master
1;
2; Definition file of ntdll.dll
3; Automatic generated by gendef
4; written by Kai Tietz 2008
5;
6LIBRARY "ntdll.dll"
7EXPORTS
8RtlDispatchAPC@12
9RtlActivateActivationContextUnsafeFast@0
10RtlDeactivateActivationContextUnsafeFast@0
11RtlInterlockedPushListSList@8
12@RtlUlongByteSwap@4
13@RtlUlonglongByteSwap@8
14@RtlUshortByteSwap@4
15ExpInterlockedPopEntrySListEnd@0
16ExpInterlockedPopEntrySListFault@0
17ExpInterlockedPopEntrySListResume@0
18RtlpInterlockedPopEntrySeqSListEnd@0
19RtlpInterlockedPopEntrySeqSListFault@0
20RtlpInterlockedPopEntrySeqSListResume@0
21A_SHAFinal@8
22A_SHAInit@4
23A_SHAUpdate@12
24AlpcAdjustCompletionListConcurrencyCount@8
25AlpcFreeCompletionListMessage@8
26AlpcGetCompletionListLastMessageInformation@12
27AlpcGetCompletionListMessageAttributes@8
28AlpcGetHeaderSize@4
29AlpcGetMessageAttribute@8
30AlpcGetMessageFromCompletionList@8
31AlpcGetOutstandingCompletionListMessageCount@4
32AlpcInitializeMessageAttribute@16
33AlpcMaxAllowedMessageLength@0
34AlpcRegisterCompletionList@20
35AlpcRegisterCompletionListWorkerThread@4
36AlpcRundownCompletionList@4
37AlpcUnregisterCompletionList@4
38AlpcUnregisterCompletionListWorkerThread@4
39ApiSetQueryApiSetPresence@8
40ApiSetQueryApiSetPresenceEx@12
41CsrAllocateCaptureBuffer@8
42CsrAllocateMessagePointer@12
43CsrCaptureMessageBuffer@16
44CsrCaptureMessageMultiUnicodeStringsInPlace@12
45CsrCaptureMessageString@20
46CsrCaptureTimeout@8
47CsrClientCallServer@16
48CsrClientConnectToServer@20
49CsrFreeCaptureBuffer@4
50CsrGetProcessId@0
51CsrIdentifyAlertableThread@0
52CsrNewThread@0
53CsrProbeForRead@12
54CsrProbeForWrite@12
55CsrSetPriorityClass@8
56CsrVerifyRegion@8
57DbgBreakPoint@0
58DbgPrint
59DbgPrintEx
60DbgPrintReturnControlC
61DbgPrompt@12
62DbgQueryDebugFilterState@8
63DbgSetDebugFilterState@12
64DbgSsHandleKmApiMsg@8
65DbgSsInitialize@16
66DbgUiConnectToDbg@0
67DbgUiContinue@8
68DbgUiConvertStateChangeStructure@8
69DbgUiConvertStateChangeStructureEx@8
70DbgUiDebugActiveProcess@4
71DbgUiGetThreadDebugObject@0
72DbgUiIssueRemoteBreakin@4
73DbgUiRemoteBreakin@4
74DbgUiSetThreadDebugObject@4
75DbgUiStopDebugging@4
76DbgUiWaitStateChange@8
77DbgUserBreakPoint@0
78EtwCheckCoverage@4
79EtwCreateTraceInstanceId@8
80EtwDeliverDataBlock@4
81EtwEnumerateProcessRegGuids@12
82EtwEventActivityIdControl@8
83EtwEventEnabled@12
84EtwEventProviderEnabled@20
85EtwEventRegister@16
86EtwEventSetInformation@20
87EtwEventUnregister@8
88EtwEventWrite@20
89EtwEventWriteEndScenario@20
90EtwEventWriteEx@40
91EtwEventWriteFull@32
92EtwEventWriteNoRegistration@16
93EtwEventWriteStartScenario@20
94EtwEventWriteString@24
95EtwEventWriteTransfer@28
96EtwGetTraceEnableFlags@8
97EtwGetTraceEnableLevel@8
98EtwGetTraceLoggerHandle@4
99EtwLogTraceEvent@12
100EtwNotificationRegister@20
101EtwNotificationUnregister@12
102EtwProcessPrivateLoggerRequest@4
103EtwRegisterSecurityProvider@0
104EtwRegisterTraceGuidsA@32
105EtwRegisterTraceGuidsW@32
106EtwReplyNotification@4
107EtwSendNotification@20
108EtwSetMark@16
109EtwTraceEventInstance@20
110EtwTraceMessage
111EtwTraceMessageVa@24
112EtwUnregisterTraceGuids@8
113EtwWriteUMSecurityEvent@16
114EtwpCreateEtwThread@8
115EtwpGetCpuSpeed@8
116;EtwpNotificationThread
117EvtIntReportAuthzEventAndSourceAsync@44
118EvtIntReportEventAndSourceAsync@44
119KiFastSystemCall@0
120KiFastSystemCallRet@0
121KiIntSystemCall@0
122KiRaiseUserExceptionDispatcher@0
123KiUserApcDispatcher@20
124KiUserCallbackDispatcher@12
125KiUserExceptionDispatcher@8
126LdrAccessResource@16
127LdrAddDllDirectory@8
128LdrAddLoadAsDataTable@16; Check!!! gendef says @20
129LdrAddRefDll@8
130LdrAlternateResourcesEnabled@0
131LdrAppxHandleIntegrityFailure@4
132LdrCallEnclave@12
133LdrControlFlowGuardEnforced@0
134LdrCreateEnclave@36
135LdrDeleteEnclave@4
136LdrDisableThreadCalloutsForDll@4
137LdrEnumResources@20
138LdrEnumerateLoadedModules@12
139LdrFastFailInLoaderCallout@0
140LdrFindEntryForAddress@8
141LdrFindResourceDirectory_U@16
142LdrFindResourceEx_U@20
143LdrFindResource_U@16
144LdrFlushAlternateResourceModules@0
145LdrGetDllDirectory@4
146LdrGetDllFullName@8
147LdrGetDllHandle@16
148LdrGetDllHandleByMapping@8
149LdrGetDllHandleByName@12
150LdrGetDllHandleEx@20
151LdrGetDllPath@16
152LdrGetFailureData@0
153LdrGetFileNameFromLoadAsDataTable@8
154LdrGetProcedureAddress@16
155LdrGetProcedureAddressEx@20
156LdrGetProcedureAddressForCaller@24
157LdrHotPatchRoutine@0
158LdrInitShimEngineDynamic@4
159LdrInitializeEnclave@20
160LdrInitializeThunk@16
161LdrIsModuleSxsRedirected@4
162LdrLoadAlternateResourceModule@16
163LdrLoadAlternateResourceModuleEx@20
164LdrLoadDll@16
165LdrLoadEnclaveModule@12
166LdrLockLoaderLock@12
167LdrOpenImageFileOptionsKey@12
168LdrParentInterlockedPopEntrySList@0
169LdrParentRtlInitializeNtUserPfn@0
170LdrParentRtlResetNtUserPfn@0
171LdrParentRtlRetrieveNtUserPfn@0
172LdrProcessRelocationBlock@16
173LdrProcessRelocationBlockEx@20
174LdrQueryImageFileExecutionOptions@24
175LdrQueryImageFileExecutionOptionsEx@28
176LdrQueryImageFileKeyOption@24
177LdrQueryModuleServiceTags@12
178LdrQueryOptionalDelayLoadedAPI@16
179LdrQueryProcessModuleInformation@12
180LdrRegisterDllNotification@16
181LdrRemoveDllDirectory@4
182LdrRemoveLoadAsDataTable@16
183LdrResFindResource@36
184LdrResFindResourceDirectory@28
185LdrResGetRCConfig@20
186LdrResRelease@12
187LdrResSearchResource@32
188LdrResolveDelayLoadedAPI@24
189LdrResolveDelayLoadsFromDll@12
190LdrRscIsTypeExist@16
191LdrSetAppCompatDllRedirectionCallback@12
192LdrSetDefaultDllDirectories@4
193LdrSetDllDirectory@4
194LdrSetDllManifestProber@4
195LdrSetImplicitPathOptions@8
196LdrSetMUICacheType@4
197LdrShutdownProcess@0
198LdrShutdownThread@0
199LdrStandardizeSystemPath@4
200LdrSystemDllInitBlock@0
201LdrUnloadAlternateResourceModule@4
202LdrUnloadAlternateResourceModuleEx@8
203LdrUnloadDll@4
204LdrUnlockLoaderLock@8
205LdrUnregisterDllNotification@4
206LdrUpdatePackageSearchPath@4
207LdrVerifyImageMatchesChecksum@16
208LdrVerifyImageMatchesChecksumEx@8
209LdrpChildNtdll@0
210LdrpResGetMappingSize@16
211LdrpResGetRCConfig@20
212LdrpResGetResourceDirectory@20
213LdrWx86FormatVirtualImage@12
214MD4Final@4
215MD4Init@4
216MD4Update@12
217MD5Final@4
218MD5Init@4
219MD5Update@12
220NlsAnsiCodePage DATA
221NlsMbCodePageTag DATA
222NlsMbOemCodePageTag DATA
223NtAcceptConnectPort@24
224NtAccessCheck@32
225NtAccessCheckAndAuditAlarm@44
226NtAccessCheckByType@44
227NtAccessCheckByTypeAndAuditAlarm@64
228NtAccessCheckByTypeResultList@44
229NtAccessCheckByTypeResultListAndAuditAlarm@64
230NtAccessCheckByTypeResultListAndAuditAlarmByHandle@68
231NtAcquireCrossVmMutant@8
232NtAcquireProcessActivityReference@12
233NtAcquireCMFViewOwnership@12
234NtAddAtom@12
235NtAddAtomEx@16
236NtAddBootEntry@8
237NtAddDriverEntry@8
238NtAdjustGroupsToken@24
239NtAdjustPrivilegesToken@24
240NtAdjustTokenClaimsAndDeviceGroups@64
241NtAlertResumeThread@8
242NtAlertThread@4
243NtAlertThreadByThreadId@4
244NtAllocateLocallyUniqueId@4
245NtAllocateReserveObject@12
246NtAllocateUserPhysicalPages@12
247NtAllocateUserPhysicalPagesEx@20
248NtAllocateUuids@16
249NtAllocateVirtualMemory@24
250NtAllocateVirtualMemoryEx@28
251NtAlpcAcceptConnectPort@36
252NtAlpcCancelMessage@12
253NtAlpcConnectPort@44
254NtAlpcConnectPortEx@44
255NtAlpcCreatePort@12
256NtAlpcCreatePortSection@24
257NtAlpcCreateResourceReserve@16
258NtAlpcCreateSectionView@12
259NtAlpcCreateSecurityContext@12
260NtAlpcDeletePortSection@12
261NtAlpcDeleteResourceReserve@12
262NtAlpcDeleteSectionView@12
263NtAlpcDeleteSecurityContext@12
264NtAlpcDisconnectPort@8
265NtAlpcImpersonateClientContainerOfPort@12
266NtAlpcImpersonateClientOfPort@12
267NtAlpcOpenSenderProcess@24
268NtAlpcOpenSenderThread@24
269NtAlpcQueryInformation@20
270NtAlpcQueryInformationMessage@24
271NtAlpcRevokeSecurityContext@12
272NtAlpcSendWaitReceivePort@32
273NtAlpcSetInformation@16
274NtApphelpCacheControl@8
275NtAreMappedFilesTheSame@8
276NtAssignProcessToJobObject@8
277NtAssociateWaitCompletionPacket@32
278NtCallEnclave@16
279NtCallbackReturn@12
280NtCancelDeviceWakeupRequest@4
281NtCancelIoFile@8
282NtCancelIoFileEx@12
283NtCancelSynchronousIoFile@12
284NtCancelTimer2@8
285NtCancelTimer@8
286NtCancelWaitCompletionPacket@8
287NtChangeProcessState@24
288NtChangeThreadState@24
289NtClearEvent@4
290NtClose@4
291NtCloseObjectAuditAlarm@12
