| ; |
| ; Definition file of ntdll.dll |
| ; Automatic generated by gendef |
| ; written by Kai Tietz 2008 |
| ; |
| LIBRARY "ntdll.dll" |
| EXPORTS |
| RtlActivateActivationContextUnsafeFast@0 |
| RtlDeactivateActivationContextUnsafeFast@0 |
| RtlInterlockedPushListSList@8 |
| @RtlUlongByteSwap@4 |
| @RtlUlonglongByteSwap@8 |
| @RtlUshortByteSwap@4 |
| ExpInterlockedPopEntrySListEnd@0 |
| ExpInterlockedPopEntrySListFault@0 |
| ExpInterlockedPopEntrySListResume@0 |
| RtlpInterlockedPopEntrySeqSListEnd@0 |
| RtlpInterlockedPopEntrySeqSListFault@0 |
| RtlpInterlockedPopEntrySeqSListResume@0 |
| A_SHAFinal@8 |
| A_SHAInit@4 |
| A_SHAUpdate@12 |
| AlpcAdjustCompletionListConcurrencyCount@8 |
| AlpcFreeCompletionListMessage@8 |
| AlpcGetCompletionListLastMessageInformation@12 |
| AlpcGetCompletionListMessageAttributes@8 |
| AlpcGetHeaderSize@4 |
| AlpcGetMessageAttribute@8 |
| AlpcGetMessageFromCompletionList@8 |
| AlpcGetOutstandingCompletionListMessageCount@4 |
| AlpcInitializeMessageAttribute@16 |
| AlpcMaxAllowedMessageLength@0 |
| AlpcRegisterCompletionList@20 |
| AlpcRegisterCompletionListWorkerThread@4 |
| AlpcRundownCompletionList@4 |
| AlpcUnregisterCompletionList@4 |
| AlpcUnregisterCompletionListWorkerThread@4 |
| CsrAllocateCaptureBuffer@8 |
| CsrAllocateMessagePointer@12 |
| CsrCaptureMessageBuffer@16 |
| CsrCaptureMessageMultiUnicodeStringsInPlace@12 |
| CsrCaptureMessageString@20 |
| CsrCaptureTimeout@8 |
| CsrClientCallServer@16 |
| CsrClientConnectToServer@20 |
| CsrFreeCaptureBuffer@4 |
| CsrGetProcessId@0 |
| CsrIdentifyAlertableThread@0 |
| CsrNewThread@0 |
| CsrProbeForRead@12 |
| CsrProbeForWrite@12 |
| CsrSetPriorityClass@8 |
| CsrVerifyRegion@8 |
| DbgBreakPoint@0 |
| DbgPrint |
| DbgPrintEx |
| DbgPrintReturnControlC |
| DbgPrompt@12 |
| DbgQueryDebugFilterState@8 |
| DbgSetDebugFilterState@12 |
| DbgSsHandleKmApiMsg@8 |
| DbgSsInitialize@16 |
| DbgUiConnectToDbg@0 |
| DbgUiContinue@8 |
| DbgUiConvertStateChangeStructure@8 |
| DbgUiDebugActiveProcess@4 |
| DbgUiGetThreadDebugObject@0 |
| DbgUiIssueRemoteBreakin@4 |
| DbgUiRemoteBreakin@4 |
| DbgUiSetThreadDebugObject@4 |
| DbgUiStopDebugging@4 |
| DbgUiWaitStateChange@8 |
| DbgUserBreakPoint@0 |
| EtwCreateTraceInstanceId@8 |
| EtwDeliverDataBlock@4 |
| EtwEnumerateProcessRegGuids@12 |
| EtwEventActivityIdControl@8 |
| EtwEventEnabled@12 |
| EtwEventProviderEnabled@20 |
| EtwEventRegister@16 |
| EtwEventUnregister@8 |
| EtwEventWrite@20 |
| EtwEventWriteEndScenario@20 |
| EtwEventWriteEx@40 |
| EtwEventWriteFull@32 |
| EtwEventWriteNoRegistration@16 |
| EtwEventWriteStartScenario@20 |
| EtwEventWriteString@24 |
| EtwEventWriteTransfer@28 |
| EtwGetTraceEnableFlags@8 |
| EtwGetTraceEnableLevel@8 |
| EtwGetTraceLoggerHandle@4 |
| EtwLogTraceEvent@12 |
| EtwNotificationRegister@20 |
| EtwNotificationUnregister@12 |
| EtwProcessPrivateLoggerRequest@4 |
| EtwRegisterSecurityProvider@0 |
| EtwRegisterTraceGuidsA@32 |
| EtwRegisterTraceGuidsW@32 |
| EtwReplyNotification@4 |
| EtwSendNotification@20 |
| EtwSetMark@16 |
| EtwTraceEventInstance@20 |
| EtwTraceMessage |
| EtwTraceMessageVa@24 |
| EtwUnregisterTraceGuids@8 |
| EtwWriteUMSecurityEvent@16 |
| EtwpCreateEtwThread@8 |
| EtwpGetCpuSpeed@8 |
| ;EtwpNotificationThread |
| EvtIntReportAuthzEventAndSourceAsync@44 |
| EvtIntReportEventAndSourceAsync@44 |
| KiFastSystemCall@0 |
| KiFastSystemCallRet@0 |
| KiIntSystemCall@0 |
| KiRaiseUserExceptionDispatcher@0 |
| KiUserApcDispatcher@20 |
| KiUserCallbackDispatcher@12 |
| KiUserExceptionDispatcher@8 |
| LdrAccessResource@16 |
| LdrAddLoadAsDataTable@16; Check!!! gendef says @20 |
| LdrAddRefDll@8 |
| LdrAlternateResourcesEnabled@0 |
| LdrDisableThreadCalloutsForDll@4 |
| LdrEnumResources@20 |
| LdrEnumerateLoadedModules@12 |
| LdrFindEntryForAddress@8 |
| LdrFindResourceDirectory_U@16 |
| LdrFindResourceEx_U@20 |
| LdrFindResource_U@16 |
| LdrFlushAlternateResourceModules@0 |
| LdrGetDllHandle@16 |
| LdrGetDllHandleByMapping@8 |
| LdrGetDllHandleByName@12 |
| LdrGetDllHandleEx@20 |
| LdrGetFailureData@0 |
| LdrGetFileNameFromLoadAsDataTable@8 |
| LdrGetProcedureAddress@16 |
| LdrGetProcedureAddressEx@20 |
| LdrHotPatchRoutine@0 |
| LdrInitShimEngineDynamic@4 |
| LdrInitializeThunk@16 |
| LdrLoadAlternateResourceModule@16 |
| LdrLoadAlternateResourceModuleEx@20 |
| LdrLoadDll@16 |
| LdrAlternateResourcesEnabled@0 |
| LdrLockLoaderLock@12 |
| LdrOpenImageFileOptionsKey@12 |
| LdrProcessRelocationBlock@16 |
| LdrQueryImageFileExecutionOptions@24 |
| LdrQueryImageFileExecutionOptionsEx@28 |
| LdrQueryImageFileKeyOption@24 |
| LdrQueryModuleServiceTags@12 |
| LdrQueryProcessModuleInformation@12 |
| LdrRegisterDllNotification@16 |
| LdrRemoveLoadAsDataTable@16 |
| LdrResFindResource@36 |
| LdrResFindResourceDirectory@28 |
| LdrResGetRCConfig@20 |
| LdrResRelease@12 |
| LdrResSearchResource@32 |
| LdrRscIsTypeExist@16 |
| LdrSetAppCompatDllRedirectionCallback@12 |
| LdrSetDllManifestProber@4 |
| LdrSetMUICacheType@4 |
| LdrShutdownProcess@0 |
| LdrShutdownThread@0 |
| LdrUnloadAlternateResourceModule@4 |
| LdrUnloadAlternateResourceModuleEx@8 |
| LdrUnloadDll@4 |
| LdrUnlockLoaderLock@8 |
| LdrUnregisterDllNotification@4 |
| LdrVerifyImageMatchesChecksum@16 |
| LdrVerifyImageMatchesChecksumEx@8 |
| LdrWx86FormatVirtualImage@12 |
| LdrpResGetMappingSize@16 |
| LdrpResGetRCConfig@20 |
| LdrpResGetResourceDirectory@20 |
| MD4Final@4 |
| MD4Init@4 |
| MD4Update@12 |
| MD5Final@4 |
| MD5Init@4 |
| MD5Update@12 |
| NlsAnsiCodePage DATA |
| NlsMbCodePageTag DATA |
| NlsMbOemCodePageTag DATA |
| NtAcceptConnectPort@24 |
| NtAccessCheck@32 |
| NtAccessCheckAndAuditAlarm@44 |
| NtAccessCheckByType@44 |
| NtAccessCheckByTypeAndAuditAlarm@64 |
| NtAccessCheckByTypeResultList@44 |
| NtAccessCheckByTypeResultListAndAuditAlarm@64 |
| NtAccessCheckByTypeResultListAndAuditAlarmByHandle@68 |
| NtAcquireCMFViewOwnership@12 |
| NtAddAtom@12 |
| NtAddBootEntry@8 |
| NtAddDriverEntry@8 |
| NtAdjustGroupsToken@24 |
| NtAdjustPrivilegesToken@24 |
| NtAlertResumeThread@8 |
| NtAlertThread@4 |
| NtAllocateLocallyUniqueId@4 |
| NtAllocateReserveObject@12 |
| NtAllocateUserPhysicalPages@12 |
| NtAllocateUuids@16 |
| NtAllocateVirtualMemory@24 |
| NtAlpcAcceptConnectPort@36 |
| NtAlpcCancelMessage@12 |
| NtAlpcConnectPort@44 |
| NtAlpcCreatePort@12 |
| NtAlpcCreatePortSection@24 |
| NtAlpcCreateResourceReserve@16 |
| NtAlpcCreateSectionView@12 |
| NtAlpcCreateSecurityContext@12 |
| NtAlpcDeletePortSection@12 |
| NtAlpcDeleteResourceReserve@12 |
| NtAlpcDeleteSectionView@12 |
| NtAlpcDeleteSecurityContext@12 |
| NtAlpcDisconnectPort@8 |
| NtAlpcImpersonateClientOfPort@12 |
| NtAlpcOpenSenderProcess@24 |
| NtAlpcOpenSenderThread@24 |
| NtAlpcQueryInformation@20 |
| NtAlpcQueryInformationMessage@24 |
| NtAlpcRevokeSecurityContext@12 |
| NtAlpcSendWaitReceivePort@32 |
| NtAlpcSetInformation@16 |
| NtApphelpCacheControl@8 |
| NtAreMappedFilesTheSame@8 |
| NtAssignProcessToJobObject@8 |
| NtCallbackReturn@12 |
| NtCancelDeviceWakeupRequest@4 |
| NtCancelIoFile@8 |
| NtCancelIoFileEx@12 |
| NtCancelSynchronousIoFile@12 |
| NtCancelTimer@8 |
| NtClearEvent@4 |
| NtClose@4 |
| NtCloseObjectAuditAlarm@12 |
