Commit 851a7288a9

@@ -0,0 +1,2082 @@
+;
+; Definition file of ntdll.dll
+; Automatic generated by gendef
+; written by Kai Tietz 2008
+;
+LIBRARY "ntdll.dll"
+EXPORTS
+RtlActivateActivationContextUnsafeFast@0
+RtlDeactivateActivationContextUnsafeFast@0
+RtlInterlockedPushListSList@8
+@RtlUlongByteSwap@4
+@RtlUlonglongByteSwap@8
+@RtlUshortByteSwap@4
+ExpInterlockedPopEntrySListEnd@0
+ExpInterlockedPopEntrySListFault@0
+ExpInterlockedPopEntrySListResume@0
+RtlpInterlockedPopEntrySeqSListEnd@0
+RtlpInterlockedPopEntrySeqSListFault@0
+RtlpInterlockedPopEntrySeqSListResume@0
+A_SHAFinal@8
+A_SHAInit@4
+A_SHAUpdate@12
+AlpcAdjustCompletionListConcurrencyCount@8
+AlpcFreeCompletionListMessage@8
+AlpcGetCompletionListLastMessageInformation@12
+AlpcGetCompletionListMessageAttributes@8
+AlpcGetHeaderSize@4
+AlpcGetMessageAttribute@8
+AlpcGetMessageFromCompletionList@8
+AlpcGetOutstandingCompletionListMessageCount@4
+AlpcInitializeMessageAttribute@16
+AlpcMaxAllowedMessageLength@0
+AlpcRegisterCompletionList@20
+AlpcRegisterCompletionListWorkerThread@4
+AlpcRundownCompletionList@4
+AlpcUnregisterCompletionList@4
+AlpcUnregisterCompletionListWorkerThread@4
+CsrAllocateCaptureBuffer@8
+CsrAllocateMessagePointer@12
+CsrCaptureMessageBuffer@16
+CsrCaptureMessageMultiUnicodeStringsInPlace@12
+CsrCaptureMessageString@20
+CsrCaptureTimeout@8
+CsrClientCallServer@16
+CsrClientConnectToServer@20
+CsrFreeCaptureBuffer@4
+CsrGetProcessId@0
+CsrIdentifyAlertableThread@0
+CsrNewThread@0
+CsrProbeForRead@12
+CsrProbeForWrite@12
+CsrSetPriorityClass@8
+CsrVerifyRegion@8
+DbgBreakPoint@0
+DbgPrint
+DbgPrintEx
+DbgPrintReturnControlC
+DbgPrompt@12
+DbgQueryDebugFilterState@8
+DbgSetDebugFilterState@12
+DbgSsHandleKmApiMsg@8
+DbgSsInitialize@16
+DbgUiConnectToDbg@0
+DbgUiContinue@8
+DbgUiConvertStateChangeStructure@8
+DbgUiDebugActiveProcess@4
+DbgUiGetThreadDebugObject@0
+DbgUiIssueRemoteBreakin@4
+DbgUiRemoteBreakin@4
+DbgUiSetThreadDebugObject@4
+DbgUiStopDebugging@4
+DbgUiWaitStateChange@8
+DbgUserBreakPoint@0
+EtwCreateTraceInstanceId@8
+EtwDeliverDataBlock@4
+EtwEnumerateProcessRegGuids@12
+EtwEventActivityIdControl@8
+EtwEventEnabled@12
+EtwEventProviderEnabled@20
+EtwEventRegister@16
+EtwEventUnregister@8
+EtwEventWrite@20
+EtwEventWriteEndScenario@20
+EtwEventWriteEx@40
+EtwEventWriteFull@32
+EtwEventWriteNoRegistration@16
+EtwEventWriteStartScenario@20
+EtwEventWriteString@24
+EtwEventWriteTransfer@28
+EtwGetTraceEnableFlags@8
+EtwGetTraceEnableLevel@8
+EtwGetTraceLoggerHandle@4
+EtwLogTraceEvent@12
+EtwNotificationRegister@20
+EtwNotificationUnregister@12
+EtwProcessPrivateLoggerRequest@4
+EtwRegisterSecurityProvider@0
+EtwRegisterTraceGuidsA@32
+EtwRegisterTraceGuidsW@32
+EtwReplyNotification@4
+EtwSendNotification@20
+EtwSetMark@16
+EtwTraceEventInstance@20
+EtwTraceMessage
+EtwTraceMessageVa@24
+EtwUnregisterTraceGuids@8
+EtwWriteUMSecurityEvent@16
+EtwpCreateEtwThread@8
+EtwpGetCpuSpeed@8
+;EtwpNotificationThread
+EvtIntReportAuthzEventAndSourceAsync@44
+EvtIntReportEventAndSourceAsync@44
+KiFastSystemCall@0
+KiFastSystemCallRet@0
+KiIntSystemCall@0
+KiRaiseUserExceptionDispatcher@0
+KiUserApcDispatcher@20
+KiUserCallbackDispatcher@12
+KiUserExceptionDispatcher@8
+LdrAccessResource@16
+LdrAddLoadAsDataTable@16; Check!!! gendef says @20
+LdrAddRefDll@8
+LdrAlternateResourcesEnabled@0
+LdrDisableThreadCalloutsForDll@4
+LdrEnumResources@20
+LdrEnumerateLoadedModules@12
+LdrFindEntryForAddress@8
+LdrFindResourceDirectory_U@16
+LdrFindResourceEx_U@20
+LdrFindResource_U@16
+LdrFlushAlternateResourceModules@0
+LdrGetDllHandle@16
+LdrGetDllHandleByMapping@8
+LdrGetDllHandleByName@12
+LdrGetDllHandleEx@20
+LdrGetFailureData@0
+LdrGetFileNameFromLoadAsDataTable@8
+LdrGetProcedureAddress@16
+LdrGetProcedureAddressEx@20
+LdrHotPatchRoutine@0
+LdrInitShimEngineDynamic@4
+LdrInitializeThunk@16
+LdrLoadAlternateResourceModule@16
+LdrLoadAlternateResourceModuleEx@20
+LdrLoadDll@16
+LdrAlternateResourcesEnabled@0
+LdrLockLoaderLock@12
+LdrOpenImageFileOptionsKey@12
+LdrProcessRelocationBlock@16
+LdrQueryImageFileExecutionOptions@24
+LdrQueryImageFileExecutionOptionsEx@28
+LdrQueryImageFileKeyOption@24
+LdrQueryModuleServiceTags@12
+LdrQueryProcessModuleInformation@12
+LdrRegisterDllNotification@16
+LdrRemoveLoadAsDataTable@16
+LdrResFindResource@36
+LdrResFindResourceDirectory@28
+LdrResGetRCConfig@20
+LdrResRelease@12
+LdrResSearchResource@32
+LdrRscIsTypeExist@16
+LdrSetAppCompatDllRedirectionCallback@12
+LdrSetDllManifestProber@4
+LdrSetMUICacheType@4
+LdrShutdownProcess@0
+LdrShutdownThread@0
+LdrUnloadAlternateResourceModule@4
+LdrUnloadAlternateResourceModuleEx@8
+LdrUnloadDll@4
+LdrUnlockLoaderLock@8
+LdrUnregisterDllNotification@4
+LdrVerifyImageMatchesChecksum@16
+LdrVerifyImageMatchesChecksumEx@8
+LdrWx86FormatVirtualImage@12
+LdrpResGetMappingSize@16
+LdrpResGetRCConfig@20
+LdrpResGetResourceDirectory@20
+MD4Final@4
+MD4Init@4
+MD4Update@12
+MD5Final@4
+MD5Init@4
+MD5Update@12
+NlsAnsiCodePage DATA
+NlsMbCodePageTag DATA
+NlsMbOemCodePageTag DATA
+NtAcceptConnectPort@24
+NtAccessCheck@32
+NtAccessCheckAndAuditAlarm@44
+NtAccessCheckByType@44
+NtAccessCheckByTypeAndAuditAlarm@64
+NtAccessCheckByTypeResultList@44
+NtAccessCheckByTypeResultListAndAuditAlarm@64
+NtAccessCheckByTypeResultListAndAuditAlarmByHandle@68
+NtAcquireCMFViewOwnership@12
+NtAddAtom@12
+NtAddBootEntry@8
+NtAddDriverEntry@8
+NtAdjustGroupsToken@24
+NtAdjustPrivilegesToken@24
+NtAlertResumeThread@8
+NtAlertThread@4
+NtAllocateLocallyUniqueId@4
+NtAllocateReserveObject@12
+NtAllocateUserPhysicalPages@12
+NtAllocateUuids@16
+NtAllocateVirtualMemory@24
+NtAlpcAcceptConnectPort@36
+NtAlpcCancelMessage@12
+NtAlpcConnectPort@44
+NtAlpcCreatePort@12
+NtAlpcCreatePortSection@24
+NtAlpcCreateResourceReserve@16
+NtAlpcCreateSectionView@12
+NtAlpcCreateSecurityContext@12
+NtAlpcDeletePortSection@12
+NtAlpcDeleteResourceReserve@12
+NtAlpcDeleteSectionView@12
+NtAlpcDeleteSecurityContext@12
+NtAlpcDisconnectPort@8
+NtAlpcImpersonateClientOfPort@12
+NtAlpcOpenSenderProcess@24
+NtAlpcOpenSenderThread@24
+NtAlpcQueryInformation@20
+NtAlpcQueryInformationMessage@24
+NtAlpcRevokeSecurityContext@12
+NtAlpcSendWaitReceivePort@32
+NtAlpcSetInformation@16
+NtApphelpCacheControl@8
+NtAreMappedFilesTheSame@8
+NtAssignProcessToJobObject@8
+NtCallbackReturn@12
+NtCancelDeviceWakeupRequest@4
+NtCancelIoFile@8
+NtCancelIoFileEx@12
+NtCancelSynchronousIoFile@12
