Meg's Mirrors

zig

1	LIBRARY "NTDLL.dll"
2	EXPORTS
3
4	; This file is a comprehensive documentation for 32-bit x86 ntdll.dll symbols.
5	; It covers all 3 platforms Win32s, Win9x and WinNT and contains information
6	; from native ntdll.dll libraries on 32-bit Windows systems and also from
7	; 32-bit WoW64 ntdll.dll libraries on 64-bit Windows systems. Symbols in this
8	; file are ordered by increasing Windows version in which they were introduced.
9	; First are Win32s versions, then followed by Win9x versions and then WinNT
10	; because logically Win32s symbols are subset of Win9x symbols which is subset
11	; of WinNT symbols. Comments contains additional information with exceptions.
12
13	; This is list of symbols available in all Windows versions (Win32s since Win32s 1.1; Win9x since Windows 95; WinNT since Windows NT 3.1)
14	DbgBreakPoint@0
15	DbgPrint ; cdecl
16	DbgPrompt@12
17	NtCurrentTeb@0
18	NtQueryEaFile@36
19	NtQueryPerformanceCounter@8
20	NtSetEaFile@16
21	RtlCreateHeap@24
22	RtlEnlargedIntegerMultiply@8
23	RtlExtendedIntegerMultiply@12
24	RtlExtendedLargeIntegerDivide@16
25	RtlImageDirectoryEntryToData@16
26	RtlImageNtHeader@4
27	RtlLargeIntegerSubtract@16
28	RtlUnwind@16
29	RtlValidateHeap@12 ; Win32s, Win9x and Windows NT 3.1 has ABI "RtlValidateHeap@4", Windows NT 3.5 and new has ABI "RtlValidateHeap@12"
30
31	; This is list of symbols available only in Win32s (not available in Win9x and WinNT)
32	; RtlProcessHeap@0
33
34	; This is list of symbols available in Win32s and Win9x but not in WinNT
35	; RtlExFreeHeap@12
36	; RtlExReAllocateHeap@16
37	; RtlExSizeHeap@12
38
39	; This is list of symbols added in Win32s 1.15 and available in all Win9x and WinNT versions
40	; Note that Win32s 1.15 and all later versions merged advapi32.dll, gdi32.dll,
41	; kernel32.dll, ntdll.dll, user32.dll (and Win32s 1.25a and later also mpr.dll)
42	; libraries into one big w32scomb.dll library and made those libraries as alias
43	; to w32scomb.dll, which effectively means that every symbol from every library
44	; is available also from ntdll.dll (aliased to w32scomb.dll). Below are only
45	; those Win32s symbols which are available in some Win9x or WinNT version of
46	; ntdll.dll or logically belongs to ntdll.dll.
47	RtlAnsiStringToUnicodeString@12
48	RtlDestroyHeap@4
49
50	; This is list of symbols added in Win32s 1.15 and available only in Win32s (not available in Win9x and WinNT)
51	; _RtlCopyMemory@12
52	; _RtlMultiByteToUnicodeN@20 ; WinNT has this symbol without leading underline
53	; _RtlUnicodeToMultiByteN@20 ; WinNT has this symbol without leading underline
54
55	; This is list of symbols added in Win32s 1.15 and available in all Win9x version, but not in WinNT
56	; RtlExAllocateHeap@12
57
58	; This is list of symbols added in Win32s 1.15 and available in all WinNT version, but not in Win9x
59	NtCreateSection@28
60	NtMapViewOfSection@40
61	NtOpenDirectoryObject@12
62	NtUnmapViewOfSection@8
63	RtlInitAnsiString@8
64	RtlInitUnicodeString@8
65	RtlMoveMemory@12
66	RtlZeroMemory@8
67
68	; This is list of symbols added in Win32s 1.15a and available in all Win9x and WinNT versions
69	RtlUnicodeStringToAnsiString@12
70
71	; This is list of symbols added in Win32s 1.15a and available in all WinNT version, but not in Win9x
72	RtlAnsiStringToUnicodeSize@4
73	RtlInitString@8
74	RtlIntegerToUnicodeString@12
75	RtlUnicodeStringToAnsiSize@4
76	RtlUnicodeStringToInteger@12
77
78	; This is list of symbols added in Win32s 1.20 and available in all WinNT version, but not in Win9x
79	NtClose@4
80	NtCreateSemaphore@20 ; Win32s has ABI "NtCreateSemaphore@36", WinNT has ABI "NtCreateSemaphore@20"
81	NtReleaseSemaphore@12
82	NtWaitForSingleObject@12
83	RtlCreateSecurityDescriptor@8
84	RtlFillMemory@12
85	RtlSetDaclSecurityDescriptor@16
86
87	;; This is end of Win32s symbols ;;
88
89
90	; This is list of symbols available in all Win9x and WinNT versions, but not available in Win32s
91	RtlAllocateHeap@12 ; Win9x has ABI "RtlAllocateHeap@8", WinNT has ABI "RtlAllocateHeap@12"
92	RtlConvertLongToLargeInteger@4
93	RtlConvertUlongToLargeInteger@4
94	RtlEnlargedUnsignedDivide@16 ; removed in Windows 8
95	RtlEnlargedUnsignedMultiply@8
96	RtlExtendedMagicDivide@20
97	RtlFreeHeap@12 ; Win9x has ABI "RtlFreeHeap@8", WinNT has ABI "RtlFreeHeap@12"
98	RtlLargeIntegerAdd@16
99	RtlLargeIntegerArithmeticShift@12
100	RtlLargeIntegerDivide@20
101	RtlLargeIntegerNegate@8
102	RtlLargeIntegerShiftLeft@12
103	RtlLargeIntegerShiftRight@12
104	RtlMultiByteToUnicodeN@20 ; Win9x has ABI "RtlMultiByteToUnicodeN@16", WinNT has ABI "RtlMultiByteToUnicodeN@20"
105	RtlReAllocateHeap@16 ; Win9x has ABI "RtlReAllocateHeap@12", WinNT has ABI "RtlReAllocateHeap@16"
106	RtlSizeHeap@12 ; Win9x has ABI "RtlSizeHeap@8", WinNT has ABI "RtlSizeHeap@12"
107	RtlUnicodeToMultiByteN@20 ; Win9x has ABI "RtlUnicodeToMultiByteN@16", WinNT has ABI "RtlUnicodeToMultiByteN@20"
108
109	; This is list of symbols available in all Win9x versions, in Windows NT 3.1, but not available in Win32s, Windows NT 3.5 and new
110	; RtlGetHandleValueHeap@8 ; Win9x ABI
111	; RtlGetHandleValueHeap@12 ; Windows NT 3.1 ABI
112	; RtlSetHandleValueHeap@12 ; Win9x ABI
113	; RtlSetHandleValueHeap@16 ; Windows NT 3.1 ABI
114
115	; This is list of symbols available in all Win9x versions, but not available in Win32s and WinNT
116	; RtlGrowHeap@8
117
118	; This is list of symbols added in Windows 98, available also in all WinNT versions, but not available in Win32s
119	NtCreateFile@44
120	RtlNtStatusToDosError@4
121
122	; This is list of symbols added in Windows 98, but not available in Win32s and WinNT
123	; IoUnregisterDeviceInterface@4
124	; NtGetDevnodeFromFileHandle@8
125
126	; This is list of symbols added in Windows 98 and also since Windows NT 3.51, but not available in Win32s
127	NtSetSystemPowerState@12
128
129	; This is list of symbols added in Windows 98 and also since Windows 2000, but not available in Win32s
130	NtInitiatePowerAction@16
131	NtPowerInformation@20
132	NtRequestWakeupLatency@4 ; removed in Windows 7
133
134	;; This is end of Win9x symbols ;;
135
136
137	; This is list of symbols available since Windows NT 3.1
138	CsrAllocateCaptureBuffer@8 ; Windows NT 3.1-4.0 has ABI "CsrAllocateCaptureBuffer@12", Windows 2000 and new has ABI "CsrAllocateCaptureBuffer@8"
139	; CsrAllocateCapturePointer@12 ; removed in Windows 2000
140	CsrAllocateMessagePointer@12
141	CsrCaptureMessageBuffer@16
142	CsrCaptureMessageString@20
143	CsrCaptureTimeout@8
144	CsrClientCallServer@16
145	CsrClientConnectToServer@20 ; Windows NT 3.1-2000 has ABI "CsrClientConnectToServer@24", Windows XP and new has ABI "CsrClientConnectToServer@20"
146	; CsrClientMaxMessage@0 ; removed in Windows NT 4.0
147	; CsrClientSendMessage@0 ; removed in Windows NT 4.0
148	; CsrClientThreadConnect@0 ; removed in Windows NT 4.0
149	; CsrDumpProfile@0 ; removed in Windows NT 3.5
150	CsrFreeCaptureBuffer@4
151	CsrIdentifyAlertableThread@0
152	CsrNewThread@0 ; removed in Windows Vista SP1
153	CsrProbeForRead@12 ; removed in Windows Vista
154	CsrProbeForWrite@12 ; removed in Windows Vista
155	CsrSetPriorityClass@8
156	; CsrStartProfile@0 ; removed in Windows NT 3.5
157	; CsrStopDumpProfile@0 ; removed in Windows NT 3.5
158	; CsrStopProfile@0 ; removed in Windows NT 3.5
159	; CsrpProcessCallbackRequest@4 ; removed in Windows NT 4.0
160	DbgSsHandleKmApiMsg@8 ; removed in Windows XP
161	DbgSsInitialize@16 ; removed in Windows XP
162	DbgUiConnectToDbg@0
163	DbgUiContinue@8
164	DbgUiWaitStateChange@8
165	DbgUserBreakPoint@0
166	KiUserApcDispatcher@20 ; really stdcall @20, gendef detects it incorrectly
167	KiUserExceptionDispatcher@8
168	LdrAccessResource@16
169	LdrFindEntryForAddress@8
170	LdrFindResourceDirectory_U@16
171	LdrFindResource_U@16
172	LdrGetDllHandle@16
173	LdrGetProcedureAddress@16
174	LdrInitializeThunk@16 ; really stdcall @16, gendef detects it incorrectly
175	LdrLoadDll@16
176	LdrProcessRelocationBlock@16
177	LdrQueryImageFileExecutionOptions@24
178	LdrQueryProcessModuleInformation@12
179	LdrShutdownProcess@0
180	LdrShutdownThread@0
181	LdrUnloadDll@4
182	LdrVerifyImageMatchesChecksum@16 ; Windows NT 3.1-3.51 has ABI "LdrVerifyImageMatchesChecksum@4", Windows NT 4.0 and new has ABI "LdrVerifyImageMatchesChecksum@16"
183	NtAcceptConnectPort@24
184	NtAccessCheck@32
185	NtAccessCheckAndAuditAlarm@44
186	NtAdjustGroupsToken@24
187	NtAdjustPrivilegesToken@24
188	NtAlertResumeThread@8
189	NtAlertThread@4
190	NtAllocateLocallyUniqueId@4
191	NtAllocateVirtualMemory@24
192	NtCancelIoFile@8
193	NtCancelTimer@8
194	NtCloseObjectAuditAlarm@12
195	NtCompleteConnectPort@4
196	NtConnectPort@32
197	NtContinue@8
198	NtCreateDirectoryObject@12
199	NtCreateEvent@20
200	NtCreateEventPair@12
201	NtCreateKey@28
202	NtCreateMailslotFile@32
203	NtCreateMutant@16
204	NtCreateNamedPipeFile@56
205	NtCreatePagingFile@16
206	NtCreatePort@20
207	NtCreateProcess@32
208	NtCreateProfile@36 ; Windows NT 3.1-3.5 has ABI "NtCreateProfile@28", Windows NT 3.51 and new has ABI "NtCreateProfile@36"
209	NtCreateSymbolicLinkObject@16
210	NtCreateThread@32
211	NtCreateTimer@16 ; Windows NT 3.1-3.51 has ABI "NtCreateTimer@12", Windows NT 4.0 and new has ABI "NtCreateTimer@16"
212	NtCreateToken@52
213	NtDelayExecution@8
214	NtDeleteKey@4
215	NtDeleteValueKey@8
216	NtDeviceIoControlFile@40
217	NtDisplayString@4
218	NtDuplicateObject@28
219	NtDuplicateToken@24
220	NtEnumerateKey@24
221	NtEnumerateValueKey@24
222	NtExtendSection@8
223	NtFlushBuffersFile@8
224	NtFlushInstructionCache@12
225	NtFlushKey@4
226	NtFlushVirtualMemory@16
227	NtFlushWriteBuffer@0
228	NtFreeVirtualMemory@16
229	NtFsControlFile@40
230	NtGetContextThread@8
231	; NtGetTickCount@0 ; removed in Windows XP
232	NtImpersonateClientOfPort@8
233	NtImpersonateThread@12
234	NtInitializeRegistry@4
235	; NtInitializeVDM@0 ; removed in Windows NT 3.5
236	NtListenPort@8
237	NtLoadDriver@4
238	NtLoadKey@8
239	NtLockFile@40
240	NtLockVirtualMemory@16
241	NtMakeTemporaryObject@4
242	NtNotifyChangeDirectoryFile@36
243	NtNotifyChangeKey@40
244	NtOpenEvent@12
245	NtOpenEventPair@12
246	NtOpenFile@24
247	NtOpenKey@12
248	NtOpenMutant@12
249	NtOpenObjectAuditAlarm@48
250	NtOpenProcess@16
251	NtOpenProcessToken@12
252	NtOpenSection@12
253	NtOpenSemaphore@12
254	NtOpenSymbolicLinkObject@12
255	NtOpenThread@16
256	NtOpenThreadToken@16
257	NtOpenTimer@12
258	NtPrivilegeCheck@12
259	NtPrivilegeObjectAuditAlarm@24
260	NtPrivilegedServiceAuditAlarm@20
261	NtProtectVirtualMemory@20
262	NtPulseEvent@8
263	NtQueryDefaultLocale@8
264	NtQueryDirectoryFile@44
265	NtQueryDirectoryObject@28
266	NtQueryEvent@20
267	NtQueryInformationFile@20
268	NtQueryInformationPort@20
269	NtQueryInformationProcess@20
270	NtQueryInformationThread@20
271	NtQueryInformationToken@20
272	NtQueryIntervalProfile@8 ; Windows NT 3.1-3.5 has ABI "NtQueryIntervalProfile@4", Windows NT 3.51 and new has ABI "NtQueryIntervalProfile@8"
273	NtQueryKey@20
274	NtQueryMutant@20
275	NtQueryObject@20
276	NtQuerySection@20
277	NtQuerySecurityObject@20
278	NtQuerySemaphore@20
279	NtQuerySymbolicLinkObject@12
280	NtQuerySystemEnvironmentValue@16
281	NtQuerySystemInformation@16
282	NtQuerySystemTime@4
283	NtQueryTimer@20
284	NtQueryValueKey@24
285	NtQueryVirtualMemory@24
286	NtQueryVolumeInformationFile@20
287	NtRaiseException@12
288	NtRaiseHardError@24
289	NtReadFile@36
290	NtReadRequestData@24
291	NtReadVirtualMemory@20
292	NtRegisterThreadTerminatePort@4
293	NtReleaseMutant@8
294	; NtReleaseProcessMutant@0 ; removed in Windows NT 4.0
295	; NtRenameValueKey@16 ; removed in Windows NT 3.5
296	NtReplaceKey@12
297	NtReplyPort@8
298	NtReplyWaitReceivePort@16
299	NtReplyWaitReplyPort@8
300	NtRequestPort@8
301	NtRequestWaitReplyPort@12
302	NtResetEvent@8
303	NtRestoreKey@12
304	NtResumeThread@8
305	NtSaveKey@8
306	NtSetContextThread@8
307	NtSetDefaultHardErrorPort@4
308	NtSetDefaultLocale@8
309	NtSetEvent@8
310	NtSetHighEventPair@4
311	NtSetHighWaitLowEventPair@4
312	; NtSetHighWaitLowThread@0 ; removed in Windows 2000
313	NtSetInformationFile@20
314	NtSetInformationKey@16
315	NtSetInformationProcess@16
316	NtSetInformationThread@16
317	NtSetInformationToken@16
318	NtSetIntervalProfile@8 ; Windows NT 3.1-3.5 has ABI "NtSetIntervalProfile@4", Windows NT 3.51 and new has ABI "NtSetIntervalProfile@8"
319	NtSetLdtEntries@24
320	NtSetLowEventPair@4
321	NtSetLowWaitHighEventPair@4
322	; NtSetLowWaitHighThread@0 ; removed in Windows 2000
323	NtSetSecurityObject@12
324	NtSetSystemEnvironmentValue@8
325	NtSetSystemTime@8
326	NtSetTimer@28 ; Windows NT 3.1-3.5 has ABI "NtSetTimer@20", Windows NT 3.51 has ABI "NtSetTimer@24", Windows NT 4.0 and new has ABI NtSetTimer@28
327	NtSetValueKey@24
328	NtSetVolumeInformationFile@20
329	NtShutdownSystem@4
330	NtStartProfile@4
331	NtStopProfile@4
332	NtSuspendThread@8
333	NtSystemDebugControl@24
334	NtTerminateProcess@8
335	NtTerminateThread@8
336	NtTestAlert@0
337	NtUnloadDriver@4
338	NtUnloadKey@4
339	NtUnlockFile@20
340	NtUnlockVirtualMemory@16
341	NtVdmControl@8 ; Windows NT 3.1 has ABI "NtVdmControl@16", Windows NT 3.5 and new has ABI "NtVdmControl@8"
342	; NtVdmStartExecution@0 ; removed in Windows NT 3.5
343	NtWaitForMultipleObjects@20
344	; NtWaitForProcessMutant@0 ; removed in Windows NT 4.0
345	NtWaitHighEventPair@4
346	NtWaitLowEventPair@4
347	NtWriteFile@36
348	NtWriteRequestData@24
349	NtWriteVirtualMemory@20
350	PfxFindPrefix@8
351	PfxInitialize@4
352	PfxInsertPrefix@12
353	PfxRemovePrefix@8
354	RtlAbortRXact@4
355	RtlAbsoluteToSelfRelativeSD@12
356	RtlAcquirePebLock@0
357	RtlAcquireResourceExclusive@8
358	RtlAcquireResourceShared@8
359	RtlAddAccessAllowedAce@16
360	RtlAddAccessDeniedAce@16
361	RtlAddAce@20
362	RtlAddActionToRXact@24
363	RtlAddAttributeActionToRXact@32
364	RtlAddAuditAccessAce@24
365	RtlAdjustPrivilege@16
366	RtlAllocateAndInitializeSid@44
367	; RtlAnalyzeProfile@0 ; removed in Windows NT 3.5
368	RtlAnsiCharToUnicodeChar@4
369	RtlAppendAsciizToString@8
370	RtlAppendStringToString@8
