2083 lines
48 KiB
Modula-2
2083 lines
48 KiB
Modula-2
;
|
|
; Definition file of ntdll.dll
|
|
; Automatic generated by gendef
|
|
; written by Kai Tietz 2008
|
|
;
|
|
LIBRARY "ntdll.dll"
|
|
EXPORTS
|
|
RtlActivateActivationContextUnsafeFast@0
|
|
RtlDeactivateActivationContextUnsafeFast@0
|
|
RtlInterlockedPushListSList@8
|
|
@RtlUlongByteSwap@4
|
|
@RtlUlonglongByteSwap@8
|
|
@RtlUshortByteSwap@4
|
|
ExpInterlockedPopEntrySListEnd@0
|
|
ExpInterlockedPopEntrySListFault@0
|
|
ExpInterlockedPopEntrySListResume@0
|
|
RtlpInterlockedPopEntrySeqSListEnd@0
|
|
RtlpInterlockedPopEntrySeqSListFault@0
|
|
RtlpInterlockedPopEntrySeqSListResume@0
|
|
A_SHAFinal@8
|
|
A_SHAInit@4
|
|
A_SHAUpdate@12
|
|
AlpcAdjustCompletionListConcurrencyCount@8
|
|
AlpcFreeCompletionListMessage@8
|
|
AlpcGetCompletionListLastMessageInformation@12
|
|
AlpcGetCompletionListMessageAttributes@8
|
|
AlpcGetHeaderSize@4
|
|
AlpcGetMessageAttribute@8
|
|
AlpcGetMessageFromCompletionList@8
|
|
AlpcGetOutstandingCompletionListMessageCount@4
|
|
AlpcInitializeMessageAttribute@16
|
|
AlpcMaxAllowedMessageLength@0
|
|
AlpcRegisterCompletionList@20
|
|
AlpcRegisterCompletionListWorkerThread@4
|
|
AlpcRundownCompletionList@4
|
|
AlpcUnregisterCompletionList@4
|
|
AlpcUnregisterCompletionListWorkerThread@4
|
|
CsrAllocateCaptureBuffer@8
|
|
CsrAllocateMessagePointer@12
|
|
CsrCaptureMessageBuffer@16
|
|
CsrCaptureMessageMultiUnicodeStringsInPlace@12
|
|
CsrCaptureMessageString@20
|
|
CsrCaptureTimeout@8
|
|
CsrClientCallServer@16
|
|
CsrClientConnectToServer@20
|
|
CsrFreeCaptureBuffer@4
|
|
CsrGetProcessId@0
|
|
CsrIdentifyAlertableThread@0
|
|
CsrNewThread@0
|
|
CsrProbeForRead@12
|
|
CsrProbeForWrite@12
|
|
CsrSetPriorityClass@8
|
|
CsrVerifyRegion@8
|
|
DbgBreakPoint@0
|
|
DbgPrint
|
|
DbgPrintEx
|
|
DbgPrintReturnControlC
|
|
DbgPrompt@12
|
|
DbgQueryDebugFilterState@8
|
|
DbgSetDebugFilterState@12
|
|
DbgSsHandleKmApiMsg@8
|
|
DbgSsInitialize@16
|
|
DbgUiConnectToDbg@0
|
|
DbgUiContinue@8
|
|
DbgUiConvertStateChangeStructure@8
|
|
DbgUiDebugActiveProcess@4
|
|
DbgUiGetThreadDebugObject@0
|
|
DbgUiIssueRemoteBreakin@4
|
|
DbgUiRemoteBreakin@4
|
|
DbgUiSetThreadDebugObject@4
|
|
DbgUiStopDebugging@4
|
|
DbgUiWaitStateChange@8
|
|
DbgUserBreakPoint@0
|
|
EtwCreateTraceInstanceId@8
|
|
EtwDeliverDataBlock@4
|
|
EtwEnumerateProcessRegGuids@12
|
|
EtwEventActivityIdControl@8
|
|
EtwEventEnabled@12
|
|
EtwEventProviderEnabled@20
|
|
EtwEventRegister@16
|
|
EtwEventUnregister@8
|
|
EtwEventWrite@20
|
|
EtwEventWriteEndScenario@20
|
|
EtwEventWriteEx@40
|
|
EtwEventWriteFull@32
|
|
EtwEventWriteNoRegistration@16
|
|
EtwEventWriteStartScenario@20
|
|
EtwEventWriteString@24
|
|
EtwEventWriteTransfer@28
|
|
EtwGetTraceEnableFlags@8
|
|
EtwGetTraceEnableLevel@8
|
|
EtwGetTraceLoggerHandle@4
|
|
EtwLogTraceEvent@12
|
|
EtwNotificationRegister@20
|
|
EtwNotificationUnregister@12
|
|
EtwProcessPrivateLoggerRequest@4
|
|
EtwRegisterSecurityProvider@0
|
|
EtwRegisterTraceGuidsA@32
|
|
EtwRegisterTraceGuidsW@32
|
|
EtwReplyNotification@4
|
|
EtwSendNotification@20
|
|
EtwSetMark@16
|
|
EtwTraceEventInstance@20
|
|
EtwTraceMessage
|
|
EtwTraceMessageVa@24
|
|
EtwUnregisterTraceGuids@8
|
|
EtwWriteUMSecurityEvent@16
|
|
EtwpCreateEtwThread@8
|
|
EtwpGetCpuSpeed@8
|
|
;EtwpNotificationThread
|
|
EvtIntReportAuthzEventAndSourceAsync@44
|
|
EvtIntReportEventAndSourceAsync@44
|
|
KiFastSystemCall@0
|
|
KiFastSystemCallRet@0
|
|
KiIntSystemCall@0
|
|
KiRaiseUserExceptionDispatcher@0
|
|
KiUserApcDispatcher@20
|
|
KiUserCallbackDispatcher@12
|
|
KiUserExceptionDispatcher@8
|
|
LdrAccessResource@16
|
|
LdrAddLoadAsDataTable@16; Check!!! gendef says @20
|
|
LdrAddRefDll@8
|
|
LdrAlternateResourcesEnabled@0
|
|
LdrDisableThreadCalloutsForDll@4
|
|
LdrEnumResources@20
|
|
LdrEnumerateLoadedModules@12
|
|
LdrFindEntryForAddress@8
|
|
LdrFindResourceDirectory_U@16
|
|
LdrFindResourceEx_U@20
|
|
LdrFindResource_U@16
|
|
LdrFlushAlternateResourceModules@0
|
|
LdrGetDllHandle@16
|
|
LdrGetDllHandleByMapping@8
|
|
LdrGetDllHandleByName@12
|
|
LdrGetDllHandleEx@20
|
|
LdrGetFailureData@0
|
|
LdrGetFileNameFromLoadAsDataTable@8
|
|
LdrGetProcedureAddress@16
|
|
LdrGetProcedureAddressEx@20
|
|
LdrHotPatchRoutine@0
|
|
LdrInitShimEngineDynamic@4
|
|
LdrInitializeThunk@16
|
|
LdrLoadAlternateResourceModule@16
|
|
LdrLoadAlternateResourceModuleEx@20
|
|
LdrLoadDll@16
|
|
LdrAlternateResourcesEnabled@0
|
|
LdrLockLoaderLock@12
|
|
LdrOpenImageFileOptionsKey@12
|
|
LdrProcessRelocationBlock@16
|
|
LdrQueryImageFileExecutionOptions@24
|
|
LdrQueryImageFileExecutionOptionsEx@28
|
|
LdrQueryImageFileKeyOption@24
|
|
LdrQueryModuleServiceTags@12
|
|
LdrQueryProcessModuleInformation@12
|
|
LdrRegisterDllNotification@16
|
|
LdrRemoveLoadAsDataTable@16
|
|
LdrResFindResource@36
|
|
LdrResFindResourceDirectory@28
|
|
LdrResGetRCConfig@20
|
|
LdrResRelease@12
|
|
LdrResSearchResource@32
|
|
LdrRscIsTypeExist@16
|
|
LdrSetAppCompatDllRedirectionCallback@12
|
|
LdrSetDllManifestProber@4
|
|
LdrSetMUICacheType@4
|
|
LdrShutdownProcess@0
|
|
LdrShutdownThread@0
|
|
LdrUnloadAlternateResourceModule@4
|
|
LdrUnloadAlternateResourceModuleEx@8
|
|
LdrUnloadDll@4
|
|
LdrUnlockLoaderLock@8
|
|
LdrUnregisterDllNotification@4
|
|
LdrVerifyImageMatchesChecksum@16
|
|
LdrVerifyImageMatchesChecksumEx@8
|
|
LdrWx86FormatVirtualImage@12
|
|
LdrpResGetMappingSize@16
|
|
LdrpResGetRCConfig@20
|
|
LdrpResGetResourceDirectory@20
|
|
MD4Final@4
|
|
MD4Init@4
|
|
MD4Update@12
|
|
MD5Final@4
|
|
MD5Init@4
|
|
MD5Update@12
|
|
NlsAnsiCodePage DATA
|
|
NlsMbCodePageTag DATA
|
|
NlsMbOemCodePageTag DATA
|
|
NtAcceptConnectPort@24
|
|
NtAccessCheck@32
|
|
NtAccessCheckAndAuditAlarm@44
|
|
NtAccessCheckByType@44
|
|
NtAccessCheckByTypeAndAuditAlarm@64
|
|
NtAccessCheckByTypeResultList@44
|
|
NtAccessCheckByTypeResultListAndAuditAlarm@64
|
|
NtAccessCheckByTypeResultListAndAuditAlarmByHandle@68
|
|
NtAcquireCMFViewOwnership@12
|
|
NtAddAtom@12
|
|
NtAddBootEntry@8
|
|
NtAddDriverEntry@8
|
|
NtAdjustGroupsToken@24
|
|
NtAdjustPrivilegesToken@24
|
|
NtAlertResumeThread@8
|
|
NtAlertThread@4
|
|
NtAllocateLocallyUniqueId@4
|
|
NtAllocateReserveObject@12
|
|
NtAllocateUserPhysicalPages@12
|
|
NtAllocateUuids@16
|
|
NtAllocateVirtualMemory@24
|
|
NtAlpcAcceptConnectPort@36
|
|
NtAlpcCancelMessage@12
|
|
NtAlpcConnectPort@44
|
|
NtAlpcCreatePort@12
|
|
NtAlpcCreatePortSection@24
|
|
NtAlpcCreateResourceReserve@16
|
|
NtAlpcCreateSectionView@12
|
|
NtAlpcCreateSecurityContext@12
|
|
NtAlpcDeletePortSection@12
|
|
NtAlpcDeleteResourceReserve@12
|
|
NtAlpcDeleteSectionView@12
|
|
NtAlpcDeleteSecurityContext@12
|
|
NtAlpcDisconnectPort@8
|
|
NtAlpcImpersonateClientOfPort@12
|
|
NtAlpcOpenSenderProcess@24
|
|
NtAlpcOpenSenderThread@24
|
|
NtAlpcQueryInformation@20
|
|
NtAlpcQueryInformationMessage@24
|
|
NtAlpcRevokeSecurityContext@12
|
|
NtAlpcSendWaitReceivePort@32
|
|
NtAlpcSetInformation@16
|
|
NtApphelpCacheControl@8
|
|
NtAreMappedFilesTheSame@8
|
|
NtAssignProcessToJobObject@8
|
|
NtCallbackReturn@12
|
|
NtCancelDeviceWakeupRequest@4
|
|
NtCancelIoFile@8
|
|
NtCancelIoFileEx@12
|
|
NtCancelSynchronousIoFile@12
|
|
NtCancelTimer@8
|
|
NtClearEvent@4
|
|
NtClose@4
|
|
NtCloseObjectAuditAlarm@12
|
|
NtCommitComplete@8
|
|
NtCommitEnlistment@8
|
|
NtCommitTransaction@8
|
|
NtCompactKeys@8
|
|
NtCompareTokens@12
|
|
NtCompleteConnectPort@4
|
|
NtCompressKey@4
|
|
NtConnectPort@32
|
|
NtContinue@8
|
|
NtCreateDebugObject@16
|
|
NtCreateDirectoryObject@12
|
|
NtCreateEnlistment@32
|
|
NtCreateEvent@20
|
|
NtCreateEventPair@12
|
|
NtCreateFile@44
|
|
NtCreateIoCompletion@16
|
|
NtCreateJobObject@12
|
|
NtCreateJobSet@12
|
|
NtCreateKey@28
|
|
NtCreateKeyTransacted@32
|
|
NtCreateKeyedEvent@16
|
|
NtCreateMailslotFile@32
|
