| ;note that the Zw... functions are alternate names for the |
| ;Nt... functions. (see www.sysinternals.com for details) |
| ;if you change a Nt.. function DON'T FORGET to change the |
| ;Zw one too. |
| |
| LIBRARY ntdll.dll |
| EXPORTS |
| CsrAllocateCaptureBuffer@8 |
| CsrAllocateMessagePointer@12 |
| CsrCaptureMessageBuffer@16 |
| CsrCaptureMessageString@20 |
| CsrCaptureTimeout@8 |
| CsrClientCallServer@16 |
| CsrClientConnectToServer@24 |
| CsrFreeCaptureBuffer@4 |
| CsrIdentifyAlertableThread@0 |
| CsrNewThread@0 |
| CsrProbeForRead@12 |
| CsrProbeForWrite@12 |
| CsrSetPriorityClass@8 |
| DbgBreakPoint@0 |
| DbgPrint |
| DbgPrintReturnControlC |
| DbgPrompt@12 |
| DbgSsHandleKmApiMsg@8 |
| DbgSsInitialize@16 |
| DbgUiConnectToDbg@0 |
| DbgUiContinue@8 |
| DbgUiWaitStateChange@8 |
| DbgUserBreakPoint@0 |
| KiRaiseUserExceptionDispatcher@0 |
| KiUserApcDispatcher@20 |
| KiUserCallbackDispatcher@12 |
| KiUserExceptionDispatcher@8 |
| LdrAccessResource@16 |
| LdrAlternateResourcesEnabled@0 |
| LdrDisableThreadCalloutsForDll@4 |
| LdrEnumResources@20 |
| LdrFindEntryForAddress@8 |
| LdrFindResourceDirectory_U@16 |
| LdrFindResource_U@16 |
| LdrFlushAlternateResourceModules@0 |
| LdrGetDllHandle@16 |
| LdrGetProcedureAddress@16 |
| LdrInitializeThunk@16 |
| LdrLoadAlternateResourceModule@8 |
| LdrLoadDll@16 |
| LdrProcessRelocationBlock@16 |
| LdrQueryImageFileExecutionOptions@24 |
| LdrQueryProcessModuleInformation@12 |
| LdrShutdownProcess@0 |
| LdrShutdownThread@0 |
| LdrUnloadAlternateResourceModule@4 |
| LdrUnloadDll@4 |
| LdrVerifyImageMatchesChecksum@16 |
| NlsAnsiCodePage |
| NlsMbCodePageTag |
| NlsMbOemCodePageTag |
| NtAcceptConnectPort@24 |
| NtAccessCheck@32 |
| NtAccessCheckAndAuditAlarm@44 |
| NtAccessCheckByType@44 |
| NtAccessCheckByTypeAndAuditAlarm@64 |
| NtAccessCheckByTypeResultList@44 |
| NtAccessCheckByTypeResultListAndAuditAlarm@64 |
| NtAccessCheckByTypeResultListAndAuditAlarmByHandle@68 |
| NtAddAtom@12 |
| NtAdjustGroupsToken@24 |
| NtAdjustPrivilegesToken@24 |
| NtAlertResumeThread@8 |
| NtAlertThread@4 |
| NtAllocateLocallyUniqueId@4 |
| NtAllocateUserPhysicalPages@12 |
| NtAllocateUuids@16 |
| NtAllocateVirtualMemory@24 |
| NtAreMappedFilesTheSame@8 |
| NtAssignProcessToJobObject@8 |
| NtCallbackReturn@12 |
| NtCancelDeviceWakeupRequest@4 |
| NtCancelIoFile@8 |
| NtCancelTimer@8 |
| NtClearEvent@4 |
| NtClose@4 |
| NtCloseObjectAuditAlarm@12 |
| NtCompleteConnectPort@4 |
| NtConnectPort@32 |
| NtContinue@8 |
| NtCreateDirectoryObject@12 |
| NtCreateEvent@20 |
| NtCreateEventPair@12 |
| NtCreateFile@44 |
| NtCreateIoCompletion@16 |
| NtCreateJobObject@12 |
| NtCreateKey@28 |
| NtCreateMailslotFile@32 |
| NtCreateMutant@16 |
| NtCreateNamedPipeFile@56 |
| NtCreatePagingFile@16 |
| NtCreatePort@20 |
| NtCreateProcess@32 |
| NtCreateProfile@36 |
| NtCreateSection@28 |
| NtCreateSemaphore@20 |
| NtCreateSymbolicLinkObject@16 |
| NtCreateThread@32 |
| NtCreateTimer@16 |
| NtCreateToken@52 |
| NtCreateWaitablePort@20 |
| NtDelayExecution@8 |
| NtDeleteAtom@4 |
| NtDeleteFile@4 |
| NtDeleteKey@4 |
| NtDeleteObjectAuditAlarm@12 |
| NtDeleteValueKey@8 |
| NtDeviceIoControlFile@40 |
| NtDisplayString@4 |
| NtDuplicateObject@28 |
| NtDuplicateToken@24 |
| NtEnumerateKey@24 |
| NtEnumerateValueKey@24 |