371	RtlAppendUnicodeStringToString@8
372	RtlAppendUnicodeToString@8
373	RtlApplyRXact@4
374	RtlApplyRXactNoFlush@4
375	RtlAreAllAccessesGranted@8
376	RtlAreAnyAccessesGranted@8
377	RtlAreBitsClear@12
378	RtlAreBitsSet@12
379	RtlAssert@16
380	RtlCaptureStackBackTrace@16
381	RtlCharToInteger@12
382	RtlCheckRegistryKey@8
383	RtlClearAllBits@4
384	RtlClearBits@12
385	RtlCompactHeap@8
386	RtlCompareMemory@12
387	RtlCompareMemoryUlong@12
388	RtlCompareString@12
389	RtlCompareUnicodeString@12
390	RtlConsoleMultiByteToUnicodeN@24
391	RtlConvertExclusiveToShared@4
392	RtlConvertSharedToExclusive@4
393	RtlConvertSidToUnicodeString@12
394	RtlConvertUiListToApiList@12 ; removed in Windows 8.1
395	RtlCopyLuid@8
396	RtlCopyLuidAndAttributesArray@12
397	RtlCopySecurityDescriptor@8
398	RtlCopySid@12
399	RtlCopySidAndAttributesArray@28
400	RtlCopyString@8
401	RtlCopyUnicodeString@8
402	RtlCreateAcl@12
403	RtlCreateAndSetSD@20
404	RtlCreateEnvironment@8
405	RtlCreateProcessParameters@40
406	RtlCreateRegistryKey@8
407	RtlCreateUnicodeString@8
408	RtlCreateUnicodeStringFromAsciiz@8
409	RtlCreateUserProcess@40
410	RtlCreateUserSecurityObject@28
411	RtlCreateUserThread@40
412	RtlCustomCPToUnicodeN@24
413	RtlDeNormalizeProcessParams@4
414	RtlDelete@4
415	RtlDeleteAce@8
416	RtlDeleteCriticalSection@4
417	RtlDeleteElementGenericTable@8
418	RtlDeleteRegistryValue@12
419	RtlDeleteResource@4
420	RtlDeleteSecurityObject@4
421	RtlDestroyEnvironment@4
422	RtlDestroyProcessParameters@4
423	RtlDetermineDosPathNameType_U@4
424	RtlDoesFileExists_U@4
425	RtlDosPathNameToNtPathName_U@16
426	RtlDosSearchPath_U@24
427	RtlDumpResource@4
428	RtlEnterCriticalSection@4
429	RtlEnumerateGenericTable@8
430	RtlEnumerateGenericTableWithoutSplaying@8
431	RtlEqualComputerName@8
432	RtlEqualDomainName@8
433	RtlEqualLuid@8
434	RtlEqualPrefixSid@8
435	RtlEqualSid@8
436	RtlEqualString@12
437	RtlEqualUnicodeString@12
438	RtlEraseUnicodeString@4
439	; RtlExpandEnvironmentStrings@16 ; removed in Windows NT 3.5
440	RtlExpandEnvironmentStrings_U@16
441	RtlFillMemoryUlong@12
442	RtlFindClearBits@12
443	RtlFindClearBitsAndSet@12
444	RtlFindLongestRunClear@8
445	RtlFindLongestRunSet@8 ; removed in Windows 2000
446	RtlFindMessage@20
447	RtlFindSetBits@12
448	RtlFindSetBitsAndClear@12
449	RtlFirstFreeAce@8
450	RtlFormatMessage@36
451	RtlFreeAnsiString@4
452	RtlFreeOemString@4
453	RtlFreeSid@4
454	RtlFreeUnicodeString@4
455	RtlGenerate8dot3Name@16 ; Windows NT 3.1 has ABI "RtlGenerate8dot3Name@12", Windows NT 3.5 and new has ABI "RtlGenerate8dot3Name@16"
456	RtlGetAce@12
457	RtlGetCallersAddress@8
458	RtlGetControlSecurityDescriptor@12
459	RtlGetCurrentDirectory_U@8
460	RtlGetDaclSecurityDescriptor@16
461	RtlGetElementGenericTable@8
462	RtlGetFullPathName_U@16
463	RtlGetGroupSecurityDescriptor@12
464	; RtlGetHeapUserValue@4 ; removed in Windows NT 3.5
465	RtlGetNtGlobalFlags@0
466	RtlGetNtProductType@4
467	RtlGetOwnerSecurityDescriptor@12
468	RtlGetSaclSecurityDescriptor@16
469	RtlIdentifierAuthoritySid@4
470	RtlImpersonateSelf@4
471	RtlInitCodePageTable@8
472	RtlInitNlsTables@16
473	RtlInitializeBitMap@12
474	RtlInitializeContext@20
475	RtlInitializeCriticalSection@4
476	RtlInitializeGenericTable@20
477	; RtlInitializeProfile@4 ; removed in Windows NT 3.5
478	RtlInitializeRXact@12
479	RtlInitializeResource@4
480	RtlInitializeSid@12
481	; RtlInitializeStackTraceDataBase@12 ; removed in Windows NT 3.51, added back in Windows XP SP2 and removed again in Windows Server 2003
482	RtlInsertElementGenericTable@16
483	RtlIntegerToChar@16
484	RtlIsDosDeviceName_U@4
485	RtlIsGenericTableEmpty@4
486	RtlLargeIntegerToChar@16
487	RtlLeaveCriticalSection@4
488	RtlLengthRequiredSid@4
489	RtlLengthSecurityDescriptor@4
490	RtlLengthSid@4
491	RtlLocalTimeToSystemTime@8
492	RtlLockHeap@4
493	; RtlLogStackBackTrace@0 ; removed in Windows NT 3.51
494	RtlLookupElementGenericTable@8
495	; RtlLookupSymbolByAddress@24 ; removed in Windows NT 3.51
496	; RtlLookupSymbolByName@16 ; removed in Windows NT 3.51
497	RtlMakeSelfRelativeSD@12
498	RtlMapGenericMask@8
499	RtlMultiByteToUnicodeSize@12
500	RtlNewInstanceSecurityObject@40
501	RtlNewSecurityGrantedAccess@24
502	RtlNewSecurityObject@24
503	RtlNormalizeProcessParams@4
504	RtlNumberGenericTableElements@4
505	RtlNumberOfClearBits@4
506	RtlNumberOfSetBits@4
507	RtlOemStringToUnicodeSize@4
508	RtlOemStringToUnicodeString@12
509	RtlOemToUnicodeN@20
510	RtlOpenCurrentUser@8
511	RtlPcToFileHeader@8
512	RtlPrefixString@12
513	RtlPrefixUnicodeString@12
514	; RtlQueryEnvironmentVariable@0 ; removed in Windows NT 3.5
515	RtlQueryEnvironmentVariable_U@12
516	RtlQueryInformationAcl@16
517	; RtlQueryModuleInformation@24 ; removed in Windows NT 3.51
518	RtlQueryProcessBackTraceInformation@4 ; Windows NT 3.1-3.5 has ABI "RtlQueryProcessBackTraceInformation@12", Windows NT 3.51 and new has ABI "RtlQueryProcessBackTraceInformation@4"
519	RtlQueryProcessHeapInformation@4 ; Windows NT 3.1-3.5 has ABI "RtlQueryProcessHeapInformation@12", Windows NT 3.51 and new has ABI "RtlQueryProcessHeapInformation@4"
520	RtlQueryProcessLockInformation@4 ; Windows NT 3.1-3.5 has ABI "RtlQueryProcessLockInformation@12", Windows NT 3.51 and new has ABI "RtlQueryProcessLockInformation@4"
521	RtlQueryRegistryValues@20
522	RtlQuerySecurityObject@20
523	RtlQueryTimeZoneInformation@4
524	RtlRaiseException@4
525	RtlRaiseStatus@4
526	RtlRandom@4
527	RtlRealPredecessor@4
528	RtlRealSuccessor@4
529	RtlReleasePebLock@0
530	RtlReleaseResource@4
531	RtlRemoteCall@28
532	RtlResetRtlTranslations@4
533	RtlRunDecodeUnicodeString@8
534	RtlRunEncodeUnicodeString@8
535	RtlSecondsSince1970ToTime@8
536	RtlSecondsSince1980ToTime@8
537	RtlSelfRelativeToAbsoluteSD@44
538	RtlSetAllBits@4
539	RtlSetBits@12
540	RtlSetCurrentDirectory_U@4
541	RtlSetCurrentEnvironment@8
542	RtlSetEnvironmentVariable@12
543	RtlSetGroupSecurityDescriptor@12
544	; RtlSetHeapUserValue@8 ; removed in Windows NT 3.5
545	RtlSetInformationAcl@16
546	RtlSetOwnerSecurityDescriptor@12
547	RtlSetSaclSecurityDescriptor@16
548	RtlSetSecurityObject@20
549	RtlSetTimeZoneInformation@4
550	; RtlSnapShotHeap@16 ; removed in Windows NT 3.51
551	RtlSplay@4
552	; RtlStartProfile@0 ; removed in Windows NT 3.5
553	RtlStartRXact@4
554	; RtlStopProfile@0 ; removed in Windows NT 3.5
555	RtlSubAuthorityCountSid@4
556	RtlSubAuthoritySid@8
557	RtlSubtreePredecessor@4
558	RtlSubtreeSuccessor@4
559	RtlSystemTimeToLocalTime@8
560	RtlTimeFieldsToTime@8
561	RtlTimeToElapsedTimeFields@8
562	RtlTimeToSecondsSince1970@8
563	RtlTimeToSecondsSince1980@8
564	RtlTimeToTimeFields@8
565	RtlUnicodeStringToCountedOemString@12
566	RtlUnicodeStringToOemSize@4
567	RtlUnicodeStringToOemString@12
568	RtlUnicodeToCustomCPN@24
569	RtlUnicodeToMultiByteSize@12
570	RtlUnicodeToOemN@20
571	RtlUniform@4
572	RtlUnlockHeap@4
573	RtlUpcaseUnicodeChar@4
574	RtlUpcaseUnicodeString@12
575	RtlUpcaseUnicodeStringToAnsiString@12
576	RtlUpcaseUnicodeStringToCountedOemString@12
577	RtlUpcaseUnicodeStringToOemString@12
578	RtlUpcaseUnicodeToCustomCPN@24
579	RtlUpcaseUnicodeToMultiByteN@20
580	RtlUpcaseUnicodeToOemN@20
581	RtlUpperChar@4
582	RtlUpperString@8
583	RtlValidAcl@4
584	RtlValidSecurityDescriptor@4
585	RtlValidSid@4
586	RtlWriteRegistryValue@24
587	; RtlpInitializeRtl@12 ; removed in Windows NT 4.0
588	RtlpNtCreateKey@24
589	RtlpNtEnumerateSubKey@16
590	RtlpNtMakeTemporaryKey@4
591	RtlpNtOpenKey@16
592	RtlpNtQueryValueKey@20
593	RtlpNtSetValueKey@16
594	RtlpUnWaitCriticalSection@4
595	RtlpWaitForCriticalSection@4
596	ZwAcceptConnectPort@24
597	ZwAccessCheck@32
598	ZwAccessCheckAndAuditAlarm@44
599	ZwAdjustGroupsToken@24
600	ZwAdjustPrivilegesToken@24
601	ZwAlertResumeThread@8
602	ZwAlertThread@4
603	ZwAllocateLocallyUniqueId@4
604	ZwAllocateVirtualMemory@24
605	ZwCancelIoFile@8
606	ZwCancelTimer@8
607	ZwClose@4
608	ZwCloseObjectAuditAlarm@12
609	ZwCompleteConnectPort@4
610	ZwConnectPort@32
611	ZwContinue@8
612	ZwCreateDirectoryObject@12
613	ZwCreateEvent@20
614	ZwCreateEventPair@12
615	ZwCreateFile@44
616	ZwCreateKey@28
617	ZwCreateMailslotFile@32
618	ZwCreateMutant@16
619	ZwCreateNamedPipeFile@56
620	ZwCreatePagingFile@16
621	ZwCreatePort@20
622	ZwCreateProcess@32
623	ZwCreateProfile@36 ; Windows NT 3.1-3.5 has ABI "ZwCreateProfile@28", Windows NT 3.51 and new has ABI "ZwCreateProfile@36"
624	ZwCreateSection@28
625	ZwCreateSemaphore@20
626	ZwCreateSymbolicLinkObject@16
627	ZwCreateThread@32
628	ZwCreateTimer@16 ; Windows NT 3.1-3.51 has ABI "ZwCreateTimer@12", Windows NT 4.0 and new has ABI "ZwCreateTimer@16"
629	ZwCreateToken@52
630	ZwDelayExecution@8
631	ZwDeleteKey@4
632	ZwDeleteValueKey@8
633	ZwDeviceIoControlFile@40
634	ZwDisplayString@4
635	ZwDuplicateObject@28
636	ZwDuplicateToken@24
637	ZwEnumerateKey@24
638	ZwEnumerateValueKey@24
639	ZwExtendSection@8
640	ZwFlushBuffersFile@8
641	ZwFlushInstructionCache@12
642	ZwFlushKey@4
643	ZwFlushVirtualMemory@16
644	ZwFlushWriteBuffer@0
645	ZwFreeVirtualMemory@16
646	ZwFsControlFile@40
647	ZwGetContextThread@8
648	ZwGetTickCount@0 ; removed in Windows XP
649	ZwImpersonateClientOfPort@8
650	ZwImpersonateThread@12
651	ZwInitializeRegistry@4
652	; ZwInitializeVDM@0 ; removed in Windows NT 3.5
653	ZwListenPort@8
654	ZwLoadDriver@4
655	ZwLoadKey@8
656	ZwLockFile@40
657	ZwLockVirtualMemory@16
658	ZwMakeTemporaryObject@4
659	ZwMapViewOfSection@40
660	ZwNotifyChangeDirectoryFile@36
661	ZwNotifyChangeKey@40
662	ZwOpenDirectoryObject@12
663	ZwOpenEvent@12
664	ZwOpenEventPair@12
665	ZwOpenFile@24
666	ZwOpenKey@12
667	ZwOpenMutant@12
668	ZwOpenObjectAuditAlarm@48
669	ZwOpenProcess@16
670	ZwOpenProcessToken@12
671	ZwOpenSection@12
672	ZwOpenSemaphore@12
673	ZwOpenSymbolicLinkObject@12
674	ZwOpenThread@16
675	ZwOpenThreadToken@16
676	ZwOpenTimer@12
677	ZwPrivilegeCheck@12
678	ZwPrivilegeObjectAuditAlarm@24
679	ZwPrivilegedServiceAuditAlarm@20
680	ZwProtectVirtualMemory@20
681	ZwPulseEvent@8
682	ZwQueryDefaultLocale@8
683	ZwQueryDirectoryFile@44
684	ZwQueryDirectoryObject@28
685	ZwQueryEaFile@36
686	ZwQueryEvent@20
687	ZwQueryInformationFile@20
688	ZwQueryInformationPort@20
689	ZwQueryInformationProcess@20
690	ZwQueryInformationThread@20
691	ZwQueryInformationToken@20
692	ZwQueryIntervalProfile@8 ; Windows NT 3.1-3.51 has ABI "ZwQueryIntervalProfile@4", Windows NT 4.0 and new has ABI "ZwQueryIntervalProfile@8"
693	ZwQueryKey@20
694	ZwQueryMutant@20
695	ZwQueryObject@20
696	ZwQueryPerformanceCounter@8
697	ZwQuerySection@20
698	ZwQuerySecurityObject@20
699	ZwQuerySemaphore@20
700	ZwQuerySymbolicLinkObject@12
701	ZwQuerySystemEnvironmentValue@16
702	ZwQuerySystemInformation@16
703	ZwQuerySystemTime@4
704	ZwQueryTimer@20
705	ZwQueryValueKey@24
706	ZwQueryVirtualMemory@24
707	ZwQueryVolumeInformationFile@20
708	ZwRaiseException@12
709	ZwRaiseHardError@24
710	ZwReadFile@36
711	ZwReadRequestData@24
712	ZwReadVirtualMemory@20
713	ZwRegisterThreadTerminatePort@4
714	ZwReleaseMutant@8
715	; ZwReleaseProcessMutant@0 ; removed in Windows NT 4.0
716	ZwReleaseSemaphore@12
717	; ZwRenameValueKey@16 ; removed in Windows NT 3.5
718	ZwReplaceKey@12
719	ZwReplyPort@8
720	ZwReplyWaitReceivePort@16
721	ZwReplyWaitReplyPort@8
722	ZwRequestPort@8
723	ZwRequestWaitReplyPort@12
724	ZwResetEvent@8
725	ZwRestoreKey@12
726	ZwResumeThread@8
727	ZwSaveKey@8
728	ZwSetContextThread@8
729	ZwSetDefaultHardErrorPort@4
730	ZwSetDefaultLocale@8
731	ZwSetEaFile@16
732	ZwSetEvent@8
733	ZwSetHighEventPair@4
734	ZwSetHighWaitLowEventPair@4
735	; ZwSetHighWaitLowThread@0 ; removed in Windows 2000
736	ZwSetInformationFile@20
737	ZwSetInformationKey@16
738	ZwSetInformationProcess@16
739	ZwSetInformationThread@16
740	ZwSetInformationToken@16
741	ZwSetIntervalProfile@8 ; Windows NT 3.1-3.5 has ABI "ZwSetIntervalProfile@4", Windows NT 3.51 and new has ABI "ZwSetIntervalProfile@8"
742	ZwSetLdtEntries@24
743	ZwSetLowEventPair@4
744	ZwSetLowWaitHighEventPair@4
745	; ZwSetLowWaitHighThread@0 ; removed in Windows 2000
746	ZwSetSecurityObject@12
747	ZwSetSystemEnvironmentValue@8
748	ZwSetSystemTime@8
749	ZwSetTimer@28 ; Windows NT 3.1-3.5 has ABI "ZwSetTimer@20", Windows NT 3.51 has ABI "ZwSetTimer@24", Windows NT 4.0 and new has ABI "ZwSetTimer@28"
750	ZwSetValueKey@24
751	ZwSetVolumeInformationFile@20
752	ZwShutdownSystem@4
753	ZwStartProfile@4
754	ZwStopProfile@4
755	ZwSuspendThread@8
756	ZwSystemDebugControl@24
757	ZwTerminateProcess@8
758	ZwTerminateThread@8
759	ZwTestAlert@0
760	ZwUnloadDriver@4
761	ZwUnloadKey@4
762	ZwUnlockFile@20
763	ZwUnlockVirtualMemory@16
764	ZwUnmapViewOfSection@8
765	ZwVdmControl@8 ; Windows NT 3.1 has ABI "ZwVdmControl@16", Windows NT 3.5 and new has ABI "ZwVdmControl@8"
766	; ZwVdmStartExecution@0 ; removed in Windows NT 3.5
767	ZwWaitForMultipleObjects@20
768	; ZwWaitForProcessMutant@0 ; removed in Windows NT 4.0
769	ZwWaitForSingleObject@12
770	ZwWaitHighEventPair@4
771	ZwWaitLowEventPair@4
772	ZwWriteFile@36
773	ZwWriteRequestData@24
774	ZwWriteVirtualMemory@20
775	; xRtlDosPathNameToNtPathName@16 ; removed in Windows NT 3.5
776
777	; This is list of non-stdcall FPU emulator symbols, available since Windows NT 3.1 and removed in Windows XP SP2 and Windows Server 2003 SP1
778	; NPXEMULATORTABLE DATA ; removed in Windows XP
779	; RestoreEm87Context
780	; SaveEm87Context
781	; __eCommonExceptions
782	; __eEmulatorInit
783	; __eF2XM1
784	; __eFABS
785	; __eFADD32
786	; __eFADD64
787	; __eFADDPreg
788	; __eFADDreg
789	; __eFADDtop
790	; __eFCHS
791	; __eFCOM32
792	; __eFCOM64
793	; __eFCOM
794	; __eFCOMP32
795	; __eFCOMP64
796	; __eFCOMP
797	; __eFCOMPP
798	; __eFCOS
799	; __eFDECSTP
800	; __eFDIV32
801	; __eFDIV64
802	; __eFDIVPreg
803	; __eFDIVR32
804	; __eFDIVR64
805	; __eFDIVRPreg
806	; __eFDIVRreg
807	; __eFDIVRtop
808	; __eFDIVreg
809	; __eFDIVtop
810	; __eFFREE
811	; __eFIADD16
812	; __eFIADD32
813	; __eFICOM16
814	; __eFICOM32
815	; __eFICOMP16
816	; __eFICOMP32
817	; __eFIDIV16
818	; __eFIDIV32
819	; __eFIDIVR16
820	; __eFIDIVR32
821	; __eFILD16
822	; __eFILD32
823	; __eFILD64
824	; __eFIMUL16
825	; __eFIMUL32
826	; __eFINCSTP