+NtCancelTimer@8
+NtClearEvent@4
+NtClose@4
+NtCloseObjectAuditAlarm@12
+NtCommitComplete@8
+NtCommitEnlistment@8
+NtCommitTransaction@8
+NtCompactKeys@8
+NtCompareTokens@12
+NtCompleteConnectPort@4
+NtCompressKey@4
+NtConnectPort@32
+NtContinue@8
+NtCreateDebugObject@16
+NtCreateDirectoryObject@12
+NtCreateEnlistment@32
+NtCreateEvent@20
+NtCreateEventPair@12
+NtCreateFile@44
+NtCreateIoCompletion@16
+NtCreateJobObject@12
+NtCreateJobSet@12
+NtCreateKey@28
+NtCreateKeyTransacted@32
+NtCreateKeyedEvent@16
+NtCreateMailslotFile@32
+NtCreateMutant@16
+NtCreateNamedPipeFile@56
+NtCreatePagingFile@16
+NtCreatePort@20
+NtCreatePrivateNamespace@16
+NtCreateProcess@32
+NtCreateProcessEx@36
+NtCreateProfile@36
+NtCreateProfileEx@40
+NtCreateResourceManager@28
+NtCreateSection@28
+NtCreateSemaphore@20
+NtCreateSymbolicLinkObject@16
+NtCreateThread@32
+NtCreateThreadEx@44
+NtCreateTimer@16
+NtCreateToken@52
+NtCreateTransaction@40
+NtCreateTransactionManager@24
+NtCreateUserProcess@44
+NtCreateWaitablePort@20
+NtCreateWorkerFactory@40
+NtCurrentTeb@0
+NtDebugActiveProcess@8
+NtDebugContinue@12
+NtDelayExecution@8
+NtDeleteAtom@4
+NtDeleteBootEntry@4
+NtDeleteDriverEntry@4
+NtDeleteFile@4
+NtDeleteKey@4
+NtDeleteObjectAuditAlarm@12
+NtDeletePrivateNamespace@4
+NtDeleteValueKey@8
+NtDeviceIoControlFile@40
+NtDisableLastKnownGood@0
+NtDisplayString@4
+NtDrawText@4
+NtDuplicateObject@28
+NtDuplicateToken@24
+NtEnableLastKnownGood@0
+NtEnumerateBootEntries@8
+NtEnumerateDriverEntries@8
+NtEnumerateKey@24
+NtEnumerateSystemEnvironmentValuesEx@12
+NtEnumerateTransactionObject@20
+NtEnumerateValueKey@24
+NtExtendSection@8
+NtFilterToken@24
+NtFindAtom@12
+NtFlushBuffersFile@8
+NtFlushInstallUILanguage@8
+NtFlushInstructionCache@12
+NtFlushKey@4
+NtFlushProcessWriteBuffers@0
+NtFlushVirtualMemory@16
+NtFlushWriteBuffer@0
+NtFreeUserPhysicalPages@12
+NtFreeVirtualMemory@16
+NtFreezeRegistry@4
+NtFreezeTransactions@8
+NtFsControlFile@40
+NtGetContextThread@8
+NtGetCurrentProcessorNumber@0
+NtGetDevicePowerState@8
+NtGetMUIRegistryInfo@12
+NtGetNextProcess@20
+NtGetNextThread@24
+NtGetNlsSectionPtr@20
+NtGetNotificationResourceManager@28
+NtGetPlugPlayEvent@16
+NtGetTickCount@0
+NtGetWriteWatch@28
+NtImpersonateAnonymousToken@4
+NtImpersonateClientOfPort@8
+NtImpersonateThread@12
+NtInitializeNlsFiles@16 ;Check!!! gendef says 12
+NtInitializeRegistry@4
+NtInitiatePowerAction@16
+NtIsProcessInJob@8
+NtIsSystemResumeAutomatic@0
+NtIsUILanguageComitted@0
+NtListenPort@8
+NtLoadDriver@4
+NtLoadKey2@12
+NtLoadKey@8
+NtLoadKeyEx@32
+NtLockFile@40
+NtLockProductActivationKeys@8
+NtLockRegistryKey@4
+NtLockVirtualMemory@16
+NtMakePermanentObject@4
+NtMakeTemporaryObject@4
+NtMapCMFModule@24
+NtMapUserPhysicalPages@12
+NtMapUserPhysicalPagesScatter@12
+NtMapViewOfSection@40
+NtModifyBootEntry@4
+NtModifyDriverEntry@4
+NtNotifyChangeDirectoryFile@36
+NtNotifyChangeKey@40
+NtNotifyChangeMultipleKeys@48
+NtNotifyChangeSession@32
+NtOpenDirectoryObject@12
+NtOpenEnlistment@20
+NtOpenEvent@12
+NtOpenEventPair@12
+NtOpenFile@24
+NtOpenIoCompletion@12
+NtOpenJobObject@12
+NtOpenKey@12
+NtOpenKeyEx@16
+NtOpenKeyTransacted@16
+NtOpenKeyTransactedEx@20
+NtOpenKeyedEvent@12
+NtOpenMutant@12
+NtOpenObjectAuditAlarm@48
+NtOpenPrivateNamespace@16
+NtOpenProcess@16
+NtOpenProcessToken@12
+NtOpenProcessTokenEx@16
+NtOpenResourceManager@20
+NtOpenSection@12
+NtOpenSemaphore@12
+NtOpenSession@12
+NtOpenSymbolicLinkObject@12
+NtOpenThread@16
+NtOpenThreadToken@16
+NtOpenThreadTokenEx@20
+NtOpenTimer@12
+NtOpenTransaction@20
+NtOpenTransactionManager@24
+NtPlugPlayControl@12
+NtPowerInformation@20
+NtPrePrepareComplete@8
+NtPrePrepareEnlistment@8
+NtPrepareComplete@8
+NtPrepareEnlistment@8
+NtPrivilegeCheck@12
+NtPrivilegeObjectAuditAlarm@24
+NtPrivilegedServiceAuditAlarm@20
+NtPropagationComplete@16
+NtPropagationFailed@12
+NtProtectVirtualMemory@20
+NtPulseEvent@8
+NtQueryAttributesFile@8
+NtQueryBootEntryOrder@8
+NtQueryBootOptions@8
+NtQueryDebugFilterState@8
+NtQueryDefaultLocale@8
+NtQueryDefaultUILanguage@4
+NtQueryDirectoryFile@44
+NtQueryDirectoryObject@28
+NtQueryDriverEntryOrder@8
+NtQueryEaFile@36
+NtQueryEvent@20
+NtQueryFullAttributesFile@8
+NtQueryInformationAtom@20
+NtQueryInformationEnlistment@20
+NtQueryInformationFile@20
+NtQueryInformationJobObject@20
+NtQueryInformationPort@20
+NtQueryInformationProcess@20
+NtQueryInformationResourceManager@20
+NtQueryInformationThread@20
+NtQueryInformationToken@20
+NtQueryInformationTransaction@20
+NtQueryInformationTransactionManager@20
+NtQueryInformationWorkerFactory@20
+NtQueryInstallUILanguage@4
+NtQueryIntervalProfile@8
+NtQueryIoCompletion@20
+NtQueryKey@20
+NtQueryLicenseValue@20
+NtQueryMultipleValueKey@24
+NtQueryMutant@20
+NtQueryObject@20
+NtQueryOpenSubKeys@8
+NtQueryOpenSubKeysEx@16
+NtQueryPerformanceCounter@8
+NtQueryPortInformationProcess@0
+NtQueryQuotaInformationFile@36
+NtQuerySection@20
+NtQuerySecurityAttributesToken@24
+NtQuerySecurityObject@20
+NtQuerySemaphore@20
+NtQuerySymbolicLinkObject@12
+NtQuerySystemEnvironmentValue@16
+NtQuerySystemEnvironmentValueEx@20
+NtQuerySystemInformation@16
+NtQuerySystemInformationEx@24
+NtQuerySystemTime@4
+NtQueryTimer@20
+NtQueryTimerResolution@12
+NtQueryValueKey@24
+NtQueryVirtualMemory@24
+NtQueryVolumeInformationFile@20
+NtQueueApcThread@20
+NtQueueApcThreadEx@24
+NtRaiseException@12
+NtRaiseHardError@24
+NtReadFile@36
+NtReadFileScatter@36
+NtReadOnlyEnlistment@8
+NtReadRequestData@24
+NtReadVirtualMemory@20
+NtRecoverEnlistment@8
+NtRecoverResourceManager@4
+NtRecoverTransactionManager@4
+NtRegisterProtocolAddressInformation@20
+NtRegisterThreadTerminatePort@4
+NtReleaseCMFViewOwnership@0
+NtReleaseKeyedEvent@16
+NtReleaseMutant@8
+NtReleaseSemaphore@12
+NtReleaseWorkerFactoryWorker@4
+NtRemoveIoCompletion@20
+NtRemoveIoCompletionEx@24
+NtRemoveProcessDebug@8
+NtRenameKey@8
+NtRenameTransactionManager@8
+NtReplaceKey@12
+NtReplacePartitionUnit@12
+NtReplyPort@8
+NtReplyWaitReceivePort@16
+NtReplyWaitReceivePortEx@20
+NtReplyWaitReplyPort@8
+NtRequestDeviceWakeup@4
+NtRequestPort@8
+NtRequestWaitReplyPort@12
+NtRequestWakeupLatency@4
+NtResetEvent@8
+NtResetWriteWatch@12
+NtRestoreKey@12
+NtResumeProcess@4
+NtResumeThread@8
+NtRollbackComplete@8
+NtRollbackEnlistment@8
+NtRollbackTransaction@8
+NtRollforwardTransactionManager@8
+NtSaveKey@8
+NtSaveKeyEx@12
+NtSaveMergedKeys@12
+NtSecureConnectPort@36