| NtCommitComplete@8 |
| NtCommitEnlistment@8 |
| NtCommitTransaction@8 |
| NtCompactKeys@8 |
| NtCompareTokens@12 |
| NtCompleteConnectPort@4 |
| NtCompressKey@4 |
| NtConnectPort@32 |
| NtContinue@8 |
| NtCreateDebugObject@16 |
| NtCreateDirectoryObject@12 |
| NtCreateEnlistment@32 |
| NtCreateEvent@20 |
| NtCreateEventPair@12 |
| NtCreateFile@44 |
| NtCreateIoCompletion@16 |
| NtCreateJobObject@12 |
| NtCreateJobSet@12 |
| NtCreateKey@28 |
| NtCreateKeyTransacted@32 |
| NtCreateKeyedEvent@16 |
| NtCreateMailslotFile@32 |
| NtCreateMutant@16 |
| NtCreateNamedPipeFile@56 |
| NtCreatePagingFile@16 |
| NtCreatePort@20 |
| NtCreatePrivateNamespace@16 |
| NtCreateProcess@32 |
| NtCreateProcessEx@36 |
| NtCreateProfile@36 |
| NtCreateProfileEx@40 |
| NtCreateResourceManager@28 |
| NtCreateSection@28 |
| NtCreateSemaphore@20 |
| NtCreateSymbolicLinkObject@16 |
| NtCreateThread@32 |
| NtCreateThreadEx@44 |
| NtCreateTimer@16 |
| NtCreateToken@52 |
| NtCreateTransaction@40 |
| NtCreateTransactionManager@24 |
| NtCreateUserProcess@44 |
| NtCreateWaitablePort@20 |
| NtCreateWorkerFactory@40 |
| NtCurrentTeb@0 |
| NtDebugActiveProcess@8 |
| NtDebugContinue@12 |
| NtDelayExecution@8 |
| NtDeleteAtom@4 |
| NtDeleteBootEntry@4 |
| NtDeleteDriverEntry@4 |
| NtDeleteFile@4 |
| NtDeleteKey@4 |
| NtDeleteObjectAuditAlarm@12 |
| NtDeletePrivateNamespace@4 |
| NtDeleteValueKey@8 |
| NtDeviceIoControlFile@40 |
| NtDisableLastKnownGood@0 |
| NtDisplayString@4 |
| NtDrawText@4 |
| NtDuplicateObject@28 |
| NtDuplicateToken@24 |
| NtEnableLastKnownGood@0 |
| NtEnumerateBootEntries@8 |
| NtEnumerateDriverEntries@8 |
| NtEnumerateKey@24 |
| NtEnumerateSystemEnvironmentValuesEx@12 |
| NtEnumerateTransactionObject@20 |
| NtEnumerateValueKey@24 |
| NtExtendSection@8 |
| NtFilterToken@24 |
| NtFindAtom@12 |
| NtFlushBuffersFile@8 |
| NtFlushInstallUILanguage@8 |
| NtFlushInstructionCache@12 |
| NtFlushKey@4 |
| NtFlushProcessWriteBuffers@0 |
| NtFlushVirtualMemory@16 |
| NtFlushWriteBuffer@0 |
| NtFreeUserPhysicalPages@12 |
| NtFreeVirtualMemory@16 |
| NtFreezeRegistry@4 |
| NtFreezeTransactions@8 |
| NtFsControlFile@40 |
| NtGetContextThread@8 |
| NtGetCurrentProcessorNumber@0 |
| NtGetDevicePowerState@8 |
| NtGetMUIRegistryInfo@12 |
| NtGetNextProcess@20 |
| NtGetNextThread@24 |
| NtGetNlsSectionPtr@20 |
| NtGetNotificationResourceManager@28 |
| NtGetPlugPlayEvent@16 |
| NtGetTickCount@0 |
| NtGetWriteWatch@28 |
| NtImpersonateAnonymousToken@4 |
| NtImpersonateClientOfPort@8 |
| NtImpersonateThread@12 |
| NtInitializeNlsFiles@16 ;Check!!! gendef says 12 |
| NtInitializeRegistry@4 |
| NtInitiatePowerAction@16 |
| NtIsProcessInJob@8 |
| NtIsSystemResumeAutomatic@0 |
| NtIsUILanguageComitted@0 |
| NtListenPort@8 |
| NtLoadDriver@4 |
| NtLoadKey2@12 |
| NtLoadKey@8 |
| NtLoadKeyEx@32 |
| NtLockFile@40 |
| NtLockProductActivationKeys@8 |
| NtLockRegistryKey@4 |
| NtLockVirtualMemory@16 |
| NtMakePermanentObject@4 |
| NtMakeTemporaryObject@4 |
| NtMapCMFModule@24 |
| NtMapUserPhysicalPages@12 |
| NtMapUserPhysicalPagesScatter@12 |
| NtMapViewOfSection@40 |
| NtModifyBootEntry@4 |
| NtModifyDriverEntry@4 |
| NtNotifyChangeDirectoryFile@36 |
| NtNotifyChangeKey@40 |
| NtNotifyChangeMultipleKeys@48 |
| NtNotifyChangeSession@32 |
| NtOpenDirectoryObject@12 |
| NtOpenEnlistment@20 |
| NtOpenEvent@12 |
| NtOpenEventPair@12 |
| NtOpenFile@24 |
| NtOpenIoCompletion@12 |
| NtOpenJobObject@12 |
| NtOpenKey@12 |
| NtOpenKeyEx@16 |
| NtOpenKeyTransacted@16 |
| NtOpenKeyTransactedEx@20 |
| NtOpenKeyedEvent@12 |
| NtOpenMutant@12 |
| NtOpenObjectAuditAlarm@48 |
| NtOpenPrivateNamespace@16 |
| NtOpenProcess@16 |
| NtOpenProcessToken@12 |
| NtOpenProcessTokenEx@16 |
| NtOpenResourceManager@20 |
| NtOpenSection@12 |
| NtOpenSemaphore@12 |
| NtOpenSession@12 |
| NtOpenSymbolicLinkObject@12 |
| NtOpenThread@16 |
| NtOpenThreadToken@16 |
| NtOpenThreadTokenEx@20 |
| NtOpenTimer@12 |
| NtOpenTransaction@20 |
| NtOpenTransactionManager@24 |
| NtPlugPlayControl@12 |
| NtPowerInformation@20 |
| NtPrePrepareComplete@8 |
| NtPrePrepareEnlistment@8 |
| NtPrepareComplete@8 |
| NtPrepareEnlistment@8 |
| NtPrivilegeCheck@12 |
| NtPrivilegeObjectAuditAlarm@24 |
| NtPrivilegedServiceAuditAlarm@20 |
| NtPropagationComplete@16 |
| NtPropagationFailed@12 |
| NtProtectVirtualMemory@20 |
| NtPulseEvent@8 |
| NtQueryAttributesFile@8 |
| NtQueryBootEntryOrder@8 |
| NtQueryBootOptions@8 |
| NtQueryDebugFilterState@8 |
| NtQueryDefaultLocale@8 |
| NtQueryDefaultUILanguage@4 |
| NtQueryDirectoryFile@44 |
| NtQueryDirectoryObject@28 |
| NtQueryDriverEntryOrder@8 |
| NtQueryEaFile@36 |
| NtQueryEvent@20 |
| NtQueryFullAttributesFile@8 |
| NtQueryInformationAtom@20 |
| NtQueryInformationEnlistment@20 |
| NtQueryInformationFile@20 |
| NtQueryInformationJobObject@20 |
| NtQueryInformationPort@20 |
| NtQueryInformationProcess@20 |
| NtQueryInformationResourceManager@20 |
| NtQueryInformationThread@20 |
| NtQueryInformationToken@20 |
| NtQueryInformationTransaction@20 |
| NtQueryInformationTransactionManager@20 |
| NtQueryInformationWorkerFactory@20 |
| NtQueryInstallUILanguage@4 |
| NtQueryIntervalProfile@8 |
| NtQueryIoCompletion@20 |
| NtQueryKey@20 |
| NtQueryLicenseValue@20 |
| NtQueryMultipleValueKey@24 |
| NtQueryMutant@20 |
| NtQueryObject@20 |
| NtQueryOpenSubKeys@8 |
| NtQueryOpenSubKeysEx@16 |
| NtQueryPerformanceCounter@8 |
| NtQueryPortInformationProcess@0 |
| NtQueryQuotaInformationFile@36 |
| NtQuerySection@20 |
| NtQuerySecurityAttributesToken@24 |
| NtQuerySecurityObject@20 |
| NtQuerySemaphore@20 |
| NtQuerySymbolicLinkObject@12 |
| NtQuerySystemEnvironmentValue@16 |
| NtQuerySystemEnvironmentValueEx@20 |
| NtQuerySystemInformation@16 |
| NtQuerySystemInformationEx@24 |
| NtQuerySystemTime@4 |
| NtQueryTimer@20 |
| NtQueryTimerResolution@12 |
| NtQueryValueKey@24 |
| NtQueryVirtualMemory@24 |
| NtQueryVolumeInformationFile@20 |
| NtQueueApcThread@20 |
| NtQueueApcThreadEx@24 |
| NtRaiseException@12 |
| NtRaiseHardError@24 |
| NtReadFile@36 |
| NtReadFileScatter@36 |
| NtReadOnlyEnlistment@8 |
| NtReadRequestData@24 |
| NtReadVirtualMemory@20 |
| NtRecoverEnlistment@8 |
| NtRecoverResourceManager@4 |
| NtRecoverTransactionManager@4 |
| NtRegisterProtocolAddressInformation@20 |
| NtRegisterThreadTerminatePort@4 |
| NtReleaseCMFViewOwnership@0 |
| NtReleaseKeyedEvent@16 |
| NtReleaseMutant@8 |
| NtReleaseSemaphore@12 |
| NtReleaseWorkerFactoryWorker@4 |
| NtRemoveIoCompletion@20 |
| NtRemoveIoCompletionEx@24 |
| NtRemoveProcessDebug@8 |
| NtRenameKey@8 |
| NtRenameTransactionManager@8 |
| NtReplaceKey@12 |
| NtReplacePartitionUnit@12 |
| NtReplyPort@8 |
| NtReplyWaitReceivePort@16 |
| NtReplyWaitReceivePortEx@20 |
| NtReplyWaitReplyPort@8 |
| NtRequestDeviceWakeup@4 |
| NtRequestPort@8 |
| NtRequestWaitReplyPort@12 |
| NtRequestWakeupLatency@4 |
| NtResetEvent@8 |
| NtResetWriteWatch@12 |
| NtRestoreKey@12 |
| NtResumeProcess@4 |
| NtResumeThread@8 |
| NtRollbackComplete@8 |
| NtRollbackEnlistment@8 |
| NtRollbackTransaction@8 |
| NtRollforwardTransactionManager@8 |
| NtSaveKey@8 |
| NtSaveKeyEx@12 |
| NtSaveMergedKeys@12 |
| NtSecureConnectPort@36 |
| NtSerializeBoot@0 |
| NtSetBootEntryOrder@8 |
