| 1 | #include "func.def.in" |
| 2 | |
| 3 | LIBRARY "ntdll.dll" |
| 4 | EXPORTS |
| 5 | #ifdef __x86_64__ |
| 6 | PropertyLengthAsVariant |
| 7 | RtlConvertPropertyToVariant |
| 8 | RtlConvertVariantToProperty |
| 9 | #endif |
| 10 | A_SHAFinal |
| 11 | A_SHAInit |
| 12 | A_SHAUpdate |
| 13 | AlpcAdjustCompletionListConcurrencyCount |
| 14 | AlpcFreeCompletionListMessage |
| 15 | AlpcGetCompletionListLastMessageInformation |
| 16 | AlpcGetCompletionListMessageAttributes |
| 17 | AlpcGetHeaderSize |
| 18 | AlpcGetMessageAttribute |
| 19 | AlpcGetMessageFromCompletionList |
| 20 | AlpcGetOutstandingCompletionListMessageCount |
| 21 | AlpcInitializeMessageAttribute |
| 22 | AlpcMaxAllowedMessageLength |
| 23 | AlpcRegisterCompletionList |
| 24 | AlpcRegisterCompletionListWorkerThread |
| 25 | AlpcRundownCompletionList |
| 26 | AlpcUnregisterCompletionList |
| 27 | AlpcUnregisterCompletionListWorkerThread |
| 28 | ApiSetQueryApiSetPresence |
| 29 | ApiSetQueryApiSetPresenceEx |
| 30 | CsrAllocateCaptureBuffer |
| 31 | CsrAllocateMessagePointer |
| 32 | CsrCaptureMessageBuffer |
| 33 | CsrCaptureMessageMultiUnicodeStringsInPlace |
| 34 | CsrCaptureMessageString |
| 35 | CsrCaptureTimeout |
| 36 | CsrClientCallServer |
| 37 | CsrClientConnectToServer |
| 38 | CsrFreeCaptureBuffer |
| 39 | CsrGetProcessId |
| 40 | CsrIdentifyAlertableThread |
| 41 | #if defined(__i386__) || defined(__x86_64__) |
| 42 | CsrNewThread |
| 43 | CsrProbeForRead |
| 44 | CsrProbeForWrite |
| 45 | #endif |
| 46 | CsrSetPriorityClass |
| 47 | CsrVerifyRegion |
| 48 | DbgBreakPoint |
| 49 | DbgPrint |
| 50 | DbgPrintEx |
| 51 | DbgPrintReturnControlC |
| 52 | DbgPrompt |
| 53 | DbgQueryDebugFilterState |
| 54 | DbgSetDebugFilterState |
| 55 | DbgUiConnectToDbg |
| 56 | DbgUiContinue |
| 57 | DbgUiConvertStateChangeStructure |
| 58 | DbgUiConvertStateChangeStructureEx |
| 59 | DbgUiDebugActiveProcess |
| 60 | DbgUiGetThreadDebugObject |
| 61 | DbgUiIssueRemoteBreakin |
| 62 | DbgUiRemoteBreakin |
| 63 | DbgUiSetThreadDebugObject |
| 64 | DbgUiStopDebugging |
| 65 | DbgUiWaitStateChange |
| 66 | DbgUserBreakPoint |
| 67 | EtwCheckCoverage |
| 68 | #ifdef __x86_64__ |
| 69 | EtwControlTraceA |
| 70 | EtwControlTraceW |
| 71 | #endif |
| 72 | EtwCreateTraceInstanceId |
| 73 | #ifdef __x86_64__ |
| 74 | EtwEnableTrace |
| 75 | EtwEnumerateTraceGuids |
| 76 | EtwFlushTraceA |
| 77 | EtwFlushTraceW |
| 78 | #endif |
| 79 | EtwDeliverDataBlock |
| 80 | EtwEnumerateProcessRegGuids |
| 81 | EtwEventActivityIdControl |
| 82 | EtwEventEnabled |
| 83 | EtwEventProviderEnabled |
| 84 | EtwEventRegister |
| 85 | EtwEventSetInformation |
| 86 | EtwEventUnregister |
| 87 | EtwEventWrite |
| 88 | EtwEventWriteEndScenario |
| 89 | EtwEventWriteEx |
| 90 | EtwEventWriteFull |
| 91 | EtwEventWriteNoRegistration |
| 92 | EtwEventWriteStartScenario |
| 93 | EtwEventWriteString |
| 94 | EtwEventWriteTransfer |
| 95 | EtwGetTraceEnableFlags |
| 96 | EtwGetTraceEnableLevel |
| 97 | EtwGetTraceLoggerHandle |
| 98 | #ifdef __x86_64__ |
| 99 | EtwNotificationRegistrationA |
| 100 | EtwNotificationRegistrationW |
| 101 | EtwQueryAllTracesA |
| 102 | EtwQueryAllTracesW |
| 103 | EtwQueryTraceA |
| 104 | EtwQueryTraceW |
| 105 | EtwReceiveNotificationsA |
| 106 | EtwReceiveNotificationsW |
| 107 | #endif |
| 108 | EtwLogTraceEvent |
| 109 | EtwNotificationRegister |
| 110 | EtwNotificationUnregister |
| 111 | EtwProcessPrivateLoggerRequest |
| 112 | EtwRegisterSecurityProvider |
| 113 | EtwRegisterTraceGuidsA |
| 114 | EtwRegisterTraceGuidsW |
| 115 | #ifdef __x86_64__ |
| 116 | EtwStartTraceA |
| 117 | EtwStartTraceW |
| 118 | EtwStopTraceA |
| 119 | EtwStopTraceW |
| 120 | EtwTraceEvent |
| 121 | #endif |
| 122 | EtwReplyNotification |
| 123 | EtwSendNotification |
| 124 | EtwSetMark |
| 125 | EtwTraceEventInstance |
| 126 | EtwTraceMessage |
| 127 | EtwTraceMessageVa |
| 128 | EtwUnregisterTraceGuids |
| 129 | #ifdef __x86_64__ |
| 130 | EtwUpdateTraceA |
| 131 | EtwUpdateTraceW |
| 132 | EtwpGetTraceBuffer |
| 133 | EtwpSetHWConfigFunction |
| 134 | #endif |
| 135 | EtwWriteUMSecurityEvent |
| 136 | EtwpCreateEtwThread |
| 137 | EtwpGetCpuSpeed |
| 138 | F_X64(EtwpNotificationThread) |
| 139 | EvtIntReportAuthzEventAndSourceAsync |
| 140 | EvtIntReportEventAndSourceAsync |
| 141 | #ifndef __arm__ |
| 142 | ExpInterlockedPopEntrySListEnd |
| 143 | F_X64(ExpInterlockedPopEntrySListEnd16) |
| 144 | ExpInterlockedPopEntrySListFault |
| 145 | F_X64(ExpInterlockedPopEntrySListFault16) |
| 146 | ExpInterlockedPopEntrySListResume |
| 147 | F_X64(ExpInterlockedPopEntrySListResume16) |
| 148 | #endif |
| 149 | KiRaiseUserExceptionDispatcher |
| 150 | KiUserApcDispatcher |
| 151 | KiUserCallbackDispatcher |
| 152 | F_ARM_ANY(KiUserCallbackDispatcherReturn) |
| 153 | KiUserExceptionDispatcher |
| 154 | KiUserInvertedFunctionTable F_ARM_ANY(DATA) |
| 155 | F_X64(LdrAccessOutOfProcessResource) |
| 156 | LdrAccessResource |
| 157 | LdrAddDllDirectory |
| 158 | LdrAddLoadAsDataTable |
| 159 | LdrAddRefDll |
| 160 | F_X86_ANY(LdrAlternateResourcesEnabled) |
| 161 | LdrAppxHandleIntegrityFailure |
| 162 | LdrCallEnclave |
| 163 | LdrControlFlowGuardEnforced |
| 164 | LdrCreateEnclave |
| 165 | F_X64(LdrCreateOutOfProcessImage) |
| 166 | LdrDeleteEnclave |
| 167 | F_X64(LdrDestroyOutOfProcessImage) |
| 168 | LdrDisableThreadCalloutsForDll |
| 169 | LdrEnumResources |
| 170 | LdrEnumerateLoadedModules |
| 171 | LdrFastFailInLoaderCallout |
| 172 | F_X64(LdrFindCreateProcessManifest) |
| 173 | LdrFindEntryForAddress |
| 174 | LdrFindResourceDirectory_U |
| 175 | LdrFindResourceEx_U |
| 176 | LdrFindResource_U |
| 177 | LdrFlushAlternateResourceModules |
| 178 | LdrGetDllDirectory |
| 179 | LdrGetDllFullName |
| 180 | LdrGetDllHandle |
| 181 | LdrGetDllHandleByMapping |
| 182 | LdrGetDllHandleByName |
| 183 | LdrGetDllHandleEx |
| 184 | LdrGetDllPath |
| 185 | LdrGetFailureData |
| 186 | LdrGetFileNameFromLoadAsDataTable |
| 187 | F64(LdrGetKnownDllSectionHandle) |
| 188 | LdrGetProcedureAddress |
| 189 | LdrGetProcedureAddressEx |
| 190 | LdrGetProcedureAddressForCaller |
| 191 | F_X86_ANY(LdrHotPatchRoutine) |
| 192 | LdrInitShimEngineDynamic |
| 193 | LdrInitializeEnclave |
| 194 | LdrInitializeThunk |
| 195 | LdrIsModuleSxsRedirected |
| 196 | LdrLoadAlternateResourceModule |
| 197 | LdrLoadAlternateResourceModuleEx |
| 198 | LdrLoadDll |
| 199 | LdrLoadEnclaveModule |
| 200 | LdrLockLoaderLock |
| 201 | LdrOpenImageFileOptionsKey |
| 202 | F64(LdrProcessInitializationComplete) |
| 203 | LdrProcessRelocationBlock |
| 204 | LdrProcessRelocationBlockEx |
| 205 | LdrQueryImageFileExecutionOptions |
| 206 | LdrQueryImageFileExecutionOptionsEx |
| 207 | LdrQueryImageFileKeyOption |
| 208 | LdrQueryModuleServiceTags |
| 209 | LdrQueryOptionalDelayLoadedAPI |
| 210 | LdrQueryProcessModuleInformation |
| 211 | LdrRegisterDllNotification |
| 212 | LdrRemoveDllDirectory |
| 213 | LdrRemoveLoadAsDataTable |
| 214 | LdrResFindResource |
| 215 | LdrResFindResourceDirectory |
| 216 | LdrResGetRCConfig |
| 217 | LdrResRelease |
| 218 | LdrResSearchResource |
| 219 | LdrResolveDelayLoadedAPI |
| 220 | LdrResolveDelayLoadsFromDll |
| 221 | LdrRscIsTypeExist |
| 222 | LdrSetAppCompatDllRedirectionCallback |
| 223 | LdrSetDefaultDllDirectories |
| 224 | LdrSetDllDirectory |
| 225 | LdrSetDllManifestProber |
| 226 | LdrSetImplicitPathOptions |
| 227 | LdrSetMUICacheType |
| 228 | LdrShutdownProcess |
| 229 | LdrShutdownThread |
| 230 | LdrStandardizeSystemPath |
| 231 | LdrSystemDllInitBlock DATA |
| 232 | LdrUnloadAlternateResourceModule |
| 233 | LdrUnloadAlternateResourceModuleEx |
| 234 | LdrUnloadDll |
| 235 | LdrUnlockLoaderLock |
| 236 | LdrUnregisterDllNotification |
| 237 | LdrUpdatePackageSearchPath |
| 238 | LdrVerifyImageMatchesChecksum |
| 239 | LdrVerifyImageMatchesChecksumEx |
| 240 | LdrpResGetMappingSize |
| 241 | LdrpResGetResourceDirectory |
| 242 | MD4Final |
| 243 | MD4Init |
| 244 | MD4Update |
| 245 | MD5Final |
| 246 | MD5Init |
| 247 | MD5Update |
| 248 | NlsAnsiCodePage DATA |
| 249 | NlsMbCodePageTag DATA |
| 250 | NlsMbOemCodePageTag DATA |
| 251 | NtAcceptConnectPort |
| 252 | NtAccessCheck |
| 253 | NtAccessCheckAndAuditAlarm |
| 254 | NtAccessCheckByType |
| 255 | NtAccessCheckByTypeAndAuditAlarm |
| 256 | NtAccessCheckByTypeResultList |
| 257 | NtAccessCheckByTypeResultListAndAuditAlarm |
| 258 | NtAccessCheckByTypeResultListAndAuditAlarmByHandle |
| 259 | NtAcquireCrossVmMutant |
| 260 | NtAcquireProcessActivityReference |
| 261 | NtAddAtom |
| 262 | NtAddAtomEx |
| 263 | NtAddBootEntry |
| 264 | NtAddDriverEntry |
| 265 | NtAdjustGroupsToken |
| 266 | NtAdjustPrivilegesToken |
| 267 | NtAdjustTokenClaimsAndDeviceGroups |
| 268 | NtAlertResumeThread |
| 269 | NtAlertThread |
| 270 | NtAlertThreadByThreadId |
| 271 | NtAllocateLocallyUniqueId |
| 272 | NtAllocateReserveObject |
| 273 | NtAllocateUserPhysicalPages |
| 274 | F_X86_ANY(NtAllocateUserPhysicalPagesEx) |
| 275 | NtAllocateUuids |
| 276 | NtAllocateVirtualMemory |
| 277 | NtAllocateVirtualMemoryEx |
| 278 | NtAlpcAcceptConnectPort |
| 279 | NtAlpcCancelMessage |
| 280 | NtAlpcConnectPort |
| 281 | NtAlpcConnectPortEx |
| 282 | NtAlpcCreatePort |
| 283 | NtAlpcCreatePortSection |
| 284 | NtAlpcCreateResourceReserve |
| 285 | NtAlpcCreateSectionView |
| 286 | NtAlpcCreateSecurityContext |
| 287 | NtAlpcDeletePortSection |
| 288 | NtAlpcDeleteResourceReserve |
| 289 | NtAlpcDeleteSectionView |
| 290 | NtAlpcDeleteSecurityContext |
| 291 | NtAlpcDisconnectPort |
| 292 | NtAlpcImpersonateClientContainerOfPort |
| 293 | NtAlpcImpersonateClientOfPort |
| 294 | NtAlpcOpenSenderProcess |
| 295 | NtAlpcOpenSenderThread |
| 296 | NtAlpcQueryInformation |
| 297 | NtAlpcQueryInformationMessage |
| 298 | NtAlpcRevokeSecurityContext |
| 299 | NtAlpcSendWaitReceivePort |
| 300 | NtAlpcSetInformation |
| 301 | NtApphelpCacheControl |
| 302 | NtAreMappedFilesTheSame |
| 303 | NtAssignProcessToJobObject |
| 304 | NtAssociateWaitCompletionPacket |
| 305 | NtCallEnclave |
| 306 | NtCallbackReturn |
| 307 | F_X86_ANY(NtCancelDeviceWakeupRequest) |
| 308 | NtCancelIoFile |
| 309 | NtCancelIoFileEx |
| 310 | NtCancelSynchronousIoFile |
