LIBRARY "NTDLL.dll"
EXPORTS

; This file is a comprehensive documentation for 32-bit x86 ntdll.dll symbols.
; It covers all 3 platforms Win32s, Win9x and WinNT and contains information
; from native ntdll.dll libraries on 32-bit Windows systems and also from
; 32-bit WoW64 ntdll.dll libraries on 64-bit Windows systems. Symbols in this
; file are ordered by increasing Windows version in which they were introduced.
; First are Win32s versions, then followed by Win9x versions and then WinNT
; because logically Win32s symbols are subset of Win9x symbols which is subset
; of WinNT symbols. Comments contains additional information with exceptions.

; This is list of symbols available in all Windows versions (Win32s since Win32s 1.1; Win9x since Windows 95; WinNT since Windows NT 3.1)
DbgBreakPoint@0
DbgPrint ; cdecl
DbgPrompt@12
NtCurrentTeb@0
NtQueryEaFile@36
NtQueryPerformanceCounter@8
NtSetEaFile@16
RtlCreateHeap@24
RtlEnlargedIntegerMultiply@8
RtlExtendedIntegerMultiply@12
RtlExtendedLargeIntegerDivide@16
RtlImageDirectoryEntryToData@16
RtlImageNtHeader@4
RtlLargeIntegerSubtract@16
RtlUnwind@16
RtlValidateHeap@12 ; Win32s, Win9x and Windows NT 3.1 has ABI "RtlValidateHeap@4", Windows NT 3.5 and new has ABI "RtlValidateHeap@12"

; This is list of symbols available only in Win32s (not available in Win9x and WinNT)
; RtlProcessHeap@0

; This is list of symbols available in Win32s and Win9x but not in WinNT
; RtlExFreeHeap@12
; RtlExReAllocateHeap@16
; RtlExSizeHeap@12

; This is list of symbols added in Win32s 1.15 and available in all Win9x and WinNT versions
; Note that Win32s 1.15 and all later versions merged advapi32.dll, gdi32.dll,
; kernel32.dll, ntdll.dll, user32.dll (and Win32s 1.25a and later also mpr.dll)
; libraries into one big w32scomb.dll library and made those libraries as alias
; to w32scomb.dll, which effectively means that every symbol from every library
; is available also from ntdll.dll (aliased to w32scomb.dll). Below are only
; those Win32s symbols which are available in some Win9x or WinNT version of
; ntdll.dll or logically belongs to ntdll.dll.
RtlAnsiStringToUnicodeString@12
RtlDestroyHeap@4

; This is list of symbols added in Win32s 1.15 and available only in Win32s (not available in Win9x and WinNT)
; _RtlCopyMemory@12
; _RtlMultiByteToUnicodeN@20 ; WinNT has this symbol without leading underline
; _RtlUnicodeToMultiByteN@20 ; WinNT has this symbol without leading underline

; This is list of symbols added in Win32s 1.15 and available in all Win9x version, but not in WinNT
; RtlExAllocateHeap@12

; This is list of symbols added in Win32s 1.15 and available in all WinNT version, but not in Win9x
NtCreateSection@28
NtMapViewOfSection@40
NtOpenDirectoryObject@12
NtUnmapViewOfSection@8
RtlInitAnsiString@8
RtlInitUnicodeString@8
RtlMoveMemory@12
RtlZeroMemory@8

; This is list of symbols added in Win32s 1.15a and available in all Win9x and WinNT versions
RtlUnicodeStringToAnsiString@12

; This is list of symbols added in Win32s 1.15a and available in all WinNT version, but not in Win9x
RtlAnsiStringToUnicodeSize@4
RtlInitString@8
RtlIntegerToUnicodeString@12
RtlUnicodeStringToAnsiSize@4
RtlUnicodeStringToInteger@12

; This is list of symbols added in Win32s 1.20 and available in all WinNT version, but not in Win9x
NtClose@4
NtCreateSemaphore@20 ; Win32s has ABI "NtCreateSemaphore@36", WinNT has ABI "NtCreateSemaphore@20"
NtReleaseSemaphore@12
NtWaitForSingleObject@12
RtlCreateSecurityDescriptor@8
RtlFillMemory@12
RtlSetDaclSecurityDescriptor@16

;; This is end of Win32s symbols ;;


; This is list of symbols available in all Win9x and WinNT versions, but not available in Win32s
RtlAllocateHeap@12 ; Win9x has ABI "RtlAllocateHeap@8", WinNT has ABI "RtlAllocateHeap@12"
RtlConvertLongToLargeInteger@4
RtlConvertUlongToLargeInteger@4
RtlEnlargedUnsignedDivide@16 ; removed in Windows 8
RtlEnlargedUnsignedMultiply@8
RtlExtendedMagicDivide@20
RtlFreeHeap@12 ; Win9x has ABI "RtlFreeHeap@8", WinNT has ABI "RtlFreeHeap@12"
RtlLargeIntegerAdd@16
RtlLargeIntegerArithmeticShift@12
RtlLargeIntegerDivide@20
RtlLargeIntegerNegate@8
RtlLargeIntegerShiftLeft@12
RtlLargeIntegerShiftRight@12
RtlMultiByteToUnicodeN@20 ; Win9x has ABI "RtlMultiByteToUnicodeN@16", WinNT has ABI "RtlMultiByteToUnicodeN@20"
RtlReAllocateHeap@16 ; Win9x has ABI "RtlReAllocateHeap@12", WinNT has ABI "RtlReAllocateHeap@16"
RtlSizeHeap@12 ; Win9x has ABI "RtlSizeHeap@8", WinNT has ABI "RtlSizeHeap@12"
RtlUnicodeToMultiByteN@20 ; Win9x has ABI "RtlUnicodeToMultiByteN@16", WinNT has ABI "RtlUnicodeToMultiByteN@20"

; This is list of symbols available in all Win9x versions, in Windows NT 3.1, but not available in Win32s, Windows NT 3.5 and new
; RtlGetHandleValueHeap@8 ; Win9x ABI
; RtlGetHandleValueHeap@12 ; Windows NT 3.1 ABI
; RtlSetHandleValueHeap@12 ; Win9x ABI
; RtlSetHandleValueHeap@16 ; Windows NT 3.1 ABI

; This is list of symbols available in all Win9x versions, but not available in Win32s and WinNT
; RtlGrowHeap@8

; This is list of symbols added in Windows 98, available also in all WinNT versions, but not available in Win32s
NtCreateFile@44
RtlNtStatusToDosError@4

; This is list of symbols added in Windows 98, but not available in Win32s and WinNT
; IoUnregisterDeviceInterface@4
; NtGetDevnodeFromFileHandle@8

; This is list of symbols added in Windows 98 and also since Windows NT 3.51, but not available in Win32s
NtSetSystemPowerState@12

; This is list of symbols added in Windows 98 and also since Windows 2000, but not available in Win32s
NtInitiatePowerAction@16
NtPowerInformation@20
NtRequestWakeupLatency@4 ; removed in Windows 7

;; This is end of Win9x symbols ;;