+NtSerializeBoot@0
+NtSetBootEntryOrder@8
+NtSetBootOptions@8
+NtSetContextThread@8
+NtSetDebugFilterState@12
+NtSetDefaultHardErrorPort@4
+NtSetDefaultLocale@8
+NtSetDefaultUILanguage@4
+NtSetDriverEntryOrder@8
+NtSetEaFile@16
+NtSetEvent@8
+NtSetEventBoostPriority@4
+NtSetHighEventPair@4
+NtSetHighWaitLowEventPair@4
+NtSetInformationDebugObject@20
+NtSetInformationEnlistment@16
+NtSetInformationFile@20
+NtSetInformationJobObject@16
+NtSetInformationKey@16
+NtSetInformationObject@16
+NtSetInformationProcess@16
+NtSetInformationResourceManager@16
+NtSetInformationThread@16
+NtSetInformationToken@16
+NtSetInformationTransaction@16
+NtSetInformationTransactionManager@16
+NtSetInformationWorkerFactory@16
+NtSetIntervalProfile@8
+NtSetIoCompletion@20
+NtSetIoCompletionEx@24
+NtSetLdtEntries@24
+NtSetLowEventPair@4
+NtSetLowWaitHighEventPair@4
+NtSetQuotaInformationFile@16
+NtSetSecurityObject@12
+NtSetSystemEnvironmentValue@8
+NtSetSystemEnvironmentValueEx@20
+NtSetSystemInformation@12
+NtSetSystemPowerState@12
+NtSetSystemTime@8
+NtSetThreadExecutionState@8
+NtSetTimer@28
+NtSetTimerEx@16
+NtSetTimerResolution@12
+NtSetUuidSeed@4
+NtSetValueKey@24
+NtSetVolumeInformationFile@20
+NtShutdownSystem@4
+NtShutdownWorkerFactory@8
+NtSignalAndWaitForSingleObject@16
+NtSinglePhaseReject@8
+NtStartProfile@4
+NtStopProfile@4
+NtSuspendProcess@4
+NtSuspendThread@8
+NtSystemDebugControl@24
+NtTerminateJobObject@8
+NtTerminateProcess@8
+NtTerminateThread@8
+NtTestAlert@0
+NtThawRegistry@0
+NtThawTransactions@0
+NtTraceControl@24
+NtTraceEvent@16
+NtTranslateFilePath@16
+NtUmsThreadYield@4
+NtUnloadDriver@4
+NtUnloadKey2@8
+NtUnloadKey@4
+NtUnloadKeyEx@8
+NtUnlockFile@20
+NtUnlockVirtualMemory@16
+NtUnmapViewOfSection@8
+NtVdmControl@8
+NtWaitForDebugEvent@16
+NtWaitForKeyedEvent@16
+NtWaitForMultipleObjects32@20
+NtWaitForMultipleObjects@20
+NtWaitForSingleObject@12
+NtWaitForWorkViaWorkerFactory@8
+NtWaitHighEventPair@4
+NtWaitLowEventPair@4
+NtWorkerFactoryWorkerReady@4
+NtWow64CallFunction64@28
+NtWow64CsrAllocateCaptureBuffer@8
+NtWow64CsrAllocateMessagePointer@12
+NtWow64CsrCaptureMessageBuffer@16
+NtWow64CsrCaptureMessageString@20
+NtWow64CsrClientCallServer@16
+NtWow64CsrClientConnectToServer@20
+NtWow64CsrFreeCaptureBuffer@4
+NtWow64CsrGetProcessId@0
+NtWow64CsrIdentifyAlertableThread@0
+NtWow64CsrVerifyRegion@8
+NtWow64DebuggerCall@20
+NtWow64GetCurrentProcessorNumberEx@4
+NtWow64GetNativeSystemInformation@16
+NtWow64InterlockedPopEntrySList@4
+NtWow64QueryInformationProcess64@20
+NtWow64QueryVirtualMemory64@32
+NtWow64ReadVirtualMemory64@28
+NtWow64WriteVirtualMemory64@28
+NtWriteFile@36
+NtWriteFileGather@36
+NtWriteRequestData@24
+NtWriteVirtualMemory@20
+NtYieldExecution@0
+; Not sure, but we assume here standard DefWindowProc arguments
+NtdllDefWindowProc_A@16
+NtdllDefWindowProc_W@16
+; Not sure, but we assume here standard DefDlgProc arguments
+NtdllDialogWndProc_A@16
+NtdllDialogWndProc_W@16
+PfxFindPrefix@8
+PfxInitialize@4
+PfxInsertPrefix@12
+PfxRemovePrefix@8
+RtlAbortRXact@4
+RtlAbsoluteToSelfRelativeSD@12
+RtlAcquirePebLock@0
+RtlAcquirePrivilege@16
+RtlAcquireReleaseSRWLockExclusive@4
+RtlAcquireResourceExclusive@8
+RtlAcquireResourceShared@8
+RtlAcquireSRWLockExclusive@4
+RtlAcquireSRWLockShared@4
+RtlActivateActivationContext@12
+RtlActivateActivationContextEx@16
+RtlAddAccessAllowedAce@16
+RtlAddAccessAllowedAceEx@20
+RtlAddAccessAllowedObjectAce@28
+RtlAddAccessDeniedAce@16
+RtlAddAccessDeniedAceEx@20
+RtlAddAccessDeniedObjectAce@28
+RtlAddAce@20
+RtlAddActionToRXact@24
+RtlAddAtomToAtomTable@12
+RtlAddAttributeActionToRXact@32
+RtlAddAuditAccessAce@24
+RtlAddAuditAccessAceEx@28
+RtlAddAuditAccessObjectAce@36
+RtlAddCompoundAce@24
+RtlAddIntegrityLabelToBoundaryDescriptor@8
+RtlAddMandatoryAce@24
+RtlAddRefActivationContext@4
+RtlAddRange@36
+RtlAddRefMemoryStream@4
+RtlAddSIDToBoundaryDescriptor@8
+RtlAddVectoredContinueHandler@8
+RtlAddVectoredExceptionHandler@8
+RtlAddressInSectionTable@12
+RtlAdjustPrivilege@16
+RtlAllocateActivationContextStack@4
+RtlAllocateAndInitializeSid@44
+RtlAllocateHandle@8
+RtlAllocateHeap@12
+RtlAllocateMemoryBlockLookaside@12
+RtlAllocateMemoryZone@12
+RtlAnsiCharToUnicodeChar@4
+RtlAnsiStringToUnicodeSize@4
+RtlAnsiStringToUnicodeString@12
+RtlAppendAsciizToString@8
+RtlAppendPathElement@12
+RtlAppendStringToString@8
+RtlAppendUnicodeStringToString@8
+RtlAppendUnicodeToString@8
+RtlApplicationVerifierStop@40
+RtlApplyRXact@4
+RtlApplyRXactNoFlush@4
+RtlAreAllAccessesGranted@8
+RtlAreAnyAccessesGranted@8
+RtlAreBitsClear@12
+RtlAreBitsSet@12
+RtlAssert@16
+RtlBarrier@8
+RtlBarrierForDelete@8
+RtlCallbackLpcClient@12
+RtlCancelTimer@8
+RtlCaptureContext@4
+RtlCaptureStackBackTrace@16
+RtlCaptureStackContext@12
+RtlCharToInteger@12
+RtlCheckForOrphanedCriticalSections@4
+RtlCheckRegistryKey@8
+RtlCleanUpTEBLangLists@0
+RtlClearAllBits@4
+RtlClearBits@12
+RtlCloneMemoryStream@8
+RtlCloneUserProcess@20
+RtlCmDecodeMemIoResource@8
+RtlCmEncodeMemIoResource@24
+RtlCommitDebugInfo@8
+RtlCommitMemoryStream@8
+RtlCompactHeap@8
+RtlCompareAltitudes@8
+RtlCompareMemory@12
+RtlCompareMemoryUlong@12
+RtlCompareString@12
+RtlCompareUnicodeString@12
+RtlCompareUnicodeStrings@20
+RtlCompressBuffer@32
+RtlComputeCrc32@12
+RtlComputeImportTableHash@12
+RtlComputePrivatizedDllName_U@12
+RtlConnectToSm@16
+RtlConsoleMultiByteToUnicodeN@24
+RtlContractHashTable@4
+RtlConvertExclusiveToShared@4
+RtlConvertLCIDToString@20
+RtlConvertLongToLargeInteger@4
+RtlConvertSharedToExclusive@4
+RtlConvertSidToUnicodeString@12
+RtlConvertToAutoInheritSecurityObject@24
+RtlConvertUiListToApiList@12
+RtlConvertUlongToLargeInteger@4
+RtlCopyExtendedContext@12
+RtlCopyLuid@8
+RtlCopyLuidAndAttributesArray@12
+RtlCopyMappedMemory@12
+RtlCopyMemoryStreamTo@24
+RtlCopyOutOfProcessMemoryStreamTo@24
+RtlCopyRangeList@8
+RtlCopySecurityDescriptor@8
+RtlCopySid@12
+RtlCopySidAndAttributesArray@28
+RtlCopyString@8
+RtlCopyUnicodeString@8
+RtlCreateAcl@12
+RtlCreateActivationContext@24
+RtlCreateAndSetSD@20
+RtlCreateAtomTable@8
+RtlCreateBootStatusDataFile@4
+RtlCreateBoundaryDescriptor@8
+RtlCreateEnvironment@8
+RtlCreateEnvironmentEx@12
+RtlCreateHashTable@12
+RtlCreateHeap@24
+RtlCreateLpcServer@24
+RtlCreateMemoryBlockLookaside@20
+RtlCreateMemoryZone@12
+RtlCreateProcessParameters@40
+RtlCreateProcessParametersEx@44
+RtlCreateProcessReflection@24
