LIBRARY "ADVAPI32.dll"
EXPORTS

; This file is a comprehensive documentation for 32-bit x86 advapi32.dll symbols.
; It covers all 3 platforms (Win32s, Win9x and WinNT) and contains information
; from native advapi32.dll libraries on 32-bit Windows systems and also from
; 32-bit WoW64 advapi32.dll libraries on 64-bit Windows systems. Symbols in this
; file are ordered by increasing Windows version in which they were introduced.
; First are Win32s versions, then followed by Win9x versions and then WinNT
; because logically Win32s symbols are a subset of Win9x symbols which are a
; subset of WinNT symbols. Comments contains additional information with exceptions.
;
; BEWARE that this file contains only information about symbol availability and
; whether it is possible to load an application or library which references these
; symbols. It does not contain information if the particular Windows version
; supports or implements corresponding API functions. Lots of -W functions are
; unimplemented on Win32s and Win9x platforms and simply signal
; ERROR_CALL_NOT_IMPLEMENTED.

; This is list of symbols available in all Windows versions (Win32s since Win32s 1.1;
; Win9x since Windows 95; WinNT since Windows NT 3.1)
AbortSystemShutdownA@4
AbortSystemShutdownW@4
AccessCheck@32
AccessCheckAndAuditAlarmA@44
AccessCheckAndAuditAlarmW@44
AddAccessAllowedAce@16
AddAccessDeniedAce@16
AddAce@20
AddAuditAccessAce@24
AdjustTokenGroups@24
AdjustTokenPrivileges@24
AllocateAndInitializeSid@44
AllocateLocallyUniqueId@4
AreAllAccessesGranted@8
AreAnyAccessesGranted@8
BackupEventLogA@8
BackupEventLogW@8
ChangeServiceConfigA@44
ChangeServiceConfigW@44
ClearEventLogA@8
ClearEventLogW@8
CloseEventLog@4
CloseServiceHandle@4
ControlService@12
CopySid@12
CreatePrivateObjectSecurity@24
CreateServiceA@52
CreateServiceW@52
DeleteAce@8
DeleteService@4
DeregisterEventSource@4
DestroyPrivateObjectSecurity@4
DuplicateToken@12
EnumDependentServicesA@24
EnumDependentServicesW@24
EnumServicesStatusA@32
EnumServicesStatusW@32
EqualPrefixSid@8
EqualSid@8
FindFirstFreeAce@8
FreeSid@4
GetAce@12
GetAclInformation@16
GetFileSecurityA@20
GetFileSecurityW@20
GetKernelObjectSecurity@20
GetLengthSid@4
GetNumberOfEventLogRecords@8
GetOldestEventLogRecord@8
GetPrivateObjectSecurity@20
GetSecurityDescriptorControl@12
GetSecurityDescriptorDacl@16
GetSecurityDescriptorGroup@12
GetSecurityDescriptorLength@4
GetSecurityDescriptorOwner@12
GetSecurityDescriptorSacl@16
GetServiceDisplayNameA@16
GetServiceDisplayNameW@16
GetServiceKeyNameA@16
GetServiceKeyNameW@16
GetSidIdentifierAuthority@4
GetSidLengthRequired@4
GetSidSubAuthority@8
GetSidSubAuthorityCount@4
GetTokenInformation@20
GetUserNameA@8
GetUserNameW@8
ImpersonateNamedPipeClient@4
ImpersonateSelf@4
InitializeAcl@12
InitializeSecurityDescriptor@8
InitializeSid@12
InitiateSystemShutdownA@20
InitiateSystemShutdownW@20
IsValidAcl@4
IsValidSecurityDescriptor@4
IsValidSid@4
LockServiceDatabase@4
LookupAccountNameA@28
LookupAccountNameW@28
LookupAccountSidA@28
LookupAccountSidW@28
LookupPrivilegeDisplayNameA@20
LookupPrivilegeDisplayNameW@20
LookupPrivilegeNameA@16
LookupPrivilegeNameW@16
LookupPrivilegeValueA@12
LookupPrivilegeValueW@12
MakeAbsoluteSD@44
MakeSelfRelativeSD@12
MapGenericMask@8
NotifyBootConfigStatus@4
ObjectCloseAuditAlarmA@12
ObjectCloseAuditAlarmW@12
ObjectOpenAuditAlarmA@48
ObjectOpenAuditAlarmW@48
ObjectPrivilegeAuditAlarmA@24
ObjectPrivilegeAuditAlarmW@24
OpenBackupEventLogA@8
OpenBackupEventLogW@8
OpenEventLogA@8
OpenEventLogW@8
OpenProcessToken@12
OpenSCManagerA@12
OpenSCManagerW@12
OpenServiceA@12
OpenServiceW@12
OpenThreadToken@16
PrivilegeCheck@12
PrivilegedServiceAuditAlarmA@20
PrivilegedServiceAuditAlarmW@20
QueryServiceConfigA@16
QueryServiceConfigW@16
QueryServiceLockStatusA@16
QueryServiceLockStatusW@16
QueryServiceObjectSecurity@20
QueryServiceStatus@8
ReadEventLogA@28
ReadEventLogW@28
RegCloseKey@4
RegConnectRegistryA@12
RegConnectRegistryW@12
RegCreateKeyA@12
RegCreateKeyExA@36
RegCreateKeyExW@36
RegCreateKeyW@12
RegDeleteKeyA@8
RegDeleteKeyW@8
RegDeleteValueA@8
RegDeleteValueW@8
RegEnumKeyA@16
RegEnumKeyExA@32
RegEnumKeyExW@32
RegEnumKeyW@16
RegEnumValueA@32
RegEnumValueW@32
RegFlushKey@4
RegGetKeySecurity@16
RegLoadKeyA@12
RegLoadKeyW@12
RegNotifyChangeKeyValue@20
RegOpenKeyA@12
RegOpenKeyExA@20
RegOpenKeyExW@20
RegOpenKeyW@12
RegQueryInfoKeyA@48
RegQueryInfoKeyW@48
RegQueryValueA@16
RegQueryValueExA@24
RegQueryValueExW@24
RegQueryValueW@16
RegReplaceKeyA@16
RegReplaceKeyW@16
RegRestoreKeyA@12
RegRestoreKeyW@12
RegSaveKeyA@12
RegSaveKeyW@12
RegSetKeySecurity@12
RegSetValueA@20
RegSetValueExA@24
RegSetValueExW@24
RegSetValueW@20
RegUnLoadKeyA@8
RegUnLoadKeyW@8
RegisterEventSourceA@8
RegisterEventSourceW@8
RegisterServiceCtrlHandlerA@8
RegisterServiceCtrlHandlerW@8
ReportEventA@36
ReportEventW@36
RevertToSelf@0
SetAclInformation@16
SetFileSecurityA@12
SetFileSecurityW@12
SetKernelObjectSecurity@12
SetPrivateObjectSecurity@20
SetSecurityDescriptorDacl@16
SetSecurityDescriptorGroup@12
SetSecurityDescriptorOwner@12
SetSecurityDescriptorSacl@16
SetServiceObjectSecurity@12
SetServiceStatus@8
SetTokenInformation@16
StartServiceA@12
StartServiceCtrlDispatcherA@4
StartServiceCtrlDispatcherW@4
StartServiceW@12
UnlockServiceDatabase@4

