Windows APIs

win11_23h2 Symbols in ntoskrnl.exe

⇒

general DLL page

• AlpcCreateSecurityContext
• AlpcGetHeaderSize
• AlpcGetMessageAttribute
• AlpcInitializeMessageAttribute
• AsanWrapperMemcmp
• BgkDisplayCharacter
• BgkGetConsoleState
• BgkGetCursorState
• BgkSetCursor
• CarCopyRuleViolationDetails
• CarCreateRuleViolationDetails
• CarDeleteRuleViolationDetails
• CarDeregisterRuleClassConfiguration
• CarDeregisterRuleOverride
• CarInitializeRuleViolationDetails
• CarQueryReportAction
• CarQueryReportActionForTriage
• CarRegisterDefaultRuleClassConfiguration
• CarRegisterRuleClassConfiguration
• CarRegisterRuleOverride
• CarRegisterRuleOverrideAllContexts
• CarRegisterRuleOverridesAllContexts
• CarReportRuleViolation
• CarReportRuleViolationForTriage
• CarSetCustomIdInRuleOverride
• CarSetCustomRuleIdRange
• CcAddDirtyPagesToExternalCache
• CcAsyncCopyRead
• CcCanIWrite
• CcCoherencyFlushAndPurgeCache
• CcCopyRead
• CcCopyReadEx
• CcCopyWrite
• CcCopyWriteEx
• CcCopyWriteWontFlush
• CcDeductDirtyPagesFromExternalCache
• CcDeferWrite
• CcErrorCallbackRoutine
• CcFastCopyRead
• CcFastCopyWrite
• CcFastMdlReadWait
• CcFlushCache
• CcFlushCacheToLsn
• CcGetCachedDirtyPageCountForFile
• CcGetDirtyPages
• CcGetFileObjectFromBcb
• CcGetFileObjectFromSectionPtrs
• CcGetFileObjectFromSectionPtrsRef
• CcGetFlushedValidData
• CcGetLsnForFileObject
• CcGetNumberOfMappedPages
• CcInitializeCacheMap
• CcInitializeCacheMapEx
• CcInitializeCacheMapEx2
• CcIsCacheManagerCallbackNeeded
• CcIsThereDirtyData
• CcIsThereDirtyDataEx
• CcIsThereDirtyLoggedPages
• CcMapData
• CcMdlRead
• CcMdlReadComplete
• CcMdlWriteAbort
• CcMdlWriteComplete
• CcPinMappedData
• CcPinRead
• CcPrepareMdlWrite
• CcPreparePinWrite
• CcPurgeCacheSection
• CcRegisterExternalCache
• CcRemapBcb
• CcRepinBcb
• CcScheduleReadAhead
• CcScheduleReadAheadEx
• CcSetAdditionalCacheAttributes
• CcSetAdditionalCacheAttributesEx
• CcSetBcbOwnerPointer
• CcSetDirtyPageThreshold
• CcSetDirtyPinnedData
• CcSetFileSizes
• CcSetFileSizesEx
• CcSetLogHandleForFile
• CcSetLogHandleForFileEx
• CcSetLoggedDataThreshold
• CcSetParallelFlushFile
• CcSetReadAheadGranularity
• CcSetReadAheadGranularityEx
• CcTestControl
• CcUninitializeCacheMap
• CcUnmapFileOffsetFromSystemCache
• CcUnpinData
• CcUnpinDataForThread
• CcUnpinRepinnedBcb
• CcUnregisterExternalCache
• CcWaitForCurrentLazyWriterActivity
• CcZeroData
• CcZeroDataOnDisk
• CmCallbackGetKeyObjectID
• CmCallbackGetKeyObjectIDEx
• CmCallbackReleaseKeyObjectIDEx
• CmGetBoundTransaction
• CmGetCallbackVersion
• CmKeyObjectType
• CmRegisterCallback
• CmRegisterCallbackEx
• CmRegisterMachineHiveLoadedNotification
• CmSetCallbackObjectContext
• CmUnRegisterCallback
• CmUnregisterMachineHiveLoadedNotification
• DbgBreakPoint
• DbgBreakPointWithStatus
• DbgCommandString
• DbgLoadImageSymbols
• DbgPrint
• DbgPrintEx
• DbgPrintReturnControlC
• DbgPrompt
• DbgQueryDebugFilterState
• DbgSetDebugFilterState
• DbgSetDebugPrintCallback
• DbgkLkmdRegisterCallback
• DbgkLkmdUnregisterCallback
• DbgkWerCaptureLiveKernelDump
• DbgkWerCaptureLiveKernelDump2
• DifFindThreadContextData
• DifGetPluginPerDriverData
• DifPluginSimplePerfControl
• DifPopThreadContextData
• DifPushThreadContextData
• DifRegisterPlugin
• DifUtilDbgPrint
• EmClientQueryRuleState
• EmClientRuleDeregisterNotification
• EmClientRuleEvaluate
• EmClientRuleRegisterNotification
• EmProviderDeregister
• EmProviderDeregisterEntry
• EmProviderRegister
• EmProviderRegisterEntry
• EmpProviderRegister
• EtwActivityIdControl
• EtwEnableTrace
• EtwEventEnabled
• EtwProviderEnabled
• EtwRegister
• EtwRegisterClassicProvider
• EtwSendTraceBuffer
• EtwSetInformation
• EtwTelemetryCoverageReport
• EtwUnregister
• EtwWrite
• EtwWriteEndScenario
• EtwWriteEx
• EtwWriteStartScenario
• EtwWriteString
• EtwWriteTransfer
• EtwpDisableStackWalkApc
• EtwpReenableStackWalkApc
• ExAcquireAutoExpandPushLockExclusive
• ExAcquireAutoExpandPushLockShared
• ExAcquireCacheAwarePushLockExclusive
• ExAcquireCacheAwarePushLockExclusiveEx
• ExAcquireCacheAwarePushLockSharedEx
• ExAcquireFastMutex
• ExAcquireFastMutexUnsafe
• ExAcquireFastResourceExclusive
• ExAcquireFastResourceShared
• ExAcquireFastResourceSharedStarveExclusive