|
NtCreateMutant@16
|
|
NtCreateNamedPipeFile@56
|
|
NtCreatePagingFile@16
|
|
NtCreatePort@20
|
|
NtCreatePrivateNamespace@16
|
|
NtCreateProcess@32
|
|
NtCreateProcessEx@36
|
|
NtCreateProfile@36
|
|
NtCreateProfileEx@40
|
|
NtCreateResourceManager@28
|
|
NtCreateSection@28
|
|
NtCreateSemaphore@20
|
|
NtCreateSymbolicLinkObject@16
|
|
NtCreateThread@32
|
|
NtCreateThreadEx@44
|
|
NtCreateTimer@16
|
|
NtCreateToken@52
|
|
NtCreateTransaction@40
|
|
NtCreateTransactionManager@24
|
|
NtCreateUserProcess@44
|
|
NtCreateWaitablePort@20
|
|
NtCreateWorkerFactory@40
|
|
NtCurrentTeb@0
|
|
NtDebugActiveProcess@8
|
|
NtDebugContinue@12
|
|
NtDelayExecution@8
|
|
NtDeleteAtom@4
|
|
NtDeleteBootEntry@4
|
|
NtDeleteDriverEntry@4
|
|
NtDeleteFile@4
|
|
NtDeleteKey@4
|
|
NtDeleteObjectAuditAlarm@12
|
|
NtDeletePrivateNamespace@4
|
|
NtDeleteValueKey@8
|
|
NtDeviceIoControlFile@40
|
|
NtDisableLastKnownGood@0
|
|
NtDisplayString@4
|
|
NtDrawText@4
|
|
NtDuplicateObject@28
|
|
NtDuplicateToken@24
|
|
NtEnableLastKnownGood@0
|
|
NtEnumerateBootEntries@8
|
|
NtEnumerateDriverEntries@8
|
|
NtEnumerateKey@24
|
|
NtEnumerateSystemEnvironmentValuesEx@12
|
|
NtEnumerateTransactionObject@20
|
|
NtEnumerateValueKey@24
|
|
NtExtendSection@8
|
|
NtFilterToken@24
|
|
NtFindAtom@12
|
|
NtFlushBuffersFile@8
|
|
NtFlushInstallUILanguage@8
|
|
NtFlushInstructionCache@12
|
|
NtFlushKey@4
|
|
NtFlushProcessWriteBuffers@0
|
|
NtFlushVirtualMemory@16
|
|
NtFlushWriteBuffer@0
|
|
NtFreeUserPhysicalPages@12
|
|
NtFreeVirtualMemory@16
|
|
NtFreezeRegistry@4
|
|
NtFreezeTransactions@8
|
|
NtFsControlFile@40
|
|
NtGetContextThread@8
|
|
NtGetCurrentProcessorNumber@0
|
|
NtGetDevicePowerState@8
|
|
NtGetMUIRegistryInfo@12
|
|
NtGetNextProcess@20
|
|
NtGetNextThread@24
|
|
NtGetNlsSectionPtr@20
|
|
NtGetNotificationResourceManager@28
|
|
NtGetPlugPlayEvent@16
|
|
NtGetTickCount@0
|
|
NtGetWriteWatch@28
|
|
NtImpersonateAnonymousToken@4
|
|
NtImpersonateClientOfPort@8
|
|
NtImpersonateThread@12
|
|
NtInitializeNlsFiles@16 ;Check!!! gendef says 12
|
|
NtInitializeRegistry@4
|
|
NtInitiatePowerAction@16
|
|
NtIsProcessInJob@8
|
|
NtIsSystemResumeAutomatic@0
|
|
NtIsUILanguageComitted@0
|
|
NtListenPort@8
|
|
NtLoadDriver@4
|
|
NtLoadKey2@12
|
|
NtLoadKey@8
|
|
NtLoadKeyEx@32
|
|
NtLockFile@40
|
|
NtLockProductActivationKeys@8
|
|
NtLockRegistryKey@4
|
|
NtLockVirtualMemory@16
|
|
NtMakePermanentObject@4
|
|
NtMakeTemporaryObject@4
|
|
NtMapCMFModule@24
|
|
NtMapUserPhysicalPages@12
|
|
NtMapUserPhysicalPagesScatter@12
|
|
NtMapViewOfSection@40
|
|
NtModifyBootEntry@4
|
|
NtModifyDriverEntry@4
|
|
NtNotifyChangeDirectoryFile@36
|
|
NtNotifyChangeKey@40
|
|
NtNotifyChangeMultipleKeys@48
|
|
NtNotifyChangeSession@32
|
|
NtOpenDirectoryObject@12
|
|
NtOpenEnlistment@20
|
|
NtOpenEvent@12
|
|
NtOpenEventPair@12
|
|
NtOpenFile@24
|
|
NtOpenIoCompletion@12
|
|
NtOpenJobObject@12
|
|
NtOpenKey@12
|
|
NtOpenKeyEx@16
|
|
NtOpenKeyTransacted@16
|
|
NtOpenKeyTransactedEx@20
|
|
NtOpenKeyedEvent@12
|
|
NtOpenMutant@12
|
|
NtOpenObjectAuditAlarm@48
|
|
NtOpenPrivateNamespace@16
|
|
NtOpenProcess@16
|
|
NtOpenProcessToken@12
|
|
NtOpenProcessTokenEx@16
|
|
NtOpenResourceManager@20
|
|
NtOpenSection@12
|
|
NtOpenSemaphore@12
|
|
NtOpenSession@12
|
|
NtOpenSymbolicLinkObject@12
|
|
NtOpenThread@16
|
|
NtOpenThreadToken@16
|
|
NtOpenThreadTokenEx@20
|
|
NtOpenTimer@12
|
|
NtOpenTransaction@20
|
|
NtOpenTransactionManager@24
|
|
NtPlugPlayControl@12
|
|
NtPowerInformation@20
|
|
NtPrePrepareComplete@8
|
|
NtPrePrepareEnlistment@8
|
|
NtPrepareComplete@8
|
|
NtPrepareEnlistment@8
|
|
NtPrivilegeCheck@12
|
|
NtPrivilegeObjectAuditAlarm@24
|
|
NtPrivilegedServiceAuditAlarm@20
|
|
NtPropagationComplete@16
|
|
NtPropagationFailed@12
|
|
NtProtectVirtualMemory@20
|
|
NtPulseEvent@8
|
|
NtQueryAttributesFile@8
|
|
NtQueryBootEntryOrder@8
|
|
NtQueryBootOptions@8
|
|
NtQueryDebugFilterState@8
|
|
NtQueryDefaultLocale@8
|
|
NtQueryDefaultUILanguage@4
|
|
NtQueryDirectoryFile@44
|
|
NtQueryDirectoryObject@28
|
|
NtQueryDriverEntryOrder@8
|
|
NtQueryEaFile@36
|
|
NtQueryEvent@20
|
|
NtQueryFullAttributesFile@8
|
|
NtQueryInformationAtom@20
|
|
NtQueryInformationEnlistment@20
|
|
NtQueryInformationFile@20
|
|
NtQueryInformationJobObject@20
|
|
NtQueryInformationPort@20
|
|
NtQueryInformationProcess@20
|
|
NtQueryInformationResourceManager@20
|
|
NtQueryInformationThread@20
|
|
NtQueryInformationToken@20
|
|
NtQueryInformationTransaction@20
|
|
NtQueryInformationTransactionManager@20
|
|
NtQueryInformationWorkerFactory@20
|
|
NtQueryInstallUILanguage@4
|
|
NtQueryIntervalProfile@8
|
|
NtQueryIoCompletion@20
|
|
NtQueryKey@20
|
|
NtQueryLicenseValue@20
|
|
NtQueryMultipleValueKey@24
|
|
NtQueryMutant@20
|
|
NtQueryObject@20
|
|
NtQueryOpenSubKeys@8
|
|
NtQueryOpenSubKeysEx@16
|
|
NtQueryPerformanceCounter@8
|
|
NtQueryPortInformationProcess@0
|
|
NtQueryQuotaInformationFile@36
|
|
NtQuerySection@20
|
|
NtQuerySecurityAttributesToken@24
|
|
NtQuerySecurityObject@20
|
|
NtQuerySemaphore@20
|
|
NtQuerySymbolicLinkObject@12
|
|
NtQuerySystemEnvironmentValue@16
|
|
NtQuerySystemEnvironmentValueEx@20
|
|
NtQuerySystemInformation@16
|
|
NtQuerySystemInformationEx@24
|
|
NtQuerySystemTime@4
|
|
NtQueryTimer@20
|
|
NtQueryTimerResolution@12
|
|
NtQueryValueKey@24
|
|
NtQueryVirtualMemory@24
|
|
NtQueryVolumeInformationFile@20
|
|
NtQueueApcThread@20
|
|
NtQueueApcThreadEx@24
|
|
NtRaiseException@12
|
|
NtRaiseHardError@24
|
|
NtReadFile@36
|
|
NtReadFileScatter@36
|
|
NtReadOnlyEnlistment@8
|
|
NtReadRequestData@24
|
|
NtReadVirtualMemory@20
|
|
NtRecoverEnlistment@8
|
|
NtRecoverResourceManager@4
|
|
NtRecoverTransactionManager@4
|
|
NtRegisterProtocolAddressInformation@20
|
|
NtRegisterThreadTerminatePort@4
|
|
NtReleaseCMFViewOwnership@0
|
|
NtReleaseKeyedEvent@16
|
|
NtReleaseMutant@8
|
|
NtReleaseSemaphore@12
|
|
NtReleaseWorkerFactoryWorker@4
|
|
NtRemoveIoCompletion@20
|
|
NtRemoveIoCompletionEx@24
|
|
NtRemoveProcessDebug@8
|
|
NtRenameKey@8
|
|
NtRenameTransactionManager@8
|
|
NtReplaceKey@12
|
|
NtReplacePartitionUnit@12
|
|
NtReplyPort@8
|
|
NtReplyWaitReceivePort@16
|
|
NtReplyWaitReceivePortEx@20
|
|
NtReplyWaitReplyPort@8
|
|
NtRequestDeviceWakeup@4
|
|
NtRequestPort@8
|
|
NtRequestWaitReplyPort@12
|
|
NtRequestWakeupLatency@4
|
|
NtResetEvent@8
|
|
NtResetWriteWatch@12
|
|
NtRestoreKey@12
|
|
NtResumeProcess@4
|
|
NtResumeThread@8
|
|
NtRollbackComplete@8
|
|
NtRollbackEnlistment@8
|
|
NtRollbackTransaction@8
|
|
NtRollforwardTransactionManager@8
|
|
NtSaveKey@8
|
|
NtSaveKeyEx@12
|
|
NtSaveMergedKeys@12
|
|
NtSecureConnectPort@36
|
|
NtSerializeBoot@0
|
|
NtSetBootEntryOrder@8
|
|
NtSetBootOptions@8
|
|
NtSetContextThread@8
|
|
NtSetDebugFilterState@12
|
|
NtSetDefaultHardErrorPort@4
|
|
NtSetDefaultLocale@8
|
|
NtSetDefaultUILanguage@4
|
|
NtSetDriverEntryOrder@8
|
|
NtSetEaFile@16
|
|
NtSetEvent@8
|
|
NtSetEventBoostPriority@4
|
|
NtSetHighEventPair@4
|
|
NtSetHighWaitLowEventPair@4
|
|
NtSetInformationDebugObject@20
|
|
NtSetInformationEnlistment@16
|
|
NtSetInformationFile@20
|
|
NtSetInformationJobObject@16
|
|
NtSetInformationKey@16
|
|
NtSetInformationObject@16
|
|
NtSetInformationProcess@16
|
|
NtSetInformationResourceManager@16
|
|
NtSetInformationThread@16
|
|
NtSetInformationToken@16
|
|
NtSetInformationTransaction@16
|
|
NtSetInformationTransactionManager@16
|
|
NtSetInformationWorkerFactory@16
|
|
NtSetIntervalProfile@8
|
|
NtSetIoCompletion@20
|
|
NtSetIoCompletionEx@24
|
|
NtSetLdtEntries@24
|
|
NtSetLowEventPair@4
|
|
NtSetLowWaitHighEventPair@4
|
|
NtSetQuotaInformationFile@16
|
|
NtSetSecurityObject@12
|
|
NtSetSystemEnvironmentValue@8
|
|
NtSetSystemEnvironmentValueEx@20
|
|
NtSetSystemInformation@12
|
|
NtSetSystemPowerState@12
|
|
NtSetSystemTime@8