; This is list of symbols available since Windows NT 3.1
CsrAllocateCaptureBuffer@8 ; Windows NT 3.1-4.0 has ABI "CsrAllocateCaptureBuffer@12", Windows 2000 and new has ABI "CsrAllocateCaptureBuffer@8"
; CsrAllocateCapturePointer@12 ; removed in Windows 2000
CsrAllocateMessagePointer@12
CsrCaptureMessageBuffer@16
CsrCaptureMessageString@20
CsrCaptureTimeout@8
CsrClientCallServer@16
CsrClientConnectToServer@20 ; Windows NT 3.1-2000 has ABI "CsrClientConnectToServer@24", Windows XP and new has ABI "CsrClientConnectToServer@20"
; CsrClientMaxMessage@0 ; removed in Windows NT 4.0
; CsrClientSendMessage@0 ; removed in Windows NT 4.0
; CsrClientThreadConnect@0 ; removed in Windows NT 4.0
; CsrDumpProfile@0 ; removed in Windows NT 3.5
CsrFreeCaptureBuffer@4
CsrIdentifyAlertableThread@0
CsrNewThread@0 ; removed in Windows Vista SP1
CsrProbeForRead@12 ; removed in Windows Vista
CsrProbeForWrite@12 ; removed in Windows Vista
CsrSetPriorityClass@8
; CsrStartProfile@0 ; removed in Windows NT 3.5
; CsrStopDumpProfile@0 ; removed in Windows NT 3.5
; CsrStopProfile@0 ; removed in Windows NT 3.5
; CsrpProcessCallbackRequest@4 ; removed in Windows NT 4.0
DbgSsHandleKmApiMsg@8 ; removed in Windows XP
DbgSsInitialize@16 ; removed in Windows XP
DbgUiConnectToDbg@0
DbgUiContinue@8
DbgUiWaitStateChange@8
DbgUserBreakPoint@0
KiUserApcDispatcher@20 ; really stdcall @20, gendef detects it incorrectly
KiUserExceptionDispatcher@8
LdrAccessResource@16
LdrFindEntryForAddress@8
LdrFindResourceDirectory_U@16
LdrFindResource_U@16
LdrGetDllHandle@16
LdrGetProcedureAddress@16
LdrInitializeThunk@16 ; really stdcall @16, gendef detects it incorrectly
LdrLoadDll@16
LdrProcessRelocationBlock@16
LdrQueryImageFileExecutionOptions@24
LdrQueryProcessModuleInformation@12
LdrShutdownProcess@0
LdrShutdownThread@0
LdrUnloadDll@4
LdrVerifyImageMatchesChecksum@16 ; Windows NT 3.1-3.51 has ABI "LdrVerifyImageMatchesChecksum@4", Windows NT 4.0 and new has ABI "LdrVerifyImageMatchesChecksum@16"
NtAcceptConnectPort@24
NtAccessCheck@32
NtAccessCheckAndAuditAlarm@44
NtAdjustGroupsToken@24
NtAdjustPrivilegesToken@24
NtAlertResumeThread@8
NtAlertThread@4
NtAllocateLocallyUniqueId@4
NtAllocateVirtualMemory@24
NtCancelIoFile@8
NtCancelTimer@8
NtCloseObjectAuditAlarm@12
NtCompleteConnectPort@4
NtConnectPort@32
NtContinue@8
NtCreateDirectoryObject@12
NtCreateEvent@20
NtCreateEventPair@12
NtCreateKey@28
NtCreateMailslotFile@32
NtCreateMutant@16
NtCreateNamedPipeFile@56
NtCreatePagingFile@16
NtCreatePort@20
NtCreateProcess@32
NtCreateProfile@36 ; Windows NT 3.1-3.5 has ABI "NtCreateProfile@28", Windows NT 3.51 and new has ABI "NtCreateProfile@36"
NtCreateSymbolicLinkObject@16
NtCreateThread@32
NtCreateTimer@16 ; Windows NT 3.1-3.51 has ABI "NtCreateTimer@12", Windows NT 4.0 and new has ABI "NtCreateTimer@16"
NtCreateToken@52
NtDelayExecution@8
NtDeleteKey@4
NtDeleteValueKey@8
NtDeviceIoControlFile@40
NtDisplayString@4
NtDuplicateObject@28
NtDuplicateToken@24
NtEnumerateKey@24
NtEnumerateValueKey@24
NtExtendSection@8
NtFlushBuffersFile@8
NtFlushInstructionCache@12
NtFlushKey@4
NtFlushVirtualMemory@16
NtFlushWriteBuffer@0
NtFreeVirtualMemory@16
NtFsControlFile@40
NtGetContextThread@8
; NtGetTickCount@0 ; removed in Windows XP
NtImpersonateClientOfPort@8
NtImpersonateThread@12
NtInitializeRegistry@4
; NtInitializeVDM@0 ; removed in Windows NT 3.5
NtListenPort@8
NtLoadDriver@4
NtLoadKey@8
NtLockFile@40
NtLockVirtualMemory@16
NtMakeTemporaryObject@4
NtNotifyChangeDirectoryFile@36
NtNotifyChangeKey@40
NtOpenEvent@12
NtOpenEventPair@12
NtOpenFile@24
NtOpenKey@12
NtOpenMutant@12
NtOpenObjectAuditAlarm@48
NtOpenProcess@16
NtOpenProcessToken@12
NtOpenSection@12
NtOpenSemaphore@12
NtOpenSymbolicLinkObject@12
NtOpenThread@16
NtOpenThreadToken@16
NtOpenTimer@12
NtPrivilegeCheck@12
NtPrivilegeObjectAuditAlarm@24
NtPrivilegedServiceAuditAlarm@20
NtProtectVirtualMemory@20
NtPulseEvent@8
NtQueryDefaultLocale@8
NtQueryDirectoryFile@44
NtQueryDirectoryObject@28
NtQueryEvent@20
NtQueryInformationFile@20
NtQueryInformationPort@20
NtQueryInformationProcess@20
NtQueryInformationThread@20
NtQueryInformationToken@20
NtQueryIntervalProfile@8 ; Windows NT 3.1-3.5 has ABI "NtQueryIntervalProfile@4", Windows NT 3.51 and new has ABI "NtQueryIntervalProfile@8"
NtQueryKey@20
NtQueryMutant@20
NtQueryObject@20
NtQuerySection@20
NtQuerySecurityObject@20
NtQuerySemaphore@20
NtQuerySymbolicLinkObject@12
NtQuerySystemEnvironmentValue@16
NtQuerySystemInformation@16
NtQuerySystemTime@4
NtQueryTimer@20
NtQueryValueKey@24
NtQueryVirtualMemory@24
NtQueryVolumeInformationFile@20
NtRaiseException@12
NtRaiseHardError@24
NtReadFile@36
NtReadRequestData@24
NtReadVirtualMemory@20
NtRegisterThreadTerminatePort@4
NtReleaseMutant@8
; NtReleaseProcessMutant@0 ; removed in Windows NT 4.0
; NtRenameValueKey@16 ; removed in Windows NT 3.5
NtReplaceKey@12
NtReplyPort@8
NtReplyWaitReceivePort@16
NtReplyWaitReplyPort@8
NtRequestPort@8
NtRequestWaitReplyPort@12
NtResetEvent@8
NtRestoreKey@12
NtResumeThread@8
NtSaveKey@8
NtSetContextThread@8
NtSetDefaultHardErrorPort@4
NtSetDefaultLocale@8
NtSetEvent@8
NtSetHighEventPair@4
NtSetHighWaitLowEventPair@4
; NtSetHighWaitLowThread@0 ; removed in Windows 2000
NtSetInformationFile@20
NtSetInformationKey@16
NtSetInformationProcess@16
NtSetInformationThread@16
NtSetInformationToken@16
NtSetIntervalProfile@8 ; Windows NT 3.1-3.5 has ABI "NtSetIntervalProfile@4", Windows NT 3.51 and new has ABI "NtSetIntervalProfile@8"
NtSetLdtEntries@24
NtSetLowEventPair@4
NtSetLowWaitHighEventPair@4
; NtSetLowWaitHighThread@0 ; removed in Windows 2000
NtSetSecurityObject@12
NtSetSystemEnvironmentValue@8
NtSetSystemTime@8
NtSetTimer@28 ; Windows NT 3.1-3.5 has ABI "NtSetTimer@20", Windows NT 3.51 has ABI "NtSetTimer@24", Windows NT 4.0 and new has ABI NtSetTimer@28
NtSetValueKey@24
NtSetVolumeInformationFile@20
NtShutdownSystem@4
NtStartProfile@4
NtStopProfile@4
NtSuspendThread@8
NtSystemDebugControl@24
NtTerminateProcess@8
NtTerminateThread@8
NtTestAlert@0
NtUnloadDriver@4
NtUnloadKey@4
NtUnlockFile@20
NtUnlockVirtualMemory@16
NtVdmControl@8 ; Windows NT 3.1 has ABI "NtVdmControl@16", Windows NT 3.5 and new has ABI "NtVdmControl@8"
; NtVdmStartExecution@0 ; removed in Windows NT 3.5
NtWaitForMultipleObjects@20
; NtWaitForProcessMutant@0 ; removed in Windows NT 4.0
NtWaitHighEventPair@4
NtWaitLowEventPair@4
NtWriteFile@36
NtWriteRequestData@24
NtWriteVirtualMemory@20
PfxFindPrefix@8
PfxInitialize@4
PfxInsertPrefix@12
PfxRemovePrefix@8
RtlAbortRXact@4
RtlAbsoluteToSelfRelativeSD@12
RtlAcquirePebLock@0
RtlAcquireResourceExclusive@8
RtlAcquireResourceShared@8
RtlAddAccessAllowedAce@16
RtlAddAccessDeniedAce@16
RtlAddAce@20
RtlAddActionToRXact@24
RtlAddAttributeActionToRXact@32
RtlAddAuditAccessAce@24
RtlAdjustPrivilege@16
RtlAllocateAndInitializeSid@44
; RtlAnalyzeProfile@0 ; removed in Windows NT 3.5
RtlAnsiCharToUnicodeChar@4
RtlAppendAsciizToString@8
RtlAppendStringToString@8
RtlAppendUnicodeStringToString@8
RtlAppendUnicodeToString@8
RtlApplyRXact@4
RtlApplyRXactNoFlush@4
RtlAreAllAccessesGranted@8
RtlAreAnyAccessesGranted@8
RtlAreBitsClear@12
RtlAreBitsSet@12
RtlAssert@16
RtlCaptureStackBackTrace@16
RtlCharToInteger@12
RtlCheckRegistryKey@8
RtlClearAllBits@4
RtlClearBits@12
RtlCompactHeap@8
RtlCompareMemory@12
RtlCompareMemoryUlong@12
RtlCompareString@12
RtlCompareUnicodeString@12
RtlConsoleMultiByteToUnicodeN@24
RtlConvertExclusiveToShared@4
RtlConvertSharedToExclusive@4
RtlConvertSidToUnicodeString@12
RtlConvertUiListToApiList@12 ; removed in Windows 8.1
RtlCopyLuid@8
RtlCopyLuidAndAttributesArray@12
RtlCopySecurityDescriptor@8
RtlCopySid@12
RtlCopySidAndAttributesArray@28
RtlCopyString@8
RtlCopyUnicodeString@8
RtlCreateAcl@12
RtlCreateAndSetSD@20
RtlCreateEnvironment@8
RtlCreateProcessParameters@40
RtlCreateRegistryKey@8
RtlCreateUnicodeString@8
RtlCreateUnicodeStringFromAsciiz@8
RtlCreateUserProcess@40
RtlCreateUserSecurityObject@28
RtlCreateUserThread@40
RtlCustomCPToUnicodeN@24
RtlDeNormalizeProcessParams@4
RtlDelete@4
RtlDeleteAce@8
RtlDeleteCriticalSection@4
RtlDeleteElementGenericTable@8
RtlDeleteRegistryValue@12
RtlDeleteResource@4
RtlDeleteSecurityObject@4
RtlDestroyEnvironment@4
RtlDestroyProcessParameters@4
RtlDetermineDosPathNameType_U@4
RtlDoesFileExists_U@4
RtlDosPathNameToNtPathName_U@16
RtlDosSearchPath_U@24
RtlDumpResource@4
RtlEnterCriticalSection@4
RtlEnumerateGenericTable@8
RtlEnumerateGenericTableWithoutSplaying@8
RtlEqualComputerName@8
RtlEqualDomainName@8
RtlEqualLuid@8
RtlEqualPrefixSid@8
RtlEqualSid@8
RtlEqualString@12
RtlEqualUnicodeString@12
RtlEraseUnicodeString@4
; RtlExpandEnvironmentStrings@16 ; removed in Windows NT 3.5
RtlExpandEnvironmentStrings_U@16
RtlFillMemoryUlong@12
RtlFindClearBits@12
RtlFindClearBitsAndSet@12
RtlFindLongestRunClear@8
RtlFindLongestRunSet@8 ; removed in Windows 2000
RtlFindMessage@20
RtlFindSetBits@12
RtlFindSetBitsAndClear@12
RtlFirstFreeAce@8
RtlFormatMessage@36
RtlFreeAnsiString@4
RtlFreeOemString@4
RtlFreeSid@4
RtlFreeUnicodeString@4
RtlGenerate8dot3Name@16 ; Windows NT 3.1 has ABI "RtlGenerate8dot3Name@12", Windows NT 3.5 and new has ABI "RtlGenerate8dot3Name@16"
RtlGetAce@12
RtlGetCallersAddress@8
RtlGetControlSecurityDescriptor@12
RtlGetCurrentDirectory_U@8
RtlGetDaclSecurityDescriptor@16
RtlGetElementGenericTable@8
RtlGetFullPathName_U@16
RtlGetGroupSecurityDescriptor@12
; RtlGetHeapUserValue@4 ; removed in Windows NT 3.5
RtlGetNtGlobalFlags@0
RtlGetNtProductType@4
RtlGetOwnerSecurityDescriptor@12
RtlGetSaclSecurityDescriptor@16
RtlIdentifierAuthoritySid@4
RtlImpersonateSelf@4
RtlInitCodePageTable@8
RtlInitNlsTables@16
RtlInitializeBitMap@12
RtlInitializeContext@20
RtlInitializeCriticalSection@4
RtlInitializeGenericTable@20
; RtlInitializeProfile@4 ; removed in Windows NT 3.5
RtlInitializeRXact@12
RtlInitializeResource@4
RtlInitializeSid@12
; RtlInitializeStackTraceDataBase@12 ; removed in Windows NT 3.51, added back in Windows XP SP2 and removed again in Windows Server 2003
RtlInsertElementGenericTable@16
RtlIntegerToChar@16
RtlIsDosDeviceName_U@4
RtlIsGenericTableEmpty@4
RtlLargeIntegerToChar@16
RtlLeaveCriticalSection@4
RtlLengthRequiredSid@4
RtlLengthSecurityDescriptor@4
RtlLengthSid@4
RtlLocalTimeToSystemTime@8
RtlLockHeap@4
; RtlLogStackBackTrace@0 ; removed in Windows NT 3.51
RtlLookupElementGenericTable@8
; RtlLookupSymbolByAddress@24 ; removed in Windows NT 3.51
; RtlLookupSymbolByName@16 ; removed in Windows NT 3.51
RtlMakeSelfRelativeSD@12
RtlMapGenericMask@8
RtlMultiByteToUnicodeSize@12
RtlNewInstanceSecurityObject@40
RtlNewSecurityGrantedAccess@24
RtlNewSecurityObject@24
RtlNormalizeProcessParams@4
RtlNumberGenericTableElements@4
RtlNumberOfClearBits@4
RtlNumberOfSetBits@4
RtlOemStringToUnicodeSize@4
RtlOemStringToUnicodeString@12
RtlOemToUnicodeN@20
RtlOpenCurrentUser@8
RtlPcToFileHeader@8
RtlPrefixString@12
RtlPrefixUnicodeString@12
; RtlQueryEnvironmentVariable@0 ; removed in Windows NT 3.5
RtlQueryEnvironmentVariable_U@12
RtlQueryInformationAcl@16
; RtlQueryModuleInformation@24 ; removed in Windows NT 3.51
RtlQueryProcessBackTraceInformation@4 ; Windows NT 3.1-3.5 has ABI "RtlQueryProcessBackTraceInformation@12", Windows NT 3.51 and new has ABI "RtlQueryProcessBackTraceInformation@4"
RtlQueryProcessHeapInformation@4 ; Windows NT 3.1-3.5 has ABI "RtlQueryProcessHeapInformation@12", Windows NT 3.51 and new has ABI "RtlQueryProcessHeapInformation@4"
RtlQueryProcessLockInformation@4 ; Windows NT 3.1-3.5 has ABI "RtlQueryProcessLockInformation@12", Windows NT 3.51 and new has ABI "RtlQueryProcessLockInformation@4"
RtlQueryRegistryValues@20
RtlQuerySecurityObject@20
RtlQueryTimeZoneInformation@4
RtlRaiseException@4
RtlRaiseStatus@4
RtlRandom@4
RtlRealPredecessor@4
RtlRealSuccessor@4
RtlReleasePebLock@0
RtlReleaseResource@4
RtlRemoteCall@28
RtlResetRtlTranslations@4
RtlRunDecodeUnicodeString@8
RtlRunEncodeUnicodeString@8
RtlSecondsSince1970ToTime@8
RtlSecondsSince1980ToTime@8
RtlSelfRelativeToAbsoluteSD@44
RtlSetAllBits@4
RtlSetBits@12
RtlSetCurrentDirectory_U@4
RtlSetCurrentEnvironment@8
RtlSetEnvironmentVariable@12
RtlSetGroupSecurityDescriptor@12
; RtlSetHeapUserValue@8 ; removed in Windows NT 3.5
RtlSetInformationAcl@16
RtlSetOwnerSecurityDescriptor@12
RtlSetSaclSecurityDescriptor@16
RtlSetSecurityObject@20
RtlSetTimeZoneInformation@4
; RtlSnapShotHeap@16 ; removed in Windows NT 3.51
RtlSplay@4
; RtlStartProfile@0 ; removed in Windows NT 3.5
RtlStartRXact@4
; RtlStopProfile@0 ; removed in Windows NT 3.5
RtlSubAuthorityCountSid@4
RtlSubAuthoritySid@8
RtlSubtreePredecessor@4
RtlSubtreeSuccessor@4
RtlSystemTimeToLocalTime@8
RtlTimeFieldsToTime@8
RtlTimeToElapsedTimeFields@8
RtlTimeToSecondsSince1970@8
RtlTimeToSecondsSince1980@8
RtlTimeToTimeFields@8
RtlUnicodeStringToCountedOemString@12
RtlUnicodeStringToOemSize@4
RtlUnicodeStringToOemString@12
RtlUnicodeToCustomCPN@24
RtlUnicodeToMultiByteSize@12
RtlUnicodeToOemN@20
RtlUniform@4
RtlUnlockHeap@4
RtlUpcaseUnicodeChar@4
RtlUpcaseUnicodeString@12
RtlUpcaseUnicodeStringToAnsiString@12
RtlUpcaseUnicodeStringToCountedOemString@12
RtlUpcaseUnicodeStringToOemString@12
RtlUpcaseUnicodeToCustomCPN@24
RtlUpcaseUnicodeToMultiByteN@20
RtlUpcaseUnicodeToOemN@20
RtlUpperChar@4
RtlUpperString@8
RtlValidAcl@4
RtlValidSecurityDescriptor@4
RtlValidSid@4
RtlWriteRegistryValue@24
; RtlpInitializeRtl@12 ; removed in Windows NT 4.0
RtlpNtCreateKey@24
RtlpNtEnumerateSubKey@16
RtlpNtMakeTemporaryKey@4
RtlpNtOpenKey@16
RtlpNtQueryValueKey@20
RtlpNtSetValueKey@16
RtlpUnWaitCriticalSection@4
RtlpWaitForCriticalSection@4
ZwAcceptConnectPort@24
ZwAccessCheck@32
ZwAccessCheckAndAuditAlarm@44
ZwAdjustGroupsToken@24
ZwAdjustPrivilegesToken@24
ZwAlertResumeThread@8
ZwAlertThread@4
ZwAllocateLocallyUniqueId@4
ZwAllocateVirtualMemory@24
ZwCancelIoFile@8
ZwCancelTimer@8
ZwClose@4
ZwCloseObjectAuditAlarm@12
ZwCompleteConnectPort@4
ZwConnectPort@32
ZwContinue@8
ZwCreateDirectoryObject@12
ZwCreateEvent@20
ZwCreateEventPair@12
ZwCreateFile@44
ZwCreateKey@28
ZwCreateMailslotFile@32
ZwCreateMutant@16
ZwCreateNamedPipeFile@56
ZwCreatePagingFile@16
ZwCreatePort@20
ZwCreateProcess@32
ZwCreateProfile@36 ; Windows NT 3.1-3.5 has ABI "ZwCreateProfile@28", Windows NT 3.51 and new has ABI "ZwCreateProfile@36"
ZwCreateSection@28
ZwCreateSemaphore@20
ZwCreateSymbolicLinkObject@16
ZwCreateThread@32
ZwCreateTimer@16 ; Windows NT 3.1-3.51 has ABI "ZwCreateTimer@12", Windows NT 4.0 and new has ABI "ZwCreateTimer@16"
ZwCreateToken@52
ZwDelayExecution@8
ZwDeleteKey@4
ZwDeleteValueKey@8
ZwDeviceIoControlFile@40
ZwDisplayString@4
ZwDuplicateObject@28
ZwDuplicateToken@24
ZwEnumerateKey@24
ZwEnumerateValueKey@24
ZwExtendSection@8
ZwFlushBuffersFile@8
ZwFlushInstructionCache@12
ZwFlushKey@4
ZwFlushVirtualMemory@16
ZwFlushWriteBuffer@0
ZwFreeVirtualMemory@16
ZwFsControlFile@40
ZwGetContextThread@8
ZwGetTickCount@0 ; removed in Windows XP
ZwImpersonateClientOfPort@8
ZwImpersonateThread@12
ZwInitializeRegistry@4
; ZwInitializeVDM@0 ; removed in Windows NT 3.5
ZwListenPort@8
ZwLoadDriver@4
ZwLoadKey@8
ZwLockFile@40
ZwLockVirtualMemory@16
ZwMakeTemporaryObject@4
ZwMapViewOfSection@40
ZwNotifyChangeDirectoryFile@36
ZwNotifyChangeKey@40
ZwOpenDirectoryObject@12
ZwOpenEvent@12
ZwOpenEventPair@12
ZwOpenFile@24
ZwOpenKey@12
ZwOpenMutant@12
ZwOpenObjectAuditAlarm@48
ZwOpenProcess@16
ZwOpenProcessToken@12
ZwOpenSection@12
ZwOpenSemaphore@12
ZwOpenSymbolicLinkObject@12
ZwOpenThread@16
ZwOpenThreadToken@16
ZwOpenTimer@12
ZwPrivilegeCheck@12
ZwPrivilegeObjectAuditAlarm@24
ZwPrivilegedServiceAuditAlarm@20
ZwProtectVirtualMemory@20
ZwPulseEvent@8
ZwQueryDefaultLocale@8
ZwQueryDirectoryFile@44
ZwQueryDirectoryObject@28
ZwQueryEaFile@36
ZwQueryEvent@20
ZwQueryInformationFile@20
ZwQueryInformationPort@20
ZwQueryInformationProcess@20
ZwQueryInformationThread@20
ZwQueryInformationToken@20
ZwQueryIntervalProfile@8 ; Windows NT 3.1-3.51 has ABI "ZwQueryIntervalProfile@4", Windows NT 4.0 and new has ABI "ZwQueryIntervalProfile@8"
ZwQueryKey@20
ZwQueryMutant@20
ZwQueryObject@20
ZwQueryPerformanceCounter@8
ZwQuerySection@20
ZwQuerySecurityObject@20
ZwQuerySemaphore@20
ZwQuerySymbolicLinkObject@12
ZwQuerySystemEnvironmentValue@16
ZwQuerySystemInformation@16
ZwQuerySystemTime@4
ZwQueryTimer@20
ZwQueryValueKey@24
ZwQueryVirtualMemory@24
ZwQueryVolumeInformationFile@20
ZwRaiseException@12
ZwRaiseHardError@24
ZwReadFile@36
ZwReadRequestData@24
ZwReadVirtualMemory@20
ZwRegisterThreadTerminatePort@4
ZwReleaseMutant@8
; ZwReleaseProcessMutant@0 ; removed in Windows NT 4.0
ZwReleaseSemaphore@12
; ZwRenameValueKey@16 ; removed in Windows NT 3.5
ZwReplaceKey@12
ZwReplyPort@8
ZwReplyWaitReceivePort@16
ZwReplyWaitReplyPort@8
ZwRequestPort@8
ZwRequestWaitReplyPort@12
ZwResetEvent@8
ZwRestoreKey@12
ZwResumeThread@8
ZwSaveKey@8
ZwSetContextThread@8
ZwSetDefaultHardErrorPort@4
ZwSetDefaultLocale@8
ZwSetEaFile@16
ZwSetEvent@8
ZwSetHighEventPair@4
ZwSetHighWaitLowEventPair@4
; ZwSetHighWaitLowThread@0 ; removed in Windows 2000
ZwSetInformationFile@20
ZwSetInformationKey@16
ZwSetInformationProcess@16
ZwSetInformationThread@16
ZwSetInformationToken@16
ZwSetIntervalProfile@8 ; Windows NT 3.1-3.5 has ABI "ZwSetIntervalProfile@4", Windows NT 3.51 and new has ABI "ZwSetIntervalProfile@8"
ZwSetLdtEntries@24
ZwSetLowEventPair@4
ZwSetLowWaitHighEventPair@4
; ZwSetLowWaitHighThread@0 ; removed in Windows 2000
ZwSetSecurityObject@12
ZwSetSystemEnvironmentValue@8
ZwSetSystemTime@8
ZwSetTimer@28 ; Windows NT 3.1-3.5 has ABI "ZwSetTimer@20", Windows NT 3.51 has ABI "ZwSetTimer@24", Windows NT 4.0 and new has ABI "ZwSetTimer@28"
ZwSetValueKey@24
ZwSetVolumeInformationFile@20
ZwShutdownSystem@4
ZwStartProfile@4
ZwStopProfile@4
ZwSuspendThread@8
ZwSystemDebugControl@24
ZwTerminateProcess@8
ZwTerminateThread@8
ZwTestAlert@0
ZwUnloadDriver@4
ZwUnloadKey@4
ZwUnlockFile@20
ZwUnlockVirtualMemory@16
ZwUnmapViewOfSection@8
ZwVdmControl@8 ; Windows NT 3.1 has ABI "ZwVdmControl@16", Windows NT 3.5 and new has ABI "ZwVdmControl@8"
; ZwVdmStartExecution@0 ; removed in Windows NT 3.5
ZwWaitForMultipleObjects@20
; ZwWaitForProcessMutant@0 ; removed in Windows NT 4.0
ZwWaitForSingleObject@12
ZwWaitHighEventPair@4
ZwWaitLowEventPair@4
ZwWriteFile@36
ZwWriteRequestData@24
ZwWriteVirtualMemory@20
; xRtlDosPathNameToNtPathName@16 ; removed in Windows NT 3.5