• ExAcquireFastResourceWithFlags
• ExAcquirePushLockExclusiveEx
• ExAcquirePushLockSharedEx
• ExAcquireResourceExclusiveLite
• ExAcquireResourceSharedLite
• ExAcquireRundownProtection
• ExAcquireRundownProtectionCacheAware
• ExAcquireRundownProtectionCacheAwareEx
• ExAcquireRundownProtectionEx
• ExAcquireSharedStarveExclusive
• ExAcquireSharedWaitForExclusive
• ExAcquireSpinLockExclusive
• ExAcquireSpinLockExclusiveAtDpcLevel
• ExAcquireSpinLockShared
• ExAcquireSpinLockSharedAtDpcLevel
• ExActivationObjectType
• ExAllocateAutoExpandPushLock
• ExAllocateCacheAwarePushLock
• ExAllocateCacheAwareRundownProtection
• ExAllocateFromLookasideListEx
• ExAllocateFromNPagedLookasideList
• ExAllocateFromPagedLookasideList
• ExAllocatePool
• ExAllocatePool2
• ExAllocatePool3
• ExAllocatePoolWithQuota
• ExAllocatePoolWithQuotaTag
• ExAllocatePoolWithTag
• ExAllocatePoolWithTagPriority
• ExAllocateTimer
• ExBlockOnAddressPushLock
• ExBlockPushLock
• ExCancelDpcEventWait
• ExCancelTimer
• ExCleanupAutoExpandPushLock
• ExCleanupRundownProtectionCacheAware
• ExCompositionObjectType
• ExConvertExclusiveToSharedLite
• ExConvertFastResourceExclusiveToShared
• ExConvertPushLockExclusiveToShared
• ExCoreMessagingObjectType
• ExCreateCallback
• ExCreateDpcEvent
• ExCreatePool
• ExDeleteDpcEvent
• ExDeleteFastResource
• ExDeleteLookasideListEx
• ExDeleteNPagedLookasideList
• ExDeletePagedLookasideList
• ExDeleteResourceLite
• ExDeleteTimer
• ExDesktopObjectType
• ExDestroyPool
• ExDisableResourceBoostLite
• ExDisownFastResource
• ExEnterCriticalRegionAndAcquireFastMutexUnsafe
• ExEnterCriticalRegionAndAcquireResourceExclusive
• ExEnterCriticalRegionAndAcquireResourceShared
• ExEnterCriticalRegionAndAcquireSharedWaitForExclusive
• ExEnterPriorityRegionAndAcquireResourceExclusive
• ExEnterPriorityRegionAndAcquireResourceShared
• ExEnumHandleTable
• ExEnumerateSystemFirmwareTables
• ExEventObjectType
• ExExtendZone
• ExFetchLicenseData
• ExFlushLookasideListEx
• ExFreeAutoExpandPushLock
• ExFreeCacheAwarePushLock
• ExFreeCacheAwareRundownProtection
• ExFreePool
• ExFreePool2
• ExFreePoolWithTag
• ExFreeToLookasideListEx
• ExFreeToNPagedLookasideList
• ExFreeToPagedLookasideList
• ExGetCurrentProcessorCounts
• ExGetCurrentProcessorCpuUsage
• ExGetExclusiveWaiterCount
• ExGetFirmwareEnvironmentVariable
• ExGetFirmwareType
• ExGetLicenseTamperState
• ExGetPreviousMode
• ExGetSharedWaiterCount
• ExGetSystemFirmwareTable
• ExInitializeAutoExpandPushLock
• ExInitializeDeviceAts
• ExInitializeFastOwnerEntry
• ExInitializeFastResource
• ExInitializeFastResourceAcquired
• ExInitializeLookasideListEx
• ExInitializeNPagedLookasideList
• ExInitializePagedLookasideList
• ExInitializePushLock
• ExInitializeResourceLite
• ExInitializeRundownProtection
• ExInitializeRundownProtectionCacheAware
• ExInitializeRundownProtectionCacheAwareEx
• ExInitializeZone
• ExInterlockedAddLargeInteger
• ExInterlockedAddUlong
• ExInterlockedExtendZone
• ExInterlockedInsertHeadList
• ExInterlockedInsertTailList
• ExInterlockedPopEntryList
• ExInterlockedPushEntryList
• ExInterlockedRemoveHeadList
• ExIsFastResourceContended
• ExIsFastResourceHeld
• ExIsFastResourceHeldExclusive
• ExIsManufacturingModeEnabled
• ExIsProcessorFeaturePresent
• ExIsResourceAcquiredExclusiveLite
• ExIsResourceAcquiredSharedLite
• ExIsSoftBoot
• ExLocalTimeToSystemTime
• ExMoveFastResourceOwnershipWithFlags
• ExNotifyBootDeviceRemoval
• ExNotifyCallback
• ExQueryDepthSList
• ExQueryFastCacheDevLicense
• ExQueryPoolBlockSize
• ExQueryTimerResolution
• ExQueryWnfStateData
• ExQueueDpcEventWait
• ExQueueWorkItem
• ExRaiseAccessViolation
• ExRaiseDatatypeMisalignment
• ExRaiseException
• ExRaiseHardError
• ExRaiseStatus
• ExRawInputManagerObjectType
• ExReInitializeRundownProtection
• ExReInitializeRundownProtectionCacheAware
• ExRealTimeIsUniversal
• ExRegisterBootDevice
• ExRegisterCallback
• ExRegisterExtension
• ExReinitializeFastResource
• ExReinitializeResourceLite
• ExReleaseAutoExpandPushLockExclusive
• ExReleaseAutoExpandPushLockShared
• ExReleaseCacheAwarePushLockExclusive
• ExReleaseCacheAwarePushLockExclusiveEx
• ExReleaseCacheAwarePushLockSharedEx
• ExReleaseDisownedFastResource