292NtCommitComplete@8
293NtCommitEnlistment@8
294NtCommitRegistryTransaction@8
295NtCommitTransaction@8
296NtCompactKeys@8
297NtCompareObjects@8
298NtCompareSigningLevels@8
299NtCompareTokens@12
300NtCompleteConnectPort@4
301NtCompressKey@4
302NtConnectPort@32
303NtContinue@8
304NtContinueEx@8
305NtConvertBetweenAuxiliaryCounterAndPerformanceCounter@16
306NtCreateCrossVmEvent@24
307NtCreateCrossVmMutant@24
308NtCreateDebugObject@16
309NtCreateDirectoryObject@12
310NtCreateDirectoryObjectEx@20
311NtCreateEnclave@36
312NtCreateEnlistment@32
313NtCreateEvent@20
314NtCreateEventPair@12
315NtCreateFile@44
316NtCreateIRTimer@12
317NtCreateIoCompletion@16
318NtCreateIoRing@20
319NtCreateJobObject@12
320NtCreateJobSet@12
321NtCreateKey@28
322NtCreateKeyTransacted@32
323NtCreateKeyedEvent@16
324NtCreateLowBoxToken@36
325NtCreateMailslotFile@32
326NtCreateMutant@16
327NtCreateNamedPipeFile@56
328NtCreatePagingFile@16
329NtCreatePartition@16
330NtCreatePort@20
331NtCreatePrivateNamespace@16
332NtCreateProcess@32
333NtCreateProcessEx@36
334NtCreateProcessStateChange@20
335NtCreateProfile@36
336NtCreateProfileEx@40
337NtCreateRegistryTransaction@16
338NtCreateResourceManager@28
339NtCreateSection@28
340NtCreateSectionEx@36
341NtCreateSemaphore@20
342NtCreateSymbolicLinkObject@16
343NtCreateThread@32
344NtCreateThreadEx@44
345NtCreateThreadStateChange@20
346NtCreateTimer2@20
347NtCreateTimer@16
348NtCreateToken@52
349NtCreateTokenEx@68
350NtCreateTransaction@40
351NtCreateTransactionManager@24
352NtCreateUserProcess@44
353NtCreateWaitCompletionPacket@12
354NtCreateWaitablePort@20
355NtCreateWnfStateName@28
356NtCreateWorkerFactory@40
357NtCurrentTeb@0
358NtDebugActiveProcess@8
359NtDebugContinue@12
360NtDelayExecution@8
361NtDeleteAtom@4
362NtDeleteBootEntry@4
363NtDeleteDriverEntry@4
364NtDeleteFile@4
365NtDeleteKey@4
366NtDeleteObjectAuditAlarm@12
367NtDeletePrivateNamespace@4
368NtDeleteValueKey@8
369NtDeleteWnfStateData@8
370NtDeleteWnfStateName@4
371NtDeviceIoControlFile@40
372NtDirectGraphicsCall@20
373NtDisableLastKnownGood@0
374NtDisplayString@4
375NtDrawText@4
376NtDuplicateObject@28
377NtDuplicateToken@24
378NtEnableLastKnownGood@0
379NtEnumerateBootEntries@8
380NtEnumerateDriverEntries@8
381NtEnumerateKey@24
382NtEnumerateSystemEnvironmentValuesEx@12
383NtEnumerateTransactionObject@20
384NtEnumerateValueKey@24
385NtExtendSection@8
386NtFilterBootOption@20
387NtFilterToken@24
388NtFilterTokenEx@56
389NtFindAtom@12
390NtFlushBuffersFile@8
391NtFlushBuffersFileEx@20
392NtFlushInstallUILanguage@8
393NtFlushInstructionCache@12
394NtFlushKey@4
395NtFlushProcessWriteBuffers@0
396NtFlushVirtualMemory@16
397NtFlushWriteBuffer@0
398NtFreeUserPhysicalPages@12
399NtFreeVirtualMemory@16
400NtFreezeRegistry@4
401NtFreezeTransactions@8
402NtFsControlFile@40
403NtGetCachedSigningLevel@24
404NtGetCompleteWnfStateSubscription@24
405NtGetContextThread@8
406NtGetCurrentProcessorNumber@0
407NtGetCurrentProcessorNumberEx@4
408NtGetDevicePowerState@8
409NtGetMUIRegistryInfo@12
410NtGetNextProcess@20
411NtGetNextThread@24
412NtGetNlsSectionPtr@20
413NtGetNotificationResourceManager@28
414NtGetPlugPlayEvent@16
415NtGetTickCount@0
416NtGetWriteWatch@28
417NtImpersonateAnonymousToken@4
418NtImpersonateClientOfPort@8
419NtImpersonateThread@12
420NtInitializeEnclave@20
421NtInitializeNlsFiles@16 ;Check!!! gendef says 12
422NtInitializeRegistry@4
423NtInitiatePowerAction@16
424NtIsProcessInJob@8
425NtIsSystemResumeAutomatic@0
426NtIsUILanguageComitted@0
427NtListenPort@8
428NtLoadDriver@4
429NtLoadEnclaveData@36
430NtLoadKey2@12
431NtLoadKey3@32
432NtLoadKey@8
433NtLoadKeyEx@32
434NtLockFile@40
435NtLockProductActivationKeys@8
436NtLockRegistryKey@4
437NtLockVirtualMemory@16
438NtMakePermanentObject@4
439NtMakeTemporaryObject@4
440NtManageHotPatch@16
441NtManagePartition@20
442NtMapCMFModule@24
443NtMapUserPhysicalPages@12
444NtMapUserPhysicalPagesScatter@12
445NtMapViewOfSection@40
446NtMapViewOfSectionEx@36
447NtModifyBootEntry@4
448NtModifyDriverEntry@4
449NtNotifyChangeDirectoryFile@36
450NtNotifyChangeDirectoryFileEx@40
451NtNotifyChangeKey@40
452NtNotifyChangeMultipleKeys@48
453NtNotifyChangeSession@32
454NtOpenDirectoryObject@12
455NtOpenEnlistment@20
456NtOpenEvent@12
457NtOpenEventPair@12
458NtOpenFile@24
459NtOpenIoCompletion@12
460NtOpenJobObject@12
461NtOpenKey@12
462NtOpenKeyEx@16
463NtOpenKeyTransacted@16
464NtOpenKeyTransactedEx@20
465NtOpenKeyedEvent@12
466NtOpenMutant@12
467NtOpenObjectAuditAlarm@48
468NtOpenPartition@12
469NtOpenPrivateNamespace@16
470NtOpenProcess@16
471NtOpenProcessToken@12
472NtOpenProcessTokenEx@16
473NtOpenRegistryTransaction@12
474NtOpenResourceManager@20
475NtOpenSection@12
476NtOpenSemaphore@12
477NtOpenSession@12
478NtOpenSymbolicLinkObject@12
479NtOpenThread@16
480NtOpenThreadToken@16
481NtOpenThreadTokenEx@20
482NtOpenTimer@12
483NtOpenTransaction@20
484NtOpenTransactionManager@24
485NtPlugPlayControl@12
486NtPowerInformation@20
487NtPrePrepareComplete@8
488NtPrePrepareEnlistment@8
489NtPrepareComplete@8
490NtPrepareEnlistment@8
491NtPrivilegeCheck@12
492NtPrivilegeObjectAuditAlarm@24
493NtPrivilegedServiceAuditAlarm@20
494NtPropagationComplete@16
495NtPropagationFailed@12
496NtProtectVirtualMemory@20
497NtPssCaptureVaSpaceBulk@20
498NtPulseEvent@8
499NtQueryAttributesFile@8
500NtQueryAuxiliaryCounterFrequency@4
501NtQueryBootEntryOrder@8
502NtQueryBootOptions@8
503NtQueryDebugFilterState@8
504NtQueryDefaultLocale@8
505NtQueryDefaultUILanguage@4
506NtQueryDirectoryFile@44
507NtQueryDirectoryFileEx@40
508NtQueryDirectoryObject@28
509NtQueryDriverEntryOrder@8
510NtQueryEaFile@36
511NtQueryEvent@20
512NtQueryFullAttributesFile@8
513NtQueryInformationAtom@20
514NtQueryInformationByName@20
515NtQueryInformationEnlistment@20
516NtQueryInformationFile@20
517NtQueryInformationJobObject@20
518NtQueryInformationPort@20
519NtQueryInformationProcess@20
520NtQueryInformationResourceManager@20
521NtQueryInformationThread@20
522NtQueryInformationToken@20
523NtQueryInformationTransaction@20
524NtQueryInformationTransactionManager@20
525NtQueryInformationWorkerFactory@20
526NtQueryInstallUILanguage@4
527NtQueryIntervalProfile@8
528NtQueryIoCompletion@20
529NtQueryIoRingCapabilities@8
530NtQueryKey@20
531NtQueryLicenseValue@20
532NtQueryMultipleValueKey@24
533NtQueryMutant@20
534NtQueryObject@20
535NtQueryOpenSubKeys@8
536NtQueryOpenSubKeysEx@16
537NtQueryPerformanceCounter@8
538NtQueryPortInformationProcess@0
539NtQueryQuotaInformationFile@36
540NtQuerySection@20
541NtQuerySecurityAttributesToken@24
542NtQuerySecurityObject@20
543NtQuerySecurityPolicy@24
544NtQuerySemaphore@20
545NtQuerySymbolicLinkObject@12
546NtQuerySystemEnvironmentValue@16
547NtQuerySystemEnvironmentValueEx@20
548NtQuerySystemInformation@16
549NtQuerySystemInformationEx@24
550NtQuerySystemTime@4
551NtQueryTimer@20
552NtQueryTimerResolution@12
553NtQueryValueKey@24
554NtQueryVirtualMemory@24
555NtQueryVolumeInformationFile@20
556NtQueryWnfStateData@24
557NtQueryWnfStateNameInformation@20
558NtQueueApcThread@20
559NtQueueApcThreadEx2@28
560NtQueueApcThreadEx@24
561NtRaiseException@12
562NtRaiseHardError@24
563NtReadFile@36
564NtReadFileScatter@36
565NtReadOnlyEnlistment@8
566NtReadRequestData@24
567NtReadVirtualMemory@20
568NtReadVirtualMemoryEx@24
569NtRecoverEnlistment@8
570NtRecoverResourceManager@4
571NtRecoverTransactionManager@4
572NtRegisterProtocolAddressInformation@20
573NtRegisterThreadTerminatePort@4
574NtReleaseCMFViewOwnership@0
575NtReleaseKeyedEvent@16
576NtReleaseMutant@8
577NtReleaseSemaphore@12
578NtReleaseWorkerFactoryWorker@4
579NtRemoveIoCompletion@20
580NtRemoveIoCompletionEx@24
581NtRemoveProcessDebug@8
582NtRenameKey@8
583NtRenameTransactionManager@8
584NtReplaceKey@12
585NtReplacePartitionUnit@12
586NtReplyPort@8
587NtReplyWaitReceivePort@16
588NtReplyWaitReceivePortEx@20
589NtReplyWaitReplyPort@8
590NtRequestDeviceWakeup@4
591NtRequestPort@8
592NtRequestWaitReplyPort@12
593NtRequestWakeupLatency@4
594NtResetEvent@8
595NtResetWriteWatch@12
596NtRestoreKey@12
597NtResumeProcess@4
598NtResumeThread@8
599NtRevertContainerImpersonation@0
600NtRollbackComplete@8
601NtRollbackEnlistment@8
602NtRollbackRegistryTransaction@8
603NtRollbackTransaction@8
604NtRollforwardTransactionManager@8
605NtSaveKey@8
606NtSaveKeyEx@12
607NtSaveMergedKeys@12
608NtSecureConnectPort@36