| NtExtendSection@8 |
| NtFilterToken@24 |
| NtFindAtom@12 |
| NtFlushBuffersFile@8 |
| NtFlushInstructionCache@12 |
| NtFlushKey@4 |
| NtFlushVirtualMemory@16 |
| NtFlushWriteBuffer@0 |
| NtFreeUserPhysicalPages@12 |
| NtFreeVirtualMemory@16 |
| NtFsControlFile@40 |
| NtGetContextThread@8 |
| NtGetDevicePowerState@8 |
| NtGetPlugPlayEvent@16 |
| NtGetTickCount@0 |
| NtGetWriteWatch@28 |
| NtImpersonateAnonymousToken@8 |
| NtImpersonateClientOfPort@8 |
| NtImpersonateThread@12 |
| NtInitializeRegistry@4 |
| NtInitiatePowerAction@16 |
| NtIsSystemResumeAutomatic@0 |
| NtListenPort@8 |
| NtLoadDriver@4 |
| NtLoadKey@8 |
| NtLoadKey2@12 |
| NtLockFile@40 |
| NtLockVirtualMemory@16 |
| NtMakeTemporaryObject@4 |
| NtMapUserPhysicalPages@12 |
| NtMapUserPhysicalPagesScatter@12 |
| NtMapViewOfSection@40 |
| NtNotifyChangeDirectoryFile@36 |
| NtNotifyChangeKey@40 |
| NtNotifyChangeMultipleKeys@48 |
| NtOpenDirectoryObject@12 |
| NtOpenEvent@12 |
| NtOpenEventPair@12 |
| NtOpenFile@24 |
| NtOpenIoCompletion@12 |
| NtOpenJobObject@12 |
| NtOpenKey@12 |
| NtOpenMutant@12 |
| NtOpenObjectAuditAlarm@48 |
| NtOpenProcess@16 |
| NtOpenProcessToken@12 |
| NtOpenSection@12 |
| NtOpenSemaphore@12 |
| NtOpenSymbolicLinkObject@12 |
| NtOpenThread@16 |
| NtOpenThreadToken@16 |
| NtOpenTimer@12 |
| NtPowerInformation@20 |
| NtPrivilegeCheck@12 |
| NtPrivilegedServiceAuditAlarm@20 |
| NtPrivilegeObjectAuditAlarm@24 |
| NtProtectVirtualMemory@20 |
| NtPulseEvent@8 |
| NtQueryAttributesFile@8 |
| NtQueryDefaultLocale@8 |
| NtQueryDefaultUILanguage@4 |
| NtQueryDirectoryFile@44 |
| NtQueryDirectoryObject@28 |
| NtQueryEaFile@36 |
| NtQueryEvent@20 |
| NtQueryFullAttributesFile@8 |
| NtQueryInformationAtom@20 |
| NtQueryInformationFile@20 |
| NtQueryInformationJobObject@20 |
| NtQueryInformationPort@20 |
| NtQueryInformationProcess@20 |
| NtQueryInformationThread@20 |
| NtQueryInformationToken@20 |
| NtQueryIntervalProfile@8 |
| NtQueryIoCompletion@20 |
| NtQueryKey@20 |
| NtQueryMultipleValueKey@24 |
| NtQueryMutant@20 |
| NtQueryObject@20 |
| NtQueryOpenSubKeys@8 |
| NtQueryPerformanceCounter@8 |
| NtQueryQuotaInformationFile@36 |
| NtQuerySection@20 |
| NtQuerySecurityObject@20 |
| NtQuerySemaphore@20 |
| NtQuerySymbolicLinkObject@12 |
| NtQuerySystemEnvironmentValue@16 |
| NtQuerySystemInformation@16 |
| NtQuerySystemTime@4 |
| NtQueryTimer@20 |
| NtQueryTimerResolution@12 |
| NtQueryValueKey@24 |
| NtQueryVirtualMemory@24 |
| NtQueryVolumeInformationFile@20 |
| NtQueueApcThread@20 |
| NtRaiseException@12 |
| NtRaiseHardError@24 |
| NtReadFile@36 |
| NtReadFileScatter@36 |
| NtReadRequestData@24 |
| NtReadVirtualMemory@20 |
| NtRegisterThreadTerminatePort@4 |
| NtReleaseMutant@8 |
| NtReleaseSemaphore@12 |
| NtRemoveIoCompletion@20 |
| NtReplaceKey@12 |
| NtReplyPort@8 |
| NtReplyWaitReceivePort@16 |
| NtReplyWaitReceivePortEx@20 |
| NtReplyWaitReplyPort@8 |
| NtRequestDeviceWakeup@4 |
| NtRequestPort@8 |
| NtRequestWaitReplyPort@12 |
| NtRequestWakeupLatency@4 |
| NtResetEvent@8 |
| NtResetWriteWatch@12 |
| NtRestoreKey@12 |
| NtResumeThread@8 |
| NtSaveKey@8 |
| NtSaveMergedKeys@12 |
| NtSecureConnectPort@36 |
| NtSetContextThread@8 |
| NtSetDefaultHardErrorPort@4 |
| NtSetDefaultLocale@8 |
| NtSetDefaultUILanguage@4 |
| NtSetEaFile@16 |