|
|
NtSetThreadExecutionState@8
|
|
NtSetTimer@28
|
|
NtSetTimerEx@16
|
|
NtSetTimerResolution@12
|
|
NtSetUuidSeed@4
|
|
NtSetValueKey@24
|
|
NtSetVolumeInformationFile@20
|
|
NtShutdownSystem@4
|
|
NtShutdownWorkerFactory@8
|
|
NtSignalAndWaitForSingleObject@16
|
|
NtSinglePhaseReject@8
|
|
NtStartProfile@4
|
|
NtStopProfile@4
|
|
NtSuspendProcess@4
|
|
NtSuspendThread@8
|
|
NtSystemDebugControl@24
|
|
NtTerminateJobObject@8
|
|
NtTerminateProcess@8
|
|
NtTerminateThread@8
|
|
NtTestAlert@0
|
|
NtThawRegistry@0
|
|
NtThawTransactions@0
|
|
NtTraceControl@24
|
|
NtTraceEvent@16
|
|
NtTranslateFilePath@16
|
|
NtUmsThreadYield@4
|
|
NtUnloadDriver@4
|
|
NtUnloadKey2@8
|
|
NtUnloadKey@4
|
|
NtUnloadKeyEx@8
|
|
NtUnlockFile@20
|
|
NtUnlockVirtualMemory@16
|
|
NtUnmapViewOfSection@8
|
|
NtVdmControl@8
|
|
NtWaitForDebugEvent@16
|
|
NtWaitForKeyedEvent@16
|
|
NtWaitForMultipleObjects32@20
|
|
NtWaitForMultipleObjects@20
|
|
NtWaitForSingleObject@12
|
|
NtWaitForWorkViaWorkerFactory@8
|
|
NtWaitHighEventPair@4
|
|
NtWaitLowEventPair@4
|
|
NtWorkerFactoryWorkerReady@4
|
|
NtWow64CallFunction64@28
|
|
NtWow64CsrAllocateCaptureBuffer@8
|
|
NtWow64CsrAllocateMessagePointer@12
|
|
NtWow64CsrCaptureMessageBuffer@16
|
|
NtWow64CsrCaptureMessageString@20
|
|
NtWow64CsrClientCallServer@16
|
|
NtWow64CsrClientConnectToServer@20
|
|
NtWow64CsrFreeCaptureBuffer@4
|
|
NtWow64CsrGetProcessId@0
|
|
NtWow64CsrIdentifyAlertableThread@0
|
|
NtWow64CsrVerifyRegion@8
|
|
NtWow64DebuggerCall@20
|
|
NtWow64GetCurrentProcessorNumberEx@4
|
|
NtWow64GetNativeSystemInformation@16
|
|
NtWow64InterlockedPopEntrySList@4
|
|
NtWow64QueryInformationProcess64@20
|
|
NtWow64QueryVirtualMemory64@32
|
|
NtWow64ReadVirtualMemory64@28
|
|
NtWow64WriteVirtualMemory64@28
|
|
NtWriteFile@36
|
|
NtWriteFileGather@36
|
|
NtWriteRequestData@24
|
|
NtWriteVirtualMemory@20
|
|
NtYieldExecution@0
|
|
; Not sure, but we assume here standard DefWindowProc arguments
|
|
NtdllDefWindowProc_A@16
|
|
NtdllDefWindowProc_W@16
|
|
; Not sure, but we assume here standard DefDlgProc arguments
|
|
NtdllDialogWndProc_A@16
|
|
NtdllDialogWndProc_W@16
|
|
PfxFindPrefix@8
|
|
PfxInitialize@4
|
|
PfxInsertPrefix@12
|
|
PfxRemovePrefix@8
|
|
RtlAbortRXact@4
|
|
RtlAbsoluteToSelfRelativeSD@12
|
|
RtlAcquirePebLock@0
|
|
RtlAcquirePrivilege@16
|
|
RtlAcquireReleaseSRWLockExclusive@4
|
|
RtlAcquireResourceExclusive@8
|
|
RtlAcquireResourceShared@8
|
|
RtlAcquireSRWLockExclusive@4
|
|
RtlAcquireSRWLockShared@4
|
|
RtlActivateActivationContext@12
|
|
RtlActivateActivationContextEx@16
|
|
RtlAddAccessAllowedAce@16
|
|
RtlAddAccessAllowedAceEx@20
|
|
RtlAddAccessAllowedObjectAce@28
|
|
RtlAddAccessDeniedAce@16
|
|
RtlAddAccessDeniedAceEx@20
|
|
RtlAddAccessDeniedObjectAce@28
|
|
RtlAddAce@20
|
|
RtlAddActionToRXact@24
|
|
RtlAddAtomToAtomTable@12
|
|
RtlAddAttributeActionToRXact@32
|
|
RtlAddAuditAccessAce@24
|
|
RtlAddAuditAccessAceEx@28
|
|
RtlAddAuditAccessObjectAce@36
|
|
RtlAddCompoundAce@24
|
|
RtlAddIntegrityLabelToBoundaryDescriptor@8
|
|
RtlAddMandatoryAce@24
|
|
RtlAddRefActivationContext@4
|
|
RtlAddRange@36
|
|
RtlAddRefMemoryStream@4
|
|
RtlAddSIDToBoundaryDescriptor@8
|
|
RtlAddVectoredContinueHandler@8
|
|
RtlAddVectoredExceptionHandler@8
|
|
RtlAddressInSectionTable@12
|
|
RtlAdjustPrivilege@16
|
|
RtlAllocateActivationContextStack@4
|
|
RtlAllocateAndInitializeSid@44
|
|
RtlAllocateHandle@8
|
|
RtlAllocateHeap@12
|
|
RtlAllocateMemoryBlockLookaside@12
|
|
RtlAllocateMemoryZone@12
|
|
RtlAnsiCharToUnicodeChar@4
|
|
RtlAnsiStringToUnicodeSize@4
|
|
RtlAnsiStringToUnicodeString@12
|
|
RtlAppendAsciizToString@8
|
|
RtlAppendPathElement@12
|
|
RtlAppendStringToString@8
|
|
RtlAppendUnicodeStringToString@8
|
|
RtlAppendUnicodeToString@8
|
|
RtlApplicationVerifierStop@40
|
|
RtlApplyRXact@4
|
|
RtlApplyRXactNoFlush@4
|
|
RtlAreAllAccessesGranted@8
|
|
RtlAreAnyAccessesGranted@8
|
|
RtlAreBitsClear@12
|
|
RtlAreBitsSet@12
|
|
RtlAssert@16
|
|
RtlBarrier@8
|
|
RtlBarrierForDelete@8
|
|
RtlCallbackLpcClient@12
|
|
RtlCancelTimer@8
|
|
RtlCaptureContext@4
|
|
RtlCaptureStackBackTrace@16
|
|
RtlCaptureStackContext@12
|
|
RtlCharToInteger@12
|
|
RtlCheckForOrphanedCriticalSections@4
|
|
RtlCheckRegistryKey@8
|
|
RtlCleanUpTEBLangLists@0
|
|
RtlClearAllBits@4
|
|
RtlClearBits@12
|
|
RtlCloneMemoryStream@8
|
|
RtlCloneUserProcess@20
|
|
RtlCmDecodeMemIoResource@8
|
|
RtlCmEncodeMemIoResource@24
|
|
RtlCommitDebugInfo@8
|
|
RtlCommitMemoryStream@8
|
|
RtlCompactHeap@8
|
|
RtlCompareAltitudes@8
|
|
RtlCompareMemory@12
|
|
RtlCompareMemoryUlong@12
|
|
RtlCompareString@12
|
|
RtlCompareUnicodeString@12
|
|
RtlCompareUnicodeStrings@20
|
|
RtlCompressBuffer@32
|
|
RtlComputeCrc32@12
|
|
RtlComputeImportTableHash@12
|
|
RtlComputePrivatizedDllName_U@12
|
|
RtlConnectToSm@16
|
|
RtlConsoleMultiByteToUnicodeN@24
|
|
RtlContractHashTable@4
|
|
RtlConvertExclusiveToShared@4
|
|
RtlConvertLCIDToString@20
|
|
RtlConvertLongToLargeInteger@4
|
|
RtlConvertSharedToExclusive@4
|
|
RtlConvertSidToUnicodeString@12
|
|
RtlConvertToAutoInheritSecurityObject@24
|
|
RtlConvertUiListToApiList@12
|
|
RtlConvertUlongToLargeInteger@4
|
|
RtlCopyExtendedContext@12
|
|
RtlCopyLuid@8
|
|
RtlCopyLuidAndAttributesArray@12
|
|
RtlCopyMappedMemory@12
|
|
RtlCopyMemoryStreamTo@24
|
|
RtlCopyOutOfProcessMemoryStreamTo@24
|
|
RtlCopyRangeList@8
|
|
RtlCopySecurityDescriptor@8
|
|
RtlCopySid@12
|
|
RtlCopySidAndAttributesArray@28
|
|
RtlCopyString@8
|
|
RtlCopyUnicodeString@8
|
|
RtlCreateAcl@12
|
|
RtlCreateActivationContext@24
|
|
RtlCreateAndSetSD@20
|
|
RtlCreateAtomTable@8
|
|
RtlCreateBootStatusDataFile@4
|
|
RtlCreateBoundaryDescriptor@8
|
|
RtlCreateEnvironment@8
|
|
RtlCreateEnvironmentEx@12
|
|
RtlCreateHashTable@12
|
|
RtlCreateHeap@24
|
|
RtlCreateLpcServer@24
|
|
RtlCreateMemoryBlockLookaside@20
|
|
RtlCreateMemoryZone@12
|
|
RtlCreateProcessParameters@40
|
|
RtlCreateProcessParametersEx@44
|
|
RtlCreateProcessReflection@24
|
|
RtlCreateQueryDebugBuffer@8
|
|
RtlCreateRegistryKey@8
|
|
RtlCreateSecurityDescriptor@8
|
|
RtlCreateServiceSid@12
|
|
RtlCreateSystemVolumeInformationFolder@4
|
|
RtlCreateTagHeap@16
|
|
RtlCreateTimer@28
|
|
RtlCreateTimerQueue@4
|
|
RtlCreateUnicodeString@8
|
|
RtlCreateUnicodeStringFromAsciiz@8
|
|
RtlCreateUserProcess@40
|
|
RtlCreateUserSecurityObject@28
|
|
RtlCreateUserStack@24
|
|
RtlCreateUserThread@40
|
|
RtlCreateVirtualAccountSid@16
|
|
RtlCultureNameToLCID@8
|
|
RtlCustomCPToUnicodeN@24
|
|
RtlCutoverTimeToSystemTime@16
|
|
RtlDeCommitDebugInfo@12
|
|
RtlDeNormalizeProcessParams@4
|
|
RtlDeactivateActivationContext@8
|
|
RtlDebugPrintTimes@0
|
|
RtlDecodePointer@4
|
|
RtlDecodeSystemPointer@4
|
|
RtlDecompressBuffer@24
|
|
RtlDecompressFragment@32
|
|
RtlDefaultNpAcl@4
|
|
RtlDelete@4
|
|
RtlDeleteAce@8
|
|
RtlDeleteAtomFromAtomTable@8
|
|
RtlDeleteBarrier@4
|
|
RtlDeleteBoundaryDescriptor@4
|
|
RtlDeleteCriticalSection@4
|
|
RtlDeleteElementGenericTable@8
|
|
RtlDeleteElementGenericTableAvl@8
|
|
RtlDeleteHashTable@4
|
|
RtlDeleteNoSplay@8
|
|
RtlDeleteOwnersRanges@8
|
|
RtlDeleteRange@24
|
|
RtlDeleteRegistryValue@12
|
|
RtlDeleteResource@4
|
|
RtlDeleteSecurityObject@4
|
|
RtlDeleteTimer@12
|
|
RtlDeleteTimerQueue@4
|
|
RtlDeleteTimerQueueEx@8
|
|
RtlDeNormalizeProcessParams@4
|
|
RtlDeregisterSecureMemoryCacheCallback@4
|
|
RtlDeregisterWait@4
|
|
RtlDeregisterWaitEx@8
|
|
RtlDestroyAtomTable@4
|
|
RtlDestroyEnvironment@4
|
|
RtlDestroyHandleTable@4
|
|
RtlDestroyHeap@4
|
|
RtlDestroyMemoryBlockLookaside@4
|
|
RtlDestroyMemoryZone@4
|
|
RtlDestroyProcessParameters@4
|
|
RtlDestroyQueryDebugBuffer@4
|
|
RtlDetectHeapLeaks@0
|
|
RtlDetermineDosPathNameType_U@4
|
|
RtlDisableThreadProfiling@4
|
|
RtlDllShutdownInProgress@0
|
|
RtlDnsHostNameToComputerName@12