; This is list of non-stdcall FPU emulator symbols, available since Windows NT 3.1 and removed in Windows XP SP2 and Windows Server 2003 SP1
; NPXEMULATORTABLE DATA ; removed in Windows XP
; RestoreEm87Context
; SaveEm87Context
; __eCommonExceptions
; __eEmulatorInit
; __eF2XM1
; __eFABS
; __eFADD32
; __eFADD64
; __eFADDPreg
; __eFADDreg
; __eFADDtop
; __eFCHS
; __eFCOM32
; __eFCOM64
; __eFCOM
; __eFCOMP32
; __eFCOMP64
; __eFCOMP
; __eFCOMPP
; __eFCOS
; __eFDECSTP
; __eFDIV32
; __eFDIV64
; __eFDIVPreg
; __eFDIVR32
; __eFDIVR64
; __eFDIVRPreg
; __eFDIVRreg
; __eFDIVRtop
; __eFDIVreg
; __eFDIVtop
; __eFFREE
; __eFIADD16
; __eFIADD32
; __eFICOM16
; __eFICOM32
; __eFICOMP16
; __eFICOMP32
; __eFIDIV16
; __eFIDIV32
; __eFIDIVR16
; __eFIDIVR32
; __eFILD16
; __eFILD32
; __eFILD64
; __eFIMUL16
; __eFIMUL32
; __eFINCSTP
; __eFINIT
; __eFIST16
; __eFIST32
; __eFISTP16
; __eFISTP32
; __eFISTP64
; __eFISUB16
; __eFISUB32
; __eFISUBR16
; __eFISUBR32
; __eFLD1
; __eFLD32
; __eFLD64
; __eFLD80
; __eFLDCW
; __eFLDENV
; __eFLDL2E
; __eFLDLN2
; __eFLDPI
; __eFLDZ
; __eFMUL32
; __eFMUL64
; __eFMULPreg
; __eFMULreg
; __eFMULtop
; __eFPATAN
; __eFPREM
; __eFPREM1
; __eFPTAN
; __eFRNDINT
; __eFRSTOR
; __eFSAVE
; __eFSCALE
; __eFSIN
; __eFSQRT
; __eFST32
; __eFST64
; __eFST
; __eFSTCW
; __eFSTENV
; __eFSTP32
; __eFSTP64
; __eFSTP80
; __eFSTP
; __eFSTSW
; __eFSUB32
; __eFSUB64
; __eFSUBPreg
; __eFSUBR32
; __eFSUBR64
; __eFSUBRPreg
; __eFSUBRreg
; __eFSUBRtop
; __eFSUBreg
; __eFSUBtop
; __eFTST
; __eFUCOM
; __eFUCOMP
; __eFUCOMPP
; __eFXAM
; __eFXCH
; __eFXTRACT
; __eFYL2X
; __eFYL2XP1
; __eGetStatusWord

; This is list of symbols added in Windows NT 3.5
LdrDisableThreadCalloutsForDll@4
NlsMbCodePageTag DATA
NlsMbOemCodePageTag DATA
NtClearEvent@4
NtCreateIoCompletion@16
NtDeleteFile@4
NtOpenIoCompletion@12
NtQueryAttributesFile@8
NtQueryIoCompletion@20
NtQueryTimerResolution@12
NtRemoveIoCompletion@20
NtSetInformationObject@16
NtSetSystemInformation@12
NtSetTimerResolution@12
RtlCompressBuffer@32
RtlCutoverTimeToSystemTime@16
RtlDecompressBuffer@24
RtlDecompressFragment@32
RtlFormatCurrentUserKeyPath@4
RtlGetCompressionWorkSpaceSize@12
RtlGetLongestNtPathLength@0
; RtlGetUserFlagsHeap@16 ; removed in Windows NT 3.51
; RtlGetUserValueHeap@16 ; removed in Windows NT 3.51
RtlIsTextUnicode@12
RtlSetUserFlagsHeap@20
RtlSetUserValueHeap@16
RtlWalkHeap@8
RtlZeroHeap@8
RtlxAnsiStringToUnicodeSize@4
RtlxOemStringToUnicodeSize@4
RtlxUnicodeStringToAnsiSize@4
RtlxUnicodeStringToOemSize@4
ZwClearEvent@4
ZwCreateIoCompletion@16
ZwDeleteFile@4
ZwOpenIoCompletion@12
ZwQueryAttributesFile@8
ZwQueryIoCompletion@20
ZwQueryTimerResolution@12
ZwRemoveIoCompletion@20
ZwSetInformationObject@16
ZwSetSystemInformation@12
ZwSetTimerResolution@12

; This is list of symbols added in Windows NT 3.51
KiUserCallbackDispatcher@12 ; really stdcall @12, gendef detects it incorrectly
LdrEnumResources@20
NtAllocateUuids@16 ; Windows NT 3.51-4.0 has ABI "NtAllocateUuids@12", Windows 2000 and new has ABI "NtAllocateUuids@16"
NtCallbackReturn@12
; NtEnumerateBus@8 ; removed in Windows NT 4.0
NtGetPlugPlayEvent@16 ; removed in Windows 8
NtPlugPlayControl@12 ; Windows NT 3.51-4.0 has ABI "NtPlugPlayControl@16", Windows 2000 and new has ABI "NtPlugPlayControl@12"
; NtRegisterNewDevice@8 ; removed in Windows NT 4.0
NtSetIoCompletion@20
; NtW32Call@20 ; removed in Windows NT 4.0 SP4
RtlCreateQueryDebugBuffer@8
RtlCreateTagHeap@16
RtlDestroyQueryDebugBuffer@4
RtlEnumProcessHeaps@8
RtlExtendHeap@16 ; removed in Windows Vista
RtlGetProcessHeaps@8
RtlGetUserInfoHeap@20
RtlIsNameLegalDOS8Dot3@12
RtlProtectHeap@8
RtlQueryProcessDebugInformation@12
RtlQueryTagHeap@20
RtlUsageHeap@12 ; removed in Windows Vista
RtlValidateProcessHeaps@0
ZwAllocateUuids@16 ; Windows NT 3.51-4.0 has ABI "ZwAllocateUuids@12", Windows 2000 and new has ABI "ZwAllocateUuids@16"
ZwCallbackReturn@12
; ZwEnumerateBus@8 ; remvoed in Windows NT 4.0
ZwGetPlugPlayEvent@16 ; removed in Windows 8
ZwPlugPlayControl@12 ; Windows NT 3.51-4.0 has ABI "ZwPlugPlayControl@16", Windows 2000 and new has ABI "ZwPlugPlayControl@12"
; ZwRegisterNewDevice@8 ; removed in Windows NT 4.0
ZwSetIoCompletion@20
ZwSetSystemPowerState@12
; ZwW32Call@20 ; removed in Windows NT 4.0 SP4

; This is list of symbols added in Windows NT 4.0
; public: virtual void *__thiscall CBufferAllocator::Allocate(unsigned long)
; ?Allocate@CBufferAllocator@@UAEPAXK@Z ; has WINAPI (@4) ; removed in Windows 2000
KiRaiseUserExceptionDispatcher@0
NlsAnsiCodePage DATA
NtAddAtom@12 ; Windows NT 4.0 has ABI "NtAddAtom@8", Windows 2000 and new has ABI "NtAddAtom@12"
; NtCreateChannel@8 ; removed in Windows XP
NtDeleteAtom@4
NtDeleteObjectAuditAlarm@12
NtFindAtom@12 ; Windows NT 4.0 has ABI "NtFindAtom@8", Windows 2000 and new has ABI "NtFindAtom@12"
; NtListenChannel@8 ; removed in Windows XP
NtLoadKey2@12
; NtOpenChannel@8 ; removed in Windows XP
NtQueryFullAttributesFile@8
NtQueryInformationAtom@20
NtQueryMultipleValueKey@24
; NtQueryOleDirectoryFile@44 ; removed in Windows 2000
NtQueueApcThread@20
; NtReplyWaitSendChannel@12 ; removed in Windows XP
; NtSendWaitReplyChannel@16 ; removed in Windows XP
; NtSetContextChannel@4 ; removed in Windows XP
NtSignalAndWaitForSingleObject@16
NtYieldExecution@0
; PropertyLengthAsVariant@16 ; removed in Windows Vista
RtlAddAtomToAtomTable@12
RtlAddCompoundAce@24
RtlAllocateHandle@8
; RtlClosePropertySet@4 ; removed in Windows 2000
; RtlCompareVariants@12 ; removed in Windows 2000
; RtlConvertPropertyToVariant@16 ; removed in Windows Vista
; RtlConvertVariantToProperty@28 ; removed in Windows Vista
RtlCreateAtomTable@8
; RtlCreatePropertySet@36 ; removed in Windows 2000
RtlDeleteAtomFromAtomTable@8
RtlDeleteNoSplay@8
RtlDestroyAtomTable@4
RtlDestroyHandleTable@4
RtlDowncaseUnicodeString@12
RtlEmptyAtomTable@8
; RtlEnumerateProperties@24 ; removed in Windows 2000
; RtlFlushPropertySet@4 ; removed in Windows 2000
RtlFreeHandle@8
RtlFreeUserThreadStack@8 ; removed in Windows Vista
; RtlGuidToPropertySetName@8 ; removed in Windows 2000
RtlImageRvaToSection@12
RtlImageRvaToVa@16
RtlInitializeAtomPackage@4
RtlInitializeHandleTable@12
RtlIsValidHandle@8
RtlIsValidIndexHandle@12
RtlLookupAtomInAtomTable@12
RtlPinAtomInAtomTable@8
; RtlPropertySetNameToGuid@12 ; removed in Windows 2000
RtlQueryAtomInAtomTable@24
; RtlQueryProperties@28 ; removed in Windows 2000
; RtlQueryPropertyNames@16 ; removed in Windows 2000
; RtlQueryPropertySet@8 ; removed in Windows 2000
RtlSetAttributesSecurityDescriptor@12
; RtlSetProperties@28 ; removed in Windows 2000
; RtlSetPropertyNames@16 ; removed in Windows 2000
; RtlSetPropertySetClassId@8 ; removed in Windows 2000
; RtlSetUnicodeCallouts@4 ; removed in Windows Vista
RtlTryEnterCriticalSection@4
ZwAddAtom@12 ; Windows NT 4.0 has ABI "ZwAddAtom@8", Windows 2000 and new has ABI "ZwAddAtom@12"
; ZwCreateChannel@8 ; removed in Windows XP
ZwDeleteAtom@4
ZwDeleteObjectAuditAlarm@12
ZwFindAtom@12 ; Windows NT 4.0 has ABI "ZwFindAtom@8", Windows 2000 and new has ABI "ZwFindAtom@12"
; ZwListenChannel@8 ; removed in Windows XP
ZwLoadKey2@12
; ZwOpenChannel@8 ; removed in Windows XP
ZwQueryFullAttributesFile@8
ZwQueryInformationAtom@20
ZwQueryMultipleValueKey@24
; ZwQueryOleDirectoryFile@44 ; removed in Windows 2000
ZwQueueApcThread@20
; ZwReplyWaitSendChannel@12 ; removed in Windows XP
; ZwSendWaitReplyChannel@16 ; removed in Windows XP
; ZwSetContextChannel@4 ; removed in Windows XP
ZwSignalAndWaitForSingleObject@16
ZwYieldExecution@0

; In Windows NT 4.0 SP1 was not added any new symbol

; This is list of symbols added in Windows NT 4.0 SP2
NtReadFileScatter@36
NtWriteFileGather@36
; RtlOnMappedStreamEvent@12 ; removed in Windows 2000
ZwReadFileScatter@36
ZwWriteFileGather@36

; This is list of symbols added in Windows NT 4.0 SP3
RtlInitializeCriticalSectionAndSpinCount@8
RtlSetCriticalSectionSpinCount@8

; In Windows NT 4.0 SP4 was not added any new symbol but some were removed

; In Windows NT 4.0 SP5 was not added any new symbol

; In Windows NT 4.0 SP6 was not added any new symbol

; In Windows NT 4.0 SP6a was not added any new symbol

; This is list of symbols added in Windows 2000
DbgPrintReturnControlC ; cdecl
LdrAlternateResourcesEnabled@0 ; removed in Windows Vista
LdrFlushAlternateResourceModules@0
LdrLoadAlternateResourceModule@16 ; Windows 2000-2003 has ABI "LdrLoadAlternateResourceModule@8", Windows Vista and new has ABI "LdrLoadAlternateResourceModule@16"
LdrUnloadAlternateResourceModule@4
NtAccessCheckByType@44
NtAccessCheckByTypeAndAuditAlarm@64
NtAccessCheckByTypeResultList@44
NtAccessCheckByTypeResultListAndAuditAlarm@64
NtAccessCheckByTypeResultListAndAuditAlarmByHandle@68
NtAllocateUserPhysicalPages@12
NtAreMappedFilesTheSame@8
NtAssignProcessToJobObject@8
NtCancelDeviceWakeupRequest@4 ; removed in Windows 7
NtCreateJobObject@12
NtCreateWaitablePort@20
NtFilterToken@24
NtFreeUserPhysicalPages@12
NtGetDevicePowerState@8
NtGetWriteWatch@28
NtImpersonateAnonymousToken@4
NtIsSystemResumeAutomatic@0
NtMapUserPhysicalPages@12
NtMapUserPhysicalPagesScatter@12
NtNotifyChangeMultipleKeys@48
NtOpenJobObject@12
NtQueryDefaultUILanguage@4
NtQueryInformationJobObject@20
NtQueryInstallUILanguage@4
NtQueryOpenSubKeys@8
NtQueryQuotaInformationFile@36
NtReplyWaitReceivePortEx@20
NtRequestDeviceWakeup@4 ; removed in Windows 7
NtResetWriteWatch@12
NtSaveMergedKeys@12
NtSecureConnectPort@36
NtSetDefaultUILanguage@4
NtSetInformationJobObject@16
NtSetQuotaInformationFile@16
NtSetThreadExecutionState@8
NtSetUuidSeed@4
NtTerminateJobObject@8
RtlAddAccessAllowedAceEx@20
RtlAddAccessAllowedObjectAce@28
RtlAddAccessDeniedAceEx@20
RtlAddAccessDeniedObjectAce@28
RtlAddAuditAccessAceEx@28
RtlAddAuditAccessObjectAce@36
RtlAddRange@36 ; removed in Windows Server 2003
RtlCallbackLpcClient@12 ; removed in Windows XP
RtlCancelTimer@8
RtlCheckForOrphanedCriticalSections@4
RtlConvertToAutoInheritSecurityObject@24
RtlCopyRangeList@8 ; removed in Windows Server 2003
RtlCreateLpcServer@24 ; removed in Windows XP
RtlCreateTimer@28
RtlCreateTimerQueue@4
RtlDebugPrintTimes@0
RtlDefaultNpAcl@4
RtlDeleteOwnersRanges@8 ; removed in Windows Server 2003
RtlDeleteRange@24 ; removed in Windows Server 2003
RtlDeleteTimer@12
RtlDeleteTimerQueue@4
RtlDeleteTimerQueueEx@8
RtlDeregisterWait@4
RtlDeregisterWaitEx@8
RtlDnsHostNameToComputerName@12
RtlEnableEarlyCriticalSectionEventCreation@0
RtlFindLastBackwardRunClear@12
RtlFindLeastSignificantBit@8
RtlFindMostSignificantBit@8
RtlFindNextForwardRunClear@12
RtlFindRange@48 ; removed in Windows Server 2003
; RtlFreeRangeList@4 ; removed in Windows Server 2003
RtlGUIDFromString@8
RtlGetFirstRange@12 ; removed in Windows Server 2003
RtlGetNextRange@12 ; removed in Windows Server 2003
RtlGetSecurityDescriptorRMControl@8
RtlGetVersion@4
RtlImpersonateLpcClient@8 ; removed in Windows XP
; RtlInitializeRangeList@4 ; removed in Windows Server 2003
RtlInt64ToUnicodeString@16
RtlInvertRangeList@8 ; removed in Windows Server 2003
RtlIsRangeAvailable@40 ; removed in Windows Server 2003
RtlMergeRangeLists@16 ; removed in Windows Server 2003
RtlNewSecurityObjectEx@32
RtlQueueWorkItem@12
RtlRegisterWait@24
RtlSelfRelativeToAbsoluteSD2@8
RtlSetControlSecurityDescriptor@12
RtlSetIoCompletionCallback@12
RtlSetSecurityDescriptorRMControl@8
RtlSetSecurityObjectEx@24
RtlSetThreadPoolStartFunc@8
RtlSetTimer@28
RtlShutdownLpcServer@4 ; removed in Windows XP
RtlStringFromGUID@8
@RtlUlongByteSwap@4 ; fastcall
@RtlUlonglongByteSwap@8 ; fastcall
RtlUpdateTimer@16
@RtlUshortByteSwap@4 ; fastcall
RtlValidRelativeSecurityDescriptor@12
RtlVerifyVersionInfo@16
RtlWalkFrameChain@12
VerSetConditionMask@16
ZwAccessCheckByType@44
ZwAccessCheckByTypeAndAuditAlarm@64
ZwAccessCheckByTypeResultList@44
ZwAccessCheckByTypeResultListAndAuditAlarm@64
ZwAccessCheckByTypeResultListAndAuditAlarmByHandle@68
ZwAllocateUserPhysicalPages@12
ZwAreMappedFilesTheSame@8
ZwAssignProcessToJobObject@8
ZwCancelDeviceWakeupRequest@4 ; removed in Windows 7
ZwCreateJobObject@12
ZwCreateWaitablePort@20
ZwFilterToken@24
ZwFreeUserPhysicalPages@12
ZwGetDevicePowerState@8
ZwGetWriteWatch@28
ZwImpersonateAnonymousToken@4
ZwInitiatePowerAction@16
ZwIsSystemResumeAutomatic@0
ZwMapUserPhysicalPages@12
ZwMapUserPhysicalPagesScatter@12
ZwNotifyChangeMultipleKeys@48
ZwOpenJobObject@12
ZwPowerInformation@20
ZwQueryDefaultUILanguage@4
ZwQueryInformationJobObject@20
ZwQueryInstallUILanguage@4
ZwQueryOpenSubKeys@8
ZwQueryQuotaInformationFile@36
ZwReplyWaitReceivePortEx@20
ZwRequestDeviceWakeup@4 ; removed in Windows 7
ZwRequestWakeupLatency@4 ; removed in Windows 7
ZwResetWriteWatch@12
ZwSaveMergedKeys@12
ZwSecureConnectPort@36
ZwSetDefaultUILanguage@4
ZwSetInformationJobObject@16
ZwSetQuotaInformationFile@16
ZwSetThreadExecutionState@8
ZwSetUuidSeed@4
ZwTerminateJobObject@8