609NtSerializeBoot@0
610NtSetBootEntryOrder@8
611NtSetBootOptions@8
612NtSetCachedSigningLevel2@24
613NtSetCachedSigningLevel@20
614NtSetContextThread@8
615NtSetDebugFilterState@12
616NtSetDefaultHardErrorPort@4
617NtSetDefaultLocale@8
618NtSetDefaultUILanguage@4
619NtSetDriverEntryOrder@8
620NtSetEaFile@16
621NtSetEvent@8
622NtSetEventBoostPriority@4
623NtSetHighEventPair@4
624NtSetHighWaitLowEventPair@4
625NtSetIRTimer@8
626NtSetInformationDebugObject@20
627NtSetInformationEnlistment@16
628NtSetInformationFile@20
629NtSetInformationIoRing@16
630NtSetInformationJobObject@16
631NtSetInformationKey@16
632NtSetInformationObject@16
633NtSetInformationProcess@16
634NtSetInformationResourceManager@16
635NtSetInformationSymbolicLink@16
636NtSetInformationThread@16
637NtSetInformationToken@16
638NtSetInformationTransaction@16
639NtSetInformationTransactionManager@16
640NtSetInformationVirtualMemory@24
641NtSetInformationWorkerFactory@16
642NtSetIntervalProfile@8
643NtSetIoCompletion@20
644NtSetIoCompletionEx@24
645NtSetLdtEntries@24
646NtSetLowEventPair@4
647NtSetLowWaitHighEventPair@4
648NtSetQuotaInformationFile@16
649NtSetSecurityObject@12
650NtSetSystemEnvironmentValue@8
651NtSetSystemEnvironmentValueEx@20
652NtSetSystemInformation@12
653NtSetSystemPowerState@12
654NtSetSystemTime@8
655NtSetThreadExecutionState@8
656NtSetTimer2@16
657NtSetTimer@28
658NtSetTimerEx@16
659NtSetTimerResolution@12
660NtSetUuidSeed@4
661NtSetValueKey@24
662NtSetVolumeInformationFile@20
663NtSetWnfProcessNotificationEvent@4
664NtShutdownSystem@4
665NtShutdownWorkerFactory@8
666NtSignalAndWaitForSingleObject@16
667NtSinglePhaseReject@8
668NtStartProfile@4
669NtStopProfile@4
670NtSubmitIoRing@16
671NtSubscribeWnfStateChange@16
672NtSuspendProcess@4
673NtSuspendThread@8
674NtSystemDebugControl@24
675NtTerminateEnclave@8
676NtTerminateJobObject@8
677NtTerminateProcess@8
678NtTerminateThread@8
679NtTestAlert@0
680NtThawRegistry@0
681NtThawTransactions@0
682NtTraceControl@24
683NtTraceEvent@16
684NtTranslateFilePath@16
685NtUmsThreadYield@4
686NtUnloadDriver@4
687NtUnloadKey2@8
688NtUnloadKey@4
689NtUnloadKeyEx@8
690NtUnlockFile@20
691NtUnlockVirtualMemory@16
692NtUnmapViewOfSection@8
693NtUnmapViewOfSectionEx@12
694NtUnsubscribeWnfStateChange@4
695NtUpdateWnfStateData@28
696NtVdmControl@8
697NtWaitForAlertByThreadId@8
698NtWaitForDebugEvent@16
699NtWaitForKeyedEvent@16
700NtWaitForMultipleObjects32@20
701NtWaitForMultipleObjects@20
702NtWaitForSingleObject@12
703NtWaitForWorkViaWorkerFactory@8
704NtWaitHighEventPair@4
705NtWaitLowEventPair@4
706NtWorkerFactoryWorkerReady@4
707NtWow64CallFunction64@28
708NtWow64CsrAllocateCaptureBuffer@8
709NtWow64CsrAllocateMessagePointer@12
710NtWow64CsrCaptureMessageBuffer@16
711NtWow64CsrCaptureMessageString@20
712NtWow64CsrClientCallServer@16
713NtWow64CsrClientConnectToServer@20
714NtWow64CsrFreeCaptureBuffer@4
715NtWow64CsrGetProcessId@0
716NtWow64CsrIdentifyAlertableThread@0
717NtWow64CsrVerifyRegion@8
718NtWow64DebuggerCall@20
719NtWow64GetCurrentProcessorNumberEx@4
720NtWow64GetNativeSystemInformation@16
721NtWow64InterlockedPopEntrySList@4
722NtWow64QueryInformationProcess64@20
723NtWow64QueryVirtualMemory64@32
724NtWow64ReadVirtualMemory64@28
725NtWow64WriteVirtualMemory64@28
726NtWriteFile@36
727NtWriteFileGather@36
728NtWriteRequestData@24
729NtWriteVirtualMemory@20
730NtYieldExecution@0
731; Not sure, but we assume here standard DefWindowProc arguments
732NtdllDefWindowProc_A@16
733NtdllDefWindowProc_W@16
734; Not sure, but we assume here standard DefDlgProc arguments
735NtdllDialogWndProc_A@16
736NtdllDialogWndProc_W@16
737PfxFindPrefix@8
738PfxInitialize@4
739PfxInsertPrefix@12
740PfxRemovePrefix@8
741PssNtCaptureSnapshot@16
742PssNtDuplicateSnapshot@20
743PssNtFreeRemoteSnapshot@8
744PssNtFreeSnapshot@4
745PssNtFreeWalkMarker@4
746PssNtQuerySnapshot@16
747PssNtValidateDescriptor@8
748PssNtWalkSnapshot@20
749RtlAbortRXact@4
750RtlAbsoluteToSelfRelativeSD@12
751RtlAcquirePebLock@0
752RtlAcquirePrivilege@16
753RtlAcquireReleaseSRWLockExclusive@4
754RtlAcquireResourceExclusive@8
755RtlAcquireResourceShared@8
756RtlAcquireSRWLockExclusive@4
757RtlAcquireSRWLockShared@4
758RtlActivateActivationContext@12
759RtlActivateActivationContextEx@16
760RtlAddAccessAllowedAce@16
761RtlAddAccessAllowedAceEx@20
762RtlAddAccessAllowedObjectAce@28
763RtlAddAccessDeniedAce@16
764RtlAddAccessDeniedAceEx@20
765RtlAddAccessDeniedObjectAce@28
766RtlAddAccessFilterAce@32
767RtlAddAce@20
768RtlAddActionToRXact@24
769RtlAddAtomToAtomTable@12
770RtlAddAttributeActionToRXact@32
771RtlAddAuditAccessAce@24
772RtlAddAuditAccessAceEx@28
773RtlAddAuditAccessObjectAce@36
774RtlAddCompoundAce@24
775RtlAddIntegrityLabelToBoundaryDescriptor@8
776RtlAddMandatoryAce@24
777RtlAddProcessTrustLabelAce@24
778RtlAddRefActivationContext@4
779RtlAddRange@36
780RtlAddRefMemoryStream@4
781RtlAddResourceAttributeAce@28
782RtlAddSIDToBoundaryDescriptor@8
783RtlAddScopedPolicyIDAce@20
784RtlAddVectoredContinueHandler@8
785RtlAddVectoredExceptionHandler@8
786RtlAddressInSectionTable@12
787RtlAdjustPrivilege@16
788RtlAllocateActivationContextStack@4
789RtlAllocateAndInitializeSid@44
790RtlAllocateAndInitializeSidEx@16
791RtlAllocateHandle@8
792RtlAllocateHeap@12
793RtlAllocateMemoryBlockLookaside@12
794RtlAllocateMemoryZone@12
795RtlAllocateWnfSerializationGroup@0
796RtlAnsiCharToUnicodeChar@4
797RtlAnsiStringToUnicodeSize@4
798RtlAnsiStringToUnicodeString@12
799RtlAppendAsciizToString@8
800RtlAppendPathElement@12
801RtlAppendStringToString@8
802RtlAppendUnicodeStringToString@8
803RtlAppendUnicodeToString@8
804RtlApplicationVerifierStop@40
805RtlApplyRXact@4
806RtlApplyRXactNoFlush@4
807RtlAppxIsFileOwnedByTrustedInstaller@8
808RtlAreAllAccessesGranted@8
809RtlAreAnyAccessesGranted@8
810RtlAreBitsClear@12
811RtlAreBitsSet@12
812RtlAreLongPathsEnabled@0
813RtlAssert@16
814RtlAvlInsertNodeEx@16
815RtlAvlRemoveNode@8
816RtlBarrier@8
817RtlBarrierForDelete@8
818RtlCallbackLpcClient@12
819RtlCancelTimer@8
820RtlCanonicalizeDomainName@12
821RtlCapabilityCheck@12
822RtlCapabilityCheckForSingleSessionSku@12
823RtlCaptureContext@4
824RtlCaptureStackBackTrace@16
825RtlCaptureStackContext@12
826RtlCharToInteger@12
827RtlCheckBootStatusIntegrity@8
828RtlCheckForOrphanedCriticalSections@4
829RtlCheckPortableOperatingSystem@4
830RtlCheckRegistryKey@8
831RtlCheckSandboxedToken@8
832RtlCheckSystemBootStatusIntegrity@4
833RtlCheckTokenCapability@12
834RtlCheckTokenMembership@12
835RtlCheckTokenMembershipEx@16
836RtlCleanUpTEBLangLists@0
837RtlClearAllBits@4
838RtlClearBit@8
839RtlClearBits@12
840RtlClearThreadWorkOnBehalfTicket@0
841RtlCloneMemoryStream@8
842RtlCloneUserProcess@20
843RtlCmDecodeMemIoResource@8
844RtlCmEncodeMemIoResource@24
845RtlCommitDebugInfo@8
846RtlCommitMemoryStream@8
847RtlCompactHeap@8
848RtlCompareAltitudes@8
849RtlCompareExchangePointerMapping@16
850RtlCompareExchangePropertyStore@16
851RtlCompareMemory@12
852RtlCompareMemoryUlong@12
853RtlCompareString@12
854RtlCompareUnicodeString@12
855RtlCompareUnicodeStrings@20
856RtlCompressBuffer@32
857RtlComputeCrc32@12
858RtlComputeImportTableHash@12
859RtlComputePrivatizedDllName_U@12
860RtlConnectToSm@16
861RtlConsoleMultiByteToUnicodeN@24
862RtlConstructCrossVmEventPath@12
863RtlConstructCrossVmMutexPath@12
864RtlContractHashTable@4
865RtlConvertDeviceFamilyInfoToString@16
866RtlConvertExclusiveToShared@4
867RtlConvertLCIDToString@20
868RtlConvertLongToLargeInteger@4
869RtlConvertSRWLockExclusiveToShared@4
870RtlConvertSharedToExclusive@4
871RtlConvertSidToUnicodeString@12
872RtlConvertToAutoInheritSecurityObject@24
873RtlConvertUiListToApiList@12
874RtlConvertUlongToLargeInteger@4
875RtlCopyBitMap@12
876RtlCopyContext@12
877RtlCopyExtendedContext@12
878RtlCopyLuid@8
879RtlCopyLuidAndAttributesArray@12
880RtlCopyMappedMemory@12
881RtlCopyMemoryStreamTo@24
882RtlCopyOutOfProcessMemoryStreamTo@24
883RtlCopyRangeList@8
884RtlCopySecurityDescriptor@8
885RtlCopySid@12
886RtlCopySidAndAttributesArray@28
887RtlCopyString@8
888RtlCopyUnicodeString@8
889RtlCrc32@12
890RtlCrc64@16
891RtlCreateAcl@12
892RtlCreateActivationContext@24
893RtlCreateAndSetSD@20
894RtlCreateAtomTable@8
895RtlCreateBootStatusDataFile@4
896RtlCreateBoundaryDescriptor@8
897RtlCreateEnvironment@8
898RtlCreateEnvironmentEx@12
899RtlCreateHashTable@12
900RtlCreateHashTableEx@16