• ExReleaseDisownedFastResourceExclusive
• ExReleaseDisownedFastResourceShared
• ExReleaseFastMutex
• ExReleaseFastMutexUnsafe
• ExReleaseFastMutexUnsafeAndLeaveCriticalRegion
• ExReleaseFastResource
• ExReleaseFastResourceExclusive
• ExReleaseFastResourceShared
• ExReleasePushLockEx
• ExReleasePushLockExclusiveEx
• ExReleasePushLockSharedEx
• ExReleaseResourceAndLeaveCriticalRegion
• ExReleaseResourceAndLeavePriorityRegion
• ExReleaseResourceForThreadLite
• ExReleaseResourceLite
• ExReleaseRundownProtection
• ExReleaseRundownProtectionCacheAware
• ExReleaseRundownProtectionCacheAwareEx
• ExReleaseRundownProtectionEx
• ExReleaseSpinLockExclusive
• ExReleaseSpinLockExclusiveFromDpcLevel
• ExReleaseSpinLockShared
• ExReleaseSpinLockSharedFromDpcLevel
• ExRundownCompleted
• ExRundownCompletedCacheAware
• ExSecurePoolUpdate
• ExSecurePoolValidate
• ExSemaphoreObjectType
• ExSetFirmwareEnvironmentVariable
• ExSetLicenseTamperState
• ExSetResourceOwnerPointer
• ExSetResourceOwnerPointerEx
• ExSetTimer
• ExSetTimerResolution
• ExShareAddressSpaceWithDevice
• ExShareUltraSpaceWithDevice
• ExSizeOfAutoExpandPushLock
• ExSizeOfRundownProtectionCacheAware
• ExSubscribeWnfStateChange
• ExSvmBeginDeviceReset
• ExSvmFinalizeDeviceReset
• ExSystemExceptionFilter
• ExSystemTimeToLocalTime
• ExTimedWaitForUnblockPushLock
• ExTimerObjectType
• ExTryAcquireAutoExpandPushLockExclusive
• ExTryAcquireAutoExpandPushLockShared
• ExTryAcquireCacheAwarePushLockExclusiveEx
• ExTryAcquireCacheAwarePushLockSharedEx
• ExTryAcquirePushLockExclusiveEx
• ExTryAcquirePushLockSharedEx
• ExTryAcquireSpinLockExclusiveAtDpcLevel
• ExTryAcquireSpinLockSharedAtDpcLevel
• ExTryConvertPushLockSharedToExclusiveEx
• ExTryConvertSharedSpinLockExclusive
• ExTryQueueWorkItem
• ExTryToAcquireFastMutex
• ExTryToAcquireResourceExclusiveLite
• ExTryToConvertFastResourceSharedToExclusive
• ExUnblockOnAddressPushLockEx
• ExUnblockPushLockEx
• ExUnregisterCallback
• ExUnregisterExtension
• ExUnsubscribeWnfStateChange
• ExUpdateLicenseData
• ExUuidCreate
• ExVerifySuite
• ExWaitForRundownProtectionRelease
• ExWaitForRundownProtectionReleaseCacheAware
• ExWaitForUnblockPushLock
• ExWindowStationObjectType
• ExfAcquirePushLockExclusive
• ExfAcquirePushLockShared
• ExfReleasePushLock
• ExfReleasePushLockExclusive
• ExfReleasePushLockShared
• ExfTryAcquirePushLockShared
• ExfTryToWakePushLock
• ExfUnblockPushLock
• ExpInterlockedFlushSList
• ExpInterlockedPopEntrySList
• ExpInterlockedPushEntrySList
• FirstEntrySList
• FsRtlAcknowledgeEcp
• FsRtlAcquireEofLock
• FsRtlAcquireFileExclusive
• FsRtlAcquireHeaderMutex
• FsRtlAddBaseMcbEntry
• FsRtlAddBaseMcbEntryEx
• FsRtlAddLargeMcbEntry
• FsRtlAddMcbEntry
• FsRtlAddToTunnelCache
• FsRtlAddToTunnelCacheEx
• FsRtlAllocateAePushLock
• FsRtlAllocateExtraCreateParameter
• FsRtlAllocateExtraCreateParameterFromLookasideList
• FsRtlAllocateExtraCreateParameterList
• FsRtlAllocateFileLock
• FsRtlAllocatePool
• FsRtlAllocatePoolWithQuota
• FsRtlAllocatePoolWithQuotaTag
• FsRtlAllocatePoolWithTag
• FsRtlAllocateResource
• FsRtlAreNamesEqual
• FsRtlAreThereCurrentOrInProgressFileLocks
• FsRtlAreThereWaitingFileLocks
• FsRtlAreVolumeStartupApplicationsComplete
• FsRtlBalanceReads
• FsRtlCancellableWaitForMultipleObjects
• FsRtlCancellableWaitForSingleObject
• FsRtlChangeBackingFileObject
• FsRtlCheckLockForOplockRequest
• FsRtlCheckLockForReadAccess
• FsRtlCheckLockForWriteAccess
• FsRtlCheckOplock
• FsRtlCheckOplockEx
• FsRtlCheckOplockEx2
• FsRtlCheckOplockForFsFilterCallback
• FsRtlCheckUpperOplock
• FsRtlCopyRead
• FsRtlCopyWrite
• FsRtlCreateSectionForDataScan
• FsRtlCurrentBatchOplock
• FsRtlCurrentOplock
• FsRtlCurrentOplockH
• FsRtlDedupChangeInit
• FsRtlDedupChangeLogOverwriteOrFree
• FsRtlDedupChangeLogWrite
• FsRtlDedupChangeUninit
• FsRtlDeleteExtraCreateParameterLookasideList
• FsRtlDeleteKeyFromTunnelCache
• FsRtlDeleteTunnelCache
• FsRtlDeregisterUncProvider
• FsRtlDisallowLegacyFilterOnDevice
• FsRtlDismountComplete
• FsRtlDissectDbcs
• FsRtlDissectName
• FsRtlDoesDbcsContainWildCards
• FsRtlDoesNameContainWildCards
• FsRtlFastCheckLockForRead
• FsRtlFastCheckLockForWrite
• FsRtlFastUnlockAll
• FsRtlFastUnlockAllByKey
