;
; Definition file of ntdll.dll
; Automatic generated by gendef
; written by Kai Tietz 2008
;
LIBRARY "ntdll.dll"
EXPORTS
RtlDispatchAPC@12
RtlActivateActivationContextUnsafeFast@0
RtlDeactivateActivationContextUnsafeFast@0
RtlInterlockedPushListSList@8
@RtlUlongByteSwap@4
@RtlUlonglongByteSwap@8
@RtlUshortByteSwap@4
ExpInterlockedPopEntrySListEnd@0
ExpInterlockedPopEntrySListFault@0
ExpInterlockedPopEntrySListResume@0
RtlpInterlockedPopEntrySeqSListEnd@0
RtlpInterlockedPopEntrySeqSListFault@0
RtlpInterlockedPopEntrySeqSListResume@0
A_SHAFinal@8
A_SHAInit@4
A_SHAUpdate@12
AlpcAdjustCompletionListConcurrencyCount@8
AlpcFreeCompletionListMessage@8
AlpcGetCompletionListLastMessageInformation@12
AlpcGetCompletionListMessageAttributes@8
AlpcGetHeaderSize@4
AlpcGetMessageAttribute@8
AlpcGetMessageFromCompletionList@8
AlpcGetOutstandingCompletionListMessageCount@4
AlpcInitializeMessageAttribute@16
AlpcMaxAllowedMessageLength@0
AlpcRegisterCompletionList@20
AlpcRegisterCompletionListWorkerThread@4
AlpcRundownCompletionList@4
AlpcUnregisterCompletionList@4
AlpcUnregisterCompletionListWorkerThread@4
ApiSetQueryApiSetPresence@8
ApiSetQueryApiSetPresenceEx@12
CsrAllocateCaptureBuffer@8
CsrAllocateMessagePointer@12
CsrCaptureMessageBuffer@16
CsrCaptureMessageMultiUnicodeStringsInPlace@12
CsrCaptureMessageString@20
CsrCaptureTimeout@8
CsrClientCallServer@16
CsrClientConnectToServer@20
CsrFreeCaptureBuffer@4
CsrGetProcessId@0
CsrIdentifyAlertableThread@0
CsrNewThread@0
CsrProbeForRead@12
CsrProbeForWrite@12
CsrSetPriorityClass@8
CsrVerifyRegion@8
DbgBreakPoint@0
DbgPrint
DbgPrintEx
DbgPrintReturnControlC
DbgPrompt@12
DbgQueryDebugFilterState@8
DbgSetDebugFilterState@12
DbgSsHandleKmApiMsg@8
DbgSsInitialize@16
DbgUiConnectToDbg@0
DbgUiContinue@8
DbgUiConvertStateChangeStructure@8
DbgUiConvertStateChangeStructureEx@8
DbgUiDebugActiveProcess@4
DbgUiGetThreadDebugObject@0
DbgUiIssueRemoteBreakin@4
DbgUiRemoteBreakin@4
DbgUiSetThreadDebugObject@4
DbgUiStopDebugging@4
DbgUiWaitStateChange@8
DbgUserBreakPoint@0
EtwCheckCoverage@4
EtwCreateTraceInstanceId@8
EtwDeliverDataBlock@4
EtwEnumerateProcessRegGuids@12
EtwEventActivityIdControl@8
EtwEventEnabled@12
EtwEventProviderEnabled@20
EtwEventRegister@16
EtwEventSetInformation@20
EtwEventUnregister@8
EtwEventWrite@20
EtwEventWriteEndScenario@20
EtwEventWriteEx@40
EtwEventWriteFull@32
EtwEventWriteNoRegistration@16
EtwEventWriteStartScenario@20
EtwEventWriteString@24
EtwEventWriteTransfer@28
EtwGetTraceEnableFlags@8
EtwGetTraceEnableLevel@8
EtwGetTraceLoggerHandle@4
EtwLogTraceEvent@12
EtwNotificationRegister@20
EtwNotificationUnregister@12
EtwProcessPrivateLoggerRequest@4
EtwRegisterSecurityProvider@0
EtwRegisterTraceGuidsA@32
EtwRegisterTraceGuidsW@32
EtwReplyNotification@4
EtwSendNotification@20
EtwSetMark@16
EtwTraceEventInstance@20
EtwTraceMessage
EtwTraceMessageVa@24
EtwUnregisterTraceGuids@8
EtwWriteUMSecurityEvent@16
EtwpCreateEtwThread@8
EtwpGetCpuSpeed@8
;EtwpNotificationThread
EvtIntReportAuthzEventAndSourceAsync@44
EvtIntReportEventAndSourceAsync@44
KiFastSystemCall@0
KiFastSystemCallRet@0
KiIntSystemCall@0
KiRaiseUserExceptionDispatcher@0
KiUserApcDispatcher@20
KiUserCallbackDispatcher@12
KiUserExceptionDispatcher@8
LdrAccessResource@16
LdrAddDllDirectory@8
LdrAddLoadAsDataTable@16; Check!!! gendef says @20
LdrAddRefDll@8
LdrAlternateResourcesEnabled@0
LdrAppxHandleIntegrityFailure@4
LdrCallEnclave@12
LdrControlFlowGuardEnforced@0
LdrCreateEnclave@36
LdrDeleteEnclave@4
LdrDisableThreadCalloutsForDll@4
LdrEnumResources@20
LdrEnumerateLoadedModules@12
LdrFastFailInLoaderCallout@0
LdrFindEntryForAddress@8
LdrFindResourceDirectory_U@16
LdrFindResourceEx_U@20
LdrFindResource_U@16
LdrFlushAlternateResourceModules@0
LdrGetDllDirectory@4
LdrGetDllFullName@8
LdrGetDllHandle@16
LdrGetDllHandleByMapping@8
LdrGetDllHandleByName@12
LdrGetDllHandleEx@20
LdrGetDllPath@16
LdrGetFailureData@0
LdrGetFileNameFromLoadAsDataTable@8
LdrGetProcedureAddress@16
LdrGetProcedureAddressEx@20
LdrGetProcedureAddressForCaller@24
LdrHotPatchRoutine@0
LdrInitShimEngineDynamic@4
LdrInitializeEnclave@20
LdrInitializeThunk@16
LdrIsModuleSxsRedirected@4
LdrLoadAlternateResourceModule@16
LdrLoadAlternateResourceModuleEx@20
LdrLoadDll@16
LdrLoadEnclaveModule@12
LdrAlternateResourcesEnabled@0
LdrLockLoaderLock@12
LdrOpenImageFileOptionsKey@12
LdrParentInterlockedPopEntrySList@0
LdrParentRtlInitializeNtUserPfn@0
LdrParentRtlResetNtUserPfn@0
LdrParentRtlRetrieveNtUserPfn@0
LdrProcessRelocationBlock@16
LdrProcessRelocationBlockEx@20
LdrQueryImageFileExecutionOptions@24
LdrQueryImageFileExecutionOptionsEx@28
LdrQueryImageFileKeyOption@24
LdrQueryModuleServiceTags@12
LdrQueryOptionalDelayLoadedAPI@16
LdrQueryProcessModuleInformation@12
LdrRegisterDllNotification@16
LdrRemoveDllDirectory@4
LdrRemoveLoadAsDataTable@16
LdrResFindResource@36
LdrResFindResourceDirectory@28
LdrResGetRCConfig@20
LdrResRelease@12
LdrResSearchResource@32
LdrResolveDelayLoadedAPI@24
LdrResolveDelayLoadsFromDll@12
LdrRscIsTypeExist@16
LdrSetAppCompatDllRedirectionCallback@12
LdrSetDefaultDllDirectories@4
LdrSetDllDirectory@4
LdrSetDllManifestProber@4
LdrSetImplicitPathOptions@8
LdrSetMUICacheType@4
LdrShutdownProcess@0
LdrShutdownThread@0
LdrStandardizeSystemPath@4
LdrSystemDllInitBlock@0
LdrUnloadAlternateResourceModule@4
LdrUnloadAlternateResourceModuleEx@8
LdrUnloadDll@4
LdrUnlockLoaderLock@8
LdrUnregisterDllNotification@4
LdrUpdatePackageSearchPath@4
LdrVerifyImageMatchesChecksum@16
LdrVerifyImageMatchesChecksumEx@8
LdrpChildNtdll@0
LdrpResGetMappingSize@16
LdrpResGetRCConfig@20
LdrpResGetResourceDirectory@20
LdrWx86FormatVirtualImage@12
MD4Final@4
MD4Init@4
MD4Update@12
MD5Final@4
MD5Init@4
MD5Update@12
NlsAnsiCodePage DATA
NlsMbCodePageTag DATA
NlsMbOemCodePageTag DATA
NtAcceptConnectPort@24
NtAccessCheck@32
NtAccessCheckAndAuditAlarm@44
NtAccessCheckByType@44
NtAccessCheckByTypeAndAuditAlarm@64
NtAccessCheckByTypeResultList@44
NtAccessCheckByTypeResultListAndAuditAlarm@64
NtAccessCheckByTypeResultListAndAuditAlarmByHandle@68
NtAcquireProcessActivityReference@12
NtAcquireCMFViewOwnership@12
NtAddAtom@12
NtAddAtomEx@16
NtAddBootEntry@8
NtAddDriverEntry@8
NtAdjustGroupsToken@24
NtAdjustPrivilegesToken@24
NtAdjustTokenClaimsAndDeviceGroups@64
NtAlertResumeThread@8
NtAlertThread@4
NtAlertThreadByThreadId@4
NtAllocateLocallyUniqueId@4
NtAllocateReserveObject@12
NtAllocateUserPhysicalPages@12
NtAllocateUserPhysicalPagesEx@20
NtAllocateUuids@16
NtAllocateVirtualMemory@24
NtAllocateVirtualMemoryEx@28
NtAlpcAcceptConnectPort@36
NtAlpcCancelMessage@12
NtAlpcConnectPort@44
NtAlpcConnectPortEx@44
NtAlpcCreatePort@12
NtAlpcCreatePortSection@24
NtAlpcCreateResourceReserve@16
NtAlpcCreateSectionView@12
NtAlpcCreateSecurityContext@12
NtAlpcDeletePortSection@12
NtAlpcDeleteResourceReserve@12
NtAlpcDeleteSectionView@12
NtAlpcDeleteSecurityContext@12
NtAlpcDisconnectPort@8
NtAlpcImpersonateClientContainerOfPort@12
NtAlpcImpersonateClientOfPort@12
NtAlpcOpenSenderProcess@24
NtAlpcOpenSenderThread@24
NtAlpcQueryInformation@20
NtAlpcQueryInformationMessage@24
NtAlpcRevokeSecurityContext@12
NtAlpcSendWaitReceivePort@32
NtAlpcSetInformation@16
NtApphelpCacheControl@8
NtAreMappedFilesTheSame@8