901RtlCreateHeap@24
902RtlCreateLpcServer@24
903RtlCreateMemoryBlockLookaside@20
904RtlCreateMemoryZone@12
905RtlCreateProcessParameters@40
906RtlCreateProcessParametersEx@44
907RtlCreateProcessParametersWithTemplate@12
908RtlCreateProcessReflection@24
909RtlCreateQueryDebugBuffer@8
910RtlCreateRegistryKey@8
911RtlCreateSecurityDescriptor@8
912RtlCreateServiceSid@12
913RtlCreateSystemVolumeInformationFolder@4
914RtlCreateTagHeap@16
915RtlCreateTimer@28
916RtlCreateTimerQueue@4
917RtlCreateUnicodeString@8
918RtlCreateUnicodeStringFromAsciiz@8
919RtlCreateUserProcess@40
920RtlCreateUserProcessEx@20
921RtlCreateUserSecurityObject@28
922RtlCreateUserStack@24
923RtlCreateUserThread@40
924RtlCreateVirtualAccountSid@16
925RtlCultureNameToLCID@8
926RtlCustomCPToUnicodeN@24
927RtlCutoverTimeToSystemTime@16
928RtlDeCommitDebugInfo@12
929RtlDeNormalizeProcessParams@4
930RtlDeactivateActivationContext@8
931RtlDebugPrintTimes@0
932RtlDecodePointer@4
933RtlDecodeRemotePointer@12
934RtlDecodeSystemPointer@4
935RtlDecompressBuffer@24
936RtlDecompressBufferEx@28
937RtlDecompressFragment@32
938RtlDefaultNpAcl@4
939RtlDelayExecution@8
940RtlDelete@4
941RtlDeleteAce@8
942RtlDeleteAtomFromAtomTable@8
943RtlDeleteBarrier@4
944RtlDeleteBoundaryDescriptor@4
945RtlDeleteCriticalSection@4
946RtlDeleteElementGenericTable@8
947RtlDeleteElementGenericTableAvl@8
948RtlDeleteElementGenericTableAvlEx@8
949RtlDeleteHashTable@4
950RtlDeleteNoSplay@8
951RtlDeleteOwnersRanges@8
952RtlDeleteRange@24
953RtlDeleteRegistryValue@12
954RtlDeleteResource@4
955RtlDeleteSecurityObject@4
956RtlDeleteTimer@12
957RtlDeleteTimerQueue@4
958RtlDeleteTimerQueueEx@8
959RtlDeregisterSecureMemoryCacheCallback@4
960RtlDeregisterWait@4
961RtlDeregisterWaitEx@8
962RtlDeriveCapabilitySidsFromName@12
963RtlDestroyAtomTable@4
964RtlDestroyEnvironment@4
965RtlDestroyHandleTable@4
966RtlDestroyHeap@4
967RtlDestroyMemoryBlockLookaside@4
968RtlDestroyMemoryZone@4
969RtlDestroyProcessParameters@4
970RtlDestroyQueryDebugBuffer@4
971RtlDetectHeapLeaks@0
972RtlDetermineDosPathNameType_U@4
973RtlDisableThreadProfiling@4
974RtlDllShutdownInProgress@0
975RtlDnsHostNameToComputerName@12
976RtlDoesFileExists_U@4
977RtlDoesNameContainWildCards@4
978RtlDosApplyFileIsolationRedirection_Ustr@36
979RtlDosLongPathNameToNtPathName_U_WithStatus@16
980RtlDosLongPathNameToRelativeNtPathName_U_WithStatus@16
981RtlDosPathNameToNtPathName_U@16
982RtlDosPathNameToNtPathName_U_WithStatus@16
983RtlDosPathNameToRelativeNtPathName_U@16
984RtlDosPathNameToRelativeNtPathName_U_WithStatus@16
985RtlDosSearchPath_U@24
986RtlDosSearchPath_Ustr@36
987RtlDowncaseUnicodeChar@4
988RtlDowncaseUnicodeString@12
989RtlDumpResource@4
990RtlDuplicateUnicodeString@12
991RtlEmptyAtomTable@8
992RtlEnableEarlyCriticalSectionEventCreation@0
993RtlEnableThreadProfiling@20
994RtlEncodePointer@4
995RtlEncodeRemotePointer@12
996RtlEncodeSystemPointer@4
997RtlEndEnumerationHashTable@8
998RtlEndStrongEnumerationHashTable@8
999RtlEndWeakEnumerationHashTable@8
1000RtlEnlargedIntegerMultiply@8
1001RtlEnlargedUnsignedDivide@16
1002RtlEnlargedUnsignedMultiply@8
1003RtlEnterCriticalSection@4
1004RtlEnumProcessHeaps@8
1005RtlEnumerateEntryHashTable@8
1006RtlEnumerateGenericTable@8
1007RtlEnumerateGenericTableAvl@8
1008RtlEnumerateGenericTableLikeADirectory@28
1009RtlEnumerateGenericTableWithoutSplaying@8
1010RtlEnumerateGenericTableWithoutSplayingAvl@8
1011RtlEqualComputerName@8
1012RtlEqualDomainName@8
1013RtlEqualLuid@8
1014RtlEqualPrefixSid@8
1015RtlEqualSid@8
1016RtlEqualString@12
1017RtlEqualUnicodeString@12
1018RtlEqualWnfChangeStamps@8
1019RtlEraseUnicodeString@4
1020RtlEthernetAddressToStringA@8
1021RtlEthernetAddressToStringW@8
1022RtlEthernetStringToAddressA@12
1023RtlEthernetStringToAddressW@12
1024RtlExitUserProcess@4
1025RtlExitUserThread@4 ; Not sure, but we assume @4
1026RtlExpandEnvironmentStrings@24
1027RtlExpandEnvironmentStrings_U@16
1028RtlExpandHashTable@4
1029RtlExtendCorrelationVector@4
1030RtlExtendMemoryBlockLookaside@8
1031RtlExtendMemoryZone@8
1032RtlExtendedIntegerMultiply@12
1033RtlExtendedLargeIntegerDivide@16
1034RtlExtendedMagicDivide@20
1035RtlExtractBitMap@16
1036RtlExtendHeap@16
1037RtlFillMemory@12
1038RtlFillMemoryUlong@12
1039RtlFillMemoryUlonglong@16
1040RtlFinalReleaseOutOfProcessMemoryStream@4
1041RtlFindAceByType@12
1042RtlFindActivationContextSectionGuid@20
1043RtlFindActivationContextSectionString@20
1044RtlFindCharInUnicodeString@16
1045RtlFindClearBits@12
1046RtlFindClearBitsAndSet@12
1047RtlFindClearRuns@16
1048RtlFindClosestEncodableLength@12
1049RtlFindExportedRoutineByName@8
1050RtlFindLastBackwardRunClear@12
1051RtlFindLeastSignificantBit@8
1052RtlFindLongestRunClear@8
1053RtlFindLongestRunSet@8
1054RtlFindMessage@20
1055RtlFindMostSignificantBit@8
1056RtlFindNextForwardRunClear@12
1057RtlFindRange@48
1058RtlFindSetBits@12
1059RtlFindSetBitsAndClear@12
1060RtlFindUnicodeSubstring@12
1061RtlFirstEntrySList@4
1062RtlFirstFreeAce@8
1063RtlFlsAlloc@8
1064RtlFlsFree@4
1065RtlFlsGetValue@8
1066RtlFlsSetValue@8
1067RtlFlushHeaps@0
1068RtlFlushSecureMemoryCache@8
1069RtlFormatCurrentUserKeyPath@4
1070RtlFormatMessage@36
1071RtlFormatMessageEx@40
1072RtlFreeActivationContextStack@4
1073RtlFreeAnsiString@4
1074RtlFreeHandle@8
1075RtlFreeHeap@12
1076RtlFreeMemoryBlockLookaside@8
1077RtlFreeOemString@4
1078RtlFreeSid@4
1079RtlFreeThreadActivationContextStack@0
1080RtlFreeUTF8String@4
1081RtlFreeUnicodeString@4
1082RtlFreeUserStack@4
1083RtlFreeUserThreadStack@8
1084RtlGUIDFromString@8
1085RtlGenerate8dot3Name@16
1086RtlGetAce@12
1087RtlGetActiveActivationContext@4
1088RtlGetActiveConsoleId@0
1089RtlGetAppContainerNamedObjectPath@16
1090RtlGetAppContainerParent@8
1091RtlGetAppContainerSidType@8
1092RtlGetCallersAddress@8
1093RtlGetCompressionWorkSpaceSize@12
1094RtlGetConsoleSessionForegroundProcessId@0
1095RtlGetControlSecurityDescriptor@12
1096RtlGetCriticalSectionRecursionCount@4
1097RtlGetCurrentDirectory_U@8
1098RtlGetCurrentPeb@0
1099RtlGetCurrentProcessorNumber@0
1100RtlGetCurrentProcessorNumberEx@4
1101RtlGetCurrentServiceSessionId@0
1102RtlGetCurrentTransaction@0
1103RtlGetDaclSecurityDescriptor@16
1104RtlGetDeviceFamilyInfoEnum@12
1105RtlGetElementGenericTable@8
1106RtlGetElementGenericTableAvl@8
1107RtlGetEnabledExtendedFeatures@8
1108RtlGetExePath@8
1109RtlGetExtendedContextLength2@16
1110RtlGetExtendedContextLength@8
1111RtlGetExtendedFeaturesMask@4
1112RtlGetFileMUIPath@28
1113RtlGetFirstRange@12
1114RtlGetFrame@0
1115RtlGetFullPathName_U@16
1116RtlGetFullPathName_UEx@20
1117RtlGetFullPathName_UstrEx@32
1118RtlGetGroupSecurityDescriptor@12
1119RtlGetImageFileMachines@8
1120RtlGetIntegerAtom@8
1121RtlGetInterruptTimePrecise@4
1122RtlGetLastNtStatus@0
1123RtlGetLastWin32Error@0
1124RtlGetLengthWithoutLastFullDosOrNtPathElement@12
1125RtlGetLengthWithoutTrailingPathSeperators@12
1126RtlGetLocaleFileMappingAddress@12
1127RtlGetLongestNtPathLength@0
1128RtlGetMultiTimePrecise@12
1129RtlGetNativeSystemInformation@16
1130RtlGetNextRange@12
1131RtlGetNextEntryHashTable@8
1132RtlGetNtGlobalFlags@0
1133RtlGetNtProductType@4
1134RtlGetNtSystemRoot@0
1135RtlGetNtVersionNumbers@12
1136RtlGetOwnerSecurityDescriptor@12
1137RtlGetParentLocaleName@16
1138RtlGetPersistedStateLocation@28
1139RtlGetProcessHeaps@8
1140RtlGetProcessPreferredUILanguages@16
1141RtlGetProductInfo@20
1142RtlGetReturnAddressHijackTarget@0
1143RtlGetSaclSecurityDescriptor@16
1144RtlGetSearchPath@4
1145RtlGetSecurityDescriptorRMControl@8
1146RtlGetSessionProperties@8
1147RtlGetSetBootStatusData@24
1148RtlGetSuiteMask@0
1149RtlGetSystemBootStatus@16
1150RtlGetSystemBootStatusEx@12
1151RtlGetSystemGlobalData@12
1152RtlGetSystemPreferredUILanguages@20
1153RtlGetSystemTimeAndBias@12
1154RtlGetSystemTimePrecise@0
1155RtlGetThreadErrorMode@0
1156RtlGetThreadLangIdByIndex@16
1157RtlGetThreadPreferredUILanguages@16
1158RtlGetThreadWorkOnBehalfTicket@8
1159RtlGetTokenNamedObjectPath@12
1160RtlGetUILanguageInfo@20
1161RtlGetUnloadEventTrace@0
1162RtlGetUnloadEventTraceEx@12
1163RtlGetUserInfoHeap@20
1164RtlGetUserPreferredUILanguages@20
1165RtlGetVersion@4
1166RtlGuardCheckLongJumpTarget@12
1167RtlHashUnicodeString@16
1168RtlHeapTrkInitialize@4
1169RtlIdentifierAuthoritySid@4
1170RtlIdnToAscii@20
1171RtlIdnToNameprepUnicode@20
1172RtlIdnToUnicode@20
1173RtlImageDirectoryEntryToData@16