| NtSetEvent@8 |
| NtSetHighEventPair@4 |
| NtSetHighWaitLowEventPair@4 |
| NtSetInformationFile@20 |
| NtSetInformationJobObject@16 |
| NtSetInformationKey@16 |
| NtSetInformationObject@16 |
| NtSetInformationProcess@16 |
| NtSetInformationThread@16 |
| NtSetInformationToken@16 |
| NtSetIntervalProfile@8 |
| NtSetIoCompletion@20 |
| NtSetLdtEntries@16 |
| NtSetLowEventPair@4 |
| NtSetLowWaitHighEventPair@4 |
| NtSetQuotaInformationFile@16 |
| NtSetSecurityObject@12 |
| NtSetSystemEnvironmentValue@8 |
| NtSetSystemInformation@12 |
| NtSetSystemPowerState@12 |
| NtSetSystemTime@8 |
| NtSetThreadExecutionState@8 |
| NtSetTimer@28 |
| NtSetTimerResolution@12 |
| NtSetUuidSeed@4 |
| NtSetValueKey@24 |
| NtSetVolumeInformationFile@20 |
| NtShutdownSystem@4 |
| NtSignalAndWaitForSingleObject@16 |
| NtStartProfile@4 |
| NtStopProfile@4 |
| NtSuspendThread@8 |
| NtSystemDebugControl@24 |
| NtTerminateJobObject@8 |
| NtTerminateProcess@8 |
| NtTerminateThread@8 |
| NtTestAlert@0 |
| NtUnloadDriver@4 |
| NtUnloadKey@4 |
| NtUnlockFile@20 |
| NtUnlockVirtualMemory@16 |
| NtUnmapViewOfSection@8 |
| NtVdmControl@8 |
| NtWaitForMultipleObjects@20 |
| NtWaitForSingleObject@12 |
| NtWaitHighEventPair@4 |
| NtWaitLowEventPair@4 |
| NtWriteFile@36 |
| NtWriteFileGather@36 |
| NtWriteRequestData@24 |
| NtWriteVirtualMemory@20 |
| NtYieldExecution@0 |
| RtlAbortRXact@4 |
| RtlAbsoluteToSelfRelativeSD@12 |
| RtlAcquirePebLock@0 |
| RtlAcquireResourceExclusive@8 |
| RtlAcquireResourceShared@8 |
| RtlAddAccessAllowedAce@16 |
| RtlAddAccessAllowedAceEx@20 |
| RtlAddAccessAllowedObjectAce@28 |
| RtlAddAccessDeniedAce@16 |
| RtlAddAccessDeniedAceEx@20 |
| RtlAddAccessDeniedObjectAce@28 |
| RtlAddAce@20 |
| RtlAddActionToRXact@24 |
| RtlAddAtomToAtomTable@12 |
| RtlAddAttributeActionToRXact@32 |
| RtlAddAuditAccessAce@24 |
| RtlAddAuditAccessAceEx@28 |
| RtlAddAuditAccessObjectAce@36 |
| RtlAddCompoundAce@24 |
| RtlAddRange@36 |
| RtlAdjustPrivilege@16 |
| RtlAllocateAndInitializeSid@44 |
| RtlAllocateHandle@8 |
| RtlAllocateHeap@12 |
| RtlAnsiCharToUnicodeChar@4 |
| RtlAnsiStringToUnicodeSize@4 |
| RtlAnsiStringToUnicodeString@12 |
| RtlAppendAsciizToString@8 |
| RtlAppendStringToString@8 |
| RtlAppendUnicodeStringToString@8 |
| RtlAppendUnicodeToString@8 |
| RtlApplyRXact@4 |
| RtlApplyRXactNoFlush@4 |
| RtlAreAllAccessesGranted@8 |
| RtlAreAnyAccessesGranted@8 |
| RtlAreBitsClear@12 |
| RtlAreBitsSet@12 |
| RtlAssert@16 |
| RtlCallbackLpcClient@12 |
| RtlCancelTimer@8 |
| RtlCaptureStackBackTrace@16 |
| RtlCharToInteger@12 |
| RtlCheckForOrphanedCriticalSections@4 |
| RtlCheckRegistryKey@8 |
| RtlClearAllBits@4 |
| RtlClearBits@12 |
| RtlCompactHeap@8 |
| RtlCompareMemory@12 |
| RtlCompareMemoryUlong@12 |
| RtlCompareString@12 |
| RtlCompareUnicodeString@12 |
| RtlCompressBuffer@32 |
| RtlConsoleMultiByteToUnicodeN@24 |
| RtlConvertExclusiveToShared@4 |
| RtlConvertSharedToExclusive@4 |
| RtlConvertSidToUnicodeString@12 |
| RtlConvertToAutoInheritSecurityObject@24 |
| RtlConvertUiListToApiList@12 |
| RtlConvertUlongToLargeInteger@4 |
| RtlConvertVariantToProperty@28 |
| RtlCopyLuid@8 |
| RtlCopyLuidAndAttributesArray@12 |
| RtlCopyRangeList@8 |
| RtlCopySecurityDescriptor@8 |
| RtlCopySid@12 |
| RtlCopySidAndAttributesArray@28 |