; This is list of symbols added in Win32s 1.20 and available in all Win9x and WinNT versions
SetThreadToken@8

; This is list of symbols added in Win32s 1.20 and available in all WinNT versions, but not in Win9x
ElfBackupEventLogFileA@8 ; removed in Windows 11 2022 Update (Sun Valley 2 / 22H2)
ElfBackupEventLogFileW@8 ; removed in Windows 11 2022 Update (Sun Valley 2 / 22H2)
ElfChangeNotify@8 ; removed in Windows 11 2022 Update (Sun Valley 2 / 22H2)
ElfClearEventLogFileA@8 ; removed in Windows 11 2022 Update (Sun Valley 2 / 22H2)
ElfClearEventLogFileW@8 ; removed in Windows 11 2022 Update (Sun Valley 2 / 22H2)
ElfCloseEventLog@4 ; removed in Windows 11 2022 Update (Sun Valley 2 / 22H2)
ElfDeregisterEventSource@4 ; removed in Windows 11 2022 Update (Sun Valley 2 / 22H2)
ElfNumberOfRecords@8 ; removed in Windows 11 2022 Update (Sun Valley 2 / 22H2)
ElfOldestRecord@8 ; removed in Windows 11 2022 Update (Sun Valley 2 / 22H2)
ElfOpenBackupEventLogA@12 ; removed in Windows 11 2022 Update (Sun Valley 2 / 22H2)
ElfOpenBackupEventLogW@12 ; removed in Windows 11 2022 Update (Sun Valley 2 / 22H2)
ElfOpenEventLogA@12 ; removed in Windows 11 2022 Update (Sun Valley 2 / 22H2)
ElfOpenEventLogW@12 ; removed in Windows 11 2022 Update (Sun Valley 2 / 22H2)
ElfReadEventLogA@28 ; removed in Windows 11 2022 Update (Sun Valley 2 / 22H2)
ElfReadEventLogW@28 ; removed in Windows 11 2022 Update (Sun Valley 2 / 22H2)
ElfRegisterEventSourceA@12 ; removed in Windows 11 2022 Update (Sun Valley 2 / 22H2)
ElfRegisterEventSourceW@12 ; removed in Windows 11 2022 Update (Sun Valley 2 / 22H2)
ElfReportEventA@48 ; removed in Windows 11 2022 Update (Sun Valley 2 / 22H2)
ElfReportEventW@48 ; removed in Windows 11 2022 Update (Sun Valley 2 / 22H2)
I_ScSetServiceBitsA@20
I_ScSetServiceBitsW@20
LsaAddPrivilegesToAccount@8
LsaClearAuditLog@4
LsaClose@4
LsaCreateAccount@16
LsaCreateSecret@16
LsaCreateTrustedDomain@16
LsaDelete@4
LsaEnumerateAccounts@20
LsaEnumeratePrivileges@20
LsaEnumeratePrivilegesOfAccount@8
LsaEnumerateTrustedDomains@20
LsaFreeMemory@4
LsaGetQuotasForAccount@8
LsaGetSystemAccessAccount@8
LsaICLookupNames@40 ; Win32s has ABI "LsaICLookupNames@40", Windows NT 3.1-4.0 has ABI "LsaICLookupNames@28", Windows 2000 has ABI "LsaICLookupNames@32", Windows XP and new has ABI "LsaICLookupNames@40"
LsaICLookupSids@36 ; Win32s has ABI "LsaICLookupSids@36", Windows NT 3.1-4.0 has ABI "LsaICLookupSids@28", Windows 2000 has ABI "LsaICLookupSids@32", Windows XP and new has ABI "LsaICLookupSids@36"
LsaLookupNames@20
LsaLookupPrivilegeDisplayName@16
LsaLookupPrivilegeName@12
LsaLookupPrivilegeValue@12
LsaLookupSids@20
LsaOpenAccount@16
LsaOpenPolicy@16
LsaOpenSecret@16
LsaOpenTrustedDomain@16
LsaQueryInfoTrustedDomain@12
LsaQueryInformationPolicy@12
LsaQuerySecret@20
LsaQuerySecurityObject@12
LsaRemovePrivilegesFromAccount@12
LsaSetInformationPolicy@12
LsaSetInformationTrustedDomain@12
LsaSetQuotasForAccount@8
LsaSetSecret@12
LsaSetSecurityObject@12
LsaSetSystemAccessAccount@8
QueryWindows31FilesMigration@4 ; removed in Windows Server 2003
SynchronizeWindows31FilesAndWindowsNTRegistry@16 ; removed in Windows Server 2003
SystemFunction001@12
SystemFunction002@12
SystemFunction003@8
SystemFunction004@12
SystemFunction005@12
SystemFunction006@8
SystemFunction007@8
SystemFunction008@12
SystemFunction009@12
SystemFunction010@12
SystemFunction011@12
SystemFunction012@12
SystemFunction013@12
SystemFunction014@12
SystemFunction015@12
SystemFunction016@12
SystemFunction017@12
SystemFunction018@12
SystemFunction019@12
SystemFunction020@12
SystemFunction021@12
SystemFunction022@12
SystemFunction023@12
SystemFunction024@12
SystemFunction025@12
SystemFunction026@12
SystemFunction027@12
SystemFunction028@8
SystemFunction029@8
SystemFunction030@8
SystemFunction031@8