|
|
RtlDoesFileExists_U@4
|
|
RtlDosApplyFileIsolationRedirection_Ustr@36
|
|
RtlDosPathNameToNtPathName_U@16
|
|
RtlDosPathNameToNtPathName_U_WithStatus@16
|
|
RtlDosPathNameToRelativeNtPathName_U@16
|
|
RtlDosPathNameToRelativeNtPathName_U_WithStatus@16
|
|
RtlDosSearchPath_U@24
|
|
RtlDosSearchPath_Ustr@36
|
|
RtlDowncaseUnicodeChar@4
|
|
RtlDowncaseUnicodeString@12
|
|
RtlDumpResource@4
|
|
RtlDuplicateUnicodeString@12
|
|
RtlEmptyAtomTable@8
|
|
RtlEnableEarlyCriticalSectionEventCreation@0
|
|
RtlEnableThreadProfiling@20
|
|
RtlEncodePointer@4
|
|
RtlEncodeSystemPointer@4
|
|
RtlEndEnumerationHashTable@8
|
|
RtlEndWeakEnumerationHashTable@8
|
|
RtlEnlargedIntegerMultiply@8
|
|
RtlEnlargedUnsignedDivide@16
|
|
RtlEnlargedUnsignedMultiply@8
|
|
RtlEnterCriticalSection@4
|
|
RtlEnumProcessHeaps@8
|
|
RtlEnumerateEntryHashTable@8
|
|
RtlEnumerateGenericTable@8
|
|
RtlEnumerateGenericTableAvl@8
|
|
RtlEnumerateGenericTableLikeADirectory@28
|
|
RtlEnumerateGenericTableWithoutSplaying@8
|
|
RtlEnumerateGenericTableWithoutSplayingAvl@8
|
|
RtlEqualComputerName@8
|
|
RtlEqualDomainName@8
|
|
RtlEqualLuid@8
|
|
RtlEqualPrefixSid@8
|
|
RtlEqualSid@8
|
|
RtlEqualString@12
|
|
RtlEqualUnicodeString@12
|
|
RtlEraseUnicodeString@4
|
|
RtlEthernetAddressToStringA@8
|
|
RtlEthernetAddressToStringW@8
|
|
RtlEthernetStringToAddressA@12
|
|
RtlEthernetStringToAddressW@12
|
|
RtlExitUserProcess@4
|
|
; Not sure, but we assume @4
|
|
RtlExitUserThread@4
|
|
RtlExpandEnvironmentStrings@24
|
|
RtlExpandEnvironmentStrings_U@16
|
|
RtlExpandHashTable@4
|
|
RtlExtendMemoryBlockLookaside@8
|
|
RtlExtendMemoryZone@8
|
|
RtlExtendedIntegerMultiply@12
|
|
RtlExtendedLargeIntegerDivide@16
|
|
RtlExtendedMagicDivide@20
|
|
RtlExtendHeap@16
|
|
RtlFillMemory@12
|
|
RtlFillMemoryUlong@12
|
|
RtlFillMemoryUlonglong@16
|
|
RtlFinalReleaseOutOfProcessMemoryStream@4
|
|
RtlFindAceByType@12
|
|
RtlFindActivationContextSectionGuid@20
|
|
RtlFindActivationContextSectionString@20
|
|
RtlFindCharInUnicodeString@16
|
|
RtlFindClearBits@12
|
|
RtlFindClearBitsAndSet@12
|
|
RtlFindClearRuns@16
|
|
RtlFindClosestEncodableLength@12
|
|
RtlFindLastBackwardRunClear@12
|
|
RtlFindLeastSignificantBit@8
|
|
RtlFindLongestRunClear@8
|
|
RtlFindLongestRunSet@8
|
|
RtlFindMessage@20
|
|
RtlFindMostSignificantBit@8
|
|
RtlFindNextForwardRunClear@12
|
|
RtlFindRange@48
|
|
RtlFindSetBits@12
|
|
RtlFindSetBitsAndClear@12
|
|
RtlFirstEntrySList@4
|
|
RtlFirstFreeAce@8
|
|
RtlFlsAlloc@8
|
|
RtlFlsFree@4
|
|
RtlFlushSecureMemoryCache@8
|
|
RtlFormatCurrentUserKeyPath@4
|
|
RtlFormatMessage@36
|
|
RtlFormatMessageEx@40
|
|
RtlFreeActivationContextStack@4
|
|
RtlFreeAnsiString@4
|
|
RtlFreeHandle@8
|
|
RtlFreeHeap@12
|
|
RtlFreeMemoryBlockLookaside@8
|
|
RtlFreeOemString@4
|
|
RtlFreeSid@4
|
|
RtlFreeThreadActivationContextStack@0
|
|
RtlFreeUnicodeString@4
|
|
RtlFreeUserStack@4
|
|
RtlFreeUserThreadStack@8
|
|
RtlGUIDFromString@8
|
|
RtlGenerate8dot3Name@16
|
|
RtlGetAce@12
|
|
RtlGetActiveActivationContext@4
|
|
RtlGetCallersAddress@8
|
|
RtlGetCompressionWorkSpaceSize@12
|
|
RtlGetControlSecurityDescriptor@12
|
|
RtlGetCriticalSectionRecursionCount@4
|
|
RtlGetCurrentDirectory_U@8
|
|
RtlGetCurrentPeb@0
|
|
RtlGetCurrentProcessorNumber@0
|
|
RtlGetCurrentProcessorNumberEx@4
|
|
RtlGetCurrentTransaction@0
|
|
RtlGetDaclSecurityDescriptor@16
|
|
RtlGetElementGenericTable@8
|
|
RtlGetElementGenericTableAvl@8
|
|
RtlGetEnabledExtendedFeatures@8
|
|
RtlGetExtendedContextLength@8
|
|
RtlGetExtendedFeaturesMask@4
|
|
RtlGetFileMUIPath@28
|
|
RtlGetFirstRange@12
|
|
RtlGetFrame@0
|
|
RtlGetFullPathName_U@16
|
|
RtlGetFullPathName_UEx@20
|
|
RtlGetFullPathName_UstrEx@32
|
|
RtlGetGroupSecurityDescriptor@12
|
|
RtlGetIntegerAtom@8
|
|
RtlGetLastNtStatus@0
|
|
RtlGetLastWin32Error@0
|
|
RtlGetLengthWithoutLastFullDosOrNtPathElement@12
|
|
RtlGetLengthWithoutTrailingPathSeperators@12
|
|
RtlGetLocaleFileMappingAddress@12
|
|
RtlGetLongestNtPathLength@0
|
|
RtlGetNativeSystemInformation@16
|
|
RtlGetNextRange@12
|
|
RtlGetNextEntryHashTable@8
|
|
RtlGetNtGlobalFlags@0
|
|
RtlGetNtProductType@4
|
|
RtlGetNtVersionNumbers@12
|
|
RtlGetOwnerSecurityDescriptor@12
|
|
RtlGetParentLocaleName@16
|
|
RtlGetProcessHeaps@8
|
|
RtlGetProcessPreferredUILanguages@16
|
|
RtlGetProductInfo@20
|
|
RtlGetSaclSecurityDescriptor@16
|
|
RtlGetSecurityDescriptorRMControl@8
|
|
RtlGetSetBootStatusData@24
|
|
RtlGetSystemPreferredUILanguages@20
|
|
RtlGetThreadErrorMode@0
|
|
RtlGetThreadLangIdByIndex@16
|
|
RtlGetThreadPreferredUILanguages@16
|
|
RtlGetUILanguageInfo@20
|
|
RtlGetUnloadEventTrace@0
|
|
RtlGetUnloadEventTraceEx@12
|
|
RtlGetUserInfoHeap@20
|
|
RtlGetUserPreferredUILanguages@20
|
|
RtlGetVersion@4
|
|
RtlGUIDFromString@8
|
|
RtlHashUnicodeString@16
|
|
RtlHeapTrkInitialize@4
|
|
RtlIdentifierAuthoritySid@4
|
|
RtlIdnToAscii@20
|
|
RtlIdnToNameprepUnicode@20
|
|
RtlIdnToUnicode@20
|
|
RtlImageDirectoryEntryToData@16
|
|
RtlImageNtHeader@4
|
|
RtlImageNtHeaderEx@20
|
|
RtlImageRvaToSection@12
|
|
RtlImageRvaToVa@16
|
|
RtlImpersonateLpcClient@8
|
|
RtlImpersonateSelf@4
|
|
RtlImpersonateSelfEx@12
|
|
RtlInitAnsiString@8
|
|
RtlInitAnsiStringEx@8
|
|
RtlInitBarrier@12
|
|
RtlInitCodePageTable@8
|
|
RtlInitEnumerationHashTable@8
|
|
RtlInitMemoryStream@4
|
|
RtlInitNlsTables@16
|
|
RtlInitOutOfProcessMemoryStream@4
|
|
RtlInitString@8
|
|
RtlInitUnicodeString@8
|
|
RtlInitUnicodeStringEx@8
|
|
RtlInitWeakEnumerationHashTable@8
|
|
RtlInitializeAtomPackage@4
|
|
RtlInitializeBitMap@12
|
|
RtlInitializeConditionVariable@4
|
|
RtlInitializeContext@20
|
|
RtlInitializeCriticalSection@4
|
|
RtlInitializeCriticalSectionAndSpinCount@8
|
|
RtlInitializeCriticalSectionEx@12
|
|
RtlInitializeExceptionChain@4
|
|
RtlInitializeExtendedContext@12
|
|
RtlInitializeGenericTable@20
|
|
RtlInitializeGenericTableAvl@20
|
|
RtlInitializeHandleTable@12
|
|
RtlInitializeNtUserPfn@24
|
|
RtlInitializeRXact@12
|
|
RtlInitializeResource@4
|
|
RtlInitializeSListHead@4
|
|
RtlInitializeSRWLock@4
|
|
RtlInitializeSid@12
|
|
RtlInsertElementGenericTable@16
|
|
RtlInsertElementGenericTableAvl@16
|
|
RtlInsertElementGenericTableFull@24
|
|
RtlInsertElementGenericTableFullAvl@24
|
|
RtlInsertEntryHashTable@16
|
|
RtlInt64ToUnicodeString@16
|
|
RtlIntegerToChar@16
|
|
RtlIntegerToUnicodeString@12
|
|
RtlInterlockedClearBitRun@12
|
|
RtlInterlockedCompareExchange64@20
|
|
RtlInterlockedFlushSList@4
|
|
RtlInterlockedPopEntrySList@4
|
|
RtlInterlockedPushEntrySList@8
|
|
RtlInvertRangeList@8
|
|
RtlInterlockedSetBitRun@12
|
|
RtlIoDecodeMemIoResource@16
|
|
RtlIoEncodeMemIoResource@40
|
|
RtlIpv4AddressToStringA@8
|
|
RtlIpv4AddressToStringExA@16
|
|
RtlIpv4AddressToStringExW@16
|
|
RtlIpv4AddressToStringW@8
|
|
RtlIpv4StringToAddressA@16
|
|
RtlIpv4StringToAddressExA@16
|
|
RtlIpv4StringToAddressExW@16
|
|
RtlIpv4StringToAddressW@16
|
|
RtlIpv6AddressToStringA@8
|
|
RtlIpv6AddressToStringExA@20
|
|
RtlIpv6AddressToStringExW@20
|
|
RtlIpv6AddressToStringW@8
|
|
RtlIpv6StringToAddressA@12
|
|
RtlIpv6StringToAddressExA@16
|
|
RtlIpv6StringToAddressExW@16
|
|
RtlIpv6StringToAddressW@12
|
|
RtlIsActivationContextActive@4
|
|
RtlIsCriticalSectionLocked@4
|
|
RtlIsCriticalSectionLockedByThread@4
|
|
RtlIsCurrentThreadAttachExempt@0
|
|
RtlIsDosDeviceName_U@4
|
|
RtlIsGenericTableEmpty@4
|
|
RtlIsGenericTableEmptyAvl@4
|
|
RtlIsNameInExpression@16
|
|
RtlIsNameLegalDOS8Dot3@12
|
|
RtlIsNormalizedString@16
|
|
RtlIsRangeAvailable@40
|
|
RtlIsTextUnicode@12
|
|
RtlIsThreadWithinLoaderCallout@0
|
|
RtlIsValidHandle@8
|
|
RtlIsValidIndexHandle@12
|
|
RtlIsValidLocaleName@8
|
|
RtlKnownExceptionFilter@4
|
|
RtlLCIDToCultureName@8
|
|
RtlLargeIntegerAdd@16
|
|
RtlLargeIntegerArithmeticShift@12
|
|