| NtSetBootOptions@8 |
| NtSetContextThread@8 |
| NtSetDebugFilterState@12 |
| NtSetDefaultHardErrorPort@4 |
| NtSetDefaultLocale@8 |
| NtSetDefaultUILanguage@4 |
| NtSetDriverEntryOrder@8 |
| NtSetEaFile@16 |
| NtSetEvent@8 |
| NtSetEventBoostPriority@4 |
| NtSetHighEventPair@4 |
| NtSetHighWaitLowEventPair@4 |
| NtSetInformationDebugObject@20 |
| NtSetInformationEnlistment@16 |
| NtSetInformationFile@20 |
| NtSetInformationJobObject@16 |
| NtSetInformationKey@16 |
| NtSetInformationObject@16 |
| NtSetInformationProcess@16 |
| NtSetInformationResourceManager@16 |
| NtSetInformationThread@16 |
| NtSetInformationToken@16 |
| NtSetInformationTransaction@16 |
| NtSetInformationTransactionManager@16 |
| NtSetInformationWorkerFactory@16 |
| NtSetIntervalProfile@8 |
| NtSetIoCompletion@20 |
| NtSetIoCompletionEx@24 |
| NtSetLdtEntries@24 |
| NtSetLowEventPair@4 |
| NtSetLowWaitHighEventPair@4 |
| NtSetQuotaInformationFile@16 |
| NtSetSecurityObject@12 |
| NtSetSystemEnvironmentValue@8 |
| NtSetSystemEnvironmentValueEx@20 |
| NtSetSystemInformation@12 |
| NtSetSystemPowerState@12 |
| NtSetSystemTime@8 |
| NtSetThreadExecutionState@8 |
| NtSetTimer@28 |
| NtSetTimerEx@16 |
| NtSetTimerResolution@12 |
| NtSetUuidSeed@4 |
| NtSetValueKey@24 |
| NtSetVolumeInformationFile@20 |
| NtShutdownSystem@4 |
| NtShutdownWorkerFactory@8 |
| NtSignalAndWaitForSingleObject@16 |
| NtSinglePhaseReject@8 |
| NtStartProfile@4 |
| NtStopProfile@4 |
| NtSuspendProcess@4 |
| NtSuspendThread@8 |
| NtSystemDebugControl@24 |
| NtTerminateJobObject@8 |
| NtTerminateProcess@8 |
| NtTerminateThread@8 |
| NtTestAlert@0 |
| NtThawRegistry@0 |
| NtThawTransactions@0 |
| NtTraceControl@24 |
| NtTraceEvent@16 |
| NtTranslateFilePath@16 |
| NtUmsThreadYield@4 |
| NtUnloadDriver@4 |
| NtUnloadKey2@8 |
| NtUnloadKey@4 |
| NtUnloadKeyEx@8 |
| NtUnlockFile@20 |
| NtUnlockVirtualMemory@16 |
| NtUnmapViewOfSection@8 |
| NtVdmControl@8 |
| NtWaitForDebugEvent@16 |
| NtWaitForKeyedEvent@16 |
| NtWaitForMultipleObjects32@20 |
| NtWaitForMultipleObjects@20 |
| NtWaitForSingleObject@12 |
| NtWaitForWorkViaWorkerFactory@8 |
| NtWaitHighEventPair@4 |
| NtWaitLowEventPair@4 |
| NtWorkerFactoryWorkerReady@4 |
| NtWow64CallFunction64@28 |
| NtWow64CsrAllocateCaptureBuffer@8 |
| NtWow64CsrAllocateMessagePointer@12 |
| NtWow64CsrCaptureMessageBuffer@16 |
| NtWow64CsrCaptureMessageString@20 |
| NtWow64CsrClientCallServer@16 |
| NtWow64CsrClientConnectToServer@20 |
| NtWow64CsrFreeCaptureBuffer@4 |
| NtWow64CsrGetProcessId@0 |
| NtWow64CsrIdentifyAlertableThread@0 |
| NtWow64CsrVerifyRegion@8 |
| NtWow64DebuggerCall@20 |
| NtWow64GetCurrentProcessorNumberEx@4 |
| NtWow64GetNativeSystemInformation@16 |
| NtWow64InterlockedPopEntrySList@4 |
| NtWow64QueryInformationProcess64@20 |
| NtWow64QueryVirtualMemory64@32 |
| NtWow64ReadVirtualMemory64@28 |
| NtWow64WriteVirtualMemory64@28 |
| NtWriteFile@36 |
| NtWriteFileGather@36 |
| NtWriteRequestData@24 |
| NtWriteVirtualMemory@20 |
| NtYieldExecution@0 |
| ; Not sure, but we assume here standard DefWindowProc arguments |
| NtdllDefWindowProc_A@16 |
| NtdllDefWindowProc_W@16 |
| ; Not sure, but we assume here standard DefDlgProc arguments |
| NtdllDialogWndProc_A@16 |
| NtdllDialogWndProc_W@16 |
| PfxFindPrefix@8 |
| PfxInitialize@4 |
| PfxInsertPrefix@12 |
| PfxRemovePrefix@8 |
| RtlAbortRXact@4 |
| RtlAbsoluteToSelfRelativeSD@12 |
| RtlAcquirePebLock@0 |
| RtlAcquirePrivilege@16 |
| RtlAcquireReleaseSRWLockExclusive@4 |
| RtlAcquireResourceExclusive@8 |
| RtlAcquireResourceShared@8 |
| RtlAcquireSRWLockExclusive@4 |
| RtlAcquireSRWLockShared@4 |
| RtlActivateActivationContext@12 |
| RtlActivateActivationContextEx@16 |
| RtlAddAccessAllowedAce@16 |
| RtlAddAccessAllowedAceEx@20 |
| RtlAddAccessAllowedObjectAce@28 |
| RtlAddAccessDeniedAce@16 |
| RtlAddAccessDeniedAceEx@20 |
| RtlAddAccessDeniedObjectAce@28 |
| RtlAddAce@20 |
| RtlAddActionToRXact@24 |
| RtlAddAtomToAtomTable@12 |
| RtlAddAttributeActionToRXact@32 |
| RtlAddAuditAccessAce@24 |
| RtlAddAuditAccessAceEx@28 |
| RtlAddAuditAccessObjectAce@36 |
| RtlAddCompoundAce@24 |
| RtlAddIntegrityLabelToBoundaryDescriptor@8 |
| RtlAddMandatoryAce@24 |
| RtlAddRefActivationContext@4 |
| RtlAddRange@36 |
| RtlAddRefMemoryStream@4 |
| RtlAddSIDToBoundaryDescriptor@8 |
| RtlAddVectoredContinueHandler@8 |
| RtlAddVectoredExceptionHandler@8 |
| RtlAddressInSectionTable@12 |
| RtlAdjustPrivilege@16 |
| RtlAllocateActivationContextStack@4 |
| RtlAllocateAndInitializeSid@44 |
| RtlAllocateHandle@8 |
| RtlAllocateHeap@12 |
| RtlAllocateMemoryBlockLookaside@12 |
| RtlAllocateMemoryZone@12 |
| RtlAnsiCharToUnicodeChar@4 |
| RtlAnsiStringToUnicodeSize@4 |
| RtlAnsiStringToUnicodeString@12 |
| RtlAppendAsciizToString@8 |
| RtlAppendPathElement@12 |
| RtlAppendStringToString@8 |
| RtlAppendUnicodeStringToString@8 |
| RtlAppendUnicodeToString@8 |
| RtlApplicationVerifierStop@40 |
| RtlApplyRXact@4 |
| RtlApplyRXactNoFlush@4 |
| RtlAreAllAccessesGranted@8 |
| RtlAreAnyAccessesGranted@8 |
| RtlAreBitsClear@12 |
| RtlAreBitsSet@12 |
| RtlAssert@16 |
| RtlBarrier@8 |
| RtlBarrierForDelete@8 |
| RtlCallbackLpcClient@12 |
| RtlCancelTimer@8 |
| RtlCaptureContext@4 |
| RtlCaptureStackBackTrace@16 |
| RtlCaptureStackContext@12 |
| RtlCharToInteger@12 |
| RtlCheckForOrphanedCriticalSections@4 |
| RtlCheckRegistryKey@8 |
| RtlCleanUpTEBLangLists@0 |
| RtlClearAllBits@4 |
| RtlClearBits@12 |
| RtlCloneMemoryStream@8 |
| RtlCloneUserProcess@20 |
| RtlCmDecodeMemIoResource@8 |
| RtlCmEncodeMemIoResource@24 |
| RtlCommitDebugInfo@8 |
| RtlCommitMemoryStream@8 |
| RtlCompactHeap@8 |
| RtlCompareAltitudes@8 |
| RtlCompareMemory@12 |
| RtlCompareMemoryUlong@12 |
| RtlCompareString@12 |
| RtlCompareUnicodeString@12 |
| RtlCompareUnicodeStrings@20 |
| RtlCompressBuffer@32 |
| RtlComputeCrc32@12 |
| RtlComputeImportTableHash@12 |
| RtlComputePrivatizedDllName_U@12 |
| RtlConnectToSm@16 |
| RtlConsoleMultiByteToUnicodeN@24 |
| RtlContractHashTable@4 |
| RtlConvertExclusiveToShared@4 |
| RtlConvertLCIDToString@20 |
| RtlConvertLongToLargeInteger@4 |
| RtlConvertSharedToExclusive@4 |
| RtlConvertSidToUnicodeString@12 |
| RtlConvertToAutoInheritSecurityObject@24 |
| RtlConvertUiListToApiList@12 |
| RtlConvertUlongToLargeInteger@4 |
| RtlCopyExtendedContext@12 |
| RtlCopyLuid@8 |
| RtlCopyLuidAndAttributesArray@12 |
| RtlCopyMappedMemory@12 |
| RtlCopyMemoryStreamTo@24 |
| RtlCopyOutOfProcessMemoryStreamTo@24 |
| RtlCopyRangeList@8 |
| RtlCopySecurityDescriptor@8 |
| RtlCopySid@12 |
| RtlCopySidAndAttributesArray@28 |
| RtlCopyString@8 |
| RtlCopyUnicodeString@8 |
| RtlCreateAcl@12 |
| RtlCreateActivationContext@24 |
| RtlCreateAndSetSD@20 |
| RtlCreateAtomTable@8 |
| RtlCreateBootStatusDataFile@4 |
| RtlCreateBoundaryDescriptor@8 |
| RtlCreateEnvironment@8 |
| RtlCreateEnvironmentEx@12 |
| RtlCreateHashTable@12 |
| RtlCreateHeap@24 |
| RtlCreateLpcServer@24 |
| RtlCreateMemoryBlockLookaside@20 |
| RtlCreateMemoryZone@12 |
| RtlCreateProcessParameters@40 |
| RtlCreateProcessParametersEx@44 |
| RtlCreateProcessReflection@24 |
| RtlCreateQueryDebugBuffer@8 |
| RtlCreateRegistryKey@8 |
| RtlCreateSecurityDescriptor@8 |
| RtlCreateServiceSid@12 |