; This is list of symbols added in Win32s 1.20, available in all Win9x versions and since Windows NT 3.5
IsTextUnicode@12
NotifyChangeEventLog@8
SetServiceBits@16

; This is list of symbols added in Win32s 1.20, available since Windows NT 3.5, but not available in Win9x
SystemFunction032@8
SystemFunction033@8

; This is list of symbols added in Win32s 1.25, available in all Win9x versions and since Windows NT 3.51
CreateProcessAsUserA@44
CreateProcessAsUserW@44
ImpersonateLoggedOnUser@4
LogonUserA@24
LogonUserW@24

; This is list of symbols added in Win32s 1.25, available since Windows NT 3.51, but not available in Win9x
LsaAddAccountRights@16
LsaDeleteTrustedDomain@8
LsaEnumerateAccountRights@16
LsaEnumerateAccountsWithUserRight@16
LsaQueryTrustedDomainInfo@16
LsaRemoveAccountRights@20
LsaRetrievePrivateData@12
LsaSetTrustedDomainInformation@16
LsaStorePrivateData@12

; This is list of symbols added in Win32s 1.30, available in all Win9x versions and since Windows NT 3.51
RegQueryMultipleValuesA@20
RegQueryMultipleValuesW@20

; This is list of symbols added in Win32s 1.30, available since Windows NT 3.51, but not available in Win9x
LsaNtStatusToWinError@4

;; This is end of Win32s symbols ;;

; This is list of symbols available in all Win9x versions, but not available in Win32s and WinNT
; RegRemapPreDefKey@8

; This is list of symbols added in Windows 95 OSR2 and also since Windows NT 4.0, but not available in Win32s
CryptAcquireContextA@20
CryptCreateHash@20
CryptDecrypt@24
CryptDeriveKey@20
CryptDestroyHash@4
CryptDestroyKey@4
CryptEncrypt@28
CryptExportKey@24
CryptGenKey@16
CryptGenRandom@12
CryptGetHashParam@20
CryptGetKeyParam@20
CryptGetProvParam@20
CryptGetUserKey@12
CryptHashData@16
CryptHashSessionKey@12
CryptImportKey@24
CryptReleaseContext@8
CryptSetHashParam@16
CryptSetKeyParam@16
CryptSetProvParam@16
CryptSetProviderA@8
CryptSignHashA@24
CryptVerifySignatureA@24

; This is list of symbols added in Windows 98 and also since Windows NT 4.0, but not available in Win32s
BuildExplicitAccessWithNameA@20
BuildExplicitAccessWithNameW@20
BuildImpersonateExplicitAccessWithNameA@24
BuildImpersonateExplicitAccessWithNameW@24
BuildImpersonateTrusteeA@8
BuildImpersonateTrusteeW@8
BuildSecurityDescriptorA@36
BuildSecurityDescriptorW@36
BuildTrusteeWithNameA@8
BuildTrusteeWithNameW@8
BuildTrusteeWithSidA@8
BuildTrusteeWithSidW@8
CryptAcquireContextW@20
CryptSetProviderW@8
CryptSignHashW@24
CryptVerifySignatureW@24
DuplicateTokenEx@24
GetAuditedPermissionsFromAclA@16
GetAuditedPermissionsFromAclW@16
GetCurrentHwProfileA@4
GetCurrentHwProfileW@4
GetEffectiveRightsFromAclA@12
GetEffectiveRightsFromAclW@12
GetExplicitEntriesFromAclA@12
GetExplicitEntriesFromAclW@12
GetMultipleTrusteeA@4
GetMultipleTrusteeOperationA@4
GetMultipleTrusteeOperationW@4
GetMultipleTrusteeW@4
GetNamedSecurityInfoA@32
GetNamedSecurityInfoW@32
GetSecurityInfo@32
GetTrusteeNameA@4
GetTrusteeNameW@4
GetTrusteeTypeA@4
GetTrusteeTypeW@4
LookupSecurityDescriptorPartsA@28
LookupSecurityDescriptorPartsW@28
ObjectDeleteAuditAlarmA@12
ObjectDeleteAuditAlarmW@12
SetEntriesInAclA@16
SetEntriesInAclW@16
SetNamedSecurityInfoA@28
SetNamedSecurityInfoW@28
SetSecurityInfo@28