RtlLargeIntegerDivide@20
|
|
RtlLargeIntegerNegate@8
|
|
RtlLargeIntegerShiftLeft@12
|
|
RtlLargeIntegerShiftRight@12
|
|
RtlLargeIntegerSubtract@16
|
|
RtlLargeIntegerToChar@16
|
|
RtlLcidToLocaleName@16
|
|
RtlLeaveCriticalSection@4
|
|
RtlLengthRequiredSid@4
|
|
RtlLengthSecurityDescriptor@4
|
|
RtlLengthSid@4
|
|
RtlLoadString@32
|
|
RtlLocalTimeToSystemTime@8
|
|
RtlLocaleNameToLcid@12
|
|
RtlLocateExtendedFeature@12
|
|
RtlLocateLegacyContext@8
|
|
RtlLockBootStatusData@4
|
|
RtlLockCurrentThread@0
|
|
RtlLockHeap@4
|
|
RtlLockMemoryBlockLookaside@4
|
|
RtlLockMemoryStreamRegion@24
|
|
RtlLockMemoryZone@4
|
|
RtlLockModuleSection@4
|
|
RtlLogStackBackTrace@0
|
|
RtlLookupAtomInAtomTable@12
|
|
RtlLookupElementGenericTable@8
|
|
RtlLookupElementGenericTableAvl@8
|
|
RtlLookupElementGenericTableFull@16
|
|
RtlLookupElementGenericTableFullAvl@16
|
|
RtlLookupEntryHashTable@12
|
|
RtlMakeSelfRelativeSD@12
|
|
RtlMapGenericMask@8
|
|
RtlMapSecurityErrorToNtStatus@4
|
|
RtlMergeRangeLists@16
|
|
RtlMoveMemory@12
|
|
RtlMultiAppendUnicodeStringBuffer@12
|
|
RtlMultiByteToUnicodeN@20
|
|
RtlMultiByteToUnicodeSize@12
|
|
RtlMultipleAllocateHeap@20
|
|
RtlMultipleFreeHeap@16
|
|
RtlNewInstanceSecurityObject@40
|
|
RtlNewSecurityGrantedAccess@24
|
|
RtlNewSecurityObject@24
|
|
RtlNewSecurityObjectEx@32
|
|
RtlNewSecurityObjectWithMultipleInheritance@36
|
|
RtlNormalizeProcessParams@4
|
|
RtlNormalizeString@20
|
|
RtlNtPathNameToDosPathName@16
|
|
RtlNtStatusToDosError@4
|
|
RtlNtStatusToDosErrorNoTeb@4
|
|
RtlNumberGenericTableElements@4
|
|
RtlNumberGenericTableElementsAvl@4
|
|
RtlNumberOfClearBits@4
|
|
RtlNumberOfSetBits@4
|
|
RtlNumberOfSetBitsUlongPtr@4
|
|
RtlOemStringToUnicodeSize@4
|
|
RtlOemStringToUnicodeString@12
|
|
RtlOemToUnicodeN@20
|
|
RtlOpenCurrentUser@8
|
|
RtlOwnerAcesPresent@4
|
|
RtlPcToFileHeader@8
|
|
RtlPinAtomInAtomTable@8
|
|
RtlPopFrame@4
|
|
RtlPrefixString@12
|
|
RtlPrefixUnicodeString@12
|
|
RtlProcessFlsData@4
|
|
RtlProtectHeap@8
|
|
RtlPushFrame@4
|
|
RtlQueryActivationContextApplicationSettings@28
|
|
RtlQueryAtomInAtomTable@24
|
|
RtlQueryCriticalSectionOwner@4
|
|
RtlQueryDepthSList@4
|
|
RtlQueryDynamicTimeZoneInformation@4
|
|
RtlQueryElevationFlags@4
|
|
RtlQueryEnvironmentVariable@24
|
|
RtlQueryEnvironmentVariable_U@12
|
|
RtlQueryHeapInformation@20
|
|
RtlQueryInformationAcl@16
|
|
RtlQueryInformationActivationContext@28
|
|
RtlQueryInformationActiveActivationContext@16
|
|
RtlQueryInterfaceMemoryStream@12
|
|
RtlQueryModuleInformation@12
|
|
RtlQueryPerformanceCounter@4
|
|
RtlQueryPerformanceFrequency@4
|
|
RtlQueryProcessBackTraceInformation@4
|
|
RtlQueryProcessDebugInformation@12
|
|
RtlQueryProcessHeapInformation@4
|
|
RtlQueryProcessLockInformation@4
|
|
RtlQueryRegistryValues@20
|
|
RtlQuerySecurityObject@20
|
|
RtlQueryTagHeap@20
|
|
RtlQueryThreadProfiling@8
|
|
RtlQueryTimeZoneInformation@4
|
|
RtlQueueApcWow64Thread@20
|
|
RtlQueueWorkItem@12
|
|
RtlRaiseException@4
|
|
RtlRaiseStatus@4
|
|
RtlRandom@4
|
|
RtlRandomEx@4
|
|
RtlReAllocateHeap@16
|
|
RtlReadMemoryStream@16
|
|
RtlReadOutOfProcessMemoryStream@16
|
|
RtlReadThreadProfilingData@12
|
|
RtlRealPredecessor@4
|
|
RtlRealSuccessor@4
|
|
RtlRegisterSecureMemoryCacheCallback@4
|
|
RtlRegisterThreadWithCsrss@0
|
|
RtlRegisterWait@24
|
|
RtlReleaseActivationContext@4
|
|
RtlReleaseMemoryStream@4
|
|
RtlReleasePebLock@0
|
|
RtlReleasePrivilege@4
|
|
RtlReleaseRelativeName@4
|
|
RtlReleaseResource@4
|
|
RtlReleaseSRWLockExclusive@4
|
|
RtlReleaseSRWLockShared@4
|
|
RtlRemoteCall@28
|
|
RtlRemoveEntryHashTable@12
|
|
RtlRemovePrivileges@12
|
|
RtlRemoveVectoredContinueHandler@4
|
|
RtlRemoveVectoredExceptionHandler@4
|
|
RtlReplaceSidInSd@16
|
|
RtlReportException@12
|
|
RtlReportSilentProcessExit@8
|
|
RtlReportSqmEscalation@24
|
|
RtlResetMemoryBlockLookaside@4
|
|
RtlResetMemoryZone@4
|
|
RtlResetRtlTranslations@4
|
|
RtlRestoreLastWin32Error@4
|
|
RtlRetrieveNtUserPfn@12
|
|
RtlRevertMemoryStream@4
|
|
RtlRunDecodeUnicodeString@8
|
|
RtlRunEncodeUnicodeString@8
|
|
RtlRunOnceBeginInitialize@12
|
|
RtlRunOnceComplete@12
|
|
RtlRunOnceExecuteOnce@16
|
|
RtlRunOnceInitialize@4
|
|
RtlSecondsSince1970ToTime@8
|
|
RtlSecondsSince1980ToTime@8
|
|
RtlSeekMemoryStream@20
|
|
RtlSelfRelativeToAbsoluteSD2@8
|
|
RtlSelfRelativeToAbsoluteSD@44
|
|
RtlSendMsgToSm@8
|
|
RtlSetAllBits@4
|
|
RtlSetAttributesSecurityDescriptor@12
|
|
RtlSetBits@12
|
|
RtlSetControlSecurityDescriptor@12
|
|
RtlSetCriticalSectionSpinCount@8
|
|
RtlSetCurrentDirectory_U@4
|
|
RtlSetCurrentEnvironment@8
|
|
RtlSetCurrentTransaction@4
|
|
RtlSetDaclSecurityDescriptor@16
|
|
RtlSetDynamicTimeZoneInformation@4
|
|
RtlSetEnvironmentStrings@8
|
|
RtlSetEnvironmentVar@20
|
|
RtlSetEnvironmentVariable@12
|
|
RtlSetExtendedFeaturesMask@12
|
|
RtlSetGroupSecurityDescriptor@12
|
|
RtlSetHeapInformation@16
|
|
RtlSetInformationAcl@16
|
|
RtlSetIoCompletionCallback@12
|
|
RtlSetLastWin32Error@4
|
|
RtlSetLastWin32ErrorAndNtStatusFromNtStatus@4
|
|
RtlSetMemoryStreamSize@12
|
|
RtlSetOwnerSecurityDescriptor@12
|
|
RtlSetProcessDebugInformation@12
|
|
RtlSetProcessIsCritical@0
|
|
RtlSetProcessPreferredUILanguages@12
|
|
RtlSetSaclSecurityDescriptor@16
|
|
RtlSetSecurityDescriptorRMControl@8
|
|
RtlSetSecurityObject@20
|
|
RtlSetSecurityObjectEx@24
|
|
RtlSetThreadErrorMode@8
|
|
RtlSetThreadIsCritical@0
|
|
RtlSetThreadPoolStartFunc@8
|
|
RtlSetThreadPreferredUILanguages@12
|
|
RtlSetTimeZoneInformation@4
|
|
RtlSetTimer@28
|
|
RtlSetUnhandledExceptionFilter@4
|
|
RtlSetUserCallbackExceptionFilter@4
|
|
RtlSetUserFlagsHeap@20
|
|
RtlSetUserValueHeap@16
|
|
RtlShutdownLpcServer@4
|
|
RtlSidDominates@12
|
|
RtlSidEqualLevel@12
|
|
RtlSidHashInitialize@12
|
|
RtlSidHashLookup@8
|
|
RtlSidIsHigherLevel@12
|
|
RtlSizeHeap@12
|
|
RtlSleepConditionVariableCS@12
|
|
RtlSleepConditionVariableSRW@16
|
|
RtlSplay@4
|
|
RtlStartRXact@4
|
|
RtlStatMemoryStream@12
|
|
RtlStringFromGUID@8
|
|
RtlSubAuthorityCountSid@4
|
|
RtlSubAuthoritySid@8
|
|
RtlSubtreePredecessor@4
|
|
RtlSubtreeSuccessor@4
|
|
RtlSystemTimeToLocalTime@8
|
|
RtlTestBit@8
|
|
RtlTimeFieldsToTime@8
|
|
RtlTimeToElapsedTimeFields@8
|
|
RtlTimeToSecondsSince1970@8
|
|
RtlTimeToSecondsSince1980@8
|
|
RtlTimeToTimeFields@8
|
|
RtlTraceDatabaseAdd@16
|
|
RtlTraceDatabaseCreate@20
|
|
RtlTraceDatabaseDestroy@4
|
|
RtlTraceDatabaseEnumerate@12
|
|
RtlTraceDatabaseFind@16
|
|
RtlTraceDatabaseLock@4
|
|
RtlTraceDatabaseUnlock@4
|
|
RtlTraceDatabaseValidate@4
|
|
RtlTryAcquirePebLock@0
|
|
RtlTryAcquireSRWLockExclusive@4
|
|
RtlTryAcquireSRWLockShared@4
|
|
RtlTryEnterCriticalSection@4
|
|
RtlUTF8ToUnicodeN@20
|
|
RtlUnhandledExceptionFilter2@8
|
|
RtlUnhandledExceptionFilter@4
|
|
RtlUnicodeStringToAnsiSize@4
|
|
RtlUnicodeStringToAnsiString@12
|
|
RtlUnicodeStringToCountedOemString@12
|
|
RtlUnicodeStringToInteger@12
|
|
RtlUnicodeStringToOemSize@4
|
|
RtlUnicodeStringToOemString@12
|
|
RtlUnicodeToCustomCPN@24
|
|
RtlUnicodeToMultiByteN@20
|
|
RtlUnicodeToMultiByteSize@12
|
|
RtlUnicodeToOemN@20
|
|
RtlUnicodeToUTF8N@20
|
|
RtlUniform@4
|
|
RtlUnlockBootStatusData@4
|
|
RtlUnlockCurrentThread@0
|
|
RtlUnlockHeap@4
|
|
RtlUnlockMemoryBlockLookaside@4
|
|
RtlUnlockMemoryStreamRegion@24
|
|
RtlUnlockMemoryZone@4
|
|
RtlUnlockModuleSection@4
|
|
RtlUnwind@16
|
|
RtlUpcaseUnicodeChar@4
|
|
RtlUpcaseUnicodeString@12
|
|
RtlUpcaseUnicodeStringToAnsiString@12
|
|
RtlUpcaseUnicodeStringToCountedOemString@12
|
|
RtlUpcaseUnicodeStringToOemString@12
|
|
RtlUpcaseUnicodeToCustomCPN@24
|
|
RtlUpcaseUnicodeToMultiByteN@20
|
|
RtlUpcaseUnicodeToOemN@20
|
|
RtlUpdateClonedCriticalSection@4
|
|
RtlUpdateClonedSRWLock@8
|
|
RtlUpdateTimer@16
|
|
RtlUpperChar@4
|
|
RtlUpperString@8
|
|
RtlUsageHeap@12
|
|
; Not sure.