| RtlCopyString@8 |
| RtlCopyUnicodeString@8 |
| RtlCreateAcl@12 |
| RtlCreateAndSetSD@20 |
| RtlCreateAtomTable@8 |
| RtlCreateEnvironment@8 |
| RtlCreateHeap@24 |
| RtlCreateLpcServer@24 |
| RtlCreateProcessParameters@40 |
| RtlCreateQueryDebugBuffer@8 |
| RtlCreateRegistryKey@8 |
| RtlCreateSecurityDescriptor@8 |
| RtlCreateTagHeap@16 |
| RtlCreateTimer@28 |
| RtlCreateTimerQueue@4 |
| RtlCreateUnicodeString@8 |
| RtlCreateUnicodeStringFromAsciiz@8 |
| RtlCreateUserProcess@40 |
| RtlCreateUserThread@40 |
| RtlCustomCPToUnicodeN@24 |
| RtlCutoverTimeToSystemTime@16 |
| RtlDebugPrintTimes@0 |
| RtlDecompressBuffer@24 |
| RtlDecompressFragment@32 |
| RtlDefaultNpAcl@4 |
| RtlDelete@4 |
| RtlDeleteAce@8 |
| RtlDeleteAtomFromAtomTable@8 |
| RtlDeleteCriticalSection@4 |
| RtlDeleteElementGenericTable@8 |
| RtlDeleteNoSplay@8 |
| RtlDeleteOwnersRanges@8 |
| RtlDeleteRange@24 |
| RtlDeleteResource@4 |
| RtlDeleteSecurityObject@4 |
| RtlDeleteTimer@12 |
| RtlDeleteTimerQueue@4 |
| RtlDeleteTimerQueueEx@8 |
| RtlDeNormalizeProcessParams@4 |
| RtlDeregisterWait@4 |
| RtlDeregisterWaitEx@8 |
| RtlDestroyAtomTable@4 |
| RtlDestroyEnvironment@4 |
| RtlDestroyHandleTable@4 |
| RtlDestroyHeap@4 |
| RtlDestroyProcessParameters@4 |
| RtlDestroyQueryDebugBuffer@4 |
| RtlDetermineDosPathNameType_U@4 |
| RtlDoesFileExists_U@4 |
| RtlDosPathNameToNtPathName_U@16 |
| RtlDosSearchPath_U@24 |
| RtlDowncaseUnicodeString@12 |
| RtlEmptyAtomTable@8 |
| RtlEnableEarlyCriticalSectionEventCreation@0 |
| RtlEnlargedIntegerMultiply@8 |
| RtlEnlargedUnsignedDivide@16 |
| RtlEnlargedUnsignedMultiply@8 |
| RtlEnterCriticalSection@4 |
| RtlEnumerateGenericTable@8 |
| RtlEnumerateGenericTableWithoutSplaying@8 |
| RtlEnumProcessHeaps@8 |
| RtlEqualComputerName@8 |
| RtlEqualDomainName@8 |
| RtlEqualLuid@8 |
| RtlEqualPrefixSid@8 |
| RtlEqualSid@8 |
| RtlEqualString@12 |
| RtlEqualUnicodeString@12 |
| RtlEraseUnicodeString@4 |
| RtlExpandEnvironmentStrings_U@16 |
| RtlExtendedLargeIntegerDivide@16 |
| RtlExtendedMagicDivide@20 |
| RtlExtendHeap@16 |
| RtlFillMemory@12 |
| RtlFillMemoryUlong@12 |
| RtlFindClearBits@12 |
| RtlFindClearBitsAndSet@12 |
| RtlFindLeastSignificantBit@8 |
| RtlFindLongestRunClear@8 |
| RtlFindLongestRunSet@8 |
| RtlFindMessage@20 |
| RtlFindMostSignificantBit@8 |
| RtlFindNextForwardRunClear@12 |
| RtlFindRange@48 |
| RtlFindSetBits@12 |
| RtlFindSetBitsAndClear@12 |
| RtlFirstFreeAce@8 |
| RtlFormatCurrentUserKeyPath@4 |
| RtlFormatMessage@36 |
| RtlFreeAnsiString@4 |
| RtlFreeHandle@8 |
| RtlFreeHeap@12 |
| RtlFreeOemString@4 |
| RtlFreeSid@4 |
| RtlFreeUnicodeString@4 |
| RtlFreeUserThreadStack@8 |
| RtlGenerate8dot3Name@16 |
| RtlGetAce@12 |
| RtlGetCallersAddress@8 |
| RtlGetCompressionWorkSpaceSize@12 |
| RtlGetControlSecurityDescriptor@12 |
| RtlGetCurrentDirectory_U@8 |
| RtlGetDaclSecurityDescriptor@16 |
| RtlGetElementGenericTable@8 |
| RtlGetFirstRange@12 |
| RtlGetFullPathName_U@16 |
| RtlGetGroupSecurityDescriptor@12 |
| RtlGetLongestNtPathLength@0 |
| RtlGetNextRange@12 |
| RtlGetNtGlobalFlags@0 |
| RtlGetNtProductType@4 |
| RtlGetOwnerSecurityDescriptor@12 |
| RtlGetProcessHeaps@8 |
| RtlGetSaclSecurityDescriptor@16 |
| RtlGetSecurityDescriptorRMControl@8 |
| RtlGetUserInfoHeap@20 |
| |
| RtlGUIDFromString@8 |