| 311 | NtCancelTimer |
| 312 | NtCancelTimer2 |
| 313 | NtCancelWaitCompletionPacket |
| 314 | NtChangeProcessState |
| 315 | NtChangeThreadState |
| 316 | NtClearEvent |
| 317 | NtClose |
| 318 | NtCloseObjectAuditAlarm |
| 319 | NtCommitComplete |
| 320 | NtCommitEnlistment |
| 321 | NtCommitRegistryTransaction |
| 322 | NtCommitTransaction |
| 323 | NtCompactKeys |
| 324 | NtCompareObjects |
| 325 | NtCompareSigningLevels |
| 326 | NtCompareTokens |
| 327 | NtCompleteConnectPort |
| 328 | NtCompressKey |
| 329 | NtConnectPort |
| 330 | NtContinue |
| 331 | NtContinueEx |
| 332 | NtConvertBetweenAuxiliaryCounterAndPerformanceCounter |
| 333 | NtCreateCrossVmEvent |
| 334 | NtCreateCrossVmMutant |
| 335 | NtCreateDebugObject |
| 336 | NtCreateDirectoryObject |
| 337 | NtCreateDirectoryObjectEx |
| 338 | NtCreateEnclave |
| 339 | NtCreateEnlistment |
| 340 | NtCreateEvent |
| 341 | NtCreateEventPair |
| 342 | NtCreateFile |
| 343 | NtCreateIRTimer |
| 344 | NtCreateIoCompletion |
| 345 | NtCreateIoRing |
| 346 | NtCreateJobObject |
| 347 | NtCreateJobSet |
| 348 | NtCreateKey |
| 349 | NtCreateKeyTransacted |
| 350 | NtCreateKeyedEvent |
| 351 | NtCreateLowBoxToken |
| 352 | NtCreateMailslotFile |
| 353 | NtCreateMutant |
| 354 | NtCreateNamedPipeFile |
| 355 | NtCreatePagingFile |
| 356 | NtCreatePartition |
| 357 | NtCreatePort |
| 358 | NtCreatePrivateNamespace |
| 359 | NtCreateProcess |
| 360 | NtCreateProcessEx |
| 361 | NtCreateProcessStateChange |
| 362 | NtCreateProfile |
| 363 | NtCreateProfileEx |
| 364 | NtCreateRegistryTransaction |
| 365 | NtCreateResourceManager |
| 366 | NtCreateSection |
| 367 | NtCreateSectionEx |
| 368 | NtCreateSemaphore |
| 369 | NtCreateSymbolicLinkObject |
| 370 | NtCreateThread |
| 371 | NtCreateThreadEx |
| 372 | NtCreateThreadStateChange |
| 373 | NtCreateTimer |
| 374 | NtCreateTimer2 |
| 375 | NtCreateToken |
| 376 | NtCreateTokenEx |
| 377 | NtCreateTransaction |
| 378 | NtCreateTransactionManager |
| 379 | NtCreateUserProcess |
| 380 | NtCreateWaitCompletionPacket |
| 381 | NtCreateWaitablePort |
| 382 | NtCreateWnfStateName |
| 383 | NtCreateWorkerFactory |
| 384 | NtDebugActiveProcess |
| 385 | NtDebugContinue |
| 386 | NtDelayExecution |
| 387 | NtDeleteAtom |
| 388 | NtDeleteBootEntry |
| 389 | NtDeleteDriverEntry |
| 390 | NtDeleteFile |
| 391 | NtDeleteKey |
| 392 | NtDeleteObjectAuditAlarm |
| 393 | NtDeletePrivateNamespace |
| 394 | NtDeleteValueKey |
| 395 | NtDeleteWnfStateData |
| 396 | NtDeleteWnfStateName |
| 397 | NtDeviceIoControlFile |
| 398 | NtDirectGraphicsCall |
| 399 | NtDisableLastKnownGood |
| 400 | NtDisplayString |
| 401 | NtDrawText |
| 402 | NtDuplicateObject |
| 403 | NtDuplicateToken |
| 404 | NtEnableLastKnownGood |
| 405 | NtEnumerateBootEntries |
| 406 | NtEnumerateDriverEntries |
| 407 | NtEnumerateKey |
| 408 | NtEnumerateSystemEnvironmentValuesEx |
| 409 | NtEnumerateTransactionObject |
| 410 | NtEnumerateValueKey |
| 411 | NtExtendSection |
| 412 | NtFilterBootOption |
| 413 | NtFilterToken |
| 414 | NtFilterTokenEx |
| 415 | NtFindAtom |
| 416 | NtFlushBuffersFile |
| 417 | NtFlushBuffersFileEx |
| 418 | NtFlushInstallUILanguage |
| 419 | NtFlushInstructionCache |
| 420 | NtFlushKey |
| 421 | NtFlushProcessWriteBuffers |
| 422 | NtFlushVirtualMemory |
| 423 | NtFlushWriteBuffer |
| 424 | NtFreeUserPhysicalPages |
| 425 | NtFreeVirtualMemory |
| 426 | NtFreezeRegistry |
| 427 | NtFreezeTransactions |
| 428 | NtFsControlFile |
| 429 | NtGetCachedSigningLevel |
| 430 | NtGetCompleteWnfStateSubscription |
| 431 | NtGetContextThread |
| 432 | NtGetCurrentProcessorNumber |
| 433 | NtGetCurrentProcessorNumberEx |
| 434 | NtGetDevicePowerState |
| 435 | NtGetMUIRegistryInfo |
| 436 | NtGetNextProcess |
| 437 | NtGetNextThread |
| 438 | NtGetNlsSectionPtr |
| 439 | NtGetNotificationResourceManager |
| 440 | F_X86_ANY(NtGetPlugPlayEvent) |
| 441 | NtGetTickCount |
| 442 | NtGetWriteWatch |
| 443 | NtImpersonateAnonymousToken |
| 444 | NtImpersonateClientOfPort |
| 445 | NtImpersonateThread |
| 446 | NtInitializeEnclave |
| 447 | NtInitializeNlsFiles |
| 448 | NtInitializeRegistry |
| 449 | NtInitiatePowerAction |
| 450 | NtIsProcessInJob |
| 451 | NtIsSystemResumeAutomatic |
| 452 | NtIsUILanguageComitted |
| 453 | NtListenPort |
| 454 | NtLoadDriver |
| 455 | NtLoadEnclaveData |
| 456 | NtLoadKey |
| 457 | NtLoadKey2 |
| 458 | NtLoadKey3 |
| 459 | NtLoadKeyEx |
| 460 | NtLockFile |
| 461 | NtLockProductActivationKeys |
| 462 | NtLockRegistryKey |
| 463 | NtLockVirtualMemory |
| 464 | NtMakePermanentObject |
| 465 | NtMakeTemporaryObject |
| 466 | NtManageHotPatch |
| 467 | NtManagePartition |
| 468 | NtMapCMFModule |
| 469 | NtMapUserPhysicalPages |
| 470 | NtMapUserPhysicalPagesScatter |
| 471 | NtMapViewOfSection |
| 472 | NtMapViewOfSectionEx |
| 473 | NtModifyBootEntry |
| 474 | NtModifyDriverEntry |
| 475 | NtNotifyChangeDirectoryFile |
| 476 | NtNotifyChangeDirectoryFileEx |
| 477 | NtNotifyChangeKey |
| 478 | NtNotifyChangeMultipleKeys |
| 479 | NtNotifyChangeSession |
| 480 | NtOpenDirectoryObject |
| 481 | NtOpenEnlistment |
| 482 | NtOpenEvent |
| 483 | NtOpenEventPair |
| 484 | NtOpenFile |
| 485 | NtOpenIoCompletion |
| 486 | NtOpenJobObject |
| 487 | NtOpenKey |
| 488 | NtOpenKeyEx |
| 489 | NtOpenKeyTransacted |
| 490 | NtOpenKeyTransactedEx |
| 491 | NtOpenKeyedEvent |
| 492 | NtOpenMutant |
| 493 | NtOpenObjectAuditAlarm |
| 494 | NtOpenPartition |
| 495 | NtOpenPrivateNamespace |
| 496 | NtOpenProcess |
| 497 | NtOpenProcessToken |
| 498 | NtOpenProcessTokenEx |
| 499 | NtOpenRegistryTransaction |
| 500 | NtOpenResourceManager |
| 501 | NtOpenSection |
| 502 | NtOpenSemaphore |
| 503 | NtOpenSession |
| 504 | NtOpenSymbolicLinkObject |
| 505 | NtOpenThread |
| 506 | NtOpenThreadToken |
| 507 | NtOpenThreadTokenEx |
| 508 | NtOpenTimer |
| 509 | NtOpenTransaction |
| 510 | NtOpenTransactionManager |
| 511 | NtPlugPlayControl |
| 512 | NtPowerInformation |
| 513 | NtPrePrepareComplete |
| 514 | NtPrePrepareEnlistment |
| 515 | NtPrepareComplete |
| 516 | NtPrepareEnlistment |
| 517 | NtPrivilegeCheck |
| 518 | NtPrivilegeObjectAuditAlarm |
| 519 | NtPrivilegedServiceAuditAlarm |
| 520 | NtPropagationComplete |
| 521 | NtPropagationFailed |
| 522 | NtProtectVirtualMemory |
| 523 | F_X86_ANY(NtPssCaptureVaSpaceBulk) |
| 524 | NtPulseEvent |
| 525 | NtQueryAttributesFile |
| 526 | NtQueryAuxiliaryCounterFrequency |
| 527 | NtQueryBootEntryOrder |
| 528 | NtQueryBootOptions |
| 529 | NtQueryDebugFilterState |
| 530 | NtQueryDefaultLocale |
| 531 | NtQueryDefaultUILanguage |
| 532 | NtQueryDirectoryFile |
| 533 | NtQueryDirectoryFileEx |
| 534 | NtQueryDirectoryObject |
| 535 | NtQueryDriverEntryOrder |
| 536 | NtQueryEaFile |
| 537 | NtQueryEvent |
| 538 | NtQueryFullAttributesFile |
| 539 | NtQueryInformationAtom |
| 540 | NtQueryInformationByName |
| 541 | NtQueryInformationEnlistment |
| 542 | NtQueryInformationFile |
| 543 | NtQueryInformationJobObject |
| 544 | NtQueryInformationPort |
| 545 | NtQueryInformationProcess |
| 546 | NtQueryInformationResourceManager |
| 547 | NtQueryInformationThread |
| 548 | NtQueryInformationToken |
| 549 | NtQueryInformationTransaction |
| 550 | NtQueryInformationTransactionManager |
| 551 | NtQueryInformationWorkerFactory |
| 552 | NtQueryInstallUILanguage |
| 553 | NtQueryIntervalProfile |
| 554 | NtQueryIoCompletion |
| 555 | NtQueryIoRingCapabilities |
| 556 | NtQueryKey |
| 557 | NtQueryLicenseValue |
| 558 | NtQueryMultipleValueKey |
| 559 | NtQueryMutant |
| 560 | NtQueryObject |
| 561 | NtQueryOpenSubKeys |
| 562 | NtQueryOpenSubKeysEx |
| 563 | NtQueryPerformanceCounter |
| 564 | NtQueryPortInformationProcess |
| 565 | NtQueryQuotaInformationFile |
| 566 | NtQuerySection |
| 567 | NtQuerySecurityAttributesToken |
| 568 | NtQuerySecurityObject |
| 569 | NtQuerySecurityPolicy |
| 570 | NtQuerySemaphore |
| 571 | NtQuerySymbolicLinkObject |
| 572 | NtQuerySystemEnvironmentValue |
| 573 | NtQuerySystemEnvironmentValueEx |
| 574 | NtQuerySystemInformation |
| 575 | NtQuerySystemInformationEx |
| 576 | NtQuerySystemTime |
| 577 | NtQueryTimer |
| 578 | NtQueryTimerResolution |
| 579 | NtQueryValueKey |
| 580 | NtQueryVirtualMemory |
| 581 | NtQueryVolumeInformationFile |
| 582 | NtQueryWnfStateData |
| 583 | NtQueryWnfStateNameInformation |
| 584 | NtQueueApcThread |
| 585 | NtQueueApcThreadEx |
| 586 | NtQueueApcThreadEx2 |
| 587 | NtRaiseException |
| 588 | NtRaiseHardError |
| 589 | NtReadFile |
| 590 | NtReadFileScatter |
| 591 | NtReadOnlyEnlistment |
| 592 | NtReadRequestData |
| 593 | NtReadVirtualMemory |
| 594 | NtReadVirtualMemoryEx |
| 595 | NtRecoverEnlistment |
| 596 | NtRecoverResourceManager |
| 597 | NtRecoverTransactionManager |
| 598 | NtRegisterProtocolAddressInformation |
| 599 | NtRegisterThreadTerminatePort |
| 600 | NtReleaseKeyedEvent |
| 601 | NtReleaseMutant |
| 602 | NtReleaseSemaphore |
| 603 | NtReleaseWorkerFactoryWorker |
| 604 | NtRemoveIoCompletion |
| 605 | NtRemoveIoCompletionEx |
| 606 | NtRemoveProcessDebug |
| 607 | NtRenameKey |
| 608 | NtRenameTransactionManager |
| 609 | NtReplaceKey |
| 610 | NtReplacePartitionUnit |
| 611 | NtReplyPort |
| 612 | NtReplyWaitReceivePort |
| 613 | NtReplyWaitReceivePortEx |
| 614 | NtReplyWaitReplyPort |
| 615 | F_X86_ANY(NtRequestDeviceWakeup) |
| 616 | NtRequestPort |
| 617 | NtRequestWaitReplyPort |
| 618 | F_X86_ANY(NtRequestWakeupLatency) |
| 619 | NtResetEvent |
| 620 | NtResetWriteWatch |
| 621 | NtRestoreKey |
| 622 | NtResumeProcess |
| 623 | NtResumeThread |
| 624 | NtRevertContainerImpersonation |
| 625 | NtRollbackComplete |
| 626 | NtRollbackEnlistment |
| 627 | NtRollbackRegistryTransaction |
| 628 | NtRollbackTransaction |
| 629 | NtRollforwardTransactionManager |
| 630 | NtSaveKey |
| 631 | NtSaveKeyEx |
| 632 | NtSaveMergedKeys |
| 633 | NtSecureConnectPort |
| 634 | NtSerializeBoot |
| 635 | NtSetBootEntryOrder |
| 636 | NtSetBootOptions |
| 637 | NtSetCachedSigningLevel |
| 638 | NtSetCachedSigningLevel2 |
| 639 | NtSetContextThread |
| 640 | NtSetDebugFilterState |
| 641 | NtSetDefaultHardErrorPort |
| 642 | NtSetDefaultLocale |
| 643 | NtSetDefaultUILanguage |
| 644 | NtSetDriverEntryOrder |