+RtlCreateQueryDebugBuffer@8
+RtlCreateRegistryKey@8
+RtlCreateSecurityDescriptor@8
+RtlCreateServiceSid@12
+RtlCreateSystemVolumeInformationFolder@4
+RtlCreateTagHeap@16
+RtlCreateTimer@28
+RtlCreateTimerQueue@4
+RtlCreateUnicodeString@8
+RtlCreateUnicodeStringFromAsciiz@8
+RtlCreateUserProcess@40
+RtlCreateUserSecurityObject@28
+RtlCreateUserStack@24
+RtlCreateUserThread@40
+RtlCreateVirtualAccountSid@16
+RtlCultureNameToLCID@8
+RtlCustomCPToUnicodeN@24
+RtlCutoverTimeToSystemTime@16
+RtlDeCommitDebugInfo@12
+RtlDeNormalizeProcessParams@4
+RtlDeactivateActivationContext@8
+RtlDebugPrintTimes@0
+RtlDecodePointer@4
+RtlDecodeSystemPointer@4
+RtlDecompressBuffer@24
+RtlDecompressFragment@32
+RtlDefaultNpAcl@4
+RtlDelete@4
+RtlDeleteAce@8
+RtlDeleteAtomFromAtomTable@8
+RtlDeleteBarrier@4
+RtlDeleteBoundaryDescriptor@4
+RtlDeleteCriticalSection@4
+RtlDeleteElementGenericTable@8
+RtlDeleteElementGenericTableAvl@8
+RtlDeleteHashTable@4
+RtlDeleteNoSplay@8
+RtlDeleteOwnersRanges@8
+RtlDeleteRange@24
+RtlDeleteRegistryValue@12
+RtlDeleteResource@4
+RtlDeleteSecurityObject@4
+RtlDeleteTimer@12
+RtlDeleteTimerQueue@4
+RtlDeleteTimerQueueEx@8
+RtlDeNormalizeProcessParams@4
+RtlDeregisterSecureMemoryCacheCallback@4
+RtlDeregisterWait@4
+RtlDeregisterWaitEx@8
+RtlDestroyAtomTable@4
+RtlDestroyEnvironment@4
+RtlDestroyHandleTable@4
+RtlDestroyHeap@4
+RtlDestroyMemoryBlockLookaside@4
+RtlDestroyMemoryZone@4
+RtlDestroyProcessParameters@4
+RtlDestroyQueryDebugBuffer@4
+RtlDetectHeapLeaks@0
+RtlDetermineDosPathNameType_U@4
+RtlDisableThreadProfiling@4
+RtlDllShutdownInProgress@0
+RtlDnsHostNameToComputerName@12
+RtlDoesFileExists_U@4
+RtlDosApplyFileIsolationRedirection_Ustr@36
+RtlDosPathNameToNtPathName_U@16
+RtlDosPathNameToNtPathName_U_WithStatus@16
+RtlDosPathNameToRelativeNtPathName_U@16
+RtlDosPathNameToRelativeNtPathName_U_WithStatus@16
+RtlDosSearchPath_U@24
+RtlDosSearchPath_Ustr@36
+RtlDowncaseUnicodeChar@4
+RtlDowncaseUnicodeString@12
+RtlDumpResource@4
+RtlDuplicateUnicodeString@12
+RtlEmptyAtomTable@8
+RtlEnableEarlyCriticalSectionEventCreation@0
+RtlEnableThreadProfiling@20
+RtlEncodePointer@4
+RtlEncodeSystemPointer@4
+RtlEndEnumerationHashTable@8
+RtlEndWeakEnumerationHashTable@8
+RtlEnlargedIntegerMultiply@8
+RtlEnlargedUnsignedDivide@16
+RtlEnlargedUnsignedMultiply@8
+RtlEnterCriticalSection@4
+RtlEnumProcessHeaps@8
+RtlEnumerateEntryHashTable@8
+RtlEnumerateGenericTable@8
+RtlEnumerateGenericTableAvl@8
+RtlEnumerateGenericTableLikeADirectory@28
+RtlEnumerateGenericTableWithoutSplaying@8
+RtlEnumerateGenericTableWithoutSplayingAvl@8
+RtlEqualComputerName@8
+RtlEqualDomainName@8
+RtlEqualLuid@8
+RtlEqualPrefixSid@8
+RtlEqualSid@8
+RtlEqualString@12
+RtlEqualUnicodeString@12
+RtlEraseUnicodeString@4
+RtlEthernetAddressToStringA@8
+RtlEthernetAddressToStringW@8
+RtlEthernetStringToAddressA@12
+RtlEthernetStringToAddressW@12
+RtlExitUserProcess@4
+; Not sure, but we assume @4
+RtlExitUserThread@4
+RtlExpandEnvironmentStrings@24
+RtlExpandEnvironmentStrings_U@16
+RtlExpandHashTable@4
+RtlExtendMemoryBlockLookaside@8
+RtlExtendMemoryZone@8
+RtlExtendedIntegerMultiply@12
+RtlExtendedLargeIntegerDivide@16
+RtlExtendedMagicDivide@20
+RtlExtendHeap@16
+RtlFillMemory@12
+RtlFillMemoryUlong@12
+RtlFillMemoryUlonglong@16
+RtlFinalReleaseOutOfProcessMemoryStream@4
+RtlFindAceByType@12
+RtlFindActivationContextSectionGuid@20
+RtlFindActivationContextSectionString@20
+RtlFindCharInUnicodeString@16
+RtlFindClearBits@12
+RtlFindClearBitsAndSet@12
+RtlFindClearRuns@16
+RtlFindClosestEncodableLength@12
+RtlFindLastBackwardRunClear@12
+RtlFindLeastSignificantBit@8
+RtlFindLongestRunClear@8
+RtlFindLongestRunSet@8
+RtlFindMessage@20
+RtlFindMostSignificantBit@8
+RtlFindNextForwardRunClear@12
+RtlFindRange@48
+RtlFindSetBits@12
+RtlFindSetBitsAndClear@12
+RtlFirstEntrySList@4
+RtlFirstFreeAce@8
+RtlFlsAlloc@8
+RtlFlsFree@4
+RtlFlushSecureMemoryCache@8
+RtlFormatCurrentUserKeyPath@4
+RtlFormatMessage@36
+RtlFormatMessageEx@40
+RtlFreeActivationContextStack@4
+RtlFreeAnsiString@4
+RtlFreeHandle@8
+RtlFreeHeap@12
+RtlFreeMemoryBlockLookaside@8
+RtlFreeOemString@4
+RtlFreeSid@4
+RtlFreeThreadActivationContextStack@0
+RtlFreeUnicodeString@4
+RtlFreeUserStack@4
+RtlFreeUserThreadStack@8
+RtlGUIDFromString@8
+RtlGenerate8dot3Name@16
+RtlGetAce@12
+RtlGetActiveActivationContext@4
+RtlGetCallersAddress@8
+RtlGetCompressionWorkSpaceSize@12
+RtlGetControlSecurityDescriptor@12
+RtlGetCriticalSectionRecursionCount@4
+RtlGetCurrentDirectory_U@8
+RtlGetCurrentPeb@0
+RtlGetCurrentProcessorNumber@0
+RtlGetCurrentProcessorNumberEx@4
+RtlGetCurrentTransaction@0
+RtlGetDaclSecurityDescriptor@16
+RtlGetElementGenericTable@8
+RtlGetElementGenericTableAvl@8
+RtlGetEnabledExtendedFeatures@8
+RtlGetExtendedContextLength@8
+RtlGetExtendedFeaturesMask@4
+RtlGetFileMUIPath@28
+RtlGetFirstRange@12
+RtlGetFrame@0
+RtlGetFullPathName_U@16
+RtlGetFullPathName_UEx@20
+RtlGetFullPathName_UstrEx@32
+RtlGetGroupSecurityDescriptor@12
+RtlGetIntegerAtom@8
+RtlGetLastNtStatus@0
+RtlGetLastWin32Error@0
+RtlGetLengthWithoutLastFullDosOrNtPathElement@12
+RtlGetLengthWithoutTrailingPathSeperators@12
+RtlGetLocaleFileMappingAddress@12
+RtlGetLongestNtPathLength@0
+RtlGetNativeSystemInformation@16
+RtlGetNextRange@12
+RtlGetNextEntryHashTable@8
+RtlGetNtGlobalFlags@0
+RtlGetNtProductType@4
+RtlGetNtVersionNumbers@12
+RtlGetOwnerSecurityDescriptor@12
+RtlGetParentLocaleName@16
+RtlGetProcessHeaps@8
+RtlGetProcessPreferredUILanguages@16
+RtlGetProductInfo@20
+RtlGetSaclSecurityDescriptor@16
+RtlGetSecurityDescriptorRMControl@8
+RtlGetSetBootStatusData@24
+RtlGetSystemPreferredUILanguages@20
+RtlGetThreadErrorMode@0
+RtlGetThreadLangIdByIndex@16
+RtlGetThreadPreferredUILanguages@16
+RtlGetUILanguageInfo@20
+RtlGetUnloadEventTrace@0
+RtlGetUnloadEventTraceEx@12
+RtlGetUserInfoHeap@20
+RtlGetUserPreferredUILanguages@20
+RtlGetVersion@4
+RtlGUIDFromString@8
+RtlHashUnicodeString@16
+RtlHeapTrkInitialize@4
+RtlIdentifierAuthoritySid@4
+RtlIdnToAscii@20
+RtlIdnToNameprepUnicode@20
+RtlIdnToUnicode@20
+RtlImageDirectoryEntryToData@16
+RtlImageNtHeader@4
+RtlImageNtHeaderEx@20
+RtlImageRvaToSection@12
+RtlImageRvaToVa@16
+RtlImpersonateLpcClient@8
+RtlImpersonateSelf@4
+RtlImpersonateSelfEx@12
+RtlInitAnsiString@8
+RtlInitAnsiStringEx@8
+RtlInitBarrier@12
+RtlInitCodePageTable@8
+RtlInitEnumerationHashTable@8
+RtlInitMemoryStream@4
+RtlInitNlsTables@16