| RtlIdentifierAuthoritySid@4 |
| RtlImageDirectoryEntryToData@16 |
| RtlImageNtHeader@4 |
| RtlImageRvaToSection@12 |
| RtlImageRvaToVa@16 |
| RtlImpersonateLpcClient@8 |
| RtlImpersonateSelf@4 |
| RtlInitAnsiString@8 |
| RtlInitCodePageTable@8 |
| RtlInitNlsTables@16 |
| RtlInitString@8 |
| RtlInitUnicodeString@8 |
| RtlInitializeAtomPackage@4 |
| RtlInitializeBitMap@12 |
| RtlInitializeContext@20 |
| RtlInitializeCriticalSection@4 |
| RtlInitializeCriticalSectionAndSpinCount@8 |
| RtlInitializeGenericTable@20 |
| RtlInitializeHandleTable@12 |
| RtlInitializeRXact@12 |
| RtlInitializeRangeList@4 |
| RtlInitializeResource@4 |
| RtlInitializeSid@12 |
| RtlInsertElementGenericTable@16 |
| RtlIntegerToChar@16 |
| RtlIntegerToUnicodeString@12 |
| RtlInvertRangeList@8 |
| RtlIsDosDeviceName_U@4 |
| RtlIsNameLegalDOS8Dot3@12 |
| RtlIsRangeAvailable@40 |
| RtlIsTextUnicode@12 |
| RtlIsValidHandle@8 |
| RtlIsValidIndexHandle@12 |
| RtlLargeIntegerAdd@16 |
| RtlLargeIntegerArithmeticShift@12 |
| RtlLargeIntegerDivide@20 |
| RtlLargeIntegerNegate@8 |
| RtlLargeIntegerShiftLeft@12 |
| RtlLargeIntegerShiftRight@12 |
| RtlLargeIntegerSubtract@16 |
| RtlLargeIntegerToChar@16 |
| RtlLeaveCriticalSection@4 |
| RtlLengthRequiredSid@4 |
| RtlLengthSecurityDescriptor@4 |
| RtlLengthSid@4 |
| RtlLocalTimeToSystemTime@8 |
| RtlLockHeap@4 |
| RtlLookupAtomInAtomTable@12 |
| RtlLookupElementGenericTable@8 |
| RtlMakeSelfRelativeSD@12 |
| RtlMapGenericMask@8 |
| RtlMergeRangeLists@16 |
| RtlMoveMemory@12 |
| RtlMultiByteToUnicodeN@20 |
| RtlMultiByteToUnicodeSize@12 |
| RtlNewInstanceSecurityObject@40 |
| RtlNewSecurityGrantedAccess@24 |
| RtlNewSecurityObject@24 |
| RtlNewSecurityObjectEx@32 |
| RtlNormalizeProcessParams@4 |
| RtlNtStatusToDosError@4 |
| RtlNumberGenericTableElements@4 |
| RtlNumberOfClearBits@4 |
| RtlNumberOfSetBits@4 |
| RtlOemStringToUnicodeSize@4 |
| RtlOemStringToUnicodeString@12 |
| RtlOemToUnicodeN@12 |
| RtlOpenCurrentUser@8 |
| RtlPcToFileHeader@8 |
| RtlPinAtomInAtomTable@8 |
| RtlPrefixString@12 |
| RtlPrefixUnicodeString@12 |
| RtlProtectHeap@8 |
| RtlQueryAtomInAtomTable@24 |
| RtlQueryEnvironmentVariable_U@12 |
| RtlQueryInformationAcl@16 |
| RtlQueryProcessBackTraceInformation@4 |
| RtlQueryProcessDebugInformation@12 |
| RtlQueryProcessHeapInformation@4 |
| RtlQueryProcessLockInformation@4 |
| RtlQueryRegistryValues@20 |
| RtlQuerySecurityObject@20 |
| RtlQueryTagHeap@20 |
| RtlQueryTimeZoneInformation@4 |
| RtlQueueWorkItem@12 |
| RtlRaiseException@4 |
| RtlRaiseStatus@4 |
| RtlReAllocateHeap@16 |
| RtlRealPredecessor@4 |
| RtlRegisterWait@24 |
| RtlReleasePebLock@0 |
| RtlReleaseResource@4 |
| RtlRemoteCall@28 |
| RtlResetRtlTranslations@4 |
| RtlRunDecodeUnicodeString@8 |
| RtlRunEncodeUnicodeString@8 |
| RtlSecondsSince1970ToTime@8 |
| RtlSecondsSince1980ToTime@8 |
| RtlSelfRelativeToAbsoluteSD2@8 |
| RtlSelfRelativeToAbsoluteSD@44 |
| RtlSetAllBits@4 |
| RtlSetAttributesSecurityDescriptor@12 |
| RtlSetBits@12 |
| RtlSetControlSecurityDescriptor@12 |
| RtlSetCriticalSectionSpinCount@8 |
| RtlSetCurrentDirectory_U@4 |
| RtlSetCurrentEnvironment@8 |
| RtlSetDaclSecurityDescriptor@16 |
| RtlSetEnvironmentVariable@12 |
| RtlSetGroupSecurityDescriptor@12 |
| RtlSetInformationAcl@16 |
| RtlSetIoCompletionCallback@12 |