| 645 | NtSetEaFile |
| 646 | NtSetEvent |
| 647 | NtSetEventBoostPriority |
| 648 | NtSetHighEventPair |
| 649 | NtSetHighWaitLowEventPair |
| 650 | NtSetIRTimer |
| 651 | NtSetInformationDebugObject |
| 652 | NtSetInformationEnlistment |
| 653 | NtSetInformationFile |
| 654 | NtSetInformationIoRing |
| 655 | NtSetInformationJobObject |
| 656 | NtSetInformationKey |
| 657 | NtSetInformationObject |
| 658 | NtSetInformationProcess |
| 659 | NtSetInformationResourceManager |
| 660 | NtSetInformationSymbolicLink |
| 661 | NtSetInformationThread |
| 662 | NtSetInformationToken |
| 663 | NtSetInformationTransaction |
| 664 | NtSetInformationTransactionManager |
| 665 | NtSetInformationVirtualMemory |
| 666 | NtSetInformationWorkerFactory |
| 667 | NtSetIntervalProfile |
| 668 | NtSetIoCompletion |
| 669 | NtSetIoCompletionEx |
| 670 | NtSetLdtEntries |
| 671 | NtSetLowEventPair |
| 672 | NtSetLowWaitHighEventPair |
| 673 | NtSetQuotaInformationFile |
| 674 | NtSetSecurityObject |
| 675 | NtSetSystemEnvironmentValue |
| 676 | NtSetSystemEnvironmentValueEx |
| 677 | NtSetSystemInformation |
| 678 | NtSetSystemPowerState |
| 679 | NtSetSystemTime |
| 680 | NtSetThreadExecutionState |
| 681 | NtSetTimer |
| 682 | NtSetTimer2 |
| 683 | NtSetTimerEx |
| 684 | NtSetTimerResolution |
| 685 | NtSetUuidSeed |
| 686 | NtSetValueKey |
| 687 | NtSetVolumeInformationFile |
| 688 | NtSetWnfProcessNotificationEvent |
| 689 | NtShutdownSystem |
| 690 | NtShutdownWorkerFactory |
| 691 | NtSignalAndWaitForSingleObject |
| 692 | NtSinglePhaseReject |
| 693 | NtStartProfile |
| 694 | NtStopProfile |
| 695 | NtSubmitIoRing |
| 696 | NtSubscribeWnfStateChange |
| 697 | NtSuspendProcess |
| 698 | NtSuspendThread |
| 699 | NtSystemDebugControl |
| 700 | NtTerminateEnclave |
| 701 | NtTerminateJobObject |
| 702 | NtTerminateProcess |
| 703 | NtTerminateThread |
| 704 | NtTestAlert |
| 705 | NtThawRegistry |
| 706 | NtThawTransactions |
| 707 | NtTraceControl |
| 708 | NtTraceEvent |
| 709 | NtTranslateFilePath |
| 710 | NtUmsThreadYield |
| 711 | NtUnloadDriver |
| 712 | NtUnloadKey |
| 713 | NtUnloadKey2 |
| 714 | NtUnloadKeyEx |
| 715 | NtUnlockFile |
| 716 | NtUnlockVirtualMemory |
| 717 | NtUnmapViewOfSection |
| 718 | NtUnmapViewOfSectionEx |
| 719 | NtUnsubscribeWnfStateChange |
| 720 | NtUpdateWnfStateData |
| 721 | NtVdmControl |
| 722 | NtWaitForAlertByThreadId |
| 723 | NtWaitForDebugEvent |
| 724 | NtWaitForKeyedEvent |
| 725 | NtWaitForMultipleObjects |
| 726 | NtWaitForMultipleObjects32 |
| 727 | NtWaitForSingleObject |
| 728 | NtWaitForWorkViaWorkerFactory |
| 729 | NtWaitHighEventPair |
| 730 | NtWaitLowEventPair |
| 731 | NtWorkerFactoryWorkerReady |
| 732 | #ifdef __arm__ |
| 733 | NtWow64AllocateVirtualMemory64 |
| 734 | NtWow64CallFunction64 |
| 735 | NtWow64CsrAllocateCaptureBuffer |
| 736 | NtWow64CsrAllocateMessagePointer |
| 737 | NtWow64CsrCaptureMessageBuffer |
| 738 | NtWow64CsrCaptureMessageString |
| 739 | NtWow64CsrClientCallServer |
| 740 | NtWow64CsrClientConnectToServer |
| 741 | NtWow64CsrFreeCaptureBuffer |
| 742 | NtWow64CsrGetProcessId |
| 743 | NtWow64CsrIdentifyAlertableThread |
| 744 | NtWow64CsrVerifyRegion |
| 745 | NtWow64DebuggerCall |
| 746 | NtWow64GetCurrentProcessorNumberEx |
| 747 | NtWow64GetNativeSystemInformation |
| 748 | NtWow64IsProcessorFeaturePresent |
| 749 | NtWow64QueryInformationProcess64 |
| 750 | NtWow64ReadVirtualMemory64 |
| 751 | NtWow64WriteVirtualMemory64 |
| 752 | #endif |
| 753 | NtWriteFile |
| 754 | NtWriteFileGather |
| 755 | NtWriteRequestData |
| 756 | NtWriteVirtualMemory |
| 757 | NtYieldExecution |
| 758 | NtdllDefWindowProc_A |
| 759 | NtdllDefWindowProc_W |
| 760 | NtdllDialogWndProc_A |
| 761 | NtdllDialogWndProc_W |
| 762 | PfxFindPrefix |
| 763 | PfxInitialize |
| 764 | PfxInsertPrefix |
| 765 | PfxRemovePrefix |
| 766 | PssNtCaptureSnapshot |
| 767 | PssNtDuplicateSnapshot |
| 768 | PssNtFreeRemoteSnapshot |
| 769 | PssNtFreeSnapshot |
| 770 | PssNtFreeWalkMarker |
| 771 | PssNtQuerySnapshot |
| 772 | PssNtValidateDescriptor |
| 773 | PssNtWalkSnapshot |
| 774 | F_ARM32(ReadTimeStampCounter) |
| 775 | RtlAbortRXact |
| 776 | RtlAbsoluteToSelfRelativeSD |
| 777 | RtlAcquirePebLock |
| 778 | RtlAcquirePrivilege |
| 779 | RtlAcquireReleaseSRWLockExclusive |
| 780 | RtlAcquireResourceExclusive |
| 781 | RtlAcquireResourceShared |
| 782 | RtlAcquireSRWLockExclusive |
| 783 | RtlAcquireSRWLockShared |
| 784 | RtlActivateActivationContext |
| 785 | RtlActivateActivationContextEx |
| 786 | RtlActivateActivationContextUnsafeFast |
| 787 | RtlAddAccessAllowedAce |
| 788 | RtlAddAccessAllowedAceEx |
| 789 | RtlAddAccessAllowedObjectAce |
| 790 | RtlAddAccessDeniedAce |
| 791 | RtlAddAccessDeniedAceEx |
| 792 | RtlAddAccessDeniedObjectAce |
| 793 | RtlAddAccessFilterAce |
| 794 | RtlAddAce |
| 795 | RtlAddActionToRXact |
| 796 | RtlAddAtomToAtomTable |
| 797 | RtlAddAttributeActionToRXact |
| 798 | RtlAddAuditAccessAce |
| 799 | RtlAddAuditAccessAceEx |
| 800 | RtlAddAuditAccessObjectAce |
| 801 | RtlAddCompoundAce |
| 802 | RtlAddFunctionTable |
| 803 | RtlAddGrowableFunctionTable |
| 804 | RtlAddIntegrityLabelToBoundaryDescriptor |
| 805 | RtlAddMandatoryAce |
| 806 | RtlAddProcessTrustLabelAce |
| 807 | RtlAddRefActivationContext |
| 808 | RtlAddRefMemoryStream |
| 809 | RtlAddResourceAttributeAce |
| 810 | RtlAddSIDToBoundaryDescriptor |
| 811 | RtlAddScopedPolicyIDAce |
| 812 | RtlAddVectoredContinueHandler |
| 813 | RtlAddVectoredExceptionHandler |
| 814 | RtlAddressInSectionTable |
| 815 | RtlAdjustPrivilege |
| 816 | RtlAllocateActivationContextStack |
| 817 | RtlAllocateAndInitializeSid |
| 818 | RtlAllocateAndInitializeSidEx |
| 819 | RtlAllocateHandle |
| 820 | RtlAllocateHeap |
| 821 | RtlAllocateMemoryBlockLookaside |
| 822 | RtlAllocateMemoryZone |
| 823 | RtlAllocateWnfSerializationGroup |
| 824 | RtlAnsiCharToUnicodeChar |
| 825 | RtlAnsiStringToUnicodeSize |
| 826 | RtlAnsiStringToUnicodeString |
| 827 | RtlAppendAsciizToString |
| 828 | RtlAppendPathElement |
| 829 | RtlAppendStringToString |
| 830 | RtlAppendUnicodeStringToString |
| 831 | RtlAppendUnicodeToString |
| 832 | RtlApplicationVerifierStop |
| 833 | RtlApplyRXact |
| 834 | RtlApplyRXactNoFlush |
| 835 | RtlAppxIsFileOwnedByTrustedInstaller |
| 836 | RtlAreAllAccessesGranted |
| 837 | RtlAreAnyAccessesGranted |
| 838 | RtlAreBitsClear |
| 839 | F_X64(RtlAreBitsClearEx) |
| 840 | RtlAreBitsSet |
| 841 | RtlAreLongPathsEnabled |
| 842 | RtlAssert |
| 843 | RtlAvlInsertNodeEx |
| 844 | RtlAvlRemoveNode |
| 845 | RtlBarrier |
| 846 | RtlBarrierForDelete |
| 847 | F_X64(RtlCallEnclaveReturn) |
| 848 | RtlCancelTimer |
| 849 | RtlCanonicalizeDomainName |
| 850 | RtlCapabilityCheck |
| 851 | RtlCapabilityCheckForSingleSessionSku |
| 852 | RtlCaptureContext |
| 853 | RtlCaptureContext2 |
| 854 | RtlCaptureStackBackTrace |
| 855 | RtlCharToInteger |
| 856 | RtlCheckBootStatusIntegrity |
| 857 | RtlCheckForOrphanedCriticalSections |
| 858 | RtlCheckPortableOperatingSystem |
| 859 | F_X64(RtlCheckProcessParameters) |
| 860 | RtlCheckRegistryKey |
| 861 | RtlCheckSandboxedToken |
| 862 | RtlCheckSystemBootStatusIntegrity |
| 863 | RtlCheckTokenCapability |
| 864 | RtlCheckTokenMembership |
| 865 | RtlCheckTokenMembershipEx |
| 866 | RtlCleanUpTEBLangLists |
| 867 | RtlClearAllBits |
| 868 | F_X64(RtlClearAllBitsEx) |
| 869 | RtlClearBit |
| 870 | F_X64(RtlClearBitEx) |
| 871 | RtlClearBits |
| 872 | F_X64(RtlClearBitsEx) |
| 873 | RtlClearThreadWorkOnBehalfTicket |
| 874 | RtlCloneMemoryStream |
| 875 | RtlCloneUserProcess |
| 876 | RtlCmDecodeMemIoResource |
| 877 | RtlCmEncodeMemIoResource |
| 878 | RtlCommitDebugInfo |
| 879 | RtlCommitMemoryStream |
| 880 | RtlCompactHeap |
| 881 | RtlCompareAltitudes |
| 882 | RtlCompareExchangePointerMapping |
| 883 | RtlCompareExchangePropertyStore |
| 884 | RtlCompareMemory |
| 885 | RtlCompareMemoryUlong |
| 886 | RtlCompareString |
| 887 | RtlCompareUnicodeString |
| 888 | RtlCompareUnicodeStrings |
| 889 | F64(RtlCompleteProcessCloning) |
| 890 | RtlCompressBuffer |
| 891 | RtlComputeCrc32 |
| 892 | RtlComputeImportTableHash |
| 893 | RtlComputePrivatizedDllName_U |
| 894 | RtlConnectToSm |
| 895 | RtlConsoleMultiByteToUnicodeN |
| 896 | RtlConstructCrossVmEventPath |
| 897 | RtlConstructCrossVmMutexPath |
| 898 | RtlContractHashTable |
| 899 | RtlConvertDeviceFamilyInfoToString |
| 900 | RtlConvertExclusiveToShared |
| 901 | RtlConvertLCIDToString |
| 902 | RtlConvertSRWLockExclusiveToShared |
| 903 | RtlConvertSharedToExclusive |
| 904 | RtlConvertSidToUnicodeString |
| 905 | RtlConvertToAutoInheritSecurityObject |
| 906 | F_X86_ANY(RtlConvertUiListToApiList) |
| 907 | RtlCopyBitMap |
| 908 | RtlCopyContext |
| 909 | RtlCopyExtendedContext |
| 910 | RtlCopyLuid |
| 911 | RtlCopyLuidAndAttributesArray |
| 912 | RtlCopyMappedMemory |
| 913 | RtlCopyMemory |
| 914 | F_X64(RtlCopyMemoryNonTemporal) |
| 915 | RtlCopyMemoryStreamTo |
| 916 | RtlCopyOutOfProcessMemoryStreamTo |
| 917 | RtlCopySecurityDescriptor |
| 918 | RtlCopySid |
| 919 | RtlCopySidAndAttributesArray |
| 920 | RtlCopyString |
| 921 | RtlCopyUnicodeString |
| 922 | RtlCrc32 |
| 923 | RtlCrc64 |
| 924 | RtlCreateAcl |
| 925 | RtlCreateActivationContext |
| 926 | RtlCreateAndSetSD |
| 927 | RtlCreateAtomTable |
| 928 | RtlCreateBootStatusDataFile |
| 929 | RtlCreateBoundaryDescriptor |
| 930 | RtlCreateEnvironment |
| 931 | RtlCreateEnvironmentEx |
| 932 | RtlCreateHashTable |
| 933 | RtlCreateHashTableEx |
| 934 | RtlCreateHeap |
| 935 | RtlCreateMemoryBlockLookaside |
| 936 | RtlCreateMemoryZone |
| 937 | RtlCreateProcessParameters |
| 938 | RtlCreateProcessParametersEx |
| 939 | RtlCreateProcessParametersWithTemplate |
| 940 | RtlCreateProcessReflection |
| 941 | RtlCreateQueryDebugBuffer |
| 942 | RtlCreateRegistryKey |
| 943 | RtlCreateSecurityDescriptor |
| 944 | RtlCreateServiceSid |
| 945 | RtlCreateSystemVolumeInformationFolder |
| 946 | RtlCreateTagHeap |
| 947 | RtlCreateTimer |
| 948 | RtlCreateTimerQueue |
| 949 | #ifdef __x86_64__ |
| 950 | RtlCreateUmsCompletionList |
| 951 | RtlCreateUmsThread |
| 952 | RtlCreateUmsThreadContext |
| 953 | #endif |
| 954 | RtlCreateUnicodeString |