NtAssignProcessToJobObject@8
NtAssociateWaitCompletionPacket@32
NtCallEnclave@16
NtCallbackReturn@12
NtCancelDeviceWakeupRequest@4
NtCancelIoFile@8
NtCancelIoFileEx@12
NtCancelSynchronousIoFile@12
NtCancelTimer2@8
NtCancelTimer@8
NtCancelWaitCompletionPacket@8
NtClearEvent@4
NtClose@4
NtCloseObjectAuditAlarm@12
NtCommitComplete@8
NtCommitEnlistment@8
NtCommitRegistryTransaction@8
NtCommitTransaction@8
NtCompactKeys@8
NtCompareObjects@8
NtCompareSigningLevels@8
NtCompareTokens@12
NtCompleteConnectPort@4
NtCompressKey@4
NtConnectPort@32
NtContinue@8
NtConvertBetweenAuxiliaryCounterAndPerformanceCounter@16
NtCreateCrossVmEvent@24
NtCreateDebugObject@16
NtCreateDirectoryObject@12
NtCreateDirectoryObjectEx@20
NtCreateEnclave@36
NtCreateEnlistment@32
NtCreateEvent@20
NtCreateEventPair@12
NtCreateFile@44
NtCreateIRTimer@12
NtCreateIoCompletion@16
NtCreateJobObject@12
NtCreateJobSet@12
NtCreateKey@28
NtCreateKeyTransacted@32
NtCreateKeyedEvent@16
NtCreateLowBoxToken@36
NtCreateMailslotFile@32
NtCreateMutant@16
NtCreateNamedPipeFile@56
NtCreatePagingFile@16
NtCreatePartition@16
NtCreatePort@20
NtCreatePrivateNamespace@16
NtCreateProcess@32
NtCreateProcessEx@36
NtCreateProfile@36
NtCreateProfileEx@40
NtCreateRegistryTransaction@16
NtCreateResourceManager@28
NtCreateSection@28
NtCreateSectionEx@36
NtCreateSemaphore@20
NtCreateSymbolicLinkObject@16
NtCreateThread@32
NtCreateThreadEx@44
NtCreateTimer2@20
NtCreateTimer@16
NtCreateToken@52
NtCreateTokenEx@68
NtCreateTransaction@40
NtCreateTransactionManager@24
NtCreateUserProcess@44
NtCreateWaitCompletionPacket@12
NtCreateWaitablePort@20
NtCreateWnfStateName@28
NtCreateWorkerFactory@40
NtCurrentTeb@0
NtDebugActiveProcess@8
NtDebugContinue@12
NtDelayExecution@8
NtDeleteAtom@4
NtDeleteBootEntry@4
NtDeleteDriverEntry@4
NtDeleteFile@4
NtDeleteKey@4
NtDeleteObjectAuditAlarm@12
NtDeletePrivateNamespace@4
NtDeleteValueKey@8
NtDeleteWnfStateData@8
NtDeleteWnfStateName@4
NtDeviceIoControlFile@40
NtDisableLastKnownGood@0
NtDisplayString@4
NtDrawText@4
NtDuplicateObject@28
NtDuplicateToken@24
NtEnableLastKnownGood@0
NtEnumerateBootEntries@8
NtEnumerateDriverEntries@8
NtEnumerateKey@24
NtEnumerateSystemEnvironmentValuesEx@12
NtEnumerateTransactionObject@20
NtEnumerateValueKey@24
NtExtendSection@8
NtFilterBootOption@20
NtFilterToken@24
NtFilterTokenEx@56
NtFindAtom@12
NtFlushBuffersFile@8
NtFlushBuffersFileEx@20
NtFlushInstallUILanguage@8
NtFlushInstructionCache@12
NtFlushKey@4
NtFlushProcessWriteBuffers@0
NtFlushVirtualMemory@16
NtFlushWriteBuffer@0
NtFreeUserPhysicalPages@12
NtFreeVirtualMemory@16
NtFreezeRegistry@4
NtFreezeTransactions@8
NtFsControlFile@40
NtGetCachedSigningLevel@24
NtGetCompleteWnfStateSubscription@24
NtGetContextThread@8
NtGetCurrentProcessorNumber@0
NtGetCurrentProcessorNumberEx@4
NtGetDevicePowerState@8
NtGetMUIRegistryInfo@12
NtGetNextProcess@20
NtGetNextThread@24
NtGetNlsSectionPtr@20
NtGetNotificationResourceManager@28
NtGetPlugPlayEvent@16
NtGetTickCount@0
NtGetWriteWatch@28
NtImpersonateAnonymousToken@4
NtImpersonateClientOfPort@8
NtImpersonateThread@12
NtInitializeEnclave@20
NtInitializeNlsFiles@16 ;Check!!! gendef says 12
NtInitializeRegistry@4
NtInitiatePowerAction@16
NtIsProcessInJob@8
NtIsSystemResumeAutomatic@0
NtIsUILanguageComitted@0
NtListenPort@8
NtLoadDriver@4
NtLoadEnclaveData@36
NtLoadKey2@12
NtLoadKey@8
NtLoadKeyEx@32
NtLockFile@40
NtLockProductActivationKeys@8
NtLockRegistryKey@4
NtLockVirtualMemory@16
NtMakePermanentObject@4
NtMakeTemporaryObject@4
NtManageHotPatch@16
NtManagePartition@20
NtMapCMFModule@24
NtMapUserPhysicalPages@12
NtMapUserPhysicalPagesScatter@12
NtMapViewOfSection@40
NtMapViewOfSectionEx@36
NtModifyBootEntry@4
NtModifyDriverEntry@4
NtNotifyChangeDirectoryFile@36
NtNotifyChangeDirectoryFileEx@40
NtNotifyChangeKey@40
NtNotifyChangeMultipleKeys@48
NtNotifyChangeSession@32
NtOpenDirectoryObject@12
NtOpenEnlistment@20
NtOpenEvent@12
NtOpenEventPair@12
NtOpenFile@24
NtOpenIoCompletion@12
NtOpenJobObject@12
NtOpenKey@12
NtOpenKeyEx@16
NtOpenKeyTransacted@16
NtOpenKeyTransactedEx@20
NtOpenKeyedEvent@12
NtOpenMutant@12
NtOpenObjectAuditAlarm@48
NtOpenPartition@12
NtOpenPrivateNamespace@16
NtOpenProcess@16
NtOpenProcessToken@12
NtOpenProcessTokenEx@16
NtOpenRegistryTransaction@12
NtOpenResourceManager@20
NtOpenSection@12
NtOpenSemaphore@12
NtOpenSession@12
NtOpenSymbolicLinkObject@12
NtOpenThread@16
NtOpenThreadToken@16
NtOpenThreadTokenEx@20
NtOpenTimer@12
NtOpenTransaction@20
NtOpenTransactionManager@24
NtPlugPlayControl@12
NtPowerInformation@20
NtPrePrepareComplete@8
NtPrePrepareEnlistment@8
NtPrepareComplete@8
NtPrepareEnlistment@8
NtPrivilegeCheck@12
NtPrivilegeObjectAuditAlarm@24
NtPrivilegedServiceAuditAlarm@20
NtPropagationComplete@16
NtPropagationFailed@12
NtProtectVirtualMemory@20
NtPssCaptureVaSpaceBulk@20
NtPulseEvent@8
NtQueryAttributesFile@8
NtQueryAuxiliaryCounterFrequency@4
NtQueryBootEntryOrder@8
NtQueryBootOptions@8
NtQueryDebugFilterState@8
NtQueryDefaultLocale@8
NtQueryDefaultUILanguage@4
NtQueryDirectoryFile@44
NtQueryDirectoryFileEx@40
NtQueryDirectoryObject@28
NtQueryDriverEntryOrder@8
NtQueryEaFile@36
NtQueryEvent@20
NtQueryFullAttributesFile@8
NtQueryInformationAtom@20
NtQueryInformationByName@20
NtQueryInformationEnlistment@20
NtQueryInformationFile@20
NtQueryInformationJobObject@20
NtQueryInformationPort@20
NtQueryInformationProcess@20
NtQueryInformationResourceManager@20
NtQueryInformationThread@20
NtQueryInformationToken@20
NtQueryInformationTransaction@20
NtQueryInformationTransactionManager@20
NtQueryInformationWorkerFactory@20
NtQueryInstallUILanguage@4
NtQueryIntervalProfile@8
NtQueryIoCompletion@20
NtQueryKey@20
NtQueryLicenseValue@20
NtQueryMultipleValueKey@24
NtQueryMutant@20
NtQueryObject@20
NtQueryOpenSubKeys@8
NtQueryOpenSubKeysEx@16
NtQueryPerformanceCounter@8
NtQueryPortInformationProcess@0
NtQueryQuotaInformationFile@36
NtQuerySection@20
NtQuerySecurityAttributesToken@24
NtQuerySecurityObject@20
NtQuerySecurityPolicy@24
NtQuerySemaphore@20
NtQuerySymbolicLinkObject@12
NtQuerySystemEnvironmentValue@16
NtQuerySystemEnvironmentValueEx@20
NtQuerySystemInformation@16
NtQuerySystemInformationEx@24
NtQuerySystemTime@4
NtQueryTimer@20
NtQueryTimerResolution@12
NtQueryValueKey@24
NtQueryVirtualMemory@24
NtQueryVolumeInformationFile@20
NtQueryWnfStateData@24
NtQueryWnfStateNameInformation@20
NtQueueApcThread@20
NtQueueApcThreadEx@24
NtRaiseException@12
NtRaiseHardError@24
NtReadFile@36
NtReadFileScatter@36
NtReadOnlyEnlistment@8
NtReadRequestData@24
NtReadVirtualMemory@20
NtRecoverEnlistment@8
NtRecoverResourceManager@4
NtRecoverTransactionManager@4
NtRegisterProtocolAddressInformation@20
NtRegisterThreadTerminatePort@4
NtReleaseCMFViewOwnership@0
NtReleaseKeyedEvent@16
NtReleaseMutant@8
NtReleaseSemaphore@12
NtReleaseWorkerFactoryWorker@4
NtRemoveIoCompletion@20
NtRemoveIoCompletionEx@24
NtRemoveProcessDebug@8
NtRenameKey@8
NtRenameTransactionManager@8
NtReplaceKey@12
NtReplacePartitionUnit@12
NtReplyPort@8
NtReplyWaitReceivePort@16
NtReplyWaitReceivePortEx@20
NtReplyWaitReplyPort@8
NtRequestDeviceWakeup@4
NtRequestPort@8
NtRequestWaitReplyPort@12
NtRequestWakeupLatency@4
NtResetEvent@8
NtResetWriteWatch@12
NtRestoreKey@12
NtResumeProcess@4