827	; __eFINIT
828	; __eFIST16
829	; __eFIST32
830	; __eFISTP16
831	; __eFISTP32
832	; __eFISTP64
833	; __eFISUB16
834	; __eFISUB32
835	; __eFISUBR16
836	; __eFISUBR32
837	; __eFLD1
838	; __eFLD32
839	; __eFLD64
840	; __eFLD80
841	; __eFLDCW
842	; __eFLDENV
843	; __eFLDL2E
844	; __eFLDLN2
845	; __eFLDPI
846	; __eFLDZ
847	; __eFMUL32
848	; __eFMUL64
849	; __eFMULPreg
850	; __eFMULreg
851	; __eFMULtop
852	; __eFPATAN
853	; __eFPREM
854	; __eFPREM1
855	; __eFPTAN
856	; __eFRNDINT
857	; __eFRSTOR
858	; __eFSAVE
859	; __eFSCALE
860	; __eFSIN
861	; __eFSQRT
862	; __eFST32
863	; __eFST64
864	; __eFST
865	; __eFSTCW
866	; __eFSTENV
867	; __eFSTP32
868	; __eFSTP64
869	; __eFSTP80
870	; __eFSTP
871	; __eFSTSW
872	; __eFSUB32
873	; __eFSUB64
874	; __eFSUBPreg
875	; __eFSUBR32
876	; __eFSUBR64
877	; __eFSUBRPreg
878	; __eFSUBRreg
879	; __eFSUBRtop
880	; __eFSUBreg
881	; __eFSUBtop
882	; __eFTST
883	; __eFUCOM
884	; __eFUCOMP
885	; __eFUCOMPP
886	; __eFXAM
887	; __eFXCH
888	; __eFXTRACT
889	; __eFYL2X
890	; __eFYL2XP1
891	; __eGetStatusWord
892
893	; This is list of symbols added in Windows NT 3.5
894	LdrDisableThreadCalloutsForDll@4
895	NlsMbCodePageTag DATA
896	NlsMbOemCodePageTag DATA
897	NtClearEvent@4
898	NtCreateIoCompletion@16
899	NtDeleteFile@4
900	NtOpenIoCompletion@12
901	NtQueryAttributesFile@8
902	NtQueryIoCompletion@20
903	NtQueryTimerResolution@12
904	NtRemoveIoCompletion@20
905	NtSetInformationObject@16
906	NtSetSystemInformation@12
907	NtSetTimerResolution@12
908	RtlCompressBuffer@32
909	RtlCutoverTimeToSystemTime@16
910	RtlDecompressBuffer@24
911	RtlDecompressFragment@32
912	RtlFormatCurrentUserKeyPath@4
913	RtlGetCompressionWorkSpaceSize@12
914	RtlGetLongestNtPathLength@0
915	; RtlGetUserFlagsHeap@16 ; removed in Windows NT 3.51
916	; RtlGetUserValueHeap@16 ; removed in Windows NT 3.51
917	RtlIsTextUnicode@12
918	RtlSetUserFlagsHeap@20
919	RtlSetUserValueHeap@16
920	RtlWalkHeap@8
921	RtlZeroHeap@8
922	RtlxAnsiStringToUnicodeSize@4
923	RtlxOemStringToUnicodeSize@4
924	RtlxUnicodeStringToAnsiSize@4
925	RtlxUnicodeStringToOemSize@4
926	ZwClearEvent@4
927	ZwCreateIoCompletion@16
928	ZwDeleteFile@4
929	ZwOpenIoCompletion@12
930	ZwQueryAttributesFile@8
931	ZwQueryIoCompletion@20
932	ZwQueryTimerResolution@12
933	ZwRemoveIoCompletion@20
934	ZwSetInformationObject@16
935	ZwSetSystemInformation@12
936	ZwSetTimerResolution@12
937
938	; This is list of symbols added in Windows NT 3.51
939	KiUserCallbackDispatcher@12 ; really stdcall @12, gendef detects it incorrectly
940	LdrEnumResources@20
941	NtAllocateUuids@16 ; Windows NT 3.51-4.0 has ABI "NtAllocateUuids@12", Windows 2000 and new has ABI "NtAllocateUuids@16"
942	NtCallbackReturn@12
943	; NtEnumerateBus@8 ; removed in Windows NT 4.0
944	NtGetPlugPlayEvent@16 ; removed in Windows 8
945	NtPlugPlayControl@12 ; Windows NT 3.51-4.0 has ABI "NtPlugPlayControl@16", Windows 2000 and new has ABI "NtPlugPlayControl@12"
946	; NtRegisterNewDevice@8 ; removed in Windows NT 4.0
947	NtSetIoCompletion@20
948	; NtW32Call@20 ; removed in Windows NT 4.0 SP4
949	RtlCreateQueryDebugBuffer@8
950	RtlCreateTagHeap@16
951	RtlDestroyQueryDebugBuffer@4
952	RtlEnumProcessHeaps@8
953	RtlExtendHeap@16 ; removed in Windows Vista
954	RtlGetProcessHeaps@8
955	RtlGetUserInfoHeap@20
956	RtlIsNameLegalDOS8Dot3@12
957	RtlProtectHeap@8
958	RtlQueryProcessDebugInformation@12
959	RtlQueryTagHeap@20
960	RtlUsageHeap@12 ; removed in Windows Vista
961	RtlValidateProcessHeaps@0
962	ZwAllocateUuids@16 ; Windows NT 3.51-4.0 has ABI "ZwAllocateUuids@12", Windows 2000 and new has ABI "ZwAllocateUuids@16"
963	ZwCallbackReturn@12
964	; ZwEnumerateBus@8 ; remvoed in Windows NT 4.0
965	ZwGetPlugPlayEvent@16 ; removed in Windows 8
966	ZwPlugPlayControl@12 ; Windows NT 3.51-4.0 has ABI "ZwPlugPlayControl@16", Windows 2000 and new has ABI "ZwPlugPlayControl@12"
967	; ZwRegisterNewDevice@8 ; removed in Windows NT 4.0
968	ZwSetIoCompletion@20
969	ZwSetSystemPowerState@12
970	; ZwW32Call@20 ; removed in Windows NT 4.0 SP4
971
972	; This is list of symbols added in Windows NT 4.0
973	; public: virtual void *__thiscall CBufferAllocator::Allocate(unsigned long)
974	; ?Allocate@CBufferAllocator@@UAEPAXK@Z ; has WINAPI (@4) ; removed in Windows 2000
975	KiRaiseUserExceptionDispatcher@0
976	NlsAnsiCodePage DATA
977	NtAddAtom@12 ; Windows NT 4.0 has ABI "NtAddAtom@8", Windows 2000 and new has ABI "NtAddAtom@12"
978	; NtCreateChannel@8 ; removed in Windows XP
979	NtDeleteAtom@4
980	NtDeleteObjectAuditAlarm@12
981	NtFindAtom@12 ; Windows NT 4.0 has ABI "NtFindAtom@8", Windows 2000 and new has ABI "NtFindAtom@12"
982	; NtListenChannel@8 ; removed in Windows XP
983	NtLoadKey2@12
984	; NtOpenChannel@8 ; removed in Windows XP
985	NtQueryFullAttributesFile@8
986	NtQueryInformationAtom@20
987	NtQueryMultipleValueKey@24
988	; NtQueryOleDirectoryFile@44 ; removed in Windows 2000
989	NtQueueApcThread@20
990	; NtReplyWaitSendChannel@12 ; removed in Windows XP
991	; NtSendWaitReplyChannel@16 ; removed in Windows XP
992	; NtSetContextChannel@4 ; removed in Windows XP
993	NtSignalAndWaitForSingleObject@16
994	NtYieldExecution@0
995	; PropertyLengthAsVariant@16 ; removed in Windows Vista
996	RtlAddAtomToAtomTable@12
997	RtlAddCompoundAce@24
998	RtlAllocateHandle@8
999	; RtlClosePropertySet@4 ; removed in Windows 2000
1000	; RtlCompareVariants@12 ; removed in Windows 2000
1001	; RtlConvertPropertyToVariant@16 ; removed in Windows Vista
1002	; RtlConvertVariantToProperty@28 ; removed in Windows Vista
1003	RtlCreateAtomTable@8
1004	; RtlCreatePropertySet@36 ; removed in Windows 2000
1005	RtlDeleteAtomFromAtomTable@8
1006	RtlDeleteNoSplay@8
1007	RtlDestroyAtomTable@4
1008	RtlDestroyHandleTable@4
1009	RtlDowncaseUnicodeString@12
1010	RtlEmptyAtomTable@8
1011	; RtlEnumerateProperties@24 ; removed in Windows 2000
1012	; RtlFlushPropertySet@4 ; removed in Windows 2000
1013	RtlFreeHandle@8
1014	RtlFreeUserThreadStack@8 ; removed in Windows Vista
1015	; RtlGuidToPropertySetName@8 ; removed in Windows 2000
1016	RtlImageRvaToSection@12
1017	RtlImageRvaToVa@16
1018	RtlInitializeAtomPackage@4
1019	RtlInitializeHandleTable@12
1020	RtlIsValidHandle@8
1021	RtlIsValidIndexHandle@12
1022	RtlLookupAtomInAtomTable@12
1023	RtlPinAtomInAtomTable@8
1024	; RtlPropertySetNameToGuid@12 ; removed in Windows 2000
1025	RtlQueryAtomInAtomTable@24
1026	; RtlQueryProperties@28 ; removed in Windows 2000
1027	; RtlQueryPropertyNames@16 ; removed in Windows 2000
1028	; RtlQueryPropertySet@8 ; removed in Windows 2000
1029	RtlSetAttributesSecurityDescriptor@12
1030	; RtlSetProperties@28 ; removed in Windows 2000
1031	; RtlSetPropertyNames@16 ; removed in Windows 2000
1032	; RtlSetPropertySetClassId@8 ; removed in Windows 2000
1033	; RtlSetUnicodeCallouts@4 ; removed in Windows Vista
1034	RtlTryEnterCriticalSection@4
1035	ZwAddAtom@12 ; Windows NT 4.0 has ABI "ZwAddAtom@8", Windows 2000 and new has ABI "ZwAddAtom@12"
1036	; ZwCreateChannel@8 ; removed in Windows XP
1037	ZwDeleteAtom@4
1038	ZwDeleteObjectAuditAlarm@12
1039	ZwFindAtom@12 ; Windows NT 4.0 has ABI "ZwFindAtom@8", Windows 2000 and new has ABI "ZwFindAtom@12"
1040	; ZwListenChannel@8 ; removed in Windows XP
1041	ZwLoadKey2@12
1042	; ZwOpenChannel@8 ; removed in Windows XP
1043	ZwQueryFullAttributesFile@8
1044	ZwQueryInformationAtom@20
1045	ZwQueryMultipleValueKey@24
1046	; ZwQueryOleDirectoryFile@44 ; removed in Windows 2000
1047	ZwQueueApcThread@20
1048	; ZwReplyWaitSendChannel@12 ; removed in Windows XP
1049	; ZwSendWaitReplyChannel@16 ; removed in Windows XP
1050	; ZwSetContextChannel@4 ; removed in Windows XP
1051	ZwSignalAndWaitForSingleObject@16
1052	ZwYieldExecution@0
1053
1054	; In Windows NT 4.0 SP1 was not added any new symbol
1055
1056	; This is list of symbols added in Windows NT 4.0 SP2
1057	NtReadFileScatter@36
1058	NtWriteFileGather@36
1059	; RtlOnMappedStreamEvent@12 ; removed in Windows 2000
1060	ZwReadFileScatter@36
1061	ZwWriteFileGather@36
1062
1063	; This is list of symbols added in Windows NT 4.0 SP3
1064	RtlInitializeCriticalSectionAndSpinCount@8
1065	RtlSetCriticalSectionSpinCount@8
1066
1067	; In Windows NT 4.0 SP4 was not added any new symbol but some were removed
1068
1069	; In Windows NT 4.0 SP5 was not added any new symbol
1070
1071	; In Windows NT 4.0 SP6 was not added any new symbol
1072
1073	; In Windows NT 4.0 SP6a was not added any new symbol
1074
1075	; This is list of symbols added in Windows 2000
1076	DbgPrintReturnControlC ; cdecl
1077	LdrAlternateResourcesEnabled@0 ; removed in Windows Vista
1078	LdrFlushAlternateResourceModules@0
1079	LdrLoadAlternateResourceModule@16 ; Windows 2000-2003 has ABI "LdrLoadAlternateResourceModule@8", Windows Vista and new has ABI "LdrLoadAlternateResourceModule@16"
1080	LdrUnloadAlternateResourceModule@4
1081	NtAccessCheckByType@44
1082	NtAccessCheckByTypeAndAuditAlarm@64
1083	NtAccessCheckByTypeResultList@44
1084	NtAccessCheckByTypeResultListAndAuditAlarm@64
1085	NtAccessCheckByTypeResultListAndAuditAlarmByHandle@68
1086	NtAllocateUserPhysicalPages@12
1087	NtAreMappedFilesTheSame@8
1088	NtAssignProcessToJobObject@8
1089	NtCancelDeviceWakeupRequest@4 ; removed in Windows 7
1090	NtCreateJobObject@12
1091	NtCreateWaitablePort@20
1092	NtFilterToken@24
1093	NtFreeUserPhysicalPages@12
1094	NtGetDevicePowerState@8
1095	NtGetWriteWatch@28
1096	NtImpersonateAnonymousToken@4
1097	NtIsSystemResumeAutomatic@0
1098	NtMapUserPhysicalPages@12
1099	NtMapUserPhysicalPagesScatter@12
1100	NtNotifyChangeMultipleKeys@48
1101	NtOpenJobObject@12
1102	NtQueryDefaultUILanguage@4
1103	NtQueryInformationJobObject@20
1104	NtQueryInstallUILanguage@4
1105	NtQueryOpenSubKeys@8
1106	NtQueryQuotaInformationFile@36
1107	NtReplyWaitReceivePortEx@20
1108	NtRequestDeviceWakeup@4 ; removed in Windows 7
1109	NtResetWriteWatch@12
1110	NtSaveMergedKeys@12
1111	NtSecureConnectPort@36
1112	NtSetDefaultUILanguage@4
1113	NtSetInformationJobObject@16
1114	NtSetQuotaInformationFile@16
1115	NtSetThreadExecutionState@8
1116	NtSetUuidSeed@4
1117	NtTerminateJobObject@8
1118	RtlAddAccessAllowedAceEx@20
1119	RtlAddAccessAllowedObjectAce@28
1120	RtlAddAccessDeniedAceEx@20
1121	RtlAddAccessDeniedObjectAce@28
1122	RtlAddAuditAccessAceEx@28
1123	RtlAddAuditAccessObjectAce@36
1124	RtlAddRange@36 ; removed in Windows Server 2003
1125	RtlCallbackLpcClient@12 ; removed in Windows XP
1126	RtlCancelTimer@8
1127	RtlCheckForOrphanedCriticalSections@4
1128	RtlConvertToAutoInheritSecurityObject@24
1129	RtlCopyRangeList@8 ; removed in Windows Server 2003
1130	RtlCreateLpcServer@24 ; removed in Windows XP
1131	RtlCreateTimer@28
1132	RtlCreateTimerQueue@4
1133	RtlDebugPrintTimes@0
1134	RtlDefaultNpAcl@4
1135	RtlDeleteOwnersRanges@8 ; removed in Windows Server 2003
1136	RtlDeleteRange@24 ; removed in Windows Server 2003
1137	RtlDeleteTimer@12
1138	RtlDeleteTimerQueue@4
1139	RtlDeleteTimerQueueEx@8
1140	RtlDeregisterWait@4
1141	RtlDeregisterWaitEx@8
1142	RtlDnsHostNameToComputerName@12
1143	RtlEnableEarlyCriticalSectionEventCreation@0
1144	RtlFindLastBackwardRunClear@12
1145	RtlFindLeastSignificantBit@8
1146	RtlFindMostSignificantBit@8
1147	RtlFindNextForwardRunClear@12
1148	RtlFindRange@48 ; removed in Windows Server 2003
1149	; RtlFreeRangeList@4 ; removed in Windows Server 2003
1150	RtlGUIDFromString@8
1151	RtlGetFirstRange@12 ; removed in Windows Server 2003
1152	RtlGetNextRange@12 ; removed in Windows Server 2003
1153	RtlGetSecurityDescriptorRMControl@8
1154	RtlGetVersion@4
1155	RtlImpersonateLpcClient@8 ; removed in Windows XP
1156	; RtlInitializeRangeList@4 ; removed in Windows Server 2003
1157	RtlInt64ToUnicodeString@16
1158	RtlInvertRangeList@8 ; removed in Windows Server 2003
1159	RtlIsRangeAvailable@40 ; removed in Windows Server 2003
1160	RtlMergeRangeLists@16 ; removed in Windows Server 2003
1161	RtlNewSecurityObjectEx@32
1162	RtlQueueWorkItem@12
1163	RtlRegisterWait@24
1164	RtlSelfRelativeToAbsoluteSD2@8
1165	RtlSetControlSecurityDescriptor@12
1166	RtlSetIoCompletionCallback@12
1167	RtlSetSecurityDescriptorRMControl@8
1168	RtlSetSecurityObjectEx@24
1169	RtlSetThreadPoolStartFunc@8
1170	RtlSetTimer@28
1171	RtlShutdownLpcServer@4 ; removed in Windows XP
1172	RtlStringFromGUID@8
1173	@RtlUlongByteSwap@4 ; fastcall
1174	@RtlUlonglongByteSwap@8 ; fastcall
1175	RtlUpdateTimer@16
1176	@RtlUshortByteSwap@4 ; fastcall
1177	RtlValidRelativeSecurityDescriptor@12
1178	RtlVerifyVersionInfo@16
1179	RtlWalkFrameChain@12
1180	VerSetConditionMask@16
1181	ZwAccessCheckByType@44
1182	ZwAccessCheckByTypeAndAuditAlarm@64
1183	ZwAccessCheckByTypeResultList@44
1184	ZwAccessCheckByTypeResultListAndAuditAlarm@64
1185	ZwAccessCheckByTypeResultListAndAuditAlarmByHandle@68
1186	ZwAllocateUserPhysicalPages@12
1187	ZwAreMappedFilesTheSame@8
1188	ZwAssignProcessToJobObject@8
1189	ZwCancelDeviceWakeupRequest@4 ; removed in Windows 7
1190	ZwCreateJobObject@12
1191	ZwCreateWaitablePort@20
1192	ZwFilterToken@24
1193	ZwFreeUserPhysicalPages@12
1194	ZwGetDevicePowerState@8
1195	ZwGetWriteWatch@28
1196	ZwImpersonateAnonymousToken@4
1197	ZwInitiatePowerAction@16
1198	ZwIsSystemResumeAutomatic@0
1199	ZwMapUserPhysicalPages@12
1200	ZwMapUserPhysicalPagesScatter@12
1201	ZwNotifyChangeMultipleKeys@48
1202	ZwOpenJobObject@12
1203	ZwPowerInformation@20
1204	ZwQueryDefaultUILanguage@4
1205	ZwQueryInformationJobObject@20
1206	ZwQueryInstallUILanguage@4
1207	ZwQueryOpenSubKeys@8
1208	ZwQueryQuotaInformationFile@36
1209	ZwReplyWaitReceivePortEx@20
1210	ZwRequestDeviceWakeup@4 ; removed in Windows 7
1211	ZwRequestWakeupLatency@4 ; removed in Windows 7
1212	ZwResetWriteWatch@12
1213	ZwSaveMergedKeys@12
1214	ZwSecureConnectPort@36
1215	ZwSetDefaultUILanguage@4
1216	ZwSetInformationJobObject@16
1217	ZwSetQuotaInformationFile@16
1218	ZwSetThreadExecutionState@8
1219	ZwSetUuidSeed@4
1220	ZwTerminateJobObject@8
1221
1222	; This is list of symbols added in Windows 2000 SP1
1223	RtlTraceDatabaseAdd@16
1224	RtlTraceDatabaseCreate@20
1225	RtlTraceDatabaseDestroy@4
1226	RtlTraceDatabaseEnumerate@12
1227	RtlTraceDatabaseFind@16