+RtlInitOutOfProcessMemoryStream@4
+RtlInitString@8
+RtlInitUnicodeString@8
+RtlInitUnicodeStringEx@8
+RtlInitWeakEnumerationHashTable@8
+RtlInitializeAtomPackage@4
+RtlInitializeBitMap@12
+RtlInitializeConditionVariable@4
+RtlInitializeContext@20
+RtlInitializeCriticalSection@4
+RtlInitializeCriticalSectionAndSpinCount@8
+RtlInitializeCriticalSectionEx@12
+RtlInitializeExceptionChain@4
+RtlInitializeExtendedContext@12
+RtlInitializeGenericTable@20
+RtlInitializeGenericTableAvl@20
+RtlInitializeHandleTable@12
+RtlInitializeNtUserPfn@24
+RtlInitializeRXact@12
+RtlInitializeResource@4
+RtlInitializeSListHead@4
+RtlInitializeSRWLock@4
+RtlInitializeSid@12
+RtlInsertElementGenericTable@16
+RtlInsertElementGenericTableAvl@16
+RtlInsertElementGenericTableFull@24
+RtlInsertElementGenericTableFullAvl@24
+RtlInsertEntryHashTable@16
+RtlInt64ToUnicodeString@16
+RtlIntegerToChar@16
+RtlIntegerToUnicodeString@12
+RtlInterlockedClearBitRun@12
+RtlInterlockedCompareExchange64@20
+RtlInterlockedFlushSList@4
+RtlInterlockedPopEntrySList@4
+RtlInterlockedPushEntrySList@8
+RtlInvertRangeList@8
+RtlInterlockedSetBitRun@12
+RtlIoDecodeMemIoResource@16
+RtlIoEncodeMemIoResource@40
+RtlIpv4AddressToStringA@8
+RtlIpv4AddressToStringExA@16
+RtlIpv4AddressToStringExW@16
+RtlIpv4AddressToStringW@8
+RtlIpv4StringToAddressA@16
+RtlIpv4StringToAddressExA@16
+RtlIpv4StringToAddressExW@16
+RtlIpv4StringToAddressW@16
+RtlIpv6AddressToStringA@8
+RtlIpv6AddressToStringExA@20
+RtlIpv6AddressToStringExW@20
+RtlIpv6AddressToStringW@8
+RtlIpv6StringToAddressA@12
+RtlIpv6StringToAddressExA@16
+RtlIpv6StringToAddressExW@16
+RtlIpv6StringToAddressW@12
+RtlIsActivationContextActive@4
+RtlIsCriticalSectionLocked@4
+RtlIsCriticalSectionLockedByThread@4
+RtlIsCurrentThreadAttachExempt@0
+RtlIsDosDeviceName_U@4
+RtlIsGenericTableEmpty@4
+RtlIsGenericTableEmptyAvl@4
+RtlIsNameInExpression@16
+RtlIsNameLegalDOS8Dot3@12
+RtlIsNormalizedString@16
+RtlIsRangeAvailable@40
+RtlIsTextUnicode@12
+RtlIsThreadWithinLoaderCallout@0
+RtlIsValidHandle@8
+RtlIsValidIndexHandle@12
+RtlIsValidLocaleName@8
+RtlKnownExceptionFilter@4
+RtlLCIDToCultureName@8
+RtlLargeIntegerAdd@16
+RtlLargeIntegerArithmeticShift@12
+RtlLargeIntegerDivide@20
+RtlLargeIntegerNegate@8
+RtlLargeIntegerShiftLeft@12
+RtlLargeIntegerShiftRight@12
+RtlLargeIntegerSubtract@16
+RtlLargeIntegerToChar@16
+RtlLcidToLocaleName@16
+RtlLeaveCriticalSection@4
+RtlLengthRequiredSid@4
+RtlLengthSecurityDescriptor@4
+RtlLengthSid@4
+RtlLoadString@32
+RtlLocalTimeToSystemTime@8
+RtlLocaleNameToLcid@12
+RtlLocateExtendedFeature@12
+RtlLocateLegacyContext@8
+RtlLockBootStatusData@4
+RtlLockCurrentThread@0
+RtlLockHeap@4
+RtlLockMemoryBlockLookaside@4
+RtlLockMemoryStreamRegion@24
+RtlLockMemoryZone@4
+RtlLockModuleSection@4
+RtlLogStackBackTrace@0
+RtlLookupAtomInAtomTable@12
+RtlLookupElementGenericTable@8
+RtlLookupElementGenericTableAvl@8
+RtlLookupElementGenericTableFull@16
+RtlLookupElementGenericTableFullAvl@16
+RtlLookupEntryHashTable@12
+RtlMakeSelfRelativeSD@12
+RtlMapGenericMask@8
+RtlMapSecurityErrorToNtStatus@4
+RtlMergeRangeLists@16
+RtlMoveMemory@12
+RtlMultiAppendUnicodeStringBuffer@12
+RtlMultiByteToUnicodeN@20
+RtlMultiByteToUnicodeSize@12
+RtlMultipleAllocateHeap@20
+RtlMultipleFreeHeap@16
+RtlNewInstanceSecurityObject@40
+RtlNewSecurityGrantedAccess@24
+RtlNewSecurityObject@24
+RtlNewSecurityObjectEx@32
+RtlNewSecurityObjectWithMultipleInheritance@36
+RtlNormalizeProcessParams@4
+RtlNormalizeString@20
+RtlNtPathNameToDosPathName@16
+RtlNtStatusToDosError@4
+RtlNtStatusToDosErrorNoTeb@4
+RtlNumberGenericTableElements@4
+RtlNumberGenericTableElementsAvl@4
+RtlNumberOfClearBits@4
+RtlNumberOfSetBits@4
+RtlNumberOfSetBitsUlongPtr@4
+RtlOemStringToUnicodeSize@4
+RtlOemStringToUnicodeString@12
+RtlOemToUnicodeN@20
+RtlOpenCurrentUser@8
+RtlOwnerAcesPresent@4
+RtlPcToFileHeader@8
+RtlPinAtomInAtomTable@8
+RtlPopFrame@4
+RtlPrefixString@12
+RtlPrefixUnicodeString@12
+RtlProcessFlsData@4
+RtlProtectHeap@8
+RtlPushFrame@4
+RtlQueryActivationContextApplicationSettings@28
+RtlQueryAtomInAtomTable@24
+RtlQueryCriticalSectionOwner@4
+RtlQueryDepthSList@4
+RtlQueryDynamicTimeZoneInformation@4
+RtlQueryElevationFlags@4
+RtlQueryEnvironmentVariable@24
+RtlQueryEnvironmentVariable_U@12
+RtlQueryHeapInformation@20
+RtlQueryInformationAcl@16
+RtlQueryInformationActivationContext@28
+RtlQueryInformationActiveActivationContext@16
+RtlQueryInterfaceMemoryStream@12
+RtlQueryModuleInformation@12
+RtlQueryPerformanceCounter@4
+RtlQueryPerformanceFrequency@4
+RtlQueryProcessBackTraceInformation@4
+RtlQueryProcessDebugInformation@12
+RtlQueryProcessHeapInformation@4
+RtlQueryProcessLockInformation@4
+RtlQueryRegistryValues@20
+RtlQuerySecurityObject@20
+RtlQueryTagHeap@20
+RtlQueryThreadProfiling@8
+RtlQueryTimeZoneInformation@4
+RtlQueueApcWow64Thread@20
+RtlQueueWorkItem@12
+RtlRaiseException@4
+RtlRaiseStatus@4
+RtlRandom@4
+RtlRandomEx@4
+RtlReAllocateHeap@16
+RtlReadMemoryStream@16
+RtlReadOutOfProcessMemoryStream@16
+RtlReadThreadProfilingData@12
+RtlRealPredecessor@4
+RtlRealSuccessor@4
+RtlRegisterSecureMemoryCacheCallback@4
+RtlRegisterThreadWithCsrss@0
+RtlRegisterWait@24
+RtlReleaseActivationContext@4
+RtlReleaseMemoryStream@4
+RtlReleasePebLock@0
+RtlReleasePrivilege@4
+RtlReleaseRelativeName@4
+RtlReleaseResource@4
+RtlReleaseSRWLockExclusive@4
+RtlReleaseSRWLockShared@4
+RtlRemoteCall@28
+RtlRemoveEntryHashTable@12
+RtlRemovePrivileges@12
+RtlRemoveVectoredContinueHandler@4
+RtlRemoveVectoredExceptionHandler@4
+RtlReplaceSidInSd@16
+RtlReportException@12
+RtlReportSilentProcessExit@8
+RtlReportSqmEscalation@24
+RtlResetMemoryBlockLookaside@4
+RtlResetMemoryZone@4
+RtlResetRtlTranslations@4
+RtlRestoreLastWin32Error@4
+RtlRetrieveNtUserPfn@12
+RtlRevertMemoryStream@4
+RtlRunDecodeUnicodeString@8
+RtlRunEncodeUnicodeString@8
+RtlRunOnceBeginInitialize@12
+RtlRunOnceComplete@12
+RtlRunOnceExecuteOnce@16
+RtlRunOnceInitialize@4
+RtlSecondsSince1970ToTime@8
+RtlSecondsSince1980ToTime@8
+RtlSeekMemoryStream@20
+RtlSelfRelativeToAbsoluteSD2@8
+RtlSelfRelativeToAbsoluteSD@44
+RtlSendMsgToSm@8
+RtlSetAllBits@4
+RtlSetAttributesSecurityDescriptor@12
+RtlSetBits@12
+RtlSetControlSecurityDescriptor@12
+RtlSetCriticalSectionSpinCount@8
+RtlSetCurrentDirectory_U@4
+RtlSetCurrentEnvironment@8
+RtlSetCurrentTransaction@4
+RtlSetDaclSecurityDescriptor@16
+RtlSetDynamicTimeZoneInformation@4