NtResumeThread@8
NtRevertContainerImpersonation@0
NtRollbackComplete@8
NtRollbackEnlistment@8
NtRollbackRegistryTransaction@8
NtRollbackTransaction@8
NtRollforwardTransactionManager@8
NtSaveKey@8
NtSaveKeyEx@12
NtSaveMergedKeys@12
NtSecureConnectPort@36
NtSerializeBoot@0
NtSetBootEntryOrder@8
NtSetBootOptions@8
NtSetCachedSigningLevel2@24
NtSetCachedSigningLevel@20
NtSetContextThread@8
NtSetDebugFilterState@12
NtSetDefaultHardErrorPort@4
NtSetDefaultLocale@8
NtSetDefaultUILanguage@4
NtSetDriverEntryOrder@8
NtSetEaFile@16
NtSetEvent@8
NtSetEventBoostPriority@4
NtSetHighEventPair@4
NtSetHighWaitLowEventPair@4
NtSetIRTimer@8
NtSetInformationDebugObject@20
NtSetInformationEnlistment@16
NtSetInformationFile@20
NtSetInformationJobObject@16
NtSetInformationKey@16
NtSetInformationObject@16
NtSetInformationProcess@16
NtSetInformationResourceManager@16
NtSetInformationSymbolicLink@16
NtSetInformationThread@16
NtSetInformationToken@16
NtSetInformationTransaction@16
NtSetInformationTransactionManager@16
NtSetInformationVirtualMemory@24
NtSetInformationWorkerFactory@16
NtSetIntervalProfile@8
NtSetIoCompletion@20
NtSetIoCompletionEx@24
NtSetLdtEntries@24
NtSetLowEventPair@4
NtSetLowWaitHighEventPair@4
NtSetQuotaInformationFile@16
NtSetSecurityObject@12
NtSetSystemEnvironmentValue@8
NtSetSystemEnvironmentValueEx@20
NtSetSystemInformation@12
NtSetSystemPowerState@12
NtSetSystemTime@8
NtSetThreadExecutionState@8
NtSetTimer2@16
NtSetTimer@28
NtSetTimerEx@16
NtSetTimerResolution@12
NtSetUuidSeed@4
NtSetValueKey@24
NtSetVolumeInformationFile@20
NtSetWnfProcessNotificationEvent@4
NtShutdownSystem@4
NtShutdownWorkerFactory@8
NtSignalAndWaitForSingleObject@16
NtSinglePhaseReject@8
NtStartProfile@4
NtStopProfile@4
NtSubscribeWnfStateChange@16
NtSuspendProcess@4
NtSuspendThread@8
NtSystemDebugControl@24
NtTerminateEnclave@8
NtTerminateJobObject@8
NtTerminateProcess@8
NtTerminateThread@8
NtTestAlert@0
NtThawRegistry@0
NtThawTransactions@0
NtTraceControl@24
NtTraceEvent@16
NtTranslateFilePath@16
NtUmsThreadYield@4
NtUnloadDriver@4
NtUnloadKey2@8
NtUnloadKey@4
NtUnloadKeyEx@8
NtUnlockFile@20
NtUnlockVirtualMemory@16
NtUnmapViewOfSection@8
NtUnmapViewOfSectionEx@12
NtUnsubscribeWnfStateChange@4
NtUpdateWnfStateData@28
NtVdmControl@8
NtWaitForAlertByThreadId@8
NtWaitForDebugEvent@16
NtWaitForKeyedEvent@16
NtWaitForMultipleObjects32@20
NtWaitForMultipleObjects@20
NtWaitForSingleObject@12
NtWaitForWorkViaWorkerFactory@8
NtWaitHighEventPair@4
NtWaitLowEventPair@4
NtWorkerFactoryWorkerReady@4
NtWow64CallFunction64@28
NtWow64CsrAllocateCaptureBuffer@8
NtWow64CsrAllocateMessagePointer@12
NtWow64CsrCaptureMessageBuffer@16
NtWow64CsrCaptureMessageString@20
NtWow64CsrClientCallServer@16
NtWow64CsrClientConnectToServer@20
NtWow64CsrFreeCaptureBuffer@4
NtWow64CsrGetProcessId@0
NtWow64CsrIdentifyAlertableThread@0
NtWow64CsrVerifyRegion@8
NtWow64DebuggerCall@20
NtWow64GetCurrentProcessorNumberEx@4
NtWow64GetNativeSystemInformation@16
NtWow64InterlockedPopEntrySList@4
NtWow64QueryInformationProcess64@20
NtWow64QueryVirtualMemory64@32
NtWow64ReadVirtualMemory64@28
NtWow64WriteVirtualMemory64@28
NtWriteFile@36
NtWriteFileGather@36
NtWriteRequestData@24
NtWriteVirtualMemory@20
NtYieldExecution@0
; Not sure, but we assume here standard DefWindowProc arguments
NtdllDefWindowProc_A@16
NtdllDefWindowProc_W@16
; Not sure, but we assume here standard DefDlgProc arguments
NtdllDialogWndProc_A@16
NtdllDialogWndProc_W@16
PfxFindPrefix@8
PfxInitialize@4
PfxInsertPrefix@12
PfxRemovePrefix@8
PssNtCaptureSnapshot@16
PssNtDuplicateSnapshot@20
PssNtFreeRemoteSnapshot@8
PssNtFreeSnapshot@4
PssNtFreeWalkMarker@4
PssNtQuerySnapshot@16
PssNtValidateDescriptor@8
PssNtWalkSnapshot@20
RtlAbortRXact@4
RtlAbsoluteToSelfRelativeSD@12
RtlAcquirePebLock@0
RtlAcquirePrivilege@16
RtlAcquireReleaseSRWLockExclusive@4
RtlAcquireResourceExclusive@8
RtlAcquireResourceShared@8
RtlAcquireSRWLockExclusive@4
RtlAcquireSRWLockShared@4
RtlActivateActivationContext@12
RtlActivateActivationContextEx@16
RtlAddAccessAllowedAce@16
RtlAddAccessAllowedAceEx@20
RtlAddAccessAllowedObjectAce@28
RtlAddAccessDeniedAce@16
RtlAddAccessDeniedAceEx@20
RtlAddAccessDeniedObjectAce@28
RtlAddAccessFilterAce@32
RtlAddAce@20
RtlAddActionToRXact@24
RtlAddAtomToAtomTable@12
RtlAddAttributeActionToRXact@32
RtlAddAuditAccessAce@24
RtlAddAuditAccessAceEx@28
RtlAddAuditAccessObjectAce@36
RtlAddCompoundAce@24
RtlAddIntegrityLabelToBoundaryDescriptor@8
RtlAddMandatoryAce@24
RtlAddProcessTrustLabelAce@24
RtlAddRefActivationContext@4
RtlAddRange@36
RtlAddRefMemoryStream@4
RtlAddResourceAttributeAce@28
RtlAddSIDToBoundaryDescriptor@8
RtlAddScopedPolicyIDAce@20
RtlAddVectoredContinueHandler@8
RtlAddVectoredExceptionHandler@8
RtlAddressInSectionTable@12
RtlAdjustPrivilege@16
RtlAllocateActivationContextStack@4
RtlAllocateAndInitializeSid@44
RtlAllocateAndInitializeSidEx@16
RtlAllocateHandle@8
RtlAllocateHeap@12
RtlAllocateMemoryBlockLookaside@12
RtlAllocateMemoryZone@12
RtlAllocateWnfSerializationGroup@0
RtlAnsiCharToUnicodeChar@4
RtlAnsiStringToUnicodeSize@4
RtlAnsiStringToUnicodeString@12
RtlAppendAsciizToString@8
RtlAppendPathElement@12
RtlAppendStringToString@8
RtlAppendUnicodeStringToString@8
RtlAppendUnicodeToString@8
RtlApplicationVerifierStop@40
RtlApplyRXact@4
RtlApplyRXactNoFlush@4
RtlAppxIsFileOwnedByTrustedInstaller@8
RtlAreAllAccessesGranted@8
RtlAreAnyAccessesGranted@8
RtlAreBitsClear@12
RtlAreBitsSet@12
RtlAreLongPathsEnabled@0
RtlAssert@16
RtlAvlInsertNodeEx@16
RtlAvlRemoveNode@8
RtlBarrier@8
RtlBarrierForDelete@8
RtlCallbackLpcClient@12
RtlCancelTimer@8
RtlCanonicalizeDomainName@12
RtlCapabilityCheck@12
RtlCapabilityCheckForSingleSessionSku@12
RtlCaptureContext@4
RtlCaptureStackBackTrace@16
RtlCaptureStackContext@12
RtlCharToInteger@12
RtlCheckBootStatusIntegrity@8
RtlCheckForOrphanedCriticalSections@4
RtlCheckPortableOperatingSystem@4
RtlCheckRegistryKey@8
RtlCheckSandboxedToken@8
RtlCheckSystemBootStatusIntegrity@4
RtlCheckTokenCapability@12
RtlCheckTokenMembership@12
RtlCheckTokenMembershipEx@16
RtlCleanUpTEBLangLists@0
RtlClearAllBits@4
RtlClearBit@8
RtlClearBits@12
RtlClearThreadWorkOnBehalfTicket@0
RtlCloneMemoryStream@8
RtlCloneUserProcess@20
RtlCmDecodeMemIoResource@8
RtlCmEncodeMemIoResource@24
RtlCommitDebugInfo@8
RtlCommitMemoryStream@8
RtlCompactHeap@8
RtlCompareAltitudes@8
RtlCompareMemory@12
RtlCompareMemoryUlong@12
RtlCompareString@12
RtlCompareUnicodeString@12
RtlCompareUnicodeStrings@20
RtlCompressBuffer@32
RtlComputeCrc32@12
RtlComputeImportTableHash@12
RtlComputePrivatizedDllName_U@12
RtlConnectToSm@16
RtlConsoleMultiByteToUnicodeN@24
RtlConstructCrossVmEventPath@12
RtlContractHashTable@4
RtlConvertDeviceFamilyInfoToString@16
RtlConvertExclusiveToShared@4
RtlConvertLCIDToString@20
RtlConvertLongToLargeInteger@4
RtlConvertSRWLockExclusiveToShared@4
RtlConvertSharedToExclusive@4
RtlConvertSidToUnicodeString@12
RtlConvertToAutoInheritSecurityObject@24
RtlConvertUiListToApiList@12
RtlConvertUlongToLargeInteger@4
RtlCopyBitMap@12
RtlCopyContext@12
RtlCopyExtendedContext@12
RtlCopyLuid@8
RtlCopyLuidAndAttributesArray@12
RtlCopyMappedMemory@12
RtlCopyMemoryStreamTo@24
RtlCopyOutOfProcessMemoryStreamTo@24
RtlCopyRangeList@8
RtlCopySecurityDescriptor@8