|
|
RtlUserThreadStart
|
|
RtlValidAcl@4
|
|
RtlValidRelativeSecurityDescriptor@12
|
|
RtlValidSecurityDescriptor@4
|
|
RtlValidSid@4
|
|
RtlValidateHeap@12
|
|
RtlValidateProcessHeaps@0
|
|
RtlValidateUnicodeString@8
|
|
RtlVerifyVersionInfo@16
|
|
RtlWakeAllConditionVariable@4
|
|
RtlWakeConditionVariable@4
|
|
RtlWalkFrameChain@12
|
|
RtlWalkHeap@8
|
|
RtlWeaklyEnumerateEntryHashTable@8
|
|
RtlWerpReportException@16
|
|
RtlWow64CallFunction64@28
|
|
RtlWow64EnableFsRedirection@4
|
|
RtlWow64EnableFsRedirectionEx@8
|
|
RtlWow64LogMessageInEventLogger@12
|
|
RtlWriteMemoryStream@16
|
|
RtlWriteRegistryValue@24
|
|
RtlZeroHeap@8
|
|
RtlZeroMemory@8
|
|
RtlZombifyActivationContext@4
|
|
RtlpApplyLengthFunction@16
|
|
RtlpCheckDynamicTimeZoneInformation@8
|
|
RtlpCleanupRegistryKeys@0
|
|
RtlpConvertCultureNamesToLCIDs@8
|
|
RtlpConvertLCIDsToCultureNames@8
|
|
RtlpCreateProcessRegistryInfo@4
|
|
RtlpEnsureBufferSize@12
|
|
RtlpGetLCIDFromLangInfoNode@12
|
|
RtlpGetNameFromLangInfoNode@12
|
|
RtlpGetSystemDefaultUILanguage@4 ; Check!!! gendef says @8
|
|
RtlpGetUserOrMachineUILanguage4NLS@12
|
|
RtlpInitializeLangRegistryInfo@4
|
|
RtlpIsQualifiedLanguage@12
|
|
RtlpLoadMachineUIByPolicy@12
|
|
RtlpLoadUserUIByPolicy@12
|
|
RtlpMuiFreeLangRegistryInfo@4
|
|
RtlpMuiRegCreateRegistryInfo@0
|
|
RtlpMuiRegFreeRegistryInfo@8
|
|
RtlpMuiRegLoadRegistryInfo@8
|
|
RtlpNotOwnerCriticalSection@0 ; Check!!! gebdef says @4
|
|
RtlpNtCreateKey@24
|
|
RtlpNtEnumerateSubKey@16
|
|
RtlpNtMakeTemporaryKey@4
|
|
RtlpNtOpenKey@16
|
|
RtlpNtQueryValueKey@20
|
|
RtlpNtSetValueKey@16
|
|
RtlpQueryDefaultUILanguage@8
|
|
; Not sure.
|
|
RtlpQueryProcessDebugInformationRemote
|
|
RtlpRefreshCachedUILanguage@8
|
|
RtlpSetInstallLanguage@8
|
|
RtlpSetPreferredUILanguages@12
|
|
RtlpSetUserPreferredUILanguages@12
|
|
RtlpUnWaitCriticalSection@4
|
|
RtlpVerifyAndCommitUILanguageSettings@4
|
|
RtlpWaitForCriticalSection@4
|
|
RtlxAnsiStringToUnicodeSize@4
|
|
RtlxOemStringToUnicodeSize@4
|
|
RtlxUnicodeStringToAnsiSize@4
|
|
RtlxUnicodeStringToOemSize@4
|
|
SbExecuteProcedure@20
|
|
SbSelectProcedure@16
|
|
ShipAssert@8
|
|
ShipAssertGetBufferInfo@8
|
|
ShipAssertMsgA@12
|
|
ShipAssertMsgW@12
|
|
TpAllocAlpcCompletion@20
|
|
TpAllocAlpcCompletionEx@20
|
|
TpAllocCleanupGroup@4
|
|
TpAllocIoCompletion@20
|
|
TpAllocPool@8
|
|
TpAllocTimer@16
|
|
TpAllocWait@16
|
|
TpAllocWork@16
|
|
TpAlpcRegisterCompletionList@4
|
|
TpAlpcUnregisterCompletionList@4
|
|
TpCallbackIndependent@4
|
|
TpCallbackLeaveCriticalSectionOnCompletion@8
|
|
TpCallbackMayRunLong@4
|
|
TpCallbackReleaseMutexOnCompletion@8
|
|
TpCallbackReleaseSemaphoreOnCompletion@12
|
|
TpCallbackSetEventOnCompletion@8
|
|
TpCallbackUnloadDllOnCompletion@8
|
|
TpCancelAsyncIoOperation@4
|
|
TpCaptureCaller@4
|
|
TpCheckTerminateWorker@4
|
|
TpDbgDumpHeapUsage@12
|
|
TpDbgGetFreeInfo@8
|
|
TpDbgSetLogRoutine@4
|
|
TpDisablePoolCallbackChecks@4
|
|
TpDisassociateCallback@4
|
|
TpIsTimerSet@4
|
|
TpPoolFreeUnusedNodes@4
|
|
TpPostWork@4
|
|
TpQueryPoolStackInformation@8
|
|
TpReleaseAlpcCompletion@4
|
|
TpReleaseCleanupGroup@4
|
|
TpReleaseCleanupGroupMembers@12
|
|
TpReleaseIoCompletion@4
|
|
TpReleasePool@4
|
|
TpReleaseTimer@4
|
|
TpReleaseWait@4
|
|
TpReleaseWork@4
|
|
TpSetDefaultPoolMaxThreads@4
|
|
TpSetDefaultPoolStackInformation@4
|
|
TpSetPoolMaxThreads@8
|
|
TpSetPoolMinThreads@8
|
|
TpSetPoolStackInformation@8
|
|
TpSetTimer@16
|
|
TpSetWait@12
|
|
TpSimpleTryPost@12
|
|
TpStartAsyncIoOperation@4
|
|
TpWaitForAlpcCompletion@4
|
|
TpWaitForIoCompletion@8
|
|
TpWaitForTimer@8
|
|
TpWaitForWait@8
|
|
TpWaitForWork@8
|
|
VerSetConditionMask@16
|
|
WerCheckEventEscalation@8
|
|
WerReportSQMEvent@12
|
|
WerReportWatsonEvent@16
|
|
WerReportSQMEvent@16
|
|
WinSqmAddToAverageDWORD@12
|
|
WinSqmAddToStream@16
|
|
WinSqmAddToStreamEx@20
|
|
WinSqmCheckEscalationAddToStreamEx@20
|
|
WinSqmCheckEscalationSetDWORD64@20
|
|
WinSqmCheckEscalationSetDWORD@16
|
|
WinSqmCheckEscalationSetString@16
|
|
WinSqmCommonDatapointDelete@4
|
|
WinSqmCommonDatapointSetDWORD64@16
|
|
WinSqmCommonDatapointSetDWORD@12
|
|
WinSqmCommonDatapointSetStreamEx@20
|
|
WinSqmCommonDatapointSetString@12
|
|
WinSqmEndSession@4
|
|
WinSqmEventEnabled@8
|
|
WinSqmEventWrite@12
|
|
WinSqmGetEscalationRuleStatus@8
|
|
WinSqmGetInstrumentationProperty@16
|
|
WinSqmIncrementDWORD@12
|
|
WinSqmIsOptedIn@0
|
|
WinSqmIsOptedInEx@4
|
|
WinSqmSetDWORD64@16
|
|
WinSqmSetDWORD@12
|
|
WinSqmSetEscalationInfo@16
|
|
WinSqmSetIfMaxDWORD@12
|
|
WinSqmSetIfMinDWORD@12
|
|
WinSqmSetString@12
|
|
WinSqmStartSession@12
|
|
ZwAcceptConnectPort@24
|
|
ZwAccessCheck@32
|
|
ZwAccessCheckAndAuditAlarm@44
|
|
ZwAccessCheckByType@44
|
|
ZwAccessCheckByTypeAndAuditAlarm@64
|
|
ZwAccessCheckByTypeResultList@44
|
|
ZwAccessCheckByTypeResultListAndAuditAlarm@64
|
|
ZwAccessCheckByTypeResultListAndAuditAlarmByHandle@68
|
|
ZwAcquireCMFViewOwnership@12
|
|
ZwAddAtom@12
|
|
ZwAddBootEntry@8
|
|
ZwAddDriverEntry@8
|
|
ZwAdjustGroupsToken@24
|
|
ZwAdjustPrivilegesToken@24
|
|
ZwAlertResumeThread@8
|
|
ZwAlertThread@4
|
|
ZwAllocateLocallyUniqueId@4
|
|
ZwAllocateReserveObject@12
|
|
ZwAllocateUserPhysicalPages@12
|
|
ZwAllocateUuids@16
|
|
ZwAllocateVirtualMemory@24
|
|
ZwAlpcAcceptConnectPort@36
|
|
ZwAlpcCancelMessage@12
|
|
ZwAlpcConnectPort@44
|
|
ZwAlpcCreatePort@12
|
|
ZwAlpcCreatePortSection@24
|
|
ZwAlpcCreateResourceReserve@16
|
|
ZwAlpcCreateSectionView@12
|
|
ZwAlpcCreateSecurityContext@12
|
|
ZwAlpcDeletePortSection@12
|
|
ZwAlpcDeleteResourceReserve@12
|
|
ZwAlpcDeleteSectionView@12
|
|
ZwAlpcDeleteSecurityContext@12
|
|
ZwAlpcDisconnectPort@8
|
|
ZwAlpcImpersonateClientOfPort@12
|
|
ZwAlpcOpenSenderProcess@24
|
|
ZwAlpcOpenSenderThread@24
|
|
ZwAlpcQueryInformation@20
|
|
ZwAlpcQueryInformationMessage@24
|
|
ZwAlpcRevokeSecurityContext@12
|
|
ZwAlpcSendWaitReceivePort@32
|
|
ZwAlpcSetInformation@16
|
|
ZwApphelpCacheControl@8
|
|
ZwAreMappedFilesTheSame@8
|
|
ZwAssignProcessToJobObject@8
|
|
ZwCallbackReturn@12
|
|
ZwCancelDeviceWakeupRequest@4
|
|
ZwCancelIoFile@8
|
|
ZwCancelIoFileEx@12
|
|
ZwCancelSynchronousIoFile@12
|
|
ZwCancelTimer@8
|
|
ZwClearEvent@4
|
|
ZwClose@4
|
|
ZwCloseObjectAuditAlarm@12
|
|
ZwCommitComplete@8
|
|
ZwCommitEnlistment@8