1228	RtlTraceDatabaseLock@4
1229	RtlTraceDatabaseUnlock@4
1230	RtlTraceDatabaseValidate@4
1231
1232	; In Windows 2000 SP2 was not added any new symbol
1233
1234	; In Windows 2000 SP3 was not added any new symbol
1235
1236	; In Windows 2000 SP4 was not added any new symbol
1237
1238	; This is list of symbols added in Windows XP
1239	CsrCaptureMessageMultiUnicodeStringsInPlace@12
1240	CsrGetProcessId@0
1241	DbgPrintEx ; cdecl
1242	DbgQueryDebugFilterState@8
1243	DbgSetDebugFilterState@12
1244	DbgUiConvertStateChangeStructure@8
1245	DbgUiDebugActiveProcess@4
1246	DbgUiGetThreadDebugObject@0
1247	DbgUiIssueRemoteBreakin@4
1248	DbgUiRemoteBreakin@4
1249	DbgUiSetThreadDebugObject@4
1250	DbgUiStopDebugging@4
1251	; LdrAccessOutOfProcessResource@20 ; removed in Windows Vista
1252	LdrAddRefDll@8
1253	; LdrCreateOutOfProcessImage@20 ; Windows XP has ABI "LdrCreateOutOfProcessImage@16", Windows Server 2003 has ABI "LdrCreateOutOfProcessImage@20", removed in Windows Vista
1254	; LdrDestroyOutOfProcessImage@4 ; removed in Windows Vista
1255	; LdrFindCreateProcessManifest@20 ; removed in Windows Vista
1256	LdrFindResourceEx_U@20
1257	LdrGetDllHandleEx@20
1258	LdrInitShimEngineDynamic@4 ; Windows XP-7 has ABI "LdrInitShimEngineDynamic@4", Windows 8 an new has ABI "LdrInitShimEngineDynamic@8"
1259	LdrLockLoaderLock@12
1260	LdrSetAppCompatDllRedirectionCallback@12
1261	LdrSetDllManifestProber@4 ; Windows XP-Vista has ABI "LdrSetDllManifestProber@4", Windows 7 an new has ABI "LdrSetDllManifestProber@12"
1262	LdrUnlockLoaderLock@8
1263	NtAddBootEntry@8
1264	NtCompactKeys@8
1265	NtCompareTokens@12
1266	NtCompressKey@4
1267	NtCreateDebugObject@16
1268	NtCreateJobSet@12
1269	NtCreateKeyedEvent@16
1270	NtCreateProcessEx@36
1271	NtDebugActiveProcess@8
1272	NtDebugContinue@12
1273	NtDeleteBootEntry@4
1274	NtEnumerateBootEntries@8
1275	NtEnumerateSystemEnvironmentValuesEx@12
1276	NtIsProcessInJob@8
1277	NtLockProductActivationKeys@8
1278	NtLockRegistryKey@4
1279	NtMakePermanentObject@4
1280	NtModifyBootEntry@4
1281	NtOpenKeyedEvent@12
1282	NtOpenProcessTokenEx@16
1283	NtOpenThreadTokenEx@20
1284	NtQueryBootEntryOrder@8
1285	NtQueryBootOptions@8
1286	NtQueryDebugFilterState@8
1287	NtQueryPortInformationProcess@0
1288	NtQuerySystemEnvironmentValueEx@20
1289	NtReleaseKeyedEvent@16
1290	NtRemoveProcessDebug@8
1291	NtRenameKey@8
1292	NtResumeProcess@4
1293	NtSaveKeyEx@12
1294	NtSetBootEntryOrder@8
1295	NtSetBootOptions@8
1296	NtSetDebugFilterState@12
1297	NtSetEventBoostPriority@4
1298	NtSetInformationDebugObject@20
1299	NtSetSystemEnvironmentValueEx@20
1300	NtSuspendProcess@4
1301	NtTraceEvent@16
1302	NtTranslateFilePath@16
1303	NtUnloadKeyEx@8
1304	NtWaitForDebugEvent@16
1305	NtWaitForKeyedEvent@16
1306	RtlActivateActivationContext@12
1307	RtlActivateActivationContextEx@16
1308	@RtlActivateActivationContextUnsafeFast@8 ; fastcall
1309	RtlAddRefActivationContext@4
1310	RtlAddRefMemoryStream@4 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version
1311	RtlAddVectoredExceptionHandler@8
1312	RtlAddressInSectionTable@12
1313	RtlAppendPathElement@12
1314	RtlApplicationVerifierStop@40
1315	; RtlAssert2@20 ; removed in Windows Server 2003
1316	RtlCaptureContext@4
1317	RtlCaptureStackContext@12
1318	; RtlCheckProcessParameters@16 ; removed in Windows Vista
1319	RtlCloneMemoryStream@8 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version
1320	RtlCommitMemoryStream@8 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version
1321	RtlComputeCrc32@12
1322	RtlComputeImportTableHash@12
1323	RtlComputePrivatizedDllName_U@12
1324	RtlCopyMemoryStreamTo@24 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version
1325	RtlCopyOutOfProcessMemoryStreamTo@24 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version
1326	RtlCreateActivationContext@24
1327	RtlCreateBootStatusDataFile@4 ; Windows XP-2003 has ABI "RtlCreateBootStatusDataFile@0", Windows Vista and new has ABI "RtlCreateBootStatusDataFile@4"
1328	RtlCreateSystemVolumeInformationFolder@4
1329	RtlDeactivateActivationContext@8
1330	@RtlDeactivateActivationContextUnsafeFast@4 ; fastcall
1331	RtlDeleteElementGenericTableAvl@8
1332	RtlDllShutdownInProgress@0
1333	RtlDosApplyFileIsolationRedirection_Ustr@36
1334	RtlDosSearchPath_Ustr@36
1335	RtlDowncaseUnicodeChar@4
1336	RtlDuplicateUnicodeString@12
1337	RtlEnumerateGenericTableAvl@8
1338	RtlEnumerateGenericTableLikeADirectory@28
1339	RtlEnumerateGenericTableWithoutSplayingAvl@8
1340	RtlExitUserThread@4
1341	RtlFinalReleaseOutOfProcessMemoryStream@4 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version
1342	RtlFindActivationContextSectionGuid@20
1343	RtlFindActivationContextSectionString@20
1344	RtlFindCharInUnicodeString@16
1345	RtlFindClearRuns@16
1346	RtlFirstEntrySList@4
1347	RtlFlushSecureMemoryCache@8
1348	RtlFreeThreadActivationContextStack@0
1349	RtlGetActiveActivationContext@4
1350	RtlGetCurrentPeb@0
1351	RtlGetElementGenericTableAvl@8
1352	RtlGetFrame@0
1353	RtlGetLastNtStatus@0
1354	RtlGetLastWin32Error@0
1355	RtlGetLengthWithoutLastFullDosOrNtPathElement@12
1356	RtlGetLengthWithoutTrailingPathSeperators@12
1357	RtlGetNativeSystemInformation@16
1358	RtlGetNtVersionNumbers@12
1359	RtlGetSetBootStatusData@24
1360	RtlHashUnicodeString@16
1361	RtlInitMemoryStream@4 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version
1362	RtlInitOutOfProcessMemoryStream@4 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version
1363	RtlInitUnicodeStringEx@8
1364	RtlInitializeGenericTableAvl@20
1365	RtlInitializeSListHead@4
1366	RtlInsertElementGenericTableAvl@16
1367	RtlInterlockedFlushSList@4
1368	RtlInterlockedPopEntrySList@4
1369	RtlInterlockedPushEntrySList@8
1370	@RtlInterlockedPushListSList@16 ; fastcall
1371	RtlIpv4AddressToStringA@8
1372	RtlIpv4AddressToStringW@8
1373	RtlIpv4StringToAddressA@16
1374	RtlIpv4StringToAddressW@16
1375	RtlIpv6AddressToStringA@8
1376	RtlIpv6AddressToStringW@8
1377	RtlIpv6StringToAddressA@12
1378	RtlIpv6StringToAddressW@12
1379	RtlIsActivationContextActive@4
1380	RtlIsGenericTableEmptyAvl@4
1381	RtlLockBootStatusData@4
1382	RtlLockMemoryStreamRegion@24 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version
1383	RtlLogStackBackTrace@0
1384	RtlLookupElementGenericTableAvl@8
1385	RtlMapSecurityErrorToNtStatus@4
1386	RtlMultiAppendUnicodeStringBuffer@12
1387	RtlNewSecurityObjectWithMultipleInheritance@36
1388	RtlNtPathNameToDosPathName@16
1389	RtlNtStatusToDosErrorNoTeb@4
1390	RtlNumberGenericTableElementsAvl@4
1391	RtlPopFrame@4
1392	RtlPushFrame@4
1393	RtlQueryDepthSList@4
1394	RtlQueryHeapInformation@20
1395	RtlQueryInformationActivationContext@28
1396	RtlQueryInformationActiveActivationContext@16
1397	RtlQueryInterfaceMemoryStream@12 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version
1398	RtlQueueApcWow64Thread@20
1399	RtlRandomEx@4
1400	RtlReadMemoryStream@16 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version
1401	RtlReadOutOfProcessMemoryStream@16 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version
1402	RtlRegisterSecureMemoryCacheCallback@4
1403	RtlReleaseActivationContext@4
1404	RtlReleaseMemoryStream@4 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version
1405	RtlRemoveVectoredExceptionHandler@4
1406	RtlRestoreLastWin32Error@4
1407	RtlRevertMemoryStream@4 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version
1408	RtlSeekMemoryStream@20 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version
1409	RtlSetHeapInformation@16
1410	RtlSetLastWin32Error@4
1411	RtlSetLastWin32ErrorAndNtStatusFromNtStatus@4
1412	RtlSetMemoryStreamSize@12 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version
1413	RtlSetProcessIsCritical ; cdecl
1414	RtlSetThreadIsCritical ; cdecl
1415	RtlStatMemoryStream@12 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version
1416	RtlUnhandledExceptionFilter2@8
1417	RtlUnhandledExceptionFilter@4
1418	RtlUnlockBootStatusData@4
1419	RtlUnlockMemoryStreamRegion@24 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version
1420	RtlValidateUnicodeString@8
1421	RtlWriteMemoryStream@16 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version
1422	RtlZombifyActivationContext@4
1423	RtlpApplyLengthFunction@16
1424	RtlpEnsureBufferSize@12
1425	RtlpNotOwnerCriticalSection@4
1426	ZwAddBootEntry@8
1427	ZwCompactKeys@8
1428	ZwCompareTokens@12
1429	ZwCompressKey@4
1430	ZwCreateDebugObject@16
1431	ZwCreateJobSet@12
1432	ZwCreateKeyedEvent@16
1433	ZwCreateProcessEx@36
1434	ZwDebugActiveProcess@8
1435	ZwDebugContinue@12
1436	ZwDeleteBootEntry@4
1437	ZwEnumerateBootEntries@8
1438	ZwEnumerateSystemEnvironmentValuesEx@12
1439	ZwIsProcessInJob@8
1440	ZwLockProductActivationKeys@8
1441	ZwLockRegistryKey@4
1442	ZwMakePermanentObject@4
1443	ZwModifyBootEntry@4
1444	ZwOpenKeyedEvent@12
1445	ZwOpenProcessTokenEx@16
1446	ZwOpenThreadTokenEx@20
1447	ZwQueryBootEntryOrder@8
1448	ZwQueryBootOptions@8
1449	ZwQueryDebugFilterState@8
1450	ZwQueryPortInformationProcess@0
1451	ZwQuerySystemEnvironmentValueEx@20
1452	ZwReleaseKeyedEvent@16
1453	ZwRemoveProcessDebug@8
1454	ZwRenameKey@8
1455	ZwResumeProcess@4
1456	ZwSaveKeyEx@12
1457	ZwSetBootEntryOrder@8
1458	ZwSetBootOptions@8
1459	ZwSetDebugFilterState@12
1460	ZwSetEventBoostPriority@4
1461	ZwSetInformationDebugObject@20
1462	ZwSetSystemEnvironmentValueEx@20
1463	ZwSuspendProcess@4
1464	ZwTraceEvent@16
1465	ZwTranslateFilePath@16
1466	ZwUnloadKeyEx@8
1467	ZwWaitForDebugEvent@16
1468	ZwWaitForKeyedEvent@16
1469	vDbgPrintEx@16
1470	vDbgPrintExWithPrefix@20
1471
1472	; This is list of symbols added in Windows XP SP1
1473	LdrEnumerateLoadedModules@12
1474	RtlIsThreadWithinLoaderCallout@0
1475
1476	; This is list of symbols added in Windows XP SP2
1477	LdrHotPatchRoutine@0 ; removed in Windows 8.1
1478	RtlGetUnloadEventTrace@0
1479	RtlIpv4AddressToStringExA@16
1480	RtlIpv4AddressToStringExW@16
1481	RtlIpv4StringToAddressExA@16
1482	RtlIpv4StringToAddressExW@16
1483	RtlIpv6AddressToStringExA@20
1484	RtlIpv6AddressToStringExW@20
1485	RtlIpv6StringToAddressExA@16
1486	RtlIpv6StringToAddressExW@16
1487
1488	; This is list of symbols added in Windows XP SP2 and in Windows Server 2003 SP1 (not available in 2003 without SP1)
1489	KiFastSystemCall@0
1490	KiFastSystemCallRet@0
1491	KiIntSystemCall@0
1492	RtlDecodePointer@4
1493	RtlDecodeSystemPointer@4
1494	RtlEncodePointer@4
1495	RtlEncodeSystemPointer@4
1496
1497	; In Windows XP SP3 was not added any new symbol
1498
1499	; This is list of symbols added in Windows Server 2003
1500	; EtwControlTraceA@20 ; removed in Windows Vista
1501	; EtwControlTraceW@20 ; removed in Windows Vista
1502	EtwCreateTraceInstanceId@8
1503	; EtwEnableTrace@24 ; removed in Windows Vista
1504	; EtwEnumerateTraceGuids@12 ; removed in Windows Vista
1505	; EtwFlushTraceA@16 ; removed in Windows Vista
1506	; EtwFlushTraceW@16 ; removed in Windows Vista
1507	EtwGetTraceEnableFlags@8
1508	EtwGetTraceEnableLevel@8
1509	EtwGetTraceLoggerHandle@4
1510	; EtwNotificationRegistrationA@20 ; removed in Windows Vista
1511	; EtwNotificationRegistrationW@20 ; removed in Windows Vista
1512	; EtwQueryAllTracesA@12 ; removed in Windows Vista
1513	; EtwQueryAllTracesW@12 ; removed in Windows Vista
1514	; EtwQueryTraceA@16 ; removed in Windows Vista
1515	; EtwQueryTraceW@16 ; removed in Windows Vista
1516	; EtwReceiveNotificationsA@16 ; removed in Windows Vista
1517	; EtwReceiveNotificationsW@16 ; removed in Windows Vista
1518	EtwRegisterTraceGuidsA@32
1519	EtwRegisterTraceGuidsW@32
1520	; EtwStartTraceA@12 ; removed in Windows Vista
1521	; EtwStartTraceW@12 ; removed in Windows Vista
1522	; EtwStopTraceA@16 ; removed in Windows Vista
1523	; EtwStopTraceW@16 ; removed in Windows Vista
1524	; EtwTraceEvent@12 ; removed in Windows Vista
1525	EtwTraceEventInstance@20
1526	EtwTraceMessage ; cdecl
1527	EtwTraceMessageVa@24
1528	EtwUnregisterTraceGuids@8
1529	; EtwUpdateTraceA@16 ; removed in Windows Vista
1530	; EtwUpdateTraceW@16 ; removed in Windows Vista
1531	; EtwpGetTraceBuffer@16 ; removed in Windows Vista
1532	; EtwpSetHWConfigFunction@8 ; removed in Windows Vista
1533	LdrQueryImageFileExecutionOptionsEx@28
1534	NtAddDriverEntry@8
1535	NtApphelpCacheControl@8
1536	NtDeleteDriverEntry@4
1537	NtEnumerateDriverEntries@8
1538	NtGetCurrentProcessorNumber@0
1539	NtGetTickCount@0
1540	NtLoadKeyEx@32 ; Windows Server 2003 has ABI "NtLoadKeyEx@16", Windows Vista and new has ABI "NtLoadKeyEx@32"
1541	NtModifyDriverEntry@4
1542	NtQueryDriverEntryOrder@8
1543	NtQueryOpenSubKeysEx@16
1544	NtSetDriverEntryOrder@8
1545	NtUnloadKey2@8
1546	RtlCopyMappedMemory@12
1547	RtlDosPathNameToRelativeNtPathName_U@16
1548	RtlGetFullPathName_UstrEx@32
1549	RtlGetThreadErrorMode@0
1550	RtlImageNtHeaderEx@20
1551	RtlInitAnsiStringEx@8
1552	RtlInsertElementGenericTableFull@24
1553	RtlInsertElementGenericTableFullAvl@24
1554	RtlInterlockedCompareExchange64@20
1555	RtlLookupElementGenericTableFull@16
1556	RtlLookupElementGenericTableFullAvl@16
1557	RtlMultipleAllocateHeap@20
1558	RtlMultipleFreeHeap@16
1559	RtlReleaseRelativeName@4
1560	RtlSetEnvironmentStrings@8
1561	RtlSetThreadErrorMode@8
1562	RtlWow64EnableFsRedirection@4
1563	ZwAddDriverEntry@8
1564	ZwApphelpCacheControl@8
1565	ZwDeleteDriverEntry@4
1566	ZwEnumerateDriverEntries@8
1567	ZwGetCurrentProcessorNumber@0
1568	ZwLoadKeyEx@32 ; Windows Server 2003 has ABI "ZwLoadKeyEx@16", Windows Vista and new has ABI "ZwLoadKeyEx@32"
1569	ZwModifyDriverEntry@4
1570	ZwQueryDriverEntryOrder@8
1571	ZwQueryOpenSubKeysEx@16
1572	ZwSetDriverEntryOrder@8
1573	ZwUnloadKey2@8
1574
1575	; This is list of symbols added in Windows Server 2003 SP1 and Windows XP x64 SP1 (WoW64 version)
1576	ExpInterlockedPopEntrySListEnd@0 ; removed in Windows 10 November Update (Threshold 2 / 1511) WoW64 version, but available in non-WoW64 version
1577	ExpInterlockedPopEntrySListFault@0 ; removed in Windows 10 November Update (Threshold 2 / 1511) WoW64 version, but available in non-WoW64 version