RtlCopySid@12
RtlCopySidAndAttributesArray@28
RtlCopyString@8
RtlCopyUnicodeString@8
RtlCrc32@12
RtlCrc64@16
RtlCreateAcl@12
RtlCreateActivationContext@24
RtlCreateAndSetSD@20
RtlCreateAtomTable@8
RtlCreateBootStatusDataFile@4
RtlCreateBoundaryDescriptor@8
RtlCreateEnvironment@8
RtlCreateEnvironmentEx@12
RtlCreateHashTable@12
RtlCreateHashTableEx@16
RtlCreateHeap@24
RtlCreateLpcServer@24
RtlCreateMemoryBlockLookaside@20
RtlCreateMemoryZone@12
RtlCreateProcessParameters@40
RtlCreateProcessParametersEx@44
RtlCreateProcessParametersWithTemplate@12
RtlCreateProcessReflection@24
RtlCreateQueryDebugBuffer@8
RtlCreateRegistryKey@8
RtlCreateSecurityDescriptor@8
RtlCreateServiceSid@12
RtlCreateSystemVolumeInformationFolder@4
RtlCreateTagHeap@16
RtlCreateTimer@28
RtlCreateTimerQueue@4
RtlCreateUnicodeString@8
RtlCreateUnicodeStringFromAsciiz@8
RtlCreateUserProcess@40
RtlCreateUserProcessEx@20
RtlCreateUserSecurityObject@28
RtlCreateUserStack@24
RtlCreateUserThread@40
RtlCreateVirtualAccountSid@16
RtlCultureNameToLCID@8
RtlCustomCPToUnicodeN@24
RtlCutoverTimeToSystemTime@16
RtlDeCommitDebugInfo@12
RtlDeNormalizeProcessParams@4
RtlDeactivateActivationContext@8
RtlDebugPrintTimes@0
RtlDecodePointer@4
RtlDecodeRemotePointer@12
RtlDecodeSystemPointer@4
RtlDecompressBuffer@24
RtlDecompressBufferEx@28
RtlDecompressFragment@32
RtlDefaultNpAcl@4
RtlDelete@4
RtlDeleteAce@8
RtlDeleteAtomFromAtomTable@8
RtlDeleteBarrier@4
RtlDeleteBoundaryDescriptor@4
RtlDeleteCriticalSection@4
RtlDeleteElementGenericTable@8
RtlDeleteElementGenericTableAvl@8
RtlDeleteElementGenericTableAvlEx@8
RtlDeleteHashTable@4
RtlDeleteNoSplay@8
RtlDeleteOwnersRanges@8
RtlDeleteRange@24
RtlDeleteRegistryValue@12
RtlDeleteResource@4
RtlDeleteSecurityObject@4
RtlDeleteTimer@12
RtlDeleteTimerQueue@4
RtlDeleteTimerQueueEx@8
RtlDeNormalizeProcessParams@4
RtlDeregisterSecureMemoryCacheCallback@4
RtlDeregisterWait@4
RtlDeregisterWaitEx@8
RtlDeriveCapabilitySidsFromName@12
RtlDestroyAtomTable@4
RtlDestroyEnvironment@4
RtlDestroyHandleTable@4
RtlDestroyHeap@4
RtlDestroyMemoryBlockLookaside@4
RtlDestroyMemoryZone@4
RtlDestroyProcessParameters@4
RtlDestroyQueryDebugBuffer@4
RtlDetectHeapLeaks@0
RtlDetermineDosPathNameType_U@4
RtlDisableThreadProfiling@4
RtlDllShutdownInProgress@0
RtlDnsHostNameToComputerName@12
RtlDoesFileExists_U@4
RtlDoesNameContainWildCards@4
RtlDosApplyFileIsolationRedirection_Ustr@36
RtlDosLongPathNameToNtPathName_U_WithStatus@16
RtlDosLongPathNameToRelativeNtPathName_U_WithStatus@16
RtlDosPathNameToNtPathName_U@16
RtlDosPathNameToNtPathName_U_WithStatus@16
RtlDosPathNameToRelativeNtPathName_U@16
RtlDosPathNameToRelativeNtPathName_U_WithStatus@16
RtlDosSearchPath_U@24
RtlDosSearchPath_Ustr@36
RtlDowncaseUnicodeChar@4
RtlDowncaseUnicodeString@12
RtlDumpResource@4
RtlDuplicateUnicodeString@12
RtlEmptyAtomTable@8
RtlEnableEarlyCriticalSectionEventCreation@0
RtlEnableThreadProfiling@20
RtlEncodePointer@4
RtlEncodeRemotePointer@12
RtlEncodeSystemPointer@4
RtlEndEnumerationHashTable@8
RtlEndStrongEnumerationHashTable@8
RtlEndWeakEnumerationHashTable@8
RtlEnlargedIntegerMultiply@8
RtlEnlargedUnsignedDivide@16
RtlEnlargedUnsignedMultiply@8
RtlEnterCriticalSection@4
RtlEnumProcessHeaps@8
RtlEnumerateEntryHashTable@8
RtlEnumerateGenericTable@8
RtlEnumerateGenericTableAvl@8
RtlEnumerateGenericTableLikeADirectory@28
RtlEnumerateGenericTableWithoutSplaying@8
RtlEnumerateGenericTableWithoutSplayingAvl@8
RtlEqualComputerName@8
RtlEqualDomainName@8
RtlEqualLuid@8
RtlEqualPrefixSid@8
RtlEqualSid@8
RtlEqualString@12
RtlEqualUnicodeString@12
RtlEqualWnfChangeStamps@8
RtlEraseUnicodeString@4
RtlEthernetAddressToStringA@8
RtlEthernetAddressToStringW@8
RtlEthernetStringToAddressA@12
RtlEthernetStringToAddressW@12
RtlExitUserProcess@4
RtlExitUserThread@4 ; Not sure, but we assume @4
RtlExpandEnvironmentStrings@24
RtlExpandEnvironmentStrings_U@16
RtlExpandHashTable@4
RtlExtendCorrelationVector@4
RtlExtendMemoryBlockLookaside@8
RtlExtendMemoryZone@8
RtlExtendedIntegerMultiply@12
RtlExtendedLargeIntegerDivide@16
RtlExtendedMagicDivide@20
RtlExtractBitMap@16
RtlExtendHeap@16
RtlFillMemory@12
RtlFillMemoryUlong@12
RtlFillMemoryUlonglong@16
RtlFinalReleaseOutOfProcessMemoryStream@4
RtlFindAceByType@12
RtlFindActivationContextSectionGuid@20
RtlFindActivationContextSectionString@20
RtlFindCharInUnicodeString@16
RtlFindClearBits@12
RtlFindClearBitsAndSet@12
RtlFindClearRuns@16
RtlFindClosestEncodableLength@12
RtlFindExportedRoutineByName@8
RtlFindLastBackwardRunClear@12
RtlFindLeastSignificantBit@8
RtlFindLongestRunClear@8
RtlFindLongestRunSet@8
RtlFindMessage@20
RtlFindMostSignificantBit@8
RtlFindNextForwardRunClear@12
RtlFindRange@48
RtlFindSetBits@12
RtlFindSetBitsAndClear@12
RtlFindUnicodeSubstring@12
RtlFirstEntrySList@4
RtlFirstFreeAce@8
RtlFlsAlloc@8
RtlFlsFree@4
RtlFlsGetValue@8
RtlFlsSetValue@8
RtlFlushHeaps@0
RtlFlushSecureMemoryCache@8
RtlFormatCurrentUserKeyPath@4
RtlFormatMessage@36
RtlFormatMessageEx@40
RtlFreeActivationContextStack@4
RtlFreeAnsiString@4
RtlFreeHandle@8
RtlFreeHeap@12
RtlFreeMemoryBlockLookaside@8
RtlFreeOemString@4
RtlFreeSid@4
RtlFreeThreadActivationContextStack@0
RtlFreeUTF8String@4
RtlFreeUnicodeString@4
RtlFreeUserStack@4
RtlFreeUserThreadStack@8
RtlGUIDFromString@8
RtlGenerate8dot3Name@16
RtlGetAce@12
RtlGetActiveActivationContext@4
RtlGetActiveConsoleId@0
RtlGetAppContainerNamedObjectPath@16
RtlGetAppContainerParent@8
RtlGetAppContainerSidType@8
RtlGetCallersAddress@8
RtlGetCompressionWorkSpaceSize@12
RtlGetConsoleSessionForegroundProcessId@0
RtlGetControlSecurityDescriptor@12
RtlGetCriticalSectionRecursionCount@4
RtlGetCurrentDirectory_U@8
RtlGetCurrentPeb@0
RtlGetCurrentProcessorNumber@0
RtlGetCurrentProcessorNumberEx@4
RtlGetCurrentServiceSessionId@0
RtlGetCurrentTransaction@0
RtlGetDaclSecurityDescriptor@16
RtlGetDeviceFamilyInfoEnum@12
RtlGetElementGenericTable@8
RtlGetElementGenericTableAvl@8
RtlGetEnabledExtendedFeatures@8
RtlGetExePath@8
RtlGetExtendedContextLength2@16
RtlGetExtendedContextLength@8
RtlGetExtendedFeaturesMask@4
RtlGetFileMUIPath@28
RtlGetFirstRange@12
RtlGetFrame@0
RtlGetFullPathName_U@16
RtlGetFullPathName_UEx@20
RtlGetFullPathName_UstrEx@32
RtlGetGroupSecurityDescriptor@12
RtlGetIntegerAtom@8
RtlGetInterruptTimePrecise@4
RtlGetLastNtStatus@0
RtlGetLastWin32Error@0
RtlGetLengthWithoutLastFullDosOrNtPathElement@12
RtlGetLengthWithoutTrailingPathSeperators@12
RtlGetLocaleFileMappingAddress@12
RtlGetLongestNtPathLength@0
RtlGetMultiTimePrecise@12
RtlGetLongestNtPathLength@0
RtlGetNativeSystemInformation@16
RtlGetNextRange@12
RtlGetNextEntryHashTable@8
RtlGetNtGlobalFlags@0
RtlGetNtProductType@4
RtlGetNtSystemRoot@0
RtlGetNtVersionNumbers@12
RtlGetOwnerSecurityDescriptor@12
RtlGetParentLocaleName@16
RtlGetPersistedStateLocation@28
RtlGetProcessHeaps@8
RtlGetProcessPreferredUILanguages@16
RtlGetProductInfo@20
RtlGetSaclSecurityDescriptor@16
RtlGetSearchPath@4
RtlGetSecurityDescriptorRMControl@8
RtlGetSessionProperties@8
RtlGetSetBootStatusData@24
RtlGetSuiteMask@0
RtlGetSystemBootStatus@16
RtlGetSystemBootStatusEx@12
RtlGetSystemPreferredUILanguages@20
RtlGetSystemTimePrecise@0
RtlGetThreadErrorMode@0
RtlGetThreadLangIdByIndex@16
RtlGetThreadPreferredUILanguages@16