; This is list of symbols added in Windows 98 and also since Windows NT 4.0 SP4, but not available in Win32s
CancelOverlappedAccess@4
ConvertAccessToSecurityDescriptorA@20
ConvertAccessToSecurityDescriptorW@20
ConvertSecurityDescriptorToAccessA@28
ConvertSecurityDescriptorToAccessNamedA@28
ConvertSecurityDescriptorToAccessNamedW@28
ConvertSecurityDescriptorToAccessW@28
GetAccessPermissionsForObjectA@36
GetAccessPermissionsForObjectW@36
GetNamedSecurityInfoExA@36
GetNamedSecurityInfoExW@36
GetOverlappedAccessResults@16
GetSecurityInfoExA@36
GetSecurityInfoExW@36
SetEntriesInAccessListA@24
SetEntriesInAccessListW@24
SetEntriesInAuditListA@24
SetEntriesInAuditListW@24
SetNamedSecurityInfoExA@36
SetNamedSecurityInfoExW@36
SetSecurityInfoExA@36
SetSecurityInfoExW@36
TrusteeAccessToObjectA@24
TrusteeAccessToObjectW@24

; This is list of symbols added in Windows 98 and also since Windows 2000, but not available in Win32s
CryptContextAddRef@12
CryptDuplicateHash@16
CryptDuplicateKey@16
CryptEnumProviderTypesA@24
CryptEnumProviderTypesW@24
CryptEnumProvidersA@24
CryptEnumProvidersW@24
CryptGetDefaultProviderA@20
CryptGetDefaultProviderW@20
CryptSetProviderExA@16
CryptSetProviderExW@16

; This is list of symbols added in Windows ME, but not available in Win32s and WinNT
; CryptGetLocalKeyLimits@16

;; This is end of Win9x symbols ;;

; This is list of symbols (not mentioned in previous sections) added in Windows NT 4.0, but not available in Win32s and Win9x
; BuildAccessRequestA@12 ; removed in Windows NT 4.0 SP4
; BuildAccessRequestW@12 ; removed in Windows NT 4.0 SP4
; DenyAccessRightsA@16 ; removed in Windows NT 4.0 SP4
; DenyAccessRightsW@16 ; removed in Windows NT 4.0 SP4
EnumServiceGroupW@36
; GetAuditedPermissionsFromSDA@16 ; removed in Windows NT 4.0 SP4
; GetAuditedPermissionsFromSDW@16 ; removed in Windows NT 4.0 SP4
; GetEffectiveAccessRightsA@16 ; removed in Windows NT 4.0 SP4
; GetEffectiveAccessRightsW@16 ; removed in Windows NT 4.0 SP4
; GetEffectiveRightsFromSDA@12 ; removed in Windows NT 4.0 SP4
; GetEffectiveRightsFromSDW@12 ; removed in Windows NT 4.0 SP4
; GetExplicitAccessRightsA@16 ; removed in Windows NT 4.0 SP4
; GetExplicitAccessRightsW@16 ; removed in Windows NT 4.0 SP4
; GrantAccessRightsA@16 ; removed in Windows NT 4.0 SP4
; GrantAccessRightsW@16 ; removed in Windows NT 4.0 SP4
I_ScGetCurrentGroupStateW@12
; IsAccessPermittedA@20 ; removed in Windows NT 4.0 SP4
; IsAccessPermittedW@20 ; removed in Windows NT 4.0 SP4
LsaGetUserName@8
; NTAccessMaskToProvAccessRights@12 ; removed in Windows NT 4.0 SP4
; ProvAccessRightsToNTAccessMask@8 ; removed in Windows NT 4.0 SP4
; ReplaceAllAccessRightsA@16 ; removed in Windows NT 4.0 SP4
; ReplaceAllAccessRightsW@16 ; removed in Windows NT 4.0 SP4
; RevokeExplicitAccessRightsA@16 ; removed in Windows NT 4.0 SP4
; RevokeExplicitAccessRightsW@16 ; removed in Windows NT 4.0 SP4
; SetAccessRightsA@16 ; removed in Windows NT 4.0 SP4
; SetAccessRightsW@16 ; removed in Windows NT 4.0 SP4

; This is list of symbols (not mentioned in previous sections) added in Windows NT 4.0 SP4, but not available in Win32s and Win9x
EnumServicesStatusExA@40
EnumServicesStatusExW@40
LsaGetRemoteUserName@12
QueryServiceStatusEx@20