• FsRtlFastUnlockSingle
• FsRtlFindExtraCreateParameter
• FsRtlFindInTunnelCache
• FsRtlFindInTunnelCacheEx
• FsRtlFreeAePushLock
• FsRtlFreeExtraCreateParameter
• FsRtlFreeExtraCreateParameterList
• FsRtlFreeFileLock
• FsRtlGetCurrentProcessLoaderList
• FsRtlGetEcpListFromIrp
• FsRtlGetFileNameInformation
• FsRtlGetFileSize
• FsRtlGetIoAtEof
• FsRtlGetNextBaseMcbEntry
• FsRtlGetNextExtraCreateParameter
• FsRtlGetNextFileLock
• FsRtlGetNextLargeMcbEntry
• FsRtlGetNextMcbEntry
• FsRtlGetSectorSizeInformation
• FsRtlGetSupportedFeatures
• FsRtlGetVirtualDiskNestingLevel
• FsRtlHeatInit
• FsRtlHeatLogIo
• FsRtlHeatLogTierMove
• FsRtlHeatUninit
• FsRtlIncrementCcFastMdlReadWait
• FsRtlIncrementCcFastReadNoWait
• FsRtlIncrementCcFastReadNotPossible
• FsRtlIncrementCcFastReadResourceMiss
• FsRtlIncrementCcFastReadWait
• FsRtlInitExtraCreateParameterLookasideList
• FsRtlInitializeBaseMcb
• FsRtlInitializeBaseMcbEx
• FsRtlInitializeEofLock
• FsRtlInitializeExtraCreateParameter
• FsRtlInitializeExtraCreateParameterList
• FsRtlInitializeFileLock
• FsRtlInitializeLargeMcb
• FsRtlInitializeMcb
• FsRtlInitializeOplock
• FsRtlInitializeTunnelCache
• FsRtlInsertExtraCreateParameter
• FsRtlInsertPerFileContext
• FsRtlInsertPerFileObjectContext
• FsRtlInsertPerStreamContext
• FsRtlIs32BitProcess
• FsRtlIsDaxVolume
• FsRtlIsDbcsInExpression
• FsRtlIsEcpAcknowledged
• FsRtlIsEcpFromUserMode
• FsRtlIsExtentDangling
• FsRtlIsFatDbcsLegal
• FsRtlIsHpfsDbcsLegal
• FsRtlIsMobileOS
• FsRtlIsNameInExpression
• FsRtlIsNameInUnUpcasedExpression
• FsRtlIsNonEmptyDirectoryReparsePointAllowed
• FsRtlIsNtstatusExpected
• FsRtlIsPagingFile
• FsRtlIsSystemPagingFile
• FsRtlIsTotalDeviceFailure
• FsRtlIssueDeviceIoControl
• FsRtlKernelFsControlFile
• FsRtlLegalAnsiCharacterArray
• FsRtlLogCcFlushError
• FsRtlLookupBaseMcbEntry
• FsRtlLookupLargeMcbEntry
• FsRtlLookupLastBaseMcbEntry
• FsRtlLookupLastBaseMcbEntryAndIndex
• FsRtlLookupLastLargeMcbEntry
• FsRtlLookupLastLargeMcbEntryAndIndex
• FsRtlLookupLastMcbEntry
• FsRtlLookupMcbEntry
• FsRtlLookupPerFileContext
• FsRtlLookupPerFileObjectContext
• FsRtlLookupPerStreamContextInternal
• FsRtlMdlRead
• FsRtlMdlReadComplete
• FsRtlMdlReadCompleteDev
• FsRtlMdlReadDev
• FsRtlMdlReadEx
• FsRtlMdlWriteComplete
• FsRtlMdlWriteCompleteDev
• FsRtlMupGetProviderIdFromName
• FsRtlMupGetProviderInfoFromFileObject
• FsRtlNormalizeNtstatus
• FsRtlNotifyChangeDirectory
• FsRtlNotifyCleanup
• FsRtlNotifyCleanupAll
• FsRtlNotifyFilterChangeDirectory
• FsRtlNotifyFilterChangeDirectoryLite
• FsRtlNotifyFilterReportChange
• FsRtlNotifyFilterReportChangeLite
• FsRtlNotifyFilterReportChangeLiteEx
• FsRtlNotifyFullChangeDirectory
• FsRtlNotifyFullReportChange
• FsRtlNotifyInitializeSync
• FsRtlNotifyReportChange
• FsRtlNotifyUninitializeSync
• FsRtlNotifyVolumeEvent
• FsRtlNotifyVolumeEventEx
• FsRtlNumberOfRunsInBaseMcb
• FsRtlNumberOfRunsInLargeMcb
• FsRtlNumberOfRunsInMcb
• FsRtlOpenFileSystemRegistryKeyFromFsGuid
• FsRtlOplockBreakH
• FsRtlOplockBreakH2
• FsRtlOplockBreakToNone
• FsRtlOplockBreakToNoneEx
• FsRtlOplockFsctrl
• FsRtlOplockFsctrlEx
• FsRtlOplockGetAnyBreakOwnerProcess
• FsRtlOplockIsFastIoPossible
• FsRtlOplockIsSharedRequest
• FsRtlOplockKeysEqual
• FsRtlPostPagingFileStackOverflow
• FsRtlPostStackOverflow
• FsRtlPrepareMdlWrite
• FsRtlPrepareMdlWriteDev
• FsRtlPrepareMdlWriteEx
• FsRtlPrepareToReuseEcp
• FsRtlPrivateLock
• FsRtlProcessFileLock
• FsRtlQueryCachedVdl
• FsRtlQueryInformationFile
• FsRtlQueryKernelEaFile
• FsRtlQueryMaximumVirtualDiskNestingLevel
• FsRtlRegisterFileSystemFilterCallbacks
• FsRtlRegisterFltMgrCalls
• FsRtlRegisterMupCalls
• FsRtlRegisterUncProvider
• FsRtlRegisterUncProviderEx
• FsRtlRegisterUncProviderEx2
• FsRtlReleaseEofLock
• FsRtlReleaseFile
• FsRtlReleaseFileNameInformation
• FsRtlReleaseHeaderMutex
• FsRtlRemoveBaseMcbEntry
• FsRtlRemoveDotsFromPath
• FsRtlRemoveExtraCreateParameter
• FsRtlRemoveLargeMcbEntry
• FsRtlRemoveMcbEntry
• FsRtlRemovePerFileContext
• FsRtlRemovePerFileObjectContext
• FsRtlRemovePerStreamContext
• FsRtlResetBaseMcb
• FsRtlResetLargeMcb
• FsRtlSendModernAppTermination
• FsRtlSetDriverBacking
• FsRtlSetEcpListIntoIrp
• FsRtlSetKernelEaFile
• FsRtlSplitBaseMcb