RtlGetThreadWorkOnBehalfTicket@8
RtlGetTokenNamedObjectPath@12
RtlGetUILanguageInfo@20
RtlGetUnloadEventTrace@0
RtlGetUnloadEventTraceEx@12
RtlGetUserInfoHeap@20
RtlGetUserPreferredUILanguages@20
RtlGetVersion@4
RtlGuardCheckLongJumpTarget@12
RtlGUIDFromString@8
RtlHashUnicodeString@16
RtlHeapTrkInitialize@4
RtlIdentifierAuthoritySid@4
RtlIdnToAscii@20
RtlIdnToNameprepUnicode@20
RtlIdnToUnicode@20
RtlImageDirectoryEntryToData@16
RtlImageNtHeader@4
RtlImageNtHeaderEx@20
RtlImageRvaToSection@12
RtlImageRvaToVa@16
RtlImpersonateLpcClient@8
RtlImpersonateSelf@4
RtlImpersonateSelfEx@12
RtlIncrementCorrelationVector@4
RtlInitAnsiString@8
RtlInitAnsiStringEx@8
RtlInitBarrier@12
RtlInitCodePageTable@8
RtlInitEnumerationHashTable@8
RtlInitMemoryStream@4
RtlInitNlsTables@16
RtlInitOutOfProcessMemoryStream@4
RtlInitString@8
RtlInitStringEx@8
RtlInitStrongEnumerationHashTable@8
RtlInitUTF8String@8
RtlInitUTF8StringEx@8
RtlInitUnicodeString@8
RtlInitUnicodeStringEx@8
RtlInitWeakEnumerationHashTable@8
RtlInitializeAtomPackage@4
RtlInitializeBitMap@12
RtlInitializeConditionVariable@4
RtlInitializeContext@20
RtlInitializeCorrelationVector@12
RtlInitializeCriticalSection@4
RtlInitializeCriticalSectionAndSpinCount@8
RtlInitializeCriticalSectionEx@12
RtlInitializeExceptionChain@4
RtlInitializeExtendedContext2@20
RtlInitializeExtendedContext@12
RtlInitializeGenericTable@20
RtlInitializeGenericTableAvl@20
RtlInitializeHandleTable@12
RtlInitializeNtUserPfn@24
RtlInitializeRXact@12
RtlInitializeResource@4
RtlInitializeSListHead@4
RtlInitializeSRWLock@4
RtlInitializeSid@12
RtlInitializeSidEx@0
RtlInsertElementGenericTable@16
RtlInsertElementGenericTableAvl@16
RtlInsertElementGenericTableFull@24
RtlInsertElementGenericTableFullAvl@24
RtlInsertEntryHashTable@16
RtlInt64ToUnicodeString@16
RtlIntegerToChar@16
RtlIntegerToUnicodeString@12
RtlInterlockedClearBitRun@12
RtlInterlockedCompareExchange64@20
RtlInterlockedFlushSList@4
RtlInterlockedPopEntrySList@4
RtlInterlockedPushEntrySList@8
RtlInterlockedPushListSListEx@16
RtlInvertRangeList@8
RtlInterlockedSetBitRun@12
RtlIoDecodeMemIoResource@16
RtlIoEncodeMemIoResource@40
RtlIpv4AddressToStringA@8
RtlIpv4AddressToStringExA@16
RtlIpv4AddressToStringExW@16
RtlIpv4AddressToStringW@8
RtlIpv4StringToAddressA@16
RtlIpv4StringToAddressExA@16
RtlIpv4StringToAddressExW@16
RtlIpv4StringToAddressW@16
RtlIpv6AddressToStringA@8
RtlIpv6AddressToStringExA@20
RtlIpv6AddressToStringExW@20
RtlIpv6AddressToStringW@8
RtlIpv6StringToAddressA@12
RtlIpv6StringToAddressExA@16
RtlIpv6StringToAddressExW@16
RtlIpv6StringToAddressW@12
RtlIsActivationContextActive@4
RtlIsCapabilitySid@4
RtlIsCloudFilesPlaceholder@8
RtlIsCriticalSectionLocked@4
RtlIsCriticalSectionLockedByThread@4
RtlIsCurrentProcess@4
RtlIsCurrentThread@4
RtlIsCurrentThreadAttachExempt@0
RtlIsDosDeviceName_U@4
RtlIsElevatedRid@4
RtlIsGenericTableEmpty@4
RtlIsGenericTableEmptyAvl@4
RtlIsMultiSessionSku@0
RtlIsMultiUsersInSessionSku@0
RtlIsNameInExpression@16
RtlIsNameInUnUpcasedExpression@16
RtlIsNameLegalDOS8Dot3@12
RtlIsNonEmptyDirectoryReparsePointAllowed@4
RtlIsNormalizedString@16
RtlIsPackageSid@4
RtlIsParentOfChildAppContainer@8
RtlIsPartialPlaceholder@8
RtlIsPartialPlaceholderFileHandle@8
RtlIsPartialPlaceholderFileInfo@12
RtlIsProcessorFeaturePresent@4
RtlIsRangeAvailable@40
RtlIsStateSeparationEnabled@0
RtlIsTextUnicode@12
RtlIsThreadWithinLoaderCallout@0
RtlIsUntrustedObject@12
RtlIsValidHandle@8
RtlIsValidIndexHandle@12
RtlIsValidLocaleName@8
RtlIsValidProcessTrustLabelSid@4
RtlIsZeroMemory@8
RtlKnownExceptionFilter@4
RtlLCIDToCultureName@8
RtlLargeIntegerAdd@16
RtlLargeIntegerArithmeticShift@12
RtlLargeIntegerDivide@20
RtlLargeIntegerNegate@8
RtlLargeIntegerShiftLeft@12
RtlLargeIntegerShiftRight@12
RtlLargeIntegerSubtract@16
RtlLargeIntegerToChar@16
RtlLcidToLocaleName@16
RtlLeaveCriticalSection@4
RtlLengthRequiredSid@4
RtlLengthSecurityDescriptor@4
RtlLengthSid@4
RtlLengthSidAsUnicodeString@8
RtlLoadString@32
RtlLocalTimeToSystemTime@8
RtlLocaleNameToLcid@12
RtlLocateExtendedFeature2@16
RtlLocateExtendedFeature@12
RtlLocateLegacyContext@8
RtlLockBootStatusData@4
RtlLockCurrentThread@0
RtlLockHeap@4
RtlLockMemoryBlockLookaside@4
RtlLockMemoryStreamRegion@24
RtlLockMemoryZone@4
RtlLockModuleSection@4
RtlLogStackBackTrace@0
RtlLookupAtomInAtomTable@12
RtlLookupElementGenericTable@8
RtlLookupElementGenericTableAvl@8
RtlLookupElementGenericTableFull@16
RtlLookupElementGenericTableFullAvl@16
RtlLookupEntryHashTable@12
RtlLookupFirstMatchingElementGenericTableAvl@12
RtlMakeSelfRelativeSD@12
RtlMapGenericMask@8
RtlMapSecurityErrorToNtStatus@4
RtlMergeRangeLists@16
RtlMoveMemory@12
RtlMultiAppendUnicodeStringBuffer@12
RtlMultiByteToUnicodeN@20
RtlMultiByteToUnicodeSize@12
RtlMultipleAllocateHeap@20
RtlMultipleFreeHeap@16
RtlNewInstanceSecurityObject@40
RtlNewSecurityGrantedAccess@24
RtlNewSecurityObject@24
RtlNewSecurityObjectEx@32
RtlNewSecurityObjectWithMultipleInheritance@36
RtlNormalizeProcessParams@4
RtlNormalizeSecurityDescriptor@20
RtlNormalizeString@20
RtlNtPathNameToDosPathName@16
RtlNtStatusToDosError@4
RtlNtStatusToDosErrorNoTeb@4
RtlNumberGenericTableElements@4
RtlNumberGenericTableElementsAvl@4
RtlNumberOfClearBits@4
RtlNumberOfClearBitsInRange@12
RtlNumberOfSetBits@4
RtlNumberOfSetBitsInRange@12
RtlNumberOfSetBitsUlongPtr@4
RtlOemStringToUnicodeSize@4
RtlOemStringToUnicodeString@12
RtlOemToUnicodeN@20
RtlOpenCurrentUser@8
RtlOsDeploymentState@4
RtlOwnerAcesPresent@4
RtlPcToFileHeader@8
RtlPinAtomInAtomTable@8
RtlPopFrame@4
RtlPrefixString@12
RtlPrefixUnicodeString@12
RtlProcessFlsData@4
RtlProtectHeap@8
RtlPublishWnfStateData@24
RtlPushFrame@4
RtlQueryActivationContextApplicationSettings@28
RtlQueryAtomInAtomTable@24
RtlQueryCriticalSectionOwner@4
RtlQueryDepthSList@4
RtlQueryDynamicTimeZoneInformation@4
RtlQueryElevationFlags@4
RtlQueryEnvironmentVariable@24
RtlQueryEnvironmentVariable_U@12
RtlQueryHeapInformation@20
RtlQueryImageMitigationPolicy@20
RtlQueryInformationAcl@16
RtlQueryInformationActivationContext@28
RtlQueryInformationActiveActivationContext@16
RtlQueryInterfaceMemoryStream@12
RtlQueryModuleInformation@12
RtlQueryPackageClaims@32
RtlQueryPackageIdentity@24
RtlQueryPackageIdentityEx@28
RtlQueryPerformanceCounter@4
RtlQueryPerformanceFrequency@4
RtlQueryProcessBackTraceInformation@4
RtlQueryProcessDebugInformation@12
RtlQueryProcessHeapInformation@4
RtlQueryProcessLockInformation@4
RtlQueryProcessPlaceholderCompatibilityMode@0
RtlQueryProtectedPolicy@8
RtlQueryRegistryValueWithFallback@28
RtlQueryRegistryValues@20
RtlQueryRegistryValuesEx@20
RtlQueryResourcePolicy@16
RtlQuerySecurityObject@20
RtlQueryTagHeap@20
RtlQueryThreadPlaceholderCompatibilityMode@0
RtlQueryThreadProfiling@8
RtlQueryTimeZoneInformation@4
RtlQueryTokenHostIdAsUlong64@8
RtlQueryUnbiasedInterruptTime@4
RtlQueryValidationRunlevel@4
RtlQueryWnfMetaNotification@20
RtlQueryWnfStateData@24
RtlQueryWnfStateDataWithExplicitScope@28
RtlQueueApcWow64Thread@20
RtlQueueWorkItem@12
RtlRaiseCustomSystemEventTrigger@4
RtlRaiseException@4
RtlRaiseStatus@4
RtlRandom@4
RtlRandomEx@4
RtlRbInsertNodeEx@16
RtlRbRemoveNode@8
RtlReAllocateHeap@16
RtlReadMemoryStream@16
RtlReadOutOfProcessMemoryStream@16