+RtlSetEnvironmentStrings@8
+RtlSetEnvironmentVar@20
+RtlSetEnvironmentVariable@12
+RtlSetExtendedFeaturesMask@12
+RtlSetGroupSecurityDescriptor@12
+RtlSetHeapInformation@16
+RtlSetInformationAcl@16
+RtlSetIoCompletionCallback@12
+RtlSetLastWin32Error@4
+RtlSetLastWin32ErrorAndNtStatusFromNtStatus@4
+RtlSetMemoryStreamSize@12
+RtlSetOwnerSecurityDescriptor@12
+RtlSetProcessDebugInformation@12
+RtlSetProcessIsCritical@0
+RtlSetProcessPreferredUILanguages@12
+RtlSetSaclSecurityDescriptor@16
+RtlSetSecurityDescriptorRMControl@8
+RtlSetSecurityObject@20
+RtlSetSecurityObjectEx@24
+RtlSetThreadErrorMode@8
+RtlSetThreadIsCritical@0
+RtlSetThreadPoolStartFunc@8
+RtlSetThreadPreferredUILanguages@12
+RtlSetTimeZoneInformation@4
+RtlSetTimer@28
+RtlSetUnhandledExceptionFilter@4
+RtlSetUserCallbackExceptionFilter@4
+RtlSetUserFlagsHeap@20
+RtlSetUserValueHeap@16
+RtlShutdownLpcServer@4
+RtlSidDominates@12
+RtlSidEqualLevel@12
+RtlSidHashInitialize@12
+RtlSidHashLookup@8
+RtlSidIsHigherLevel@12
+RtlSizeHeap@12
+RtlSleepConditionVariableCS@12
+RtlSleepConditionVariableSRW@16
+RtlSplay@4
+RtlStartRXact@4
+RtlStatMemoryStream@12
+RtlStringFromGUID@8
+RtlSubAuthorityCountSid@4
+RtlSubAuthoritySid@8
+RtlSubtreePredecessor@4
+RtlSubtreeSuccessor@4
+RtlSystemTimeToLocalTime@8
+RtlTestBit@8
+RtlTimeFieldsToTime@8
+RtlTimeToElapsedTimeFields@8
+RtlTimeToSecondsSince1970@8
+RtlTimeToSecondsSince1980@8
+RtlTimeToTimeFields@8
+RtlTraceDatabaseAdd@16
+RtlTraceDatabaseCreate@20
+RtlTraceDatabaseDestroy@4
+RtlTraceDatabaseEnumerate@12
+RtlTraceDatabaseFind@16
+RtlTraceDatabaseLock@4
+RtlTraceDatabaseUnlock@4
+RtlTraceDatabaseValidate@4
+RtlTryAcquirePebLock@0
+RtlTryAcquireSRWLockExclusive@4
+RtlTryAcquireSRWLockShared@4
+RtlTryEnterCriticalSection@4
+RtlUTF8ToUnicodeN@20
+RtlUnhandledExceptionFilter2@8
+RtlUnhandledExceptionFilter@4
+RtlUnicodeStringToAnsiSize@4
+RtlUnicodeStringToAnsiString@12
+RtlUnicodeStringToCountedOemString@12
+RtlUnicodeStringToInteger@12
+RtlUnicodeStringToOemSize@4
+RtlUnicodeStringToOemString@12
+RtlUnicodeToCustomCPN@24
+RtlUnicodeToMultiByteN@20
+RtlUnicodeToMultiByteSize@12
+RtlUnicodeToOemN@20
+RtlUnicodeToUTF8N@20
+RtlUniform@4
+RtlUnlockBootStatusData@4
+RtlUnlockCurrentThread@0
+RtlUnlockHeap@4
+RtlUnlockMemoryBlockLookaside@4
+RtlUnlockMemoryStreamRegion@24
+RtlUnlockMemoryZone@4
+RtlUnlockModuleSection@4
+RtlUnwind@16
+RtlUpcaseUnicodeChar@4
+RtlUpcaseUnicodeString@12
+RtlUpcaseUnicodeStringToAnsiString@12
+RtlUpcaseUnicodeStringToCountedOemString@12
+RtlUpcaseUnicodeStringToOemString@12
+RtlUpcaseUnicodeToCustomCPN@24
+RtlUpcaseUnicodeToMultiByteN@20
+RtlUpcaseUnicodeToOemN@20
+RtlUpdateClonedCriticalSection@4
+RtlUpdateClonedSRWLock@8
+RtlUpdateTimer@16
+RtlUpperChar@4
+RtlUpperString@8
+RtlUsageHeap@12
+; Not sure.
+RtlUserThreadStart
+RtlValidAcl@4
+RtlValidRelativeSecurityDescriptor@12
+RtlValidSecurityDescriptor@4
+RtlValidSid@4
+RtlValidateHeap@12
+RtlValidateProcessHeaps@0
+RtlValidateUnicodeString@8
+RtlVerifyVersionInfo@16
+RtlWakeAllConditionVariable@4
+RtlWakeConditionVariable@4
+RtlWalkFrameChain@12
+RtlWalkHeap@8
+RtlWeaklyEnumerateEntryHashTable@8
+RtlWerpReportException@16
+RtlWow64CallFunction64@28
+RtlWow64EnableFsRedirection@4
+RtlWow64EnableFsRedirectionEx@8
+RtlWow64LogMessageInEventLogger@12
+RtlWriteMemoryStream@16
+RtlWriteRegistryValue@24
+RtlZeroHeap@8
+RtlZeroMemory@8
+RtlZombifyActivationContext@4
+RtlpApplyLengthFunction@16
+RtlpCheckDynamicTimeZoneInformation@8
+RtlpCleanupRegistryKeys@0
+RtlpConvertCultureNamesToLCIDs@8
+RtlpConvertLCIDsToCultureNames@8
+RtlpCreateProcessRegistryInfo@4
+RtlpEnsureBufferSize@12
+RtlpGetLCIDFromLangInfoNode@12
+RtlpGetNameFromLangInfoNode@12
+RtlpGetSystemDefaultUILanguage@4 ; Check!!! gendef says @8
+RtlpGetUserOrMachineUILanguage4NLS@12
+RtlpInitializeLangRegistryInfo@4
+RtlpIsQualifiedLanguage@12
+RtlpLoadMachineUIByPolicy@12
+RtlpLoadUserUIByPolicy@12
+RtlpMuiFreeLangRegistryInfo@4
+RtlpMuiRegCreateRegistryInfo@0
+RtlpMuiRegFreeRegistryInfo@8
+RtlpMuiRegLoadRegistryInfo@8
+RtlpNotOwnerCriticalSection@0 ; Check!!! gebdef says @4
+RtlpNtCreateKey@24
+RtlpNtEnumerateSubKey@16
+RtlpNtMakeTemporaryKey@4
+RtlpNtOpenKey@16
+RtlpNtQueryValueKey@20
+RtlpNtSetValueKey@16
+RtlpQueryDefaultUILanguage@8
+; Not sure.
+RtlpQueryProcessDebugInformationRemote
+RtlpRefreshCachedUILanguage@8
+RtlpSetInstallLanguage@8
+RtlpSetPreferredUILanguages@12
+RtlpSetUserPreferredUILanguages@12
+RtlpUnWaitCriticalSection@4
+RtlpVerifyAndCommitUILanguageSettings@4
+RtlpWaitForCriticalSection@4
+RtlxAnsiStringToUnicodeSize@4
+RtlxOemStringToUnicodeSize@4
+RtlxUnicodeStringToAnsiSize@4
+RtlxUnicodeStringToOemSize@4
+SbExecuteProcedure@20
+SbSelectProcedure@16
+ShipAssert@8
+ShipAssertGetBufferInfo@8
+ShipAssertMsgA@12
+ShipAssertMsgW@12
+TpAllocAlpcCompletion@20
+TpAllocAlpcCompletionEx@20
+TpAllocCleanupGroup@4
+TpAllocIoCompletion@20
+TpAllocPool@8
+TpAllocTimer@16
+TpAllocWait@16
+TpAllocWork@16
+TpAlpcRegisterCompletionList@4
+TpAlpcUnregisterCompletionList@4
+TpCallbackIndependent@4
+TpCallbackLeaveCriticalSectionOnCompletion@8
+TpCallbackMayRunLong@4
+TpCallbackReleaseMutexOnCompletion@8
+TpCallbackReleaseSemaphoreOnCompletion@12
+TpCallbackSetEventOnCompletion@8
+TpCallbackUnloadDllOnCompletion@8
+TpCancelAsyncIoOperation@4
+TpCaptureCaller@4
+TpCheckTerminateWorker@4
+TpDbgDumpHeapUsage@12
+TpDbgGetFreeInfo@8
+TpDbgSetLogRoutine@4
+TpDisablePoolCallbackChecks@4
+TpDisassociateCallback@4
+TpIsTimerSet@4
+TpPoolFreeUnusedNodes@4
+TpPostWork@4
+TpQueryPoolStackInformation@8
+TpReleaseAlpcCompletion@4
+TpReleaseCleanupGroup@4
+TpReleaseCleanupGroupMembers@12
+TpReleaseIoCompletion@4
+TpReleasePool@4
+TpReleaseTimer@4
+TpReleaseWait@4
+TpReleaseWork@4
+TpSetDefaultPoolMaxThreads@4
+TpSetDefaultPoolStackInformation@4
+TpSetPoolMaxThreads@8
+TpSetPoolMinThreads@8
+TpSetPoolStackInformation@8
+TpSetTimer@16
+TpSetWait@12
+TpSimpleTryPost@12
+TpStartAsyncIoOperation@4
+TpWaitForAlpcCompletion@4
+TpWaitForIoCompletion@8
+TpWaitForTimer@8
+TpWaitForWait@8
+TpWaitForWork@8
+VerSetConditionMask@16
+WerCheckEventEscalation@8
+WerReportSQMEvent@12
+WerReportWatsonEvent@16
+WerReportSQMEvent@16
+WinSqmAddToAverageDWORD@12
+WinSqmAddToStream@16
+WinSqmAddToStreamEx@20
+WinSqmCheckEscalationAddToStreamEx@20
+WinSqmCheckEscalationSetDWORD64@20
+WinSqmCheckEscalationSetDWORD@16
+WinSqmCheckEscalationSetString@16
+WinSqmCommonDatapointDelete@4