• FsRtlSplitLargeMcb
• FsRtlSyncVolumes
• FsRtlTeardownPerFileContexts
• FsRtlTeardownPerStreamContexts
• FsRtlTruncateBaseMcb
• FsRtlTruncateLargeMcb
• FsRtlTruncateMcb
• FsRtlTryToAcquireHeaderMutex
• FsRtlUninitializeBaseMcb
• FsRtlUninitializeFileLock
• FsRtlUninitializeLargeMcb
• FsRtlUninitializeMcb
• FsRtlUninitializeOplock
• FsRtlUpdateDiskCounters
• FsRtlUpperOplockFsctrl
• FsRtlValidateReparsePointBuffer
• FsRtlVolumeDeviceToCorrelationId
• HalAcpiGetTableEx
• HalAcquireDisplayOwnership
• HalAdjustResourceList
• HalAllProcessorsStarted
• HalAllocateAdapterChannel
• HalAllocateCommonBuffer
• HalAllocateCrashDumpRegisters
• HalAllocateHardwareCounters
• HalAssignSlotResources
• HalBugCheckSystem
• HalCalibratePerformanceCounter
• HalClearSoftwareInterrupt
• HalConvertDeviceIdtToIrql
• HalDisableInterrupt
• HalDispatchTable
• HalDisplayString
• HalDmaAllocateCrashDumpRegistersEx
• HalDmaFreeCrashDumpRegistersEx
• HalEnableInterrupt
• HalEnumerateEnvironmentVariablesEx
• HalEnumerateProcessors
• HalExamineMBR
• HalFlushCommonBuffer
• HalFreeCommonBuffer
• HalFreeHardwareCounters
• HalGetAdapter
• HalGetBusData
• HalGetBusDataByOffset
• HalGetEnvironmentVariable
• HalGetEnvironmentVariableEx
• HalGetInterruptTargetInformation
• HalGetInterruptVector
• HalGetMemoryCachingRequirements
• HalGetMessageRoutingInfo
• HalGetProcessorIdByNtNumber
• HalGetVectorInput
• HalHandleMcheck
• HalHandleNMI
• HalInitSystem
• HalInitializeBios
• HalInitializeOnResume
• HalInitializeProcessor
• HalIsHyperThreadingEnabled
• HalMakeBeep
• HalPerformEndOfInterrupt
• HalPrivateDispatchTable
• HalProcessorIdle
• HalQueryDisplayParameters
• HalQueryEnvironmentVariableInfoEx
• HalQueryMaximumProcessorCount
• HalQueryRealTimeClock
• HalReadDmaCounter
• HalRegisterDynamicProcessor
• HalRegisterErrataCallbacks
• HalReportResourceUsage
• HalRequestClockInterrupt
• HalRequestDeferredRecoveryServiceInterrupt
• HalRequestIpi
• HalRequestIpiSpecifyVector
• HalRequestSoftwareInterrupt
• HalReturnToFirmware
• HalSendNMI
• HalSendSoftwareInterrupt
• HalSetBusData
• HalSetBusDataByOffset
• HalSetDisplayParameters
• HalSetEnvironmentVariable
• HalSetEnvironmentVariableEx
• HalSetProfileInterval
• HalSetRealTimeClock
• HalStartDynamicProcessor
• HalStartNextProcessor
• HalStartProfileInterrupt
• HalStopProfileInterrupt
• HalSystemVectorDispatchEntry
• HalTranslateBusAddress
• HalWheaUpdateCmciPolicy
• HeadlessDispatch
• HviGetHardwareFeatures
• HviGetHypervisorFeatures
• HviIsAnyHypervisorPresent
• HviIsHypervisorVendorMicrosoft
• HvlGetApicIdFromLpIndex
• HvlGetLpIndexFromApicId
• HvlGetLpIndexFromProcessorIndex
• HvlInvokeFastExtendedHypercall
• HvlInvokeHypercall
• HvlIsSchedulerAssistAvailable
• HvlLpReadMultipleMsr
• HvlLpWriteMultipleMsr
• HvlPerformEndOfInterrupt
• HvlQueryActiveHypervisorProcessorCount
• HvlQueryActiveProcessors
• HvlQueryConnection
• HvlQueryHypervisorProcessorNodeNumber
• HvlQueryNumaDistance
• HvlQueryProcessorTopology
• HvlQueryProcessorTopologyCount
• HvlQueryProcessorTopologyEx
• HvlQueryProcessorTopologyHighestId
• HvlQueryStartedProcessors
• HvlReadPerformanceStateCounters
• HvlRegisterInterruptCallback
• HvlRegisterWheaErrorNotification
• HvlSchedulerAssistAcknowledgeEvents
• HvlUnregisterInterruptCallback
• HvlUnregisterWheaErrorNotification
• HvlUpdatePerformanceStateCountersForLp
• InbvAcquireDisplayOwnership
• InbvCheckDisplayOwnership
• InbvDisplayString
• InbvEnableBootDriver
• InbvEnableDisplayString
• InbvInstallDisplayStringFilter
• InbvIsBootDriverInstalled
• InbvNotifyDisplayOwnershipChange
• InbvNotifyDisplayOwnershipLost
• InbvResetDisplay
• InbvSetScrollRegion
• InbvSetTextColor
• InbvSetVirtualFrameBuffer
• InbvSolidColorFill
• InitSafeBootMode
• InitializeSListHead
• InterlockedPushListSList
• IoAcquireCancelSpinLock
• IoAcquireKsrPersistentMemory
• IoAcquireKsrPersistentMemoryEx
• IoAcquireRemoveLockEx
• IoAcquireVpbSpinLock
• IoAdapterObjectType
• IoAddBugcheckTriageThread
• IoAdjustStackSizeForRedirection
• IoAllocateAdapterChannel
• IoAllocateController
• IoAllocateDriverObjectExtension
• IoAllocateErrorLogEntry
• IoAllocateIrp
• IoAllocateIrpEx
• IoAllocateMdl
• IoAllocateMiniCompletionPacket