; This is list of symbols added in Windows 2000 SP1
RtlTraceDatabaseAdd@16
RtlTraceDatabaseCreate@20
RtlTraceDatabaseDestroy@4
RtlTraceDatabaseEnumerate@12
RtlTraceDatabaseFind@16
RtlTraceDatabaseLock@4
RtlTraceDatabaseUnlock@4
RtlTraceDatabaseValidate@4

; In Windows 2000 SP2 was not added any new symbol

; In Windows 2000 SP3 was not added any new symbol

; In Windows 2000 SP4 was not added any new symbol

; This is list of symbols added in Windows XP
CsrCaptureMessageMultiUnicodeStringsInPlace@12
CsrGetProcessId@0
DbgPrintEx ; cdecl
DbgQueryDebugFilterState@8
DbgSetDebugFilterState@12
DbgUiConvertStateChangeStructure@8
DbgUiDebugActiveProcess@4
DbgUiGetThreadDebugObject@0
DbgUiIssueRemoteBreakin@4
DbgUiRemoteBreakin@4
DbgUiSetThreadDebugObject@4
DbgUiStopDebugging@4
; LdrAccessOutOfProcessResource@20 ; removed in Windows Vista
LdrAddRefDll@8
; LdrCreateOutOfProcessImage@20 ; Windows XP has ABI "LdrCreateOutOfProcessImage@16", Windows Server 2003 has ABI "LdrCreateOutOfProcessImage@20", removed in Windows Vista
; LdrDestroyOutOfProcessImage@4 ; removed in Windows Vista
; LdrFindCreateProcessManifest@20 ; removed in Windows Vista
LdrFindResourceEx_U@20
LdrGetDllHandleEx@20
LdrInitShimEngineDynamic@4 ; Windows XP-7 has ABI "LdrInitShimEngineDynamic@4", Windows 8 an new has ABI "LdrInitShimEngineDynamic@8"
LdrLockLoaderLock@12
LdrSetAppCompatDllRedirectionCallback@12
LdrSetDllManifestProber@4 ; Windows XP-Vista has ABI "LdrSetDllManifestProber@4", Windows 7 an new has ABI "LdrSetDllManifestProber@12"
LdrUnlockLoaderLock@8
NtAddBootEntry@8
NtCompactKeys@8
NtCompareTokens@12
NtCompressKey@4
NtCreateDebugObject@16
NtCreateJobSet@12
NtCreateKeyedEvent@16
NtCreateProcessEx@36
NtDebugActiveProcess@8
NtDebugContinue@12
NtDeleteBootEntry@4
NtEnumerateBootEntries@8
NtEnumerateSystemEnvironmentValuesEx@12
NtIsProcessInJob@8
NtLockProductActivationKeys@8
NtLockRegistryKey@4
NtMakePermanentObject@4
NtModifyBootEntry@4
NtOpenKeyedEvent@12
NtOpenProcessTokenEx@16
NtOpenThreadTokenEx@20
NtQueryBootEntryOrder@8
NtQueryBootOptions@8
NtQueryDebugFilterState@8
NtQueryPortInformationProcess@0
NtQuerySystemEnvironmentValueEx@20
NtReleaseKeyedEvent@16
NtRemoveProcessDebug@8
NtRenameKey@8
NtResumeProcess@4
NtSaveKeyEx@12
NtSetBootEntryOrder@8
NtSetBootOptions@8
NtSetDebugFilterState@12
NtSetEventBoostPriority@4
NtSetInformationDebugObject@20
NtSetSystemEnvironmentValueEx@20
NtSuspendProcess@4
NtTraceEvent@16
NtTranslateFilePath@16
NtUnloadKeyEx@8
NtWaitForDebugEvent@16
NtWaitForKeyedEvent@16
RtlActivateActivationContext@12
RtlActivateActivationContextEx@16
@RtlActivateActivationContextUnsafeFast@8 ; fastcall
RtlAddRefActivationContext@4
RtlAddRefMemoryStream@4 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version
RtlAddVectoredExceptionHandler@8
RtlAddressInSectionTable@12
RtlAppendPathElement@12
RtlApplicationVerifierStop@40
; RtlAssert2@20 ; removed in Windows Server 2003
RtlCaptureContext@4
RtlCaptureStackContext@12
; RtlCheckProcessParameters@16 ; removed in Windows Vista
RtlCloneMemoryStream@8 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version
RtlCommitMemoryStream@8 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version
RtlComputeCrc32@12
RtlComputeImportTableHash@12
RtlComputePrivatizedDllName_U@12
RtlCopyMemoryStreamTo@24 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version
RtlCopyOutOfProcessMemoryStreamTo@24 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version
RtlCreateActivationContext@24
RtlCreateBootStatusDataFile@4 ; Windows XP-2003 has ABI "RtlCreateBootStatusDataFile@0", Windows Vista and new has ABI "RtlCreateBootStatusDataFile@4"
RtlCreateSystemVolumeInformationFolder@4
RtlDeactivateActivationContext@8
@RtlDeactivateActivationContextUnsafeFast@4 ; fastcall
RtlDeleteElementGenericTableAvl@8
RtlDllShutdownInProgress@0
RtlDosApplyFileIsolationRedirection_Ustr@36
RtlDosSearchPath_Ustr@36
RtlDowncaseUnicodeChar@4
RtlDuplicateUnicodeString@12
RtlEnumerateGenericTableAvl@8
RtlEnumerateGenericTableLikeADirectory@28
RtlEnumerateGenericTableWithoutSplayingAvl@8
RtlExitUserThread@4
RtlFinalReleaseOutOfProcessMemoryStream@4 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version
RtlFindActivationContextSectionGuid@20
RtlFindActivationContextSectionString@20
RtlFindCharInUnicodeString@16
RtlFindClearRuns@16
RtlFirstEntrySList@4
RtlFlushSecureMemoryCache@8
RtlFreeThreadActivationContextStack@0
RtlGetActiveActivationContext@4
RtlGetCurrentPeb@0
RtlGetElementGenericTableAvl@8
RtlGetFrame@0
RtlGetLastNtStatus@0
RtlGetLastWin32Error@0
RtlGetLengthWithoutLastFullDosOrNtPathElement@12
RtlGetLengthWithoutTrailingPathSeperators@12
RtlGetNativeSystemInformation@16
RtlGetNtVersionNumbers@12
RtlGetSetBootStatusData@24
RtlHashUnicodeString@16
RtlInitMemoryStream@4 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version
RtlInitOutOfProcessMemoryStream@4 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version
RtlInitUnicodeStringEx@8
RtlInitializeGenericTableAvl@20
RtlInitializeSListHead@4
RtlInsertElementGenericTableAvl@16
RtlInterlockedFlushSList@4
RtlInterlockedPopEntrySList@4
RtlInterlockedPushEntrySList@8
@RtlInterlockedPushListSList@16 ; fastcall
RtlIpv4AddressToStringA@8
RtlIpv4AddressToStringW@8
RtlIpv4StringToAddressA@16
RtlIpv4StringToAddressW@16
RtlIpv6AddressToStringA@8
RtlIpv6AddressToStringW@8
RtlIpv6StringToAddressA@12
RtlIpv6StringToAddressW@12
RtlIsActivationContextActive@4
RtlIsGenericTableEmptyAvl@4
RtlLockBootStatusData@4
RtlLockMemoryStreamRegion@24 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version
RtlLogStackBackTrace@0
RtlLookupElementGenericTableAvl@8
RtlMapSecurityErrorToNtStatus@4
RtlMultiAppendUnicodeStringBuffer@12
RtlNewSecurityObjectWithMultipleInheritance@36
RtlNtPathNameToDosPathName@16
RtlNtStatusToDosErrorNoTeb@4
RtlNumberGenericTableElementsAvl@4
RtlPopFrame@4
RtlPushFrame@4
RtlQueryDepthSList@4
RtlQueryHeapInformation@20
RtlQueryInformationActivationContext@28
RtlQueryInformationActiveActivationContext@16
RtlQueryInterfaceMemoryStream@12 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version
RtlQueueApcWow64Thread@20
RtlRandomEx@4
RtlReadMemoryStream@16 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version
RtlReadOutOfProcessMemoryStream@16 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version
RtlRegisterSecureMemoryCacheCallback@4
RtlReleaseActivationContext@4
RtlReleaseMemoryStream@4 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version
RtlRemoveVectoredExceptionHandler@4
RtlRestoreLastWin32Error@4
RtlRevertMemoryStream@4 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version
RtlSeekMemoryStream@20 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version
RtlSetHeapInformation@16
RtlSetLastWin32Error@4
RtlSetLastWin32ErrorAndNtStatusFromNtStatus@4
RtlSetMemoryStreamSize@12 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version
RtlSetProcessIsCritical ; cdecl
RtlSetThreadIsCritical ; cdecl
RtlStatMemoryStream@12 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version
RtlUnhandledExceptionFilter2@8
RtlUnhandledExceptionFilter@4
RtlUnlockBootStatusData@4
RtlUnlockMemoryStreamRegion@24 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version
RtlValidateUnicodeString@8
RtlWriteMemoryStream@16 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version
RtlZombifyActivationContext@4
RtlpApplyLengthFunction@16
RtlpEnsureBufferSize@12
RtlpNotOwnerCriticalSection@4
ZwAddBootEntry@8
ZwCompactKeys@8
ZwCompareTokens@12
ZwCompressKey@4
ZwCreateDebugObject@16
ZwCreateJobSet@12
ZwCreateKeyedEvent@16
ZwCreateProcessEx@36
ZwDebugActiveProcess@8
ZwDebugContinue@12
ZwDeleteBootEntry@4
ZwEnumerateBootEntries@8
ZwEnumerateSystemEnvironmentValuesEx@12
ZwIsProcessInJob@8
ZwLockProductActivationKeys@8
ZwLockRegistryKey@4
ZwMakePermanentObject@4
ZwModifyBootEntry@4
ZwOpenKeyedEvent@12
ZwOpenProcessTokenEx@16
ZwOpenThreadTokenEx@20
ZwQueryBootEntryOrder@8
ZwQueryBootOptions@8
ZwQueryDebugFilterState@8
ZwQueryPortInformationProcess@0
ZwQuerySystemEnvironmentValueEx@20
ZwReleaseKeyedEvent@16
ZwRemoveProcessDebug@8
ZwRenameKey@8
ZwResumeProcess@4
ZwSaveKeyEx@12
ZwSetBootEntryOrder@8
ZwSetBootOptions@8
ZwSetDebugFilterState@12
ZwSetEventBoostPriority@4
ZwSetInformationDebugObject@20
ZwSetSystemEnvironmentValueEx@20
ZwSuspendProcess@4
ZwTraceEvent@16
ZwTranslateFilePath@16
ZwUnloadKeyEx@8
ZwWaitForDebugEvent@16
ZwWaitForKeyedEvent@16
vDbgPrintEx@16
vDbgPrintExWithPrefix@20

; This is list of symbols added in Windows XP SP1
LdrEnumerateLoadedModules@12
RtlIsThreadWithinLoaderCallout@0

; This is list of symbols added in Windows XP SP2
LdrHotPatchRoutine@0 ; removed in Windows 8.1
RtlGetUnloadEventTrace@0
RtlIpv4AddressToStringExA@16
RtlIpv4AddressToStringExW@16
RtlIpv4StringToAddressExA@16
RtlIpv4StringToAddressExW@16
RtlIpv6AddressToStringExA@20
RtlIpv6AddressToStringExW@20
RtlIpv6StringToAddressExA@16
RtlIpv6StringToAddressExW@16

; This is list of symbols added in Windows XP SP2 and in Windows Server 2003 SP1 (not available in 2003 without SP1)
KiFastSystemCall@0
KiFastSystemCallRet@0
KiIntSystemCall@0
RtlDecodePointer@4
RtlDecodeSystemPointer@4
RtlEncodePointer@4
RtlEncodeSystemPointer@4

; In Windows XP SP3 was not added any new symbol

; This is list of symbols added in Windows Server 2003
; EtwControlTraceA@20 ; removed in Windows Vista
; EtwControlTraceW@20 ; removed in Windows Vista
EtwCreateTraceInstanceId@8
; EtwEnableTrace@24 ; removed in Windows Vista
; EtwEnumerateTraceGuids@12 ; removed in Windows Vista
; EtwFlushTraceA@16 ; removed in Windows Vista
; EtwFlushTraceW@16 ; removed in Windows Vista
EtwGetTraceEnableFlags@8
EtwGetTraceEnableLevel@8
EtwGetTraceLoggerHandle@4
; EtwNotificationRegistrationA@20 ; removed in Windows Vista
; EtwNotificationRegistrationW@20 ; removed in Windows Vista
; EtwQueryAllTracesA@12 ; removed in Windows Vista
; EtwQueryAllTracesW@12 ; removed in Windows Vista
; EtwQueryTraceA@16 ; removed in Windows Vista
; EtwQueryTraceW@16 ; removed in Windows Vista
; EtwReceiveNotificationsA@16 ; removed in Windows Vista
; EtwReceiveNotificationsW@16 ; removed in Windows Vista
EtwRegisterTraceGuidsA@32
EtwRegisterTraceGuidsW@32
; EtwStartTraceA@12 ; removed in Windows Vista
; EtwStartTraceW@12 ; removed in Windows Vista
; EtwStopTraceA@16 ; removed in Windows Vista
; EtwStopTraceW@16 ; removed in Windows Vista
; EtwTraceEvent@12 ; removed in Windows Vista
EtwTraceEventInstance@20
EtwTraceMessage ; cdecl
EtwTraceMessageVa@24
EtwUnregisterTraceGuids@8
; EtwUpdateTraceA@16 ; removed in Windows Vista
; EtwUpdateTraceW@16 ; removed in Windows Vista
; EtwpGetTraceBuffer@16 ; removed in Windows Vista
; EtwpSetHWConfigFunction@8 ; removed in Windows Vista
LdrQueryImageFileExecutionOptionsEx@28
NtAddDriverEntry@8
NtApphelpCacheControl@8
NtDeleteDriverEntry@4
NtEnumerateDriverEntries@8
NtGetCurrentProcessorNumber@0
NtGetTickCount@0
NtLoadKeyEx@32 ; Windows Server 2003 has ABI "NtLoadKeyEx@16", Windows Vista and new has ABI "NtLoadKeyEx@32"
NtModifyDriverEntry@4
NtQueryDriverEntryOrder@8
NtQueryOpenSubKeysEx@16
NtSetDriverEntryOrder@8
NtUnloadKey2@8
RtlCopyMappedMemory@12
RtlDosPathNameToRelativeNtPathName_U@16
RtlGetFullPathName_UstrEx@32
RtlGetThreadErrorMode@0
RtlImageNtHeaderEx@20
RtlInitAnsiStringEx@8
RtlInsertElementGenericTableFull@24
RtlInsertElementGenericTableFullAvl@24
RtlInterlockedCompareExchange64@20
RtlLookupElementGenericTableFull@16
RtlLookupElementGenericTableFullAvl@16
RtlMultipleAllocateHeap@20
RtlMultipleFreeHeap@16
RtlReleaseRelativeName@4
RtlSetEnvironmentStrings@8
RtlSetThreadErrorMode@8
RtlWow64EnableFsRedirection@4
ZwAddDriverEntry@8
ZwApphelpCacheControl@8
ZwDeleteDriverEntry@4
ZwEnumerateDriverEntries@8
ZwGetCurrentProcessorNumber@0
ZwLoadKeyEx@32 ; Windows Server 2003 has ABI "ZwLoadKeyEx@16", Windows Vista and new has ABI "ZwLoadKeyEx@32"
ZwModifyDriverEntry@4
ZwQueryDriverEntryOrder@8
ZwQueryOpenSubKeysEx@16
ZwSetDriverEntryOrder@8
ZwUnloadKey2@8