; This is list of symbols added in Windows 2000
AccessCheckByType@44
AccessCheckByTypeAndAuditAlarmA@64
AccessCheckByTypeAndAuditAlarmW@64
AccessCheckByTypeResultList@44
AccessCheckByTypeResultListAndAuditAlarmA@64
AccessCheckByTypeResultListAndAuditAlarmByHandleA@68
AccessCheckByTypeResultListAndAuditAlarmByHandleW@68
AccessCheckByTypeResultListAndAuditAlarmW@64
AddAccessAllowedAceEx@20
AddAccessAllowedObjectAce@28
AddAccessDeniedAceEx@20
AddAccessDeniedObjectAce@28
AddAuditAccessAceEx@28
AddAuditAccessObjectAce@36
AddUsersToEncryptedFile@8
BuildTrusteeWithObjectsAndNameA@24
BuildTrusteeWithObjectsAndNameW@24
BuildTrusteeWithObjectsAndSidA@20
BuildTrusteeWithObjectsAndSidW@20
ChangeServiceConfig2A@12
ChangeServiceConfig2W@12
CheckTokenMembership@12
CloseEncryptedFileRaw@4
CloseTrace@8
CommandLineFromMsiDescriptor@12
ControlTraceA@20
ControlTraceW@20
ConvertSDToStringSDRootDomainA@24
ConvertSDToStringSDRootDomainW@24
ConvertSecurityDescriptorToStringSecurityDescriptorA@20
ConvertSecurityDescriptorToStringSecurityDescriptorW@20
ConvertSidToStringSidA@8
ConvertSidToStringSidW@8
ConvertStringSDToSDRootDomainA@20
ConvertStringSDToSDRootDomainW@20
ConvertStringSecurityDescriptorToSecurityDescriptorA@16
ConvertStringSecurityDescriptorToSecurityDescriptorW@16
ConvertStringSidToSidA@8
ConvertStringSidToSidW@8
ConvertToAutoInheritPrivateObjectSecurity@24
CreatePrivateObjectSecurityEx@32
CreateProcessWithLogonW@44
CreateRestrictedToken@36
CreateTraceInstanceId@8
DecryptFileA@8
DecryptFileW@8
DuplicateEncryptionInfoFile@20 ; Windows 2000 has ABI "DuplicateEncryptionInfoFile@8", Windows XP and new has ABI "DuplicateEncryptionInfoFile@20"
EnableTrace@24
EncryptFileA@4
EncryptFileW@4
EncryptionDisable@8
FileEncryptionStatusA@8
FileEncryptionStatusW@8
FreeEncryptionCertificateHashList@4
GetEventLogInformation@20
GetLocalManagedApplications@12
GetManagedApplications@20
GetMangledSiteSid@12 ; removed in Windows XP
GetSecurityDescriptorRMControl@8
GetSiteDirectoryA@12 ; removed in Windows XP
GetSiteDirectoryW@12 ; removed in Windows XP
GetSiteNameFromSid@8 ; removed in Windows XP
GetSiteSidFromToken@4 ; removed in Windows XP
GetSiteSidFromUrl@4 ; removed in Windows XP
GetTraceEnableFlags@8
GetTraceEnableLevel@8
GetTraceLoggerHandle@4
GetTrusteeFormA@4
GetTrusteeFormW@4
I_ScIsSecurityProcess@0
I_ScPnPGetServiceName@12
ImpersonateAnonymousToken@4
InitiateSystemShutdownExA@24
InitiateSystemShutdownExW@24
InstallApplication@4
; IsInSandbox@0 ; removed in Windows XP
IsProcessRestricted@0 ; removed in Windows XP
IsTokenRestricted@4
LsaCreateTrustedDomainEx@20
LsaEnumerateTrustedDomainsEx@20
LsaOpenTrustedDomainByName@16
LsaQueryDomainInformationPolicy@12
LsaQueryTrustedDomainInfoByName@16
LsaSetDomainInformationPolicy@12
LsaSetTrustedDomainInfoByName@16
MakeAbsoluteSD2@8
OpenEncryptedFileRawA@12
OpenEncryptedFileRawW@12
OpenTraceA@4
OpenTraceW@4
ProcessTrace@16
QueryAllTracesA@12
QueryAllTracesW@12
QueryRecoveryAgentsOnEncryptedFile@8
QueryServiceConfig2A@20
QueryServiceConfig2W@20
QueryUsersOnEncryptedFile@8
ReadEncryptedFileRaw@12
RegDisablePredefinedCache@0
RegOpenCurrentUser@8
RegOpenUserClassesRoot@16
RegOverridePredefKey@8
RegisterServiceCtrlHandlerExA@12
RegisterServiceCtrlHandlerExW@12
RegisterTraceGuidsA@32
RegisterTraceGuidsW@32
RemoveTraceCallback@4
RemoveUsersFromEncryptedFile@8
SetPrivateObjectSecurityEx@24
SetSecurityDescriptorControl@12
SetSecurityDescriptorRMControl@8
SetTraceCallback@8
SetUserFileEncryptionKey@4
StartTraceA@12
StartTraceW@12
SystemFunction034@12
SystemFunction035@4
TraceEvent@12
TraceEventInstance@20
UninstallApplication@8 ; Windows 2000 has ABI "UninstallApplication@4", Windows XP and new has ABI "UninstallApplication@8"
UnregisterTraceGuids@8
WmiCloseBlock@4
WmiDevInstToInstanceNameA@16
WmiDevInstToInstanceNameW@16
WmiEnumerateGuids@8
WmiExecuteMethodA@28
WmiExecuteMethodW@28
WmiFileHandleToInstanceNameA@16
WmiFileHandleToInstanceNameW@16
WmiFreeBuffer@4
WmiMofEnumerateResourcesA@12
WmiMofEnumerateResourcesW@12
WmiNotificationRegistrationA@20
WmiNotificationRegistrationW@20
WmiOpenBlock@12
WmiQueryAllDataA@12
WmiQueryAllDataW@12
WmiQueryGuidInformation@8
WmiQuerySingleInstanceA@16
WmiQuerySingleInstanceW@16
WmiSetSingleInstanceA@20
WmiSetSingleInstanceW@20
WmiSetSingleItemA@24
WmiSetSingleItemW@24
WriteEncryptedFileRaw@12