|
|
ZwCommitTransaction@8
|
|
ZwCompactKeys@8
|
|
ZwCompareTokens@12
|
|
ZwCompleteConnectPort@4
|
|
ZwCompressKey@4
|
|
ZwConnectPort@32
|
|
ZwContinue@8
|
|
ZwCreateDebugObject@16
|
|
ZwCreateDirectoryObject@12
|
|
ZwCreateEnlistment@32
|
|
ZwCreateEvent@20
|
|
ZwCreateEventPair@12
|
|
ZwCreateFile@44
|
|
ZwCreateIoCompletion@16
|
|
ZwCreateJobObject@12
|
|
ZwCreateJobSet@12
|
|
ZwCreateKey@28
|
|
ZwCreateKeyTransacted@32
|
|
ZwCreateKeyedEvent@16
|
|
ZwCreateMailslotFile@32
|
|
ZwCreateMutant@16
|
|
ZwCreateNamedPipeFile@56
|
|
ZwCreatePagingFile@16
|
|
ZwCreatePort@20
|
|
ZwCreatePrivateNamespace@16
|
|
ZwCreateProcess@32
|
|
ZwCreateProcessEx@36
|
|
ZwCreateProfile@36
|
|
ZwCreateProfileEx@40
|
|
ZwCreateResourceManager@28
|
|
ZwCreateSection@28
|
|
ZwCreateSemaphore@20
|
|
ZwCreateSymbolicLinkObject@16
|
|
ZwCreateThread@32
|
|
ZwCreateThreadEx@44
|
|
ZwCreateTimer@16
|
|
ZwCreateToken@52
|
|
ZwCreateTransaction@40
|
|
ZwCreateTransactionManager@24
|
|
ZwCreateUserProcess@44
|
|
ZwCreateWaitablePort@20
|
|
ZwCreateWorkerFactory@40
|
|
ZwDebugActiveProcess@8
|
|
ZwDebugContinue@12
|
|
ZwDelayExecution@8
|
|
ZwDeleteAtom@4
|
|
ZwDeleteBootEntry@4
|
|
ZwDeleteDriverEntry@4
|
|
ZwDeleteFile@4
|
|
ZwDeleteKey@4
|
|
ZwDeleteObjectAuditAlarm@12
|
|
ZwDeletePrivateNamespace@4
|
|
ZwDeleteValueKey@8
|
|
ZwDeviceIoControlFile@40
|
|
ZwDisableLastKnownGood@0
|
|
ZwDisplayString@4
|
|
ZwDrawText@4
|
|
ZwDuplicateObject@28
|
|
ZwDuplicateToken@24
|
|
ZwEnableLastKnownGood@0
|
|
ZwEnumerateBootEntries@8
|
|
ZwEnumerateDriverEntries@8
|
|
ZwEnumerateKey@24
|
|
ZwEnumerateSystemEnvironmentValuesEx@12
|
|
ZwEnumerateTransactionObject@20
|
|
ZwEnumerateValueKey@24
|
|
ZwExtendSection@8
|
|
ZwFilterToken@24
|
|
ZwFindAtom@12
|
|
ZwFlushBuffersFile@8
|
|
ZwFlushInstallUILanguage@8
|
|
ZwFlushInstructionCache@12
|
|
ZwFlushKey@4
|
|
ZwFlushProcessWriteBuffers@0
|
|
ZwFlushVirtualMemory@16
|
|
ZwFlushWriteBuffer@0
|
|
ZwFreeUserPhysicalPages@12
|
|
ZwFreeVirtualMemory@16
|
|
ZwFreezeRegistry@4
|
|
ZwFreezeTransactions@8
|
|
ZwFsControlFile@40
|
|
ZwGetContextThread@8
|
|
ZwGetCurrentProcessorNumber@0
|
|
ZwGetDevicePowerState@8
|
|
ZwGetMUIRegistryInfo@12
|
|
ZwGetNextProcess@20
|
|
ZwGetNextThread@24
|
|
ZwGetNlsSectionPtr@20
|
|
ZwGetNotificationResourceManager@28
|
|
ZwGetPlugPlayEvent@16
|
|
ZwGetTickCount@0
|
|
ZwGetWriteWatch@28
|
|
ZwImpersonateAnonymousToken@4
|
|
ZwImpersonateClientOfPort@8
|
|
ZwImpersonateThread@12
|
|
ZwInitializeNlsFiles@16
|
|
ZwInitializeRegistry@4
|
|
ZwInitiatePowerAction@16
|
|
ZwIsProcessInJob@8
|
|
ZwIsSystemResumeAutomatic@0
|
|
ZwIsUILanguageComitted@0
|
|
ZwListenPort@8
|
|
ZwLoadDriver@4
|
|
ZwLoadKey2@12
|
|
ZwLoadKey@8
|
|
ZwLoadKeyEx@32
|
|
ZwLockFile@40
|
|
ZwLockProductActivationKeys@8
|
|
ZwLockRegistryKey@4
|
|
ZwLockVirtualMemory@16
|
|
ZwMakePermanentObject@4
|
|
ZwMakeTemporaryObject@4
|
|
ZwMapCMFModule@24
|
|
ZwMapUserPhysicalPages@12
|
|
ZwMapUserPhysicalPagesScatter@12
|
|
ZwMapViewOfSection@40
|
|
ZwModifyBootEntry@4
|
|
ZwModifyDriverEntry@4
|
|
ZwNotifyChangeDirectoryFile@36
|
|
ZwNotifyChangeKey@40
|
|
ZwNotifyChangeMultipleKeys@48
|
|
ZwNotifyChangeSession@32
|
|
ZwOpenDirectoryObject@12
|
|
ZwOpenEnlistment@20
|
|
ZwOpenEvent@12
|
|
ZwOpenEventPair@12
|
|
ZwOpenFile@24
|
|
ZwOpenIoCompletion@12
|
|
ZwOpenJobObject@12
|
|
ZwOpenKey@12
|
|
ZwOpenKeyEx@16
|
|
ZwOpenKeyTransacted@16
|
|
ZwOpenKeyTransactedEx@20
|
|
ZwOpenKeyedEvent@12
|
|
ZwOpenMutant@12
|
|
ZwOpenObjectAuditAlarm@48
|
|
ZwOpenPrivateNamespace@16
|
|
ZwOpenProcess@16
|
|
ZwOpenProcessToken@12
|
|
ZwOpenProcessTokenEx@16
|
|
ZwOpenResourceManager@20
|
|
ZwOpenSection@12
|
|
ZwOpenSemaphore@12
|
|
ZwOpenSession@12
|
|
ZwOpenSymbolicLinkObject@12
|
|
ZwOpenThread@16
|
|
ZwOpenThreadToken@16
|
|
ZwOpenThreadTokenEx@20
|
|
ZwOpenTimer@12
|
|
ZwOpenTransaction@20
|
|
ZwOpenTransactionManager@24
|
|
ZwPlugPlayControl@12
|
|
ZwPowerInformation@20
|
|
ZwPrePrepareComplete@8
|
|
ZwPrePrepareEnlistment@8
|
|
ZwPrepareComplete@8
|
|
ZwPrepareEnlistment@8
|
|
ZwPrivilegeCheck@12
|
|
ZwPrivilegeObjectAuditAlarm@24
|
|
ZwPrivilegedServiceAuditAlarm@20
|
|
ZwPropagationComplete@16
|
|
ZwPropagationFailed@12
|
|
ZwProtectVirtualMemory@20
|
|
ZwPulseEvent@8
|
|
ZwQueryAttributesFile@8
|
|
ZwQueryBootEntryOrder@8
|
|
ZwQueryBootOptions@8
|
|
ZwQueryDebugFilterState@8
|
|
ZwQueryDefaultLocale@8
|
|
ZwQueryDefaultUILanguage@4
|
|
ZwQueryDirectoryFile@44
|
|
ZwQueryDirectoryObject@28
|
|
ZwQueryDriverEntryOrder@8
|
|
ZwQueryEaFile@36
|
|
ZwQueryEvent@20
|
|
ZwQueryFullAttributesFile@8
|
|
ZwQueryInformationAtom@20
|
|
ZwQueryInformationEnlistment@20
|
|
ZwQueryInformationFile@20
|
|
ZwQueryInformationJobObject@20
|
|
ZwQueryInformationPort@20
|
|
ZwQueryInformationProcess@20
|
|
ZwQueryInformationResourceManager@20
|
|
ZwQueryInformationThread@20
|
|
ZwQueryInformationToken@20
|
|
ZwQueryInformationTransaction@20
|
|
ZwQueryInformationTransactionManager@20
|
|
ZwQueryInformationWorkerFactory@20
|
|
ZwQueryInstallUILanguage@4
|
|
ZwQueryIntervalProfile@8
|
|
ZwQueryIoCompletion@20
|
|
ZwQueryKey@20
|
|
ZwQueryLicenseValue@20
|
|
ZwQueryMultipleValueKey@24
|
|
ZwQueryMutant@20
|
|
ZwQueryObject@20
|
|
ZwQueryOpenSubKeys@8
|
|
ZwQueryOpenSubKeysEx@16
|
|
ZwQueryPerformanceCounter@8
|
|
ZwQueryPortInformationProcess@0
|
|
ZwQueryQuotaInformationFile@36
|
|
ZwQuerySection@20
|
|
ZwQuerySecurityAttributesToken@24
|
|
ZwQuerySecurityObject@20
|
|
ZwQuerySemaphore@20
|
|
ZwQuerySymbolicLinkObject@12
|
|
ZwQuerySystemEnvironmentValue@16
|
|
ZwQuerySystemEnvironmentValueEx@20
|
|
ZwQuerySystemInformation@16
|
|
ZwQuerySystemInformationEx@24
|
|
ZwQuerySystemTime@4
|
|
ZwQueryTimer@20
|
|
ZwQueryTimerResolution@12
|
|
ZwQueryValueKey@24
|
|
ZwQueryVirtualMemory@24
|
|
ZwQueryVolumeInformationFile@20
|
|
ZwQueueApcThread@20
|
|
ZwQueueApcThreadEx@24
|
|
ZwRaiseException@12
|
|
ZwRaiseHardError@24
|
|
ZwReadFile@36
|
|
ZwReadFileScatter@36
|
|
ZwReadOnlyEnlistment@8
|
|
ZwReadRequestData@24
|
|
ZwReadVirtualMemory@20
|
|
ZwRecoverEnlistment@8
|
|
ZwRecoverResourceManager@4
|
|
ZwRecoverTransactionManager@4
|
|
ZwRegisterProtocolAddressInformation@20
|
|
ZwRegisterThreadTerminatePort@4
|
|
ZwReleaseCMFViewOwnership@0
|
|
ZwReleaseKeyedEvent@16