• IoAllocateSfioStreamIdentifier
• IoAllocateWorkItem
• IoApplyPriorityInfoThread
• IoAssignResources
• IoAttachDevice
• IoAttachDeviceByPointer
• IoAttachDeviceToDeviceStack
• IoAttachDeviceToDeviceStackSafe
• IoBoostThreadIo
• IoBuildAsynchronousFsdRequest
• IoBuildDeviceIoControlRequest
• IoBuildPartialMdl
• IoBuildSynchronousFsdRequest
• IoCallDriver
• IoCancelFileOpen
• IoCancelIrp
• IoCancelMiniCompletionPacket
• IoCheckDesiredAccess
• IoCheckEaBufferValidity
• IoCheckFileObjectOpenedAsCopyDestination
• IoCheckFileObjectOpenedAsCopySource
• IoCheckFunctionAccess
• IoCheckLinkShareAccess
• IoCheckQuerySetFileInformation
• IoCheckQuerySetVolumeInformation
• IoCheckQuotaBufferValidity
• IoCheckRedirectionTrustLevel
• IoCheckShareAccess
• IoCheckShareAccessEx
• IoCleanupIrp
• IoClearActivityIdThread
• IoClearAdapterCryptoEngineExtension
• IoClearFsTrackOffsetState
• IoClearIrpExtraCreateParameter
• IoCompleteRequest
• IoCompletionObjectType
• IoComputeRedirectionTrustLevel
• IoConnectInterrupt
• IoConnectInterruptEx
• IoConvertFileHandleToKernelHandle
• IoCopyDeviceObjectHint
• IoCreateArcName
• IoCreateController
• IoCreateDevice
• IoCreateDeviceSecure
• IoCreateDisk
• IoCreateDriver
• IoCreateFile
• IoCreateFileEx
• IoCreateFileSpecifyDeviceObjectHint
• IoCreateNotificationEvent
• IoCreateStreamFileObject
• IoCreateStreamFileObjectEx
• IoCreateStreamFileObjectEx2
• IoCreateStreamFileObjectLite
• IoCreateSymbolicLink
• IoCreateSymbolicLink2
• IoCreateSynchronizationEvent
• IoCreateSystemThread
• IoCreateUnprotectedSymbolicLink
• IoCsqInitialize
• IoCsqInitializeEx
• IoCsqInsertIrp
• IoCsqInsertIrpEx
• IoCsqRemoveIrp
• IoCsqRemoveNextIrp
• IoDecrementKeepAliveCount
• IoDeleteController
• IoDeleteDevice
• IoDeleteDriver
• IoDeleteSymbolicLink
• IoDetachDevice
• IoDeviceHandlerObjectSize
• IoDeviceHandlerObjectType
• IoDeviceObjectType
• IoDisconnectInterrupt
• IoDisconnectInterruptEx
• IoDriverObjectType
• IoDuplicateDependency
• IoEnqueueIrp
• IoEnumerateDeviceObjectList
• IoEnumerateKsrPersistentMemoryEx
• IoEnumerateRegisteredFiltersList
• IoFastQueryNetworkAttributes
• IoFileObjectType
• IoFlushAdapterBuffers
• IoForwardAndCatchIrp
• IoForwardIrpSynchronously
• IoFreeAdapterChannel
• IoFreeController
• IoFreeErrorLogEntry
• IoFreeIrp
• IoFreeKsrPersistentMemory
• IoFreeMapRegisters
• IoFreeMdl
• IoFreeMiniCompletionPacket
• IoFreeSfioStreamIdentifier
• IoFreeWorkItem
• IoGetActivityIdIrp
• IoGetActivityIdThread
• IoGetAdapterCryptoEngineExtension
• IoGetAffinityInterrupt
• IoGetAttachedDevice
• IoGetAttachedDeviceReference
• IoGetBaseFileSystemDeviceObject
• IoGetBootDiskInformation
• IoGetBootDiskInformationLite
• IoGetConfigurationInformation
• IoGetContainerInformation
• IoGetCopyInformationExtension
• IoGetCurrentProcess
• IoGetDeviceAttachmentBaseRef
• IoGetDeviceDirectory
• IoGetDeviceInterfaceAlias
• IoGetDeviceInterfacePropertyData
• IoGetDeviceInterfaces
• IoGetDeviceNumaNode
• IoGetDeviceObjectPointer
• IoGetDeviceProperty
• IoGetDevicePropertyData
• IoGetDeviceToVerify
• IoGetDiskDeviceObject
• IoGetDmaAdapter
• IoGetDriverDirectory
• IoGetDriverObjectExtension
• IoGetFileObjectGenericMapping
• IoGetFsTrackOffsetState
• IoGetFsZeroingOffset
• IoGetGenericIrpExtension
• IoGetInitialStack
• IoGetInitiatorProcess
• IoGetIoAttributionHandle
• IoGetIoPriorityHint
• IoGetIommuInterface
• IoGetIommuInterfaceEx
• IoGetIrpExtraCreateParameter
• IoGetLowerDeviceObject
• IoGetOplockKeyContext
• IoGetOplockKeyContextEx
• IoGetPagingIoPriority
• IoGetRelatedDeviceObject
• IoGetRequestorProcess
• IoGetRequestorProcessId
• IoGetRequestorSessionId
• IoGetSfioStreamIdentifier
• IoGetShadowFileInformation
• IoGetSilo
• IoGetSiloParameters
• IoGetStackLimits
• IoGetSymlinkSupportInformation
• IoGetTopLevelIrp
• IoGetTransactionParameterBlock
• IoIncrementKeepAliveCount
• IoInitializeIrp
• IoInitializeIrpEx
• IoInitializeMiniCompletionPacket
• IoInitializeRemoveLockEx
• IoInitializeTimer
• IoInitializeWorkItem
• IoInvalidateDeviceRelations
• IoInvalidateDeviceState
• IoIrpHasFsTrackOffsetExtensionType
• IoIs32bitProcess
• IoIsActivityTracingEnabled
• IoIsFileObjectIgnoringSharing
• IoIsFileOriginRemote
• IoIsInitiator32bitProcess