| 955 | RtlCreateUnicodeStringFromAsciiz |
| 956 | F_X64(RtlCreateUserFiberShadowStack) |
| 957 | RtlCreateUserProcess |
| 958 | RtlCreateUserProcessEx |
| 959 | RtlCreateUserSecurityObject |
| 960 | RtlCreateUserStack |
| 961 | RtlCreateUserThread |
| 962 | RtlCreateVirtualAccountSid |
| 963 | RtlCultureNameToLCID |
| 964 | RtlCustomCPToUnicodeN |
| 965 | RtlCutoverTimeToSystemTime |
| 966 | RtlDeCommitDebugInfo |
| 967 | RtlDeNormalizeProcessParams |
| 968 | RtlDeactivateActivationContext |
| 969 | RtlDeactivateActivationContextUnsafeFast |
| 970 | RtlDebugPrintTimes |
| 971 | RtlDecodePointer |
| 972 | RtlDecodeRemotePointer |
| 973 | RtlDecodeSystemPointer |
| 974 | RtlDecompressBuffer |
| 975 | RtlDecompressBufferEx |
| 976 | RtlDecompressFragment |
| 977 | RtlDefaultNpAcl |
| 978 | RtlDelayExecution |
| 979 | RtlDelete |
| 980 | RtlDeleteAce |
| 981 | RtlDeleteAtomFromAtomTable |
| 982 | RtlDeleteBarrier |
| 983 | RtlDeleteBoundaryDescriptor |
| 984 | RtlDeleteCriticalSection |
| 985 | RtlDeleteElementGenericTable |
| 986 | RtlDeleteElementGenericTableAvl |
| 987 | RtlDeleteElementGenericTableAvlEx |
| 988 | RtlDeleteFunctionTable |
| 989 | RtlDeleteGrowableFunctionTable |
| 990 | RtlDeleteHashTable |
| 991 | RtlDeleteNoSplay |
| 992 | RtlDeleteRegistryValue |
| 993 | RtlDeleteResource |
| 994 | RtlDeleteSecurityObject |
| 995 | RtlDeleteTimer |
| 996 | RtlDeleteTimerQueue |
| 997 | RtlDeleteTimerQueueEx |
| 998 | #ifdef __x86_64__ |
| 999 | RtlDeleteUmsCompletionList |
| 1000 | RtlDeleteUmsThreadContext |
| 1001 | RtlDequeueUmsCompletionListItems |
| 1002 | #endif |
| 1003 | RtlDeregisterSecureMemoryCacheCallback |
| 1004 | RtlDeregisterWait |
| 1005 | RtlDeregisterWaitEx |
| 1006 | RtlDeriveCapabilitySidsFromName |
| 1007 | RtlDestroyAtomTable |
| 1008 | RtlDestroyEnvironment |
| 1009 | RtlDestroyHandleTable |
| 1010 | RtlDestroyHeap |
| 1011 | RtlDestroyMemoryBlockLookaside |
| 1012 | RtlDestroyMemoryZone |
| 1013 | RtlDestroyProcessParameters |
| 1014 | RtlDestroyQueryDebugBuffer |
| 1015 | RtlDetectHeapLeaks |
| 1016 | RtlDetermineDosPathNameType_U |
| 1017 | RtlDisableThreadProfiling |
| 1018 | RtlDllShutdownInProgress |
| 1019 | RtlDnsHostNameToComputerName |
| 1020 | RtlDoesFileExists_U |
| 1021 | RtlDoesNameContainWildCards |
| 1022 | RtlDosApplyFileIsolationRedirection_Ustr |
| 1023 | RtlDosLongPathNameToNtPathName_U_WithStatus |
| 1024 | RtlDosLongPathNameToRelativeNtPathName_U_WithStatus |
| 1025 | RtlDosPathNameToNtPathName_U |
| 1026 | RtlDosPathNameToNtPathName_U_WithStatus |
| 1027 | RtlDosPathNameToRelativeNtPathName_U |
| 1028 | RtlDosPathNameToRelativeNtPathName_U_WithStatus |
| 1029 | RtlDosSearchPath_U |
| 1030 | RtlDosSearchPath_Ustr |
| 1031 | RtlDowncaseUnicodeChar |
| 1032 | RtlDowncaseUnicodeString |
| 1033 | F64(RtlDrainNonVolatileFlush) |
| 1034 | RtlDumpResource |
| 1035 | RtlDuplicateUnicodeString |
| 1036 | RtlEmptyAtomTable |
| 1037 | RtlEnableEarlyCriticalSectionEventCreation |
| 1038 | RtlEnableThreadProfiling |
| 1039 | F_X64(RtlEnclaveCallDispatch) |
| 1040 | F_X64(RtlEnclaveCallDispatchReturn) |
| 1041 | RtlEncodePointer |
| 1042 | RtlEncodeRemotePointer |
| 1043 | RtlEncodeSystemPointer |
| 1044 | RtlEndEnumerationHashTable |
| 1045 | RtlEndStrongEnumerationHashTable |
| 1046 | RtlEndWeakEnumerationHashTable |
| 1047 | RtlEnterCriticalSection |
| 1048 | F_X64(RtlEnterUmsSchedulingMode) |
| 1049 | RtlEnumProcessHeaps |
| 1050 | RtlEnumerateEntryHashTable |
| 1051 | RtlEnumerateGenericTable |
| 1052 | RtlEnumerateGenericTableAvl |
| 1053 | RtlEnumerateGenericTableLikeADirectory |
| 1054 | RtlEnumerateGenericTableWithoutSplaying |
| 1055 | RtlEnumerateGenericTableWithoutSplayingAvl |
| 1056 | RtlEqualComputerName |
| 1057 | RtlEqualDomainName |
| 1058 | RtlEqualLuid |
| 1059 | RtlEqualPrefixSid |
| 1060 | RtlEqualSid |
| 1061 | RtlEqualString |
| 1062 | RtlEqualUnicodeString |
| 1063 | RtlEqualWnfChangeStamps |
| 1064 | RtlEraseUnicodeString |
| 1065 | RtlEthernetAddressToStringA |
| 1066 | RtlEthernetAddressToStringW |
| 1067 | RtlEthernetStringToAddressA |
| 1068 | RtlEthernetStringToAddressW |
| 1069 | F_X64(RtlExecuteUmsThread) |
| 1070 | RtlExitUserProcess |
| 1071 | RtlExitUserThread |
| 1072 | RtlExpandEnvironmentStrings |
| 1073 | RtlExpandEnvironmentStrings_U |
| 1074 | F_X86_ANY(RtlExtendHeap) |
| 1075 | RtlExpandHashTable |
| 1076 | RtlExtendCorrelationVector |
| 1077 | RtlExtendMemoryBlockLookaside |
| 1078 | RtlExtendMemoryZone |
| 1079 | F_ARM32(RtlExtendedMagicDivide) |
| 1080 | RtlExtractBitMap |
| 1081 | RtlFillMemory |
| 1082 | F_X64(RtlFillMemoryNonTemporal) |
| 1083 | F_ARM_ANY(RtlFillMemoryUlong) |
| 1084 | F_ARM_ANY(RtlFillMemoryUlonglong) |
| 1085 | F64(RtlFillNonVolatileMemory) |
| 1086 | RtlFinalReleaseOutOfProcessMemoryStream |
| 1087 | RtlFindAceByType |
| 1088 | RtlFindActivationContextSectionGuid |
| 1089 | RtlFindActivationContextSectionString |
| 1090 | RtlFindCharInUnicodeString |
| 1091 | RtlFindClearBits |
| 1092 | RtlFindClearBitsAndSet |
| 1093 | RtlFindClearBitsAndSetEx |
| 1094 | F_X64(RtlFindClearBitsEx) |
| 1095 | RtlFindClearRuns |
| 1096 | RtlFindClosestEncodableLength |
| 1097 | RtlFindExportedRoutineByName |
| 1098 | RtlFindLastBackwardRunClear |
| 1099 | RtlFindLeastSignificantBit |
| 1100 | RtlFindLongestRunClear |
| 1101 | RtlFindMessage |
| 1102 | RtlFindMostSignificantBit |
| 1103 | RtlFindNextForwardRunClear |
| 1104 | RtlFindSetBits |
| 1105 | RtlFindSetBitsAndClear |
| 1106 | F_X64(RtlFindSetBitsAndClearEx) |
| 1107 | F_X64(RtlFindSetBitsEx) |
| 1108 | RtlFindUnicodeSubstring |
| 1109 | RtlFirstEntrySList |
| 1110 | RtlFirstFreeAce |
| 1111 | RtlFlsAlloc |
| 1112 | RtlFlsFree |
| 1113 | RtlFlsGetValue |
| 1114 | RtlFlsSetValue |
| 1115 | RtlFlushHeaps |
| 1116 | F64(RtlFlushNonVolatileMemory) |
| 1117 | F64(RtlFlushNonVolatileMemoryRanges) |
| 1118 | RtlFlushSecureMemoryCache |
| 1119 | RtlFormatCurrentUserKeyPath |
| 1120 | RtlFormatMessage |
| 1121 | RtlFormatMessageEx |
| 1122 | RtlFreeActivationContextStack |
| 1123 | RtlFreeAnsiString |
| 1124 | RtlFreeHandle |
| 1125 | RtlFreeHeap |
| 1126 | RtlFreeMemoryBlockLookaside |
| 1127 | F64(RtlFreeNonVolatileToken) |
| 1128 | RtlFreeOemString |
| 1129 | RtlFreeSid |
| 1130 | RtlFreeThreadActivationContextStack |
| 1131 | F_X86_ANY(RtlFreeUTF8String) |
| 1132 | RtlFreeUnicodeString |
| 1133 | F_X64(RtlFreeUserFiberShadowStack) |
| 1134 | F_X86_ANY(RtlFreeUserThreadStack) |
| 1135 | RtlFreeUserStack |
| 1136 | RtlGUIDFromString |
| 1137 | RtlGenerate8dot3Name |
| 1138 | RtlGetAce |
| 1139 | RtlGetActiveActivationContext |
| 1140 | RtlGetActiveConsoleId |
| 1141 | RtlGetAppContainerNamedObjectPath |
| 1142 | RtlGetAppContainerParent |
| 1143 | RtlGetAppContainerSidType |
| 1144 | RtlGetCallersAddress |
| 1145 | RtlGetCompressionWorkSpaceSize |
| 1146 | RtlGetConsoleSessionForegroundProcessId |
| 1147 | RtlGetControlSecurityDescriptor |
| 1148 | RtlGetCriticalSectionRecursionCount |
| 1149 | RtlGetCurrentDirectory_U |
| 1150 | RtlGetCurrentPeb |
| 1151 | RtlGetCurrentProcessorNumber |
| 1152 | RtlGetCurrentProcessorNumberEx |
| 1153 | RtlGetCurrentServiceSessionId |
| 1154 | RtlGetCurrentTransaction |
| 1155 | F_X64(RtlGetCurrentUmsThread) |
| 1156 | RtlGetDaclSecurityDescriptor |
| 1157 | RtlGetDeviceFamilyInfoEnum |
| 1158 | RtlGetElementGenericTable |
| 1159 | RtlGetElementGenericTableAvl |
| 1160 | RtlGetEnabledExtendedFeatures |
| 1161 | RtlGetExePath |
| 1162 | RtlGetExtendedContextLength |
| 1163 | RtlGetExtendedContextLength2 |
| 1164 | RtlGetExtendedFeaturesMask |
| 1165 | RtlGetFileMUIPath |
| 1166 | RtlGetFrame |
| 1167 | RtlGetFullPathName_U |
| 1168 | RtlGetFullPathName_UEx |
| 1169 | RtlGetFullPathName_UstrEx |
| 1170 | RtlGetFunctionTableListHead |
| 1171 | RtlGetGroupSecurityDescriptor |
| 1172 | RtlGetImageFileMachines |
| 1173 | RtlGetIntegerAtom |
| 1174 | RtlGetInterruptTimePrecise |
| 1175 | RtlGetLastNtStatus |
| 1176 | RtlGetLastWin32Error |
| 1177 | RtlGetLengthWithoutLastFullDosOrNtPathElement |
| 1178 | RtlGetLengthWithoutTrailingPathSeperators |
| 1179 | RtlGetLocaleFileMappingAddress |
| 1180 | RtlGetLongestNtPathLength |
| 1181 | RtlGetMultiTimePrecise |
| 1182 | RtlGetNativeSystemInformation |
| 1183 | RtlGetNextEntryHashTable |
| 1184 | F_X64(RtlGetNextUmsListItem) |
| 1185 | F64(RtlGetNonVolatileToken) |
| 1186 | RtlGetNtGlobalFlags |
| 1187 | RtlGetNtProductType |
| 1188 | RtlGetNtSystemRoot |
| 1189 | RtlGetNtVersionNumbers |
| 1190 | RtlGetOwnerSecurityDescriptor |
| 1191 | RtlGetParentLocaleName |
| 1192 | RtlGetPersistedStateLocation |
| 1193 | RtlGetProcessHeaps |
| 1194 | RtlGetProcessPreferredUILanguages |
| 1195 | RtlGetProductInfo |
| 1196 | RtlGetReturnAddressHijackTarget |
| 1197 | RtlGetSaclSecurityDescriptor |
| 1198 | RtlGetSearchPath |
| 1199 | RtlGetSecurityDescriptorRMControl |
| 1200 | RtlGetSessionProperties |
| 1201 | RtlGetSetBootStatusData |
| 1202 | RtlGetSuiteMask |
| 1203 | RtlGetSystemBootStatus |
| 1204 | RtlGetSystemBootStatusEx |
| 1205 | RtlGetSystemGlobalData |
| 1206 | RtlGetSystemPreferredUILanguages |
| 1207 | RtlGetSystemTimeAndBias |
| 1208 | RtlGetSystemTimePrecise |
| 1209 | RtlGetThreadErrorMode |
| 1210 | RtlGetThreadLangIdByIndex |
| 1211 | RtlGetThreadPreferredUILanguages |
| 1212 | RtlGetThreadWorkOnBehalfTicket |
| 1213 | RtlGetTokenNamedObjectPath |
| 1214 | RtlGetUILanguageInfo |
| 1215 | F_X64(RtlGetUmsCompletionListEvent) |
| 1216 | RtlGetUnloadEventTrace |
| 1217 | RtlGetUnloadEventTraceEx |
| 1218 | RtlGetUserInfoHeap |
| 1219 | RtlGetUserPreferredUILanguages |
| 1220 | RtlGetVersion |
| 1221 | RtlGrowFunctionTable |
| 1222 | RtlGuardCheckLongJumpTarget |
| 1223 | RtlHashUnicodeString |
| 1224 | RtlHeapTrkInitialize |
| 1225 | RtlIdentifierAuthoritySid |
| 1226 | RtlIdnToAscii |
| 1227 | RtlIdnToNameprepUnicode |
| 1228 | RtlIdnToUnicode |
| 1229 | RtlImageDirectoryEntryToData |
| 1230 | RtlImageNtHeader |
| 1231 | RtlImageNtHeaderEx |
| 1232 | RtlImageRvaToSection |
| 1233 | RtlImageRvaToVa |
| 1234 | RtlImpersonateSelf |
| 1235 | RtlImpersonateSelfEx |
| 1236 | RtlIncrementCorrelationVector |
| 1237 | RtlInitAnsiString |
| 1238 | RtlInitAnsiStringEx |
| 1239 | RtlInitBarrier |