RtlReadThreadProfilingData@12
RtlRealPredecessor@4
RtlRealSuccessor@4
RtlRegisterForWnfMetaNotification@24
RtlRegisterSecureMemoryCacheCallback@4
RtlRegisterThreadWithCsrss@0
RtlRegisterWait@24
RtlReleaseActivationContext@4
RtlReleaseMemoryStream@4
RtlReleasePath@4
RtlReleasePebLock@0
RtlReleasePrivilege@4
RtlReleaseRelativeName@4
RtlReleaseResource@4
RtlReleaseSRWLockExclusive@4
RtlReleaseSRWLockShared@4
RtlRemoteCall@28
RtlRemoveEntryHashTable@12
RtlRemovePrivileges@12
RtlRemoveVectoredContinueHandler@4
RtlRemoveVectoredExceptionHandler@4
RtlReplaceSidInSd@16
RtlReplaceSystemDirectoryInPath@16
RtlReportException@12
RtlReportExceptionEx@20
RtlReportSilentProcessExit@8
RtlReportSqmEscalation@24
RtlResetMemoryBlockLookaside@4
RtlResetMemoryZone@4
RtlResetNtUserPfn@0
RtlResetRtlTranslations@4
RtlRestoreBootStatusDefaults@4
RtlRestoreLastWin32Error@4
RtlRestoreSystemBootStatusDefaults@0
RtlRestoreThreadPreferredUILanguages@4
RtlRetrieveNtUserPfn@12
RtlRevertMemoryStream@4
RtlRunDecodeUnicodeString@8
RtlRunEncodeUnicodeString@8
RtlRunOnceBeginInitialize@12
RtlRunOnceComplete@12
RtlRunOnceExecuteOnce@16
RtlRunOnceInitialize@4
RtlSecondsSince1970ToTime@8
RtlSecondsSince1980ToTime@8
RtlSeekMemoryStream@20
RtlSelfRelativeToAbsoluteSD2@8
RtlSelfRelativeToAbsoluteSD@44
RtlSendMsgToSm@8
RtlSetAllBits@4
RtlSetAttributesSecurityDescriptor@12
RtlSetBit@8
RtlSetBits@12
RtlSetControlSecurityDescriptor@12
RtlSetCriticalSectionSpinCount@8
RtlSetCurrentDirectory_U@4
RtlSetCurrentEnvironment@8
RtlSetCurrentTransaction@4
RtlSetDaclSecurityDescriptor@16
RtlSetDynamicTimeZoneInformation@4
RtlSetEnvironmentStrings@8
RtlSetEnvironmentVar@20
RtlSetEnvironmentVariable@12
RtlSetExtendedFeaturesMask@12
RtlSetGroupSecurityDescriptor@12
RtlSetHeapInformation@16
RtlSetImageMitigationPolicy@20
RtlSetInformationAcl@16
RtlSetIoCompletionCallback@12
RtlSetLastWin32Error@4
RtlSetLastWin32ErrorAndNtStatusFromNtStatus@4
RtlSetMemoryStreamSize@12
RtlSetOwnerSecurityDescriptor@12
RtlSetPortableOperatingSystem@4
RtlSetProcessDebugInformation@12
RtlSetProcessIsCritical@0
RtlSetProcessPlaceholderCompatibilityMode@4
RtlSetProcessPreferredUILanguages@12
RtlSetProtectedPolicy@12
RtlSetProxiedProcessId@4
RtlSetSaclSecurityDescriptor@16
RtlSetSearchPathMode@4
RtlSetSecurityDescriptorRMControl@8
RtlSetSecurityObject@20
RtlSetSecurityObjectEx@24
RtlSetSystemBootStatus@16
RtlSetSystemBootStatusEx@12
RtlSetThreadErrorMode@8
RtlSetThreadIsCritical@0
RtlSetThreadPlaceholderCompatibilityMode@4
RtlSetThreadPoolStartFunc@8
RtlSetThreadPreferredUILanguages2@16
RtlSetThreadPreferredUILanguages@12
RtlSetThreadSubProcessTag@4
RtlSetThreadWorkOnBehalfTicket@4
RtlSetTimeZoneInformation@4
RtlSetTimer@28
RtlSetUnhandledExceptionFilter@4
RtlSetUserCallbackExceptionFilter@4
RtlSetUserFlagsHeap@20
RtlSetUserValueHeap@16
RtlShutdownLpcServer@4
RtlSidDominates@12
RtlSidDominatesForTrust@12
RtlSidEqualLevel@12
RtlSidHashInitialize@12
RtlSidHashLookup@8
RtlSidIsHigherLevel@12
RtlSizeHeap@12
RtlSleepConditionVariableCS@12
RtlSleepConditionVariableSRW@16
RtlSplay@4
RtlStartRXact@4
RtlStatMemoryStream@12
RtlStringFromGUID@8
RtlStringFromGUIDEx@12
RtlStronglyEnumerateEntryHashTable@8
RtlSubAuthorityCountSid@4
RtlSubAuthoritySid@8
RtlSubscribeWnfStateChangeNotification@36
RtlSubtreePredecessor@4
RtlSubtreeSuccessor@4
RtlSwitchedVVI@16
RtlSystemTimeToLocalTime@8
RtlTestAndPublishWnfStateData@28
RtlTestBit@8
RtlTestProtectedAccess@8
RtlTimeFieldsToTime@8
RtlTimeToElapsedTimeFields@8
RtlTimeToSecondsSince1970@8
RtlTimeToSecondsSince1980@8
RtlTimeToTimeFields@8
RtlTraceDatabaseAdd@16
RtlTraceDatabaseCreate@20
RtlTraceDatabaseDestroy@4
RtlTraceDatabaseEnumerate@12
RtlTraceDatabaseFind@16
RtlTraceDatabaseLock@4
RtlTraceDatabaseUnlock@4
RtlTraceDatabaseValidate@4
RtlTryAcquirePebLock@0
RtlTryAcquireSRWLockExclusive@4
RtlTryAcquireSRWLockShared@4
RtlTryConvertSRWLockSharedToExclusiveOrRelease@4
RtlTryEnterCriticalSection@4
RtlUTF8StringToUnicodeString@12
RtlUTF8ToUnicodeN@20
RtlUdiv128@28
RtlUnhandledExceptionFilter2@8
RtlUnhandledExceptionFilter@4
RtlUnicodeStringToAnsiSize@4
RtlUnicodeStringToAnsiString@12
RtlUnicodeStringToCountedOemString@12
RtlUnicodeStringToInteger@12
RtlUnicodeStringToOemSize@4
RtlUnicodeStringToOemString@12
RtlUnicodeStringToUTF8String@12
RtlUnicodeToCustomCPN@24
RtlUnicodeToMultiByteN@20
RtlUnicodeToMultiByteSize@12
RtlUnicodeToOemN@20
RtlUnicodeToUTF8N@20
RtlUniform@4
RtlUnlockBootStatusData@4
RtlUnlockCurrentThread@0
RtlUnlockHeap@4
RtlUnlockMemoryBlockLookaside@4
RtlUnlockMemoryStreamRegion@24
RtlUnlockMemoryZone@4
RtlUnlockModuleSection@4
RtlUnsubscribeWnfNotificationWaitForCompletion@4
RtlUnsubscribeWnfNotificationWithCompletionCallback@12
RtlUnsubscribeWnfStateChangeNotification@4
RtlUnwind@16
RtlUpcaseUnicodeChar@4
RtlUpcaseUnicodeString@12
RtlUpcaseUnicodeStringToAnsiString@12
RtlUpcaseUnicodeStringToCountedOemString@12
RtlUpcaseUnicodeStringToOemString@12
RtlUpcaseUnicodeToCustomCPN@24
RtlUpcaseUnicodeToMultiByteN@20
RtlUpcaseUnicodeToOemN@20
RtlUpdateClonedCriticalSection@4
RtlUpdateClonedSRWLock@8
RtlUpdateTimer@16
RtlUpperChar@4
RtlUpperString@8
RtlUsageHeap@12
; Not sure.
RtlUserThreadStart
RtlValidAcl@4
RtlValidProcessProtection@4
RtlValidRelativeSecurityDescriptor@12
RtlValidSecurityDescriptor@4
RtlValidSid@4
RtlValidateCorrelationVector@4
RtlValidateHeap@12
RtlValidateProcessHeaps@0
RtlValidateUnicodeString@8
RtlVerifyVersionInfo@16
RtlWaitForWnfMetaNotification@24
RtlWaitOnAddress@16
RtlWakeAddressAll@4
RtlWakeAddressAllNoFence@4
RtlWakeAddressSingle@4
RtlWakeAddressSingleNoFence@4
RtlWakeAllConditionVariable@4
RtlWakeConditionVariable@4
RtlWalkFrameChain@12
RtlWalkHeap@8
RtlWeaklyEnumerateEntryHashTable@8
RtlWerpReportException@16
RtlWnfCompareChangeStamp@8
RtlWnfDllUnloadCallback@4
RtlWow64CallFunction64@28
RtlWow64EnableFsRedirection@4
RtlWow64EnableFsRedirectionEx@8
RtlWow64GetCurrentMachine@0
RtlWow64GetEquivalentMachineCHPE@4
RtlWow64GetProcessMachines@12
RtlWow64GetSharedInfoProcess@12
RtlWow64IsWowGuestMachineSupported@8
RtlWow64LogMessageInEventLogger@12
RtlWriteMemoryStream@16
RtlWriteRegistryValue@24
RtlZeroHeap@8
RtlZeroMemory@8
RtlZombifyActivationContext@4
RtlpApplyLengthFunction@16
RtlpCheckDynamicTimeZoneInformation@8
RtlpCleanupRegistryKeys@0
RtlpConvertAbsoluteToRelativeSecurityAttribute@12
RtlpConvertCultureNamesToLCIDs@8
RtlpConvertLCIDsToCultureNames@8
RtlpConvertRelativeToAbsoluteSecurityAttribute@16
RtlpCreateProcessRegistryInfo@4
RtlpEnsureBufferSize@12
RtlpFreezeTimeBias@0
RtlpGetDeviceFamilyInfoEnum@12
RtlpGetLCIDFromLangInfoNode@12
RtlpGetNameFromLangInfoNode@12
RtlpGetSystemDefaultUILanguage@4 ; Check!!! gendef says @8
RtlpGetUserOrMachineUILanguage4NLS@12
RtlpInitializeLangRegistryInfo@4
RtlpIsQualifiedLanguage@12
RtlpLoadMachineUIByPolicy@12
RtlpLoadUserUIByPolicy@12
RtlpMergeSecurityAttributeInformation@16
RtlpMuiFreeLangRegistryInfo@4
RtlpMuiRegCreateRegistryInfo@0
RtlpMuiRegFreeRegistryInfo@8
RtlpMuiRegLoadRegistryInfo@8
RtlpNotOwnerCriticalSection@0 ; Check!!! gebdef says @4
RtlpNtCreateKey@24
RtlpNtEnumerateSubKey@16
RtlpNtMakeTemporaryKey@4
RtlpNtOpenKey@16
RtlpNtQueryValueKey@20
RtlpNtSetValueKey@16
RtlpQueryDefaultUILanguage@8
; Not sure.