| RtlCreateSystemVolumeInformationFolder@4 |
| RtlCreateTagHeap@16 |
| RtlCreateTimer@28 |
| RtlCreateTimerQueue@4 |
| RtlCreateUnicodeString@8 |
| RtlCreateUnicodeStringFromAsciiz@8 |
| RtlCreateUserProcess@40 |
| RtlCreateUserSecurityObject@28 |
| RtlCreateUserStack@24 |
| RtlCreateUserThread@40 |
| RtlCreateVirtualAccountSid@16 |
| RtlCultureNameToLCID@8 |
| RtlCustomCPToUnicodeN@24 |
| RtlCutoverTimeToSystemTime@16 |
| RtlDeCommitDebugInfo@12 |
| RtlDeNormalizeProcessParams@4 |
| RtlDeactivateActivationContext@8 |
| RtlDebugPrintTimes@0 |
| RtlDecodePointer@4 |
| RtlDecodeSystemPointer@4 |
| RtlDecompressBuffer@24 |
| RtlDecompressFragment@32 |
| RtlDefaultNpAcl@4 |
| RtlDelete@4 |
| RtlDeleteAce@8 |
| RtlDeleteAtomFromAtomTable@8 |
| RtlDeleteBarrier@4 |
| RtlDeleteBoundaryDescriptor@4 |
| RtlDeleteCriticalSection@4 |
| RtlDeleteElementGenericTable@8 |
| RtlDeleteElementGenericTableAvl@8 |
| RtlDeleteHashTable@4 |
| RtlDeleteNoSplay@8 |
| RtlDeleteOwnersRanges@8 |
| RtlDeleteRange@24 |
| RtlDeleteRegistryValue@12 |
| RtlDeleteResource@4 |
| RtlDeleteSecurityObject@4 |
| RtlDeleteTimer@12 |
| RtlDeleteTimerQueue@4 |
| RtlDeleteTimerQueueEx@8 |
| RtlDeNormalizeProcessParams@4 |
| RtlDeregisterSecureMemoryCacheCallback@4 |
| RtlDeregisterWait@4 |
| RtlDeregisterWaitEx@8 |
| RtlDestroyAtomTable@4 |
| RtlDestroyEnvironment@4 |
| RtlDestroyHandleTable@4 |
| RtlDestroyHeap@4 |
| RtlDestroyMemoryBlockLookaside@4 |
| RtlDestroyMemoryZone@4 |
| RtlDestroyProcessParameters@4 |
| RtlDestroyQueryDebugBuffer@4 |
| RtlDetectHeapLeaks@0 |
| RtlDetermineDosPathNameType_U@4 |
| RtlDisableThreadProfiling@4 |
| RtlDllShutdownInProgress@0 |
| RtlDnsHostNameToComputerName@12 |
| RtlDoesFileExists_U@4 |
| RtlDosApplyFileIsolationRedirection_Ustr@36 |
| RtlDosPathNameToNtPathName_U@16 |
| RtlDosPathNameToNtPathName_U_WithStatus@16 |
| RtlDosPathNameToRelativeNtPathName_U@16 |
| RtlDosPathNameToRelativeNtPathName_U_WithStatus@16 |
| RtlDosSearchPath_U@24 |
| RtlDosSearchPath_Ustr@36 |
| RtlDowncaseUnicodeChar@4 |
| RtlDowncaseUnicodeString@12 |
| RtlDumpResource@4 |
| RtlDuplicateUnicodeString@12 |
| RtlEmptyAtomTable@8 |
| RtlEnableEarlyCriticalSectionEventCreation@0 |
| RtlEnableThreadProfiling@20 |
| RtlEncodePointer@4 |
| RtlEncodeSystemPointer@4 |
| RtlEndEnumerationHashTable@8 |
| RtlEndWeakEnumerationHashTable@8 |
| RtlEnlargedIntegerMultiply@8 |
| RtlEnlargedUnsignedDivide@16 |
| RtlEnlargedUnsignedMultiply@8 |
| RtlEnterCriticalSection@4 |
| RtlEnumProcessHeaps@8 |
| RtlEnumerateEntryHashTable@8 |
| RtlEnumerateGenericTable@8 |
| RtlEnumerateGenericTableAvl@8 |
| RtlEnumerateGenericTableLikeADirectory@28 |
| RtlEnumerateGenericTableWithoutSplaying@8 |
| RtlEnumerateGenericTableWithoutSplayingAvl@8 |
| RtlEqualComputerName@8 |
| RtlEqualDomainName@8 |
| RtlEqualLuid@8 |
| RtlEqualPrefixSid@8 |
| RtlEqualSid@8 |
| RtlEqualString@12 |
| RtlEqualUnicodeString@12 |
| RtlEraseUnicodeString@4 |
| RtlEthernetAddressToStringA@8 |
| RtlEthernetAddressToStringW@8 |
| RtlEthernetStringToAddressA@12 |
| RtlEthernetStringToAddressW@12 |
| RtlExitUserProcess@4 |
| ; Not sure, but we assume @4 |
| RtlExitUserThread@4 |
| RtlExpandEnvironmentStrings@24 |
| RtlExpandEnvironmentStrings_U@16 |
| RtlExpandHashTable@4 |
| RtlExtendMemoryBlockLookaside@8 |
| RtlExtendMemoryZone@8 |
| RtlExtendedIntegerMultiply@12 |
| RtlExtendedLargeIntegerDivide@16 |
| RtlExtendedMagicDivide@20 |
| RtlExtendHeap@16 |
| RtlFillMemory@12 |
| RtlFillMemoryUlong@12 |
| RtlFillMemoryUlonglong@16 |
| RtlFinalReleaseOutOfProcessMemoryStream@4 |
| RtlFindAceByType@12 |
| RtlFindActivationContextSectionGuid@20 |
| RtlFindActivationContextSectionString@20 |
| RtlFindCharInUnicodeString@16 |
| RtlFindClearBits@12 |
| RtlFindClearBitsAndSet@12 |
| RtlFindClearRuns@16 |
| RtlFindClosestEncodableLength@12 |
| RtlFindLastBackwardRunClear@12 |
| RtlFindLeastSignificantBit@8 |
| RtlFindLongestRunClear@8 |
| RtlFindLongestRunSet@8 |
| RtlFindMessage@20 |
| RtlFindMostSignificantBit@8 |
| RtlFindNextForwardRunClear@12 |
| RtlFindRange@48 |
| RtlFindSetBits@12 |
| RtlFindSetBitsAndClear@12 |
| RtlFirstEntrySList@4 |
| RtlFirstFreeAce@8 |
| RtlFlsAlloc@8 |
| RtlFlsFree@4 |
| RtlFlushSecureMemoryCache@8 |
| RtlFormatCurrentUserKeyPath@4 |
| RtlFormatMessage@36 |
| RtlFormatMessageEx@40 |
| RtlFreeActivationContextStack@4 |
| RtlFreeAnsiString@4 |
| RtlFreeHandle@8 |
| RtlFreeHeap@12 |
| RtlFreeMemoryBlockLookaside@8 |
| RtlFreeOemString@4 |
| RtlFreeSid@4 |
| RtlFreeThreadActivationContextStack@0 |
| RtlFreeUnicodeString@4 |
| RtlFreeUserStack@4 |
| RtlFreeUserThreadStack@8 |
| RtlGUIDFromString@8 |
| RtlGenerate8dot3Name@16 |
| RtlGetAce@12 |
| RtlGetActiveActivationContext@4 |
| RtlGetCallersAddress@8 |
| RtlGetCompressionWorkSpaceSize@12 |
| RtlGetControlSecurityDescriptor@12 |
| RtlGetCriticalSectionRecursionCount@4 |
| RtlGetCurrentDirectory_U@8 |
| RtlGetCurrentPeb@0 |
| RtlGetCurrentProcessorNumber@0 |
| RtlGetCurrentProcessorNumberEx@4 |
| RtlGetCurrentTransaction@0 |
| RtlGetDaclSecurityDescriptor@16 |
| RtlGetElementGenericTable@8 |
| RtlGetElementGenericTableAvl@8 |
| RtlGetEnabledExtendedFeatures@8 |
| RtlGetExtendedContextLength@8 |
| RtlGetExtendedFeaturesMask@4 |
| RtlGetFileMUIPath@28 |
| RtlGetFirstRange@12 |
| RtlGetFrame@0 |
| RtlGetFullPathName_U@16 |
| RtlGetFullPathName_UEx@20 |
| RtlGetFullPathName_UstrEx@32 |
| RtlGetGroupSecurityDescriptor@12 |
| RtlGetIntegerAtom@8 |
| RtlGetLastNtStatus@0 |
| RtlGetLastWin32Error@0 |
| RtlGetLengthWithoutLastFullDosOrNtPathElement@12 |
| RtlGetLengthWithoutTrailingPathSeperators@12 |
| RtlGetLocaleFileMappingAddress@12 |
| RtlGetLongestNtPathLength@0 |
| RtlGetNativeSystemInformation@16 |
| RtlGetNextRange@12 |
| RtlGetNextEntryHashTable@8 |
| RtlGetNtGlobalFlags@0 |
| RtlGetNtProductType@4 |
| RtlGetNtVersionNumbers@12 |
| RtlGetOwnerSecurityDescriptor@12 |
| RtlGetParentLocaleName@16 |
| RtlGetProcessHeaps@8 |
| RtlGetProcessPreferredUILanguages@16 |
| RtlGetProductInfo@20 |
| RtlGetSaclSecurityDescriptor@16 |
| RtlGetSecurityDescriptorRMControl@8 |
| RtlGetSetBootStatusData@24 |
| RtlGetSystemPreferredUILanguages@20 |
| RtlGetThreadErrorMode@0 |
| RtlGetThreadLangIdByIndex@16 |
| RtlGetThreadPreferredUILanguages@16 |
| RtlGetUILanguageInfo@20 |
| RtlGetUnloadEventTrace@0 |
| RtlGetUnloadEventTraceEx@12 |
| RtlGetUserInfoHeap@20 |
| RtlGetUserPreferredUILanguages@20 |
| RtlGetVersion@4 |
| RtlGUIDFromString@8 |
| RtlHashUnicodeString@16 |
| RtlHeapTrkInitialize@4 |
| RtlIdentifierAuthoritySid@4 |
| RtlIdnToAscii@20 |
| RtlIdnToNameprepUnicode@20 |
| RtlIdnToUnicode@20 |
| RtlImageDirectoryEntryToData@16 |
| RtlImageNtHeader@4 |
| RtlImageNtHeaderEx@20 |
| RtlImageRvaToSection@12 |
| RtlImageRvaToVa@16 |
| RtlImpersonateLpcClient@8 |
| RtlImpersonateSelf@4 |
| RtlImpersonateSelfEx@12 |
| RtlInitAnsiString@8 |
| RtlInitAnsiStringEx@8 |
| RtlInitBarrier@12 |
| RtlInitCodePageTable@8 |
| RtlInitEnumerationHashTable@8 |
| RtlInitMemoryStream@4 |
| RtlInitNlsTables@16 |
| RtlInitOutOfProcessMemoryStream@4 |
| RtlInitString@8 |
| RtlInitUnicodeString@8 |
| RtlInitUnicodeStringEx@8 |
| RtlInitWeakEnumerationHashTable@8 |
| RtlInitializeAtomPackage@4 |