; This is list of symbols added in Windows Server 2003 SP1 and Windows XP x64 SP1 (WoW64 version)
ExpInterlockedPopEntrySListEnd@0 ; removed in Windows 10 November Update (Threshold 2 / 1511) WoW64 version, but available in non-WoW64 version
ExpInterlockedPopEntrySListFault@0 ; removed in Windows 10 November Update (Threshold 2 / 1511) WoW64 version, but available in non-WoW64 version
ExpInterlockedPopEntrySListResume@0 ; removed in Windows 10 November Update (Threshold 2 / 1511) WoW64 version, but available in non-WoW64 version
LdrOpenImageFileOptionsKey@12
LdrQueryImageFileKeyOption@24
NtWaitForMultipleObjects32@20
NtWow64CsrAllocateCaptureBuffer@8 ; available only in 32-bit WoW64 version on 64-bit system
NtWow64CsrAllocateMessagePointer@12 ; available only in 32-bit WoW64 version on 64-bit system
NtWow64CsrCaptureMessageBuffer@16 ; available only in 32-bit WoW64 version on 64-bit system
NtWow64CsrCaptureMessageString@20 ; available only in 32-bit WoW64 version on 64-bit system
NtWow64CsrClientCallServer@16 ; available only in 32-bit WoW64 version on 64-bit system
NtWow64CsrClientConnectToServer@20 ; available only in 32-bit WoW64 version on 64-bit system
NtWow64CsrFreeCaptureBuffer@4 ; available only in 32-bit WoW64 version on 64-bit system
NtWow64CsrGetProcessId@0 ; available only in 32-bit WoW64 version on 64-bit system
NtWow64CsrIdentifyAlertableThread@0 ; available only in 32-bit WoW64 version on 64-bit system
; NtWow64CsrNewThread@0 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 7
; NtWow64CsrSetPriorityClass@8 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 7
NtWow64DebuggerCall@20 ; available only in 32-bit WoW64 version on 64-bit system
NtWow64GetNativeSystemInformation@16 ; available only in 32-bit WoW64 version on 64-bit system
NtWow64QueryInformationProcess64@20 ; available only in 32-bit WoW64 version on 64-bit system
NtWow64QueryVirtualMemory64@32 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 10 (Threshold / 1507)
NtWow64ReadVirtualMemory64@28 ; available only in 32-bit WoW64 version on 64-bit system
RtlAcquirePrivilege@16
RtlAddVectoredContinueHandler@8
RtlAllocateActivationContextStack@4
RtlDosPathNameToNtPathName_U_WithStatus@16
RtlDosPathNameToRelativeNtPathName_U_WithStatus@16
RtlFormatMessageEx@40
RtlFreeActivationContextStack@4
RtlGetCriticalSectionRecursionCount@4
RtlGetCurrentProcessorNumber@0
RtlIsCriticalSectionLocked@4
RtlIsCriticalSectionLockedByThread@4
RtlReleasePrivilege@4
RtlRemoveVectoredContinueHandler@4
RtlSetUnhandledExceptionFilter@4
RtlWow64EnableFsRedirectionEx@8
ZwWaitForMultipleObjects32@20
ZwWow64CsrAllocateCaptureBuffer@8 ; available only in 32-bit WoW64 version on 64-bit system
ZwWow64CsrAllocateMessagePointer@12 ; available only in 32-bit WoW64 version on 64-bit system
ZwWow64CsrCaptureMessageBuffer@16 ; available only in 32-bit WoW64 version on 64-bit system
ZwWow64CsrCaptureMessageString@20 ; available only in 32-bit WoW64 version on 64-bit system
ZwWow64CsrClientCallServer@16 ; available only in 32-bit WoW64 version on 64-bit system
ZwWow64CsrClientConnectToServer@20 ; available only in 32-bit WoW64 version on 64-bit system
ZwWow64CsrFreeCaptureBuffer@4 ; available only in 32-bit WoW64 version on 64-bit system
ZwWow64CsrGetProcessId@0 ; available only in 32-bit WoW64 version on 64-bit system
ZwWow64CsrIdentifyAlertableThread@0 ; available only in 32-bit WoW64 version on 64-bit system
; ZwWow64CsrNewThread@0 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 7
; ZwWow64CsrSetPriorityClass@8 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 7
ZwWow64DebuggerCall@20 ; available only in 32-bit WoW64 version on 64-bit system
ZwWow64GetNativeSystemInformation@16 ; available only in 32-bit WoW64 version on 64-bit system
ZwWow64QueryInformationProcess64@20 ; available only in 32-bit WoW64 version on 64-bit system
ZwWow64QueryVirtualMemory64@32 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 10 (Threshold / 1507)
ZwWow64ReadVirtualMemory64@28 ; available only in 32-bit WoW64 version on 64-bit system

; In Windows Server 2003 SP2 and Windows XP x64 SP2 (WoW64 version) was not added any new symbol