1174RtlImageNtHeader@4
1175RtlImageNtHeaderEx@20
1176RtlImageRvaToSection@12
1177RtlImageRvaToVa@16
1178RtlImpersonateLpcClient@8
1179RtlImpersonateSelf@4
1180RtlImpersonateSelfEx@12
1181RtlIncrementCorrelationVector@4
1182RtlInitAnsiString@8
1183RtlInitAnsiStringEx@8
1184RtlInitBarrier@12
1185RtlInitCodePageTable@8
1186RtlInitEnumerationHashTable@8
1187RtlInitMemoryStream@4
1188RtlInitNlsTables@16
1189RtlInitOutOfProcessMemoryStream@4
1190RtlInitString@8
1191RtlInitStringEx@8
1192RtlInitStrongEnumerationHashTable@8
1193RtlInitUTF8String@8
1194RtlInitUTF8StringEx@8
1195RtlInitUnicodeString@8
1196RtlInitUnicodeStringEx@8
1197RtlInitWeakEnumerationHashTable@8
1198RtlInitializeAtomPackage@4
1199RtlInitializeBitMap@12
1200RtlInitializeConditionVariable@4
1201RtlInitializeContext@20
1202RtlInitializeCorrelationVector@12
1203RtlInitializeCriticalSection@4
1204RtlInitializeCriticalSectionAndSpinCount@8
1205RtlInitializeCriticalSectionEx@12
1206RtlInitializeExceptionChain@4
1207RtlInitializeExtendedContext2@20
1208RtlInitializeExtendedContext@12
1209RtlInitializeGenericTable@20
1210RtlInitializeGenericTableAvl@20
1211RtlInitializeHandleTable@12
1212RtlInitializeNtUserPfn@24
1213RtlInitializeRXact@12
1214RtlInitializeResource@4
1215RtlInitializeSListHead@4
1216RtlInitializeSRWLock@4
1217RtlInitializeSid@12
1218RtlInitializeSidEx@0
1219RtlInsertElementGenericTable@16
1220RtlInsertElementGenericTableAvl@16
1221RtlInsertElementGenericTableFull@24
1222RtlInsertElementGenericTableFullAvl@24
1223RtlInsertEntryHashTable@16
1224RtlInt64ToUnicodeString@16
1225RtlIntegerToChar@16
1226RtlIntegerToUnicodeString@12
1227RtlInterlockedClearBitRun@12
1228RtlInterlockedCompareExchange64@20
1229RtlInterlockedFlushSList@4
1230RtlInterlockedPopEntrySList@4
1231RtlInterlockedPushEntrySList@8
1232RtlInterlockedPushListSListEx@16
1233RtlInvertRangeList@8
1234RtlInterlockedSetBitRun@12
1235RtlIoDecodeMemIoResource@16
1236RtlIoEncodeMemIoResource@40
1237RtlIpv4AddressToStringA@8
1238RtlIpv4AddressToStringExA@16
1239RtlIpv4AddressToStringExW@16
1240RtlIpv4AddressToStringW@8
1241RtlIpv4StringToAddressA@16
1242RtlIpv4StringToAddressExA@16
1243RtlIpv4StringToAddressExW@16
1244RtlIpv4StringToAddressW@16
1245RtlIpv6AddressToStringA@8
1246RtlIpv6AddressToStringExA@20
1247RtlIpv6AddressToStringExW@20
1248RtlIpv6AddressToStringW@8
1249RtlIpv6StringToAddressA@12
1250RtlIpv6StringToAddressExA@16
1251RtlIpv6StringToAddressExW@16
1252RtlIpv6StringToAddressW@12
1253RtlIsActivationContextActive@4
1254RtlIsApiSetImplemented@4
1255RtlIsCapabilitySid@4
1256RtlIsCloudFilesPlaceholder@8
1257RtlIsCriticalSectionLocked@4
1258RtlIsCriticalSectionLockedByThread@4
1259RtlIsCurrentProcess@4
1260RtlIsCurrentThread@4
1261RtlIsCurrentThreadAttachExempt@0
1262RtlIsDosDeviceName_U@4
1263RtlIsElevatedRid@4
1264RtlIsEnclaveFeaturePresent@4
1265RtlIsGenericTableEmpty@4
1266RtlIsGenericTableEmptyAvl@4
1267RtlIsMultiSessionSku@0
1268RtlIsMultiUsersInSessionSku@0
1269RtlIsNameInExpression@16
1270RtlIsNameInUnUpcasedExpression@16
1271RtlIsNameLegalDOS8Dot3@12
1272RtlIsNonEmptyDirectoryReparsePointAllowed@4
1273RtlIsNormalizedString@16
1274RtlIsPackageSid@4
1275RtlIsParentOfChildAppContainer@8
1276RtlIsPartialPlaceholder@8
1277RtlIsPartialPlaceholderFileHandle@8
1278RtlIsPartialPlaceholderFileInfo@12
1279RtlIsProcessorFeaturePresent@4
1280RtlIsRangeAvailable@40
1281RtlIsStateSeparationEnabled@0
1282RtlIsTextUnicode@12
1283RtlIsThreadWithinLoaderCallout@0
1284RtlIsUntrustedObject@12
1285RtlIsValidHandle@8
1286RtlIsValidIndexHandle@12
1287RtlIsValidLocaleName@8
1288RtlIsValidProcessTrustLabelSid@4
1289RtlIsZeroMemory@8
1290RtlKnownExceptionFilter@4
1291RtlLCIDToCultureName@8
1292RtlLargeIntegerAdd@16
1293RtlLargeIntegerArithmeticShift@12
1294RtlLargeIntegerDivide@20
1295RtlLargeIntegerNegate@8
1296RtlLargeIntegerShiftLeft@12
1297RtlLargeIntegerShiftRight@12
1298RtlLargeIntegerSubtract@16
1299RtlLargeIntegerToChar@16
1300RtlLcidToLocaleName@16
1301RtlLeaveCriticalSection@4
1302RtlLengthRequiredSid@4
1303RtlLengthSecurityDescriptor@4
1304RtlLengthSid@4
1305RtlLengthSidAsUnicodeString@8
1306RtlLoadString@32
1307RtlLocalTimeToSystemTime@8
1308RtlLocaleNameToLcid@12
1309RtlLocateExtendedFeature2@16
1310RtlLocateExtendedFeature@12
1311RtlLocateLegacyContext@8
1312RtlLockBootStatusData@4
1313RtlLockCurrentThread@0
1314RtlLockHeap@4
1315RtlLockMemoryBlockLookaside@4
1316RtlLockMemoryStreamRegion@24
1317RtlLockMemoryZone@4
1318RtlLockModuleSection@4
1319RtlLogStackBackTrace@0
1320RtlLookupAtomInAtomTable@12
1321RtlLookupElementGenericTable@8
1322RtlLookupElementGenericTableAvl@8
1323RtlLookupElementGenericTableFull@16
1324RtlLookupElementGenericTableFullAvl@16
1325RtlLookupEntryHashTable@12
1326RtlLookupFirstMatchingElementGenericTableAvl@12
1327RtlMakeSelfRelativeSD@12
1328RtlMapGenericMask@8
1329RtlMapSecurityErrorToNtStatus@4
1330RtlMergeRangeLists@16
1331RtlMoveMemory@12
1332RtlMultiAppendUnicodeStringBuffer@12
1333RtlMultiByteToUnicodeN@20
1334RtlMultiByteToUnicodeSize@12
1335RtlMultipleAllocateHeap@20
1336RtlMultipleFreeHeap@16
1337RtlNewInstanceSecurityObject@40
1338RtlNewSecurityGrantedAccess@24
1339RtlNewSecurityObject@24
1340RtlNewSecurityObjectEx@32
1341RtlNewSecurityObjectWithMultipleInheritance@36
1342RtlNormalizeProcessParams@4
1343RtlNormalizeSecurityDescriptor@20
1344RtlNormalizeString@20
1345RtlNotifyFeatureUsage@4
1346RtlNtPathNameToDosPathName@16
1347RtlNtStatusToDosError@4
1348RtlNtStatusToDosErrorNoTeb@4
1349RtlNumberGenericTableElements@4
1350RtlNumberGenericTableElementsAvl@4
1351RtlNumberOfClearBits@4
1352RtlNumberOfClearBitsInRange@12
1353RtlNumberOfSetBits@4
1354RtlNumberOfSetBitsInRange@12
1355RtlNumberOfSetBitsUlongPtr@4
1356RtlOemStringToUnicodeSize@4
1357RtlOemStringToUnicodeString@12
1358RtlOemToUnicodeN@20
1359RtlOpenCurrentUser@8
1360RtlOsDeploymentState@4
1361RtlOwnerAcesPresent@4
1362RtlPcToFileHeader@8
1363RtlPinAtomInAtomTable@8
1364RtlPopFrame@4
1365RtlPrefixString@12
1366RtlPrefixUnicodeString@12
1367RtlProcessFlsData@4
1368RtlProtectHeap@8
1369RtlPublishWnfStateData@24
1370RtlPushFrame@4
1371RtlQueryActivationContextApplicationSettings@28
1372RtlQueryAllFeatureConfigurations@16
1373RtlQueryAtomInAtomTable@24
1374RtlQueryCriticalSectionOwner@4
1375RtlQueryDepthSList@4
1376RtlQueryDynamicTimeZoneInformation@4
1377RtlQueryElevationFlags@4
1378RtlQueryEnvironmentVariable@24
1379RtlQueryEnvironmentVariable_U@12
1380RtlQueryFeatureConfiguration@16
1381RtlQueryFeatureConfigurationChangeStamp@0
1382RtlQueryFeatureUsageNotificationSubscriptions@8
1383RtlQueryHeapInformation@20
1384RtlQueryImageMitigationPolicy@20
1385RtlQueryInformationAcl@16
1386RtlQueryInformationActivationContext@28
1387RtlQueryInformationActiveActivationContext@16
1388RtlQueryInterfaceMemoryStream@12
1389RtlQueryModuleInformation@12
1390RtlQueryPackageClaims@32
1391RtlQueryPackageIdentity@24
1392RtlQueryPackageIdentityEx@28
1393RtlQueryPerformanceCounter@4
1394RtlQueryPerformanceFrequency@4
1395RtlQueryPointerMapping@8
1396RtlQueryProcessBackTraceInformation@4
1397RtlQueryProcessDebugInformation@12
1398RtlQueryProcessHeapInformation@4
1399RtlQueryProcessLockInformation@4
1400RtlQueryProcessPlaceholderCompatibilityMode@0
1401RtlQueryPropertyStore@8
1402RtlQueryProtectedPolicy@8
1403RtlQueryRegistryValueWithFallback@28
1404RtlQueryRegistryValues@20
1405RtlQueryRegistryValuesEx@20
1406RtlQueryResourcePolicy@16
1407RtlQuerySecurityObject@20
1408RtlQueryTagHeap@20
1409RtlQueryThreadPlaceholderCompatibilityMode@0
1410RtlQueryThreadProfiling@8
1411RtlQueryTimeZoneInformation@4
1412RtlQueryTokenHostIdAsUlong64@8
1413RtlQueryUnbiasedInterruptTime@4
1414RtlQueryValidationRunlevel@4
1415RtlQueryWnfMetaNotification@20
1416RtlQueryWnfStateData@24
1417RtlQueryWnfStateDataWithExplicitScope@28
1418RtlQueueApcWow64Thread@20
1419RtlQueueWorkItem@12
1420RtlRaiseCustomSystemEventTrigger@4
1421RtlRaiseException@4
1422RtlRaiseStatus@4
1423RtlRandom@4
1424RtlRandomEx@4
1425RtlRbInsertNodeEx@16
1426RtlRbRemoveNode@8
1427RtlReAllocateHeap@16
1428RtlReadMemoryStream@16
1429RtlReadOutOfProcessMemoryStream@16
1430RtlReadThreadProfilingData@12
1431RtlRealPredecessor@4
1432RtlRealSuccessor@4
1433RtlRegisterFeatureConfigurationChangeNotification@16
1434RtlRegisterForWnfMetaNotification@24
1435RtlRegisterSecureMemoryCacheCallback@4