| RtlInitializeBitMap@12 |
| RtlInitializeConditionVariable@4 |
| RtlInitializeContext@20 |
| RtlInitializeCriticalSection@4 |
| RtlInitializeCriticalSectionAndSpinCount@8 |
| RtlInitializeCriticalSectionEx@12 |
| RtlInitializeExceptionChain@4 |
| RtlInitializeExtendedContext@12 |
| RtlInitializeGenericTable@20 |
| RtlInitializeGenericTableAvl@20 |
| RtlInitializeHandleTable@12 |
| RtlInitializeNtUserPfn@24 |
| RtlInitializeRXact@12 |
| RtlInitializeResource@4 |
| RtlInitializeSListHead@4 |
| RtlInitializeSRWLock@4 |
| RtlInitializeSid@12 |
| RtlInsertElementGenericTable@16 |
| RtlInsertElementGenericTableAvl@16 |
| RtlInsertElementGenericTableFull@24 |
| RtlInsertElementGenericTableFullAvl@24 |
| RtlInsertEntryHashTable@16 |
| RtlInt64ToUnicodeString@16 |
| RtlIntegerToChar@16 |
| RtlIntegerToUnicodeString@12 |
| RtlInterlockedClearBitRun@12 |
| RtlInterlockedCompareExchange64@20 |
| RtlInterlockedFlushSList@4 |
| RtlInterlockedPopEntrySList@4 |
| RtlInterlockedPushEntrySList@8 |
| RtlInvertRangeList@8 |
| RtlInterlockedSetBitRun@12 |
| RtlIoDecodeMemIoResource@16 |
| RtlIoEncodeMemIoResource@40 |
| RtlIpv4AddressToStringA@8 |
| RtlIpv4AddressToStringExA@16 |
| RtlIpv4AddressToStringExW@16 |
| RtlIpv4AddressToStringW@8 |
| RtlIpv4StringToAddressA@16 |
| RtlIpv4StringToAddressExA@16 |
| RtlIpv4StringToAddressExW@16 |
| RtlIpv4StringToAddressW@16 |
| RtlIpv6AddressToStringA@8 |
| RtlIpv6AddressToStringExA@20 |
| RtlIpv6AddressToStringExW@20 |
| RtlIpv6AddressToStringW@8 |
| RtlIpv6StringToAddressA@12 |
| RtlIpv6StringToAddressExA@16 |
| RtlIpv6StringToAddressExW@16 |
| RtlIpv6StringToAddressW@12 |
| RtlIsActivationContextActive@4 |
| RtlIsCriticalSectionLocked@4 |
| RtlIsCriticalSectionLockedByThread@4 |
| RtlIsCurrentThreadAttachExempt@0 |
| RtlIsDosDeviceName_U@4 |
| RtlIsGenericTableEmpty@4 |
| RtlIsGenericTableEmptyAvl@4 |
| RtlIsNameInExpression@16 |
| RtlIsNameLegalDOS8Dot3@12 |
| RtlIsNormalizedString@16 |
| RtlIsRangeAvailable@40 |
| RtlIsTextUnicode@12 |
| RtlIsThreadWithinLoaderCallout@0 |
| RtlIsValidHandle@8 |
| RtlIsValidIndexHandle@12 |
| RtlIsValidLocaleName@8 |
| RtlKnownExceptionFilter@4 |
| RtlLCIDToCultureName@8 |
| RtlLargeIntegerAdd@16 |
| RtlLargeIntegerArithmeticShift@12 |
| RtlLargeIntegerDivide@20 |
| RtlLargeIntegerNegate@8 |
| RtlLargeIntegerShiftLeft@12 |
| RtlLargeIntegerShiftRight@12 |
| RtlLargeIntegerSubtract@16 |
| RtlLargeIntegerToChar@16 |
| RtlLcidToLocaleName@16 |
| RtlLeaveCriticalSection@4 |
| RtlLengthRequiredSid@4 |
| RtlLengthSecurityDescriptor@4 |
| RtlLengthSid@4 |
| RtlLoadString@32 |
| RtlLocalTimeToSystemTime@8 |
| RtlLocaleNameToLcid@12 |
| RtlLocateExtendedFeature@12 |
| RtlLocateLegacyContext@8 |
| RtlLockBootStatusData@4 |
| RtlLockCurrentThread@0 |
| RtlLockHeap@4 |
| RtlLockMemoryBlockLookaside@4 |
| RtlLockMemoryStreamRegion@24 |
| RtlLockMemoryZone@4 |
| RtlLockModuleSection@4 |
| RtlLogStackBackTrace@0 |
| RtlLookupAtomInAtomTable@12 |
| RtlLookupElementGenericTable@8 |
| RtlLookupElementGenericTableAvl@8 |
| RtlLookupElementGenericTableFull@16 |
| RtlLookupElementGenericTableFullAvl@16 |
| RtlLookupEntryHashTable@12 |
| RtlMakeSelfRelativeSD@12 |
| RtlMapGenericMask@8 |
| RtlMapSecurityErrorToNtStatus@4 |
| RtlMergeRangeLists@16 |
| RtlMoveMemory@12 |
| RtlMultiAppendUnicodeStringBuffer@12 |
| RtlMultiByteToUnicodeN@20 |
| RtlMultiByteToUnicodeSize@12 |
| RtlMultipleAllocateHeap@20 |
| RtlMultipleFreeHeap@16 |
| RtlNewInstanceSecurityObject@40 |
| RtlNewSecurityGrantedAccess@24 |
| RtlNewSecurityObject@24 |
| RtlNewSecurityObjectEx@32 |
| RtlNewSecurityObjectWithMultipleInheritance@36 |
| RtlNormalizeProcessParams@4 |
| RtlNormalizeString@20 |
| RtlNtPathNameToDosPathName@16 |
| RtlNtStatusToDosError@4 |
| RtlNtStatusToDosErrorNoTeb@4 |
| RtlNumberGenericTableElements@4 |
| RtlNumberGenericTableElementsAvl@4 |
| RtlNumberOfClearBits@4 |
| RtlNumberOfSetBits@4 |
| RtlNumberOfSetBitsUlongPtr@4 |
| RtlOemStringToUnicodeSize@4 |
| RtlOemStringToUnicodeString@12 |
| RtlOemToUnicodeN@20 |
| RtlOpenCurrentUser@8 |
| RtlOwnerAcesPresent@4 |
| RtlPcToFileHeader@8 |
| RtlPinAtomInAtomTable@8 |
| RtlPopFrame@4 |
| RtlPrefixString@12 |
| RtlPrefixUnicodeString@12 |
| RtlProcessFlsData@4 |
| RtlProtectHeap@8 |
| RtlPushFrame@4 |
| RtlQueryActivationContextApplicationSettings@28 |
| RtlQueryAtomInAtomTable@24 |
| RtlQueryCriticalSectionOwner@4 |
| RtlQueryDepthSList@4 |
| RtlQueryDynamicTimeZoneInformation@4 |
| RtlQueryElevationFlags@4 |
| RtlQueryEnvironmentVariable@24 |
| RtlQueryEnvironmentVariable_U@12 |
| RtlQueryHeapInformation@20 |
| RtlQueryInformationAcl@16 |
| RtlQueryInformationActivationContext@28 |
| RtlQueryInformationActiveActivationContext@16 |
| RtlQueryInterfaceMemoryStream@12 |
| RtlQueryModuleInformation@12 |
| RtlQueryPerformanceCounter@4 |
| RtlQueryPerformanceFrequency@4 |
| RtlQueryProcessBackTraceInformation@4 |
| RtlQueryProcessDebugInformation@12 |
| RtlQueryProcessHeapInformation@4 |
| RtlQueryProcessLockInformation@4 |
| RtlQueryRegistryValues@20 |
| RtlQuerySecurityObject@20 |
| RtlQueryTagHeap@20 |
| RtlQueryThreadProfiling@8 |
| RtlQueryTimeZoneInformation@4 |
| RtlQueueApcWow64Thread@20 |
| RtlQueueWorkItem@12 |
| RtlRaiseException@4 |
| RtlRaiseStatus@4 |
| RtlRandom@4 |
| RtlRandomEx@4 |
| RtlReAllocateHeap@16 |
| RtlReadMemoryStream@16 |
| RtlReadOutOfProcessMemoryStream@16 |
| RtlReadThreadProfilingData@12 |
| RtlRealPredecessor@4 |
| RtlRealSuccessor@4 |
| RtlRegisterSecureMemoryCacheCallback@4 |
| RtlRegisterThreadWithCsrss@0 |
| RtlRegisterWait@24 |
| RtlReleaseActivationContext@4 |
| RtlReleaseMemoryStream@4 |
| RtlReleasePebLock@0 |
| RtlReleasePrivilege@4 |
| RtlReleaseRelativeName@4 |
| RtlReleaseResource@4 |
| RtlReleaseSRWLockExclusive@4 |
| RtlReleaseSRWLockShared@4 |
| RtlRemoteCall@28 |
| RtlRemoveEntryHashTable@12 |
| RtlRemovePrivileges@12 |
| RtlRemoveVectoredContinueHandler@4 |
| RtlRemoveVectoredExceptionHandler@4 |
| RtlReplaceSidInSd@16 |
| RtlReportException@12 |
| RtlReportSilentProcessExit@8 |
| RtlReportSqmEscalation@24 |
| RtlResetMemoryBlockLookaside@4 |
| RtlResetMemoryZone@4 |
| RtlResetRtlTranslations@4 |
| RtlRestoreLastWin32Error@4 |
| RtlRetrieveNtUserPfn@12 |
| RtlRevertMemoryStream@4 |
| RtlRunDecodeUnicodeString@8 |
| RtlRunEncodeUnicodeString@8 |
| RtlRunOnceBeginInitialize@12 |
| RtlRunOnceComplete@12 |
| RtlRunOnceExecuteOnce@16 |
| RtlRunOnceInitialize@4 |
| RtlSecondsSince1970ToTime@8 |
| RtlSecondsSince1980ToTime@8 |
| RtlSeekMemoryStream@20 |
| RtlSelfRelativeToAbsoluteSD2@8 |
| RtlSelfRelativeToAbsoluteSD@44 |
| RtlSendMsgToSm@8 |
| RtlSetAllBits@4 |
| RtlSetAttributesSecurityDescriptor@12 |
| RtlSetBits@12 |
| RtlSetControlSecurityDescriptor@12 |
| RtlSetCriticalSectionSpinCount@8 |
| RtlSetCurrentDirectory_U@4 |
| RtlSetCurrentEnvironment@8 |
| RtlSetCurrentTransaction@4 |
| RtlSetDaclSecurityDescriptor@16 |
| RtlSetDynamicTimeZoneInformation@4 |
| RtlSetEnvironmentStrings@8 |
| RtlSetEnvironmentVar@20 |
| RtlSetEnvironmentVariable@12 |
| RtlSetExtendedFeaturesMask@12 |
| RtlSetGroupSecurityDescriptor@12 |
| RtlSetHeapInformation@16 |
| RtlSetInformationAcl@16 |
| RtlSetIoCompletionCallback@12 |