• IoIsOperationSynchronous
• IoIsSystemThread
• IoIsValidIrpStatus
• IoIsValidNameGraftingBuffer
• IoIsWdmVersionAvailable
• IoLoadCrashDumpDriver
• IoMakeAssociatedIrp
• IoMakeAssociatedIrpEx
• IoMapTransfer
• IoOpenDeviceInterfaceRegistryKey
• IoOpenDeviceRegistryKey
• IoOpenDriverRegistryKey
• IoPageRead
• IoPropagateActivityIdToThread
• IoPropagateIrpExtension
• IoPropagateIrpExtensionEx
• IoQueryDeviceDescription
• IoQueryFileDosDeviceName
• IoQueryFileInformation
• IoQueryFullDriverPath
• IoQueryInformationByName
• IoQueryInterface
• IoQueryKsrPersistentMemorySize
• IoQueryKsrPersistentMemorySizeEx
• IoQueryVolumeInformation
• IoQueueThreadIrp
• IoQueueWorkItem
• IoQueueWorkItemEx
• IoQueueWorkItemToNode
• IoRaiseHardError
• IoRaiseInformationalHardError
• IoReadDiskSignature
• IoReadOperationCount
• IoReadPartitionTable
• IoReadPartitionTableEx
• IoReadTransferCount
• IoRecordIoAttribution
• IoRegisterBootDriverCallback
• IoRegisterBootDriverReinitialization
• IoRegisterContainerNotification
• IoRegisterDeviceInterface
• IoRegisterDriverReinitialization
• IoRegisterFileSystem
• IoRegisterFsRegistrationChange
• IoRegisterFsRegistrationChangeMountAware
• IoRegisterIoTracking
• IoRegisterLastChanceShutdownNotification
• IoRegisterPlugPlayNotification
• IoRegisterPriorityCallback
• IoRegisterShutdownNotification
• IoReleaseCancelSpinLock
• IoReleaseRemoveLockAndWaitEx
• IoReleaseRemoveLockEx
• IoReleaseVpbSpinLock
• IoRemoveIoCompletion
• IoRemoveLinkShareAccess
• IoRemoveLinkShareAccessEx
• IoRemoveShareAccess
• IoReplaceFileObjectName
• IoReplacePartitionUnit
• IoReportDetectedDevice
• IoReportHalResourceUsage
• IoReportInterruptActive
• IoReportInterruptInactive
• IoReportResourceForDetection
• IoReportResourceUsage
• IoReportRootDevice
• IoReportTargetDeviceChange
• IoReportTargetDeviceChangeAsynchronous
• IoRequestDeviceEject
• IoRequestDeviceEjectEx
• IoRequestDeviceRemovalForReset
• IoReserveDependency
• IoReserveKsrPersistentMemory
• IoReserveKsrPersistentMemoryEx
• IoResolveDependency
• IoRetrievePriorityInfo
• IoReuseIrp
• IoSetActivityIdIrp
• IoSetActivityIdThread
• IoSetAdapterCryptoEngineExtension
• IoSetCompletionRoutineEx
• IoSetDependency
• IoSetDeviceInterfacePropertyData
• IoSetDeviceInterfaceState
• IoSetDevicePropertyData
• IoSetDeviceToVerify
• IoSetFileObjectIgnoreSharing
• IoSetFileOrigin
• IoSetFsTrackOffsetState
• IoSetFsZeroingOffset
• IoSetFsZeroingOffsetRequired
• IoSetGenericIrpExtension
• IoSetHardErrorOrVerifyDevice
• IoSetInformation
• IoSetIoAttributionIrp
• IoSetIoCompletion
• IoSetIoCompletionEx
• IoSetIoCompletionEx3
• IoSetIoPriorityHint
• IoSetIoPriorityHintIntoFileObject
• IoSetIoPriorityHintIntoThread
• IoSetIrpExtraCreateParameter
• IoSetLinkShareAccess
• IoSetMasterIrpStatus
• IoSetPartitionInformation
• IoSetPartitionInformationEx
• IoSetShadowFileInformation
• IoSetShareAccess
• IoSetShareAccessEx
• IoSetStartIoAttributes
• IoSetSystemPartition
• IoSetThreadHardErrorMode
• IoSetTopLevelIrp
• IoSizeOfIrpEx
• IoSizeofGenericIrpExtension
• IoSizeofWorkItem
• IoStartNextPacket
• IoStartNextPacketByKey
• IoStartPacket
• IoStartTimer
• IoStatisticsLock
• IoSteerInterrupt
• IoStopTimer
• IoSynchronousCallDriver
• IoSynchronousPageWrite
• IoTestDependency
• IoThreadToProcess
• IoTransferActivityId
• IoTranslateBusAddress
• IoTryQueueWorkItem
• IoUninitializeWorkItem
• IoUnregisterBootDriverCallback
• IoUnregisterContainerNotification
• IoUnregisterFileSystem
• IoUnregisterFsRegistrationChange
• IoUnregisterIoTracking
• IoUnregisterPlugPlayNotification
• IoUnregisterPlugPlayNotificationEx
• IoUnregisterPriorityCallback
• IoUnregisterShutdownNotification
• IoUpdateLinkShareAccess
• IoUpdateLinkShareAccessEx
• IoUpdateShareAccess
• IoValidateDeviceIoControlAccess
• IoVerifyPartitionTable
• IoVerifyVolume
• IoVolumeDeviceNameToGuid
• IoVolumeDeviceNameToGuidPath
• IoVolumeDeviceToDosName
• IoVolumeDeviceToGuid
• IoVolumeDeviceToGuidPath
• IoWMIAllocateInstanceIds
• IoWMIDeviceObjectToInstanceName
• IoWMIDeviceObjectToProviderId
• IoWMIExecuteMethod
• IoWMIHandleToInstanceName
• IoWMIOpenBlock
• IoWMIQueryAllData
• IoWMIQueryAllDataMultiple
• IoWMIQuerySingleInstance
