceReserve | 
|  | ZwAlpcDeleteSectionView | 
|  | ZwAlpcDeleteSecurityContext | 
|  | ZwAlpcDisconnectPort | 
|  | ZwAlpcImpersonateClientOfPort | 
|  | ZwAlpcOpenSenderProcess | 
|  | ZwAlpcOpenSenderThread | 
|  | ZwAlpcQueryInformation | 
|  | ZwAlpcQueryInformationMessage | 
|  | ZwAlpcRevokeSecurityContext | 
|  | ZwAlpcSendWaitReceivePort | 
|  | ZwAlpcSetInformation | 
|  | ZwApphelpCacheControl | 
|  | ZwAreMappedFilesTheSame | 
|  | ZwAssignProcessToJobObject | 
|  | ZwAssociateWaitCompletionPacket | 
|  | ZwCallbackReturn | 
|  | ZwCancelIoFile | 
|  | ZwCancelIoFileEx | 
|  | ZwCancelSynchronousIoFile | 
|  | ZwCancelTimer | 
|  | ZwCancelTimer2 | 
|  | ZwCancelWaitCompletionPacket | 
|  | ZwClearEvent | 
|  | ZwClose | 
|  | ZwCloseObjectAuditAlarm | 
|  | ZwCommitComplete | 
|  | ZwCommitEnlistment | 
|  | ZwCommitTransaction | 
|  | ZwCompactKeys | 
|  | ZwCompareTokens | 
|  | ZwCompleteConnectPort | 
|  | ZwCompressKey | 
|  | ZwConnectPort | 
|  | ZwContinue | 
|  | ZwCreateDebugObject | 
|  | ZwCreateDirectoryObject | 
|  | ZwCreateDirectoryObjectEx | 
|  | ZwCreateEnlistment | 
|  | ZwCreateEvent | 
|  | ZwCreateEventPair | 
|  | ZwCreateFile | 
|  | ZwCreateIRTimer | 
|  | ZwCreateIoCompletion | 
|  | ZwCreateJobObject | 
|  | ZwCreateJobSet | 
|  | ZwCreateKey | 
|  | ZwCreateKeyTransacted | 
|  | ZwCreateKeyedEvent | 
|  | ZwCreateLowBoxToken | 
|  | ZwCreateMailslotFile | 
|  | ZwCreateMutant | 
|  | ZwCreateNamedPipeFile | 
|  | ZwCreatePagingFile | 
|  | ZwCreatePort | 
|  | ZwCreatePrivateNamespace | 
|  | ZwCreateProcess | 
|  | ZwCreateProcessEx | 
|  | ZwCreateProfile | 
|  | ZwCreateProfileEx | 
|  | ZwCreateResourceManager | 
|  | ZwCreateSection | 
|  | ZwCreateSemaphore | 
|  | ZwCreateSymbolicLinkObject | 
|  | ZwCreateThread | 
|  | ZwCreateThreadEx | 
|  | ZwCreateTimer | 
|  | ZwCreateTimer2 | 
|  | ZwCreateToken | 
|  | ZwCreateTokenEx | 
|  | ZwCreateTransaction | 
|  | ZwCreateTransactionManager | 
|  | ZwCreateUserProcess | 
|  | ZwCreateWaitCompletionPacket | 
|  | ZwCreateWaitablePort | 
|  | ZwCreateWnfStateName | 
|  | ZwCreateWorkerFactory | 
|  | ZwDebugActiveProcess | 
|  | ZwDebugContinue | 
|  | ZwDelayExecution | 
|  | ZwDeleteAtom | 
|  | ZwDeleteBootEntry | 
|  | ZwDeleteDriverEntry | 
|  | ZwDeleteFile | 
|  | ZwDeleteKey | 
|  | ZwDeleteObjectAuditAlarm | 
|  | ZwDeletePrivateNamespace | 
|  | ZwDeleteValueKey | 
|  | ZwDeleteWnfStateData | 
|  | ZwDeleteWnfStateName | 
|  | ZwDeviceIoControlFile | 
|  | ZwDisableLastKnownGood | 
|  | ZwDisplayString | 
|  | ZwDrawText | 
|  | ZwDuplicateObject | 
|  | ZwDuplicateToken | 
|  | ZwEnableLastKnownGood | 
|  | ZwEnumerateBootEntries | 
|  | ZwEnumerateDriverEntries | 
|  | ZwEnumerateKey | 
|  | ZwEnumerateSystemEnvironmentValuesEx | 
|  | ZwEnumerateTransactionObject | 
|  | ZwEnumerateValueKey | 