; This is list of symbols added in Windows Vista
A_SHAFinal@8
A_SHAInit@4
A_SHAUpdate@12
AlpcAdjustCompletionListConcurrencyCount@8
AlpcFreeCompletionListMessage@8
AlpcGetCompletionListLastMessageInformation@12
AlpcGetCompletionListMessageAttributes@8
AlpcGetHeaderSize@4
AlpcGetMessageAttribute@8
AlpcGetMessageFromCompletionList@8
AlpcGetOutstandingCompletionListMessageCount@4
AlpcInitializeMessageAttribute@16
AlpcMaxAllowedMessageLength@0
AlpcRegisterCompletionList@20
AlpcRegisterCompletionListWorkerThread@4
AlpcUnregisterCompletionList@4
AlpcUnregisterCompletionListWorkerThread@4
CsrVerifyRegion@8
EtwDeliverDataBlock@4
EtwEnumerateProcessRegGuids@12
EtwEventActivityIdControl@8
EtwEventEnabled@12
EtwEventProviderEnabled@20
EtwEventRegister@16
EtwEventUnregister@8
EtwEventWrite@20
EtwEventWriteEndScenario@20
EtwEventWriteFull@32
EtwEventWriteStartScenario@20
EtwEventWriteString@24
EtwEventWriteTransfer@28
EtwLogTraceEvent@12
EtwNotificationRegister@20
EtwNotificationUnregister@12
EtwProcessPrivateLoggerRequest@4
EtwRegisterSecurityProvider@0
EtwReplyNotification@4
EtwSendNotification@20
EtwSetMark@16
EtwWriteUMSecurityEvent@16
EtwpCreateEtwThread@8
EtwpGetCpuSpeed@8 ; Windows Vista-8 has ABI "EtwpGetCpuSpeed@8", Windows 8.1 and new has ABI "EtwpGetCpuSpeed@4"
; EtwpNotificationThread@0 ; removed in Windows 8.1
LdrAddLoadAsDataTable@16 ; Windows Vista has ABI "LdrAddLoadAsDataTable@16", Windows 7 and new has ABI "LdrAddLoadAsDataTable@20"
LdrGetFailureData@0
LdrGetFileNameFromLoadAsDataTable@8
LdrGetProcedureAddressEx@20
LdrLoadAlternateResourceModuleEx@20
LdrQueryModuleServiceTags@12
LdrRegisterDllNotification@16
LdrRemoveLoadAsDataTable@16
LdrResFindResource@36
LdrResFindResourceDirectory@28
LdrResRelease@12
LdrResSearchResource@32
LdrSetMUICacheType@4
LdrUnloadAlternateResourceModuleEx@8
LdrUnregisterDllNotification@4
LdrVerifyImageMatchesChecksumEx@8
MD4Final@4
MD4Init@4
MD4Update@12
MD5Final@4
MD5Init@4
MD5Update@12
NtAcquireCMFViewOwnership@12 ; removed in Windows 7
NtAlpcAcceptConnectPort@36
NtAlpcCancelMessage@12
NtAlpcConnectPort@44
NtAlpcCreatePort@12
NtAlpcCreatePortSection@24
NtAlpcCreateResourceReserve@16
NtAlpcCreateSectionView@12
NtAlpcCreateSecurityContext@12
NtAlpcDeletePortSection@12
NtAlpcDeleteResourceReserve@12
NtAlpcDeleteSectionView@12
NtAlpcDeleteSecurityContext@12
NtAlpcDisconnectPort@8
NtAlpcImpersonateClientOfPort@12
NtAlpcOpenSenderProcess@24
NtAlpcOpenSenderThread@24
NtAlpcQueryInformation@20
NtAlpcQueryInformationMessage@24
NtAlpcRevokeSecurityContext@12
NtAlpcSendWaitReceivePort@32
NtAlpcSetInformation@16
NtCancelIoFileEx@12
NtCancelSynchronousIoFile@12
; NtClearAllSavepointsTransaction@4 ; removed in Windows Vista SP1
; NtClearSavepointTransaction@8 ; removed in Windows Vista SP1
NtCommitComplete@8
NtCommitEnlistment@8
NtCommitTransaction@8
NtCreateEnlistment@32
NtCreateKeyTransacted@32
NtCreatePrivateNamespace@16
NtCreateResourceManager@28
NtCreateThreadEx@44
NtCreateTransaction@40
NtCreateTransactionManager@24
NtCreateUserProcess@44
NtCreateWorkerFactory@40
NtDeletePrivateNamespace@4
NtEnumerateTransactionObject@20
NtFlushInstallUILanguage@8
NtFlushProcessWriteBuffers@0
NtFreezeRegistry@4
NtFreezeTransactions@8
NtGetMUIRegistryInfo@12
NtGetNextProcess@20
NtGetNextThread@24
NtGetNlsSectionPtr@20
NtGetNotificationResourceManager@28
NtInitializeNlsFiles@16 ; Windows Vista has ABI "NtInitializeNlsFiles@12", Windows Vista SP1 and SP2 has ABI "NtInitializeNlsFiles@16", Windows 7 and new has again ABI "NtInitializeNlsFiles@12"
NtIsUILanguageComitted@0
; NtListTransactions@12 ; removed in Windows Vista SP1
NtMapCMFModule@24
; NtMarshallTransaction@24 ; removed in Windows Vista SP1
NtOpenEnlistment@20
NtOpenKeyTransacted@16
NtOpenPrivateNamespace@16
NtOpenResourceManager@20
NtOpenSession@12
NtOpenTransaction@20
NtOpenTransactionManager@24
NtPrePrepareComplete@8
NtPrePrepareEnlistment@8
NtPrepareComplete@8
NtPrepareEnlistment@8
NtPropagationComplete@16
NtPropagationFailed@12
; NtPullTransaction@28 ; removed in Windows Vista SP1
NtQueryInformationEnlistment@20
NtQueryInformationResourceManager@20
NtQueryInformationTransaction@20
NtQueryInformationTransactionManager@20
NtQueryInformationWorkerFactory@20
NtQueryLicenseValue@20
NtReadOnlyEnlistment@8
NtRecoverEnlistment@8
NtRecoverResourceManager@4
NtRecoverTransactionManager@4
NtRegisterProtocolAddressInformation@20
NtReleaseCMFViewOwnership@0 ; removed in Windows 7
NtReleaseWorkerFactoryWorker@4
NtRemoveIoCompletionEx@24
NtRollbackComplete@8
NtRollbackEnlistment@8
; NtRollbackSavepointTransaction@8 ; removed in Windows Vista SP1
NtRollbackTransaction@8
NtRollforwardTransactionManager@8
; NtSavepointComplete@8 ; removed in Windows Vista SP1
; NtSavepointTransaction@12 ; removed in Windows Vista SP1
NtSetInformationEnlistment@16
NtSetInformationResourceManager@16
NtSetInformationTransaction@16
NtSetInformationTransactionManager@16
NtSetInformationWorkerFactory@16
NtShutdownWorkerFactory@8
NtSinglePhaseReject@8
; NtStartTm@0 ; removed in Windows Vista SP1
NtThawRegistry@0
NtThawTransactions@0
NtTraceControl@24
NtWaitForWorkViaWorkerFactory@8 ; Windows Vista-7 has ABI "NtWaitForWorkViaWorkerFactory@8", Windows 8 has ABI "NtWaitForWorkViaWorkerFactory@16", Windows 8.1 and new has ABI "NtWaitForWorkViaWorkerFactory@20"
NtWorkerFactoryWorkerReady@4
NtWow64CallFunction64@28 ; available only in 32-bit WoW64 version on 64-bit system
NtWow64CsrVerifyRegion@8 ; available only in 32-bit WoW64 version on 64-bit system
NtWow64WriteVirtualMemory64@28 ; available only in 32-bit WoW64 version on 64-bit system
; ResCCloseRuntimeView@4 ; removed in Windows Vista SP1
; ResCCompareCacheIDs@8 ; removed in Windows Vista SP1
; ResCCreateCultureMap@12 ; removed in Windows Vista SP1
; ResCCreateDefaultCultureMap@4 ; removed in Windows Vista SP1
; ResCCreateRuntimeView@16 ; removed in Windows Vista SP1
; ResCDirectoryCreateAndPopulate@12 ; removed in Windows Vista SP1
; ResCDirectoryCreateMapping@16 ; removed in Windows Vista SP1
; ResCDirectoryFree@4 ; removed in Windows Vista SP1
; ResCDirectoryGetBaseFolder@4 ; removed in Windows Vista SP1
; ResCDirectoryGetEntry@24 ; removed in Windows Vista SP1
; ResCDirectoryGetEntryCopy@28 ; removed in Windows Vista SP1
; ResCDirectoryGetEntryEx@32 ; removed in Windows Vista SP1
; ResCDirectoryGetEntryExCopy@36 ; removed in Windows Vista SP1
; ResCDirectoryGetEntryIndex@24 ; removed in Windows Vista SP1
; ResCDirectoryGetEntryIndexEx@32 ; removed in Windows Vista SP1
; ResCDirectoryGetFirstEntry@20 ; removed in Windows Vista SP1
; ResCDirectoryGetFirstEntryIndex@20 ; removed in Windows Vista SP1
; ResCDirectoryGetSegmentIndex@8 ; removed in Windows Vista SP1
; ResCDirectoryGetSegmentName@8 ; removed in Windows Vista SP1
; ResCDirectoryLoadFixedSize@4 ; removed in Windows Vista SP1
; ResCDirectoryOpenMapping@8 ; removed in Windows Vista SP1
; ResCFreeCultureMap@4 ; removed in Windows Vista SP1
; ResCGetCacheIndices@16 ; removed in Windows Vista SP1
; ResCGetCultureID@8 ; removed in Windows Vista SP1
; ResCGetCultureIndex@8 ; removed in Windows Vista SP1
; ResCGetCultureName@16 ; removed in Windows Vista SP1
; ResCGetHighestCacheIndex@4 ; removed in Windows Vista SP1
; ResCGetHighestConsecutiveCacheIndex@12 ; removed in Windows Vista SP1
; ResCGetIndexedName@20 ; removed in Windows Vista SP1
; ResCGetName@16 ; removed in Windows Vista SP1
; ResCGetRegistryBaseFolder@16 ; removed in Windows Vista SP1
; ResCGetRegistryConfig@8 ; removed in Windows Vista SP1
; ResCGetRegistryLatestIndex@8 ; removed in Windows Vista SP1
; ResCGetRegistryMappingPrefix@16 ; removed in Windows Vista SP1
; ResCGetRegistryStatus@8 ; removed in Windows Vista SP1
; ResCGetSubIndexedName@24 ; removed in Windows Vista SP1
; ResCInitRuntimeView@8 ; removed in Windows Vista SP1
; ResCInitRuntimeViewEx@12 ; removed in Windows Vista SP1
; ResCKeDirectoryOpenMapping@20 ; removed in Windows Vista SP1
; ResCKeGetBaseFolder@8 ; removed in Windows Vista SP1
; ResCKeGetCacheIndices@8 ; removed in Windows Vista SP1
; ResCKeInitRuntimeViewEx@4 ; removed in Windows Vista SP1
; ResCKeSegmentOpenMapping@8 ; removed in Windows Vista SP1
; ResCLoadCultureMap@4 ; removed in Windows Vista SP1
; ResCOpenRegistryKey@24 ; removed in Windows Vista SP1
; ResCOpenRuntimeView@8 ; removed in Windows Vista SP1
; ResCReleaseInitMutex@4 ; removed in Windows Vista SP1
; ResCReloadCultureMap@4 ; removed in Windows Vista SP1
; ResCRequestInitMutex@8 ; removed in Windows Vista SP1
; ResCRuntimeGetAnySegmentData@20 ; removed in Windows Vista SP1
; ResCRuntimeGetCultureID@8 ; removed in Windows Vista SP1
; ResCRuntimeGetEntryData@8 ; removed in Windows Vista SP1
; ResCRuntimeGetEntryDataEx@12 ; removed in Windows Vista SP1
; ResCRuntimeGetResourceData@32 ; removed in Windows Vista SP1
; ResCRuntimeGetResourceDataEx@36 ; removed in Windows Vista SP1
; ResCRuntimeGetResourceDataForCulture@32 ; removed in Windows Vista SP1
; ResCRuntimeGetSegmentData@16 ; removed in Windows Vista SP1
; ResCRuntimeGetSegmentDataEx@20 ; removed in Windows Vista SP1
; ResCRuntimeViewLoadCultureMap@4 ; removed in Windows Vista SP1
; ResCSaveRegistryBaseFolder@8 ; removed in Windows Vista SP1
; ResCSaveRegistryConfig@8 ; removed in Windows Vista SP1
; ResCSaveRegistryLatestIndex@8 ; removed in Windows Vista SP1
; ResCSaveRegistryStatus@8 ; removed in Windows Vista SP1
; ResCSegmentCreateAndPopulate@12 ; removed in Windows Vista SP1
; ResCSegmentCreateMapping@20 ; removed in Windows Vista SP1
; ResCSegmentFree@4 ; removed in Windows Vista SP1
; ResCSegmentGetData@8 ; removed in Windows Vista SP1
; ResCSegmentLoadFixedSize@4 ; removed in Windows Vista SP1
; ResCSegmentOpenMapping@8 ; removed in Windows Vista SP1
; ResCSegmentReserveMapping@16 ; removed in Windows Vista SP1
; ResCSetCacheSecurityType@4 ; removed in Windows Vista SP1
RtlAcquireSRWLockExclusive@4
RtlAcquireSRWLockShared@4
RtlAddMandatoryAce@24
RtlAddSIDToBoundaryDescriptor@8
RtlAllocateMemoryBlockLookaside@12
RtlAllocateMemoryZone@12
RtlBarrier@8
RtlBarrierForDelete@8
RtlCleanUpTEBLangLists@0
RtlCloneUserProcess@20
RtlCmDecodeMemIoResource@8
RtlCmEncodeMemIoResource@24
RtlCommitDebugInfo@8
RtlCompareAltitudes@8
RtlCompareUnicodeStrings@20
RtlConnectToSm@16
RtlConvertLCIDToString@20
RtlCreateBoundaryDescriptor@8
RtlCreateEnvironmentEx@12
RtlCreateMemoryBlockLookaside@20
RtlCreateMemoryZone@12
RtlCreateProcessParametersEx@44
RtlCreateServiceSid@12
RtlCreateUserStack@24
RtlCultureNameToLCID@8
RtlDeCommitDebugInfo@12
RtlDeleteBarrier@4
RtlDeleteBoundaryDescriptor@4
RtlDestroyMemoryBlockLookaside@4
RtlDestroyMemoryZone@4
RtlExitUserProcess@4
RtlExpandEnvironmentStrings@24
RtlExtendMemoryBlockLookaside@8
RtlExtendMemoryZone@8
RtlFindAceByType@12
RtlFindClosestEncodableLength@12
RtlFlsAlloc@8
RtlFlsFree@4
RtlFreeMemoryBlockLookaside@8
RtlFreeUserStack@4
RtlGetCurrentTransaction@0
RtlGetFileMUIPath@28
RtlGetIntegerAtom@8
RtlGetParentLocaleName@16
RtlGetProductInfo@20
RtlGetSystemPreferredUILanguages@20
RtlGetThreadLangIdByIndex@16
RtlGetThreadPreferredUILanguages@16
RtlGetUILanguageInfo@20
RtlGetUnloadEventTraceEx@12
RtlGetUserPreferredUILanguages@20
RtlHeapTrkInitialize@4
RtlIdnToAscii@20
RtlIdnToNameprepUnicode@20
RtlIdnToUnicode@20
RtlImpersonateSelfEx@12
RtlInitBarrier@12
RtlInitializeConditionVariable@4
RtlInitializeCriticalSectionEx@12
RtlInitializeNtUserPfn@24
RtlInitializeSRWLock@4
RtlIoDecodeMemIoResource@16
RtlIoEncodeMemIoResource@40
RtlIsCurrentThreadAttachExempt@0
RtlIsNormalizedString@16
RtlIsValidLocaleName@8
RtlLCIDToCultureName@8
RtlLcidToLocaleName@16
RtlLocaleNameToLcid@12
RtlLockCurrentThread@0
RtlLockMemoryBlockLookaside@4
RtlLockMemoryZone@4
RtlLockModuleSection@4
RtlNormalizeString@20
RtlOwnerAcesPresent@4
RtlProcessFlsData@4 ; Windows Vista-10 has ABI "RtlProcessFlsData@4", Windows 10 May 2019 Update (19H1 / 1903) and new has ABI "RtlProcessFlsData@8"
RtlQueryActivationContextApplicationSettings@28
RtlQueryCriticalSectionOwner@4 ; Windows Vista-8.1 has ABI "RtlQueryCriticalSectionOwner@4", Windows 10 and new has ABI "RtlQueryCriticalSectionOwner@8"
RtlQueryDynamicTimeZoneInformation@4
RtlQueryElevationFlags@4
RtlQueryEnvironmentVariable@24
RtlQueryModuleInformation@12
RtlRegisterThreadWithCsrss@0
RtlReleaseSRWLockExclusive@4
RtlReleaseSRWLockShared@4
RtlRemovePrivileges@12
RtlReportException@12
RtlResetMemoryBlockLookaside@4
RtlResetMemoryZone@4
RtlRetrieveNtUserPfn@12
RtlRunOnceBeginInitialize@12
RtlRunOnceComplete@12
RtlRunOnceExecuteOnce@16
RtlRunOnceInitialize@4
RtlSendMsgToSm@8
RtlSetCurrentTransaction@4
RtlSetDynamicTimeZoneInformation@4
RtlSetEnvironmentVar@20
RtlSetProcessDebugInformation@12
RtlSetThreadPreferredUILanguages@12
RtlSidDominates@12
RtlSidEqualLevel@12
RtlSidHashInitialize@12
RtlSidHashLookup@8
RtlSidIsHigherLevel@12
RtlSleepConditionVariableCS@12
RtlSleepConditionVariableSRW@16
RtlTestBit@8
RtlTryAcquirePebLock@0
RtlUnlockCurrentThread@0
RtlUnlockMemoryBlockLookaside@4
RtlUnlockMemoryZone@4
RtlUnlockModuleSection@4
RtlUpdateClonedCriticalSection@4
RtlUpdateClonedSRWLock@8
RtlUserThreadStart@8
RtlWakeAllConditionVariable@4
RtlWakeConditionVariable@4
RtlWerpReportException@16 ; Windows Vista-8 has ABI "RtlWerpReportException@16", Windows 8.1 and new has ABI "RtlWerpReportException@24"
RtlWow64CallFunction64@28
RtlWow64LogMessageInEventLogger@12 ; available only in 32-bit WoW64 version on 64-bit system
RtlpCleanupRegistryKeys@0
RtlpConvertCultureNamesToLCIDs@8
RtlpConvertLCIDsToCultureNames@8
RtlpCreateProcessRegistryInfo@4
RtlpGetLCIDFromLangInfoNode@12
RtlpGetNameFromLangInfoNode@12
RtlpGetSystemDefaultUILanguage@4 ; Windows Vista has ABI "RtlpGetSystemDefaultUILanguage@4", Windows 7 and new has ABI "RtlpGetSystemDefaultUILanguage@8"
RtlpGetUserOrMachineUILanguage4NLS@12
RtlpInitializeLangRegistryInfo@4
RtlpIsQualifiedLanguage@12
RtlpLoadMachineUIByPolicy@12
RtlpLoadUserUIByPolicy@12
RtlpMuiFreeLangRegistryInfo@4
RtlpMuiRegCreateRegistryInfo@0
RtlpMuiRegFreeRegistryInfo@8
RtlpMuiRegLoadRegistryInfo@8
RtlpQueryDefaultUILanguage@8
RtlpQueryProcessDebugInformationRemote@4 ; available only in 32-bit WoW64 version on 64-bit system, since Windows 10 Creators Update (Redstone 2 / 1703) available also in non-WoW64 version
RtlpRefreshCachedUILanguage@8
RtlpSetInstallLanguage@8
RtlpSetPreferredUILanguages@12
RtlpSetUserPreferredUILanguages@12
RtlpVerifyAndCommitUILanguageSettings@4
ShipAssert@8
ShipAssertGetBufferInfo@8
ShipAssertMsgA@12
ShipAssertMsgW@12
TpAllocAlpcCompletion@20
TpAllocCleanupGroup@4
TpAllocIoCompletion@20
TpAllocPool@8
TpAllocTimer@16
TpAllocWait@16
TpAllocWork@16
TpCallbackLeaveCriticalSectionOnCompletion@8
TpCallbackMayRunLong@4
TpCallbackReleaseMutexOnCompletion@8
TpCallbackReleaseSemaphoreOnCompletion@12
TpCallbackSetEventOnCompletion@8
TpCallbackUnloadDllOnCompletion@8
TpCancelAsyncIoOperation@4
TpCaptureCaller@4
TpCheckTerminateWorker@4
TpDbgDumpHeapUsage@12
TpDbgSetLogRoutine@4
TpDisassociateCallback@4
TpIsTimerSet@4
TpPostWork@4
TpReleaseAlpcCompletion@4
TpReleaseCleanupGroup@4
TpReleaseCleanupGroupMembers@12
TpReleaseIoCompletion@4
TpReleasePool@4
TpReleaseTimer@4
TpReleaseWait@4
TpReleaseWork@4
TpSetPoolMaxThreads@8
TpSetPoolMinThreads@8
TpSetTimer@16
TpSetWait@12
TpSimpleTryPost@12
TpStartAsyncIoOperation@4
TpWaitForAlpcCompletion@4
TpWaitForIoCompletion@8
TpWaitForTimer@8
TpWaitForWait@8
TpWaitForWork@8
WerCheckEventEscalation@8 ; removed in Windows 7
WerReportSQMEvent@16 ; Windows Vista has ABI "WerReportSQMEvent@12", Windows 7 and new has ABI "WerReportSQMEvent@16"
WerReportWatsonEvent@16 ; removed in Windows 7
WinSqmAddToStream@16
WinSqmEndSession@4
WinSqmEventEnabled@8
WinSqmEventWrite@12
WinSqmIsOptedIn@0
WinSqmSetString@12
WinSqmStartSession@12
ZwAcquireCMFViewOwnership@12 ; removed in Windows 7
ZwAlpcAcceptConnectPort@36
ZwAlpcCancelMessage@12
ZwAlpcConnectPort@44
ZwAlpcCreatePort@12
ZwAlpcCreatePortSection@24
ZwAlpcCreateResourceReserve@16
ZwAlpcCreateSectionView@12
ZwAlpcCreateSecurityContext@12
ZwAlpcDeletePortSection@12
ZwAlpcDeleteResourceReserve@12
ZwAlpcDeleteSectionView@12
ZwAlpcDeleteSecurityContext@12
ZwAlpcDisconnectPort@8
ZwAlpcImpersonateClientOfPort@12
ZwAlpcOpenSenderProcess@24
ZwAlpcOpenSenderThread@24
ZwAlpcQueryInformation@20
ZwAlpcQueryInformationMessage@24
ZwAlpcRevokeSecurityContext@12
ZwAlpcSendWaitReceivePort@32
ZwAlpcSetInformation@16
ZwCancelIoFileEx@12
ZwCancelSynchronousIoFile@12
; ZwClearAllSavepointsTransaction@4 ; removed in Windows Vista SP1
; ZwClearSavepointTransaction@8 ; removed in Windows Vista SP1
ZwCommitComplete@8
ZwCommitEnlistment@8
ZwCommitTransaction@8
ZwCreateEnlistment@32
ZwCreateKeyTransacted@32
ZwCreatePrivateNamespace@16
ZwCreateResourceManager@28
ZwCreateThreadEx@44
ZwCreateTransaction@40
ZwCreateTransactionManager@24
ZwCreateUserProcess@44
ZwCreateWorkerFactory@40
ZwDeletePrivateNamespace@4
ZwEnumerateTransactionObject@20
ZwFlushInstallUILanguage@8
ZwFlushProcessWriteBuffers@0
ZwFreezeRegistry@4
ZwFreezeTransactions@8
ZwGetMUIRegistryInfo@12
ZwGetNextProcess@20
ZwGetNextThread@24
ZwGetNlsSectionPtr@20
ZwGetNotificationResourceManager@28
ZwInitializeNlsFiles@16 ; Windows Vista has ABI "ZwInitializeNlsFiles@12", Windows Vista SP1 and SP2 has ABI "ZwInitializeNlsFiles@16", Windows 7 and new has again ABI "ZwInitializeNlsFiles@12"
ZwIsUILanguageComitted@0
; ZwListTransactions@12 ; removed in Windows Vista SP1
ZwMapCMFModule@24
; ZwMarshallTransaction@24 ; removed in Windows Vista SP1
ZwOpenEnlistment@20
ZwOpenKeyTransacted@16
ZwOpenPrivateNamespace@16
ZwOpenResourceManager@20
ZwOpenSession@12
ZwOpenTransaction@20
ZwOpenTransactionManager@24
ZwPrePrepareComplete@8
ZwPrePrepareEnlistment@8
ZwPrepareComplete@8
ZwPrepareEnlistment@8
ZwPropagationComplete@16
ZwPropagationFailed@12
; ZwPullTransaction@28 ; removed in Windows Vista SP1
ZwQueryInformationEnlistment@20
ZwQueryInformationResourceManager@20
ZwQueryInformationTransaction@20
ZwQueryInformationTransactionManager@20
ZwQueryInformationWorkerFactory@20
ZwQueryLicenseValue@20
ZwReadOnlyEnlistment@8
ZwRecoverEnlistment@8
ZwRecoverResourceManager@4
ZwRecoverTransactionManager@4
ZwRegisterProtocolAddressInformation@20
ZwReleaseCMFViewOwnership@0 ; removed in Windows 7
ZwReleaseWorkerFactoryWorker@4
ZwRemoveIoCompletionEx@24
ZwRollbackComplete@8
ZwRollbackEnlistment@8
; ZwRollbackSavepointTransaction@8 ; removed in Windows Vista SP1
ZwRollbackTransaction@8
ZwRollforwardTransactionManager@8
; ZwSavepointComplete@8 ; removed in Windows Vista SP1
; ZwSavepointTransaction@12 ; removed in Windows Vista SP1
ZwSetInformationEnlistment@16
ZwSetInformationResourceManager@16
ZwSetInformationTransaction@16
ZwSetInformationTransactionManager@16
ZwSetInformationWorkerFactory@16
ZwShutdownWorkerFactory@8
ZwSinglePhaseReject@8
; ZwStartTm@0 ; removed in Windows Vista SP1
ZwThawRegistry@0
ZwThawTransactions@0
ZwTraceControl@24
ZwWaitForWorkViaWorkerFactory@8 ; Windows Vista-7 has ABI "ZwWaitForWorkViaWorkerFactory@8", Windows 8 has ABI "ZwWaitForWorkViaWorkerFactory@16", Windows 8.1 and new has ABI "ZwWaitForWorkViaWorkerFactory@20"
ZwWorkerFactoryWorkerReady@4
ZwWow64CallFunction64@28 ; available only in 32-bit WoW64 version on 64-bit system
ZwWow64CsrVerifyRegion@8 ; available only in 32-bit WoW64 version on 64-bit system
ZwWow64WriteVirtualMemory64@28 ; available only in 32-bit WoW64 version on 64-bit system
; _ResCGetRegistryFlags@16 ; removed in Windows Vista SP1
; _ResCMatchFlags@12 ; removed in Windows Vista SP1
; _ResCSaveRegistryFlags@16 ; removed in Windows Vista SP1

; This is list of symbols added in Windows Vista SP1
LdrpResGetMappingSize@16
LdrpResGetRCConfig@20 ; removed in Windows 7
LdrpResGetResourceDirectory@20
NtRenameTransactionManager@8
NtReplacePartitionUnit@12
NtdllDefWindowProc_A@16 ; same as user32.DefWindowProcA
NtdllDefWindowProc_W@16 ; same as user32.DefWindowProcW
NtdllDialogWndProc_A@16 ; same as user32.DefDlgProcA
NtdllDialogWndProc_W@16 ; same as user32.DefDlgProcW
RtlDeregisterSecureMemoryCacheCallback@4
RtlInitializeExceptionChain@4
RtlNumberOfSetBitsUlongPtr@4
RtlpCheckDynamicTimeZoneInformation@8
ZwRenameTransactionManager@8
ZwReplacePartitionUnit@12

; This is list of symbols added in Windows Vista SP2
RtlpInterlockedPopEntrySeqSListEnd@0 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 7
RtlpInterlockedPopEntrySeqSListFault@0 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 7
RtlpInterlockedPopEntrySeqSListResume@0 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 7