1578	ExpInterlockedPopEntrySListResume@0 ; removed in Windows 10 November Update (Threshold 2 / 1511) WoW64 version, but available in non-WoW64 version
1579	LdrOpenImageFileOptionsKey@12
1580	LdrQueryImageFileKeyOption@24
1581	NtWaitForMultipleObjects32@20
1582	NtWow64CsrAllocateCaptureBuffer@8 ; available only in 32-bit WoW64 version on 64-bit system
1583	NtWow64CsrAllocateMessagePointer@12 ; available only in 32-bit WoW64 version on 64-bit system
1584	NtWow64CsrCaptureMessageBuffer@16 ; available only in 32-bit WoW64 version on 64-bit system
1585	NtWow64CsrCaptureMessageString@20 ; available only in 32-bit WoW64 version on 64-bit system
1586	NtWow64CsrClientCallServer@16 ; available only in 32-bit WoW64 version on 64-bit system
1587	NtWow64CsrClientConnectToServer@20 ; available only in 32-bit WoW64 version on 64-bit system
1588	NtWow64CsrFreeCaptureBuffer@4 ; available only in 32-bit WoW64 version on 64-bit system
1589	NtWow64CsrGetProcessId@0 ; available only in 32-bit WoW64 version on 64-bit system
1590	NtWow64CsrIdentifyAlertableThread@0 ; available only in 32-bit WoW64 version on 64-bit system
1591	; NtWow64CsrNewThread@0 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 7
1592	; NtWow64CsrSetPriorityClass@8 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 7
1593	NtWow64DebuggerCall@20 ; available only in 32-bit WoW64 version on 64-bit system
1594	NtWow64GetNativeSystemInformation@16 ; available only in 32-bit WoW64 version on 64-bit system
1595	NtWow64QueryInformationProcess64@20 ; available only in 32-bit WoW64 version on 64-bit system
1596	NtWow64QueryVirtualMemory64@32 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 10 (Threshold / 1507)
1597	NtWow64ReadVirtualMemory64@28 ; available only in 32-bit WoW64 version on 64-bit system
1598	RtlAcquirePrivilege@16
1599	RtlAddVectoredContinueHandler@8
1600	RtlAllocateActivationContextStack@4
1601	RtlDosPathNameToNtPathName_U_WithStatus@16
1602	RtlDosPathNameToRelativeNtPathName_U_WithStatus@16
1603	RtlFormatMessageEx@40
1604	RtlFreeActivationContextStack@4
1605	RtlGetCriticalSectionRecursionCount@4
1606	RtlGetCurrentProcessorNumber@0
1607	RtlIsCriticalSectionLocked@4
1608	RtlIsCriticalSectionLockedByThread@4
1609	RtlReleasePrivilege@4
1610	RtlRemoveVectoredContinueHandler@4
1611	RtlSetUnhandledExceptionFilter@4
1612	RtlWow64EnableFsRedirectionEx@8
1613	ZwWaitForMultipleObjects32@20
1614	ZwWow64CsrAllocateCaptureBuffer@8 ; available only in 32-bit WoW64 version on 64-bit system
1615	ZwWow64CsrAllocateMessagePointer@12 ; available only in 32-bit WoW64 version on 64-bit system
1616	ZwWow64CsrCaptureMessageBuffer@16 ; available only in 32-bit WoW64 version on 64-bit system
1617	ZwWow64CsrCaptureMessageString@20 ; available only in 32-bit WoW64 version on 64-bit system
1618	ZwWow64CsrClientCallServer@16 ; available only in 32-bit WoW64 version on 64-bit system
1619	ZwWow64CsrClientConnectToServer@20 ; available only in 32-bit WoW64 version on 64-bit system
1620	ZwWow64CsrFreeCaptureBuffer@4 ; available only in 32-bit WoW64 version on 64-bit system
1621	ZwWow64CsrGetProcessId@0 ; available only in 32-bit WoW64 version on 64-bit system
1622	ZwWow64CsrIdentifyAlertableThread@0 ; available only in 32-bit WoW64 version on 64-bit system
1623	; ZwWow64CsrNewThread@0 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 7
1624	; ZwWow64CsrSetPriorityClass@8 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 7
1625	ZwWow64DebuggerCall@20 ; available only in 32-bit WoW64 version on 64-bit system
1626	ZwWow64GetNativeSystemInformation@16 ; available only in 32-bit WoW64 version on 64-bit system
1627	ZwWow64QueryInformationProcess64@20 ; available only in 32-bit WoW64 version on 64-bit system
1628	ZwWow64QueryVirtualMemory64@32 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 10 (Threshold / 1507)
1629	ZwWow64ReadVirtualMemory64@28 ; available only in 32-bit WoW64 version on 64-bit system
1630
1631	; In Windows Server 2003 SP2 and Windows XP x64 SP2 (WoW64 version) was not added any new symbol
1632
1633	; This is list of symbols added in Windows Vista
1634	A_SHAFinal@8
1635	A_SHAInit@4
1636	A_SHAUpdate@12
1637	AlpcAdjustCompletionListConcurrencyCount@8
1638	AlpcFreeCompletionListMessage@8
1639	AlpcGetCompletionListLastMessageInformation@12
1640	AlpcGetCompletionListMessageAttributes@8
1641	AlpcGetHeaderSize@4
1642	AlpcGetMessageAttribute@8
1643	AlpcGetMessageFromCompletionList@8
1644	AlpcGetOutstandingCompletionListMessageCount@4
1645	AlpcInitializeMessageAttribute@16
1646	AlpcMaxAllowedMessageLength@0
1647	AlpcRegisterCompletionList@20
1648	AlpcRegisterCompletionListWorkerThread@4
1649	AlpcUnregisterCompletionList@4
1650	AlpcUnregisterCompletionListWorkerThread@4
1651	CsrVerifyRegion@8
1652	EtwDeliverDataBlock@4
1653	EtwEnumerateProcessRegGuids@12
1654	EtwEventActivityIdControl@8
1655	EtwEventEnabled@12
1656	EtwEventProviderEnabled@20
1657	EtwEventRegister@16
1658	EtwEventUnregister@8
1659	EtwEventWrite@20
1660	EtwEventWriteEndScenario@20
1661	EtwEventWriteFull@32
1662	EtwEventWriteStartScenario@20
1663	EtwEventWriteString@24
1664	EtwEventWriteTransfer@28
1665	EtwLogTraceEvent@12
1666	EtwNotificationRegister@20
1667	EtwNotificationUnregister@12
1668	EtwProcessPrivateLoggerRequest@4
1669	EtwRegisterSecurityProvider@0
1670	EtwReplyNotification@4
1671	EtwSendNotification@20
1672	EtwSetMark@16
1673	EtwWriteUMSecurityEvent@16
1674	EtwpCreateEtwThread@8
1675	EtwpGetCpuSpeed@8 ; Windows Vista-8 has ABI "EtwpGetCpuSpeed@8", Windows 8.1 and new has ABI "EtwpGetCpuSpeed@4"
1676	; EtwpNotificationThread@0 ; removed in Windows 8.1
1677	LdrAddLoadAsDataTable@16 ; Windows Vista has ABI "LdrAddLoadAsDataTable@16", Windows 7 and new has ABI "LdrAddLoadAsDataTable@20"
1678	LdrGetFailureData@0
1679	LdrGetFileNameFromLoadAsDataTable@8
1680	LdrGetProcedureAddressEx@20
1681	LdrLoadAlternateResourceModuleEx@20
1682	LdrQueryModuleServiceTags@12
1683	LdrRegisterDllNotification@16
1684	LdrRemoveLoadAsDataTable@16
1685	LdrResFindResource@36
1686	LdrResFindResourceDirectory@28
1687	LdrResRelease@12
1688	LdrResSearchResource@32
1689	LdrSetMUICacheType@4
1690	LdrUnloadAlternateResourceModuleEx@8
1691	LdrUnregisterDllNotification@4
1692	LdrVerifyImageMatchesChecksumEx@8
1693	MD4Final@4
1694	MD4Init@4
1695	MD4Update@12
1696	MD5Final@4
1697	MD5Init@4
1698	MD5Update@12
1699	NtAcquireCMFViewOwnership@12 ; removed in Windows 7
1700	NtAlpcAcceptConnectPort@36
1701	NtAlpcCancelMessage@12
1702	NtAlpcConnectPort@44
1703	NtAlpcCreatePort@12
1704	NtAlpcCreatePortSection@24
1705	NtAlpcCreateResourceReserve@16
1706	NtAlpcCreateSectionView@12
1707	NtAlpcCreateSecurityContext@12
1708	NtAlpcDeletePortSection@12
1709	NtAlpcDeleteResourceReserve@12
1710	NtAlpcDeleteSectionView@12
1711	NtAlpcDeleteSecurityContext@12
1712	NtAlpcDisconnectPort@8
1713	NtAlpcImpersonateClientOfPort@12
1714	NtAlpcOpenSenderProcess@24
1715	NtAlpcOpenSenderThread@24
1716	NtAlpcQueryInformation@20
1717	NtAlpcQueryInformationMessage@24
1718	NtAlpcRevokeSecurityContext@12
1719	NtAlpcSendWaitReceivePort@32
1720	NtAlpcSetInformation@16
1721	NtCancelIoFileEx@12
1722	NtCancelSynchronousIoFile@12
1723	; NtClearAllSavepointsTransaction@4 ; removed in Windows Vista SP1
1724	; NtClearSavepointTransaction@8 ; removed in Windows Vista SP1
1725	NtCommitComplete@8
1726	NtCommitEnlistment@8
1727	NtCommitTransaction@8
1728	NtCreateEnlistment@32
1729	NtCreateKeyTransacted@32
1730	NtCreatePrivateNamespace@16
1731	NtCreateResourceManager@28
1732	NtCreateThreadEx@44
1733	NtCreateTransaction@40
1734	NtCreateTransactionManager@24
1735	NtCreateUserProcess@44
1736	NtCreateWorkerFactory@40
1737	NtDeletePrivateNamespace@4
1738	NtEnumerateTransactionObject@20
1739	NtFlushInstallUILanguage@8
1740	NtFlushProcessWriteBuffers@0
1741	NtFreezeRegistry@4
1742	NtFreezeTransactions@8
1743	NtGetMUIRegistryInfo@12
1744	NtGetNextProcess@20
1745	NtGetNextThread@24
1746	NtGetNlsSectionPtr@20
1747	NtGetNotificationResourceManager@28
1748	NtInitializeNlsFiles@16 ; Windows Vista has ABI "NtInitializeNlsFiles@12", Windows Vista SP1 and SP2 has ABI "NtInitializeNlsFiles@16", Windows 7 and new has again ABI "NtInitializeNlsFiles@12"
1749	NtIsUILanguageComitted@0
1750	; NtListTransactions@12 ; removed in Windows Vista SP1
1751	NtMapCMFModule@24
1752	; NtMarshallTransaction@24 ; removed in Windows Vista SP1
1753	NtOpenEnlistment@20
1754	NtOpenKeyTransacted@16
1755	NtOpenPrivateNamespace@16
1756	NtOpenResourceManager@20
1757	NtOpenSession@12
1758	NtOpenTransaction@20
1759	NtOpenTransactionManager@24
1760	NtPrePrepareComplete@8
1761	NtPrePrepareEnlistment@8
1762	NtPrepareComplete@8
1763	NtPrepareEnlistment@8
1764	NtPropagationComplete@16
1765	NtPropagationFailed@12
1766	; NtPullTransaction@28 ; removed in Windows Vista SP1
1767	NtQueryInformationEnlistment@20
1768	NtQueryInformationResourceManager@20
1769	NtQueryInformationTransaction@20
1770	NtQueryInformationTransactionManager@20
1771	NtQueryInformationWorkerFactory@20
1772	NtQueryLicenseValue@20
1773	NtReadOnlyEnlistment@8
1774	NtRecoverEnlistment@8
1775	NtRecoverResourceManager@4
1776	NtRecoverTransactionManager@4
1777	NtRegisterProtocolAddressInformation@20
1778	NtReleaseCMFViewOwnership@0 ; removed in Windows 7
1779	NtReleaseWorkerFactoryWorker@4
1780	NtRemoveIoCompletionEx@24
1781	NtRollbackComplete@8
1782	NtRollbackEnlistment@8
1783	; NtRollbackSavepointTransaction@8 ; removed in Windows Vista SP1
1784	NtRollbackTransaction@8
1785	NtRollforwardTransactionManager@8
1786	; NtSavepointComplete@8 ; removed in Windows Vista SP1
1787	; NtSavepointTransaction@12 ; removed in Windows Vista SP1
1788	NtSetInformationEnlistment@16
1789	NtSetInformationResourceManager@16
1790	NtSetInformationTransaction@16
1791	NtSetInformationTransactionManager@16
1792	NtSetInformationWorkerFactory@16
1793	NtShutdownWorkerFactory@8
1794	NtSinglePhaseReject@8
1795	; NtStartTm@0 ; removed in Windows Vista SP1
1796	NtThawRegistry@0
1797	NtThawTransactions@0
1798	NtTraceControl@24
1799	NtWaitForWorkViaWorkerFactory@8 ; Windows Vista-7 has ABI "NtWaitForWorkViaWorkerFactory@8", Windows 8 has ABI "NtWaitForWorkViaWorkerFactory@16", Windows 8.1 and new has ABI "NtWaitForWorkViaWorkerFactory@20"
1800	NtWorkerFactoryWorkerReady@4
1801	NtWow64CallFunction64@28 ; available only in 32-bit WoW64 version on 64-bit system
1802	NtWow64CsrVerifyRegion@8 ; available only in 32-bit WoW64 version on 64-bit system
1803	NtWow64WriteVirtualMemory64@28 ; available only in 32-bit WoW64 version on 64-bit system
1804	; ResCCloseRuntimeView@4 ; removed in Windows Vista SP1
1805	; ResCCompareCacheIDs@8 ; removed in Windows Vista SP1
1806	; ResCCreateCultureMap@12 ; removed in Windows Vista SP1
1807	; ResCCreateDefaultCultureMap@4 ; removed in Windows Vista SP1
1808	; ResCCreateRuntimeView@16 ; removed in Windows Vista SP1
1809	; ResCDirectoryCreateAndPopulate@12 ; removed in Windows Vista SP1
1810	; ResCDirectoryCreateMapping@16 ; removed in Windows Vista SP1
1811	; ResCDirectoryFree@4 ; removed in Windows Vista SP1
1812	; ResCDirectoryGetBaseFolder@4 ; removed in Windows Vista SP1
1813	; ResCDirectoryGetEntry@24 ; removed in Windows Vista SP1
1814	; ResCDirectoryGetEntryCopy@28 ; removed in Windows Vista SP1
1815	; ResCDirectoryGetEntryEx@32 ; removed in Windows Vista SP1
1816	; ResCDirectoryGetEntryExCopy@36 ; removed in Windows Vista SP1
1817	; ResCDirectoryGetEntryIndex@24 ; removed in Windows Vista SP1
1818	; ResCDirectoryGetEntryIndexEx@32 ; removed in Windows Vista SP1
1819	; ResCDirectoryGetFirstEntry@20 ; removed in Windows Vista SP1
1820	; ResCDirectoryGetFirstEntryIndex@20 ; removed in Windows Vista SP1
1821	; ResCDirectoryGetSegmentIndex@8 ; removed in Windows Vista SP1
1822	; ResCDirectoryGetSegmentName@8 ; removed in Windows Vista SP1
1823	; ResCDirectoryLoadFixedSize@4 ; removed in Windows Vista SP1
1824	; ResCDirectoryOpenMapping@8 ; removed in Windows Vista SP1
1825	; ResCFreeCultureMap@4 ; removed in Windows Vista SP1
1826	; ResCGetCacheIndices@16 ; removed in Windows Vista SP1
1827	; ResCGetCultureID@8 ; removed in Windows Vista SP1
1828	; ResCGetCultureIndex@8 ; removed in Windows Vista SP1
1829	; ResCGetCultureName@16 ; removed in Windows Vista SP1
1830	; ResCGetHighestCacheIndex@4 ; removed in Windows Vista SP1
1831	; ResCGetHighestConsecutiveCacheIndex@12 ; removed in Windows Vista SP1
1832	; ResCGetIndexedName@20 ; removed in Windows Vista SP1
1833	; ResCGetName@16 ; removed in Windows Vista SP1
1834	; ResCGetRegistryBaseFolder@16 ; removed in Windows Vista SP1
1835	; ResCGetRegistryConfig@8 ; removed in Windows Vista SP1
1836	; ResCGetRegistryLatestIndex@8 ; removed in Windows Vista SP1
1837	; ResCGetRegistryMappingPrefix@16 ; removed in Windows Vista SP1
1838	; ResCGetRegistryStatus@8 ; removed in Windows Vista SP1
1839	; ResCGetSubIndexedName@24 ; removed in Windows Vista SP1
1840	; ResCInitRuntimeView@8 ; removed in Windows Vista SP1
1841	; ResCInitRuntimeViewEx@12 ; removed in Windows Vista SP1
1842	; ResCKeDirectoryOpenMapping@20 ; removed in Windows Vista SP1
1843	; ResCKeGetBaseFolder@8 ; removed in Windows Vista SP1
1844	; ResCKeGetCacheIndices@8 ; removed in Windows Vista SP1
1845	; ResCKeInitRuntimeViewEx@4 ; removed in Windows Vista SP1
1846	; ResCKeSegmentOpenMapping@8 ; removed in Windows Vista SP1
1847	; ResCLoadCultureMap@4 ; removed in Windows Vista SP1
1848	; ResCOpenRegistryKey@24 ; removed in Windows Vista SP1
1849	; ResCOpenRuntimeView@8 ; removed in Windows Vista SP1
1850	; ResCReleaseInitMutex@4 ; removed in Windows Vista SP1
1851	; ResCReloadCultureMap@4 ; removed in Windows Vista SP1
1852	; ResCRequestInitMutex@8 ; removed in Windows Vista SP1
1853	; ResCRuntimeGetAnySegmentData@20 ; removed in Windows Vista SP1
1854	; ResCRuntimeGetCultureID@8 ; removed in Windows Vista SP1
1855	; ResCRuntimeGetEntryData@8 ; removed in Windows Vista SP1
1856	; ResCRuntimeGetEntryDataEx@12 ; removed in Windows Vista SP1
1857	; ResCRuntimeGetResourceData@32 ; removed in Windows Vista SP1
1858	; ResCRuntimeGetResourceDataEx@36 ; removed in Windows Vista SP1