| 1240 | RtlInitCodePageTable |
| 1241 | RtlInitEnumerationHashTable |
| 1242 | RtlInitMemoryStream |
| 1243 | RtlInitNlsTables |
| 1244 | RtlInitOutOfProcessMemoryStream |
| 1245 | RtlInitString |
| 1246 | RtlInitStringEx |
| 1247 | RtlInitStrongEnumerationHashTable |
| 1248 | F_X86_ANY(RtlInitUTF8String) |
| 1249 | F_X86_ANY(RtlInitUTF8StringEx) |
| 1250 | RtlInitUnicodeString |
| 1251 | RtlInitUnicodeStringEx |
| 1252 | RtlInitWeakEnumerationHashTable |
| 1253 | RtlInitializeAtomPackage |
| 1254 | RtlInitializeBitMap |
| 1255 | F64(RtlInitializeBitMapEx) |
| 1256 | RtlInitializeConditionVariable |
| 1257 | RtlInitializeContext |
| 1258 | RtlInitializeCorrelationVector |
| 1259 | RtlInitializeCriticalSection |
| 1260 | RtlInitializeCriticalSectionAndSpinCount |
| 1261 | RtlInitializeCriticalSectionEx |
| 1262 | RtlInitializeExtendedContext |
| 1263 | RtlInitializeExtendedContext2 |
| 1264 | RtlInitializeGenericTable |
| 1265 | RtlInitializeGenericTableAvl |
| 1266 | RtlInitializeHandleTable |
| 1267 | RtlInitializeNtUserPfn |
| 1268 | RtlInitializeRXact |
| 1269 | RtlInitializeResource |
| 1270 | RtlInitializeSListHead |
| 1271 | RtlInitializeSRWLock |
| 1272 | RtlInitializeSid |
| 1273 | RtlInitializeSidEx |
| 1274 | RtlInsertElementGenericTable |
| 1275 | RtlInsertElementGenericTableAvl |
| 1276 | RtlInsertElementGenericTableFull |
| 1277 | RtlInsertElementGenericTableFullAvl |
| 1278 | RtlInsertEntryHashTable |
| 1279 | RtlInstallFunctionTableCallback |
| 1280 | RtlInt64ToUnicodeString |
| 1281 | RtlIntegerToChar |
| 1282 | RtlIntegerToUnicodeString |
| 1283 | RtlInterlockedClearBitRun |
| 1284 | RtlInterlockedFlushSList |
| 1285 | RtlInterlockedPopEntrySList |
| 1286 | RtlInterlockedPushEntrySList |
| 1287 | RtlInterlockedPushListSList |
| 1288 | RtlInterlockedPushListSListEx |
| 1289 | RtlInterlockedSetBitRun |
| 1290 | RtlIoDecodeMemIoResource |
| 1291 | RtlIoEncodeMemIoResource |
| 1292 | RtlIpv4AddressToStringA |
| 1293 | RtlIpv4AddressToStringExA |
| 1294 | RtlIpv4AddressToStringExW |
| 1295 | RtlIpv4AddressToStringW |
| 1296 | RtlIpv4StringToAddressA |
| 1297 | RtlIpv4StringToAddressExA |
| 1298 | RtlIpv4StringToAddressExW |
| 1299 | RtlIpv4StringToAddressW |
| 1300 | RtlIpv6AddressToStringA |
| 1301 | RtlIpv6AddressToStringExA |
| 1302 | RtlIpv6AddressToStringExW |
| 1303 | RtlIpv6AddressToStringW |
| 1304 | RtlIpv6StringToAddressA |
| 1305 | RtlIpv6StringToAddressExA |
| 1306 | RtlIpv6StringToAddressExW |
| 1307 | RtlIpv6StringToAddressW |
| 1308 | RtlIsActivationContextActive |
| 1309 | RtlIsApiSetImplemented |
| 1310 | RtlIsCapabilitySid |
| 1311 | RtlIsCloudFilesPlaceholder |
| 1312 | RtlIsCriticalSectionLocked |
| 1313 | RtlIsCriticalSectionLockedByThread |
| 1314 | RtlIsCurrentProcess |
| 1315 | RtlIsCurrentThread |
| 1316 | RtlIsCurrentThreadAttachExempt |
| 1317 | RtlIsDosDeviceName_U |
| 1318 | RtlIsEcCode |
| 1319 | RtlIsElevatedRid |
| 1320 | RtlIsEnclaveFeaturePresent |
| 1321 | RtlIsGenericTableEmpty |
| 1322 | RtlIsGenericTableEmptyAvl |
| 1323 | RtlIsMultiSessionSku |
| 1324 | RtlIsMultiUsersInSessionSku |
| 1325 | RtlIsNameInExpression |
| 1326 | RtlIsNameInUnUpcasedExpression |
| 1327 | RtlIsNameLegalDOS8Dot3 |
| 1328 | RtlIsNonEmptyDirectoryReparsePointAllowed |
| 1329 | RtlIsNormalizedString |
| 1330 | RtlIsPackageSid |
| 1331 | RtlIsParentOfChildAppContainer |
| 1332 | RtlIsPartialPlaceholder |
| 1333 | RtlIsPartialPlaceholderFileHandle |
| 1334 | RtlIsPartialPlaceholderFileInfo |
| 1335 | RtlIsProcessorFeaturePresent |
| 1336 | RtlIsStateSeparationEnabled |
| 1337 | RtlIsTextUnicode |
| 1338 | RtlIsThreadWithinLoaderCallout |
| 1339 | RtlIsUntrustedObject |
| 1340 | RtlIsValidHandle |
| 1341 | RtlIsValidIndexHandle |
| 1342 | RtlIsValidLocaleName |
| 1343 | RtlIsValidProcessTrustLabelSid |
| 1344 | F_X86_ANY(RtlIsZeroMemory) |
| 1345 | RtlKnownExceptionFilter |
| 1346 | RtlLCIDToCultureName |
| 1347 | RtlLargeIntegerToChar |
| 1348 | RtlLcidToLocaleName |
| 1349 | RtlLeaveCriticalSection |
| 1350 | RtlLengthRequiredSid |
| 1351 | RtlLengthSecurityDescriptor |
| 1352 | RtlLengthSid |
| 1353 | RtlLengthSidAsUnicodeString |
| 1354 | RtlLoadString |
| 1355 | RtlLocalTimeToSystemTime |
| 1356 | RtlLocaleNameToLcid |
| 1357 | RtlLocateExtendedFeature |
| 1358 | RtlLocateExtendedFeature2 |
| 1359 | RtlLocateLegacyContext |
| 1360 | RtlLockBootStatusData |
| 1361 | RtlLockCurrentThread |
| 1362 | RtlLockHeap |
| 1363 | RtlLockMemoryBlockLookaside |
| 1364 | RtlLockMemoryStreamRegion |
| 1365 | RtlLockMemoryZone |
| 1366 | RtlLockModuleSection |
| 1367 | RtlLogStackBackTrace |
| 1368 | RtlLookupAtomInAtomTable |
| 1369 | RtlLookupElementGenericTable |
| 1370 | RtlLookupElementGenericTableAvl |
| 1371 | RtlLookupElementGenericTableFull |
| 1372 | RtlLookupElementGenericTableFullAvl |
| 1373 | RtlLookupEntryHashTable |
| 1374 | RtlLookupFirstMatchingElementGenericTableAvl |
| 1375 | RtlLookupFunctionEntry |
| 1376 | RtlLookupFunctionTable |
| 1377 | RtlMakeSelfRelativeSD |
| 1378 | RtlMapGenericMask |
| 1379 | RtlMapSecurityErrorToNtStatus |
| 1380 | RtlMoveMemory |
| 1381 | RtlMultiAppendUnicodeStringBuffer |
| 1382 | RtlMultiByteToUnicodeN |
| 1383 | RtlMultiByteToUnicodeSize |
| 1384 | RtlMultipleAllocateHeap |
| 1385 | RtlMultipleFreeHeap |
| 1386 | RtlNewInstanceSecurityObject |
| 1387 | RtlNewSecurityGrantedAccess |
| 1388 | RtlNewSecurityObject |
| 1389 | RtlNewSecurityObjectEx |
| 1390 | RtlNewSecurityObjectWithMultipleInheritance |
| 1391 | RtlNormalizeProcessParams |
| 1392 | F_X86_ANY(RtlNormalizeSecurityDescriptor) |
| 1393 | RtlNormalizeString |
| 1394 | RtlNotifyFeatureUsage |
| 1395 | RtlNtPathNameToDosPathName |
| 1396 | RtlNtStatusToDosError |
| 1397 | RtlNtStatusToDosErrorNoTeb |
| 1398 | F64(RtlNtdllName DATA) |
| 1399 | RtlNumberGenericTableElements |
| 1400 | RtlNumberGenericTableElementsAvl |
| 1401 | RtlNumberOfClearBits |
| 1402 | F_X64(RtlNumberOfClearBitsEx) |
| 1403 | RtlNumberOfClearBitsInRange |
| 1404 | RtlNumberOfSetBits |
| 1405 | F_X64(RtlNumberOfSetBitsEx) |
| 1406 | RtlNumberOfSetBitsInRange |
| 1407 | RtlNumberOfSetBitsUlongPtr |
| 1408 | RtlOemStringToUnicodeSize |
| 1409 | RtlOemStringToUnicodeString |
| 1410 | RtlOemToUnicodeN |
| 1411 | RtlOpenCrossProcessEmulatorWorkConnection |
| 1412 | RtlOpenCurrentUser |
| 1413 | RtlOsDeploymentState |
| 1414 | RtlOwnerAcesPresent |
| 1415 | RtlPcToFileHeader |
| 1416 | RtlPinAtomInAtomTable |
| 1417 | RtlPopFrame |
| 1418 | RtlPrefixString |
| 1419 | RtlPrefixUnicodeString |
| 1420 | F64(RtlPrepareForProcessCloning) |
| 1421 | RtlProcessFlsData |
| 1422 | RtlProtectHeap |
| 1423 | RtlPublishWnfStateData |
| 1424 | RtlPushFrame |
| 1425 | RtlQueryActivationContextApplicationSettings |
| 1426 | RtlQueryAllFeatureConfigurations |
| 1427 | RtlQueryAtomInAtomTable |
| 1428 | RtlQueryCriticalSectionOwner |
| 1429 | RtlQueryDepthSList |
| 1430 | RtlQueryDynamicTimeZoneInformation |
| 1431 | RtlQueryElevationFlags |
| 1432 | RtlQueryEnvironmentVariable |
| 1433 | RtlQueryEnvironmentVariable_U |
| 1434 | RtlQueryFeatureConfiguration |
| 1435 | RtlQueryFeatureConfigurationChangeStamp |
| 1436 | RtlQueryFeatureUsageNotificationSubscriptions |
| 1437 | RtlQueryHeapInformation |
| 1438 | RtlQueryImageMitigationPolicy |
| 1439 | RtlQueryInformationAcl |
| 1440 | RtlQueryInformationActivationContext |
| 1441 | RtlQueryInformationActiveActivationContext |
| 1442 | RtlQueryInterfaceMemoryStream |
| 1443 | RtlQueryModuleInformation |
| 1444 | RtlQueryPackageClaims |
| 1445 | RtlQueryPackageIdentity |
| 1446 | RtlQueryPackageIdentityEx |
| 1447 | RtlQueryPerformanceCounter |
| 1448 | RtlQueryPerformanceFrequency |
| 1449 | RtlQueryPointerMapping |
| 1450 | RtlQueryProcessBackTraceInformation |
| 1451 | RtlQueryProcessDebugInformation |
| 1452 | RtlQueryProcessHeapInformation |
| 1453 | RtlQueryProcessLockInformation |
| 1454 | RtlQueryProcessPlaceholderCompatibilityMode |
| 1455 | RtlQueryPropertyStore |
| 1456 | RtlQueryProtectedPolicy |
| 1457 | RtlQueryRegistryValueWithFallback |
| 1458 | RtlQueryRegistryValues |
| 1459 | RtlQueryRegistryValuesEx |
| 1460 | RtlQueryResourcePolicy |
| 1461 | RtlQuerySecurityObject |
| 1462 | RtlQueryTagHeap |
| 1463 | RtlQueryThreadPlaceholderCompatibilityMode |
| 1464 | RtlQueryThreadProfiling |
| 1465 | RtlQueryTimeZoneInformation |
| 1466 | RtlQueryTokenHostIdAsUlong64 |
| 1467 | F_X64(RtlQueryUmsThreadInformation) |
| 1468 | RtlQueryUnbiasedInterruptTime |
| 1469 | RtlQueryValidationRunlevel |
| 1470 | RtlQueryWnfMetaNotification |
| 1471 | RtlQueryWnfStateData |
| 1472 | RtlQueryWnfStateDataWithExplicitScope |
| 1473 | RtlQueueApcWow64Thread |
| 1474 | RtlQueueWorkItem |
| 1475 | RtlRaiseCustomSystemEventTrigger |
| 1476 | RtlRaiseException |
| 1477 | RtlRaiseNoncontinuableException |
| 1478 | RtlRaiseStatus |
| 1479 | RtlRandom |
| 1480 | RtlRandomEx |
| 1481 | RtlRbInsertNodeEx |
| 1482 | RtlRbRemoveNode |
| 1483 | RtlReAllocateHeap |
| 1484 | RtlReadMemoryStream |
| 1485 | RtlReadOutOfProcessMemoryStream |
| 1486 | RtlReadThreadProfilingData |
| 1487 | RtlRealPredecessor |
| 1488 | RtlRealSuccessor |
| 1489 | RtlRegisterFeatureConfigurationChangeNotification |
| 1490 | RtlRegisterForWnfMetaNotification |
| 1491 | RtlRegisterSecureMemoryCacheCallback |
| 1492 | RtlRegisterThreadWithCsrss |
| 1493 | RtlRegisterWait |
| 1494 | RtlReleaseActivationContext |
| 1495 | RtlReleaseMemoryStream |
| 1496 | RtlReleasePath |
| 1497 | RtlReleasePebLock |
| 1498 | RtlReleasePrivilege |
| 1499 | RtlReleaseRelativeName |
| 1500 | RtlReleaseResource |
| 1501 | RtlReleaseSRWLockExclusive |
| 1502 | RtlReleaseSRWLockShared |
| 1503 | RtlRemoteCall |
| 1504 | RtlRemoveEntryHashTable |
| 1505 | RtlRemovePointerMapping |
| 1506 | RtlRemovePrivileges |
| 1507 | RtlRemovePropertyStore |
| 1508 | RtlRemoveVectoredContinueHandler |
| 1509 | RtlRemoveVectoredExceptionHandler |
| 1510 | RtlReplaceSidInSd |
| 1511 | RtlReplaceSystemDirectoryInPath |
| 1512 | RtlReportException |
| 1513 | RtlReportExceptionEx |
| 1514 | RtlReportSilentProcessExit |
| 1515 | RtlReportSqmEscalation |
| 1516 | RtlResetMemoryBlockLookaside |
| 1517 | RtlResetMemoryZone |
| 1518 | RtlResetNtUserPfn |
| 1519 | RtlResetRtlTranslations |