|  | ZwExtendSection | 
|  | ZwFilterBootOption | 
|  | ZwFilterToken | 
|  | ZwFilterTokenEx | 
|  | ZwFindAtom | 
|  | ZwFlushBuffersFile | 
|  | ZwFlushBuffersFileEx | 
|  | ZwFlushInstallUILanguage | 
|  | ZwFlushInstructionCache | 
|  | ZwFlushKey | 
|  | ZwFlushProcessWriteBuffers | 
|  | ZwFlushVirtualMemory | 
|  | ZwFlushWriteBuffer | 
|  | ZwFreeUserPhysicalPages | 
|  | ZwFreeVirtualMemory | 
|  | ZwFreezeRegistry | 
|  | ZwFreezeTransactions | 
|  | ZwFsControlFile | 
|  | ZwGetCachedSigningLevel | 
|  | ZwGetCompleteWnfStateSubscription | 
|  | ZwGetContextThread | 
|  | ZwGetCurrentProcessorNumber | 
|  | ZwGetDevicePowerState | 
|  | ZwGetMUIRegistryInfo | 
|  | ZwGetNextProcess | 
|  | ZwGetNextThread | 
|  | ZwGetNlsSectionPtr | 
|  | ZwGetNotificationResourceManager | 
|  | ZwGetWriteWatch | 
|  | ZwImpersonateAnonymousToken | 
|  | ZwImpersonateClientOfPort | 
|  | ZwImpersonateThread | 
|  | ZwInitializeNlsFiles | 
|  | ZwInitializeRegistry | 
|  | ZwInitiatePowerAction | 
|  | ZwIsProcessInJob | 
|  | ZwIsSystemResumeAutomatic | 
|  | ZwIsUILanguageComitted | 
|  | ZwListenPort | 
|  | ZwLoadDriver | 
|  | ZwLoadKey | 
|  | ZwLoadKey2 | 
|  | ZwLoadKeyEx | 
|  | ZwLockFile | 
|  | ZwLockProductActivationKeys | 
|  | ZwLockRegistryKey | 
|  | ZwLockVirtualMemory | 
|  | ZwMakePermanentObject | 
|  | ZwMakeTemporaryObject | 
|  | ZwMapCMFModule | 
|  | ZwMapUserPhysicalPages | 
|  | ZwMapUserPhysicalPagesScatter | 
|  | ZwMapViewOfSection | 
|  | ZwModifyBootEntry | 
|  | ZwModifyDriverEntry | 
|  | ZwNotifyChangeDirectoryFile | 
|  | ZwNotifyChangeKey | 
|  | ZwNotifyChangeMultipleKeys | 
|  | ZwNotifyChangeSession | 
|  | ZwOpenDirectoryObject | 
|  | ZwOpenEnlistment | 
|  | ZwOpenEvent | 
|  | ZwOpenEventPair | 
|  | ZwOpenFile | 
|  | ZwOpenIoCompletion | 
|  | ZwOpenJobObject | 
|  | ZwOpenKey | 
|  | ZwOpenKeyEx | 
|  | ZwOpenKeyTransacted | 
|  | ZwOpenKeyTransactedEx | 
|  | ZwOpenKeyedEvent | 
|  | ZwOpenMutant | 
|  | ZwOpenObjectAuditAlarm | 
|  | ZwOpenPrivateNamespace | 
|  | ZwOpenProcess | 
|  | ZwOpenProcessToken | 
|  | ZwOpenProcessTokenEx | 
|  | ZwOpenResourceManager | 
|  | ZwOpenSection | 
|  | ZwOpenSemaphore | 
|  | ZwOpenSession | 
|  | ZwOpenSymbolicLinkObject | 
|  | ZwOpenThread | 
|  | ZwOpenThreadToken | 
|  | ZwOpenThreadTokenEx | 
|  | ZwOpenTimer | 
|  | ZwOpenTransaction | 
|  | ZwOpenTransactionManager | 
|  | ZwPlugPlayControl | 
|  | ZwPowerInformation | 
|  | ZwPrePrepareComplete | 
|  | ZwPrePrepareEnlistment | 
|  | ZwPrepareComplete | 
|  | ZwPrepareEnlistment | 
|  | ZwPrivilegeCheck | 
|  | ZwPrivilegeObjectAuditAlarm | 
|  | ZwPrivilegedServiceAuditAlarm | 
|  | ZwPropagationComplete | 
|  | ZwPropagationFailed | 
|  | ZwProtectVirtualMemory | 
|  | ZwPulseEvent | 
|  | ZwQueryAttributesFile | 