| RtlSetLastWin32Error@4 |
| RtlSetLastWin32ErrorAndNtStatusFromNtStatus@4 |
| RtlSetMemoryStreamSize@12 |
| RtlSetOwnerSecurityDescriptor@12 |
| RtlSetProcessDebugInformation@12 |
| RtlSetProcessIsCritical@0 |
| RtlSetProcessPreferredUILanguages@12 |
| RtlSetSaclSecurityDescriptor@16 |
| RtlSetSecurityDescriptorRMControl@8 |
| RtlSetSecurityObject@20 |
| RtlSetSecurityObjectEx@24 |
| RtlSetThreadErrorMode@8 |
| RtlSetThreadIsCritical@0 |
| RtlSetThreadPoolStartFunc@8 |
| RtlSetThreadPreferredUILanguages@12 |
| RtlSetTimeZoneInformation@4 |
| RtlSetTimer@28 |
| RtlSetUnhandledExceptionFilter@4 |
| RtlSetUserCallbackExceptionFilter@4 |
| RtlSetUserFlagsHeap@20 |
| RtlSetUserValueHeap@16 |
| RtlShutdownLpcServer@4 |
| RtlSidDominates@12 |
| RtlSidEqualLevel@12 |
| RtlSidHashInitialize@12 |
| RtlSidHashLookup@8 |
| RtlSidIsHigherLevel@12 |
| RtlSizeHeap@12 |
| RtlSleepConditionVariableCS@12 |
| RtlSleepConditionVariableSRW@16 |
| RtlSplay@4 |
| RtlStartRXact@4 |
| RtlStatMemoryStream@12 |
| RtlStringFromGUID@8 |
| RtlSubAuthorityCountSid@4 |
| RtlSubAuthoritySid@8 |
| RtlSubtreePredecessor@4 |
| RtlSubtreeSuccessor@4 |
| RtlSystemTimeToLocalTime@8 |
| RtlTestBit@8 |
| RtlTimeFieldsToTime@8 |
| RtlTimeToElapsedTimeFields@8 |
| RtlTimeToSecondsSince1970@8 |
| RtlTimeToSecondsSince1980@8 |
| RtlTimeToTimeFields@8 |
| RtlTraceDatabaseAdd@16 |
| RtlTraceDatabaseCreate@20 |
| RtlTraceDatabaseDestroy@4 |
| RtlTraceDatabaseEnumerate@12 |
| RtlTraceDatabaseFind@16 |
| RtlTraceDatabaseLock@4 |
| RtlTraceDatabaseUnlock@4 |
| RtlTraceDatabaseValidate@4 |
| RtlTryAcquirePebLock@0 |
| RtlTryAcquireSRWLockExclusive@4 |
| RtlTryAcquireSRWLockShared@4 |
| RtlTryEnterCriticalSection@4 |
| RtlUTF8ToUnicodeN@20 |
| RtlUnhandledExceptionFilter2@8 |
| RtlUnhandledExceptionFilter@4 |
| RtlUnicodeStringToAnsiSize@4 |
| RtlUnicodeStringToAnsiString@12 |
| RtlUnicodeStringToCountedOemString@12 |
| RtlUnicodeStringToInteger@12 |
| RtlUnicodeStringToOemSize@4 |
| RtlUnicodeStringToOemString@12 |
| RtlUnicodeToCustomCPN@24 |
| RtlUnicodeToMultiByteN@20 |
| RtlUnicodeToMultiByteSize@12 |
| RtlUnicodeToOemN@20 |
| RtlUnicodeToUTF8N@20 |
| RtlUniform@4 |
| RtlUnlockBootStatusData@4 |
| RtlUnlockCurrentThread@0 |
| RtlUnlockHeap@4 |
| RtlUnlockMemoryBlockLookaside@4 |
| RtlUnlockMemoryStreamRegion@24 |
| RtlUnlockMemoryZone@4 |
| RtlUnlockModuleSection@4 |
| RtlUnwind@16 |
| RtlUpcaseUnicodeChar@4 |
| RtlUpcaseUnicodeString@12 |
| RtlUpcaseUnicodeStringToAnsiString@12 |
| RtlUpcaseUnicodeStringToCountedOemString@12 |
| RtlUpcaseUnicodeStringToOemString@12 |
| RtlUpcaseUnicodeToCustomCPN@24 |
| RtlUpcaseUnicodeToMultiByteN@20 |
| RtlUpcaseUnicodeToOemN@20 |
| RtlUpdateClonedCriticalSection@4 |
| RtlUpdateClonedSRWLock@8 |
| RtlUpdateTimer@16 |
| RtlUpperChar@4 |
| RtlUpperString@8 |
| RtlUsageHeap@12 |
| ; Not sure. |
| RtlUserThreadStart |
| RtlValidAcl@4 |
| RtlValidRelativeSecurityDescriptor@12 |
| RtlValidSecurityDescriptor@4 |
| RtlValidSid@4 |
| RtlValidateHeap@12 |
| RtlValidateProcessHeaps@0 |
| RtlValidateUnicodeString@8 |
| RtlVerifyVersionInfo@16 |
| RtlWakeAllConditionVariable@4 |
| RtlWakeConditionVariable@4 |
| RtlWalkFrameChain@12 |
| RtlWalkHeap@8 |
| RtlWeaklyEnumerateEntryHashTable@8 |
| RtlWerpReportException@16 |
| RtlWow64CallFunction64@28 |
| RtlWow64EnableFsRedirection@4 |
| RtlWow64EnableFsRedirectionEx@8 |
| RtlWow64LogMessageInEventLogger@12 |
| RtlWriteMemoryStream@16 |
| RtlWriteRegistryValue@24 |
| RtlZeroHeap@8 |
| RtlZeroMemory@8 |
| RtlZombifyActivationContext@4 |
| RtlpApplyLengthFunction@16 |
| RtlpCheckDynamicTimeZoneInformation@8 |
| RtlpCleanupRegistryKeys@0 |
| RtlpConvertCultureNamesToLCIDs@8 |
| RtlpConvertLCIDsToCultureNames@8 |
| RtlpCreateProcessRegistryInfo@4 |
| RtlpEnsureBufferSize@12 |
| RtlpGetLCIDFromLangInfoNode@12 |
| RtlpGetNameFromLangInfoNode@12 |
| RtlpGetSystemDefaultUILanguage@4 ; Check!!! gendef says @8 |
| RtlpGetUserOrMachineUILanguage4NLS@12 |
| RtlpInitializeLangRegistryInfo@4 |
| RtlpIsQualifiedLanguage@12 |
| RtlpLoadMachineUIByPolicy@12 |
| RtlpLoadUserUIByPolicy@12 |
| RtlpMuiFreeLangRegistryInfo@4 |
| RtlpMuiRegCreateRegistryInfo@0 |
| RtlpMuiRegFreeRegistryInfo@8 |
| RtlpMuiRegLoadRegistryInfo@8 |
| RtlpNotOwnerCriticalSection@0 ; Check!!! gebdef says @4 |
| RtlpNtCreateKey@24 |
| RtlpNtEnumerateSubKey@16 |
| RtlpNtMakeTemporaryKey@4 |
| RtlpNtOpenKey@16 |
| RtlpNtQueryValueKey@20 |
| RtlpNtSetValueKey@16 |
| RtlpQueryDefaultUILanguage@8 |
| ; Not sure. |
| RtlpQueryProcessDebugInformationRemote |
| RtlpRefreshCachedUILanguage@8 |
| RtlpSetInstallLanguage@8 |
| RtlpSetPreferredUILanguages@12 |
| RtlpSetUserPreferredUILanguages@12 |
| RtlpUnWaitCriticalSection@4 |
| RtlpVerifyAndCommitUILanguageSettings@4 |
| RtlpWaitForCriticalSection@4 |
| RtlxAnsiStringToUnicodeSize@4 |
| RtlxOemStringToUnicodeSize@4 |
| RtlxUnicodeStringToAnsiSize@4 |
| RtlxUnicodeStringToOemSize@4 |
| SbExecuteProcedure@20 |
| SbSelectProcedure@16 |
| ShipAssert@8 |
| ShipAssertGetBufferInfo@8 |
| ShipAssertMsgA@12 |
| ShipAssertMsgW@12 |
| TpAllocAlpcCompletion@20 |
| TpAllocAlpcCompletionEx@20 |
| TpAllocCleanupGroup@4 |
| TpAllocIoCompletion@20 |
| TpAllocPool@8 |
| TpAllocTimer@16 |
| TpAllocWait@16 |
| TpAllocWork@16 |
| TpAlpcRegisterCompletionList@4 |
| TpAlpcUnregisterCompletionList@4 |
| TpCallbackIndependent@4 |
| TpCallbackLeaveCriticalSectionOnCompletion@8 |
| TpCallbackMayRunLong@4 |
| TpCallbackReleaseMutexOnCompletion@8 |
| TpCallbackReleaseSemaphoreOnCompletion@12 |
| TpCallbackSetEventOnCompletion@8 |
| TpCallbackUnloadDllOnCompletion@8 |
| TpCancelAsyncIoOperation@4 |
| TpCaptureCaller@4 |
| TpCheckTerminateWorker@4 |
| TpDbgDumpHeapUsage@12 |
| TpDbgGetFreeInfo@8 |
| TpDbgSetLogRoutine@4 |
| TpDisablePoolCallbackChecks@4 |
| TpDisassociateCallback@4 |
| TpIsTimerSet@4 |
| TpPoolFreeUnusedNodes@4 |
| TpPostWork@4 |
| TpQueryPoolStackInformation@8 |
| TpReleaseAlpcCompletion@4 |
| TpReleaseCleanupGroup@4 |
| TpReleaseCleanupGroupMembers@12 |
| TpReleaseIoCompletion@4 |
| TpReleasePool@4 |
| TpReleaseTimer@4 |
| TpReleaseWait@4 |
| TpReleaseWork@4 |
| TpSetDefaultPoolMaxThreads@4 |
| TpSetDefaultPoolStackInformation@4 |
| TpSetPoolMaxThreads@8 |
| TpSetPoolMinThreads@8 |
| TpSetPoolStackInformation@8 |
| TpSetTimer@16 |
| TpSetWait@12 |
| TpSimpleTryPost@12 |
| TpStartAsyncIoOperation@4 |
| TpWaitForAlpcCompletion@4 |
| TpWaitForIoCompletion@8 |
| TpWaitForTimer@8 |
| TpWaitForWait@8 |
| TpWaitForWork@8 |
| VerSetConditionMask@16 |
| WerCheckEventEscalation@8 |
| WerReportSQMEvent@12 |
| WerReportWatsonEvent@16 |
| WerReportSQMEvent@16 |
| WinSqmAddToAverageDWORD@12 |
| WinSqmAddToStream@16 |
| WinSqmAddToStreamEx@20 |
| WinSqmCheckEscalationAddToStreamEx@20 |
| WinSqmCheckEscalationSetDWORD64@20 |
| WinSqmCheckEscalationSetDWORD@16 |
| WinSqmCheckEscalationSetString@16 |
| WinSqmCommonDatapointDelete@4 |
| WinSqmCommonDatapointSetDWORD64@16 |
| WinSqmCommonDatapointSetDWORD@12 |
| WinSqmCommonDatapointSetStreamEx@20 |
| WinSqmCommonDatapointSetString@12 |
| WinSqmEndSession@4 |
| WinSqmEventEnabled@8 |
| WinSqmEventWrite@12 |
| WinSqmGetEscalationRuleStatus@8 |
| WinSqmGetInstrumentationProperty@16 |
| WinSqmIncrementDWORD@12 |