; This is list of symbols added in Windows 7
AlpcRundownCompletionList@4
EtwEventWriteEx@40
EtwEventWriteNoRegistration@16
EvtIntReportAuthzEventAndSourceAsync@44
EvtIntReportEventAndSourceAsync@44
LdrGetDllHandleByMapping@8
LdrGetDllHandleByName@12
LdrResGetRCConfig@20
LdrRscIsTypeExist@16
LdrWx86FormatVirtualImage@12 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 10 Creators Update (Redstone 2 / 1703)
NtAllocateReserveObject@12
NtCreateProfileEx@40
NtDisableLastKnownGood@0
NtDrawText@4
NtEnableLastKnownGood@0
NtNotifyChangeSession@32
NtOpenKeyEx@16
NtOpenKeyTransactedEx@20
NtQuerySecurityAttributesToken@24
NtQuerySystemInformationEx@24
NtQueueApcThreadEx@24
NtSerializeBoot@0
NtSetIoCompletionEx@24
NtSetTimerEx@16
NtUmsThreadYield@4
NtWow64GetCurrentProcessorNumberEx@4 ; available only in 32-bit WoW64 version on 64-bit system
NtWow64InterlockedPopEntrySList@4 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 8
RtlAcquireReleaseSRWLockExclusive@4
RtlAddIntegrityLabelToBoundaryDescriptor@8
RtlContractHashTable@4
RtlCopyExtendedContext@12
RtlCreateHashTable@12
RtlCreateProcessReflection@24
RtlCreateVirtualAccountSid@16
RtlDeleteHashTable@4
RtlDetectHeapLeaks@0
RtlDisableThreadProfiling@4
RtlEnableThreadProfiling@20
RtlEndEnumerationHashTable@8
RtlEndWeakEnumerationHashTable@8
RtlEnumerateEntryHashTable@8
RtlEthernetAddressToStringA@8
RtlEthernetAddressToStringW@8
RtlEthernetStringToAddressA@12
RtlEthernetStringToAddressW@12
RtlExpandHashTable@4
RtlFillMemoryUlonglong@16
RtlGetCurrentProcessorNumberEx@4
RtlGetEnabledExtendedFeatures@8
RtlGetExtendedContextLength@8
RtlGetExtendedFeaturesMask@4
RtlGetFullPathName_UEx@20
RtlGetLocaleFileMappingAddress@12
RtlGetNextEntryHashTable@8
RtlGetProcessPreferredUILanguages@16
RtlInitEnumerationHashTable@8
RtlInitWeakEnumerationHashTable@8
RtlInitializeExtendedContext@12
RtlInsertEntryHashTable@16
RtlInterlockedClearBitRun@12
RtlInterlockedSetBitRun@12
RtlIsNameInExpression@16
RtlKnownExceptionFilter@4
RtlLoadString@32
RtlLocateExtendedFeature@12
RtlLocateLegacyContext@8
RtlLookupEntryHashTable@12
RtlQueryPerformanceCounter@4
RtlQueryPerformanceFrequency@4
RtlQueryThreadProfiling@8
RtlReadThreadProfilingData@12
RtlRemoveEntryHashTable@12
RtlReplaceSidInSd@16
RtlReportSilentProcessExit@8
RtlReportSqmEscalation@24
RtlSetExtendedFeaturesMask@12
RtlSetProcessPreferredUILanguages@12
RtlSetUserCallbackExceptionFilter@4 ; available only in 32-bit WoW64 version on 64-bit system
RtlTryAcquireSRWLockExclusive@4
RtlTryAcquireSRWLockShared@4
RtlUTF8ToUnicodeN@20
RtlUnicodeToUTF8N@20
RtlWeaklyEnumerateEntryHashTable@8
SbExecuteProcedure@20
SbSelectProcedure@16
TpAllocAlpcCompletionEx@20
TpAlpcRegisterCompletionList@4
TpAlpcUnregisterCompletionList@4
TpCallbackIndependent@4
TpDbgGetFreeInfo@8 ; removed in Windows 8
TpDisablePoolCallbackChecks@4
TpPoolFreeUnusedNodes@4 ; removed in Windows 8
TpQueryPoolStackInformation@8
TpSetDefaultPoolMaxThreads@4
TpSetDefaultPoolStackInformation@4
TpSetPoolStackInformation@8
WinSqmAddToAverageDWORD@12
WinSqmAddToStreamEx@20
WinSqmCheckEscalationAddToStreamEx@20
WinSqmCheckEscalationSetDWORD64@20
WinSqmCheckEscalationSetDWORD@16
WinSqmCheckEscalationSetString@16
WinSqmCommonDatapointDelete@4
WinSqmCommonDatapointSetDWORD64@16
WinSqmCommonDatapointSetDWORD@12
WinSqmCommonDatapointSetStreamEx@20
WinSqmCommonDatapointSetString@12
WinSqmGetEscalationRuleStatus@8
WinSqmGetInstrumentationProperty@16
WinSqmIncrementDWORD@12
WinSqmIsOptedInEx@4
WinSqmSetDWORD64@16
WinSqmSetDWORD@12
WinSqmSetEscalationInfo@16
WinSqmSetIfMaxDWORD@12
WinSqmSetIfMinDWORD@12
ZwAllocateReserveObject@12
ZwCreateProfileEx@40
ZwDisableLastKnownGood@0
ZwDrawText@4
ZwEnableLastKnownGood@0
ZwNotifyChangeSession@32
ZwOpenKeyEx@16
ZwOpenKeyTransactedEx@20
ZwQuerySecurityAttributesToken@24
ZwQuerySystemInformationEx@24
ZwQueueApcThreadEx@24
ZwSerializeBoot@0
ZwSetIoCompletionEx@24
ZwSetTimerEx@16
ZwUmsThreadYield@4
ZwWow64GetCurrentProcessorNumberEx@4 ; available only in 32-bit WoW64 version on 64-bit system
ZwWow64InterlockedPopEntrySList@4 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 10 (Threshold / 1507)

; This is list of ordinal-only symbols added in Windows 7
; Symbol names are taken from:
; https://www.geoffchappell.com/studies/windows/win32/ntdll/history/ords61.htm
; AitLogFeatureUsageByApp@4 @1 NONAME ; removed in Windows 10 (Threshold / 1507)
; AitFireParentUsageEvent@16 @2 NONAME ; removed in Windows 10 (Threshold / 1507)
; SbtLogSystemUsageByParent@32 @3 NONAME ; removed in Windows 10 (Threshold / 1507)
; SbtLogSystemUsageByStack@28 @4 NONAME ; FIXME: Windows 7 has ABI @28, Windows 8 and 8.1 has ABI @20, removed in Windows 10 (Threshold / 1507)
; SbtDisableForCurrentProcess@0 @5 NONAME ; removed in Windows 10 (Threshold / 1507)
; SbtLogDllMapping@8 @6 NONAME ; FIXME: Windows 7 has ABI @8, Windows 8 and 8.1 has ABI @0, removed in Windows 10 (Threshold / 1507)
; SbtLogExeInitializing@0 @7 NONAME ; removed in Windows 10 (Threshold / 1507)
; RtlDispatchAPC@12 @8 NONAME ; since Windows 10 Creators Update (Redstone 2 / 1703) available as normal symbol

; This is list of symbols added in Windows 7 SP1
RtlCopyContext@12

; This is list of symbols added in Windows 8
ApiSetQueryApiSetPresence@8
EtwEventSetInformation@20
LdrAddDllDirectory@8
LdrAppxHandleIntegrityFailure@4
LdrGetDllDirectory@4
LdrGetDllFullName@8
LdrGetDllPath@16
LdrGetProcedureAddressForCaller@24
LdrProcessRelocationBlockEx@20
LdrQueryOptionalDelayLoadedAPI@16
LdrRemoveDllDirectory@4
LdrResolveDelayLoadedAPI@24
LdrResolveDelayLoadsFromDll@12
LdrSetDefaultDllDirectories@4
LdrSetDllDirectory@4
LdrStandardizeSystemPath@4
LdrSystemDllInitBlock DATA
NtAddAtomEx@16
NtAdjustTokenClaimsAndDeviceGroups@64
NtAlertThreadByThreadId@4
NtAlpcConnectPortEx@44
NtAssociateWaitCompletionPacket@32
NtCancelWaitCompletionPacket@8
NtCreateDirectoryObjectEx@20
NtCreateIRTimer@12 ; Windows 8-10 has ABI "NtCreateIRTimer@8", Windows 10 Creators Update (Redstone 2 / 1703) and new has ABI "NtCreateIRTimer@12"
NtCreateLowBoxToken@36
NtCreateTokenEx@68
NtCreateWaitCompletionPacket@12
NtCreateWnfStateName@28
NtDeleteWnfStateData@8
NtDeleteWnfStateName@4
NtFilterBootOption@20
NtFilterTokenEx@56
NtFlushBuffersFileEx@20
NtGetCachedSigningLevel@24
NtQueryWnfStateData@24
NtQueryWnfStateNameInformation@20
NtSetCachedSigningLevel@20
NtSetIRTimer@8
NtSetInformationVirtualMemory@24
NtSubscribeWnfStateChange@16
NtUnmapViewOfSectionEx@12
NtUnsubscribeWnfStateChange@4
NtUpdateWnfStateData@28
NtWaitForAlertByThreadId@8
; NtWaitForWnfNotifications@8 ; removed in Windows 8.1
; NtWow64AllocateVirtualMemory64@28 ; available only in 32-bit WoW64 version on 64-bit system
RtlAddResourceAttributeAce@28
RtlAddScopedPolicyIDAce@20
RtlAllocateWnfSerializationGroup@0
RtlAppxIsFileOwnedByTrustedInstaller@8
RtlAvlInsertNodeEx@16
RtlAvlRemoveNode@8
RtlCanonicalizeDomainName@12
RtlCheckPortableOperatingSystem@4
RtlCheckTokenCapability@12
RtlCheckTokenMembership@12
RtlCheckTokenMembershipEx@16
RtlClearBit@8
RtlCopyBitMap@12
RtlCrc32@12
RtlCrc64@16
RtlCreateHashTableEx@16
RtlDecompressBufferEx@28
RtlDeleteElementGenericTableAvlEx@8
RtlEqualWnfChangeStamps@8
RtlExtractBitMap@16
RtlFlushHeaps@0
RtlGetAppContainerNamedObjectPath@16
RtlGetExePath@8
RtlGetSearchPath@4
RtlGetSystemTimePrecise@0
RtlInterlockedPushListSListEx@16
RtlIsCapabilitySid@4
RtlIsPackageSid@4
RtlIsUntrustedObject@12
RtlLengthSidAsUnicodeString@8
RtlNumberOfClearBitsInRange@12
RtlNumberOfSetBitsInRange@12
RtlPublishWnfStateData@24
RtlQueryPackageIdentity@24
RtlQueryRegistryValuesEx@20
RtlQueryUnbiasedInterruptTime@4
RtlQueryValidationRunlevel@4
RtlQueryWnfMetaNotification@20
RtlQueryWnfStateData@24
RtlQueryWnfStateDataWithExplicitScope@28
RtlRbInsertNodeEx@16
RtlRbRemoveNode@8
RtlRegisterForWnfMetaNotification@24
RtlReleasePath@4
RtlResetNtUserPfn@0
RtlSetBit@8
RtlSetPortableOperatingSystem@4
RtlSetSearchPathMode@4
RtlSubscribeWnfStateChangeNotification@36
RtlTestAndPublishWnfStateData@28
RtlTryConvertSRWLockSharedToExclusiveOrRelease@4
RtlUnsubscribeWnfNotificationWaitForCompletion@4
RtlUnsubscribeWnfNotificationWithCompletionCallback@12
RtlUnsubscribeWnfStateChangeNotification@4
RtlWaitForWnfMetaNotification@24
RtlWaitOnAddress@16
RtlWakeAddressAll@4
RtlWakeAddressAllNoFence@4
RtlWakeAddressSingle@4
RtlWakeAddressSingleNoFence@4
RtlWnfCompareChangeStamp@8 ; removed in Windows 11 2024 Update (Hudson Valley / 24H2)
RtlWnfDllUnloadCallback@4
RtlpConvertAbsoluteToRelativeSecurityAttribute@12
RtlpConvertRelativeToAbsoluteSecurityAttribute@16
RtlpFreezeTimeBias DATA
RtlpMergeSecurityAttributeInformation@16
; RtlpWnfNotificationThread@16 ; removed in Windows 8.1
TpAllocJobNotification@20
TpCallbackDetectedUnrecoverableError@4
TpReleaseJobNotification@4
TpSetPoolThreadBasePriority@8
TpSetTimerEx@16
TpSetWaitEx@16
TpTimerOutstandingCallbackCount@4
TpWaitForJobNotification@4
WinSqmIsSessionDisabled@4
ZwAddAtomEx@16
ZwAdjustTokenClaimsAndDeviceGroups@64
ZwAlertThreadByThreadId@4
ZwAlpcConnectPortEx@44
ZwAssociateWaitCompletionPacket@32
ZwCancelWaitCompletionPacket@8
ZwCreateDirectoryObjectEx@20
ZwCreateIRTimer@12 ; Windows 8-10 has ABI "ZwCreateIRTimer@8", Windows 10 Creators Update (Redstone 2 / 1703) and new has ABI "ZwCreateIRTimer@12"
ZwCreateLowBoxToken@36
ZwCreateTokenEx@68
ZwCreateWaitCompletionPacket@12
ZwCreateWnfStateName@28
ZwDeleteWnfStateData@8
ZwDeleteWnfStateName@4
ZwFilterBootOption@20
ZwFilterTokenEx@56
ZwFlushBuffersFileEx@20
ZwGetCachedSigningLevel@24
ZwQueryWnfStateData@24
ZwQueryWnfStateNameInformation@20
ZwSetCachedSigningLevel@20
ZwSetIRTimer@8
ZwSetInformationVirtualMemory@24
ZwSubscribeWnfStateChange@16
ZwUnmapViewOfSectionEx@12
ZwUnsubscribeWnfStateChange@4
ZwUpdateWnfStateData@28
ZwWaitForAlertByThreadId@8
; ZwWaitForWnfNotifications@8 ; removed in Windows 8.1
; ZwWow64AllocateVirtualMemory64@28 ; available only in 32-bit WoW64 version on 64-bit system

; This is list of symbols added in Windows 8.1
LdrSetImplicitPathOptions@8
NtCancelTimer2@8
NtCreateTimer2@20
NtGetCompleteWnfStateSubscription@24
NtSetTimer2@16
NtSetWnfProcessNotificationEvent@4
PssNtCaptureSnapshot@16
PssNtDuplicateSnapshot@20
PssNtFreeRemoteSnapshot@8
PssNtFreeSnapshot@4
PssNtFreeWalkMarker@4
PssNtQuerySnapshot@16
PssNtValidateDescriptor@8
PssNtWalkSnapshot@20
RtlAddProcessTrustLabelAce@24
RtlAllocateAndInitializeSidEx@16
RtlGetAppContainerParent@8
RtlGetAppContainerSidType@8
RtlIsParentOfChildAppContainer@8
RtlIsValidProcessTrustLabelSid@4
RtlQueryPackageIdentityEx@28
RtlSidDominatesForTrust@12
RtlStringFromGUIDEx@12
RtlTestProtectedAccess@8
RtlValidProcessProtection@4
TpCallbackSendAlpcMessageOnCompletion@16
TpCallbackSendPendingAlpcMessage@4
WinSqmStartSessionForPartner@16
ZwCancelTimer2@8
ZwCreateTimer2@20
ZwGetCompleteWnfStateSubscription@24
ZwSetTimer2@16
ZwSetWnfProcessNotificationEvent@4

; This is list of symbols added in Windows 10 (Threshold / 1507)
DbgUiConvertStateChangeStructureEx@8
LdrFastFailInLoaderCallout@0
NtAlpcImpersonateClientContainerOfPort@12
NtCompareObjects@8
NtCreatePartition@16 ; Windows 10 has ABI "NtCreatePartition@20", Windows 10 November Update (Threshold 2 / 1511) and new has ABI "NtCreatePartition@16"
NtGetCurrentProcessorNumberEx@4
NtManagePartition@20
NtOpenPartition@12
NtRevertContainerImpersonation@0
NtSetInformationSymbolicLink@16
; NtWow64IsProcessorFeaturePresent@4 ; available only in 32-bit WoW64 version on 64-bit system
RtlCapabilityCheck@12
RtlCheckSandboxedToken@8
RtlConvertDeviceFamilyInfoToString@16
RtlConvertSRWLockExclusiveToShared@4
RtlDecodeRemotePointer@12
RtlDeriveCapabilitySidsFromName@12
RtlEncodeRemotePointer@12
RtlEndStrongEnumerationHashTable@8
RtlFindUnicodeSubstring@12
RtlGetDeviceFamilyInfoEnum@12
RtlGetInterruptTimePrecise@4
RtlInitStringEx@8
RtlInitStrongEnumerationHashTable@8
RtlInitializeSidEx@0
RtlIsMultiSessionSku@0
RtlIsProcessorFeaturePresent@4
RtlOsDeploymentState@4
RtlQueryPackageClaims@32 ; Windows 10 has ABI "RtlQueryPackageClaims@28", Windows 10 Anniversary Update (Redstone / 1607) and new has ABI "RtlQueryPackageClaims@32"
RtlQueryProtectedPolicy@8
RtlQueryResourcePolicy@16
RtlSetProtectedPolicy@12
RtlSetThreadSubProcessTag@4
RtlStronglyEnumerateEntryHashTable@8
RtlSwitchedVVI@16
RtlpGetDeviceFamilyInfoEnum@12
TpSetPoolMaxThreadsSoftLimit@8
TpSetPoolWorkerThreadIdleTimeout@12
TpTrimPools@0
WinSqmStartSqmOptinListener@0
ZwAlpcImpersonateClientContainerOfPort@12
ZwCompareObjects@8
ZwCreatePartition@16 ; Windows 10 has ABI "ZwCreatePartition@20", Windows 10 November Update (Threshold 2 / 1511) and new has ABI "ZwCreatePartition@16"
ZwGetCurrentProcessorNumberEx@4
ZwManagePartition@20
ZwOpenPartition@12
ZwRevertContainerImpersonation@0
ZwSetInformationSymbolicLink@16
; ZwWow64IsProcessorFeaturePresent@4 ; available only in 32-bit WoW64 version on 64-bit system