|  | ZwQueryBootEntryOrder | 
|  | ZwQueryBootOptions | 
|  | ZwQueryDebugFilterState | 
|  | ZwQueryDefaultLocale | 
|  | ZwQueryDefaultUILanguage | 
|  | ZwQueryDirectoryFile | 
|  | ZwQueryDirectoryObject | 
|  | ZwQueryDriverEntryOrder | 
|  | ZwQueryEaFile | 
|  | ZwQueryEvent | 
|  | ZwQueryFullAttributesFile | 
|  | ZwQueryInformationAtom | 
|  | ZwQueryInformationEnlistment | 
|  | ZwQueryInformationFile | 
|  | ZwQueryInformationJobObject | 
|  | ZwQueryInformationPort | 
|  | ZwQueryInformationProcess | 
|  | ZwQueryInformationResourceManager | 
|  | ZwQueryInformationThread | 
|  | ZwQueryInformationToken | 
|  | ZwQueryInformationTransaction | 
|  | ZwQueryInformationTransactionManager | 
|  | ZwQueryInformationWorkerFactory | 
|  | ZwQueryInstallUILanguage | 
|  | ZwQueryIntervalProfile | 
|  | ZwQueryIoCompletion | 
|  | ZwQueryKey | 
|  | ZwQueryLicenseValue | 
|  | ZwQueryMultipleValueKey | 
|  | ZwQueryMutant | 
|  | ZwQueryObject | 
|  | ZwQueryOpenSubKeys | 
|  | ZwQueryOpenSubKeysEx | 
|  | ZwQueryPerformanceCounter | 
|  | ZwQueryPortInformationProcess | 
|  | ZwQueryQuotaInformationFile | 
|  | ZwQuerySection | 
|  | ZwQuerySecurityAttributesToken | 
|  | ZwQuerySecurityObject | 
|  | ZwQuerySemaphore | 
|  | ZwQuerySymbolicLinkObject | 
|  | ZwQuerySystemEnvironmentValue | 
|  | ZwQuerySystemEnvironmentValueEx | 
|  | ZwQuerySystemInformation | 
|  | ZwQuerySystemInformationEx | 
|  | ZwQuerySystemTime | 
|  | ZwQueryTimer | 
|  | ZwQueryTimerResolution | 
|  | ZwQueryValueKey | 
|  | ZwQueryVirtualMemory | 
|  | ZwQueryVolumeInformationFile | 
|  | ZwQueryWnfStateData | 
|  | ZwQueryWnfStateNameInformation | 
|  | ZwQueueApcThread | 
|  | ZwQueueApcThreadEx | 
|  | ZwRaiseException | 
|  | ZwRaiseHardError | 
|  | ZwReadFile | 
|  | ZwReadFileScatter | 
|  | ZwReadOnlyEnlistment | 
|  | ZwReadRequestData | 
|  | ZwReadVirtualMemory | 
|  | ZwRecoverEnlistment | 
|  | ZwRecoverResourceManager | 
|  | ZwRecoverTransactionManager | 
|  | ZwRegisterProtocolAddressInformation | 
|  | ZwRegisterThreadTerminatePort | 
|  | ZwReleaseKeyedEvent | 
|  | ZwReleaseMutant | 
|  | ZwReleaseSemaphore | 
|  | ZwReleaseWorkerFactoryWorker | 
|  | ZwRemoveIoCompletion | 
|  | ZwRemoveIoCompletionEx | 
|  | ZwRemoveProcessDebug | 
|  | ZwRenameKey | 
|  | ZwRenameTransactionManager | 
|  | ZwReplaceKey | 
|  | ZwReplacePartitionUnit | 
|  | ZwReplyPort | 
|  | ZwReplyWaitReceivePort | 
|  | ZwReplyWaitReceivePortEx | 
|  | ZwReplyWaitReplyPort | 
|  | ZwRequestPort | 
|  | ZwRequestWaitReplyPort | 
|  | ZwResetEvent | 
|  | ZwResetWriteWatch | 
|  | ZwRestoreKey | 
|  | ZwResumeProcess | 
|  | ZwResumeThread | 
|  | ZwRollbackComplete | 
|  | ZwRollbackEnlistment | 
|  | ZwRollbackTransaction | 
|  | ZwRollforwardTransactionManager | 
|  | ZwSaveKey | 
|  | ZwSaveKeyEx | 
|  | ZwSaveMergedKeys | 