; In Windows 2000 SP1 there was no new symbol

; This is list of symbols added in Windows 2000 SP2
EqualDomainSid@12

; This is list of symbols added in Windows 2000 SP3
CreateWellKnownSid@16
GetWindowsAccountDomainSid@12
IsWellKnownSid@8
LsaOpenPolicySce@16
SystemFunction040@12
SystemFunction041@12

; This is list of symbols added in Windows 2000 SP4 and Windows XP SP2 (not available in Windows XP and Windows XP SP1)
; CreateProcessAsUserSecure@0 ; removed in Windows Server 2003
ElfFlushEventLog@4 ; removed in Windows 11 2022 Update (Sun Valley 2 / 22H2)

; This is list of symbols added in Windows XP
A_SHAFinal@8
A_SHAInit@4
A_SHAUpdate@12
CloseCodeAuthzLevel@4
ComputeAccessTokenFromCodeAuthzLevel@20
ConvertStringSDToSDDomainA@24
ConvertStringSDToSDDomainW@24
CreateCodeAuthzLevel@20
CreatePrivateObjectSecurityWithMultipleInheritance@36
CredDeleteA@12
CredDeleteW@12
CredEnumerateA@16
CredEnumerateW@16
CredFree@4
CredGetSessionTypes@8
CredGetTargetInfoA@12
CredGetTargetInfoW@12
CredIsMarshaledCredentialA@4
CredIsMarshaledCredentialW@4
CredMarshalCredentialA@12
CredMarshalCredentialW@12
CredProfileLoaded@0
CredReadA@16
CredReadDomainCredentialsA@16
CredReadDomainCredentialsW@16
CredReadW@16
CredRenameA@16
CredRenameW@16
CredUnmarshalCredentialA@12
CredUnmarshalCredentialW@12
CredWriteA@8
CredWriteDomainCredentialsA@12
CredWriteDomainCredentialsW@12
CredWriteW@8
CredpConvertCredential@16
CredpConvertTargetInfo@16
CredpDecodeCredential@4
CredpEncodeCredential@4
EncryptedFileKeyInfo@12
EnumerateTraceGuids@12
FlushTraceA@16
FlushTraceW@16
FreeEncryptedFileKeyInfo@4
FreeInheritedFromArray@12
GetInformationCodeAuthzLevelW@20
GetInformationCodeAuthzPolicyW@24
GetInheritanceSourceA@40
GetInheritanceSourceW@40
GetLocalManagedApplicationData@12
GetManagedApplicationCategories@8
I_ScSendTSMessage@16
IdentifyCodeAuthzLevelW@16
IsTokenUntrusted@4
LogonUserExA@40
LogonUserExW@40
LsaICLookupNamesWithCreds@48
LsaICLookupSidsWithCreds@48
LsaLookupNames2@24
LsaQueryForestTrustInformation@12
LsaSetForestTrustInformation@20
MD4Final@4
MD4Init@4
MD4Update@12
MD5Final@4
MD5Init@4
MD5Update@12
MSChapSrvChangePassword2@28
MSChapSrvChangePassword@28
ProcessIdleTasks@0
QueryTraceA@16
QueryTraceW@16
RegSaveKeyExA@16
RegSaveKeyExW@16
RegisterIdleTask@16
SaferCloseLevel@4
SaferComputeTokenFromLevel@20
SaferCreateLevel@20
SaferGetLevelInformation@20
SaferGetPolicyInformation@24
SaferIdentifyLevel@16
SaferRecordEventLogEntry@12
SaferSetLevelInformation@16
SaferSetPolicyInformation@20
SaferiChangeRegistryScope@8
SaferiCompareTokenLevels@12
SaferiIsExecutableFileType@8
SaferiPopulateDefaultsInRegistry@8
SaferiRecordEventLogEntry@12
; SaferiReplaceProcessThreadTokens@12 ; removed in Windows 7
SaferiSearchMatchingHashRules@24
SetInformationCodeAuthzLevelW@16
SetInformationCodeAuthzPolicyW@20
StopTraceA@16
StopTraceW@16
SystemFunction036@8
TraceMessage ; cdecl
TraceMessageVa@24
TreeResetNamedSecurityInfoA@44
TreeResetNamedSecurityInfoW@44
UnregisterIdleTask@12
UpdateTraceA@16
UpdateTraceW@16
; WdmWmiServiceMain@8 ; removed in Windows Vista
; WmiGetFirstTraceOffset@4 ; removed in Windows Vista
; WmiGetTraceHeader@12 ; removed in Windows Vista
; WmiParseTraceEvent@20 ; removed in Windows Vista
WmiQueryAllDataMultipleA@16
WmiQueryAllDataMultipleW@16
WmiQuerySingleInstanceMultipleA@20
WmiQuerySingleInstanceMultipleW@20
WmiReceiveNotificationsA@16
WmiReceiveNotificationsW@16
; Wow64Win32ApiEntry@12 ; removed in Windows 7

; This is list of symbols added in Windows XP SP1
; WmiCloseTraceWithCursor@4 ; removed in Windows Vista
; WmiConvertTimestamp@12 ; removed in Windows Vista
; WmiGetNextEvent@4 ; removed in Windows Vista
; WmiOpenTraceWithCursor@4 ; removed in Windows Vista

; In Windows XP SP2 there was no new symbol

; This is list of symbols added in Windows XP SP3 and Windows Vista (not available in any version of Windows Server 2003)
RegDisablePredefinedCacheEx@0