RtlpQueryProcessDebugInformationRemote
RtlpRefreshCachedUILanguage@8
RtlpSetInstallLanguage@8
RtlpSetPreferredUILanguages@12
RtlpSetUserPreferredUILanguages@12
RtlpTimeFieldsToTime@12
RtlpTimeToTimeFields@12
RtlpUnWaitCriticalSection@4
RtlpVerifyAndCommitUILanguageSettings@4
RtlpWaitForCriticalSection@4
RtlxAnsiStringToUnicodeSize@4
RtlxOemStringToUnicodeSize@4
RtlxUnicodeStringToAnsiSize@4
RtlxUnicodeStringToOemSize@4
SbExecuteProcedure@20
SbSelectProcedure@16
ShipAssert@8
ShipAssertGetBufferInfo@8
ShipAssertMsgA@12
ShipAssertMsgW@12
TpAllocAlpcCompletion@20
TpAllocAlpcCompletionEx@20
TpAllocCleanupGroup@4
TpAllocIoCompletion@20
TpAllocJobNotification@20
TpAllocPool@8
TpAllocTimer@16
TpAllocWait@16
TpAllocWork@16
TpAlpcRegisterCompletionList@4
TpAlpcUnregisterCompletionList@4
TpCallbackDetectedUnrecoverableError@4
TpCallbackIndependent@4
TpCallbackLeaveCriticalSectionOnCompletion@8
TpCallbackMayRunLong@4
TpCallbackReleaseMutexOnCompletion@8
TpCallbackReleaseSemaphoreOnCompletion@12
TpCallbackSendAlpcMessageOnCompletion@16
TpCallbackSendPendingAlpcMessage@4
TpCallbackSetEventOnCompletion@8
TpCallbackUnloadDllOnCompletion@8
TpCancelAsyncIoOperation@4
TpCaptureCaller@4
TpCheckTerminateWorker@4
TpDbgDumpHeapUsage@12
TpDbgGetFreeInfo@8
TpDbgSetLogRoutine@4
TpDisablePoolCallbackChecks@4
TpDisassociateCallback@4
TpIsTimerSet@4
TpPoolFreeUnusedNodes@4
TpPostWork@4
TpQueryPoolStackInformation@8
TpReleaseAlpcCompletion@4
TpReleaseCleanupGroup@4
TpReleaseCleanupGroupMembers@12
TpReleaseIoCompletion@4
TpReleaseJobNotification@4
TpReleasePool@4
TpReleaseTimer@4
TpReleaseWait@4
TpReleaseWork@4
TpSetDefaultPoolMaxThreads@4
TpSetDefaultPoolStackInformation@4
TpSetPoolMaxThreads@8
TpSetPoolMaxThreadsSoftLimit@8
TpSetPoolMinThreads@8
TpSetPoolStackInformation@8
TpSetPoolThreadBasePriority@8
TpSetPoolThreadCpuSets@12
TpSetPoolWorkerThreadIdleTimeout@12
TpSetTimer@16
TpSetTimerEx@16
TpSetWait@12
TpSetWaitEx@16
TpSimpleTryPost@12
TpStartAsyncIoOperation@4
TpTimerOutstandingCallbackCount@4
TpTrimPools@0
TpWaitForAlpcCompletion@4
TpWaitForIoCompletion@8
TpWaitForJobNotification@4
TpWaitForTimer@8
TpWaitForWait@8
TpWaitForWork@8
VerSetConditionMask@16
WerCheckEventEscalation@8
WerReportExceptionWorker@4
WerReportSQMEvent@12
WerReportWatsonEvent@16
WerReportSQMEvent@16
WinSqmAddToAverageDWORD@12
WinSqmAddToStream@16
WinSqmAddToStreamEx@20
WinSqmCheckEscalationAddToStreamEx@20
WinSqmCheckEscalationSetDWORD64@20
WinSqmCheckEscalationSetDWORD@16
WinSqmCheckEscalationSetString@16
WinSqmCommonDatapointDelete@4
WinSqmCommonDatapointSetDWORD64@16
WinSqmCommonDatapointSetDWORD@12
WinSqmCommonDatapointSetStreamEx@20
WinSqmCommonDatapointSetString@12
WinSqmEndSession@4
WinSqmEventEnabled@8
WinSqmEventWrite@12
WinSqmGetEscalationRuleStatus@8
WinSqmGetInstrumentationProperty@16
WinSqmIncrementDWORD@12
WinSqmIsOptedIn@0
WinSqmIsOptedInEx@4
WinSqmIsSessionDisabled@4
WinSqmSetDWORD64@16
WinSqmSetDWORD@12
WinSqmSetEscalationInfo@16
WinSqmSetIfMaxDWORD@12
WinSqmSetIfMinDWORD@12
WinSqmSetString@12
WinSqmStartSession@12
WinSqmStartSessionForPartner@16
WinSqmStartSqmOptinListener@0
ZwAcceptConnectPort@24
ZwAccessCheck@32
ZwAccessCheckAndAuditAlarm@44
ZwAccessCheckByType@44
ZwAccessCheckByTypeAndAuditAlarm@64
ZwAccessCheckByTypeResultList@44
ZwAccessCheckByTypeResultListAndAuditAlarm@64
ZwAccessCheckByTypeResultListAndAuditAlarmByHandle@68
ZwAcquireCMFViewOwnership@12
ZwAcquireProcessActivityReference@12
ZwAddAtom@12
ZwAddAtomEx@16
ZwAddBootEntry@8
ZwAddDriverEntry@8
ZwAdjustGroupsToken@24
ZwAdjustPrivilegesToken@24
ZwAdjustTokenClaimsAndDeviceGroups@64
ZwAlertResumeThread@8
ZwAlertThread@4
ZwAlertThreadByThreadId@4
ZwAllocateLocallyUniqueId@4
ZwAllocateReserveObject@12
ZwAllocateUserPhysicalPages@12
ZwAllocateUserPhysicalPagesEx@20
ZwAllocateUuids@16
ZwAllocateVirtualMemory@24
ZwAllocateVirtualMemoryEx@28
ZwAlpcAcceptConnectPort@36
ZwAlpcCancelMessage@12
ZwAlpcConnectPort@44
ZwAlpcConnectPortEx@44
ZwAlpcCreatePort@12
ZwAlpcCreatePortSection@24
ZwAlpcCreateResourceReserve@16
ZwAlpcCreateSectionView@12
ZwAlpcCreateSecurityContext@12
ZwAlpcDeletePortSection@12
ZwAlpcDeleteResourceReserve@12
ZwAlpcDeleteSectionView@12
ZwAlpcDeleteSecurityContext@12
ZwAlpcDisconnectPort@8
ZwAlpcImpersonateClientContainerOfPort@12
ZwAlpcImpersonateClientOfPort@12
ZwAlpcOpenSenderProcess@24
ZwAlpcOpenSenderThread@24
ZwAlpcQueryInformation@20
ZwAlpcQueryInformationMessage@24
ZwAlpcRevokeSecurityContext@12
ZwAlpcSendWaitReceivePort@32
ZwAlpcSetInformation@16
ZwApphelpCacheControl@8
ZwAreMappedFilesTheSame@8
ZwAssignProcessToJobObject@8
ZwAssociateWaitCompletionPacket@32
ZwCallEnclave@16
ZwCallbackReturn@12
ZwCancelDeviceWakeupRequest@4
ZwCancelIoFile@8
ZwCancelIoFileEx@12
ZwCancelSynchronousIoFile@12
ZwCancelTimer2@8
ZwCancelTimer@8
ZwCancelWaitCompletionPacket@8
ZwClearEvent@4
ZwClose@4
ZwCloseObjectAuditAlarm@12
ZwCommitComplete@8
ZwCommitEnlistment@8
ZwCommitRegistryTransaction@8
ZwCommitTransaction@8
ZwCompactKeys@8
ZwCompareObjects@8
ZwCompareSigningLevels@8
ZwCompareTokens@12
ZwCompleteConnectPort@4
ZwCompressKey@4
ZwConnectPort@32
ZwContinue@8
ZwConvertBetweenAuxiliaryCounterAndPerformanceCounter@16
ZwCreateCrossVmEvent@24
ZwCreateDebugObject@16
ZwCreateDirectoryObject@12
ZwCreateDirectoryObjectEx@20
ZwCreateEnclave@36
ZwCreateEnlistment@32
ZwCreateEvent@20
ZwCreateEventPair@12
ZwCreateFile@44
ZwCreateIRTimer@12
ZwCreateIoCompletion@16
ZwCreateJobObject@12
ZwCreateJobSet@12
ZwCreateKey@28
ZwCreateKeyTransacted@32
ZwCreateKeyedEvent@16
ZwCreateLowBoxToken@36
ZwCreateMailslotFile@32
ZwCreateMutant@16
ZwCreateNamedPipeFile@56
ZwCreatePagingFile@16
ZwCreatePartition@16
ZwCreatePort@20
ZwCreatePrivateNamespace@16
ZwCreateProcess@32
ZwCreateProcessEx@36
ZwCreateProfile@36
ZwCreateProfileEx@40
ZwCreateRegistryTransaction@16
ZwCreateResourceManager@28
ZwCreateSection@28
ZwCreateSectionEx@36
ZwCreateSemaphore@20
ZwCreateSymbolicLinkObject@16
ZwCreateThread@32
ZwCreateThreadEx@44
ZwCreateTimer2@20
ZwCreateTimer@16
ZwCreateToken@52
ZwCreateTokenEx@68
ZwCreateTransaction@40
ZwCreateTransactionManager@24
ZwCreateUserProcess@44
ZwCreateWaitCompletionPacket@12
ZwCreateWaitablePort@20
ZwCreateWnfStateName@28
ZwCreateWorkerFactory@40
ZwDebugActiveProcess@8
ZwDebugContinue@12
ZwDelayExecution@8
ZwDeleteAtom@4
ZwDeleteBootEntry@4
ZwDeleteDriverEntry@4
ZwDeleteFile@4
ZwDeleteKey@4
ZwDeleteObjectAuditAlarm@12
ZwDeletePrivateNamespace@4
ZwDeleteValueKey@8
ZwDeleteWnfStateData@8
ZwDeleteWnfStateName@4
ZwDeviceIoControlFile@40
ZwDisableLastKnownGood@0
ZwDisplayString@4
ZwDrawText@4
ZwDuplicateObject@28
ZwDuplicateToken@24
ZwEnableLastKnownGood@0
ZwEnumerateBootEntries@8
ZwEnumerateDriverEntries@8
ZwEnumerateKey@24
ZwEnumerateSystemEnvironmentValuesEx@12
ZwEnumerateTransactionObject@20
ZwEnumerateValueKey@24
ZwExtendSection@8
ZwFilterBootOption@20
ZwFilterToken@24
ZwFilterTokenEx@56
ZwFindAtom@12
ZwFlushBuffersFile@8
ZwFlushBuffersFileEx@20
ZwFlushInstallUILanguage@8
ZwFlushInstructionCache@12
ZwFlushKey@4
ZwFlushProcessWriteBuffers@0
ZwFlushVirtualMemory@16
ZwFlushWriteBuffer@0
ZwFreeUserPhysicalPages@12
ZwFreeVirtualMemory@16
ZwFreezeRegistry@4
ZwFreezeTransactions@8
ZwFsControlFile@40
ZwGetCachedSigningLevel@24
ZwGetCompleteWnfStateSubscription@24
ZwGetContextThread@8
ZwGetCurrentProcessorNumber@0
ZwGetCurrentProcessorNumberEx@4
ZwGetDevicePowerState@8
ZwGetMUIRegistryInfo@12
ZwGetNextProcess@20
ZwGetNextThread@24
ZwGetNlsSectionPtr@20
ZwGetNotificationResourceManager@28
ZwGetPlugPlayEvent@16