|
|
ZwReleaseMutant@8
|
|
ZwReleaseSemaphore@12
|
|
ZwReleaseWorkerFactoryWorker@4
|
|
ZwRemoveIoCompletion@20
|
|
ZwRemoveIoCompletionEx@24
|
|
ZwRemoveProcessDebug@8
|
|
ZwRenameKey@8
|
|
ZwRenameTransactionManager@8
|
|
ZwReplaceKey@12
|
|
ZwReplacePartitionUnit@12
|
|
ZwReplyPort@8
|
|
ZwReplyWaitReceivePort@16
|
|
ZwReplyWaitReceivePortEx@20
|
|
ZwReplyWaitReplyPort@8
|
|
ZwRequestDeviceWakeup@4
|
|
ZwRequestPort@8
|
|
ZwRequestWaitReplyPort@12
|
|
ZwRequestWakeupLatency@4
|
|
ZwResetEvent@8
|
|
ZwResetWriteWatch@12
|
|
ZwRestoreKey@12
|
|
ZwResumeProcess@4
|
|
ZwResumeThread@8
|
|
ZwRollbackComplete@8
|
|
ZwRollbackEnlistment@8
|
|
ZwRollbackTransaction@8
|
|
ZwRollforwardTransactionManager@8
|
|
ZwSaveKey@8
|
|
ZwSaveKeyEx@12
|
|
ZwSaveMergedKeys@12
|
|
ZwSecureConnectPort@36
|
|
ZwSerializeBoot@0
|
|
ZwSetBootEntryOrder@8
|
|
ZwSetBootOptions@8
|
|
ZwSetContextThread@8
|
|
ZwSetDebugFilterState@12
|
|
ZwSetDefaultHardErrorPort@4
|
|
ZwSetDefaultLocale@8
|
|
ZwSetDefaultUILanguage@4
|
|
ZwSetDriverEntryOrder@8
|
|
ZwSetEaFile@16
|
|
ZwSetEvent@8
|
|
ZwSetEventBoostPriority@4
|
|
ZwSetHighEventPair@4
|
|
ZwSetHighWaitLowEventPair@4
|
|
ZwSetInformationDebugObject@20
|
|
ZwSetInformationEnlistment@16
|
|
ZwSetInformationFile@20
|
|
ZwSetInformationJobObject@16
|
|
ZwSetInformationKey@16
|
|
ZwSetInformationObject@16
|
|
ZwSetInformationProcess@16
|
|
ZwSetInformationResourceManager@16
|
|
ZwSetInformationThread@16
|
|
ZwSetInformationToken@16
|
|
ZwSetInformationTransaction@16
|
|
ZwSetInformationTransactionManager@16
|
|
ZwSetInformationWorkerFactory@16
|
|
ZwSetIntervalProfile@8
|
|
ZwSetIoCompletion@20
|
|
ZwSetIoCompletionEx@24
|
|
ZwSetLdtEntries@24
|
|
ZwSetLowEventPair@4
|
|
ZwSetLowWaitHighEventPair@4
|
|
ZwSetQuotaInformationFile@16
|
|
ZwSetSecurityObject@12
|
|
ZwSetSystemEnvironmentValue@8
|
|
ZwSetSystemEnvironmentValueEx@20
|
|
ZwSetSystemInformation@12
|
|
ZwSetSystemPowerState@12
|
|
ZwSetSystemTime@8
|
|
ZwSetThreadExecutionState@8
|
|
ZwSetTimer@28
|
|
ZwSetTimerEx@16
|
|
ZwSetTimerResolution@12
|
|
ZwSetUuidSeed@4
|
|
ZwSetValueKey@24
|
|
ZwSetVolumeInformationFile@20
|
|
ZwShutdownSystem@4
|
|
ZwShutdownWorkerFactory@8
|
|
ZwSignalAndWaitForSingleObject@16
|
|
ZwSinglePhaseReject@8
|
|
ZwStartProfile@4
|
|
ZwStopProfile@4
|
|
ZwSuspendProcess@4
|
|
ZwSuspendThread@8
|
|
ZwSystemDebugControl@24
|
|
ZwTerminateJobObject@8
|
|
ZwTerminateProcess@8
|
|
ZwTerminateThread@8
|
|
ZwTestAlert@0
|
|
ZwThawRegistry@0
|
|
ZwThawTransactions@0
|
|
ZwTraceControl@24
|
|
ZwTraceEvent@16
|
|
ZwTranslateFilePath@16
|
|
ZwUmsThreadYield@4
|
|
ZwUnloadDriver@4
|
|
ZwUnloadKey2@8
|
|
ZwUnloadKey@4
|
|
ZwUnloadKeyEx@8
|
|
ZwUnlockFile@20
|
|
ZwUnlockVirtualMemory@16
|
|
ZwUnmapViewOfSection@8
|
|
ZwVdmControl@8
|
|
ZwWaitForDebugEvent@16
|
|
ZwWaitForKeyedEvent@16
|
|
ZwWaitForMultipleObjects32@20
|
|
ZwWaitForMultipleObjects@20
|
|
ZwWaitForSingleObject@12
|
|
ZwWaitForWorkViaWorkerFactory@8
|
|
ZwWaitHighEventPair@4
|
|
ZwWaitLowEventPair@4
|
|
ZwWorkerFactoryWorkerReady@4
|
|
ZwWow64CallFunction64@28
|
|
ZwWow64CsrAllocateCaptureBuffer@8
|
|
ZwWow64CsrAllocateMessagePointer@12
|
|
ZwWow64CsrCaptureMessageBuffer@16
|
|
ZwWow64CsrCaptureMessageString@20
|
|
ZwWow64CsrClientCallServer@16
|
|
ZwWow64CsrClientConnectToServer@20
|
|
ZwWow64CsrFreeCaptureBuffer@4
|
|
ZwWow64CsrGetProcessId@0
|
|
ZwWow64CsrIdentifyAlertableThread@0
|
|
ZwWow64CsrVerifyRegion@8
|
|
ZwWow64DebuggerCall@20
|
|
ZwWow64GetCurrentProcessorNumberEx@4
|
|
ZwWow64GetNativeSystemInformation@16
|
|
ZwWow64InterlockedPopEntrySList@4
|
|
ZwWow64QueryInformationProcess64@20
|
|
ZwWow64QueryVirtualMemory64@32
|
|
ZwWow64ReadVirtualMemory64@28
|
|
ZwWow64WriteVirtualMemory64@28
|
|
ZwWriteFile@36
|
|
ZwWriteFileGather@36
|
|
ZwWriteRequestData@24
|
|
ZwWriteVirtualMemory@20
|
|
ZwYieldExecution@0
|
|
_CIcos
|
|
_CIlog
|
|
_CIpow
|
|
_CIsin
|
|
_CIsqrt
|
|
__isascii
|
|
__iscsym
|
|
__iscsymf
|
|
__toascii
|
|
_alldiv
|
|
_alldvrm@16
|
|
_allmul@16
|
|
_alloca_probe
|
|
_alloca_probe_16
|
|
_alloca_probe_8
|
|
_allrem@16
|
|
_allshl
|
|
_allshr
|
|
_atoi64
|
|
_aulldiv@16
|
|
_aulldvrm@16
|
|
_aullrem@16
|
|
_aullshr
|
|
;_chkstk
|
|
_fltused DATA
|
|
_ftol
|
|
_i64toa
|
|
_i64toa_s
|
|
_i64tow
|
|
_i64tow_s
|
|
_itoa
|
|
_itoa_s
|
|
_itow
|
|
_itow_s
|
|
_lfind
|
|
_ltoa
|
|
_ltoa_s
|
|
_ltow
|
|
_ltow_s
|
|
_makepath_s
|
|
_memccpy
|
|
_memicmp
|
|
_snprintf
|
|
_snprintf_s
|
|
_snscanf_s
|
|
_snwprintf
|
|
_snwprintf_s
|
|
_snwscanf_s
|
|
_splitpath
|
|
_splitpath_s
|
|
_strcmpi
|
|
_stricmp
|
|
_strlwr
|
|
_strnicmp
|
|
_strnset_s
|
|
_strset_s
|
|
_strupr
|
|
_swprintf
|
|
_tolower
|
|
_toupper
|
|
_ui64toa
|
|
_ui64toa_s
|
|
_ui64tow
|
|
_ui64tow_s
|
|
_ultoa
|
|
_ultoa_s
|
|
_ultow
|
|
_ultow_s
|
|
_vscwprintf
|
|
_vsnprintf
|
|
_vsnprintf_s
|
|
_vsnwprintf
|
|
_vsnwprintf_s
|
|
_vswprintf
|
|
_wcsicmp
|
|
_wcslwr
|
|
_wcsnicmp
|
|
_wcsnset_s
|
|
_wcsset_s
|
|
_wcstoui64
|
|
_wcsupr
|
|
_wmakepath_s
|
|
_wsplitpath_s
|
|
_wtoi
|
|
_wtoi64
|
|
_wtol
|
|
abs
|
|
atan DATA
|
|
atoi
|
|
atol
|
|
bsearch
|
|
ceil
|
|
cos DATA
|
|
fabs DATA
|
|
floor DATA
|
|
isalnum
|
|
isalpha
|
|
iscntrl
|
|
isdigit
|
|
isgraph
|
|
islower
|
|
isprint
|
|
ispunct
|
|
isspace
|
|
isupper
|
|
iswalpha
|
|
iswctype
|
|
iswdigit
|
|
iswlower
|
|
iswspace
|
|
iswxdigit
|
|
isxdigit
|
|
labs
|
|
log
|
|
mbstowcs
|
|
memchr
|
|
memcmp
|
|
memcpy
|
|
memcpy_s
|
|
memmove
|
|
memmove_s
|
|
memset
|
|
pow
|
|
qsort
|
|
sin
|
|
sprintf
|
|
sprintf_s
|
|
sqrt
|
|
sscanf
|
|
sscanf_s
|
|
strcat
|
|
strcat_s
|
|
strchr
|
|
strcmp
|
|
strcpy
|
|
strcpy_s
|
|
strcspn
|
|
strlen
|
|
strncat
|
|
strncat_s
|
|
strncmp
|
|
strncpy
|
|
strncpy_s
|
|
strnlen
|
|
strpbrk
|
|
strrchr
|
|
strspn
|
|
strstr
|
|
strtok_s
|
|
strtol
|
|
strtoul
|
|
swprintf
|
|
swprintf_s
|
|
swscanf_s
|
|
tan
|
|
tolower
|
|
toupper
|
|
towlower
|
|
towupper
|
|
vDbgPrintEx@16
|
|
vDbgPrintExWithPrefix@20
|
|
vsprintf
|
|
vsprintf_s
|
|
vswprintf_s
|
|
wcscat
|
|
wcscat_s
|
|
wcschr
|
|
wcscmp
|
|
wcscpy
|
|
wcscpy_s
|
|
wcscspn
|
|
wcslen
|
|
wcsncat
|
|
wcsncat_s
|
|
wcsncmp
|
|
wcsncpy
|
|
wcsncpy_s
|
|
wcsnlen
|
|
wcspbrk
|
|
wcsrchr
|
|
wcsspn
|
|
wcsstr
|
|
wcstol
|
|
wcstombs
|
|
wcstoul
|