; This is list of symbols added in Windows 10 November Update (Threshold 2 / 1511)
NtCreateEnclave@36
NtInitializeEnclave@20
NtLoadEnclaveData@36
RtlGetCurrentServiceSessionId@0
RtlWow64GetCurrentMachine@0
ZwCreateEnclave@36
ZwInitializeEnclave@20
ZwLoadEnclaveData@36

; This is list of symbols added in Windows 10 Anniversary Update (Redstone / 1607)
NtCommitRegistryTransaction@8
NtCreateRegistryTransaction@16
NtOpenRegistryTransaction@12
NtQuerySecurityPolicy@24
NtRollbackRegistryTransaction@8
NtSetCachedSigningLevel2@24
RtlAreLongPathsEnabled@0
RtlCheckBootStatusIntegrity@8
RtlClearThreadWorkOnBehalfTicket@0
RtlFindExportedRoutineByName@8
RtlGetActiveConsoleId@0
RtlGetConsoleSessionForegroundProcessId@0
RtlGetSuiteMask@0
RtlGetThreadWorkOnBehalfTicket@8
RtlGuardCheckLongJumpTarget@12
; RtlIsLongPathAwareProcessByManifest@0 ; removed in Windows 10 Creators Update (Redstone 2 / 1703)
RtlIsMultiUsersInSessionSku@0
RtlLocateExtendedFeature2@16
RtlReplaceSystemDirectoryInPath@16
RtlReportExceptionEx@20
RtlRestoreBootStatusDefaults@4
RtlSetThreadWorkOnBehalfTicket@4
; RtlSparseBitmapCtxAreAllClear@20 ; removed in Windows 10 Creators Update (Redstone 2 / 1703)
; RtlSparseBitmapCtxAreAllSet@20 ; removed in Windows 10 Creators Update (Redstone 2 / 1703)
; RtlSparseBitmapCtxCheckBit@12 ; removed in Windows 10 Creators Update (Redstone 2 / 1703)
; RtlSparseBitmapCtxCleanup@4 ; removed in Windows 10 Creators Update (Redstone 2 / 1703)
; RtlSparseBitmapCtxClearBits@24 ; removed in Windows 10 Creators Update (Redstone 2 / 1703)
; RtlSparseBitmapCtxClearBitsEx@32 ; removed in Windows 10 Creators Update (Redstone 2 / 1703)
; RtlSparseBitmapCtxCountBitsSet@4 ; removed in Windows 10 Creators Update (Redstone 2 / 1703)
; RtlSparseBitmapCtxFindNextBitSet@12 ; removed in Windows 10 Creators Update (Redstone 2 / 1703)
; RtlSparseBitmapCtxFindSetRuns@36 ; removed in Windows 10 Creators Update (Redstone 2 / 1703)
; RtlSparseBitmapCtxInitialize@4 ; removed in Windows 10 Creators Update (Redstone 2 / 1703)
; RtlSparseBitmapCtxMetadataForBit@16 ; removed in Windows 10 Creators Update (Redstone 2 / 1703)
; RtlSparseBitmapCtxOrBitmap@8 ; removed in Windows 10 Creators Update (Redstone 2 / 1703)
; RtlSparseBitmapCtxPrepareBits@20 ; removed in Windows 10 Creators Update (Redstone 2 / 1703)
; RtlSparseBitmapCtxSetBits@24 ; removed in Windows 10 Creators Update (Redstone 2 / 1703)
; RtlSparseBitmapCtxSetBitsEx@32 ; removed in Windows 10 Creators Update (Redstone 2 / 1703)
; RtlSparseBitmapCtxStart@8 ; removed in Windows 10 Creators Update (Redstone 2 / 1703)
; RtlSparseBitmapCtxSubtractBitmap@12 ; removed in Windows 10 Creators Update (Redstone 2 / 1703)
; RtlSparseBitmapEnumerateBitmap@12 ; removed in Windows 10 Creators Update (Redstone 2 / 1703)
RtlWow64GetProcessMachines@12
RtlWow64IsWowGuestMachineSupported@8
; Wow64Transition DATA ; available only in 32-bit WoW64 version on 64-bit system
ZwCommitRegistryTransaction@8
ZwCreateRegistryTransaction@16
ZwOpenRegistryTransaction@12
ZwQuerySecurityPolicy@24
ZwRollbackRegistryTransaction@8
ZwSetCachedSigningLevel2@24

; This is list of symbols added in Windows 10 Creators Update (Redstone 2 / 1703)
LdrParentInterlockedPopEntrySList DATA
LdrParentRtlInitializeNtUserPfn DATA
LdrParentRtlResetNtUserPfn DATA
LdrParentRtlRetrieveNtUserPfn DATA
LdrUpdatePackageSearchPath@4
LdrpChildNtdll DATA
NtAcquireProcessActivityReference@12
NtCompareSigningLevels@8
; NtContinueCHPE@8 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 10 Fall Creators Update (Redstone 3 / 1709)
NtConvertBetweenAuxiliaryCounterAndPerformanceCounter@16
; NtLoadHotPatch@8 ; removed in Windows 10 October 2018 Update (Redstone 5 / 1809)
NtQueryAuxiliaryCounterFrequency@4
NtQueryInformationByName@20
RtlAddAccessFilterAce@32
RtlCreateUserProcessEx@20
RtlDispatchAPC@12 ; before Windows 10 Creators Update (Redstone 2 / 1703) available as ordinal-only symbol
RtlGetNtSystemRoot@0
RtlGetSessionProperties@8
RtlGetTokenNamedObjectPath@12
RtlIsElevatedRid@4
RtlIsNonEmptyDirectoryReparsePointAllowed@4
; RtlIsPlaceholderFileHandle@8 ; removed in Windows 10 Fall Creators Update (Redstone 3 / 1709)
; RtlIsPlaceholderFileInfo@12 ; removed in Windows 10 Fall Creators Update (Redstone 3 / 1709)
RtlLookupFirstMatchingElementGenericTableAvl@12
; RtlLookupFunctionEntryCHPE@12 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 10 Fall Creators Update (Redstone 3 / 1709)
; RtlUnwindEx@24 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 10 Fall Creators Update (Redstone 3 / 1709)
WerReportExceptionWorker@4
ZwAcquireProcessActivityReference@12
ZwCompareSigningLevels@8
; ZwContinueCHPE@8 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 10 Fall Creators Update (Redstone 3 / 1709)
ZwConvertBetweenAuxiliaryCounterAndPerformanceCounter@16
; ZwLoadHotPatch@8 ; removed in Windows 10 October 2018 Update (Redstone 5 / 1809)
ZwQueryAuxiliaryCounterFrequency@4
ZwQueryInformationByName@20

; This is list of symbols added in Windows 10 Fall Creators Update (Redstone 3 / 1709)
EtwCheckCoverage@4
LdrCallEnclave@12
LdrControlFlowGuardEnforced@0
LdrCreateEnclave@36
LdrDeleteEnclave@4
LdrInitializeEnclave@20
LdrLoadEnclaveModule@12
NtCallEnclave@16
NtNotifyChangeDirectoryFileEx@40
NtQueryDirectoryFileEx@40
NtTerminateEnclave@8
RtlCapabilityCheckForSingleSessionSku@12
RtlCheckSystemBootStatusIntegrity@4
RtlDosLongPathNameToNtPathName_U_WithStatus@16
RtlDosLongPathNameToRelativeNtPathName_U_WithStatus@16
RtlExtendCorrelationVector@4
RtlGetSystemBootStatus@16
RtlGetSystemBootStatusEx@12
RtlIncrementCorrelationVector@4
RtlInitializeCorrelationVector@12
RtlIsCloudFilesPlaceholder@8
RtlIsCurrentProcess@4
RtlIsCurrentThread@4
RtlIsPartialPlaceholder@8
RtlIsPartialPlaceholderFileHandle@8
RtlIsPartialPlaceholderFileInfo@12
RtlIsStateSeparationEnabled@0
RtlQueryImageMitigationPolicy@20
RtlQueryThreadPlaceholderCompatibilityMode@0
RtlRestoreSystemBootStatusDefaults@0
RtlSetImageMitigationPolicy@20
RtlSetProxiedProcessId@4
RtlSetSystemBootStatus@16
RtlSetSystemBootStatusEx@12
RtlSetThreadPlaceholderCompatibilityMode@4
RtlValidateCorrelationVector@4
RtlWow64GetEquivalentMachineCHPE@4
RtlWow64GetSharedInfoProcess@12
; RtlWow64PopAllCrossProcessWork@4 ; removed in Windows 10 October 2018 Update (Redstone 5 / 1809)
; RtlWow64PopCrossProcessWork@4 ; removed in Windows 10 October 2018 Update (Redstone 5 / 1809)
; RtlWow64PushCrossProcessWork@8 ; removed in Windows 10 October 2018 Update (Redstone 5 / 1809)
ZwCallEnclave@16
ZwNotifyChangeDirectoryFileEx@40
ZwQueryDirectoryFileEx@40
ZwTerminateEnclave@8

; This is list of symbols added in Windows 10 April 2018 Update (Redstone 4 / 1803)
NtAllocateVirtualMemoryEx@28
NtMapViewOfSectionEx@36
RtlGetPersistedStateLocation@28
RtlIsNameInUnUpcasedExpression@16
RtlQueryProcessPlaceholderCompatibilityMode@0
RtlQueryRegistryValueWithFallback@28
RtlQueryTokenHostIdAsUlong64@8
RtlRaiseCustomSystemEventTrigger@4
RtlSetProcessPlaceholderCompatibilityMode@4
ZwAllocateVirtualMemoryEx@28
ZwMapViewOfSectionEx@36

; This is list of symbols added in Windows 10 October 2018 Update (Redstone 5 / 1809)
ApiSetQueryApiSetPresenceEx@12
LdrIsModuleSxsRedirected@4
NtCreateSectionEx@36
NtManageHotPatch@16
RtlCreateProcessParametersWithTemplate@12
RtlGetExtendedContextLength2@16
RtlGetMultiTimePrecise@12
RtlInitializeExtendedContext2@20
; RtlUserFiberStart@0
RtlpTimeFieldsToTime@12
RtlpTimeToTimeFields@12
ZwCreateSectionEx@36
ZwManageHotPatch@16

; This is list of symbols added in Windows 10 May 2019 Update (19H1 / 1903)
NtCreateCrossVmEvent@24
RtlConstructCrossVmEventPath@12
RtlDoesNameContainWildCards@4
RtlFlsGetValue@8
RtlFlsSetValue@8
RtlUdiv128@28
TpSetPoolThreadCpuSets@12
ZwCreateCrossVmEvent@24

; In Windows 10 November 2019 Update (19H2 /1909) was not added any new symbol

; This is list of symbols added in Windows 10 May 2020 Update (20H1 / 2004)
NtAcquireCrossVmMutant@8
NtAllocateUserPhysicalPagesEx@20
NtContinueEx@8
NtCreateCrossVmMutant@24
NtDirectGraphicsCall@20
NtLoadKey3@32
NtPssCaptureVaSpaceBulk@20
RtlConstructCrossVmMutexPath@12
; RtlDisownModuleHeapAllocation@8
RtlFreeUTF8String@4
RtlGetReturnAddressHijackTarget@0
RtlInitUTF8String@8
RtlInitUTF8StringEx@8
RtlIsZeroMemory@8
RtlNormalizeSecurityDescriptor@20
RtlNotifyFeatureUsage@4
RtlQueryAllFeatureConfigurations@16
RtlQueryFeatureConfiguration@16
RtlQueryFeatureConfigurationChangeStamp@0
RtlQueryFeatureUsageNotificationSubscriptions@8
RtlRegisterFeatureConfigurationChangeNotification@16
RtlRestoreThreadPreferredUILanguages@4
RtlSetFeatureConfigurations@16
RtlSetThreadPreferredUILanguages2@16
RtlSubscribeForFeatureUsageNotification@8
RtlUTF8StringToUnicodeString@12
RtlUnicodeStringToUTF8String@12
RtlUnregisterFeatureConfigurationChangeNotification@4
RtlUnsubscribeFromFeatureUsageNotifications@8
ZwAcquireCrossVmMutant@8
ZwAllocateUserPhysicalPagesEx@20
ZwContinueEx@8
ZwCreateCrossVmMutant@24
ZwDirectGraphicsCall@20
ZwLoadKey3@32
ZwPssCaptureVaSpaceBulk@20

; In Windows 10 October 2020 Update (20H2) was not added any new symbol

; In Windows 10 May 2021 Update (21H1) was not added any new symbol

; This is list of symbols added in Windows 10 November 2021 Update (21H2)
RtlGetSystemTimeAndBias@12

; In Windows 10 2022 Update (22H2) was not added any new symbol

; This is list of symbols added in Windows 11 (Sun Valley / 21H2) (WoW64 version)
; LdrHotPatchNotify@4
; MicrosoftTelemetryAssertTriggeredUM@4
NtChangeProcessState@24
NtChangeThreadState@24
NtCreateIoRing@20
NtCreateProcessStateChange@20
NtCreateThreadStateChange@20
NtQueryIoRingCapabilities@8
NtQueueApcThreadEx2@28
NtReadVirtualMemoryEx@24
NtSetInformationIoRing@16
NtSubmitIoRing@16
RtlCompareExchangePointerMapping@16
RtlCompareExchangePropertyStore@16
; RtlConvertHostPerfCounterToPerfCounter@20
RtlDelayExecution@8
RtlGetImageFileMachines@8
RtlGetSystemGlobalData@12
RtlIsApiSetImplemented@4
RtlIsEnclaveFeaturePresent@4
RtlQueryPointerMapping@8
RtlQueryPropertyStore@8
RtlRemovePointerMapping@8
RtlRemovePropertyStore@8
RtlRestoreContext ; cdecl
ZwChangeProcessState@24
ZwChangeThreadState@24
ZwCreateIoRing@20
ZwCreateProcessStateChange@20
ZwCreateThreadStateChange@20
ZwQueryIoRingCapabilities@8
ZwQueueApcThreadEx2@28
ZwReadVirtualMemoryEx@24
ZwSetInformationIoRing@16
ZwSubmitIoRing@16

; This is list of symbols added in Windows 11 2022 Update (Sun Valley 2 / 22H2) (WoW64 version)
; NtCopyFileChunk@40
; NtCreateCpuPartition@20 ; Windows 10 has ABI "NtCreateCpuPartition@12", Windows 11 2024 Update (Hudson Valley / 24H2) and new has ABI "NtCreateCpuPartition@20"
; NtOpenCpuPartition@12
; NtQueryInformationCpuPartition@20
; NtSetInformationCpuPartition@28
; RtlOverwriteFeatureConfigurationBuffer@16
; TpWorkOnBehalfClearTicket@4
; TpWorkOnBehalfSetTicket@8
; ZwCopyFileChunk@40
; ZwCreateCpuPartition@20 ; Windows 10 has ABI "ZwCreateCpuPartition@12", Windows 11 2024 Update (Hudson Valley / 24H2) and new has ABI "ZwCreateCpuPartition@20"
; ZwOpenCpuPartition@12
; ZwQueryInformationCpuPartition@20
; ZwSetInformationCpuPartition@28

; This is list of symbols added in Windows 11 2023 Update (Sun Valley 3 / 23H2) (WoW64 version)
; RtlIsFeatureEnabledForEnterprise@4

; This is list of symbols added in Windows 11 2024 Update (Hudson Valley / 24H2) (WoW64 version)
; NtAlertMultipleThreadByThreadId@16
; NtAlertThreadByThreadIdEx@8
; NtSetEventEx@12
; NtWow64GetCurrentProcessorNumber@0
; RtlFlsAllocEx@12
; RtlFlsGetValue2@4
; RtlGetAcesBufferSize@8
; RtlGetCurrentThreadPrimaryGroup@0
; RtlGetFeatureToggleConfiguration@12
; RtlGetFeatureTogglesChangeToken@0
; RtlLogUnexpectedCodepath@4
; RtlNotifyFeatureToggleUsage@12
; RtlQueryAllInternalFeatureConfigurations@16
; RtlRcuAllocate@4
; RtlRcuFree@4
; RtlRcuReadLock@0
; RtlRcuReadUnlock@0
; RtlRcuSynchronize@4
; RtlTlsAlloc@4
; RtlTlsFree@4
; RtlTlsSetValue@8
; RtlValidateUserCallTarget@8
; RtlXRestore@12
; RtlXSave@12
; ZwAlertMultipleThreadByThreadId@16
; ZwAlertThreadByThreadIdEx@8
; ZwSetEventEx@12
; ZwWow64GetCurrentProcessorNumber@0