ZwGetTickCount@0
ZwGetWriteWatch@28
ZwImpersonateAnonymousToken@4
ZwImpersonateClientOfPort@8
ZwImpersonateThread@12
ZwInitializeEnclave@20
ZwInitializeNlsFiles@16
ZwInitializeRegistry@4
ZwInitiatePowerAction@16
ZwIsProcessInJob@8
ZwIsSystemResumeAutomatic@0
ZwIsUILanguageComitted@0
ZwListenPort@8
ZwLoadDriver@4
ZwLoadEnclaveData@36
ZwLoadKey2@12
ZwLoadKey@8
ZwLoadKeyEx@32
ZwLockFile@40
ZwLockProductActivationKeys@8
ZwLockRegistryKey@4
ZwLockVirtualMemory@16
ZwMakePermanentObject@4
ZwMakeTemporaryObject@4
ZwManageHotPatch@16
ZwManagePartition@20
ZwMapCMFModule@24
ZwMapUserPhysicalPages@12
ZwMapUserPhysicalPagesScatter@12
ZwMapViewOfSection@40
ZwMapViewOfSectionEx@36
ZwModifyBootEntry@4
ZwModifyDriverEntry@4
ZwNotifyChangeDirectoryFile@36
ZwNotifyChangeDirectoryFileEx@40
ZwNotifyChangeKey@40
ZwNotifyChangeMultipleKeys@48
ZwNotifyChangeSession@32
ZwOpenDirectoryObject@12
ZwOpenEnlistment@20
ZwOpenEvent@12
ZwOpenEventPair@12
ZwOpenFile@24
ZwOpenIoCompletion@12
ZwOpenJobObject@12
ZwOpenKey@12
ZwOpenKeyEx@16
ZwOpenKeyTransacted@16
ZwOpenKeyTransactedEx@20
ZwOpenKeyedEvent@12
ZwOpenMutant@12
ZwOpenObjectAuditAlarm@48
ZwOpenPartition@12
ZwOpenPrivateNamespace@16
ZwOpenProcess@16
ZwOpenProcessToken@12
ZwOpenProcessTokenEx@16
ZwOpenRegistryTransaction@12
ZwOpenResourceManager@20
ZwOpenSection@12
ZwOpenSemaphore@12
ZwOpenSession@12
ZwOpenSymbolicLinkObject@12
ZwOpenThread@16
ZwOpenThreadToken@16
ZwOpenThreadTokenEx@20
ZwOpenTimer@12
ZwOpenTransaction@20
ZwOpenTransactionManager@24
ZwPlugPlayControl@12
ZwPowerInformation@20
ZwPrePrepareComplete@8
ZwPrePrepareEnlistment@8
ZwPrepareComplete@8
ZwPrepareEnlistment@8
ZwPrivilegeCheck@12
ZwPrivilegeObjectAuditAlarm@24
ZwPrivilegedServiceAuditAlarm@20
ZwPropagationComplete@16
ZwPropagationFailed@12
ZwProtectVirtualMemory@20
ZwPssCaptureVaSpaceBulk@20
ZwPulseEvent@8
ZwQueryAttributesFile@8
ZwQueryAuxiliaryCounterFrequency@4
ZwQueryBootEntryOrder@8
ZwQueryBootOptions@8
ZwQueryDebugFilterState@8
ZwQueryDefaultLocale@8
ZwQueryDefaultUILanguage@4
ZwQueryDirectoryFile@44
ZwQueryDirectoryFileEx@40
ZwQueryDirectoryObject@28
ZwQueryDriverEntryOrder@8
ZwQueryEaFile@36
ZwQueryEvent@20
ZwQueryFullAttributesFile@8
ZwQueryInformationAtom@20
ZwQueryInformationByName@20
ZwQueryInformationEnlistment@20
ZwQueryInformationFile@20
ZwQueryInformationJobObject@20
ZwQueryInformationPort@20
ZwQueryInformationProcess@20
ZwQueryInformationResourceManager@20
ZwQueryInformationThread@20
ZwQueryInformationToken@20
ZwQueryInformationTransaction@20
ZwQueryInformationTransactionManager@20
ZwQueryInformationWorkerFactory@20
ZwQueryInstallUILanguage@4
ZwQueryIntervalProfile@8
ZwQueryIoCompletion@20
ZwQueryKey@20
ZwQueryLicenseValue@20
ZwQueryMultipleValueKey@24
ZwQueryMutant@20
ZwQueryObject@20
ZwQueryOpenSubKeys@8
ZwQueryOpenSubKeysEx@16
ZwQueryPerformanceCounter@8
ZwQueryPortInformationProcess@0
ZwQueryQuotaInformationFile@36
ZwQuerySection@20
ZwQuerySecurityAttributesToken@24
ZwQuerySecurityObject@20
ZwQuerySecurityPolicy@24
ZwQuerySemaphore@20
ZwQuerySymbolicLinkObject@12
ZwQuerySystemEnvironmentValue@16
ZwQuerySystemEnvironmentValueEx@20
ZwQuerySystemInformation@16
ZwQuerySystemInformationEx@24
ZwQuerySystemTime@4
ZwQueryTimer@20
ZwQueryTimerResolution@12
ZwQueryValueKey@24
ZwQueryVirtualMemory@24
ZwQueryVolumeInformationFile@20
ZwQueryWnfStateData@24
ZwQueryWnfStateNameInformation@20
ZwQueueApcThread@20
ZwQueueApcThreadEx@24
ZwRaiseException@12
ZwRaiseHardError@24
ZwReadFile@36
ZwReadFileScatter@36
ZwReadOnlyEnlistment@8
ZwReadRequestData@24
ZwReadVirtualMemory@20
ZwRecoverEnlistment@8
ZwRecoverResourceManager@4
ZwRecoverTransactionManager@4
ZwRegisterProtocolAddressInformation@20
ZwRegisterThreadTerminatePort@4
ZwReleaseCMFViewOwnership@0
ZwReleaseKeyedEvent@16
ZwReleaseMutant@8
ZwReleaseSemaphore@12
ZwReleaseWorkerFactoryWorker@4
ZwRemoveIoCompletion@20
ZwRemoveIoCompletionEx@24
ZwRemoveProcessDebug@8
ZwRenameKey@8
ZwRenameTransactionManager@8
ZwReplaceKey@12
ZwReplacePartitionUnit@12
ZwReplyPort@8
ZwReplyWaitReceivePort@16
ZwReplyWaitReceivePortEx@20
ZwReplyWaitReplyPort@8
ZwRequestDeviceWakeup@4
ZwRequestPort@8
ZwRequestWaitReplyPort@12
ZwRequestWakeupLatency@4
ZwResetEvent@8
ZwResetWriteWatch@12
ZwRestoreKey@12
ZwResumeProcess@4
ZwResumeThread@8
ZwRevertContainerImpersonation@0
ZwRollbackComplete@8
ZwRollbackEnlistment@8
ZwRollbackRegistryTransaction@8
ZwRollbackTransaction@8
ZwRollforwardTransactionManager@8
ZwSaveKey@8
ZwSaveKeyEx@12
ZwSaveMergedKeys@12
ZwSecureConnectPort@36
ZwSerializeBoot@0
ZwSetBootEntryOrder@8
ZwSetBootOptions@8
ZwSetCachedSigningLevel2@24
ZwSetCachedSigningLevel@20
ZwSetContextThread@8
ZwSetDebugFilterState@12
ZwSetDefaultHardErrorPort@4
ZwSetDefaultLocale@8
ZwSetDefaultUILanguage@4
ZwSetDriverEntryOrder@8
ZwSetEaFile@16
ZwSetEvent@8
ZwSetEventBoostPriority@4
ZwSetHighEventPair@4
ZwSetHighWaitLowEventPair@4
ZwSetIRTimer@8
ZwSetInformationDebugObject@20
ZwSetInformationEnlistment@16
ZwSetInformationFile@20
ZwSetInformationJobObject@16
ZwSetInformationKey@16
ZwSetInformationObject@16
ZwSetInformationProcess@16
ZwSetInformationResourceManager@16
ZwSetInformationSymbolicLink@16
ZwSetInformationThread@16
ZwSetInformationToken@16
ZwSetInformationTransaction@16
ZwSetInformationTransactionManager@16
ZwSetInformationVirtualMemory@24
ZwSetInformationWorkerFactory@16
ZwSetIntervalProfile@8
ZwSetIoCompletion@20
ZwSetIoCompletionEx@24
ZwSetLdtEntries@24
ZwSetLowEventPair@4
ZwSetLowWaitHighEventPair@4
ZwSetQuotaInformationFile@16
ZwSetSecurityObject@12
ZwSetSystemEnvironmentValue@8
ZwSetSystemEnvironmentValueEx@20
ZwSetSystemInformation@12
ZwSetSystemPowerState@12
ZwSetSystemTime@8
ZwSetThreadExecutionState@8
ZwSetTimer2@16
ZwSetTimer@28
ZwSetTimerEx@16
ZwSetTimerResolution@12
ZwSetUuidSeed@4
ZwSetValueKey@24
ZwSetVolumeInformationFile@20
ZwSetWnfProcessNotificationEvent@4
ZwShutdownSystem@4
ZwShutdownWorkerFactory@8
ZwSignalAndWaitForSingleObject@16
ZwSinglePhaseReject@8
ZwStartProfile@4
ZwStopProfile@4
ZwSubscribeWnfStateChange@16
ZwSuspendProcess@4
ZwSuspendThread@8
ZwSystemDebugControl@24
ZwTerminateEnclave@8
ZwTerminateJobObject@8
ZwTerminateProcess@8
ZwTerminateThread@8
ZwTestAlert@0
ZwThawRegistry@0
ZwThawTransactions@0
ZwTraceControl@24
ZwTraceEvent@16
ZwTranslateFilePath@16
ZwUmsThreadYield@4
ZwUnloadDriver@4
ZwUnloadKey2@8
ZwUnloadKey@4
ZwUnloadKeyEx@8
ZwUnlockFile@20
ZwUnlockVirtualMemory@16
ZwUnmapViewOfSection@8
ZwUnmapViewOfSectionEx@12
ZwUnsubscribeWnfStateChange@4
ZwUpdateWnfStateData@28
ZwVdmControl@8
ZwWaitForAlertByThreadId@8
ZwWaitForDebugEvent@16
ZwWaitForKeyedEvent@16
ZwWaitForMultipleObjects32@20
ZwWaitForMultipleObjects@20
ZwWaitForSingleObject@12
ZwWaitForWorkViaWorkerFactory@8
ZwWaitHighEventPair@4
ZwWaitLowEventPair@4
ZwWorkerFactoryWorkerReady@4
ZwWow64CallFunction64@28
ZwWow64CsrAllocateCaptureBuffer@8
ZwWow64CsrAllocateMessagePointer@12
ZwWow64CsrCaptureMessageBuffer@16
ZwWow64CsrCaptureMessageString@20
ZwWow64CsrClientCallServer@16
ZwWow64CsrClientConnectToServer@20
ZwWow64CsrFreeCaptureBuffer@4
ZwWow64CsrGetProcessId@0
ZwWow64CsrIdentifyAlertableThread@0
ZwWow64CsrVerifyRegion@8
ZwWow64DebuggerCall@20
ZwWow64GetCurrentProcessorNumberEx@4
ZwWow64GetNativeSystemInformation@16
ZwWow64InterlockedPopEntrySList@4
ZwWow64QueryInformationProcess64@20
ZwWow64QueryVirtualMemory64@32
ZwWow64ReadVirtualMemory64@28
ZwWow64WriteVirtualMemory64@28
ZwWriteFile@36
ZwWriteFileGather@36
ZwWriteRequestData@24
ZwWriteVirtualMemory@20
ZwYieldExecution@0
vDbgPrintEx@16
vDbgPrintExWithPrefix@20