| RtlSetOwnerSecurityDescriptor@12 |
| RtlSetSaclSecurityDescriptor@16 |
| RtlSetSecurityDescriptorRMControl@8 |
| RtlSetSecurityObject@20 |
| RtlSetSecurityObjectEx@24 |
| RtlSetThreadPoolStartFunc@8 |
| RtlSetTimeZoneInformation@4 |
| RtlSetTimer@28 |
| RtlSetUnicodeCallouts@4 |
| RtlSetUserFlagsHeap@20 |
| RtlSetUserValueHeap@16 |
| RtlShutdownLpcServer@4 |
| RtlSizeHeap@12 |
| RtlSplay@4 |
| RtlStartRXact@4 |
| RtlStringFromGUID@8 |
| RtlSubAuthorityCountSid@4 |
| RtlSubAuthoritySid@8 |
| RtlSubtreePredecessor@4 |
| RtlSubtreeSuccessor@4 |
| RtlSystemTimeToLocalTime@8 |
| RtlTimeFieldsToTime@8 |
| RtlTimeToElapsedTimeFields@8 |
| RtlTimeToSecondsSince1970@8 |
| RtlTimeToSecondsSince1980@8 |
| RtlTimeToTimeFields@8 |
| RtlTraceDatabaseAdd@16 |
| RtlTraceDatabaseCreate@20 |
| RtlTraceDatabaseDestroy@4 |
| RtlTraceDatabaseEnumerate@12 |
| RtlTraceDatabaseFind@16 |
| RtlTraceDatabaseLock@4 |
| RtlTraceDatabaseUnlock@4 |
| RtlTraceDatabaseValidate@4 |
| RtlTryEnterCriticalSection@4 |
| RtlUlongByteSwap@4 |
| RtlUlonglongByteSwap@4 |
| RtlUnicodeStringToAnsiSize@4 |
| RtlUnicodeStringToAnsiString@12 |
| RtlUnicodeStringToCountedOemString@12 |
| RtlUnicodeStringToInteger@12 |
| RtlUnicodeStringToOemSize@4 |
| RtlUnicodeStringToOemString@12 |
| RtlUnicodeToMultiByteN@20 |
| RtlUnicodeToMultiByteSize@12 |
| RtlUnicodeToOemN@20 |
| RtlUniform@4 |
| RtlUnlockHeap@4 |
| RtlUnwind@16 |
| RtlUpcaseUnicodeChar@4 |
| RtlUpcaseUnicodeString@12 |
| RtlUpcaseUnicodeStringToAnsiString@12 |
| RtlUpcaseUnicodeStringToCountedOemString@12 |
| RtlUpcaseUnicodeStringToOemString@12 |
| RtlUpcaseUnicodeToCustomCPN@24 |
| RtlUpcaseUnicodeToMultiByteN@20 |
| RtlUpcaseUnicodeToOemN@20 |
| RtlUpdateTimer@16 |
| RtlUpperChar@4 |
| RtlUpperString@12 |
| RtlUsageHeap@12 |
| RtlUshortByteSwap@4 |
| RtlValidAcl@4 |
| RtlValidRelativeSecurityDescriptor@12 |
| RtlValidSecurityDescriptor@4 |
| RtlValidSid@4 |
| RtlValidateHeap@12 |
| RtlValidateProcessHeaps@0 |
| RtlVerifyVersionInfo@16 |
| RtlWalkFrameChain@12 |
| RtlWalkHeap@8 |
| RtlWriteRegistryValue@24 |
| RtlZeroHeap@8 |
| RtlZeroMemory@8 |
| RtlpNtCreateKey@24 |
| RtlpNtEnumerateSubKey@16 |
| RtlpNtMakeTemporaryKey@4 |
| RtlpNtOpenKey@16 |
| RtlpNtQueryValueKey@20 |
| RtlpNtSetValueKey@16 |
| RtlpUnWaitCriticalSection@4 |
| RtlpWaitForCriticalSection@4 |
| RtlxAnsiStringToUnicodeSize@4 |
| RtlxOemStringToUnicodeSize@4 |
| RtlxUnicodeStringToAnsiSize@4 |
| RtlxUnicodeStringToOemSize@4 |
| ZwAcceptConnectPort@24 |
| ZwAccessCheck@32 |
| ZwAccessCheckAndAuditAlarm@44 |
| ZwAccessCheckByType@44 |
| ZwAccessCheckByTypeAndAuditAlarm@64 |
| ZwAccessCheckByTypeResultList@44 |
| ZwAccessCheckByTypeResultListAndAuditAlarm@64 |
| ZwAccessCheckByTypeResultListAndAuditAlarmByHandle@68 |
| ZwAddAtom@12 |
| ZwAdjustGroupsToken@24 |
| ZwAdjustPrivilegesToken@24 |
| ZwAlertResumeThread@8 |
| ZwAlertThread@4 |
| ZwAllocateLocallyUniqueId@4 |
| ZwAllocateUserPhysicalPages@12 |
| ZwAllocateUuids@16 |
| ZwAllocateVirtualMemory@24 |
| ZwAreMappedFilesTheSame@8 |
| ZwAssignProcessToJobObject@8 |
| ZwCallbackReturn@12 |
| ZwCancelDeviceWakeupRequest@4 |
| ZwCancelIoFile@8 |
| ZwCancelTimer@8 |
| ZwClearEvent@4 |
| ZwClose@4 |
| ZwCloseObjectAuditAlarm@12 |
| ZwCompleteConnectPort@4 |
| ZwConnectPort@32 |