1436RtlRegisterThreadWithCsrss@0
1437RtlRegisterWait@24
1438RtlReleaseActivationContext@4
1439RtlReleaseMemoryStream@4
1440RtlReleasePath@4
1441RtlReleasePebLock@0
1442RtlReleasePrivilege@4
1443RtlReleaseRelativeName@4
1444RtlReleaseResource@4
1445RtlReleaseSRWLockExclusive@4
1446RtlReleaseSRWLockShared@4
1447RtlRemoteCall@28
1448RtlRemoveEntryHashTable@12
1449RtlRemovePointerMapping@8
1450RtlRemovePrivileges@12
1451RtlRemovePropertyStore@8
1452RtlRemoveVectoredContinueHandler@4
1453RtlRemoveVectoredExceptionHandler@4
1454RtlReplaceSidInSd@16
1455RtlReplaceSystemDirectoryInPath@16
1456RtlReportException@12
1457RtlReportExceptionEx@20
1458RtlReportSilentProcessExit@8
1459RtlReportSqmEscalation@24
1460RtlResetMemoryBlockLookaside@4
1461RtlResetMemoryZone@4
1462RtlResetNtUserPfn@0
1463RtlResetRtlTranslations@4
1464RtlRestoreBootStatusDefaults@4
1465RtlRestoreContext@8
1466RtlRestoreLastWin32Error@4
1467RtlRestoreSystemBootStatusDefaults@0
1468RtlRestoreThreadPreferredUILanguages@4
1469RtlRetrieveNtUserPfn@12
1470RtlRevertMemoryStream@4
1471RtlRunDecodeUnicodeString@8
1472RtlRunEncodeUnicodeString@8
1473RtlRunOnceBeginInitialize@12
1474RtlRunOnceComplete@12
1475RtlRunOnceExecuteOnce@16
1476RtlRunOnceInitialize@4
1477RtlSecondsSince1970ToTime@8
1478RtlSecondsSince1980ToTime@8
1479RtlSeekMemoryStream@20
1480RtlSelfRelativeToAbsoluteSD2@8
1481RtlSelfRelativeToAbsoluteSD@44
1482RtlSendMsgToSm@8
1483RtlSetAllBits@4
1484RtlSetAttributesSecurityDescriptor@12
1485RtlSetBit@8
1486RtlSetBits@12
1487RtlSetControlSecurityDescriptor@12
1488RtlSetCriticalSectionSpinCount@8
1489RtlSetCurrentDirectory_U@4
1490RtlSetCurrentEnvironment@8
1491RtlSetCurrentTransaction@4
1492RtlSetDaclSecurityDescriptor@16
1493RtlSetDynamicTimeZoneInformation@4
1494RtlSetEnvironmentStrings@8
1495RtlSetEnvironmentVar@20
1496RtlSetEnvironmentVariable@12
1497RtlSetExtendedFeaturesMask@12
1498RtlSetFeatureConfigurations@16
1499RtlSetGroupSecurityDescriptor@12
1500RtlSetHeapInformation@16
1501RtlSetImageMitigationPolicy@20
1502RtlSetInformationAcl@16
1503RtlSetIoCompletionCallback@12
1504RtlSetLastWin32Error@4
1505RtlSetLastWin32ErrorAndNtStatusFromNtStatus@4
1506RtlSetMemoryStreamSize@12
1507RtlSetOwnerSecurityDescriptor@12
1508RtlSetPortableOperatingSystem@4
1509RtlSetProcessDebugInformation@12
1510RtlSetProcessIsCritical@0
1511RtlSetProcessPlaceholderCompatibilityMode@4
1512RtlSetProcessPreferredUILanguages@12
1513RtlSetProtectedPolicy@12
1514RtlSetProxiedProcessId@4
1515RtlSetSaclSecurityDescriptor@16
1516RtlSetSearchPathMode@4
1517RtlSetSecurityDescriptorRMControl@8
1518RtlSetSecurityObject@20
1519RtlSetSecurityObjectEx@24
1520RtlSetSystemBootStatus@16
1521RtlSetSystemBootStatusEx@12
1522RtlSetThreadErrorMode@8
1523RtlSetThreadIsCritical@0
1524RtlSetThreadPlaceholderCompatibilityMode@4
1525RtlSetThreadPoolStartFunc@8
1526RtlSetThreadPreferredUILanguages2@16
1527RtlSetThreadPreferredUILanguages@12
1528RtlSetThreadSubProcessTag@4
1529RtlSetThreadWorkOnBehalfTicket@4
1530RtlSetTimeZoneInformation@4
1531RtlSetTimer@28
1532RtlSetUnhandledExceptionFilter@4
1533RtlSetUserCallbackExceptionFilter@4
1534RtlSetUserFlagsHeap@20
1535RtlSetUserValueHeap@16
1536RtlShutdownLpcServer@4
1537RtlSidDominates@12
1538RtlSidDominatesForTrust@12
1539RtlSidEqualLevel@12
1540RtlSidHashInitialize@12
1541RtlSidHashLookup@8
1542RtlSidIsHigherLevel@12
1543RtlSizeHeap@12
1544RtlSleepConditionVariableCS@12
1545RtlSleepConditionVariableSRW@16
1546RtlSplay@4
1547RtlStartRXact@4
1548RtlStatMemoryStream@12
1549RtlStringFromGUID@8
1550RtlStringFromGUIDEx@12
1551RtlStronglyEnumerateEntryHashTable@8
1552RtlSubAuthorityCountSid@4
1553RtlSubAuthoritySid@8
1554RtlSubscribeForFeatureUsageNotification@8
1555RtlSubscribeWnfStateChangeNotification@36
1556RtlSubtreePredecessor@4
1557RtlSubtreeSuccessor@4
1558RtlSwitchedVVI@16
1559RtlSystemTimeToLocalTime@8
1560RtlTestAndPublishWnfStateData@28
1561RtlTestBit@8
1562RtlTestProtectedAccess@8
1563RtlTimeFieldsToTime@8
1564RtlTimeToElapsedTimeFields@8
1565RtlTimeToSecondsSince1970@8
1566RtlTimeToSecondsSince1980@8
1567RtlTimeToTimeFields@8
1568RtlTraceDatabaseAdd@16
1569RtlTraceDatabaseCreate@20
1570RtlTraceDatabaseDestroy@4
1571RtlTraceDatabaseEnumerate@12
1572RtlTraceDatabaseFind@16
1573RtlTraceDatabaseLock@4
1574RtlTraceDatabaseUnlock@4
1575RtlTraceDatabaseValidate@4
1576RtlTryAcquirePebLock@0
1577RtlTryAcquireSRWLockExclusive@4
1578RtlTryAcquireSRWLockShared@4
1579RtlTryConvertSRWLockSharedToExclusiveOrRelease@4
1580RtlTryEnterCriticalSection@4
1581RtlUTF8StringToUnicodeString@12
1582RtlUTF8ToUnicodeN@20
1583RtlUdiv128@28
1584RtlUnhandledExceptionFilter2@8
1585RtlUnhandledExceptionFilter@4
1586RtlUnicodeStringToAnsiSize@4
1587RtlUnicodeStringToAnsiString@12
1588RtlUnicodeStringToCountedOemString@12
1589RtlUnicodeStringToInteger@12
1590RtlUnicodeStringToOemSize@4
1591RtlUnicodeStringToOemString@12
1592RtlUnicodeStringToUTF8String@12
1593RtlUnicodeToCustomCPN@24
1594RtlUnicodeToMultiByteN@20
1595RtlUnicodeToMultiByteSize@12
1596RtlUnicodeToOemN@20
1597RtlUnicodeToUTF8N@20
1598RtlUniform@4
1599RtlUnlockBootStatusData@4
1600RtlUnlockCurrentThread@0
1601RtlUnlockHeap@4
1602RtlUnlockMemoryBlockLookaside@4
1603RtlUnlockMemoryStreamRegion@24
1604RtlUnlockMemoryZone@4
1605RtlUnlockModuleSection@4
1606RtlUnregisterFeatureConfigurationChangeNotification@4
1607RtlUnsubscribeFromFeatureUsageNotifications@8
1608RtlUnsubscribeWnfNotificationWaitForCompletion@4
1609RtlUnsubscribeWnfNotificationWithCompletionCallback@12
1610RtlUnsubscribeWnfStateChangeNotification@4
1611RtlUnwind@16
1612RtlUpcaseUnicodeChar@4
1613RtlUpcaseUnicodeString@12
1614RtlUpcaseUnicodeStringToAnsiString@12
1615RtlUpcaseUnicodeStringToCountedOemString@12
1616RtlUpcaseUnicodeStringToOemString@12
1617RtlUpcaseUnicodeToCustomCPN@24
1618RtlUpcaseUnicodeToMultiByteN@20
1619RtlUpcaseUnicodeToOemN@20
1620RtlUpdateClonedCriticalSection@4
1621RtlUpdateClonedSRWLock@8
1622RtlUpdateTimer@16
1623RtlUpperChar@4
1624RtlUpperString@8
1625RtlUsageHeap@12
1626; Not sure.
1627RtlUserThreadStart
1628RtlValidAcl@4
1629RtlValidProcessProtection@4
1630RtlValidRelativeSecurityDescriptor@12
1631RtlValidSecurityDescriptor@4
1632RtlValidSid@4
1633RtlValidateCorrelationVector@4
1634RtlValidateHeap@12
1635RtlValidateProcessHeaps@0
1636RtlValidateUnicodeString@8
1637RtlVerifyVersionInfo@16
1638RtlWaitForWnfMetaNotification@24
1639RtlWaitOnAddress@16
1640RtlWakeAddressAll@4
1641RtlWakeAddressAllNoFence@4
1642RtlWakeAddressSingle@4
1643RtlWakeAddressSingleNoFence@4
1644RtlWakeAllConditionVariable@4
1645RtlWakeConditionVariable@4
1646RtlWalkFrameChain@12
1647RtlWalkHeap@8
1648RtlWeaklyEnumerateEntryHashTable@8
1649RtlWerpReportException@16
1650RtlWnfCompareChangeStamp@8
1651RtlWnfDllUnloadCallback@4
1652RtlWow64CallFunction64@28
1653RtlWow64EnableFsRedirection@4
1654RtlWow64EnableFsRedirectionEx@8
1655RtlWow64GetCurrentMachine@0
1656RtlWow64GetEquivalentMachineCHPE@4
1657RtlWow64GetProcessMachines@12
1658RtlWow64GetSharedInfoProcess@12
1659RtlWow64IsWowGuestMachineSupported@8
1660RtlWow64LogMessageInEventLogger@12
1661RtlWriteMemoryStream@16
1662RtlWriteRegistryValue@24
1663RtlZeroHeap@8
1664RtlZeroMemory@8
1665RtlZombifyActivationContext@4
1666RtlpApplyLengthFunction@16
1667RtlpCheckDynamicTimeZoneInformation@8
1668RtlpCleanupRegistryKeys@0
1669RtlpConvertAbsoluteToRelativeSecurityAttribute@12
1670RtlpConvertCultureNamesToLCIDs@8
1671RtlpConvertLCIDsToCultureNames@8
1672RtlpConvertRelativeToAbsoluteSecurityAttribute@16
1673RtlpCreateProcessRegistryInfo@4
1674RtlpEnsureBufferSize@12
1675RtlpFreezeTimeBias@0
1676RtlpGetDeviceFamilyInfoEnum@12
1677RtlpGetLCIDFromLangInfoNode@12
1678RtlpGetNameFromLangInfoNode@12
1679RtlpGetSystemDefaultUILanguage@4 ; Check!!! gendef says @8
1680RtlpGetUserOrMachineUILanguage4NLS@12
1681RtlpInitializeLangRegistryInfo@4
1682RtlpIsQualifiedLanguage@12
1683RtlpLoadMachineUIByPolicy@12
1684RtlpLoadUserUIByPolicy@12
1685RtlpMergeSecurityAttributeInformation@16
1686RtlpMuiFreeLangRegistryInfo@4
1687RtlpMuiRegCreateRegistryInfo@0
1688RtlpMuiRegFreeRegistryInfo@8
1689RtlpMuiRegLoadRegistryInfo@8
1690RtlpNotOwnerCriticalSection@0 ; Check!!! gebdef says @4
1691RtlpNtCreateKey@24
1692RtlpNtEnumerateSubKey@16
1693RtlpNtMakeTemporaryKey@4
1694RtlpNtOpenKey@16
1695RtlpNtQueryValueKey@20
1696RtlpNtSetValueKey@16
1697RtlpQueryDefaultUILanguage@8
1698; Not sure.