1859	; ResCRuntimeGetResourceDataForCulture@32 ; removed in Windows Vista SP1
1860	; ResCRuntimeGetSegmentData@16 ; removed in Windows Vista SP1
1861	; ResCRuntimeGetSegmentDataEx@20 ; removed in Windows Vista SP1
1862	; ResCRuntimeViewLoadCultureMap@4 ; removed in Windows Vista SP1
1863	; ResCSaveRegistryBaseFolder@8 ; removed in Windows Vista SP1
1864	; ResCSaveRegistryConfig@8 ; removed in Windows Vista SP1
1865	; ResCSaveRegistryLatestIndex@8 ; removed in Windows Vista SP1
1866	; ResCSaveRegistryStatus@8 ; removed in Windows Vista SP1
1867	; ResCSegmentCreateAndPopulate@12 ; removed in Windows Vista SP1
1868	; ResCSegmentCreateMapping@20 ; removed in Windows Vista SP1
1869	; ResCSegmentFree@4 ; removed in Windows Vista SP1
1870	; ResCSegmentGetData@8 ; removed in Windows Vista SP1
1871	; ResCSegmentLoadFixedSize@4 ; removed in Windows Vista SP1
1872	; ResCSegmentOpenMapping@8 ; removed in Windows Vista SP1
1873	; ResCSegmentReserveMapping@16 ; removed in Windows Vista SP1
1874	; ResCSetCacheSecurityType@4 ; removed in Windows Vista SP1
1875	RtlAcquireSRWLockExclusive@4
1876	RtlAcquireSRWLockShared@4
1877	RtlAddMandatoryAce@24
1878	RtlAddSIDToBoundaryDescriptor@8
1879	RtlAllocateMemoryBlockLookaside@12
1880	RtlAllocateMemoryZone@12
1881	RtlBarrier@8
1882	RtlBarrierForDelete@8
1883	RtlCleanUpTEBLangLists@0
1884	RtlCloneUserProcess@20
1885	RtlCmDecodeMemIoResource@8
1886	RtlCmEncodeMemIoResource@24
1887	RtlCommitDebugInfo@8
1888	RtlCompareAltitudes@8
1889	RtlCompareUnicodeStrings@20
1890	RtlConnectToSm@16
1891	RtlConvertLCIDToString@20
1892	RtlCreateBoundaryDescriptor@8
1893	RtlCreateEnvironmentEx@12
1894	RtlCreateMemoryBlockLookaside@20
1895	RtlCreateMemoryZone@12
1896	RtlCreateProcessParametersEx@44
1897	RtlCreateServiceSid@12
1898	RtlCreateUserStack@24
1899	RtlCultureNameToLCID@8
1900	RtlDeCommitDebugInfo@12
1901	RtlDeleteBarrier@4
1902	RtlDeleteBoundaryDescriptor@4
1903	RtlDestroyMemoryBlockLookaside@4
1904	RtlDestroyMemoryZone@4
1905	RtlExitUserProcess@4
1906	RtlExpandEnvironmentStrings@24
1907	RtlExtendMemoryBlockLookaside@8
1908	RtlExtendMemoryZone@8
1909	RtlFindAceByType@12
1910	RtlFindClosestEncodableLength@12
1911	RtlFlsAlloc@8
1912	RtlFlsFree@4
1913	RtlFreeMemoryBlockLookaside@8
1914	RtlFreeUserStack@4
1915	RtlGetCurrentTransaction@0
1916	RtlGetFileMUIPath@28
1917	RtlGetIntegerAtom@8
1918	RtlGetParentLocaleName@16
1919	RtlGetProductInfo@20
1920	RtlGetSystemPreferredUILanguages@20
1921	RtlGetThreadLangIdByIndex@16
1922	RtlGetThreadPreferredUILanguages@16
1923	RtlGetUILanguageInfo@20
1924	RtlGetUnloadEventTraceEx@12
1925	RtlGetUserPreferredUILanguages@20
1926	RtlHeapTrkInitialize@4
1927	RtlIdnToAscii@20
1928	RtlIdnToNameprepUnicode@20
1929	RtlIdnToUnicode@20
1930	RtlImpersonateSelfEx@12
1931	RtlInitBarrier@12
1932	RtlInitializeConditionVariable@4
1933	RtlInitializeCriticalSectionEx@12
1934	RtlInitializeNtUserPfn@24
1935	RtlInitializeSRWLock@4
1936	RtlIoDecodeMemIoResource@16
1937	RtlIoEncodeMemIoResource@40
1938	RtlIsCurrentThreadAttachExempt@0
1939	RtlIsNormalizedString@16
1940	RtlIsValidLocaleName@8
1941	RtlLCIDToCultureName@8
1942	RtlLcidToLocaleName@16
1943	RtlLocaleNameToLcid@12
1944	RtlLockCurrentThread@0
1945	RtlLockMemoryBlockLookaside@4
1946	RtlLockMemoryZone@4
1947	RtlLockModuleSection@4
1948	RtlNormalizeString@20
1949	RtlOwnerAcesPresent@4
1950	RtlProcessFlsData@4 ; Windows Vista-10 has ABI "RtlProcessFlsData@4", Windows 10 May 2019 Update (19H1 / 1903) and new has ABI "RtlProcessFlsData@8"
1951	RtlQueryActivationContextApplicationSettings@28
1952	RtlQueryCriticalSectionOwner@4 ; Windows Vista-8.1 has ABI "RtlQueryCriticalSectionOwner@4", Windows 10 and new has ABI "RtlQueryCriticalSectionOwner@8"
1953	RtlQueryDynamicTimeZoneInformation@4
1954	RtlQueryElevationFlags@4
1955	RtlQueryEnvironmentVariable@24
1956	RtlQueryModuleInformation@12
1957	RtlRegisterThreadWithCsrss@0
1958	RtlReleaseSRWLockExclusive@4
1959	RtlReleaseSRWLockShared@4
1960	RtlRemovePrivileges@12
1961	RtlReportException@12
1962	RtlResetMemoryBlockLookaside@4
1963	RtlResetMemoryZone@4
1964	RtlRetrieveNtUserPfn@12
1965	RtlRunOnceBeginInitialize@12
1966	RtlRunOnceComplete@12
1967	RtlRunOnceExecuteOnce@16
1968	RtlRunOnceInitialize@4
1969	RtlSendMsgToSm@8
1970	RtlSetCurrentTransaction@4
1971	RtlSetDynamicTimeZoneInformation@4
1972	RtlSetEnvironmentVar@20
1973	RtlSetProcessDebugInformation@12
1974	RtlSetThreadPreferredUILanguages@12
1975	RtlSidDominates@12
1976	RtlSidEqualLevel@12
1977	RtlSidHashInitialize@12
1978	RtlSidHashLookup@8
1979	RtlSidIsHigherLevel@12
1980	RtlSleepConditionVariableCS@12
1981	RtlSleepConditionVariableSRW@16
1982	RtlTestBit@8
1983	RtlTryAcquirePebLock@0
1984	RtlUnlockCurrentThread@0
1985	RtlUnlockMemoryBlockLookaside@4
1986	RtlUnlockMemoryZone@4
1987	RtlUnlockModuleSection@4
1988	RtlUpdateClonedCriticalSection@4
1989	RtlUpdateClonedSRWLock@8
1990	RtlUserThreadStart@8
1991	RtlWakeAllConditionVariable@4
1992	RtlWakeConditionVariable@4
1993	RtlWerpReportException@16 ; Windows Vista-8 has ABI "RtlWerpReportException@16", Windows 8.1 and new has ABI "RtlWerpReportException@24"
1994	RtlWow64CallFunction64@28
1995	RtlWow64LogMessageInEventLogger@12 ; available only in 32-bit WoW64 version on 64-bit system
1996	RtlpCleanupRegistryKeys@0
1997	RtlpConvertCultureNamesToLCIDs@8
1998	RtlpConvertLCIDsToCultureNames@8
1999	RtlpCreateProcessRegistryInfo@4
2000	RtlpGetLCIDFromLangInfoNode@12
2001	RtlpGetNameFromLangInfoNode@12
2002	RtlpGetSystemDefaultUILanguage@4 ; Windows Vista has ABI "RtlpGetSystemDefaultUILanguage@4", Windows 7 and new has ABI "RtlpGetSystemDefaultUILanguage@8"
2003	RtlpGetUserOrMachineUILanguage4NLS@12
2004	RtlpInitializeLangRegistryInfo@4
2005	RtlpIsQualifiedLanguage@12
2006	RtlpLoadMachineUIByPolicy@12
2007	RtlpLoadUserUIByPolicy@12
2008	RtlpMuiFreeLangRegistryInfo@4
2009	RtlpMuiRegCreateRegistryInfo@0
2010	RtlpMuiRegFreeRegistryInfo@8
2011	RtlpMuiRegLoadRegistryInfo@8
2012	RtlpQueryDefaultUILanguage@8
2013	RtlpQueryProcessDebugInformationRemote@4 ; available only in 32-bit WoW64 version on 64-bit system, since Windows 10 Creators Update (Redstone 2 / 1703) available also in non-WoW64 version
2014	RtlpRefreshCachedUILanguage@8
2015	RtlpSetInstallLanguage@8
2016	RtlpSetPreferredUILanguages@12
2017	RtlpSetUserPreferredUILanguages@12
2018	RtlpVerifyAndCommitUILanguageSettings@4
2019	ShipAssert@8
2020	ShipAssertGetBufferInfo@8
2021	ShipAssertMsgA@12
2022	ShipAssertMsgW@12
2023	TpAllocAlpcCompletion@20
2024	TpAllocCleanupGroup@4
2025	TpAllocIoCompletion@20
2026	TpAllocPool@8
2027	TpAllocTimer@16
2028	TpAllocWait@16
2029	TpAllocWork@16
2030	TpCallbackLeaveCriticalSectionOnCompletion@8
2031	TpCallbackMayRunLong@4
2032	TpCallbackReleaseMutexOnCompletion@8
2033	TpCallbackReleaseSemaphoreOnCompletion@12
2034	TpCallbackSetEventOnCompletion@8
2035	TpCallbackUnloadDllOnCompletion@8
2036	TpCancelAsyncIoOperation@4
2037	TpCaptureCaller@4
2038	TpCheckTerminateWorker@4
2039	TpDbgDumpHeapUsage@12
2040	TpDbgSetLogRoutine@4
2041	TpDisassociateCallback@4
2042	TpIsTimerSet@4
2043	TpPostWork@4
2044	TpReleaseAlpcCompletion@4
2045	TpReleaseCleanupGroup@4
2046	TpReleaseCleanupGroupMembers@12
2047	TpReleaseIoCompletion@4
2048	TpReleasePool@4
2049	TpReleaseTimer@4
2050	TpReleaseWait@4
2051	TpReleaseWork@4
2052	TpSetPoolMaxThreads@8
2053	TpSetPoolMinThreads@8
2054	TpSetTimer@16
2055	TpSetWait@12
2056	TpSimpleTryPost@12
2057	TpStartAsyncIoOperation@4
2058	TpWaitForAlpcCompletion@4
2059	TpWaitForIoCompletion@8
2060	TpWaitForTimer@8
2061	TpWaitForWait@8
2062	TpWaitForWork@8
2063	WerCheckEventEscalation@8 ; removed in Windows 7
2064	WerReportSQMEvent@16 ; Windows Vista has ABI "WerReportSQMEvent@12", Windows 7 and new has ABI "WerReportSQMEvent@16"
2065	WerReportWatsonEvent@16 ; removed in Windows 7
2066	WinSqmAddToStream@16
2067	WinSqmEndSession@4
2068	WinSqmEventEnabled@8
2069	WinSqmEventWrite@12
2070	WinSqmIsOptedIn@0
2071	WinSqmSetString@12
2072	WinSqmStartSession@12
2073	ZwAcquireCMFViewOwnership@12 ; removed in Windows 7
2074	ZwAlpcAcceptConnectPort@36
2075	ZwAlpcCancelMessage@12
2076	ZwAlpcConnectPort@44
2077	ZwAlpcCreatePort@12
2078	ZwAlpcCreatePortSection@24
2079	ZwAlpcCreateResourceReserve@16
2080	ZwAlpcCreateSectionView@12
2081	ZwAlpcCreateSecurityContext@12
2082	ZwAlpcDeletePortSection@12
2083	ZwAlpcDeleteResourceReserve@12
2084	ZwAlpcDeleteSectionView@12
2085	ZwAlpcDeleteSecurityContext@12
2086	ZwAlpcDisconnectPort@8
2087	ZwAlpcImpersonateClientOfPort@12
2088	ZwAlpcOpenSenderProcess@24
2089	ZwAlpcOpenSenderThread@24
2090	ZwAlpcQueryInformation@20
2091	ZwAlpcQueryInformationMessage@24
2092	ZwAlpcRevokeSecurityContext@12
2093	ZwAlpcSendWaitReceivePort@32
2094	ZwAlpcSetInformation@16
2095	ZwCancelIoFileEx@12
2096	ZwCancelSynchronousIoFile@12
2097	; ZwClearAllSavepointsTransaction@4 ; removed in Windows Vista SP1
2098	; ZwClearSavepointTransaction@8 ; removed in Windows Vista SP1
2099	ZwCommitComplete@8
2100	ZwCommitEnlistment@8
2101	ZwCommitTransaction@8
2102	ZwCreateEnlistment@32
2103	ZwCreateKeyTransacted@32
2104	ZwCreatePrivateNamespace@16
2105	ZwCreateResourceManager@28
2106	ZwCreateThreadEx@44
2107	ZwCreateTransaction@40
2108	ZwCreateTransactionManager@24
2109	ZwCreateUserProcess@44
2110	ZwCreateWorkerFactory@40
2111	ZwDeletePrivateNamespace@4
2112	ZwEnumerateTransactionObject@20
2113	ZwFlushInstallUILanguage@8
2114	ZwFlushProcessWriteBuffers@0
2115	ZwFreezeRegistry@4
2116	ZwFreezeTransactions@8
2117	ZwGetMUIRegistryInfo@12
2118	ZwGetNextProcess@20
2119	ZwGetNextThread@24
2120	ZwGetNlsSectionPtr@20
2121	ZwGetNotificationResourceManager@28
2122	ZwInitializeNlsFiles@16 ; Windows Vista has ABI "ZwInitializeNlsFiles@12", Windows Vista SP1 and SP2 has ABI "ZwInitializeNlsFiles@16", Windows 7 and new has again ABI "ZwInitializeNlsFiles@12"
2123	ZwIsUILanguageComitted@0
2124	; ZwListTransactions@12 ; removed in Windows Vista SP1
2125	ZwMapCMFModule@24
2126	; ZwMarshallTransaction@24 ; removed in Windows Vista SP1
2127	ZwOpenEnlistment@20
2128	ZwOpenKeyTransacted@16
2129	ZwOpenPrivateNamespace@16
2130	ZwOpenResourceManager@20
2131	ZwOpenSession@12
2132	ZwOpenTransaction@20
2133	ZwOpenTransactionManager@24
2134	ZwPrePrepareComplete@8
2135	ZwPrePrepareEnlistment@8
2136	ZwPrepareComplete@8
2137	ZwPrepareEnlistment@8
2138	ZwPropagationComplete@16
2139	ZwPropagationFailed@12
2140	; ZwPullTransaction@28 ; removed in Windows Vista SP1
2141	ZwQueryInformationEnlistment@20
2142	ZwQueryInformationResourceManager@20
2143	ZwQueryInformationTransaction@20
2144	ZwQueryInformationTransactionManager@20
2145	ZwQueryInformationWorkerFactory@20
2146	ZwQueryLicenseValue@20
2147	ZwReadOnlyEnlistment@8
2148	ZwRecoverEnlistment@8
2149	ZwRecoverResourceManager@4
2150	ZwRecoverTransactionManager@4
2151	ZwRegisterProtocolAddressInformation@20
2152	ZwReleaseCMFViewOwnership@0 ; removed in Windows 7
2153	ZwReleaseWorkerFactoryWorker@4
2154	ZwRemoveIoCompletionEx@24
2155	ZwRollbackComplete@8
2156	ZwRollbackEnlistment@8
2157	; ZwRollbackSavepointTransaction@8 ; removed in Windows Vista SP1
2158	ZwRollbackTransaction@8
2159	ZwRollforwardTransactionManager@8
2160	; ZwSavepointComplete@8 ; removed in Windows Vista SP1
2161	; ZwSavepointTransaction@12 ; removed in Windows Vista SP1
2162	ZwSetInformationEnlistment@16
2163	ZwSetInformationResourceManager@16
2164	ZwSetInformationTransaction@16
2165	ZwSetInformationTransactionManager@16
2166	ZwSetInformationWorkerFactory@16
2167	ZwShutdownWorkerFactory@8
2168	ZwSinglePhaseReject@8
2169	; ZwStartTm@0 ; removed in Windows Vista SP1
2170	ZwThawRegistry@0
2171	ZwThawTransactions@0
2172	ZwTraceControl@24
2173	ZwWaitForWorkViaWorkerFactory@8 ; Windows Vista-7 has ABI "ZwWaitForWorkViaWorkerFactory@8", Windows 8 has ABI "ZwWaitForWorkViaWorkerFactory@16", Windows 8.1 and new has ABI "ZwWaitForWorkViaWorkerFactory@20"
2174	ZwWorkerFactoryWorkerReady@4
2175	ZwWow64CallFunction64@28 ; available only in 32-bit WoW64 version on 64-bit system
2176	ZwWow64CsrVerifyRegion@8 ; available only in 32-bit WoW64 version on 64-bit system
2177	ZwWow64WriteVirtualMemory64@28 ; available only in 32-bit WoW64 version on 64-bit system
2178	; _ResCGetRegistryFlags@16 ; removed in Windows Vista SP1
2179	; _ResCMatchFlags@12 ; removed in Windows Vista SP1
2180	; _ResCSaveRegistryFlags@16 ; removed in Windows Vista SP1
2181
2182	; This is list of symbols added in Windows Vista SP1
2183	LdrpResGetMappingSize@16
2184	LdrpResGetRCConfig@20 ; removed in Windows 7
2185	LdrpResGetResourceDirectory@20
2186	NtRenameTransactionManager@8
2187	NtReplacePartitionUnit@12
2188	NtdllDefWindowProc_A@16 ; same as user32.DefWindowProcA
2189	NtdllDefWindowProc_W@16 ; same as user32.DefWindowProcW
2190	NtdllDialogWndProc_A@16 ; same as user32.DefDlgProcA
2191	NtdllDialogWndProc_W@16 ; same as user32.DefDlgProcW
2192	RtlDeregisterSecureMemoryCacheCallback@4
2193	RtlInitializeExceptionChain@4
2194	RtlNumberOfSetBitsUlongPtr@4
2195	RtlpCheckDynamicTimeZoneInformation@8
2196	ZwRenameTransactionManager@8
2197	ZwReplacePartitionUnit@12
2198
2199	; This is list of symbols added in Windows Vista SP2
2200	RtlpInterlockedPopEntrySeqSListEnd@0 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 7
2201	RtlpInterlockedPopEntrySeqSListFault@0 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 7
2202	RtlpInterlockedPopEntrySeqSListResume@0 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 7
2203
2204	; This is list of symbols added in Windows 7
2205	AlpcRundownCompletionList@4
2206	EtwEventWriteEx@40
2207	EtwEventWriteNoRegistration@16
2208	EvtIntReportAuthzEventAndSourceAsync@44
2209	EvtIntReportEventAndSourceAsync@44
2210	LdrGetDllHandleByMapping@8
2211	LdrGetDllHandleByName@12
2212	LdrResGetRCConfig@20
2213	LdrRscIsTypeExist@16
2214	LdrWx86FormatVirtualImage@12 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 10 Creators Update (Redstone 2 / 1703)
2215	NtAllocateReserveObject@12
2216	NtCreateProfileEx@40
2217	NtDisableLastKnownGood@0
2218	NtDrawText@4
2219	NtEnableLastKnownGood@0
2220	NtNotifyChangeSession@32
2221	NtOpenKeyEx@16