|  | ZwSecureConnectPort | 
|  | ZwSerializeBoot | 
|  | ZwSetBootEntryOrder | 
|  | ZwSetBootOptions | 
|  | ZwSetCachedSigningLevel | 
|  | ZwSetContextThread | 
|  | ZwSetDebugFilterState | 
|  | ZwSetDefaultHardErrorPort | 
|  | ZwSetDefaultLocale | 
|  | ZwSetDefaultUILanguage | 
|  | ZwSetDriverEntryOrder | 
|  | ZwSetEaFile | 
|  | ZwSetEvent | 
|  | ZwSetEventBoostPriority | 
|  | ZwSetHighEventPair | 
|  | ZwSetHighWaitLowEventPair | 
|  | ZwSetIRTimer | 
|  | ZwSetInformationDebugObject | 
|  | ZwSetInformationEnlistment | 
|  | ZwSetInformationFile | 
|  | ZwSetInformationJobObject | 
|  | ZwSetInformationKey | 
|  | ZwSetInformationObject | 
|  | ZwSetInformationProcess | 
|  | ZwSetInformationResourceManager | 
|  | ZwSetInformationThread | 
|  | ZwSetInformationToken | 
|  | ZwSetInformationTransaction | 
|  | ZwSetInformationTransactionManager | 
|  | ZwSetInformationVirtualMemory | 
|  | ZwSetInformationWorkerFactory | 
|  | ZwSetIntervalProfile | 
|  | ZwSetIoCompletion | 
|  | ZwSetIoCompletionEx | 
|  | ZwSetLdtEntries | 
|  | ZwSetLowEventPair | 
|  | ZwSetLowWaitHighEventPair | 
|  | ZwSetQuotaInformationFile | 
|  | ZwSetSecurityObject | 
|  | ZwSetSystemEnvironmentValue | 
|  | ZwSetSystemEnvironmentValueEx | 
|  | ZwSetSystemInformation | 
|  | ZwSetSystemPowerState | 
|  | ZwSetSystemTime | 
|  | ZwSetThreadExecutionState | 
|  | ZwSetTimer | 
|  | ZwSetTimer2 | 
|  | ZwSetTimerEx | 
|  | ZwSetTimerResolution | 
|  | ZwSetUuidSeed | 
|  | ZwSetValueKey | 
|  | ZwSetVolumeInformationFile | 
|  | ZwSetWnfProcessNotificationEvent | 
|  | ZwShutdownSystem | 
|  | ZwShutdownWorkerFactory | 
|  | ZwSignalAndWaitForSingleObject | 
|  | ZwSinglePhaseReject | 
|  | ZwStartProfile | 
|  | ZwStopProfile | 
|  | ZwSubscribeWnfStateChange | 
|  | ZwSuspendProcess | 
|  | ZwSuspendThread | 
|  | ZwSystemDebugControl | 
|  | ZwTerminateJobObject | 
|  | ZwTerminateProcess | 
|  | ZwTerminateThread | 
|  | ZwTestAlert | 
|  | ZwThawRegistry | 
|  | ZwThawTransactions | 
|  | ZwTraceControl | 
|  | ZwTraceEvent | 
|  | ZwTranslateFilePath | 
|  | ZwUmsThreadYield | 
|  | ZwUnloadDriver | 
|  | ZwUnloadKey | 
|  | ZwUnloadKey2 | 
|  | ZwUnloadKeyEx | 
|  | ZwUnlockFile | 
|  | ZwUnlockVirtualMemory | 
|  | ZwUnmapViewOfSection | 
|  | ZwUnmapViewOfSectionEx | 
|  | ZwUnsubscribeWnfStateChange | 
|  | ZwUpdateWnfStateData | 
|  | ZwVdmControl | 
|  | ZwWaitForAlertByThreadId | 
|  | ZwWaitForDebugEvent | 
|  | ZwWaitForKeyedEvent | 
|  | ZwWaitForMultipleObjects | 
|  | ZwWaitForMultipleObjects32 | 
|  | ZwWaitForSingleObject | 
|  | ZwWaitForWorkViaWorkerFactory | 
|  | ZwWaitHighEventPair | 
|  | ZwWaitLowEventPair | 
|  | ZwWorkerFactoryWorkerReady | 
|  | ZwWriteFile | 
|  | ZwWriteFileGather | 
|  | ZwWriteRequestData | 
|  | ZwWriteVirtualMemory | 
|  | ZwYieldExecution |