1699RtlpQueryProcessDebugInformationRemote
1700RtlpRefreshCachedUILanguage@8
1701RtlpSetInstallLanguage@8
1702RtlpSetPreferredUILanguages@12
1703RtlpSetUserPreferredUILanguages@12
1704RtlpTimeFieldsToTime@12
1705RtlpTimeToTimeFields@12
1706RtlpUnWaitCriticalSection@4
1707RtlpVerifyAndCommitUILanguageSettings@4
1708RtlpWaitForCriticalSection@4
1709RtlxAnsiStringToUnicodeSize@4
1710RtlxOemStringToUnicodeSize@4
1711RtlxUnicodeStringToAnsiSize@4
1712RtlxUnicodeStringToOemSize@4
1713SbExecuteProcedure@20
1714SbSelectProcedure@16
1715ShipAssert@8
1716ShipAssertGetBufferInfo@8
1717ShipAssertMsgA@12
1718ShipAssertMsgW@12
1719TpAllocAlpcCompletion@20
1720TpAllocAlpcCompletionEx@20
1721TpAllocCleanupGroup@4
1722TpAllocIoCompletion@20
1723TpAllocJobNotification@20
1724TpAllocPool@8
1725TpAllocTimer@16
1726TpAllocWait@16
1727TpAllocWork@16
1728TpAlpcRegisterCompletionList@4
1729TpAlpcUnregisterCompletionList@4
1730TpCallbackDetectedUnrecoverableError@4
1731TpCallbackIndependent@4
1732TpCallbackLeaveCriticalSectionOnCompletion@8
1733TpCallbackMayRunLong@4
1734TpCallbackReleaseMutexOnCompletion@8
1735TpCallbackReleaseSemaphoreOnCompletion@12
1736TpCallbackSendAlpcMessageOnCompletion@16
1737TpCallbackSendPendingAlpcMessage@4
1738TpCallbackSetEventOnCompletion@8
1739TpCallbackUnloadDllOnCompletion@8
1740TpCancelAsyncIoOperation@4
1741TpCaptureCaller@4
1742TpCheckTerminateWorker@4
1743TpDbgDumpHeapUsage@12
1744TpDbgGetFreeInfo@8
1745TpDbgSetLogRoutine@4
1746TpDisablePoolCallbackChecks@4
1747TpDisassociateCallback@4
1748TpIsTimerSet@4
1749TpPoolFreeUnusedNodes@4
1750TpPostWork@4
1751TpQueryPoolStackInformation@8
1752TpReleaseAlpcCompletion@4
1753TpReleaseCleanupGroup@4
1754TpReleaseCleanupGroupMembers@12
1755TpReleaseIoCompletion@4
1756TpReleaseJobNotification@4
1757TpReleasePool@4
1758TpReleaseTimer@4
1759TpReleaseWait@4
1760TpReleaseWork@4
1761TpSetDefaultPoolMaxThreads@4
1762TpSetDefaultPoolStackInformation@4
1763TpSetPoolMaxThreads@8
1764TpSetPoolMaxThreadsSoftLimit@8
1765TpSetPoolMinThreads@8
1766TpSetPoolStackInformation@8
1767TpSetPoolThreadBasePriority@8
1768TpSetPoolThreadCpuSets@12
1769TpSetPoolWorkerThreadIdleTimeout@12
1770TpSetTimer@16
1771TpSetTimerEx@16
1772TpSetWait@12
1773TpSetWaitEx@16
1774TpSimpleTryPost@12
1775TpStartAsyncIoOperation@4
1776TpTimerOutstandingCallbackCount@4
1777TpTrimPools@0
1778TpWaitForAlpcCompletion@4
1779TpWaitForIoCompletion@8
1780TpWaitForJobNotification@4
1781TpWaitForTimer@8
1782TpWaitForWait@8
1783TpWaitForWork@8
1784VerSetConditionMask@16
1785WerCheckEventEscalation@8
1786WerReportExceptionWorker@4
1787WerReportSQMEvent@12
1788WerReportWatsonEvent@16
1789WerReportSQMEvent@16
1790WinSqmAddToAverageDWORD@12
1791WinSqmAddToStream@16
1792WinSqmAddToStreamEx@20
1793WinSqmCheckEscalationAddToStreamEx@20
1794WinSqmCheckEscalationSetDWORD64@20
1795WinSqmCheckEscalationSetDWORD@16
1796WinSqmCheckEscalationSetString@16
1797WinSqmCommonDatapointDelete@4
1798WinSqmCommonDatapointSetDWORD64@16
1799WinSqmCommonDatapointSetDWORD@12
1800WinSqmCommonDatapointSetStreamEx@20
1801WinSqmCommonDatapointSetString@12
1802WinSqmEndSession@4
1803WinSqmEventEnabled@8
1804WinSqmEventWrite@12
1805WinSqmGetEscalationRuleStatus@8
1806WinSqmGetInstrumentationProperty@16
1807WinSqmIncrementDWORD@12
1808WinSqmIsOptedIn@0
1809WinSqmIsOptedInEx@4
1810WinSqmIsSessionDisabled@4
1811WinSqmSetDWORD64@16
1812WinSqmSetDWORD@12
1813WinSqmSetEscalationInfo@16
1814WinSqmSetIfMaxDWORD@12
1815WinSqmSetIfMinDWORD@12
1816WinSqmSetString@12
1817WinSqmStartSession@12
1818WinSqmStartSessionForPartner@16
1819WinSqmStartSqmOptinListener@0
1820ZwAcceptConnectPort@24
1821ZwAccessCheck@32
1822ZwAccessCheckAndAuditAlarm@44
1823ZwAccessCheckByType@44
1824ZwAccessCheckByTypeAndAuditAlarm@64
1825ZwAccessCheckByTypeResultList@44
1826ZwAccessCheckByTypeResultListAndAuditAlarm@64
1827ZwAccessCheckByTypeResultListAndAuditAlarmByHandle@68
1828ZwAcquireCrossVmMutant@8
1829ZwAcquireCMFViewOwnership@12
1830ZwAcquireProcessActivityReference@12
1831ZwAddAtom@12
1832ZwAddAtomEx@16
1833ZwAddBootEntry@8
1834ZwAddDriverEntry@8
1835ZwAdjustGroupsToken@24
1836ZwAdjustPrivilegesToken@24
1837ZwAdjustTokenClaimsAndDeviceGroups@64
1838ZwAlertResumeThread@8
1839ZwAlertThread@4
1840ZwAlertThreadByThreadId@4
1841ZwAllocateLocallyUniqueId@4
1842ZwAllocateReserveObject@12
1843ZwAllocateUserPhysicalPages@12
1844ZwAllocateUserPhysicalPagesEx@20
1845ZwAllocateUuids@16
1846ZwAllocateVirtualMemory@24
1847ZwAllocateVirtualMemoryEx@28
1848ZwAlpcAcceptConnectPort@36
1849ZwAlpcCancelMessage@12
1850ZwAlpcConnectPort@44
1851ZwAlpcConnectPortEx@44
1852ZwAlpcCreatePort@12
1853ZwAlpcCreatePortSection@24
1854ZwAlpcCreateResourceReserve@16
1855ZwAlpcCreateSectionView@12
1856ZwAlpcCreateSecurityContext@12
1857ZwAlpcDeletePortSection@12
1858ZwAlpcDeleteResourceReserve@12
1859ZwAlpcDeleteSectionView@12
1860ZwAlpcDeleteSecurityContext@12
1861ZwAlpcDisconnectPort@8
1862ZwAlpcImpersonateClientContainerOfPort@12
1863ZwAlpcImpersonateClientOfPort@12
1864ZwAlpcOpenSenderProcess@24
1865ZwAlpcOpenSenderThread@24
1866ZwAlpcQueryInformation@20
1867ZwAlpcQueryInformationMessage@24
1868ZwAlpcRevokeSecurityContext@12
1869ZwAlpcSendWaitReceivePort@32
1870ZwAlpcSetInformation@16
1871ZwApphelpCacheControl@8
1872ZwAreMappedFilesTheSame@8
1873ZwAssignProcessToJobObject@8
1874ZwAssociateWaitCompletionPacket@32
1875ZwCallEnclave@16
1876ZwCallbackReturn@12
1877ZwCancelDeviceWakeupRequest@4
1878ZwCancelIoFile@8
1879ZwCancelIoFileEx@12
1880ZwCancelSynchronousIoFile@12
1881ZwCancelTimer2@8
1882ZwCancelTimer@8
1883ZwCancelWaitCompletionPacket@8
1884ZwChangeProcessState@24
1885ZwChangeThreadState@24
1886ZwClearEvent@4
1887ZwClose@4
1888ZwCloseObjectAuditAlarm@12
1889ZwCommitComplete@8
1890ZwCommitEnlistment@8
1891ZwCommitRegistryTransaction@8
1892ZwCommitTransaction@8
1893ZwCompactKeys@8
1894ZwCompareObjects@8
1895ZwCompareSigningLevels@8
1896ZwCompareTokens@12
1897ZwCompleteConnectPort@4
1898ZwCompressKey@4
1899ZwConnectPort@32
1900ZwContinue@8
1901ZwContinueEx@8
1902ZwConvertBetweenAuxiliaryCounterAndPerformanceCounter@16
1903ZwCreateCrossVmEvent@24
1904ZwCreateCrossVmMutant@24
1905ZwCreateDebugObject@16
1906ZwCreateDirectoryObject@12
1907ZwCreateDirectoryObjectEx@20
1908ZwCreateEnclave@36
1909ZwCreateEnlistment@32
1910ZwCreateEvent@20
1911ZwCreateEventPair@12
1912ZwCreateFile@44
1913ZwCreateIRTimer@12
1914ZwCreateIoCompletion@16
1915ZwCreateIoRing@20
1916ZwCreateJobObject@12
1917ZwCreateJobSet@12
1918ZwCreateKey@28
1919ZwCreateKeyTransacted@32
1920ZwCreateKeyedEvent@16
1921ZwCreateLowBoxToken@36
1922ZwCreateMailslotFile@32
1923ZwCreateMutant@16
1924ZwCreateNamedPipeFile@56
1925ZwCreatePagingFile@16
1926ZwCreatePartition@16
1927ZwCreatePort@20
1928ZwCreatePrivateNamespace@16
1929ZwCreateProcess@32
1930ZwCreateProcessEx@36
1931ZwCreateProcessStateChange@20
1932ZwCreateProfile@36
1933ZwCreateProfileEx@40
1934ZwCreateRegistryTransaction@16
1935ZwCreateResourceManager@28
1936ZwCreateSection@28
1937ZwCreateSectionEx@36
1938ZwCreateSemaphore@20
1939ZwCreateSymbolicLinkObject@16
1940ZwCreateThread@32
1941ZwCreateThreadEx@44
1942ZwCreateThreadStateChange@20
1943ZwCreateTimer2@20
1944ZwCreateTimer@16
1945ZwCreateToken@52
1946ZwCreateTokenEx@68
1947ZwCreateTransaction@40
1948ZwCreateTransactionManager@24
1949ZwCreateUserProcess@44
1950ZwCreateWaitCompletionPacket@12
1951ZwCreateWaitablePort@20
1952ZwCreateWnfStateName@28
1953ZwCreateWorkerFactory@40
1954ZwDebugActiveProcess@8
1955ZwDebugContinue@12
1956ZwDelayExecution@8
1957ZwDeleteAtom@4
1958ZwDeleteBootEntry@4
1959ZwDeleteDriverEntry@4
1960ZwDeleteFile@4
1961ZwDeleteKey@4
1962ZwDeleteObjectAuditAlarm@12
1963ZwDeletePrivateNamespace@4
1964ZwDeleteValueKey@8
1965ZwDeleteWnfStateData@8
1966ZwDeleteWnfStateName@4
1967ZwDeviceIoControlFile@40
1968ZwDirectGraphicsCall@20
1969ZwDisableLastKnownGood@0
1970ZwDisplayString@4
1971ZwDrawText@4
1972ZwDuplicateObject@28
1973ZwDuplicateToken@24
1974ZwEnableLastKnownGood@0
1975ZwEnumerateBootEntries@8
1976ZwEnumerateDriverEntries@8
1977ZwEnumerateKey@24
1978ZwEnumerateSystemEnvironmentValuesEx@12
1979ZwEnumerateTransactionObject@20
1980ZwEnumerateValueKey@24
1981ZwExtendSection@8
1982ZwFilterBootOption@20
1983ZwFilterToken@24
1984ZwFilterTokenEx@56
1985ZwFindAtom@12
1986ZwFlushBuffersFile@8
1987ZwFlushBuffersFileEx@20
1988ZwFlushInstallUILanguage@8
1989ZwFlushInstructionCache@12
1990ZwFlushKey@4
1991ZwFlushProcessWriteBuffers@0
1992ZwFlushVirtualMemory@16
1993ZwFlushWriteBuffer@0
1994ZwFreeUserPhysicalPages@12
1995ZwFreeVirtualMemory@16
1996ZwFreezeRegistry@4
1997ZwFreezeTransactions@8
1998ZwFsControlFile@40
1999ZwGetCachedSigningLevel@24
2000ZwGetCompleteWnfStateSubscription@24
2001ZwGetContextThread@8
2002ZwGetCurrentProcessorNumber@0
2003ZwGetCurrentProcessorNumberEx@4
2004ZwGetDevicePowerState@8
2005ZwGetMUIRegistryInfo@12
2006ZwGetNextProcess@20
2007ZwGetNextThread@24
2008ZwGetNlsSectionPtr@20
2009ZwGetNotificationResourceManager@28