+WinSqmCommonDatapointSetDWORD64@16
+WinSqmCommonDatapointSetDWORD@12
+WinSqmCommonDatapointSetStreamEx@20
+WinSqmCommonDatapointSetString@12
+WinSqmEndSession@4
+WinSqmEventEnabled@8
+WinSqmEventWrite@12
+WinSqmGetEscalationRuleStatus@8
+WinSqmGetInstrumentationProperty@16
+WinSqmIncrementDWORD@12
+WinSqmIsOptedIn@0
+WinSqmIsOptedInEx@4
+WinSqmSetDWORD64@16
+WinSqmSetDWORD@12
+WinSqmSetEscalationInfo@16
+WinSqmSetIfMaxDWORD@12
+WinSqmSetIfMinDWORD@12
+WinSqmSetString@12
+WinSqmStartSession@12
+ZwAcceptConnectPort@24
+ZwAccessCheck@32
+ZwAccessCheckAndAuditAlarm@44
+ZwAccessCheckByType@44
+ZwAccessCheckByTypeAndAuditAlarm@64
+ZwAccessCheckByTypeResultList@44
+ZwAccessCheckByTypeResultListAndAuditAlarm@64
+ZwAccessCheckByTypeResultListAndAuditAlarmByHandle@68
+ZwAcquireCMFViewOwnership@12
+ZwAddAtom@12
+ZwAddBootEntry@8
+ZwAddDriverEntry@8
+ZwAdjustGroupsToken@24
+ZwAdjustPrivilegesToken@24
+ZwAlertResumeThread@8
+ZwAlertThread@4
+ZwAllocateLocallyUniqueId@4
+ZwAllocateReserveObject@12
+ZwAllocateUserPhysicalPages@12
+ZwAllocateUuids@16
+ZwAllocateVirtualMemory@24
+ZwAlpcAcceptConnectPort@36
+ZwAlpcCancelMessage@12
+ZwAlpcConnectPort@44
+ZwAlpcCreatePort@12
+ZwAlpcCreatePortSection@24
+ZwAlpcCreateResourceReserve@16
+ZwAlpcCreateSectionView@12
+ZwAlpcCreateSecurityContext@12
+ZwAlpcDeletePortSection@12
+ZwAlpcDeleteResourceReserve@12
+ZwAlpcDeleteSectionView@12
+ZwAlpcDeleteSecurityContext@12
+ZwAlpcDisconnectPort@8
+ZwAlpcImpersonateClientOfPort@12
+ZwAlpcOpenSenderProcess@24
+ZwAlpcOpenSenderThread@24
+ZwAlpcQueryInformation@20
+ZwAlpcQueryInformationMessage@24
+ZwAlpcRevokeSecurityContext@12
+ZwAlpcSendWaitReceivePort@32
+ZwAlpcSetInformation@16
+ZwApphelpCacheControl@8
+ZwAreMappedFilesTheSame@8
+ZwAssignProcessToJobObject@8
+ZwCallbackReturn@12
+ZwCancelDeviceWakeupRequest@4
+ZwCancelIoFile@8
+ZwCancelIoFileEx@12
+ZwCancelSynchronousIoFile@12
+ZwCancelTimer@8
+ZwClearEvent@4
+ZwClose@4
+ZwCloseObjectAuditAlarm@12
+ZwCommitComplete@8
+ZwCommitEnlistment@8
+ZwCommitTransaction@8
+ZwCompactKeys@8
+ZwCompareTokens@12
+ZwCompleteConnectPort@4
+ZwCompressKey@4
+ZwConnectPort@32
+ZwContinue@8
+ZwCreateDebugObject@16
+ZwCreateDirectoryObject@12
+ZwCreateEnlistment@32
+ZwCreateEvent@20
+ZwCreateEventPair@12
+ZwCreateFile@44
+ZwCreateIoCompletion@16
+ZwCreateJobObject@12
+ZwCreateJobSet@12
+ZwCreateKey@28
+ZwCreateKeyTransacted@32
+ZwCreateKeyedEvent@16
+ZwCreateMailslotFile@32
+ZwCreateMutant@16
+ZwCreateNamedPipeFile@56
+ZwCreatePagingFile@16
+ZwCreatePort@20
+ZwCreatePrivateNamespace@16
+ZwCreateProcess@32
+ZwCreateProcessEx@36
+ZwCreateProfile@36
+ZwCreateProfileEx@40
+ZwCreateResourceManager@28
+ZwCreateSection@28
+ZwCreateSemaphore@20
+ZwCreateSymbolicLinkObject@16
+ZwCreateThread@32
+ZwCreateThreadEx@44
+ZwCreateTimer@16
+ZwCreateToken@52
+ZwCreateTransaction@40
+ZwCreateTransactionManager@24
+ZwCreateUserProcess@44
+ZwCreateWaitablePort@20
+ZwCreateWorkerFactory@40
+ZwDebugActiveProcess@8
+ZwDebugContinue@12
+ZwDelayExecution@8
+ZwDeleteAtom@4
+ZwDeleteBootEntry@4
+ZwDeleteDriverEntry@4
+ZwDeleteFile@4
+ZwDeleteKey@4
+ZwDeleteObjectAuditAlarm@12
+ZwDeletePrivateNamespace@4
+ZwDeleteValueKey@8
+ZwDeviceIoControlFile@40
+ZwDisableLastKnownGood@0
+ZwDisplayString@4
+ZwDrawText@4
+ZwDuplicateObject@28
+ZwDuplicateToken@24
+ZwEnableLastKnownGood@0
+ZwEnumerateBootEntries@8
+ZwEnumerateDriverEntries@8
+ZwEnumerateKey@24
+ZwEnumerateSystemEnvironmentValuesEx@12
+ZwEnumerateTransactionObject@20
+ZwEnumerateValueKey@24
+ZwExtendSection@8
+ZwFilterToken@24
+ZwFindAtom@12
+ZwFlushBuffersFile@8
+ZwFlushInstallUILanguage@8
+ZwFlushInstructionCache@12
+ZwFlushKey@4
+ZwFlushProcessWriteBuffers@0
+ZwFlushVirtualMemory@16
+ZwFlushWriteBuffer@0
+ZwFreeUserPhysicalPages@12
+ZwFreeVirtualMemory@16
+ZwFreezeRegistry@4
+ZwFreezeTransactions@8
+ZwFsControlFile@40
+ZwGetContextThread@8
+ZwGetCurrentProcessorNumber@0
+ZwGetDevicePowerState@8
+ZwGetMUIRegistryInfo@12
+ZwGetNextProcess@20
+ZwGetNextThread@24
+ZwGetNlsSectionPtr@20
+ZwGetNotificationResourceManager@28
+ZwGetPlugPlayEvent@16
+ZwGetTickCount@0
+ZwGetWriteWatch@28
+ZwImpersonateAnonymousToken@4
+ZwImpersonateClientOfPort@8
+ZwImpersonateThread@12
+ZwInitializeNlsFiles@16
+ZwInitializeRegistry@4
+ZwInitiatePowerAction@16
+ZwIsProcessInJob@8
+ZwIsSystemResumeAutomatic@0
+ZwIsUILanguageComitted@0
+ZwListenPort@8
+ZwLoadDriver@4
+ZwLoadKey2@12
+ZwLoadKey@8
+ZwLoadKeyEx@32
+ZwLockFile@40
+ZwLockProductActivationKeys@8
+ZwLockRegistryKey@4
+ZwLockVirtualMemory@16
+ZwMakePermanentObject@4
+ZwMakeTemporaryObject@4
+ZwMapCMFModule@24
+ZwMapUserPhysicalPages@12
+ZwMapUserPhysicalPagesScatter@12
+ZwMapViewOfSection@40
+ZwModifyBootEntry@4
+ZwModifyDriverEntry@4
+ZwNotifyChangeDirectoryFile@36
+ZwNotifyChangeKey@40
+ZwNotifyChangeMultipleKeys@48
+ZwNotifyChangeSession@32
+ZwOpenDirectoryObject@12
+ZwOpenEnlistment@20
+ZwOpenEvent@12
+ZwOpenEventPair@12
+ZwOpenFile@24
+ZwOpenIoCompletion@12
+ZwOpenJobObject@12
+ZwOpenKey@12
+ZwOpenKeyEx@16
+ZwOpenKeyTransacted@16
+ZwOpenKeyTransactedEx@20
+ZwOpenKeyedEvent@12
+ZwOpenMutant@12
+ZwOpenObjectAuditAlarm@48
+ZwOpenPrivateNamespace@16
+ZwOpenProcess@16
+ZwOpenProcessToken@12
+ZwOpenProcessTokenEx@16
+ZwOpenResourceManager@20
+ZwOpenSection@12
+ZwOpenSemaphore@12
+ZwOpenSession@12
+ZwOpenSymbolicLinkObject@12
+ZwOpenThread@16
+ZwOpenThreadToken@16
+ZwOpenThreadTokenEx@20
+ZwOpenTimer@12
+ZwOpenTransaction@20
+ZwOpenTransactionManager@24
+ZwPlugPlayControl@12
+ZwPowerInformation@20
+ZwPrePrepareComplete@8
+ZwPrePrepareEnlistment@8
+ZwPrepareComplete@8
+ZwPrepareEnlistment@8
+ZwPrivilegeCheck@12
+ZwPrivilegeObjectAuditAlarm@24
+ZwPrivilegedServiceAuditAlarm@20
+ZwPropagationComplete@16
+ZwPropagationFailed@12
+ZwProtectVirtualMemory@20
+ZwPulseEvent@8
+ZwQueryAttributesFile@8
+ZwQueryBootEntryOrder@8
+ZwQueryBootOptions@8
+ZwQueryDebugFilterState@8
+ZwQueryDefaultLocale@8
+ZwQueryDefaultUILanguage@4
+ZwQueryDirectoryFile@44
+ZwQueryDirectoryObject@28
+ZwQueryDriverEntryOrder@8
+ZwQueryEaFile@36
+ZwQueryEvent@20
+ZwQueryFullAttributesFile@8
+ZwQueryInformationAtom@20
+ZwQueryInformationEnlistment@20
+ZwQueryInformationFile@20
+ZwQueryInformationJobObject@20
+ZwQueryInformationPort@20
+ZwQueryInformationProcess@20
+ZwQueryInformationResourceManager@20
+ZwQueryInformationThread@20
+ZwQueryInformationToken@20
+ZwQueryInformationTransaction@20
+ZwQueryInformationTransactionManager@20
+ZwQueryInformationWorkerFactory@20