| 1520 | RtlRestoreBootStatusDefaults |
| 1521 | RtlRestoreContext |
| 1522 | RtlRestoreLastWin32Error |
| 1523 | RtlRestoreSystemBootStatusDefaults |
| 1524 | F_X86_ANY(RtlRestoreThreadPreferredUILanguages) |
| 1525 | RtlRetrieveNtUserPfn |
| 1526 | RtlRevertMemoryStream |
| 1527 | RtlRunDecodeUnicodeString |
| 1528 | RtlRunEncodeUnicodeString |
| 1529 | RtlRunOnceBeginInitialize |
| 1530 | RtlRunOnceComplete |
| 1531 | RtlRunOnceExecuteOnce |
| 1532 | RtlRunOnceInitialize |
| 1533 | RtlSecondsSince1970ToTime |
| 1534 | RtlSecondsSince1980ToTime |
| 1535 | RtlSeekMemoryStream |
| 1536 | RtlSelfRelativeToAbsoluteSD |
| 1537 | RtlSelfRelativeToAbsoluteSD2 |
| 1538 | RtlSendMsgToSm |
| 1539 | RtlSetAllBits |
| 1540 | F_X64(RtlSetAllBitsEx) |
| 1541 | RtlSetAttributesSecurityDescriptor |
| 1542 | RtlSetBit |
| 1543 | F_X64(RtlSetBitEx) |
| 1544 | RtlSetBits |
| 1545 | F_X64(RtlSetBitsEx) |
| 1546 | RtlSetControlSecurityDescriptor |
| 1547 | RtlSetCriticalSectionSpinCount |
| 1548 | RtlSetCurrentDirectory_U |
| 1549 | RtlSetCurrentEnvironment |
| 1550 | RtlSetCurrentTransaction |
| 1551 | RtlSetDaclSecurityDescriptor |
| 1552 | RtlSetDynamicTimeZoneInformation |
| 1553 | RtlSetEnvironmentStrings |
| 1554 | RtlSetEnvironmentVar |
| 1555 | RtlSetEnvironmentVariable |
| 1556 | RtlSetExtendedFeaturesMask |
| 1557 | RtlSetFeatureConfigurations |
| 1558 | RtlSetGroupSecurityDescriptor |
| 1559 | RtlSetHeapInformation |
| 1560 | RtlSetImageMitigationPolicy |
| 1561 | RtlSetInformationAcl |
| 1562 | RtlSetIoCompletionCallback |
| 1563 | RtlSetLastWin32Error |
| 1564 | RtlSetLastWin32ErrorAndNtStatusFromNtStatus |
| 1565 | RtlSetMemoryStreamSize |
| 1566 | RtlSetOwnerSecurityDescriptor |
| 1567 | RtlSetPortableOperatingSystem |
| 1568 | RtlSetProcessDebugInformation |
| 1569 | RtlSetProcessIsCritical |
| 1570 | RtlSetProcessPlaceholderCompatibilityMode |
| 1571 | RtlSetProcessPreferredUILanguages |
| 1572 | RtlSetProtectedPolicy |
| 1573 | RtlSetProxiedProcessId |
| 1574 | RtlSetSaclSecurityDescriptor |
| 1575 | RtlSetSearchPathMode |
| 1576 | RtlSetSecurityDescriptorRMControl |
| 1577 | RtlSetSecurityObject |
| 1578 | RtlSetSecurityObjectEx |
| 1579 | RtlSetSystemBootStatus |
| 1580 | RtlSetSystemBootStatusEx |
| 1581 | RtlSetThreadErrorMode |
| 1582 | RtlSetThreadIsCritical |
| 1583 | RtlSetThreadPlaceholderCompatibilityMode |
| 1584 | RtlSetThreadPoolStartFunc |
| 1585 | RtlSetThreadPreferredUILanguages |
| 1586 | F_X86_ANY(RtlSetThreadPreferredUILanguages2) |
| 1587 | RtlSetThreadSubProcessTag |
| 1588 | RtlSetThreadWorkOnBehalfTicket |
| 1589 | RtlSetTimeZoneInformation |
| 1590 | RtlSetTimer |
| 1591 | F_X64(RtlSetUmsThreadInformation) |
| 1592 | RtlSetUnhandledExceptionFilter |
| 1593 | F_X64(RtlSetUnicodeCallouts) |
| 1594 | F32(RtlSetUserCallbackExceptionFilter) |
| 1595 | RtlSetUserFlagsHeap |
| 1596 | RtlSetUserValueHeap |
| 1597 | RtlSidDominates |
| 1598 | RtlSidDominatesForTrust |
| 1599 | RtlSidEqualLevel |
| 1600 | RtlSidHashInitialize |
| 1601 | RtlSidHashLookup |
| 1602 | RtlSidIsHigherLevel |
| 1603 | RtlSizeHeap |
| 1604 | RtlSleepConditionVariableCS |
| 1605 | RtlSleepConditionVariableSRW |
| 1606 | RtlSplay |
| 1607 | RtlStartRXact |
| 1608 | RtlStatMemoryStream |
| 1609 | RtlStringFromGUID |
| 1610 | RtlStringFromGUIDEx |
| 1611 | RtlStronglyEnumerateEntryHashTable |
| 1612 | RtlSubAuthorityCountSid |
| 1613 | RtlSubAuthoritySid |
| 1614 | RtlSubscribeForFeatureUsageNotification |
| 1615 | RtlSubscribeWnfStateChangeNotification |
| 1616 | RtlSubtreePredecessor |
| 1617 | RtlSubtreeSuccessor |
| 1618 | RtlSwitchedVVI |
| 1619 | RtlSystemTimeToLocalTime |
| 1620 | RtlTestAndPublishWnfStateData |
| 1621 | RtlTestBit |
| 1622 | F64(RtlTestBitEx) |
| 1623 | RtlTestProtectedAccess |
| 1624 | RtlTimeFieldsToTime |
| 1625 | RtlTimeToElapsedTimeFields |
| 1626 | RtlTimeToSecondsSince1970 |
| 1627 | RtlTimeToSecondsSince1980 |
| 1628 | RtlTimeToTimeFields |
| 1629 | RtlTraceDatabaseAdd |
| 1630 | RtlTraceDatabaseCreate |
| 1631 | RtlTraceDatabaseDestroy |
| 1632 | RtlTraceDatabaseEnumerate |
| 1633 | RtlTraceDatabaseFind |
| 1634 | RtlTraceDatabaseLock |
| 1635 | RtlTraceDatabaseUnlock |
| 1636 | RtlTraceDatabaseValidate |
| 1637 | RtlTryAcquirePebLock |
| 1638 | RtlTryAcquireSRWLockExclusive |
| 1639 | RtlTryAcquireSRWLockShared |
| 1640 | RtlTryConvertSRWLockSharedToExclusiveOrRelease |
| 1641 | RtlTryEnterCriticalSection |
| 1642 | F_X86_ANY(RtlUTF8StringToUnicodeString) |
| 1643 | RtlUTF8ToUnicodeN |
| 1644 | RtlUdiv128 |
| 1645 | F_X64(RtlUmsThreadYield) |
| 1646 | F_ARM_NATIVE(RtlUlongByteSwap) |
| 1647 | F_ARM_NATIVE(RtlUlonglongByteSwap) |
| 1648 | RtlUnhandledExceptionFilter |
| 1649 | RtlUnhandledExceptionFilter2 |
| 1650 | RtlUnicodeStringToAnsiSize |
| 1651 | RtlUnicodeStringToAnsiString |
| 1652 | RtlUnicodeStringToCountedOemString |
| 1653 | RtlUnicodeStringToInteger |
| 1654 | RtlUnicodeStringToOemSize |
| 1655 | RtlUnicodeStringToOemString |
| 1656 | F_X86_ANY(RtlUnicodeStringToUTF8String) |
| 1657 | RtlUnicodeToCustomCPN |
| 1658 | RtlUnicodeToMultiByteN |
| 1659 | RtlUnicodeToMultiByteSize |
| 1660 | RtlUnicodeToOemN |
| 1661 | RtlUnicodeToUTF8N |
| 1662 | RtlUniform |
| 1663 | RtlUnlockBootStatusData |
| 1664 | RtlUnlockCurrentThread |
| 1665 | RtlUnlockHeap |
| 1666 | RtlUnlockMemoryBlockLookaside |
| 1667 | RtlUnlockMemoryStreamRegion |
| 1668 | RtlUnlockMemoryZone |
| 1669 | RtlUnlockModuleSection |
| 1670 | RtlUnregisterFeatureConfigurationChangeNotification |
| 1671 | RtlUnsubscribeFromFeatureUsageNotifications |
| 1672 | RtlUnsubscribeWnfNotificationWaitForCompletion |
| 1673 | RtlUnsubscribeWnfNotificationWithCompletionCallback |
| 1674 | RtlUnsubscribeWnfStateChangeNotification |
| 1675 | RtlUnwind |
| 1676 | RtlUnwindEx |
| 1677 | RtlUpcaseUnicodeChar |
| 1678 | RtlUpcaseUnicodeString |
| 1679 | RtlUpcaseUnicodeStringToAnsiString |
| 1680 | RtlUpcaseUnicodeStringToCountedOemString |
| 1681 | RtlUpcaseUnicodeStringToOemString |
| 1682 | RtlUpcaseUnicodeToCustomCPN |
| 1683 | RtlUpcaseUnicodeToMultiByteN |
| 1684 | RtlUpcaseUnicodeToOemN |
| 1685 | RtlUpdateClonedCriticalSection |
| 1686 | RtlUpdateClonedSRWLock |
| 1687 | RtlUpdateTimer |
| 1688 | RtlUpperChar |
| 1689 | RtlUpperString |
| 1690 | F_X86_ANY(RtlUsageHeap) |
| 1691 | RtlUserFiberStart |
| 1692 | RtlUserThreadStart |
| 1693 | F_ARM_NATIVE(RtlUshortByteSwap) |
| 1694 | RtlValidAcl |
| 1695 | RtlValidProcessProtection |
| 1696 | RtlValidRelativeSecurityDescriptor |
| 1697 | RtlValidSecurityDescriptor |
| 1698 | RtlValidSid |
| 1699 | RtlValidateCorrelationVector |
| 1700 | RtlValidateHeap |
| 1701 | RtlValidateProcessHeaps |
| 1702 | RtlValidateUnicodeString |
| 1703 | RtlVerifyVersionInfo |
| 1704 | RtlVirtualUnwind |
| 1705 | RtlVirtualUnwind2 |
| 1706 | RtlWaitForWnfMetaNotification |
| 1707 | RtlWaitOnAddress |
| 1708 | RtlWakeAddressAll |
| 1709 | RtlWakeAddressAllNoFence |
| 1710 | RtlWakeAddressSingle |
| 1711 | RtlWakeAddressSingleNoFence |
| 1712 | RtlWakeAllConditionVariable |
| 1713 | RtlWakeConditionVariable |
| 1714 | RtlWalkFrameChain |
| 1715 | RtlWalkHeap |
| 1716 | RtlWeaklyEnumerateEntryHashTable |
| 1717 | RtlWerpReportException |
| 1718 | RtlWnfCompareChangeStamp |
| 1719 | RtlWnfDllUnloadCallback |
| 1720 | RtlWow64CallFunction64 |
| 1721 | RtlWow64ChangeProcessState |
| 1722 | RtlWow64ChangeThreadState |
| 1723 | RtlWow64EnableFsRedirection |
| 1724 | RtlWow64EnableFsRedirectionEx |
| 1725 | F64(RtlWow64GetCpuAreaInfo) |
| 1726 | F64(RtlWow64GetCurrentCpuArea) |
| 1727 | RtlWow64GetCurrentMachine |
| 1728 | RtlWow64GetEquivalentMachineCHPE |
| 1729 | RtlWow64GetProcessMachines |
| 1730 | RtlWow64GetSharedInfoProcess |
| 1731 | F64(RtlWow64GetThreadContext) |
| 1732 | F64(RtlWow64GetThreadSelectorEntry) |
| 1733 | RtlWow64IsWowGuestMachineSupported |
| 1734 | RtlWow64LogMessageInEventLogger |
| 1735 | #if defined(__x86_64__) || defined(__aarch64__) |
| 1736 | RtlWow64PopAllCrossProcessWorkFromWorkList |
| 1737 | RtlWow64PopCrossProcessWorkFromFreeList |
| 1738 | RtlWow64PushCrossProcessWorkOntoFreeList |
| 1739 | RtlWow64PushCrossProcessWorkOntoWorkList |
| 1740 | RtlWow64RequestCrossProcessHeavyFlush |
| 1741 | RtlWow64SetThreadContext |
| 1742 | RtlWow64SuspendProcess |
| 1743 | RtlWow64SuspendThread |
| 1744 | #endif |
| 1745 | RtlWriteMemoryStream |
| 1746 | F64(RtlWriteNonVolatileMemory) |
| 1747 | RtlWriteRegistryValue |
| 1748 | RtlZeroHeap |
| 1749 | RtlZeroMemory |
| 1750 | RtlZombifyActivationContext |
| 1751 | RtlpApplyLengthFunction |
| 1752 | RtlpCheckDynamicTimeZoneInformation |
| 1753 | RtlpCleanupRegistryKeys |
| 1754 | RtlpConvertAbsoluteToRelativeSecurityAttribute |
| 1755 | RtlpConvertCultureNamesToLCIDs |
| 1756 | RtlpConvertLCIDsToCultureNames |
| 1757 | RtlpConvertRelativeToAbsoluteSecurityAttribute |
| 1758 | RtlpCreateProcessRegistryInfo |
| 1759 | RtlpEnsureBufferSize |
| 1760 | F_X64(RtlpExecuteUmsThread) |
| 1761 | RtlpFreezeTimeBias DATA |
| 1762 | RtlpGetDeviceFamilyInfoEnum |
| 1763 | RtlpGetLCIDFromLangInfoNode |
| 1764 | RtlpGetNameFromLangInfoNode |
| 1765 | RtlpGetSystemDefaultUILanguage |
| 1766 | RtlpGetUserOrMachineUILanguage4NLS |
| 1767 | RtlpInitializeLangRegistryInfo |
| 1768 | RtlpIsQualifiedLanguage |
| 1769 | RtlpLoadMachineUIByPolicy |
| 1770 | RtlpLoadUserUIByPolicy |
| 1771 | RtlpMergeSecurityAttributeInformation |
| 1772 | RtlpMuiFreeLangRegistryInfo |
| 1773 | RtlpMuiRegCreateRegistryInfo |
| 1774 | RtlpMuiRegFreeRegistryInfo |
| 1775 | RtlpMuiRegLoadRegistryInfo |
| 1776 | RtlpNotOwnerCriticalSection |
| 1777 | RtlpNtCreateKey |
| 1778 | RtlpNtEnumerateSubKey |
| 1779 | RtlpNtMakeTemporaryKey |
| 1780 | RtlpNtOpenKey |
| 1781 | RtlpNtQueryValueKey |
| 1782 | RtlpNtSetValueKey |
| 1783 | RtlpQueryDefaultUILanguage |
| 1784 | F64(RtlpQueryProcessDebugInformationFromWow64) |
| 1785 | RtlpQueryProcessDebugInformationRemote |
| 1786 | RtlpRefreshCachedUILanguage |
| 1787 | RtlpSetInstallLanguage |
| 1788 | RtlpSetPreferredUILanguages |
| 1789 | RtlpSetUserPreferredUILanguages |
| 1790 | RtlpTimeFieldsToTime |
| 1791 | RtlpTimeToTimeFields |
| 1792 | F_X64(RtlpUmsExecuteYieldThreadEnd) |
| 1793 | F_X64(RtlpUmsThreadYield) |
| 1794 | RtlpUnWaitCriticalSection |