| ZwContinue@8 |
| ZwCreateDirectoryObject@12 |
| ZwCreateEvent@20 |
| ZwCreateEventPair@12 |
| ZwCreateFile@44 |
| ZwCreateIoCompletion@16 |
| ZwCreateJobObject@12 |
| ZwCreateKey@28 |
| ZwCreateMailslotFile@32 |
| ZwCreateMutant@16 |
| ZwCreateNamedPipeFile@56 |
| ZwCreatePagingFile@16 |
| ZwCreatePort@20 |
| ZwCreateProcess@32 |
| ZwCreateProfile@36 |
| ZwCreateSection@28 |
| ZwCreateSemaphore@20 |
| ZwCreateSymbolicLinkObject@16 |
| ZwCreateThread@32 |
| ZwCreateTimer@16 |
| ZwCreateToken@52 |
| ZwCreateWaitablePort@20 |
| ZwDelayExecution@8 |
| ZwDeleteAtom@4 |
| ZwDeleteFile@4 |
| ZwDeleteKey@4 |
| ZwDeleteObjectAuditAlarm@12 |
| ZwDeleteValueKey@8 |
| ZwDeviceIoControlFile@40 |
| ZwDisplayString@4 |
| ZwDuplicateObject@28 |
| ZwDuplicateToken@24 |
| ZwEnumerateKey@24 |
| ZwEnumerateValueKey@24 |
| ZwExtendSection@8 |
| ZwFilterToken@24 |
| ZwFindAtom@12 |
| ZwFlushBuffersFile@8 |
| ZwFlushInstructionCache@12 |
| ZwFlushKey@4 |
| ZwFlushVirtualMemory@16 |
| ZwFlushWriteBuffer@0 |
| ZwFreeUserPhysicalPages@12 |
| ZwFreeVirtualMemory@16 |
| ZwFsControlFile@40 |
| ZwGetContextThread@8 |
| ZwGetDevicePowerState@8 |
| ZwGetPlugPlayEvent@16 |
| ZwGetTickCount@0 |
| ZwGetWriteWatch@28 |
| ZwImpersonateAnonymousToken@8 |
| ZwImpersonateClientOfPort@8 |
| ZwImpersonateThread@12 |
| ZwInitializeRegistry@4 |
| ZwInitiatePowerAction@16 |
| ZwIsSystemResumeAutomatic@0 |
| ZwListenPort@8 |
| ZwLoadDriver@4 |
| ZwLoadKey@8 |
| ZwLoadKey2@12 |
| ZwLockFile@40 |
| ZwLockVirtualMemory@16 |
| ZwMakeTemporaryObject@4 |
| ZwMapUserPhysicalPages@12 |
| ZwMapUserPhysicalPagesScatter@12 |
| ZwMapViewOfSection@40 |
| ZwNotifyChangeDirectoryFile@36 |
| ZwNotifyChangeKey@40 |
| ZwNotifyChangeMultipleKeys@48 |
| ZwOpenDirectoryObject@12 |
| ZwOpenEvent@12 |
| ZwOpenEventPair@12 |
| ZwOpenFile@24 |
| ZwOpenIoCompletion@12 |
| ZwOpenJobObject@12 |
| ZwOpenKey@12 |
| ZwOpenMutant@12 |
| ZwOpenObjectAuditAlarm@48 |
| ZwOpenProcess@16 |
| ZwOpenProcessToken@12 |
| ZwOpenSection@12 |
| ZwOpenSemaphore@12 |
| ZwOpenSymbolicLinkObject@12 |
| ZwOpenThread@16 |
| ZwOpenThreadToken@16 |
| ZwOpenTimer@12 |
| ZwPowerInformation@20 |
| ZwPrivilegeCheck@12 |
| ZwPrivilegedServiceAuditAlarm@20 |
| ZwPrivilegeObjectAuditAlarm@24 |
| ZwProtectVirtualMemory@20 |
| ZwPulseEvent@8 |
| ZwQueryAttributesFile@8 |
| ZwQueryDefaultLocale@8 |
| ZwQueryDefaultUILanguage@4 |
| ZwQueryDirectoryFile@44 |
| ZwQueryDirectoryObject@28 |
| ZwQueryEaFile@36 |
| ZwQueryEvent@20 |
| ZwQueryFullAttributesFile@8 |
| ZwQueryInformationAtom@20 |
| ZwQueryInformationFile@20 |
| ZwQueryInformationJobObject@20 |
| ZwQueryInformationPort@20 |
| ZwQueryInformationProcess@20 |
| ZwQueryInformationThread@20 |
| ZwQueryInformationToken@20 |
| ZwQueryIntervalProfile@8 |
| ZwQueryIoCompletion@20 |
| ZwQueryKey@20 |
| ZwQueryMultipleValueKey@24 |
| ZwQueryMutant@20 |
| ZwQueryObject@20 |
| ZwQueryOpenSubKeys@8 |
| ZwQueryPerformanceCounter@8 |
| ZwQueryQuotaInformationFile@36 |
| ZwQuerySection@20 |
| ZwQuerySecurityObject@20 |
| ZwQuerySemaphore@20 |
| ZwQuerySymbolicLinkObject@12 |
| ZwQuerySystemEnvironmentValue@16 |
| ZwQuerySystemInformation@16 |
| ZwQuerySystemTime@4 |
| ZwQueryTimer@20 |
| ZwQueryTimerResolution@12 |
| ZwQueryValueKey@24 |
| ZwQueryVirtualMemory@24 |
| ZwQueryVolumeInformationFile@20 |