; This is list of symbols added in Windows Server 2003
CreateProcessWithTokenW@36

; This is list of symbols added in Windows Server 2003 SP1 and Windows XP x64 SP1 (WoW64 version)
ElfReportEventAndSourceW@60 ; removed in Windows 11 2022 Update (Sun Valley 2 / 22H2)
I_QueryTagInformation@12
RegConnectRegistryExA@16
RegConnectRegistryExW@16
RegDeleteKeyExA@16
RegDeleteKeyExW@16
RegDisableReflectionKey@4
RegEnableReflectionKey@4
RegGetValueA@28
RegGetValueW@28
RegQueryReflectionKey@8

; In Windows Server 2003 SP2 and Windows XP x64 SP2 (WoW64 version) there was no new symbol

; This is list of symbols added in Windows Vista
AddMandatoryAce@20
AddUsersToEncryptedFileEx@16
AuditComputeEffectivePolicyBySid@16
AuditComputeEffectivePolicyByToken@16
AuditEnumerateCategories@8
AuditEnumeratePerUserPolicy@4
AuditEnumerateSubCategories@16
AuditFree@4
AuditLookupCategoryGuidFromCategoryId@8
AuditLookupCategoryIdFromCategoryGuid@8
AuditLookupCategoryNameA@8
AuditLookupCategoryNameW@8
AuditLookupSubCategoryNameA@8
AuditLookupSubCategoryNameW@8
AuditQueryPerUserPolicy@16
AuditQuerySecurity@8
AuditQuerySystemPolicy@12
AuditSetPerUserPolicy@12
AuditSetSecurity@8
AuditSetSystemPolicy@8
; CheckAppInitBlockedServiceIdentity@4 ; removed in Windows 7
CloseThreadWaitChainSession@4
ControlServiceExA@16
ControlServiceExW@16
CredBackupCredentials@20
CredEncryptAndMarshalBinaryBlob@12
CredFindBestCredentialA@16
CredFindBestCredentialW@16
CredIsProtectedA@8
CredIsProtectedW@8
CredProfileUnloaded@0
CredProtectA@24
CredProtectW@24
CredReadByTokenHandle@20
CredRestoreCredentials@16
CredUnprotectA@20
CredUnprotectW@20
CredpConvertOneCredentialSize@8
CredpEncodeSecret@20
EnableTraceEx@48
EnumerateTraceGuidsEx@24
EventAccessControl@20
EventAccessQuery@12
EventAccessRemove@4
EventActivityIdControl@8
EventEnabled@12
EventProviderEnabled@20
EventRegister@16
EventUnregister@8
EventWrite@20
EventWriteEndScenario@20
EventWriteStartScenario@20
EventWriteString@24
EventWriteTransfer@28
FlushEfsCache@4
FreeEncryptedFileMetadata@4
GetEncryptedFileMetadata@12
GetThreadWaitChain@28
I_ScQueryServiceConfig@12
I_ScSendPnPMessage@24
I_ScValidatePnPService@12
InitiateShutdownA@20
InitiateShutdownW@20
IsValidRelativeSecurityDescriptor@12
LogonUserExExW@44
LsaManageSidNameMapping@12
NotifyServiceStatusChange@12
NotifyServiceStatusChangeA@12
NotifyServiceStatusChangeW@12
OpenThreadWaitChainSession@8
PerfAddCounters@12
PerfCloseQueryHandle@4
PerfCreateInstance@16
PerfDecrementULongCounterValue@16
PerfDecrementULongLongCounterValue@20
PerfDeleteCounters@12
PerfDeleteInstance@8
PerfEnumerateCounterSet@16
PerfEnumerateCounterSetInstances@20
PerfIncrementULongCounterValue@16
PerfIncrementULongLongCounterValue@20
PerfOpenQueryHandle@8
PerfQueryCounterData@16
PerfQueryCounterInfo@16
PerfQueryCounterSetRegistrationInfo@28
PerfQueryInstance@16
PerfSetCounterRefValue@16
PerfSetCounterSetInfo@12
PerfSetULongCounterValue@16
PerfSetULongLongCounterValue@20
PerfStartProvider@12
PerfStartProviderEx@12
PerfStopProvider@4
ProcessIdleTasksW@16
QuerySecurityAccessMask@8
RegCopyTreeA@12
RegCopyTreeW@12
RegCreateKeyTransactedA@44
RegCreateKeyTransactedW@44
RegDeleteKeyTransactedA@24
RegDeleteKeyTransactedW@24
RegDeleteKeyValueA@12
RegDeleteKeyValueW@12
RegDeleteTreeA@8
RegDeleteTreeW@8
RegLoadAppKeyA@20
RegLoadAppKeyW@20
RegLoadMUIStringA@28
RegLoadMUIStringW@28
RegOpenKeyTransactedA@28
RegOpenKeyTransactedW@28
RegRenameKey@12
RegSetKeyValueA@24
RegSetKeyValueW@24
RegisterWaitChainCOMCallback@8
SetEncryptedFileMetadata@24
SetSecurityAccessMask@8
SetUserFileEncryptionKeyEx@16
TreeSetNamedSecurityInfoA@44
TreeSetNamedSecurityInfoW@44
UsePinForEncryptedFilesA@12
UsePinForEncryptedFilesW@12