| 1795 | RtlpVerifyAndCommitUILanguageSettings |
| 1796 | RtlpWaitForCriticalSection |
| 1797 | #ifdef __x86_64__ |
| 1798 | RtlpWow64CtxFromAmd64 |
| 1799 | RtlpWow64GetContextOnAmd64 |
| 1800 | RtlpWow64SetContextOnAmd64 |
| 1801 | #endif |
| 1802 | F_ARM64(RtlpWow64CtxFromArm64) |
| 1803 | RtlxAnsiStringToUnicodeSize |
| 1804 | RtlxOemStringToUnicodeSize |
| 1805 | RtlxUnicodeStringToAnsiSize |
| 1806 | RtlxUnicodeStringToOemSize |
| 1807 | SbExecuteProcedure |
| 1808 | SbSelectProcedure |
| 1809 | ShipAssert |
| 1810 | ShipAssertGetBufferInfo |
| 1811 | ShipAssertMsgA |
| 1812 | ShipAssertMsgW |
| 1813 | TpAllocAlpcCompletion |
| 1814 | TpAllocAlpcCompletionEx |
| 1815 | TpAllocCleanupGroup |
| 1816 | TpAllocIoCompletion |
| 1817 | TpAllocJobNotification |
| 1818 | TpAllocPool |
| 1819 | TpAllocTimer |
| 1820 | TpAllocWait |
| 1821 | TpAllocWork |
| 1822 | TpAlpcRegisterCompletionList |
| 1823 | TpAlpcUnregisterCompletionList |
| 1824 | TpCallbackDetectedUnrecoverableError |
| 1825 | TpCallbackIndependent |
| 1826 | TpCallbackLeaveCriticalSectionOnCompletion |
| 1827 | TpCallbackMayRunLong |
| 1828 | TpCallbackReleaseMutexOnCompletion |
| 1829 | TpCallbackReleaseSemaphoreOnCompletion |
| 1830 | TpCallbackSendAlpcMessageOnCompletion |
| 1831 | TpCallbackSendPendingAlpcMessage |
| 1832 | TpCallbackSetEventOnCompletion |
| 1833 | TpCallbackUnloadDllOnCompletion |
| 1834 | TpCancelAsyncIoOperation |
| 1835 | TpCaptureCaller |
| 1836 | TpCheckTerminateWorker |
| 1837 | TpDbgDumpHeapUsage |
| 1838 | F_X86_ANY(TpDbgGetFreeInfo) |
| 1839 | TpDbgSetLogRoutine |
| 1840 | TpDisablePoolCallbackChecks |
| 1841 | TpDisassociateCallback |
| 1842 | TpIsTimerSet |
| 1843 | F_X86_ANY(TpPoolFreeUnusedNodes) |
| 1844 | TpPostWork |
| 1845 | TpQueryPoolStackInformation |
| 1846 | TpReleaseAlpcCompletion |
| 1847 | TpReleaseCleanupGroup |
| 1848 | TpReleaseCleanupGroupMembers |
| 1849 | TpReleaseIoCompletion |
| 1850 | TpReleaseJobNotification |
| 1851 | TpReleasePool |
| 1852 | TpReleaseTimer |
| 1853 | TpReleaseWait |
| 1854 | TpReleaseWork |
| 1855 | TpSetDefaultPoolMaxThreads |
| 1856 | TpSetDefaultPoolStackInformation |
| 1857 | TpSetPoolMaxThreads |
| 1858 | TpSetPoolMaxThreadsSoftLimit |
| 1859 | TpSetPoolMinThreads |
| 1860 | TpSetPoolStackInformation |
| 1861 | TpSetPoolThreadBasePriority |
| 1862 | TpSetPoolThreadCpuSets |
| 1863 | TpSetPoolWorkerThreadIdleTimeout |
| 1864 | TpSetTimer |
| 1865 | TpSetTimerEx |
| 1866 | TpSetWait |
| 1867 | TpSetWaitEx |
| 1868 | TpSimpleTryPost |
| 1869 | TpStartAsyncIoOperation |
| 1870 | TpTimerOutstandingCallbackCount |
| 1871 | TpTrimPools |
| 1872 | TpWaitForAlpcCompletion |
| 1873 | TpWaitForIoCompletion |
| 1874 | TpWaitForJobNotification |
| 1875 | TpWaitForTimer |
| 1876 | TpWaitForWait |
| 1877 | TpWaitForWork |
| 1878 | VerSetConditionMask |
| 1879 | WerReportExceptionWorker |
| 1880 | WerReportSQMEvent |
| 1881 | WinSqmAddToAverageDWORD |
| 1882 | WinSqmAddToStream |
| 1883 | WinSqmAddToStreamEx |
| 1884 | WinSqmCheckEscalationAddToStreamEx |
| 1885 | WinSqmCheckEscalationSetDWORD |
| 1886 | WinSqmCheckEscalationSetDWORD64 |
| 1887 | WinSqmCheckEscalationSetString |
| 1888 | WinSqmCommonDatapointDelete |
| 1889 | WinSqmCommonDatapointSetDWORD |
| 1890 | WinSqmCommonDatapointSetDWORD64 |
| 1891 | WinSqmCommonDatapointSetStreamEx |
| 1892 | WinSqmCommonDatapointSetString |
| 1893 | WinSqmEndSession |
| 1894 | WinSqmEventEnabled |
| 1895 | WinSqmEventWrite |
| 1896 | WinSqmGetEscalationRuleStatus |
| 1897 | WinSqmGetInstrumentationProperty |
| 1898 | WinSqmIncrementDWORD |
| 1899 | WinSqmIsOptedIn |
| 1900 | WinSqmIsOptedInEx |
| 1901 | WinSqmIsSessionDisabled |
| 1902 | WinSqmSetDWORD |
| 1903 | WinSqmSetDWORD64 |
| 1904 | WinSqmSetEscalationInfo |
| 1905 | WinSqmSetIfMaxDWORD |
| 1906 | WinSqmSetIfMinDWORD |
| 1907 | WinSqmSetString |
| 1908 | WinSqmStartSession |
| 1909 | WinSqmStartSessionForPartner |
| 1910 | WinSqmStartSqmOptinListener |
| 1911 | ZwAcceptConnectPort |
| 1912 | ZwAccessCheck |
| 1913 | ZwAccessCheckAndAuditAlarm |
| 1914 | ZwAccessCheckByType |
| 1915 | ZwAccessCheckByTypeAndAuditAlarm |
| 1916 | ZwAccessCheckByTypeResultList |
| 1917 | ZwAccessCheckByTypeResultListAndAuditAlarm |
| 1918 | ZwAccessCheckByTypeResultListAndAuditAlarmByHandle |
| 1919 | ZwAcquireCrossVmMutant |
| 1920 | ZwAcquireProcessActivityReference |
| 1921 | ZwAddAtom |
| 1922 | ZwAddAtomEx |
| 1923 | ZwAddBootEntry |
| 1924 | ZwAddDriverEntry |
| 1925 | ZwAdjustGroupsToken |
| 1926 | ZwAdjustPrivilegesToken |
| 1927 | ZwAdjustTokenClaimsAndDeviceGroups |
| 1928 | ZwAlertResumeThread |
| 1929 | ZwAlertThread |
| 1930 | ZwAlertThreadByThreadId |
| 1931 | ZwAllocateLocallyUniqueId |
| 1932 | ZwAllocateReserveObject |
| 1933 | ZwAllocateUserPhysicalPages |
| 1934 | F_X86_ANY(ZwAllocateUserPhysicalPagesEx) |
| 1935 | ZwAllocateUuids |
| 1936 | ZwAllocateVirtualMemory |
| 1937 | ZwAllocateVirtualMemoryEx |
| 1938 | ZwAlpcAcceptConnectPort |
| 1939 | ZwAlpcCancelMessage |
| 1940 | ZwAlpcConnectPort |
| 1941 | ZwAlpcConnectPortEx |
| 1942 | ZwAlpcCreatePort |
| 1943 | ZwAlpcCreatePortSection |
| 1944 | ZwAlpcCreateResourceReserve |
| 1945 | ZwAlpcCreateSectionView |
| 1946 | ZwAlpcCreateSecurityContext |
| 1947 | ZwAlpcDeletePortSection |
| 1948 | ZwAlpcDeleteResourceReserve |
| 1949 | ZwAlpcDeleteSectionView |
| 1950 | ZwAlpcDeleteSecurityContext |
| 1951 | ZwAlpcDisconnectPort |
| 1952 | ZwAlpcImpersonateClientContainerOfPort |
| 1953 | ZwAlpcImpersonateClientOfPort |
| 1954 | ZwAlpcOpenSenderProcess |
| 1955 | ZwAlpcOpenSenderThread |
| 1956 | ZwAlpcQueryInformation |
| 1957 | ZwAlpcQueryInformationMessage |
| 1958 | ZwAlpcRevokeSecurityContext |
| 1959 | ZwAlpcSendWaitReceivePort |
| 1960 | ZwAlpcSetInformation |
| 1961 | ZwApphelpCacheControl |
| 1962 | ZwAreMappedFilesTheSame |
| 1963 | ZwAssignProcessToJobObject |
| 1964 | ZwAssociateWaitCompletionPacket |
| 1965 | ZwCallEnclave |
| 1966 | ZwCallbackReturn |
| 1967 | F_X86_ANY(ZwCancelDeviceWakeupRequest) |
| 1968 | ZwCancelIoFile |
| 1969 | ZwCancelIoFileEx |
| 1970 | ZwCancelSynchronousIoFile |
| 1971 | ZwCancelTimer |
| 1972 | ZwCancelTimer2 |
| 1973 | ZwCancelWaitCompletionPacket |
| 1974 | ZwChangeProcessState |
| 1975 | ZwChangeThreadState |
| 1976 | ZwClearEvent |
| 1977 | ZwClose |
| 1978 | ZwCloseObjectAuditAlarm |
| 1979 | ZwCommitComplete |
| 1980 | ZwCommitEnlistment |
| 1981 | ZwCommitRegistryTransaction |
| 1982 | ZwCommitTransaction |
| 1983 | ZwCompactKeys |
| 1984 | ZwCompareObjects |
| 1985 | ZwCompareSigningLevels |
| 1986 | ZwCompareTokens |
| 1987 | ZwCompleteConnectPort |
| 1988 | ZwCompressKey |
| 1989 | ZwConnectPort |
| 1990 | ZwContinue |
| 1991 | ZwContinueEx |
| 1992 | ZwConvertBetweenAuxiliaryCounterAndPerformanceCounter |
| 1993 | ZwCreateCrossVmEvent |
| 1994 | ZwCreateCrossVmMutant |
| 1995 | ZwCreateDebugObject |
| 1996 | ZwCreateDirectoryObject |
| 1997 | ZwCreateDirectoryObjectEx |
| 1998 | ZwCreateEnclave |
| 1999 | ZwCreateEnlistment |
| 2000 | ZwCreateEvent |
| 2001 | ZwCreateEventPair |
| 2002 | ZwCreateFile |
| 2003 | ZwCreateIRTimer |
| 2004 | ZwCreateIoCompletion |
| 2005 | ZwCreateIoRing |
| 2006 | ZwCreateJobObject |
| 2007 | ZwCreateJobSet |
| 2008 | ZwCreateKey |
| 2009 | ZwCreateKeyTransacted |
| 2010 | ZwCreateKeyedEvent |
| 2011 | ZwCreateLowBoxToken |
| 2012 | ZwCreateMailslotFile |
| 2013 | ZwCreateMutant |
| 2014 | ZwCreateNamedPipeFile |
| 2015 | ZwCreatePagingFile |
| 2016 | ZwCreatePartition |
| 2017 | ZwCreatePort |
| 2018 | ZwCreatePrivateNamespace |
| 2019 | ZwCreateProcess |
| 2020 | ZwCreateProcessEx |
| 2021 | ZwCreateProcessStateChange |
| 2022 | ZwCreateProfile |
| 2023 | ZwCreateProfileEx |
| 2024 | ZwCreateRegistryTransaction |
| 2025 | ZwCreateResourceManager |
| 2026 | ZwCreateSection |
| 2027 | ZwCreateSectionEx |
| 2028 | ZwCreateSemaphore |
| 2029 | ZwCreateSymbolicLinkObject |
| 2030 | ZwCreateThread |
| 2031 | ZwCreateThreadEx |
| 2032 | ZwCreateThreadStateChange |
| 2033 | ZwCreateTimer |
| 2034 | ZwCreateTimer2 |
| 2035 | ZwCreateToken |
| 2036 | ZwCreateTokenEx |
| 2037 | ZwCreateTransaction |
| 2038 | ZwCreateTransactionManager |
| 2039 | ZwCreateUserProcess |
| 2040 | ZwCreateWaitCompletionPacket |
| 2041 | ZwCreateWaitablePort |
| 2042 | ZwCreateWnfStateName |
| 2043 | ZwCreateWorkerFactory |
| 2044 | ZwDebugActiveProcess |
| 2045 | ZwDebugContinue |
| 2046 | ZwDelayExecution |
| 2047 | ZwDeleteAtom |
| 2048 | ZwDeleteBootEntry |
| 2049 | ZwDeleteDriverEntry |
| 2050 | ZwDeleteFile |
| 2051 | ZwDeleteKey |
| 2052 | ZwDeleteObjectAuditAlarm |
| 2053 | ZwDeletePrivateNamespace |
| 2054 | ZwDeleteValueKey |
| 2055 | ZwDeleteWnfStateData |
| 2056 | ZwDeleteWnfStateName |
| 2057 | ZwDeviceIoControlFile |
| 2058 | ZwDirectGraphicsCall |
| 2059 | ZwDisableLastKnownGood |
| 2060 | ZwDisplayString |
| 2061 | ZwDrawText |
| 2062 | ZwDuplicateObject |
| 2063 | ZwDuplicateToken |
| 2064 | ZwEnableLastKnownGood |
| 2065 | ZwEnumerateBootEntries |
| 2066 | ZwEnumerateDriverEntries |
| 2067 | ZwEnumerateKey |
| 2068 | ZwEnumerateSystemEnvironmentValuesEx |
| 2069 | ZwEnumerateTransactionObject |
| 2070 | ZwEnumerateValueKey |
| 2071 | ZwExtendSection |
| 2072 | ZwFilterBootOption |
| 2073 | ZwFilterToken |
| 2074 | ZwFilterTokenEx |
| 2075 | ZwFindAtom |
| 2076 | ZwFlushBuffersFile |
| 2077 | ZwFlushBuffersFileEx |
| 2078 | ZwFlushInstallUILanguage |
| 2079 | ZwFlushInstructionCache |
| 2080 | ZwFlushKey |
| 2081 | ZwFlushProcessWriteBuffers |
| 2082 | ZwFlushVirtualMemory |
| 2083 | ZwFlushWriteBuffer |
| 2084 | ZwFreeUserPhysicalPages |
| 2085 | ZwFreeVirtualMemory |
| 2086 | ZwFreezeRegistry |
| 2087 | ZwFreezeTransactions |
| 2088 | ZwFsControlFile |
| 2089 | ZwGetCachedSigningLevel |
| 2090 | ZwGetCompleteWnfStateSubscription |
| 2091 | ZwGetContextThread |
| 2092 | ZwGetCurrentProcessorNumber |
| 2093 | ZwGetCurrentProcessorNumberEx |
| 2094 | ZwGetDevicePowerState |
| 2095 | ZwGetMUIRegistryInfo |
| 2096 | ZwGetNextProcess |
| 2097 | ZwGetNextThread |
| 2098 | ZwGetNlsSectionPtr |
| 2099 | ZwGetNotificationResourceManager |
| 2100 | F_X86_ANY(ZwGetPlugPlayEvent) |
| 2101 | ZwGetWriteWatch |
| 2102 | ZwImpersonateAnonymousToken |