| ZwQueueApcThread@20 |
| ZwRaiseException@12 |
| ZwRaiseHardError@24 |
| ZwReadFile@36 |
| ZwReadFileScatter@36 |
| ZwReadRequestData@24 |
| ZwReadVirtualMemory@20 |
| ZwRegisterThreadTerminatePort@4 |
| ZwReleaseMutant@8 |
| ZwReleaseSemaphore@12 |
| ZwRemoveIoCompletion@20 |
| ZwReplaceKey@12 |
| ZwReplyPort@8 |
| ZwReplyWaitReceivePort@16 |
| ZwReplyWaitReceivePortEx@20 |
| ZwReplyWaitReplyPort@8 |
| ZwRequestDeviceWakeup@4 |
| ZwRequestPort@8 |
| ZwRequestWaitReplyPort@12 |
| ZwRequestWakeupLatency@4 |
| ZwResetEvent@8 |
| ZwResetWriteWatch@12 |
| ZwRestoreKey@12 |
| ZwResumeThread@8 |
| ZwSaveKey@8 |
| ZwSaveMergedKeys@12 |
| ZwSecureConnectPort@36 |
| ZwSetContextThread@8 |
| ZwSetDefaultHardErrorPort@4 |
| ZwSetDefaultLocale@8 |
| ZwSetDefaultUILanguage@4 |
| ZwSetEaFile@16 |
| ZwSetEvent@8 |
| ZwSetHighEventPair@4 |
| ZwSetHighWaitLowEventPair@4 |
| ZwSetInformationFile@20 |
| ZwSetInformationJobObject@16 |
| ZwSetInformationKey@16 |
| ZwSetInformationObject@16 |
| ZwSetInformationProcess@16 |
| ZwSetInformationThread@16 |
| ZwSetInformationToken@16 |
| ZwSetIntervalProfile@8 |
| ZwSetIoCompletion@20 |
| ZwSetLdtEntries@16 |
| ZwSetLowEventPair@4 |
| ZwSetLowWaitHighEventPair@4 |
| ZwSetQuotaInformationFile@16 |
| ZwSetSecurityObject@12 |
| ZwSetSystemEnvironmentValue@8 |
| ZwSetSystemInformation@12 |
| ZwSetSystemPowerState@12 |
| ZwSetSystemTime@8 |
| ZwSetThreadExecutionState@8 |
| ZwSetTimer@28 |
| ZwSetTimerResolution@12 |
| ZwSetUuidSeed@4 |
| ZwSetValueKey@24 |
| ZwSetVolumeInformationFile@20 |
| ZwShutdownSystem@4 |
| ZwSignalAndWaitForSingleObject@16 |
| ZwStartProfile@4 |
| ZwStopProfile@4 |
| ZwSuspendThread@8 |
| ZwSystemDebugControl@24 |
| ZwTerminateJobObject@8 |
| ZwTerminateProcess@8 |
| ZwTerminateThread@8 |
| ZwTestAlert@0 |
| ZwUnloadDriver@4 |
| ZwUnloadKey@4 |
| ZwUnlockFile@20 |
| ZwUnlockVirtualMemory@16 |
| ZwUnmapViewOfSection@8 |
| ZwVdmControl@8 |
| ZwWaitForMultipleObjects@20 |
| ZwWaitForSingleObject@12 |
| ZwWaitHighEventPair@4 |
| ZwWaitLowEventPair@4 |
| ZwWriteFile@36 |
| ZwWriteFileGather@36 |
| ZwWriteRequestData@24 |
| ZwWriteVirtualMemory@20 |
| ZwYieldExecution@0 |
| __isascii |
| __iscsym |
| __iscsymf |
| __toascii |
| _itoa |
| _itow |
| _ltoa |
| _ltow |
| _snprintf |
| _snwprintf |
| _strcmpi |
| _stricmp |
| _strlwr |
| _strnicmp |
| _strupr |
| _tolower |
| _toupper |
| _ultoa |
| _ultow |
| _vsnprintf |
| _wcsicmp |
| _wcslwr |
| _wcsnicmp |
| _wcsupr |
| _wtoi |
| _wtol |
| abs |
| atan |
| atoi |
| atol |
| ceil |
| cos |
| fabs |
| floor |
| isalnum |
| isalpha |
| iscntrl |
| isdigit |
| isgraph |
| islower |
| isprint |
| ispunct |
| isspace |
| isupper |
| iswalpha |
| iswctype |
| isxdigit |
| labs |
| log |
| mbstowcs |
| memchr |
| memcmp |
| memcpy |
| memmove |
| memset |
| pow |
| sin |
| sprintf |
| sqrt |
| strcat |
| strchr |
| strcmp |
| strcpy |
| strcspn |
| strlen |
| strncat |
| strncmp |
| strncpy |
| strpbrk |
| strrchr |
| strspn |
| strstr |
| strtol |
| strtoul |
| swprintf |
| tan |
| tolower |
| toupper |
| towlower |
| towupper |
| vsprintf |
| wcscat |
| wcschr |
| wcscmp |
| wcscpy |
| wcscspn |
| wcslen |
| wcsncat |
| wcsncmp |
| wcsncpy |
| wcspbrk |
| wcsrchr |
| wcsspn |
| wcsstr |
| wcstol |
| wcstombs |
| wcstoul |