| WinSqmIsOptedIn@0 |
| WinSqmIsOptedInEx@4 |
| WinSqmSetDWORD64@16 |
| WinSqmSetDWORD@12 |
| WinSqmSetEscalationInfo@16 |
| WinSqmSetIfMaxDWORD@12 |
| WinSqmSetIfMinDWORD@12 |
| WinSqmSetString@12 |
| WinSqmStartSession@12 |
| ZwAcceptConnectPort@24 |
| ZwAccessCheck@32 |
| ZwAccessCheckAndAuditAlarm@44 |
| ZwAccessCheckByType@44 |
| ZwAccessCheckByTypeAndAuditAlarm@64 |
| ZwAccessCheckByTypeResultList@44 |
| ZwAccessCheckByTypeResultListAndAuditAlarm@64 |
| ZwAccessCheckByTypeResultListAndAuditAlarmByHandle@68 |
| ZwAcquireCMFViewOwnership@12 |
| ZwAddAtom@12 |
| ZwAddBootEntry@8 |
| ZwAddDriverEntry@8 |
| ZwAdjustGroupsToken@24 |
| ZwAdjustPrivilegesToken@24 |
| ZwAlertResumeThread@8 |
| ZwAlertThread@4 |
| ZwAllocateLocallyUniqueId@4 |
| ZwAllocateReserveObject@12 |
| ZwAllocateUserPhysicalPages@12 |
| ZwAllocateUuids@16 |
| ZwAllocateVirtualMemory@24 |
| ZwAlpcAcceptConnectPort@36 |
| ZwAlpcCancelMessage@12 |
| ZwAlpcConnectPort@44 |
| ZwAlpcCreatePort@12 |
| ZwAlpcCreatePortSection@24 |
| ZwAlpcCreateResourceReserve@16 |
| ZwAlpcCreateSectionView@12 |
| ZwAlpcCreateSecurityContext@12 |
| ZwAlpcDeletePortSection@12 |
| ZwAlpcDeleteResourceReserve@12 |
| ZwAlpcDeleteSectionView@12 |
| ZwAlpcDeleteSecurityContext@12 |
| ZwAlpcDisconnectPort@8 |
| ZwAlpcImpersonateClientOfPort@12 |
| ZwAlpcOpenSenderProcess@24 |
| ZwAlpcOpenSenderThread@24 |
| ZwAlpcQueryInformation@20 |
| ZwAlpcQueryInformationMessage@24 |
| ZwAlpcRevokeSecurityContext@12 |
| ZwAlpcSendWaitReceivePort@32 |
| ZwAlpcSetInformation@16 |
| ZwApphelpCacheControl@8 |
| ZwAreMappedFilesTheSame@8 |
| ZwAssignProcessToJobObject@8 |
| ZwCallbackReturn@12 |
| ZwCancelDeviceWakeupRequest@4 |
| ZwCancelIoFile@8 |
| ZwCancelIoFileEx@12 |
| ZwCancelSynchronousIoFile@12 |
| ZwCancelTimer@8 |
| ZwClearEvent@4 |
| ZwClose@4 |
| ZwCloseObjectAuditAlarm@12 |
| ZwCommitComplete@8 |
| ZwCommitEnlistment@8 |
| ZwCommitTransaction@8 |
| ZwCompactKeys@8 |
| ZwCompareTokens@12 |
| ZwCompleteConnectPort@4 |
| ZwCompressKey@4 |
| ZwConnectPort@32 |
| ZwContinue@8 |
| ZwCreateDebugObject@16 |
| ZwCreateDirectoryObject@12 |
| ZwCreateEnlistment@32 |
| ZwCreateEvent@20 |
| ZwCreateEventPair@12 |
| ZwCreateFile@44 |
| ZwCreateIoCompletion@16 |
| ZwCreateJobObject@12 |
| ZwCreateJobSet@12 |
| ZwCreateKey@28 |
| ZwCreateKeyTransacted@32 |
| ZwCreateKeyedEvent@16 |
| ZwCreateMailslotFile@32 |
| ZwCreateMutant@16 |
| ZwCreateNamedPipeFile@56 |
| ZwCreatePagingFile@16 |
| ZwCreatePort@20 |
| ZwCreatePrivateNamespace@16 |
| ZwCreateProcess@32 |
| ZwCreateProcessEx@36 |
| ZwCreateProfile@36 |
| ZwCreateProfileEx@40 |
| ZwCreateResourceManager@28 |
| ZwCreateSection@28 |
| ZwCreateSemaphore@20 |
| ZwCreateSymbolicLinkObject@16 |
| ZwCreateThread@32 |
| ZwCreateThreadEx@44 |
| ZwCreateTimer@16 |
| ZwCreateToken@52 |
| ZwCreateTransaction@40 |
| ZwCreateTransactionManager@24 |
| ZwCreateUserProcess@44 |
| ZwCreateWaitablePort@20 |
| ZwCreateWorkerFactory@40 |
| ZwDebugActiveProcess@8 |
| ZwDebugContinue@12 |
| ZwDelayExecution@8 |
| ZwDeleteAtom@4 |
| ZwDeleteBootEntry@4 |
| ZwDeleteDriverEntry@4 |
| ZwDeleteFile@4 |
| ZwDeleteKey@4 |
| ZwDeleteObjectAuditAlarm@12 |
| ZwDeletePrivateNamespace@4 |
| ZwDeleteValueKey@8 |
| ZwDeviceIoControlFile@40 |
| ZwDisableLastKnownGood@0 |
| ZwDisplayString@4 |
| ZwDrawText@4 |
| ZwDuplicateObject@28 |
| ZwDuplicateToken@24 |
| ZwEnableLastKnownGood@0 |
| ZwEnumerateBootEntries@8 |
| ZwEnumerateDriverEntries@8 |
| ZwEnumerateKey@24 |
| ZwEnumerateSystemEnvironmentValuesEx@12 |
| ZwEnumerateTransactionObject@20 |
| ZwEnumerateValueKey@24 |
| ZwExtendSection@8 |
| ZwFilterToken@24 |
| ZwFindAtom@12 |
| ZwFlushBuffersFile@8 |
| ZwFlushInstallUILanguage@8 |
| ZwFlushInstructionCache@12 |
| ZwFlushKey@4 |
| ZwFlushProcessWriteBuffers@0 |
| ZwFlushVirtualMemory@16 |
| ZwFlushWriteBuffer@0 |
| ZwFreeUserPhysicalPages@12 |
| ZwFreeVirtualMemory@16 |
| ZwFreezeRegistry@4 |
| ZwFreezeTransactions@8 |
| ZwFsControlFile@40 |
| ZwGetContextThread@8 |
| ZwGetCurrentProcessorNumber@0 |
| ZwGetDevicePowerState@8 |
| ZwGetMUIRegistryInfo@12 |
| ZwGetNextProcess@20 |
| ZwGetNextThread@24 |
| ZwGetNlsSectionPtr@20 |
| ZwGetNotificationResourceManager@28 |
| ZwGetPlugPlayEvent@16 |
| ZwGetTickCount@0 |
| ZwGetWriteWatch@28 |
| ZwImpersonateAnonymousToken@4 |
| ZwImpersonateClientOfPort@8 |
| ZwImpersonateThread@12 |
| ZwInitializeNlsFiles@16 |
| ZwInitializeRegistry@4 |
| ZwInitiatePowerAction@16 |
| ZwIsProcessInJob@8 |
| ZwIsSystemResumeAutomatic@0 |
| ZwIsUILanguageComitted@0 |
| ZwListenPort@8 |
| ZwLoadDriver@4 |
| ZwLoadKey2@12 |
| ZwLoadKey@8 |
| ZwLoadKeyEx@32 |
| ZwLockFile@40 |
| ZwLockProductActivationKeys@8 |
| ZwLockRegistryKey@4 |
| ZwLockVirtualMemory@16 |
| ZwMakePermanentObject@4 |
| ZwMakeTemporaryObject@4 |
| ZwMapCMFModule@24 |
| ZwMapUserPhysicalPages@12 |
| ZwMapUserPhysicalPagesScatter@12 |
| ZwMapViewOfSection@40 |
| ZwModifyBootEntry@4 |
| ZwModifyDriverEntry@4 |
| ZwNotifyChangeDirectoryFile@36 |
| ZwNotifyChangeKey@40 |
| ZwNotifyChangeMultipleKeys@48 |
| ZwNotifyChangeSession@32 |
| ZwOpenDirectoryObject@12 |
| ZwOpenEnlistment@20 |
| ZwOpenEvent@12 |
| ZwOpenEventPair@12 |
| ZwOpenFile@24 |
| ZwOpenIoCompletion@12 |
| ZwOpenJobObject@12 |
| ZwOpenKey@12 |
| ZwOpenKeyEx@16 |
| ZwOpenKeyTransacted@16 |
| ZwOpenKeyTransactedEx@20 |
| ZwOpenKeyedEvent@12 |
| ZwOpenMutant@12 |
| ZwOpenObjectAuditAlarm@48 |
| ZwOpenPrivateNamespace@16 |
| ZwOpenProcess@16 |
| ZwOpenProcessToken@12 |
| ZwOpenProcessTokenEx@16 |
| ZwOpenResourceManager@20 |
| ZwOpenSection@12 |
| ZwOpenSemaphore@12 |
| ZwOpenSession@12 |
| ZwOpenSymbolicLinkObject@12 |
| ZwOpenThread@16 |
| ZwOpenThreadToken@16 |
| ZwOpenThreadTokenEx@20 |
| ZwOpenTimer@12 |
| ZwOpenTransaction@20 |
| ZwOpenTransactionManager@24 |
| ZwPlugPlayControl@12 |
| ZwPowerInformation@20 |
| ZwPrePrepareComplete@8 |
| ZwPrePrepareEnlistment@8 |
| ZwPrepareComplete@8 |
| ZwPrepareEnlistment@8 |
| ZwPrivilegeCheck@12 |
| ZwPrivilegeObjectAuditAlarm@24 |
| ZwPrivilegedServiceAuditAlarm@20 |
| ZwPropagationComplete@16 |
| ZwPropagationFailed@12 |
| ZwProtectVirtualMemory@20 |
| ZwPulseEvent@8 |
| ZwQueryAttributesFile@8 |
| ZwQueryBootEntryOrder@8 |
| ZwQueryBootOptions@8 |
| ZwQueryDebugFilterState@8 |
| ZwQueryDefaultLocale@8 |
| ZwQueryDefaultUILanguage@4 |
| ZwQueryDirectoryFile@44 |
| ZwQueryDirectoryObject@28 |
| ZwQueryDriverEntryOrder@8 |
| ZwQueryEaFile@36 |
| ZwQueryEvent@20 |
| ZwQueryFullAttributesFile@8 |
| ZwQueryInformationAtom@20 |
| ZwQueryInformationEnlistment@20 |
| ZwQueryInformationFile@20 |
| ZwQueryInformationJobObject@20 |
| ZwQueryInformationPort@20 |
| ZwQueryInformationProcess@20 |
| ZwQueryInformationResourceManager@20 |
| ZwQueryInformationThread@20 |
| ZwQueryInformationToken@20 |
| ZwQueryInformationTransaction@20 |
| ZwQueryInformationTransactionManager@20 |
| ZwQueryInformationWorkerFactory@20 |
| ZwQueryInstallUILanguage@4 |
| ZwQueryIntervalProfile@8 |
| ZwQueryIoCompletion@20 |
| ZwQueryKey@20 |
| ZwQueryLicenseValue@20 |
| ZwQueryMultipleValueKey@24 |
| ZwQueryMutant@20 |
| ZwQueryObject@20 |
| ZwQueryOpenSubKeys@8 |
| ZwQueryOpenSubKeysEx@16 |
| ZwQueryPerformanceCounter@8 |