+ZwQueryInstallUILanguage@4
+ZwQueryIntervalProfile@8
+ZwQueryIoCompletion@20
+ZwQueryKey@20
+ZwQueryLicenseValue@20
+ZwQueryMultipleValueKey@24
+ZwQueryMutant@20
+ZwQueryObject@20
+ZwQueryOpenSubKeys@8
+ZwQueryOpenSubKeysEx@16
+ZwQueryPerformanceCounter@8
+ZwQueryPortInformationProcess@0
+ZwQueryQuotaInformationFile@36
+ZwQuerySection@20
+ZwQuerySecurityAttributesToken@24
+ZwQuerySecurityObject@20
+ZwQuerySemaphore@20
+ZwQuerySymbolicLinkObject@12
+ZwQuerySystemEnvironmentValue@16
+ZwQuerySystemEnvironmentValueEx@20
+ZwQuerySystemInformation@16
+ZwQuerySystemInformationEx@24
+ZwQuerySystemTime@4
+ZwQueryTimer@20
+ZwQueryTimerResolution@12
+ZwQueryValueKey@24
+ZwQueryVirtualMemory@24
+ZwQueryVolumeInformationFile@20
+ZwQueueApcThread@20
+ZwQueueApcThreadEx@24
+ZwRaiseException@12
+ZwRaiseHardError@24
+ZwReadFile@36
+ZwReadFileScatter@36
+ZwReadOnlyEnlistment@8
+ZwReadRequestData@24
+ZwReadVirtualMemory@20
+ZwRecoverEnlistment@8
+ZwRecoverResourceManager@4
+ZwRecoverTransactionManager@4
+ZwRegisterProtocolAddressInformation@20
+ZwRegisterThreadTerminatePort@4
+ZwReleaseCMFViewOwnership@0
+ZwReleaseKeyedEvent@16
+ZwReleaseMutant@8
+ZwReleaseSemaphore@12
+ZwReleaseWorkerFactoryWorker@4
+ZwRemoveIoCompletion@20
+ZwRemoveIoCompletionEx@24
+ZwRemoveProcessDebug@8
+ZwRenameKey@8
+ZwRenameTransactionManager@8
+ZwReplaceKey@12
+ZwReplacePartitionUnit@12
+ZwReplyPort@8
+ZwReplyWaitReceivePort@16
+ZwReplyWaitReceivePortEx@20
+ZwReplyWaitReplyPort@8
+ZwRequestDeviceWakeup@4
+ZwRequestPort@8
+ZwRequestWaitReplyPort@12
+ZwRequestWakeupLatency@4
+ZwResetEvent@8
+ZwResetWriteWatch@12
+ZwRestoreKey@12
+ZwResumeProcess@4
+ZwResumeThread@8
+ZwRollbackComplete@8
+ZwRollbackEnlistment@8
+ZwRollbackTransaction@8
+ZwRollforwardTransactionManager@8
+ZwSaveKey@8
+ZwSaveKeyEx@12
+ZwSaveMergedKeys@12
+ZwSecureConnectPort@36
+ZwSerializeBoot@0
+ZwSetBootEntryOrder@8
+ZwSetBootOptions@8
+ZwSetContextThread@8
+ZwSetDebugFilterState@12
+ZwSetDefaultHardErrorPort@4
+ZwSetDefaultLocale@8
+ZwSetDefaultUILanguage@4
+ZwSetDriverEntryOrder@8
+ZwSetEaFile@16
+ZwSetEvent@8
+ZwSetEventBoostPriority@4
+ZwSetHighEventPair@4
+ZwSetHighWaitLowEventPair@4
+ZwSetInformationDebugObject@20
+ZwSetInformationEnlistment@16
+ZwSetInformationFile@20
+ZwSetInformationJobObject@16
+ZwSetInformationKey@16
+ZwSetInformationObject@16
+ZwSetInformationProcess@16
+ZwSetInformationResourceManager@16
+ZwSetInformationThread@16
+ZwSetInformationToken@16
+ZwSetInformationTransaction@16
+ZwSetInformationTransactionManager@16
+ZwSetInformationWorkerFactory@16
+ZwSetIntervalProfile@8
+ZwSetIoCompletion@20
+ZwSetIoCompletionEx@24
+ZwSetLdtEntries@24
+ZwSetLowEventPair@4
+ZwSetLowWaitHighEventPair@4
+ZwSetQuotaInformationFile@16
+ZwSetSecurityObject@12
+ZwSetSystemEnvironmentValue@8
+ZwSetSystemEnvironmentValueEx@20
+ZwSetSystemInformation@12
+ZwSetSystemPowerState@12
+ZwSetSystemTime@8
+ZwSetThreadExecutionState@8
+ZwSetTimer@28
+ZwSetTimerEx@16
+ZwSetTimerResolution@12
+ZwSetUuidSeed@4
+ZwSetValueKey@24
+ZwSetVolumeInformationFile@20
+ZwShutdownSystem@4
+ZwShutdownWorkerFactory@8
+ZwSignalAndWaitForSingleObject@16
+ZwSinglePhaseReject@8
+ZwStartProfile@4
+ZwStopProfile@4
+ZwSuspendProcess@4
+ZwSuspendThread@8
+ZwSystemDebugControl@24
+ZwTerminateJobObject@8
+ZwTerminateProcess@8
+ZwTerminateThread@8
+ZwTestAlert@0
+ZwThawRegistry@0
+ZwThawTransactions@0
+ZwTraceControl@24
+ZwTraceEvent@16
+ZwTranslateFilePath@16
+ZwUmsThreadYield@4
+ZwUnloadDriver@4
+ZwUnloadKey2@8
+ZwUnloadKey@4
+ZwUnloadKeyEx@8
+ZwUnlockFile@20
+ZwUnlockVirtualMemory@16
+ZwUnmapViewOfSection@8
+ZwVdmControl@8
+ZwWaitForDebugEvent@16
+ZwWaitForKeyedEvent@16
+ZwWaitForMultipleObjects32@20
+ZwWaitForMultipleObjects@20
+ZwWaitForSingleObject@12
+ZwWaitForWorkViaWorkerFactory@8
+ZwWaitHighEventPair@4
+ZwWaitLowEventPair@4
+ZwWorkerFactoryWorkerReady@4
+ZwWow64CallFunction64@28
+ZwWow64CsrAllocateCaptureBuffer@8
+ZwWow64CsrAllocateMessagePointer@12
+ZwWow64CsrCaptureMessageBuffer@16
+ZwWow64CsrCaptureMessageString@20
+ZwWow64CsrClientCallServer@16
+ZwWow64CsrClientConnectToServer@20
+ZwWow64CsrFreeCaptureBuffer@4
+ZwWow64CsrGetProcessId@0
+ZwWow64CsrIdentifyAlertableThread@0
+ZwWow64CsrVerifyRegion@8
+ZwWow64DebuggerCall@20
+ZwWow64GetCurrentProcessorNumberEx@4
+ZwWow64GetNativeSystemInformation@16
+ZwWow64InterlockedPopEntrySList@4
+ZwWow64QueryInformationProcess64@20
+ZwWow64QueryVirtualMemory64@32
+ZwWow64ReadVirtualMemory64@28
+ZwWow64WriteVirtualMemory64@28
+ZwWriteFile@36
+ZwWriteFileGather@36
+ZwWriteRequestData@24
+ZwWriteVirtualMemory@20
+ZwYieldExecution@0
+_CIcos
+_CIlog
+_CIpow
+_CIsin
+_CIsqrt
+__isascii
+__iscsym
+__iscsymf
+__toascii
+_alldiv
+_alldvrm@16
+_allmul@16
+_alloca_probe
+_alloca_probe_16
+_alloca_probe_8
+_allrem@16
+_allshl
+_allshr
+_atoi64
+_aulldiv@16
+_aulldvrm@16
+_aullrem@16
+_aullshr
+;_chkstk
+_fltused DATA
+_ftol
+_i64toa
+_i64toa_s
+_i64tow
+_i64tow_s
+_itoa
+_itoa_s
+_itow
+_itow_s
+_lfind
+_ltoa
+_ltoa_s
+_ltow
+_ltow_s
+_makepath_s
+_memccpy
+_memicmp
+_snprintf
+_snprintf_s
+_snscanf_s
+_snwprintf
+_snwprintf_s
+_snwscanf_s
+_splitpath
+_splitpath_s
+_strcmpi
+_stricmp
+_strlwr
+_strnicmp
+_strnset_s
+_strset_s
+_strupr
+_swprintf
+_tolower
+_toupper
+_ui64toa
+_ui64toa_s
+_ui64tow
+_ui64tow_s
+_ultoa
+_ultoa_s
+_ultow
+_ultow_s
+_vscwprintf
+_vsnprintf
+_vsnprintf_s
+_vsnwprintf
+_vsnwprintf_s
+_vswprintf
+_wcsicmp
+_wcslwr
+_wcsnicmp
+_wcsnset_s
+_wcsset_s
+_wcstoui64
+_wcsupr
+_wmakepath_s
+_wsplitpath_s
+_wtoi
+_wtoi64
+_wtol
+abs
+atan DATA
+atoi
+atol
+bsearch
+ceil
+cos DATA
+fabs DATA
+floor DATA
+isalnum
+isalpha
+iscntrl
+isdigit
+isgraph
+islower
+isprint
+ispunct
+isspace
+isupper
+iswalpha
+iswctype
+iswdigit
+iswlower
+iswspace
+iswxdigit
+isxdigit
+labs
+log
+mbstowcs
+memchr
+memcmp
+memcpy
+memcpy_s
+memmove
+memmove_s
+memset
+pow
+qsort
+sin
+sprintf
+sprintf_s
+sqrt
+sscanf
+sscanf_s
+strcat
+strcat_s
+strchr
+strcmp
+strcpy
+strcpy_s
+strcspn
+strlen
+strncat
+strncat_s
+strncmp
+strncpy
+strncpy_s
+strnlen
+strpbrk
+strrchr
+strspn
+strstr
+strtok_s
+strtol
+strtoul
+swprintf
+swprintf_s
+swscanf_s
+tan
+tolower
+toupper
+towlower
+towupper
+vDbgPrintEx@16
+vDbgPrintExWithPrefix@20
+vsprintf
+vsprintf_s
+vswprintf_s
+wcscat
+wcscat_s
+wcschr
+wcscmp
+wcscpy
+wcscpy_s
+wcscspn
+wcslen
+wcsncat
+wcsncat_s
+wcsncmp
+wcsncpy
+wcsncpy_s
+wcsnlen
+wcspbrk
+wcsrchr
+wcsspn
+wcsstr
+wcstol
+wcstombs
+wcstoul