; In Windows Vista SP1 there was no new symbol

; In Windows Vista SP2 there was no new symbol

; This is list of symbols added in Windows 7
AddConditionalAce@32
AuditQueryGlobalSaclA@8
AuditQueryGlobalSaclW@8
AuditSetGlobalSaclA@8
AuditSetGlobalSaclW@8
EnableTraceEx2@44
EventWriteEx@40
SaferiIsDllAllowed@8 ; Windows 7 has ABI "SaferiIsDllAllowed@12", Windows 8 and new has ABI "SaferiIsDllAllowed@8"
TraceSetInformation@20

; This is list of ordinal-only symbols added in Windows 7
; Symbol names are taken from:
; https://www.geoffchappell.com/studies/windows/win32/advapi32/history/ords61.htm
SaferiRegisterExtensionDll@8 @1000 NONAME

; In Windows 7 SP1 there was no new symbol

; This is list of symbols added in Windows 8
BaseRegCloseKey@4
BaseRegCreateKey@32
BaseRegDeleteKeyEx@16
BaseRegDeleteValue@8
BaseRegFlushKey@4
BaseRegGetVersion@8
BaseRegLoadKey@12
BaseRegOpenKey@20
BaseRegRestoreKey@12
BaseRegSaveKeyEx@16
BaseRegSetKeySecurity@12
BaseRegSetValue@20
BaseRegUnLoadKey@8
CheckForHiberboot@8
ConvertSDToStringSDDomainW@28
; CredProfileLoadedEx@4
EnumDynamicTimeZoneInformation@8
; EtwLogSysConfigExtension@8 ; removed in Windows 10 Anniversary Update (Redstone / 1607)
EventSetInformation@20
GetDynamicTimeZoneInformationEffectiveYears@12
GetStringConditionFromBinary@16
; I_ScRegisterPreshutdownRestart@8
LsaGetAppliedCAPIDs@12
LsaLookupSids2@24
LsaQueryCAPs@16
LsaSetCAPs@12
; MIDL_user_free_Ext@4
OperationEnd@4
OperationStart@4
PerfRegCloseKey@4
PerfRegEnumKey@24
PerfRegEnumValue@32
PerfRegQueryInfoKey@44
PerfRegQueryValue@28
PerfRegSetValue@24
; PsmActivateApplication@12 ; removed in Windows 8.1
; PsmAdjustActivationToken@24 ; removed in Windows 8.1
; PsmQueryBackgroundActivationType@8 ; removed in Windows 8.1
; PsmRegisterApplicationProcess@8 ; removed in Windows 8.1
QueryServiceDynamicInformation@12
RemoteRegEnumKeyWrapper@20
RemoteRegEnumValueWrapper@28
RemoteRegQueryInfoKeyWrapper@40
RemoteRegQueryValueWrapper@24
SafeBaseRegGetKeySecurity@16
TraceQueryInformation@24
WaitServiceState@16

; In Windows 8.1 there was no new symbol

; This is list of symbols added in Windows 10 (Threshold / 1507)
NpGetUserName@12

; This is list of symbols added in Windows 10 November Update (Threshold 2 / 1511)
; I_ScReparseServiceDatabase@4
; QueryLocalUserServiceName@12
; QueryUserServiceName@20

; This is list of symbols added in Windows 10 Anniversary Update (Redstone / 1607)
CveEventWrite@8

; This is list of symbols added in Windows 10 Creators Update (Redstone 2 / 1703)
; QueryUserServiceNameForContext@20

; This is list of symbols added in Windows 10 Fall Creators Update (Redstone 3 / 1709)
; CreateServiceEx@56
QueryTraceProcessingHandle@32
RemoteRegQueryMultipleValues2Wrapper@24
RemoteRegQueryMultipleValuesWrapper@20

; In Windows 10 April 2018 Update (Redstone 4 / 1803) there was no new symbol

; In Windows 10 October 2018 Update (Redstone 5 / 1809) there was no new symbl

; In Windows 10 May 2019 Update (19H1 / 1903) there was no new symbol

; In Windows 10 November 2019 Update (19H2 /1909) there was no new symbol

; In Windows 10 May 2020 Update (20H1 / 2004) there was no new symbol

; In Windows 10 October 2020 Update (20H2) there was no new symbol

; In Windows 10 May 2021 Update (21H1) there was no new symbol

; In Windows 10 November 2021 Update (21H2) there was no new symbol

; This is list of symbols added in Windows 10 2022 Update (22H2) and Windows 11 2022 Update (Sun Valley 2 / 22H2) (WoW64 version) (not available in Windows 11 (Sun Valley / 21H2))
LsaInvokeTrustScanner@16
LsaQueryForestTrustInformation2@16
LsaSetForestTrustInformation2@24

; This is list of symbols added in Windows 11 (Sun Valley / 21H2) (WoW64 version)
LsaConfigureAutoLogonCredentials@0
; LsaDisablePasswordLessCurrentUser@0 ; removed in Windows 11 2022 Update (Sun Valley 2 / 22H2)
LsaDisableUserArso@4
; LsaEnablePasswordLessCurrentUser@0 ; removed in Windows 11 2022 Update (Sun Valley 2 / 22H2)
LsaEnableUserArso@4
LsaGetDeviceRegistrationInfo@4
LsaIsUserArsoAllowed@4
LsaIsUserArsoEnabled@8
LsaProfileDeleted@4
LsaValidateProcUniqueLuid@4

; In Windows 11 2022 Update (Sun Valley 2 / 22H2) (WoW64 version) there was no new symbol

; In Windows 11 2023 Update (Sun Valley 3 / 23H2) (WoW64 version) there was no new symbol

; This is list of symbols added in Windows 11 2024 Update (Hudson Valley / 24H2) (WoW64 version)
; LsaIOpenPolicyWithCreds@24