2010ZwGetPlugPlayEvent@16
2011ZwGetTickCount@0
2012ZwGetWriteWatch@28
2013ZwImpersonateAnonymousToken@4
2014ZwImpersonateClientOfPort@8
2015ZwImpersonateThread@12
2016ZwInitializeEnclave@20
2017ZwInitializeNlsFiles@16
2018ZwInitializeRegistry@4
2019ZwInitiatePowerAction@16
2020ZwIsProcessInJob@8
2021ZwIsSystemResumeAutomatic@0
2022ZwIsUILanguageComitted@0
2023ZwListenPort@8
2024ZwLoadDriver@4
2025ZwLoadEnclaveData@36
2026ZwLoadKey2@12
2027ZwLoadKey3@32
2028ZwLoadKey@8
2029ZwLoadKeyEx@32
2030ZwLockFile@40
2031ZwLockProductActivationKeys@8
2032ZwLockRegistryKey@4
2033ZwLockVirtualMemory@16
2034ZwMakePermanentObject@4
2035ZwMakeTemporaryObject@4
2036ZwManageHotPatch@16
2037ZwManagePartition@20
2038ZwMapCMFModule@24
2039ZwMapUserPhysicalPages@12
2040ZwMapUserPhysicalPagesScatter@12
2041ZwMapViewOfSection@40
2042ZwMapViewOfSectionEx@36
2043ZwModifyBootEntry@4
2044ZwModifyDriverEntry@4
2045ZwNotifyChangeDirectoryFile@36
2046ZwNotifyChangeDirectoryFileEx@40
2047ZwNotifyChangeKey@40
2048ZwNotifyChangeMultipleKeys@48
2049ZwNotifyChangeSession@32
2050ZwOpenDirectoryObject@12
2051ZwOpenEnlistment@20
2052ZwOpenEvent@12
2053ZwOpenEventPair@12
2054ZwOpenFile@24
2055ZwOpenIoCompletion@12
2056ZwOpenJobObject@12
2057ZwOpenKey@12
2058ZwOpenKeyEx@16
2059ZwOpenKeyTransacted@16
2060ZwOpenKeyTransactedEx@20
2061ZwOpenKeyedEvent@12
2062ZwOpenMutant@12
2063ZwOpenObjectAuditAlarm@48
2064ZwOpenPartition@12
2065ZwOpenPrivateNamespace@16
2066ZwOpenProcess@16
2067ZwOpenProcessToken@12
2068ZwOpenProcessTokenEx@16
2069ZwOpenRegistryTransaction@12
2070ZwOpenResourceManager@20
2071ZwOpenSection@12
2072ZwOpenSemaphore@12
2073ZwOpenSession@12
2074ZwOpenSymbolicLinkObject@12
2075ZwOpenThread@16
2076ZwOpenThreadToken@16
2077ZwOpenThreadTokenEx@20
2078ZwOpenTimer@12
2079ZwOpenTransaction@20
2080ZwOpenTransactionManager@24
2081ZwPlugPlayControl@12
2082ZwPowerInformation@20
2083ZwPrePrepareComplete@8
2084ZwPrePrepareEnlistment@8
2085ZwPrepareComplete@8
2086ZwPrepareEnlistment@8
2087ZwPrivilegeCheck@12
2088ZwPrivilegeObjectAuditAlarm@24
2089ZwPrivilegedServiceAuditAlarm@20
2090ZwPropagationComplete@16
2091ZwPropagationFailed@12
2092ZwProtectVirtualMemory@20
2093ZwPssCaptureVaSpaceBulk@20
2094ZwPulseEvent@8
2095ZwQueryAttributesFile@8
2096ZwQueryAuxiliaryCounterFrequency@4
2097ZwQueryBootEntryOrder@8
2098ZwQueryBootOptions@8
2099ZwQueryDebugFilterState@8
2100ZwQueryDefaultLocale@8
2101ZwQueryDefaultUILanguage@4
2102ZwQueryDirectoryFile@44
2103ZwQueryDirectoryFileEx@40
2104ZwQueryDirectoryObject@28
2105ZwQueryDriverEntryOrder@8
2106ZwQueryEaFile@36
2107ZwQueryEvent@20
2108ZwQueryFullAttributesFile@8
2109ZwQueryInformationAtom@20
2110ZwQueryInformationByName@20
2111ZwQueryInformationEnlistment@20
2112ZwQueryInformationFile@20
2113ZwQueryInformationJobObject@20
2114ZwQueryInformationPort@20
2115ZwQueryInformationProcess@20
2116ZwQueryInformationResourceManager@20
2117ZwQueryInformationThread@20
2118ZwQueryInformationToken@20
2119ZwQueryInformationTransaction@20
2120ZwQueryInformationTransactionManager@20
2121ZwQueryInformationWorkerFactory@20
2122ZwQueryInstallUILanguage@4
2123ZwQueryIntervalProfile@8
2124ZwQueryIoCompletion@20
2125ZwQueryIoRingCapabilities@8
2126ZwQueryKey@20
2127ZwQueryLicenseValue@20
2128ZwQueryMultipleValueKey@24
2129ZwQueryMutant@20
2130ZwQueryObject@20
2131ZwQueryOpenSubKeys@8
2132ZwQueryOpenSubKeysEx@16
2133ZwQueryPerformanceCounter@8
2134ZwQueryPortInformationProcess@0
2135ZwQueryQuotaInformationFile@36
2136ZwQuerySection@20
2137ZwQuerySecurityAttributesToken@24
2138ZwQuerySecurityObject@20
2139ZwQuerySecurityPolicy@24
2140ZwQuerySemaphore@20
2141ZwQuerySymbolicLinkObject@12
2142ZwQuerySystemEnvironmentValue@16
2143ZwQuerySystemEnvironmentValueEx@20
2144ZwQuerySystemInformation@16
2145ZwQuerySystemInformationEx@24
2146ZwQuerySystemTime@4
2147ZwQueryTimer@20
2148ZwQueryTimerResolution@12
2149ZwQueryValueKey@24
2150ZwQueryVirtualMemory@24
2151ZwQueryVolumeInformationFile@20
2152ZwQueryWnfStateData@24
2153ZwQueryWnfStateNameInformation@20
2154ZwQueueApcThread@20
2155ZwQueueApcThreadEx2@28
2156ZwQueueApcThreadEx@24
2157ZwRaiseException@12
2158ZwRaiseHardError@24
2159ZwReadFile@36
2160ZwReadFileScatter@36
2161ZwReadOnlyEnlistment@8
2162ZwReadRequestData@24
2163ZwReadVirtualMemory@20
2164ZwReadVirtualMemoryEx@24
2165ZwRecoverEnlistment@8
2166ZwRecoverResourceManager@4
2167ZwRecoverTransactionManager@4
2168ZwRegisterProtocolAddressInformation@20
2169ZwRegisterThreadTerminatePort@4
2170ZwReleaseCMFViewOwnership@0
2171ZwReleaseKeyedEvent@16
2172ZwReleaseMutant@8
2173ZwReleaseSemaphore@12
2174ZwReleaseWorkerFactoryWorker@4
2175ZwRemoveIoCompletion@20
2176ZwRemoveIoCompletionEx@24
2177ZwRemoveProcessDebug@8
2178ZwRenameKey@8
2179ZwRenameTransactionManager@8
2180ZwReplaceKey@12
2181ZwReplacePartitionUnit@12
2182ZwReplyPort@8
2183ZwReplyWaitReceivePort@16
2184ZwReplyWaitReceivePortEx@20
2185ZwReplyWaitReplyPort@8
2186ZwRequestDeviceWakeup@4
2187ZwRequestPort@8
2188ZwRequestWaitReplyPort@12
2189ZwRequestWakeupLatency@4
2190ZwResetEvent@8
2191ZwResetWriteWatch@12
2192ZwRestoreKey@12
2193ZwResumeProcess@4
2194ZwResumeThread@8
2195ZwRevertContainerImpersonation@0
2196ZwRollbackComplete@8
2197ZwRollbackEnlistment@8
2198ZwRollbackRegistryTransaction@8
2199ZwRollbackTransaction@8
2200ZwRollforwardTransactionManager@8
2201ZwSaveKey@8
2202ZwSaveKeyEx@12
2203ZwSaveMergedKeys@12
2204ZwSecureConnectPort@36
2205ZwSerializeBoot@0
2206ZwSetBootEntryOrder@8
2207ZwSetBootOptions@8
2208ZwSetCachedSigningLevel2@24
2209ZwSetCachedSigningLevel@20
2210ZwSetContextThread@8
2211ZwSetDebugFilterState@12
2212ZwSetDefaultHardErrorPort@4
2213ZwSetDefaultLocale@8
2214ZwSetDefaultUILanguage@4
2215ZwSetDriverEntryOrder@8
2216ZwSetEaFile@16
2217ZwSetEvent@8
2218ZwSetEventBoostPriority@4
2219ZwSetHighEventPair@4
2220ZwSetHighWaitLowEventPair@4
2221ZwSetIRTimer@8
2222ZwSetInformationDebugObject@20
2223ZwSetInformationEnlistment@16
2224ZwSetInformationFile@20
2225ZwSetInformationIoRing@16
2226ZwSetInformationJobObject@16
2227ZwSetInformationKey@16
2228ZwSetInformationObject@16
2229ZwSetInformationProcess@16
2230ZwSetInformationResourceManager@16
2231ZwSetInformationSymbolicLink@16
2232ZwSetInformationThread@16
2233ZwSetInformationToken@16
2234ZwSetInformationTransaction@16
2235ZwSetInformationTransactionManager@16
2236ZwSetInformationVirtualMemory@24
2237ZwSetInformationWorkerFactory@16
2238ZwSetIntervalProfile@8
2239ZwSetIoCompletion@20
2240ZwSetIoCompletionEx@24
2241ZwSetLdtEntries@24
2242ZwSetLowEventPair@4
2243ZwSetLowWaitHighEventPair@4
2244ZwSetQuotaInformationFile@16
2245ZwSetSecurityObject@12
2246ZwSetSystemEnvironmentValue@8
2247ZwSetSystemEnvironmentValueEx@20
2248ZwSetSystemInformation@12
2249ZwSetSystemPowerState@12
2250ZwSetSystemTime@8
2251ZwSetThreadExecutionState@8
2252ZwSetTimer2@16
2253ZwSetTimer@28
2254ZwSetTimerEx@16
2255ZwSetTimerResolution@12
2256ZwSetUuidSeed@4
2257ZwSetValueKey@24
2258ZwSetVolumeInformationFile@20
2259ZwSetWnfProcessNotificationEvent@4
2260ZwShutdownSystem@4
2261ZwShutdownWorkerFactory@8
2262ZwSignalAndWaitForSingleObject@16
2263ZwSinglePhaseReject@8
2264ZwStartProfile@4
2265ZwStopProfile@4
2266ZwSubmitIoRing@16
2267ZwSubscribeWnfStateChange@16
2268ZwSuspendProcess@4
2269ZwSuspendThread@8
2270ZwSystemDebugControl@24
2271ZwTerminateEnclave@8
2272ZwTerminateJobObject@8
2273ZwTerminateProcess@8
2274ZwTerminateThread@8
2275ZwTestAlert@0
2276ZwThawRegistry@0
2277ZwThawTransactions@0
2278ZwTraceControl@24
2279ZwTraceEvent@16
2280ZwTranslateFilePath@16
2281ZwUmsThreadYield@4
2282ZwUnloadDriver@4
2283ZwUnloadKey2@8
2284ZwUnloadKey@4
2285ZwUnloadKeyEx@8
2286ZwUnlockFile@20
2287ZwUnlockVirtualMemory@16
2288ZwUnmapViewOfSection@8
2289ZwUnmapViewOfSectionEx@12
2290ZwUnsubscribeWnfStateChange@4
2291ZwUpdateWnfStateData@28
2292ZwVdmControl@8
2293ZwWaitForAlertByThreadId@8
2294ZwWaitForDebugEvent@16
2295ZwWaitForKeyedEvent@16
2296ZwWaitForMultipleObjects32@20
2297ZwWaitForMultipleObjects@20
2298ZwWaitForSingleObject@12
2299ZwWaitForWorkViaWorkerFactory@8
2300ZwWaitHighEventPair@4
2301ZwWaitLowEventPair@4
2302ZwWorkerFactoryWorkerReady@4
2303ZwWow64CallFunction64@28
2304ZwWow64CsrAllocateCaptureBuffer@8
2305ZwWow64CsrAllocateMessagePointer@12
2306ZwWow64CsrCaptureMessageBuffer@16
2307ZwWow64CsrCaptureMessageString@20
2308ZwWow64CsrClientCallServer@16
2309ZwWow64CsrClientConnectToServer@20
2310ZwWow64CsrFreeCaptureBuffer@4
2311ZwWow64CsrGetProcessId@0
2312ZwWow64CsrIdentifyAlertableThread@0
2313ZwWow64CsrVerifyRegion@8
2314ZwWow64DebuggerCall@20
2315ZwWow64GetCurrentProcessorNumberEx@4
2316ZwWow64GetNativeSystemInformation@16
2317ZwWow64InterlockedPopEntrySList@4
2318ZwWow64QueryInformationProcess64@20
2319ZwWow64QueryVirtualMemory64@32
2320ZwWow64ReadVirtualMemory64@28
2321ZwWow64WriteVirtualMemory64@28
2322ZwWriteFile@36
2323ZwWriteFileGather@36
2324ZwWriteRequestData@24
2325ZwWriteVirtualMemory@20
2326ZwYieldExecution@0
2327vDbgPrintEx@16
2328vDbgPrintExWithPrefix@20