| 2103 | ZwImpersonateClientOfPort |
| 2104 | ZwImpersonateThread |
| 2105 | ZwInitializeEnclave |
| 2106 | ZwInitializeNlsFiles |
| 2107 | ZwInitializeRegistry |
| 2108 | ZwInitiatePowerAction |
| 2109 | ZwIsProcessInJob |
| 2110 | ZwIsSystemResumeAutomatic |
| 2111 | ZwIsUILanguageComitted |
| 2112 | ZwListenPort |
| 2113 | ZwLoadDriver |
| 2114 | ZwLoadEnclaveData |
| 2115 | ZwLoadKey |
| 2116 | ZwLoadKey2 |
| 2117 | ZwLoadKey3 |
| 2118 | ZwLoadKeyEx |
| 2119 | ZwLockFile |
| 2120 | ZwLockProductActivationKeys |
| 2121 | ZwLockRegistryKey |
| 2122 | ZwLockVirtualMemory |
| 2123 | ZwMakePermanentObject |
| 2124 | ZwMakeTemporaryObject |
| 2125 | ZwManageHotPatch |
| 2126 | ZwManagePartition |
| 2127 | ZwMapCMFModule |
| 2128 | ZwMapUserPhysicalPages |
| 2129 | ZwMapUserPhysicalPagesScatter |
| 2130 | ZwMapViewOfSection |
| 2131 | ZwMapViewOfSectionEx |
| 2132 | ZwModifyBootEntry |
| 2133 | ZwModifyDriverEntry |
| 2134 | ZwNotifyChangeDirectoryFile |
| 2135 | ZwNotifyChangeDirectoryFileEx |
| 2136 | ZwNotifyChangeKey |
| 2137 | ZwNotifyChangeMultipleKeys |
| 2138 | ZwNotifyChangeSession |
| 2139 | ZwOpenDirectoryObject |
| 2140 | ZwOpenEnlistment |
| 2141 | ZwOpenEvent |
| 2142 | ZwOpenEventPair |
| 2143 | ZwOpenFile |
| 2144 | ZwOpenIoCompletion |
| 2145 | ZwOpenJobObject |
| 2146 | ZwOpenKey |
| 2147 | ZwOpenKeyEx |
| 2148 | ZwOpenKeyTransacted |
| 2149 | ZwOpenKeyTransactedEx |
| 2150 | ZwOpenKeyedEvent |
| 2151 | ZwOpenMutant |
| 2152 | ZwOpenObjectAuditAlarm |
| 2153 | ZwOpenPartition |
| 2154 | ZwOpenPrivateNamespace |
| 2155 | ZwOpenProcess |
| 2156 | ZwOpenProcessToken |
| 2157 | ZwOpenProcessTokenEx |
| 2158 | ZwOpenRegistryTransaction |
| 2159 | ZwOpenResourceManager |
| 2160 | ZwOpenSection |
| 2161 | ZwOpenSemaphore |
| 2162 | ZwOpenSession |
| 2163 | ZwOpenSymbolicLinkObject |
| 2164 | ZwOpenThread |
| 2165 | ZwOpenThreadToken |
| 2166 | ZwOpenThreadTokenEx |
| 2167 | ZwOpenTimer |
| 2168 | ZwOpenTransaction |
| 2169 | ZwOpenTransactionManager |
| 2170 | ZwPlugPlayControl |
| 2171 | ZwPowerInformation |
| 2172 | ZwPrePrepareComplete |
| 2173 | ZwPrePrepareEnlistment |
| 2174 | ZwPrepareComplete |
| 2175 | ZwPrepareEnlistment |
| 2176 | ZwPrivilegeCheck |
| 2177 | ZwPrivilegeObjectAuditAlarm |
| 2178 | ZwPrivilegedServiceAuditAlarm |
| 2179 | ZwPropagationComplete |
| 2180 | ZwPropagationFailed |
| 2181 | ZwProtectVirtualMemory |
| 2182 | F_X86_ANY(ZwPssCaptureVaSpaceBulk) |
| 2183 | ZwPulseEvent |
| 2184 | ZwQueryAttributesFile |
| 2185 | ZwQueryAuxiliaryCounterFrequency |
| 2186 | ZwQueryBootEntryOrder |
| 2187 | ZwQueryBootOptions |
| 2188 | ZwQueryDebugFilterState |
| 2189 | ZwQueryDefaultLocale |
| 2190 | ZwQueryDefaultUILanguage |
| 2191 | ZwQueryDirectoryFile |
| 2192 | ZwQueryDirectoryFileEx |
| 2193 | ZwQueryDirectoryObject |
| 2194 | ZwQueryDriverEntryOrder |
| 2195 | ZwQueryEaFile |
| 2196 | ZwQueryEvent |
| 2197 | ZwQueryFullAttributesFile |
| 2198 | ZwQueryInformationAtom |
| 2199 | ZwQueryInformationByName |
| 2200 | ZwQueryInformationEnlistment |
| 2201 | ZwQueryInformationFile |
| 2202 | ZwQueryInformationJobObject |
| 2203 | ZwQueryInformationPort |
| 2204 | ZwQueryInformationProcess |
| 2205 | ZwQueryInformationResourceManager |
| 2206 | ZwQueryInformationThread |
| 2207 | ZwQueryInformationToken |
| 2208 | ZwQueryInformationTransaction |
| 2209 | ZwQueryInformationTransactionManager |
| 2210 | ZwQueryInformationWorkerFactory |
| 2211 | ZwQueryInstallUILanguage |
| 2212 | ZwQueryIntervalProfile |
| 2213 | ZwQueryIoCompletion |
| 2214 | ZwQueryIoRingCapabilities |
| 2215 | ZwQueryKey |
| 2216 | ZwQueryLicenseValue |
| 2217 | ZwQueryMultipleValueKey |
| 2218 | ZwQueryMutant |
| 2219 | ZwQueryObject |
| 2220 | ZwQueryOpenSubKeys |
| 2221 | ZwQueryOpenSubKeysEx |
| 2222 | ZwQueryPerformanceCounter |
| 2223 | ZwQueryPortInformationProcess |
| 2224 | ZwQueryQuotaInformationFile |
| 2225 | ZwQuerySection |
| 2226 | ZwQuerySecurityAttributesToken |
| 2227 | ZwQuerySecurityObject |
| 2228 | ZwQuerySecurityPolicy |
| 2229 | ZwQuerySemaphore |
| 2230 | ZwQuerySymbolicLinkObject |
| 2231 | ZwQuerySystemEnvironmentValue |
| 2232 | ZwQuerySystemEnvironmentValueEx |
| 2233 | ZwQuerySystemInformation |
| 2234 | ZwQuerySystemInformationEx |
| 2235 | ZwQuerySystemTime |
| 2236 | ZwQueryTimer |
| 2237 | ZwQueryTimerResolution |
| 2238 | ZwQueryValueKey |
| 2239 | ZwQueryVirtualMemory |
| 2240 | ZwQueryVolumeInformationFile |
| 2241 | ZwQueryWnfStateData |
| 2242 | ZwQueryWnfStateNameInformation |
| 2243 | ZwQueueApcThread |
| 2244 | ZwQueueApcThreadEx |
| 2245 | ZwQueueApcThreadEx2 |
| 2246 | ZwRaiseException |
| 2247 | ZwRaiseHardError |
| 2248 | ZwReadFile |
| 2249 | ZwReadFileScatter |
| 2250 | ZwReadOnlyEnlistment |
| 2251 | ZwReadRequestData |
| 2252 | ZwReadVirtualMemory |
| 2253 | ZwReadVirtualMemoryEx |
| 2254 | ZwRecoverEnlistment |
| 2255 | ZwRecoverResourceManager |
| 2256 | ZwRecoverTransactionManager |
| 2257 | ZwRegisterProtocolAddressInformation |
| 2258 | ZwRegisterThreadTerminatePort |
| 2259 | ZwReleaseKeyedEvent |
| 2260 | ZwReleaseMutant |
| 2261 | ZwReleaseSemaphore |
| 2262 | ZwReleaseWorkerFactoryWorker |
| 2263 | ZwRemoveIoCompletion |
| 2264 | ZwRemoveIoCompletionEx |
| 2265 | ZwRemoveProcessDebug |
| 2266 | ZwRenameKey |
| 2267 | ZwRenameTransactionManager |
| 2268 | ZwReplaceKey |
| 2269 | ZwReplacePartitionUnit |
| 2270 | ZwReplyPort |
| 2271 | ZwReplyWaitReceivePort |
| 2272 | ZwReplyWaitReceivePortEx |
| 2273 | ZwReplyWaitReplyPort |
| 2274 | F_X86_ANY(ZwRequestDeviceWakeup) |
| 2275 | ZwRequestPort |
| 2276 | ZwRequestWaitReplyPort |
| 2277 | F_X86_ANY(ZwRequestWakeupLatency) |
| 2278 | ZwResetEvent |
| 2279 | ZwResetWriteWatch |
| 2280 | ZwRestoreKey |
| 2281 | ZwResumeProcess |
| 2282 | ZwResumeThread |
| 2283 | ZwRevertContainerImpersonation |
| 2284 | ZwRollbackComplete |
| 2285 | ZwRollbackEnlistment |
| 2286 | ZwRollbackRegistryTransaction |
| 2287 | ZwRollbackTransaction |
| 2288 | ZwRollforwardTransactionManager |
| 2289 | ZwSaveKey |
| 2290 | ZwSaveKeyEx |
| 2291 | ZwSaveMergedKeys |
| 2292 | ZwSecureConnectPort |
| 2293 | ZwSerializeBoot |
| 2294 | ZwSetBootEntryOrder |
| 2295 | ZwSetBootOptions |
| 2296 | ZwSetCachedSigningLevel |
| 2297 | ZwSetCachedSigningLevel2 |
| 2298 | ZwSetContextThread |
| 2299 | ZwSetDebugFilterState |
| 2300 | ZwSetDefaultHardErrorPort |
| 2301 | ZwSetDefaultLocale |
| 2302 | ZwSetDefaultUILanguage |
| 2303 | ZwSetDriverEntryOrder |
| 2304 | ZwSetEaFile |
| 2305 | ZwSetEvent |
| 2306 | ZwSetEventBoostPriority |
| 2307 | ZwSetHighEventPair |
| 2308 | ZwSetHighWaitLowEventPair |
| 2309 | ZwSetIRTimer |
| 2310 | ZwSetInformationDebugObject |
| 2311 | ZwSetInformationEnlistment |
| 2312 | ZwSetInformationFile |
| 2313 | ZwSetInformationIoRing |
| 2314 | ZwSetInformationJobObject |
| 2315 | ZwSetInformationKey |
| 2316 | ZwSetInformationObject |
| 2317 | ZwSetInformationProcess |
| 2318 | ZwSetInformationResourceManager |
| 2319 | ZwSetInformationSymbolicLink |
| 2320 | ZwSetInformationThread |
| 2321 | ZwSetInformationToken |
| 2322 | ZwSetInformationTransaction |
| 2323 | ZwSetInformationTransactionManager |
| 2324 | ZwSetInformationVirtualMemory |
| 2325 | ZwSetInformationWorkerFactory |
| 2326 | ZwSetIntervalProfile |
| 2327 | ZwSetIoCompletion |
| 2328 | ZwSetIoCompletionEx |
| 2329 | ZwSetLdtEntries |
| 2330 | ZwSetLowEventPair |
| 2331 | ZwSetLowWaitHighEventPair |
| 2332 | ZwSetQuotaInformationFile |
| 2333 | ZwSetSecurityObject |
| 2334 | ZwSetSystemEnvironmentValue |
| 2335 | ZwSetSystemEnvironmentValueEx |
| 2336 | ZwSetSystemInformation |
| 2337 | ZwSetSystemPowerState |
| 2338 | ZwSetSystemTime |
| 2339 | ZwSetThreadExecutionState |
| 2340 | ZwSetTimer |
| 2341 | ZwSetTimer2 |
| 2342 | ZwSetTimerEx |
| 2343 | ZwSetTimerResolution |
| 2344 | ZwSetUuidSeed |
| 2345 | ZwSetValueKey |
| 2346 | ZwSetVolumeInformationFile |
| 2347 | ZwSetWnfProcessNotificationEvent |
| 2348 | ZwShutdownSystem |
| 2349 | ZwShutdownWorkerFactory |
| 2350 | ZwSignalAndWaitForSingleObject |
| 2351 | ZwSinglePhaseReject |
| 2352 | ZwStartProfile |
| 2353 | ZwStopProfile |
| 2354 | ZwSubmitIoRing |
| 2355 | ZwSubscribeWnfStateChange |
| 2356 | ZwSuspendProcess |
| 2357 | ZwSuspendThread |
| 2358 | ZwSystemDebugControl |
| 2359 | ZwTerminateEnclave |
| 2360 | ZwTerminateJobObject |
| 2361 | ZwTerminateProcess |
| 2362 | ZwTerminateThread |
| 2363 | ZwTestAlert |
| 2364 | ZwThawRegistry |
| 2365 | ZwThawTransactions |
| 2366 | ZwTraceControl |
| 2367 | ZwTraceEvent |
| 2368 | ZwTranslateFilePath |
| 2369 | ZwUmsThreadYield |
| 2370 | ZwUnloadDriver |
| 2371 | ZwUnloadKey |
| 2372 | ZwUnloadKey2 |
| 2373 | ZwUnloadKeyEx |
| 2374 | ZwUnlockFile |
| 2375 | ZwUnlockVirtualMemory |
| 2376 | ZwUnmapViewOfSection |
| 2377 | ZwUnmapViewOfSectionEx |
| 2378 | ZwUnsubscribeWnfStateChange |
| 2379 | ZwUpdateWnfStateData |
| 2380 | ZwVdmControl |
| 2381 | ZwWaitForAlertByThreadId |
| 2382 | ZwWaitForDebugEvent |
| 2383 | ZwWaitForKeyedEvent |
| 2384 | ZwWaitForMultipleObjects |
| 2385 | ZwWaitForMultipleObjects32 |
| 2386 | ZwWaitForSingleObject |
| 2387 | ZwWaitForWorkViaWorkerFactory |
| 2388 | ZwWaitHighEventPair |
| 2389 | ZwWaitLowEventPair |
| 2390 | ZwWorkerFactoryWorkerReady |
| 2391 | #ifdef __arm__ |
| 2392 | ZwWow64AllocateVirtualMemory64 |
| 2393 | ZwWow64CallFunction64 |
| 2394 | ZwWow64CsrAllocateCaptureBuffer |
| 2395 | ZwWow64CsrAllocateMessagePointer |
| 2396 | ZwWow64CsrCaptureMessageBuffer |
| 2397 | ZwWow64CsrCaptureMessageString |
| 2398 | ZwWow64CsrClientCallServer |
| 2399 | ZwWow64CsrClientConnectToServer |
| 2400 | ZwWow64CsrFreeCaptureBuffer |
| 2401 | ZwWow64CsrGetProcessId |
| 2402 | ZwWow64CsrIdentifyAlertableThread |
| 2403 | ZwWow64CsrVerifyRegion |
| 2404 | ZwWow64DebuggerCall |
| 2405 | ZwWow64GetCurrentProcessorNumberEx |
| 2406 | ZwWow64GetNativeSystemInformation |
| 2407 | ZwWow64IsProcessorFeaturePresent |
| 2408 | ZwWow64QueryInformationProcess64 |
| 2409 | ZwWow64ReadVirtualMemory64 |
| 2410 | ZwWow64WriteVirtualMemory64 |
| 2411 | #endif |
| 2412 | ZwWriteFile |
| 2413 | ZwWriteFileGather |
| 2414 | ZwWriteRequestData |
| 2415 | ZwWriteVirtualMemory |
| 2416 | ZwYieldExecution |
| 2417 | vDbgPrintEx |
| 2418 | vDbgPrintExWithPrefix |