2222	NtOpenKeyTransactedEx@20
2223	NtQuerySecurityAttributesToken@24
2224	NtQuerySystemInformationEx@24
2225	NtQueueApcThreadEx@24
2226	NtSerializeBoot@0
2227	NtSetIoCompletionEx@24
2228	NtSetTimerEx@16
2229	NtUmsThreadYield@4
2230	NtWow64GetCurrentProcessorNumberEx@4 ; available only in 32-bit WoW64 version on 64-bit system
2231	NtWow64InterlockedPopEntrySList@4 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 8
2232	RtlAcquireReleaseSRWLockExclusive@4
2233	RtlAddIntegrityLabelToBoundaryDescriptor@8
2234	RtlContractHashTable@4
2235	RtlCopyExtendedContext@12
2236	RtlCreateHashTable@12
2237	RtlCreateProcessReflection@24
2238	RtlCreateVirtualAccountSid@16
2239	RtlDeleteHashTable@4
2240	RtlDetectHeapLeaks@0
2241	RtlDisableThreadProfiling@4
2242	RtlEnableThreadProfiling@20
2243	RtlEndEnumerationHashTable@8
2244	RtlEndWeakEnumerationHashTable@8
2245	RtlEnumerateEntryHashTable@8
2246	RtlEthernetAddressToStringA@8
2247	RtlEthernetAddressToStringW@8
2248	RtlEthernetStringToAddressA@12
2249	RtlEthernetStringToAddressW@12
2250	RtlExpandHashTable@4
2251	RtlFillMemoryUlonglong@16
2252	RtlGetCurrentProcessorNumberEx@4
2253	RtlGetEnabledExtendedFeatures@8
2254	RtlGetExtendedContextLength@8
2255	RtlGetExtendedFeaturesMask@4
2256	RtlGetFullPathName_UEx@20
2257	RtlGetLocaleFileMappingAddress@12
2258	RtlGetNextEntryHashTable@8
2259	RtlGetProcessPreferredUILanguages@16
2260	RtlInitEnumerationHashTable@8
2261	RtlInitWeakEnumerationHashTable@8
2262	RtlInitializeExtendedContext@12
2263	RtlInsertEntryHashTable@16
2264	RtlInterlockedClearBitRun@12
2265	RtlInterlockedSetBitRun@12
2266	RtlIsNameInExpression@16
2267	RtlKnownExceptionFilter@4
2268	RtlLoadString@32
2269	RtlLocateExtendedFeature@12
2270	RtlLocateLegacyContext@8
2271	RtlLookupEntryHashTable@12
2272	RtlQueryPerformanceCounter@4
2273	RtlQueryPerformanceFrequency@4
2274	RtlQueryThreadProfiling@8
2275	RtlReadThreadProfilingData@12
2276	RtlRemoveEntryHashTable@12
2277	RtlReplaceSidInSd@16
2278	RtlReportSilentProcessExit@8
2279	RtlReportSqmEscalation@24
2280	RtlSetExtendedFeaturesMask@12
2281	RtlSetProcessPreferredUILanguages@12
2282	RtlSetUserCallbackExceptionFilter@4 ; available only in 32-bit WoW64 version on 64-bit system
2283	RtlTryAcquireSRWLockExclusive@4
2284	RtlTryAcquireSRWLockShared@4
2285	RtlUTF8ToUnicodeN@20
2286	RtlUnicodeToUTF8N@20
2287	RtlWeaklyEnumerateEntryHashTable@8
2288	SbExecuteProcedure@20
2289	SbSelectProcedure@16
2290	TpAllocAlpcCompletionEx@20
2291	TpAlpcRegisterCompletionList@4
2292	TpAlpcUnregisterCompletionList@4
2293	TpCallbackIndependent@4
2294	TpDbgGetFreeInfo@8 ; removed in Windows 8
2295	TpDisablePoolCallbackChecks@4
2296	TpPoolFreeUnusedNodes@4 ; removed in Windows 8
2297	TpQueryPoolStackInformation@8
2298	TpSetDefaultPoolMaxThreads@4
2299	TpSetDefaultPoolStackInformation@4
2300	TpSetPoolStackInformation@8
2301	WinSqmAddToAverageDWORD@12
2302	WinSqmAddToStreamEx@20
2303	WinSqmCheckEscalationAddToStreamEx@20
2304	WinSqmCheckEscalationSetDWORD64@20
2305	WinSqmCheckEscalationSetDWORD@16
2306	WinSqmCheckEscalationSetString@16
2307	WinSqmCommonDatapointDelete@4
2308	WinSqmCommonDatapointSetDWORD64@16
2309	WinSqmCommonDatapointSetDWORD@12
2310	WinSqmCommonDatapointSetStreamEx@20
2311	WinSqmCommonDatapointSetString@12
2312	WinSqmGetEscalationRuleStatus@8
2313	WinSqmGetInstrumentationProperty@16
2314	WinSqmIncrementDWORD@12
2315	WinSqmIsOptedInEx@4
2316	WinSqmSetDWORD64@16
2317	WinSqmSetDWORD@12
2318	WinSqmSetEscalationInfo@16
2319	WinSqmSetIfMaxDWORD@12
2320	WinSqmSetIfMinDWORD@12
2321	ZwAllocateReserveObject@12
2322	ZwCreateProfileEx@40
2323	ZwDisableLastKnownGood@0
2324	ZwDrawText@4
2325	ZwEnableLastKnownGood@0
2326	ZwNotifyChangeSession@32
2327	ZwOpenKeyEx@16
2328	ZwOpenKeyTransactedEx@20
2329	ZwQuerySecurityAttributesToken@24
2330	ZwQuerySystemInformationEx@24
2331	ZwQueueApcThreadEx@24
2332	ZwSerializeBoot@0
2333	ZwSetIoCompletionEx@24
2334	ZwSetTimerEx@16
2335	ZwUmsThreadYield@4
2336	ZwWow64GetCurrentProcessorNumberEx@4 ; available only in 32-bit WoW64 version on 64-bit system
2337	ZwWow64InterlockedPopEntrySList@4 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 10 (Threshold / 1507)
2338
2339	; This is list of ordinal-only symbols added in Windows 7
2340	; Symbol names are taken from:
2341	; https://www.geoffchappell.com/studies/windows/win32/ntdll/history/ords61.htm
2342	; AitLogFeatureUsageByApp@4 @1 NONAME ; removed in Windows 10 (Threshold / 1507)
2343	; AitFireParentUsageEvent@16 @2 NONAME ; removed in Windows 10 (Threshold / 1507)
2344	; SbtLogSystemUsageByParent@32 @3 NONAME ; removed in Windows 10 (Threshold / 1507)
2345	; SbtLogSystemUsageByStack@28 @4 NONAME ; FIXME: Windows 7 has ABI @28, Windows 8 and 8.1 has ABI @20, removed in Windows 10 (Threshold / 1507)
2346	; SbtDisableForCurrentProcess@0 @5 NONAME ; removed in Windows 10 (Threshold / 1507)
2347	; SbtLogDllMapping@8 @6 NONAME ; FIXME: Windows 7 has ABI @8, Windows 8 and 8.1 has ABI @0, removed in Windows 10 (Threshold / 1507)
2348	; SbtLogExeInitializing@0 @7 NONAME ; removed in Windows 10 (Threshold / 1507)
2349	; RtlDispatchAPC@12 @8 NONAME ; since Windows 10 Creators Update (Redstone 2 / 1703) available as normal symbol
2350
2351	; This is list of symbols added in Windows 7 SP1
2352	RtlCopyContext@12
2353
2354	; This is list of symbols added in Windows 8
2355	ApiSetQueryApiSetPresence@8
2356	EtwEventSetInformation@20
2357	LdrAddDllDirectory@8
2358	LdrAppxHandleIntegrityFailure@4
2359	LdrGetDllDirectory@4
2360	LdrGetDllFullName@8
2361	LdrGetDllPath@16
2362	LdrGetProcedureAddressForCaller@24
2363	LdrProcessRelocationBlockEx@20
2364	LdrQueryOptionalDelayLoadedAPI@16
2365	LdrRemoveDllDirectory@4
2366	LdrResolveDelayLoadedAPI@24
2367	LdrResolveDelayLoadsFromDll@12
2368	LdrSetDefaultDllDirectories@4
2369	LdrSetDllDirectory@4
2370	LdrStandardizeSystemPath@4
2371	LdrSystemDllInitBlock DATA
2372	NtAddAtomEx@16
2373	NtAdjustTokenClaimsAndDeviceGroups@64
2374	NtAlertThreadByThreadId@4
2375	NtAlpcConnectPortEx@44
2376	NtAssociateWaitCompletionPacket@32
2377	NtCancelWaitCompletionPacket@8
2378	NtCreateDirectoryObjectEx@20
2379	NtCreateIRTimer@12 ; Windows 8-10 has ABI "NtCreateIRTimer@8", Windows 10 Creators Update (Redstone 2 / 1703) and new has ABI "NtCreateIRTimer@12"
2380	NtCreateLowBoxToken@36
2381	NtCreateTokenEx@68
2382	NtCreateWaitCompletionPacket@12
2383	NtCreateWnfStateName@28
2384	NtDeleteWnfStateData@8
2385	NtDeleteWnfStateName@4
2386	NtFilterBootOption@20
2387	NtFilterTokenEx@56
2388	NtFlushBuffersFileEx@20
2389	NtGetCachedSigningLevel@24
2390	NtQueryWnfStateData@24
2391	NtQueryWnfStateNameInformation@20
2392	NtSetCachedSigningLevel@20
2393	NtSetIRTimer@8
2394	NtSetInformationVirtualMemory@24
2395	NtSubscribeWnfStateChange@16
2396	NtUnmapViewOfSectionEx@12
2397	NtUnsubscribeWnfStateChange@4
2398	NtUpdateWnfStateData@28
2399	NtWaitForAlertByThreadId@8
2400	; NtWaitForWnfNotifications@8 ; removed in Windows 8.1
2401	; NtWow64AllocateVirtualMemory64@28 ; available only in 32-bit WoW64 version on 64-bit system
2402	RtlAddResourceAttributeAce@28
2403	RtlAddScopedPolicyIDAce@20
2404	RtlAllocateWnfSerializationGroup@0
2405	RtlAppxIsFileOwnedByTrustedInstaller@8
2406	RtlAvlInsertNodeEx@16
2407	RtlAvlRemoveNode@8
2408	RtlCanonicalizeDomainName@12
2409	RtlCheckPortableOperatingSystem@4
2410	RtlCheckTokenCapability@12
2411	RtlCheckTokenMembership@12
2412	RtlCheckTokenMembershipEx@16
2413	RtlClearBit@8
2414	RtlCopyBitMap@12
2415	RtlCrc32@12
2416	RtlCrc64@16
2417	RtlCreateHashTableEx@16
2418	RtlDecompressBufferEx@28
2419	RtlDeleteElementGenericTableAvlEx@8
2420	RtlEqualWnfChangeStamps@8
2421	RtlExtractBitMap@16
2422	RtlFlushHeaps@0
2423	RtlGetAppContainerNamedObjectPath@16
2424	RtlGetExePath@8
2425	RtlGetSearchPath@4
2426	RtlGetSystemTimePrecise@0
2427	RtlInterlockedPushListSListEx@16
2428	RtlIsCapabilitySid@4
2429	RtlIsPackageSid@4
2430	RtlIsUntrustedObject@12
2431	RtlLengthSidAsUnicodeString@8
2432	RtlNumberOfClearBitsInRange@12
2433	RtlNumberOfSetBitsInRange@12
2434	RtlPublishWnfStateData@24
2435	RtlQueryPackageIdentity@24
2436	RtlQueryRegistryValuesEx@20
2437	RtlQueryUnbiasedInterruptTime@4
2438	RtlQueryValidationRunlevel@4
2439	RtlQueryWnfMetaNotification@20
2440	RtlQueryWnfStateData@24
2441	RtlQueryWnfStateDataWithExplicitScope@28
2442	RtlRbInsertNodeEx@16
2443	RtlRbRemoveNode@8
2444	RtlRegisterForWnfMetaNotification@24
2445	RtlReleasePath@4
2446	RtlResetNtUserPfn@0
2447	RtlSetBit@8
2448	RtlSetPortableOperatingSystem@4
2449	RtlSetSearchPathMode@4
2450	RtlSubscribeWnfStateChangeNotification@36
2451	RtlTestAndPublishWnfStateData@28
2452	RtlTryConvertSRWLockSharedToExclusiveOrRelease@4
2453	RtlUnsubscribeWnfNotificationWaitForCompletion@4
2454	RtlUnsubscribeWnfNotificationWithCompletionCallback@12
2455	RtlUnsubscribeWnfStateChangeNotification@4
2456	RtlWaitForWnfMetaNotification@24
2457	RtlWaitOnAddress@16
2458	RtlWakeAddressAll@4
2459	RtlWakeAddressAllNoFence@4
2460	RtlWakeAddressSingle@4
2461	RtlWakeAddressSingleNoFence@4
2462	RtlWnfCompareChangeStamp@8 ; removed in Windows 11 2024 Update (Hudson Valley / 24H2)
2463	RtlWnfDllUnloadCallback@4
2464	RtlpConvertAbsoluteToRelativeSecurityAttribute@12
2465	RtlpConvertRelativeToAbsoluteSecurityAttribute@16
2466	RtlpFreezeTimeBias DATA
2467	RtlpMergeSecurityAttributeInformation@16
2468	; RtlpWnfNotificationThread@16 ; removed in Windows 8.1
2469	TpAllocJobNotification@20
2470	TpCallbackDetectedUnrecoverableError@4
2471	TpReleaseJobNotification@4
2472	TpSetPoolThreadBasePriority@8
2473	TpSetTimerEx@16
2474	TpSetWaitEx@16
2475	TpTimerOutstandingCallbackCount@4
2476	TpWaitForJobNotification@4
2477	WinSqmIsSessionDisabled@4
2478	ZwAddAtomEx@16
2479	ZwAdjustTokenClaimsAndDeviceGroups@64
2480	ZwAlertThreadByThreadId@4
2481	ZwAlpcConnectPortEx@44
2482	ZwAssociateWaitCompletionPacket@32
2483	ZwCancelWaitCompletionPacket@8
2484	ZwCreateDirectoryObjectEx@20
2485	ZwCreateIRTimer@12 ; Windows 8-10 has ABI "ZwCreateIRTimer@8", Windows 10 Creators Update (Redstone 2 / 1703) and new has ABI "ZwCreateIRTimer@12"
2486	ZwCreateLowBoxToken@36
2487	ZwCreateTokenEx@68
2488	ZwCreateWaitCompletionPacket@12
2489	ZwCreateWnfStateName@28
2490	ZwDeleteWnfStateData@8
2491	ZwDeleteWnfStateName@4
2492	ZwFilterBootOption@20
2493	ZwFilterTokenEx@56
2494	ZwFlushBuffersFileEx@20
2495	ZwGetCachedSigningLevel@24
2496	ZwQueryWnfStateData@24
2497	ZwQueryWnfStateNameInformation@20
2498	ZwSetCachedSigningLevel@20
2499	ZwSetIRTimer@8
2500	ZwSetInformationVirtualMemory@24
2501	ZwSubscribeWnfStateChange@16
2502	ZwUnmapViewOfSectionEx@12
2503	ZwUnsubscribeWnfStateChange@4
2504	ZwUpdateWnfStateData@28
2505	ZwWaitForAlertByThreadId@8
2506	; ZwWaitForWnfNotifications@8 ; removed in Windows 8.1
2507	; ZwWow64AllocateVirtualMemory64@28 ; available only in 32-bit WoW64 version on 64-bit system
2508
2509	; This is list of symbols added in Windows 8.1
2510	LdrSetImplicitPathOptions@8
2511	NtCancelTimer2@8
2512	NtCreateTimer2@20
2513	NtGetCompleteWnfStateSubscription@24
2514	NtSetTimer2@16
2515	NtSetWnfProcessNotificationEvent@4
2516	PssNtCaptureSnapshot@16
2517	PssNtDuplicateSnapshot@20
2518	PssNtFreeRemoteSnapshot@8
2519	PssNtFreeSnapshot@4
2520	PssNtFreeWalkMarker@4
2521	PssNtQuerySnapshot@16
2522	PssNtValidateDescriptor@8
2523	PssNtWalkSnapshot@20
2524	RtlAddProcessTrustLabelAce@24
2525	RtlAllocateAndInitializeSidEx@16
2526	RtlGetAppContainerParent@8
2527	RtlGetAppContainerSidType@8
2528	RtlIsParentOfChildAppContainer@8
2529	RtlIsValidProcessTrustLabelSid@4
2530	RtlQueryPackageIdentityEx@28
2531	RtlSidDominatesForTrust@12
2532	RtlStringFromGUIDEx@12
2533	RtlTestProtectedAccess@8
2534	RtlValidProcessProtection@4
2535	TpCallbackSendAlpcMessageOnCompletion@16
2536	TpCallbackSendPendingAlpcMessage@4
2537	WinSqmStartSessionForPartner@16
2538	ZwCancelTimer2@8
2539	ZwCreateTimer2@20
2540	ZwGetCompleteWnfStateSubscription@24
2541	ZwSetTimer2@16
2542	ZwSetWnfProcessNotificationEvent@4
2543
2544	; This is list of symbols added in Windows 10 (Threshold / 1507)
2545	DbgUiConvertStateChangeStructureEx@8
2546	LdrFastFailInLoaderCallout@0
2547	NtAlpcImpersonateClientContainerOfPort@12
2548	NtCompareObjects@8
2549	NtCreatePartition@16 ; Windows 10 has ABI "NtCreatePartition@20", Windows 10 November Update (Threshold 2 / 1511) and new has ABI "NtCreatePartition@16"
2550	NtGetCurrentProcessorNumberEx@4
2551	NtManagePartition@20
2552	NtOpenPartition@12
2553	NtRevertContainerImpersonation@0
2554	NtSetInformationSymbolicLink@16
2555	; NtWow64IsProcessorFeaturePresent@4 ; available only in 32-bit WoW64 version on 64-bit system
2556	RtlCapabilityCheck@12
2557	RtlCheckSandboxedToken@8
2558	RtlConvertDeviceFamilyInfoToString@16
2559	RtlConvertSRWLockExclusiveToShared@4
2560	RtlDecodeRemotePointer@12
2561	RtlDeriveCapabilitySidsFromName@12
2562	RtlEncodeRemotePointer@12
2563	RtlEndStrongEnumerationHashTable@8
2564	RtlFindUnicodeSubstring@12
2565	RtlGetDeviceFamilyInfoEnum@12
2566	RtlGetInterruptTimePrecise@4
2567	RtlInitStringEx@8
2568	RtlInitStrongEnumerationHashTable@8
2569	RtlInitializeSidEx@0
2570	RtlIsMultiSessionSku@0
2571	RtlIsProcessorFeaturePresent@4
2572	RtlOsDeploymentState@4
2573	RtlQueryPackageClaims@32 ; Windows 10 has ABI "RtlQueryPackageClaims@28", Windows 10 Anniversary Update (Redstone / 1607) and new has ABI "RtlQueryPackageClaims@32"
2574	RtlQueryProtectedPolicy@8
2575	RtlQueryResourcePolicy@16
2576	RtlSetProtectedPolicy@12
2577	RtlSetThreadSubProcessTag@4
2578	RtlStronglyEnumerateEntryHashTable@8
2579	RtlSwitchedVVI@16
2580	RtlpGetDeviceFamilyInfoEnum@12
2581	TpSetPoolMaxThreadsSoftLimit@8
2582	TpSetPoolWorkerThreadIdleTimeout@12
2583	TpTrimPools@0
2584	WinSqmStartSqmOptinListener@0
2585	ZwAlpcImpersonateClientContainerOfPort@12
2586	ZwCompareObjects@8
2587	ZwCreatePartition@16 ; Windows 10 has ABI "ZwCreatePartition@20", Windows 10 November Update (Threshold 2 / 1511) and new has ABI "ZwCreatePartition@16"
2588	ZwGetCurrentProcessorNumberEx@4
2589	ZwManagePartition@20
2590	ZwOpenPartition@12
2591	ZwRevertContainerImpersonation@0