| ZwQueryPortInformationProcess@0 |
| ZwQueryQuotaInformationFile@36 |
| ZwQuerySection@20 |
| ZwQuerySecurityAttributesToken@24 |
| ZwQuerySecurityObject@20 |
| ZwQuerySemaphore@20 |
| ZwQuerySymbolicLinkObject@12 |
| ZwQuerySystemEnvironmentValue@16 |
| ZwQuerySystemEnvironmentValueEx@20 |
| ZwQuerySystemInformation@16 |
| ZwQuerySystemInformationEx@24 |
| ZwQuerySystemTime@4 |
| ZwQueryTimer@20 |
| ZwQueryTimerResolution@12 |
| ZwQueryValueKey@24 |
| ZwQueryVirtualMemory@24 |
| ZwQueryVolumeInformationFile@20 |
| ZwQueueApcThread@20 |
| ZwQueueApcThreadEx@24 |
| ZwRaiseException@12 |
| ZwRaiseHardError@24 |
| ZwReadFile@36 |
| ZwReadFileScatter@36 |
| ZwReadOnlyEnlistment@8 |
| ZwReadRequestData@24 |
| ZwReadVirtualMemory@20 |
| ZwRecoverEnlistment@8 |
| ZwRecoverResourceManager@4 |
| ZwRecoverTransactionManager@4 |
| ZwRegisterProtocolAddressInformation@20 |
| ZwRegisterThreadTerminatePort@4 |
| ZwReleaseCMFViewOwnership@0 |
| ZwReleaseKeyedEvent@16 |
| ZwReleaseMutant@8 |
| ZwReleaseSemaphore@12 |
| ZwReleaseWorkerFactoryWorker@4 |
| ZwRemoveIoCompletion@20 |
| ZwRemoveIoCompletionEx@24 |
| ZwRemoveProcessDebug@8 |
| ZwRenameKey@8 |
| ZwRenameTransactionManager@8 |
| ZwReplaceKey@12 |
| ZwReplacePartitionUnit@12 |
| ZwReplyPort@8 |
| ZwReplyWaitReceivePort@16 |
| ZwReplyWaitReceivePortEx@20 |
| ZwReplyWaitReplyPort@8 |
| ZwRequestDeviceWakeup@4 |
| ZwRequestPort@8 |
| ZwRequestWaitReplyPort@12 |
| ZwRequestWakeupLatency@4 |
| ZwResetEvent@8 |
| ZwResetWriteWatch@12 |
| ZwRestoreKey@12 |
| ZwResumeProcess@4 |
| ZwResumeThread@8 |
| ZwRollbackComplete@8 |
| ZwRollbackEnlistment@8 |
| ZwRollbackTransaction@8 |
| ZwRollforwardTransactionManager@8 |
| ZwSaveKey@8 |
| ZwSaveKeyEx@12 |
| ZwSaveMergedKeys@12 |
| ZwSecureConnectPort@36 |
| ZwSerializeBoot@0 |
| ZwSetBootEntryOrder@8 |
| ZwSetBootOptions@8 |
| ZwSetContextThread@8 |
| ZwSetDebugFilterState@12 |
| ZwSetDefaultHardErrorPort@4 |
| ZwSetDefaultLocale@8 |
| ZwSetDefaultUILanguage@4 |
| ZwSetDriverEntryOrder@8 |
| ZwSetEaFile@16 |
| ZwSetEvent@8 |
| ZwSetEventBoostPriority@4 |
| ZwSetHighEventPair@4 |
| ZwSetHighWaitLowEventPair@4 |
| ZwSetInformationDebugObject@20 |
| ZwSetInformationEnlistment@16 |
| ZwSetInformationFile@20 |
| ZwSetInformationJobObject@16 |
| ZwSetInformationKey@16 |
| ZwSetInformationObject@16 |
| ZwSetInformationProcess@16 |
| ZwSetInformationResourceManager@16 |
| ZwSetInformationThread@16 |
| ZwSetInformationToken@16 |
| ZwSetInformationTransaction@16 |
| ZwSetInformationTransactionManager@16 |
| ZwSetInformationWorkerFactory@16 |
| ZwSetIntervalProfile@8 |
| ZwSetIoCompletion@20 |
| ZwSetIoCompletionEx@24 |
| ZwSetLdtEntries@24 |
| ZwSetLowEventPair@4 |
| ZwSetLowWaitHighEventPair@4 |
| ZwSetQuotaInformationFile@16 |
| ZwSetSecurityObject@12 |
| ZwSetSystemEnvironmentValue@8 |
| ZwSetSystemEnvironmentValueEx@20 |
| ZwSetSystemInformation@12 |
| ZwSetSystemPowerState@12 |
| ZwSetSystemTime@8 |
| ZwSetThreadExecutionState@8 |
| ZwSetTimer@28 |
| ZwSetTimerEx@16 |
| ZwSetTimerResolution@12 |
| ZwSetUuidSeed@4 |
| ZwSetValueKey@24 |
| ZwSetVolumeInformationFile@20 |
| ZwShutdownSystem@4 |
| ZwShutdownWorkerFactory@8 |
| ZwSignalAndWaitForSingleObject@16 |
| ZwSinglePhaseReject@8 |
| ZwStartProfile@4 |
| ZwStopProfile@4 |
| ZwSuspendProcess@4 |
| ZwSuspendThread@8 |
| ZwSystemDebugControl@24 |
| ZwTerminateJobObject@8 |
| ZwTerminateProcess@8 |
| ZwTerminateThread@8 |
| ZwTestAlert@0 |
| ZwThawRegistry@0 |
| ZwThawTransactions@0 |
| ZwTraceControl@24 |
| ZwTraceEvent@16 |
| ZwTranslateFilePath@16 |
| ZwUmsThreadYield@4 |
| ZwUnloadDriver@4 |
| ZwUnloadKey2@8 |
| ZwUnloadKey@4 |
| ZwUnloadKeyEx@8 |
| ZwUnlockFile@20 |
| ZwUnlockVirtualMemory@16 |
| ZwUnmapViewOfSection@8 |
| ZwVdmControl@8 |
| ZwWaitForDebugEvent@16 |
| ZwWaitForKeyedEvent@16 |
| ZwWaitForMultipleObjects32@20 |
| ZwWaitForMultipleObjects@20 |
| ZwWaitForSingleObject@12 |
| ZwWaitForWorkViaWorkerFactory@8 |
| ZwWaitHighEventPair@4 |
| ZwWaitLowEventPair@4 |
| ZwWorkerFactoryWorkerReady@4 |
| ZwWow64CallFunction64@28 |
| ZwWow64CsrAllocateCaptureBuffer@8 |
| ZwWow64CsrAllocateMessagePointer@12 |
| ZwWow64CsrCaptureMessageBuffer@16 |
| ZwWow64CsrCaptureMessageString@20 |
| ZwWow64CsrClientCallServer@16 |
| ZwWow64CsrClientConnectToServer@20 |
| ZwWow64CsrFreeCaptureBuffer@4 |
| ZwWow64CsrGetProcessId@0 |
| ZwWow64CsrIdentifyAlertableThread@0 |
| ZwWow64CsrVerifyRegion@8 |
| ZwWow64DebuggerCall@20 |
| ZwWow64GetCurrentProcessorNumberEx@4 |
| ZwWow64GetNativeSystemInformation@16 |
| ZwWow64InterlockedPopEntrySList@4 |
| ZwWow64QueryInformationProcess64@20 |
| ZwWow64QueryVirtualMemory64@32 |
| ZwWow64ReadVirtualMemory64@28 |
| ZwWow64WriteVirtualMemory64@28 |
| ZwWriteFile@36 |
| ZwWriteFileGather@36 |
| ZwWriteRequestData@24 |
| ZwWriteVirtualMemory@20 |
| ZwYieldExecution@0 |
| _CIcos |
| _CIlog |
| _CIpow |
| _CIsin |
| _CIsqrt |
| __isascii |
| __iscsym |
| __iscsymf |
| __toascii |
| _alldiv |
| _alldvrm@16 |
| _allmul@16 |
| _alloca_probe |
| _alloca_probe_16 |
| _alloca_probe_8 |
| _allrem@16 |
| _allshl |
| _allshr |
| _atoi64 |
| _aulldiv@16 |
| _aulldvrm@16 |
| _aullrem@16 |
| _aullshr |
| ;_chkstk |
| _fltused DATA |
| _ftol |
| _i64toa |
| _i64toa_s |
| _i64tow |
| _i64tow_s |
| _itoa |
| _itoa_s |
| _itow |
| _itow_s |
| _lfind |
| _ltoa |
| _ltoa_s |
| _ltow |
| _ltow_s |
| _makepath_s |
| _memccpy |
| _memicmp |
| _snprintf |
| _snprintf_s |
| _snscanf_s |
| _snwprintf |
| _snwprintf_s |
| _snwscanf_s |
| _splitpath |
| _splitpath_s |
| _strcmpi |
| _stricmp |
| _strlwr |
| _strnicmp |
| _strnset_s |
| _strset_s |
| _strupr |
| _swprintf |
| _tolower |
| _toupper |
| _ui64toa |
| _ui64toa_s |
| _ui64tow |
| _ui64tow_s |
| _ultoa |
| _ultoa_s |
| _ultow |
| _ultow_s |
| _vscwprintf |
| _vsnprintf |
| _vsnprintf_s |
| _vsnwprintf |
| _vsnwprintf_s |
| _vswprintf |
| _wcsicmp |
| _wcslwr |
| _wcsnicmp |
| _wcsnset_s |
| _wcsset_s |
| _wcstoui64 |
| _wcsupr |
| _wmakepath_s |
| _wsplitpath_s |
| _wtoi |
| _wtoi64 |
| _wtol |
| abs |
| atan |
| atoi |
| atol |
| bsearch |
| ceil |
| cos |
| fabs |
| floor |
| isalnum |
| isalpha |
| iscntrl |
| isdigit |
| isgraph |
| islower |
| isprint |
| ispunct |
| isspace |
| isupper |
| iswalpha |
| iswctype |
| iswdigit |
| iswlower |
| iswspace |
| iswxdigit |
| isxdigit |
| labs |
| log |
| mbstowcs |
| memchr |
| memcmp |
| memcpy |
| memcpy_s |
| memmove |
| memmove_s |
| memset |
| pow |
| qsort |
| sin |
| sprintf |
| sprintf_s |
| sqrt |
| sscanf |
| sscanf_s |
| strcat |
| strcat_s |
| strchr |
| strcmp |
| strcpy |
| strcpy_s |
| strcspn |
| strlen |
| strncat |
| strncat_s |
| strncmp |
| strncpy |
| strncpy_s |
| strnlen |
| strpbrk |
| strrchr |
| strspn |
| strstr |
| strtok_s |
| strtol |
| strtoul |
| swprintf |
| swprintf_s |
| swscanf_s |
| tan |
| tolower |
| toupper |
| towlower |
| towupper |
| vDbgPrintEx@16 |
| vDbgPrintExWithPrefix@20 |
| vsprintf |
| vsprintf_s |
| vswprintf_s |
| wcscat |
| wcscat_s |
| wcschr |
| wcscmp |
| wcscpy |
| wcscpy_s |
| wcscspn |
| wcslen |
| wcsncat |
| wcsncat_s |
| wcsncmp |
| wcsncpy |
| wcsncpy_s |
| wcsnlen |
| wcspbrk |
| wcsrchr |
| wcsspn |
| wcsstr |
| wcstol |
| wcstombs |
| wcstoul |