2592	ZwSetInformationSymbolicLink@16
2593	; ZwWow64IsProcessorFeaturePresent@4 ; available only in 32-bit WoW64 version on 64-bit system
2594
2595	; This is list of symbols added in Windows 10 November Update (Threshold 2 / 1511)
2596	NtCreateEnclave@36
2597	NtInitializeEnclave@20
2598	NtLoadEnclaveData@36
2599	RtlGetCurrentServiceSessionId@0
2600	RtlWow64GetCurrentMachine@0
2601	ZwCreateEnclave@36
2602	ZwInitializeEnclave@20
2603	ZwLoadEnclaveData@36
2604
2605	; This is list of symbols added in Windows 10 Anniversary Update (Redstone / 1607)
2606	NtCommitRegistryTransaction@8
2607	NtCreateRegistryTransaction@16
2608	NtOpenRegistryTransaction@12
2609	NtQuerySecurityPolicy@24
2610	NtRollbackRegistryTransaction@8
2611	NtSetCachedSigningLevel2@24
2612	RtlAreLongPathsEnabled@0
2613	RtlCheckBootStatusIntegrity@8
2614	RtlClearThreadWorkOnBehalfTicket@0
2615	RtlFindExportedRoutineByName@8
2616	RtlGetActiveConsoleId@0
2617	RtlGetConsoleSessionForegroundProcessId@0
2618	RtlGetSuiteMask@0
2619	RtlGetThreadWorkOnBehalfTicket@8
2620	RtlGuardCheckLongJumpTarget@12
2621	; RtlIsLongPathAwareProcessByManifest@0 ; removed in Windows 10 Creators Update (Redstone 2 / 1703)
2622	RtlIsMultiUsersInSessionSku@0
2623	RtlLocateExtendedFeature2@16
2624	RtlReplaceSystemDirectoryInPath@16
2625	RtlReportExceptionEx@20
2626	RtlRestoreBootStatusDefaults@4
2627	RtlSetThreadWorkOnBehalfTicket@4
2628	; RtlSparseBitmapCtxAreAllClear@20 ; removed in Windows 10 Creators Update (Redstone 2 / 1703)
2629	; RtlSparseBitmapCtxAreAllSet@20 ; removed in Windows 10 Creators Update (Redstone 2 / 1703)
2630	; RtlSparseBitmapCtxCheckBit@12 ; removed in Windows 10 Creators Update (Redstone 2 / 1703)
2631	; RtlSparseBitmapCtxCleanup@4 ; removed in Windows 10 Creators Update (Redstone 2 / 1703)
2632	; RtlSparseBitmapCtxClearBits@24 ; removed in Windows 10 Creators Update (Redstone 2 / 1703)
2633	; RtlSparseBitmapCtxClearBitsEx@32 ; removed in Windows 10 Creators Update (Redstone 2 / 1703)
2634	; RtlSparseBitmapCtxCountBitsSet@4 ; removed in Windows 10 Creators Update (Redstone 2 / 1703)
2635	; RtlSparseBitmapCtxFindNextBitSet@12 ; removed in Windows 10 Creators Update (Redstone 2 / 1703)
2636	; RtlSparseBitmapCtxFindSetRuns@36 ; removed in Windows 10 Creators Update (Redstone 2 / 1703)
2637	; RtlSparseBitmapCtxInitialize@4 ; removed in Windows 10 Creators Update (Redstone 2 / 1703)
2638	; RtlSparseBitmapCtxMetadataForBit@16 ; removed in Windows 10 Creators Update (Redstone 2 / 1703)
2639	; RtlSparseBitmapCtxOrBitmap@8 ; removed in Windows 10 Creators Update (Redstone 2 / 1703)
2640	; RtlSparseBitmapCtxPrepareBits@20 ; removed in Windows 10 Creators Update (Redstone 2 / 1703)
2641	; RtlSparseBitmapCtxSetBits@24 ; removed in Windows 10 Creators Update (Redstone 2 / 1703)
2642	; RtlSparseBitmapCtxSetBitsEx@32 ; removed in Windows 10 Creators Update (Redstone 2 / 1703)
2643	; RtlSparseBitmapCtxStart@8 ; removed in Windows 10 Creators Update (Redstone 2 / 1703)
2644	; RtlSparseBitmapCtxSubtractBitmap@12 ; removed in Windows 10 Creators Update (Redstone 2 / 1703)
2645	; RtlSparseBitmapEnumerateBitmap@12 ; removed in Windows 10 Creators Update (Redstone 2 / 1703)
2646	RtlWow64GetProcessMachines@12
2647	RtlWow64IsWowGuestMachineSupported@8
2648	; Wow64Transition DATA ; available only in 32-bit WoW64 version on 64-bit system
2649	ZwCommitRegistryTransaction@8
2650	ZwCreateRegistryTransaction@16
2651	ZwOpenRegistryTransaction@12
2652	ZwQuerySecurityPolicy@24
2653	ZwRollbackRegistryTransaction@8
2654	ZwSetCachedSigningLevel2@24
2655
2656	; This is list of symbols added in Windows 10 Creators Update (Redstone 2 / 1703)
2657	LdrParentInterlockedPopEntrySList DATA
2658	LdrParentRtlInitializeNtUserPfn DATA
2659	LdrParentRtlResetNtUserPfn DATA
2660	LdrParentRtlRetrieveNtUserPfn DATA
2661	LdrUpdatePackageSearchPath@4
2662	LdrpChildNtdll DATA
2663	NtAcquireProcessActivityReference@12
2664	NtCompareSigningLevels@8
2665	; NtContinueCHPE@8 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 10 Fall Creators Update (Redstone 3 / 1709)
2666	NtConvertBetweenAuxiliaryCounterAndPerformanceCounter@16
2667	; NtLoadHotPatch@8 ; removed in Windows 10 October 2018 Update (Redstone 5 / 1809)
2668	NtQueryAuxiliaryCounterFrequency@4
2669	NtQueryInformationByName@20
2670	RtlAddAccessFilterAce@32
2671	RtlCreateUserProcessEx@20
2672	RtlDispatchAPC@12 ; before Windows 10 Creators Update (Redstone 2 / 1703) available as ordinal-only symbol
2673	RtlGetNtSystemRoot@0
2674	RtlGetSessionProperties@8
2675	RtlGetTokenNamedObjectPath@12
2676	RtlIsElevatedRid@4
2677	RtlIsNonEmptyDirectoryReparsePointAllowed@4
2678	; RtlIsPlaceholderFileHandle@8 ; removed in Windows 10 Fall Creators Update (Redstone 3 / 1709)
2679	; RtlIsPlaceholderFileInfo@12 ; removed in Windows 10 Fall Creators Update (Redstone 3 / 1709)
2680	RtlLookupFirstMatchingElementGenericTableAvl@12
2681	; RtlLookupFunctionEntryCHPE@12 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 10 Fall Creators Update (Redstone 3 / 1709)
2682	; RtlUnwindEx@24 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 10 Fall Creators Update (Redstone 3 / 1709)
2683	WerReportExceptionWorker@4
2684	ZwAcquireProcessActivityReference@12
2685	ZwCompareSigningLevels@8
2686	; ZwContinueCHPE@8 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 10 Fall Creators Update (Redstone 3 / 1709)
2687	ZwConvertBetweenAuxiliaryCounterAndPerformanceCounter@16
2688	; ZwLoadHotPatch@8 ; removed in Windows 10 October 2018 Update (Redstone 5 / 1809)
2689	ZwQueryAuxiliaryCounterFrequency@4
2690	ZwQueryInformationByName@20
2691
2692	; This is list of symbols added in Windows 10 Fall Creators Update (Redstone 3 / 1709)
2693	EtwCheckCoverage@4
2694	LdrCallEnclave@12
2695	LdrControlFlowGuardEnforced@0
2696	LdrCreateEnclave@36
2697	LdrDeleteEnclave@4
2698	LdrInitializeEnclave@20
2699	LdrLoadEnclaveModule@12
2700	NtCallEnclave@16
2701	NtNotifyChangeDirectoryFileEx@40
2702	NtQueryDirectoryFileEx@40
2703	NtTerminateEnclave@8
2704	RtlCapabilityCheckForSingleSessionSku@12
2705	RtlCheckSystemBootStatusIntegrity@4
2706	RtlDosLongPathNameToNtPathName_U_WithStatus@16
2707	RtlDosLongPathNameToRelativeNtPathName_U_WithStatus@16
2708	RtlExtendCorrelationVector@4
2709	RtlGetSystemBootStatus@16
2710	RtlGetSystemBootStatusEx@12
2711	RtlIncrementCorrelationVector@4
2712	RtlInitializeCorrelationVector@12
2713	RtlIsCloudFilesPlaceholder@8
2714	RtlIsCurrentProcess@4
2715	RtlIsCurrentThread@4
2716	RtlIsPartialPlaceholder@8
2717	RtlIsPartialPlaceholderFileHandle@8
2718	RtlIsPartialPlaceholderFileInfo@12
2719	RtlIsStateSeparationEnabled@0
2720	RtlQueryImageMitigationPolicy@20
2721	RtlQueryThreadPlaceholderCompatibilityMode@0
2722	RtlRestoreSystemBootStatusDefaults@0
2723	RtlSetImageMitigationPolicy@20
2724	RtlSetProxiedProcessId@4
2725	RtlSetSystemBootStatus@16
2726	RtlSetSystemBootStatusEx@12
2727	RtlSetThreadPlaceholderCompatibilityMode@4
2728	RtlValidateCorrelationVector@4
2729	RtlWow64GetEquivalentMachineCHPE@4
2730	RtlWow64GetSharedInfoProcess@12
2731	; RtlWow64PopAllCrossProcessWork@4 ; removed in Windows 10 October 2018 Update (Redstone 5 / 1809)
2732	; RtlWow64PopCrossProcessWork@4 ; removed in Windows 10 October 2018 Update (Redstone 5 / 1809)
2733	; RtlWow64PushCrossProcessWork@8 ; removed in Windows 10 October 2018 Update (Redstone 5 / 1809)
2734	ZwCallEnclave@16
2735	ZwNotifyChangeDirectoryFileEx@40
2736	ZwQueryDirectoryFileEx@40
2737	ZwTerminateEnclave@8
2738
2739	; This is list of symbols added in Windows 10 April 2018 Update (Redstone 4 / 1803)
2740	NtAllocateVirtualMemoryEx@28
2741	NtMapViewOfSectionEx@36
2742	RtlGetPersistedStateLocation@28
2743	RtlIsNameInUnUpcasedExpression@16
2744	RtlQueryProcessPlaceholderCompatibilityMode@0
2745	RtlQueryRegistryValueWithFallback@28
2746	RtlQueryTokenHostIdAsUlong64@8
2747	RtlRaiseCustomSystemEventTrigger@4
2748	RtlSetProcessPlaceholderCompatibilityMode@4
2749	ZwAllocateVirtualMemoryEx@28
2750	ZwMapViewOfSectionEx@36
2751
2752	; This is list of symbols added in Windows 10 October 2018 Update (Redstone 5 / 1809)
2753	ApiSetQueryApiSetPresenceEx@12
2754	LdrIsModuleSxsRedirected@4
2755	NtCreateSectionEx@36
2756	NtManageHotPatch@16
2757	RtlCreateProcessParametersWithTemplate@12
2758	RtlGetExtendedContextLength2@16
2759	RtlGetMultiTimePrecise@12
2760	RtlInitializeExtendedContext2@20
2761	; RtlUserFiberStart@0
2762	RtlpTimeFieldsToTime@12
2763	RtlpTimeToTimeFields@12
2764	ZwCreateSectionEx@36
2765	ZwManageHotPatch@16
2766
2767	; This is list of symbols added in Windows 10 May 2019 Update (19H1 / 1903)
2768	NtCreateCrossVmEvent@24
2769	RtlConstructCrossVmEventPath@12
2770	RtlDoesNameContainWildCards@4
2771	RtlFlsGetValue@8
2772	RtlFlsSetValue@8
2773	RtlUdiv128@28
2774	TpSetPoolThreadCpuSets@12
2775	ZwCreateCrossVmEvent@24
2776
2777	; In Windows 10 November 2019 Update (19H2 /1909) was not added any new symbol
2778
2779	; This is list of symbols added in Windows 10 May 2020 Update (20H1 / 2004)
2780	NtAcquireCrossVmMutant@8
2781	NtAllocateUserPhysicalPagesEx@20
2782	NtContinueEx@8
2783	NtCreateCrossVmMutant@24
2784	NtDirectGraphicsCall@20
2785	NtLoadKey3@32
2786	NtPssCaptureVaSpaceBulk@20
2787	RtlConstructCrossVmMutexPath@12
2788	; RtlDisownModuleHeapAllocation@8
2789	RtlFreeUTF8String@4
2790	RtlGetReturnAddressHijackTarget@0
2791	RtlInitUTF8String@8
2792	RtlInitUTF8StringEx@8
2793	RtlIsZeroMemory@8
2794	RtlNormalizeSecurityDescriptor@20
2795	RtlNotifyFeatureUsage@4
2796	RtlQueryAllFeatureConfigurations@16
2797	RtlQueryFeatureConfiguration@16
2798	RtlQueryFeatureConfigurationChangeStamp@0
2799	RtlQueryFeatureUsageNotificationSubscriptions@8
2800	RtlRegisterFeatureConfigurationChangeNotification@16
2801	RtlRestoreThreadPreferredUILanguages@4
2802	RtlSetFeatureConfigurations@16
2803	RtlSetThreadPreferredUILanguages2@16
2804	RtlSubscribeForFeatureUsageNotification@8
2805	RtlUTF8StringToUnicodeString@12
2806	RtlUnicodeStringToUTF8String@12
2807	RtlUnregisterFeatureConfigurationChangeNotification@4
2808	RtlUnsubscribeFromFeatureUsageNotifications@8
2809	ZwAcquireCrossVmMutant@8
2810	ZwAllocateUserPhysicalPagesEx@20
2811	ZwContinueEx@8
2812	ZwCreateCrossVmMutant@24
2813	ZwDirectGraphicsCall@20
2814	ZwLoadKey3@32
2815	ZwPssCaptureVaSpaceBulk@20
2816
2817	; In Windows 10 October 2020 Update (20H2) was not added any new symbol
2818
2819	; In Windows 10 May 2021 Update (21H1) was not added any new symbol
2820
2821	; This is list of symbols added in Windows 10 November 2021 Update (21H2)
2822	RtlGetSystemTimeAndBias@12
2823
2824	; In Windows 10 2022 Update (22H2) was not added any new symbol
2825
2826	; This is list of symbols added in Windows 11 (Sun Valley / 21H2) (WoW64 version)
2827	; LdrHotPatchNotify@4
2828	; MicrosoftTelemetryAssertTriggeredUM@4
2829	NtChangeProcessState@24
2830	NtChangeThreadState@24
2831	NtCreateIoRing@20
2832	NtCreateProcessStateChange@20
2833	NtCreateThreadStateChange@20
2834	NtQueryIoRingCapabilities@8
2835	NtQueueApcThreadEx2@28
2836	NtReadVirtualMemoryEx@24
2837	NtSetInformationIoRing@16
2838	NtSubmitIoRing@16
2839	RtlCompareExchangePointerMapping@16
2840	RtlCompareExchangePropertyStore@16
2841	; RtlConvertHostPerfCounterToPerfCounter@20
2842	RtlDelayExecution@8
2843	RtlGetImageFileMachines@8
2844	RtlGetSystemGlobalData@12
2845	RtlIsApiSetImplemented@4
2846	RtlIsEnclaveFeaturePresent@4
2847	RtlQueryPointerMapping@8
2848	RtlQueryPropertyStore@8
2849	RtlRemovePointerMapping@8
2850	RtlRemovePropertyStore@8
2851	RtlRestoreContext ; cdecl
2852	ZwChangeProcessState@24
2853	ZwChangeThreadState@24
2854	ZwCreateIoRing@20
2855	ZwCreateProcessStateChange@20
2856	ZwCreateThreadStateChange@20
2857	ZwQueryIoRingCapabilities@8
2858	ZwQueueApcThreadEx2@28
2859	ZwReadVirtualMemoryEx@24
2860	ZwSetInformationIoRing@16
2861	ZwSubmitIoRing@16
2862
2863	; This is list of symbols added in Windows 11 2022 Update (Sun Valley 2 / 22H2) (WoW64 version)
2864	; NtCopyFileChunk@40
2865	; NtCreateCpuPartition@20 ; Windows 10 has ABI "NtCreateCpuPartition@12", Windows 11 2024 Update (Hudson Valley / 24H2) and new has ABI "NtCreateCpuPartition@20"
2866	; NtOpenCpuPartition@12
2867	; NtQueryInformationCpuPartition@20
2868	; NtSetInformationCpuPartition@28
2869	; RtlOverwriteFeatureConfigurationBuffer@16
2870	; TpWorkOnBehalfClearTicket@4
2871	; TpWorkOnBehalfSetTicket@8
2872	; ZwCopyFileChunk@40
2873	; ZwCreateCpuPartition@20 ; Windows 10 has ABI "ZwCreateCpuPartition@12", Windows 11 2024 Update (Hudson Valley / 24H2) and new has ABI "ZwCreateCpuPartition@20"
2874	; ZwOpenCpuPartition@12
2875	; ZwQueryInformationCpuPartition@20
2876	; ZwSetInformationCpuPartition@28
2877
2878	; This is list of symbols added in Windows 11 2023 Update (Sun Valley 3 / 23H2) (WoW64 version)
2879	; RtlIsFeatureEnabledForEnterprise@4
2880
2881	; This is list of symbols added in Windows 11 2024 Update (Hudson Valley / 24H2) (WoW64 version)
2882	; NtAlertMultipleThreadByThreadId@16
2883	; NtAlertThreadByThreadIdEx@8
2884	; NtSetEventEx@12
2885	; NtWow64GetCurrentProcessorNumber@0
2886	; RtlFlsAllocEx@12
2887	; RtlFlsGetValue2@4
2888	; RtlGetAcesBufferSize@8
2889	; RtlGetCurrentThreadPrimaryGroup@0
2890	; RtlGetFeatureToggleConfiguration@12
2891	; RtlGetFeatureTogglesChangeToken@0
2892	; RtlLogUnexpectedCodepath@4
2893	; RtlNotifyFeatureToggleUsage@12
2894	; RtlQueryAllInternalFeatureConfigurations@16
2895	; RtlRcuAllocate@4
2896	; RtlRcuFree@4
2897	; RtlRcuReadLock@0
2898	; RtlRcuReadUnlock@0
2899	; RtlRcuSynchronize@4
2900	; RtlTlsAlloc@4
2901	; RtlTlsFree@4
2902	; RtlTlsSetValue@8
2903	; RtlValidateUserCallTarget@8
2904	; RtlXRestore@12
2905	; RtlXSave@12
2906	; ZwAlertMultipleThreadByThreadId@16
2907	; ZwAlertThreadByThreadIdEx@8
2908	; ZwSetEventEx@12
2909	; ZwWow64GetCurrentProcessorNumber@0
2910
2911	; This is list of symbols added in Windows 11 2025 Update (Hudson Valley 2 / 25H2) (WoW64 version)
2912	; ApiSetGetImplementationHost@12
2913	; ApiSetQuerySchema@8
2914	; RtlQueryAllInternalRuntimeFeatureConfigurations@20
2915	; RtlQueryInternalFeatureConfiguration@16