• IoWMIQuerySingleInstanceMultiple
• IoWMIRegistrationControl
• IoWMISetNotificationCallback
• IoWMISetSingleInstance
• IoWMISetSingleItem
• IoWMISuggestInstanceName
• IoWMIWriteEvent
• IoWithinStackLimits
• IoWriteErrorLogEntry
• IoWriteKsrPersistentMemory
• IoWriteOperationCount
• IoWritePartitionTable
• IoWritePartitionTableEx
• IoWriteTransferCount
• IofCallDriver
• IofCompleteRequest
• KasanMarkAddressInvalid
• KasanMarkAddressRedZone
• KasanMarkAddressValid
• KasanTrackAddress
• KasanValidateAddress
• KdAcquireDebuggerLock
• KdChangeOption
• KdComPortInUse
• KdDebuggerEnabled
• KdDebuggerNotPresent
• KdDeregisterPowerHandler
• KdDisableDebugger
• KdEnableDebugger
• KdEnteredDebugger
• KdEventLoggingEnabled
• KdGetDebugDevice
• KdHvComPortInUse
• KdLogDbgPrint
• KdPollBreakIn
• KdPowerTransition
• KdPowerTransitionEx
• KdRefreshDebuggerNotPresent
• KdRegisterPowerHandler
• KdReleaseDebuggerLock
• KdSetEventLoggingPresent
• KdSystemDebugControl
• KeAcquireGuardedMutex
• KeAcquireGuardedMutexUnsafe
• KeAcquireInStackQueuedSpinLock
• KeAcquireInStackQueuedSpinLockAtDpcLevel
• KeAcquireInStackQueuedSpinLockForDpc
• KeAcquireInStackQueuedSpinLockRaiseToSynch
• KeAcquireInterruptSpinLock
• KeAcquireQueuedSpinLock
• KeAcquireQueuedSpinLockRaiseToSynch
• KeAcquireSpinLockAtDpcLevel
• KeAcquireSpinLockForDpc
• KeAcquireSpinLockRaiseToDpc
• KeAcquireSpinLockRaiseToSynch
• KeAddGroupAffinityEx
• KeAddProcessorAffinityEx
• KeAddProcessorGroupAffinity
• KeAddSystemServiceTable
• KeAddTriageDumpDataBlock
• KeAlertThread
• KeAllocateCalloutStack
• KeAllocateCalloutStackEx
• KeAllocateProcessorProfileStructures
• KeAndAffinityEx
• KeAndAffinityEx2
• KeAndGroupAffinityEx
• KeAreAllApcsDisabled
• KeAreApcsDisabled
• KeAttachProcess
• KeBugCheck
• KeBugCheckEx
• KeCancelTimer
• KeCancelTimer2
• KeCapturePersistentThreadState
• KeCheckProcessorAffinityEx
• KeCheckProcessorGroupAffinity
• KeClearEvent
• KeClockInterruptNotify
• KeClockTimerPowerChange
• KeComplementAffinityEx
• KeComplementAffinityEx2
• KeConnectInterruptForHal
• KeConvertAuxiliaryCounterToPerformanceCounter
• KeConvertPerformanceCounterToAuxiliaryCounter
• KeCopyAffinityEx
• KeCopyAffinityEx2
• KeCountSetBitsAffinityEx
• KeCountSetBitsGroupAffinity
• KeDelayExecutionThread
• KeDeregisterBoundCallback
• KeDeregisterBugCheckCallback
• KeDeregisterBugCheckReasonCallback
• KeDeregisterNmiCallback
• KeDeregisterProcessorChangeCallback
• KeDetachProcess
• KeDispatchSecondaryInterrupt
• KeDynamicPartitioningSupported
• KeEnterCriticalRegion
• KeEnterGuardedRegion
• KeEnterKernelDebugger
• KeEnumerateNextProcessor
• KeExpandKernelStackAndCallout
• KeExpandKernelStackAndCalloutEx
• KeFindConfigurationEntry
• KeFindConfigurationNextEntry
• KeFindFirstSetLeftAffinityEx
• KeFindFirstSetLeftGroupAffinity
• KeFindFirstSetRightAffinityEx
• KeFindFirstSetRightGroupAffinity
• KeFirstGroupAffinityEx
• KeFlushCurrentTbImmediately
• KeFlushEntireTb
• KeFlushIoBuffers
• KeFlushQueuedDpcs
• KeFlushWriteBuffer
• KeForceEnableNx
• KeFreeCalloutStack
• KeGenericCallDpc
• KeGetClockOwner
• KeGetClockTimerResolution
• KeGetCurrentIrql
• KeGetCurrentNodeNumber
• KeGetCurrentProcessorNumberEx
• KeGetCurrentThread
• KeGetEffectiveIrql
• KeGetNextClockTickDuration
• KeGetProcessorIndexFromNumber
• KeGetProcessorNumberFromIndex
• KeGetRecommendedSharedDataAlignment
• KeGetXSaveFeatureFlags
• KeHwPolicyLocateResource
• KeInitializeAffinityEx
• KeInitializeAffinityEx2
• KeInitializeApc
• KeInitializeCrashDumpHeader
• KeInitializeDeviceQueue
• KeInitializeDpc
• KeInitializeEnumerationContext
• KeInitializeEnumerationContextFromAffinity
• KeInitializeEnumerationContextFromGroup
• KeInitializeEvent
• KeInitializeGuardedMutex
• KeInitializeInterrupt
• KeInitializeMutant
• KeInitializeMutex
• KeInitializeQueue
• KeInitializeSecondaryInterruptServices
• KeInitializeSemaphore
• KeInitializeSpinLock
• KeInitializeThreadedDpc
• KeInitializeTimer
• KeInitializeTimer2
• KeInitializeTimerEx
• KeInitializeTriageDumpDataArray
• KeInsertByKeyDeviceQueue
• KeInsertDeviceQueue
• KeInsertHeadQueue
• KeInsertQueue
• KeInsertQueueApc
• KeInsertQueueDpc
• KeInterlockedClearProcessorAffinityEx
• KeInterlockedSetProcessorAffinityEx
• KeInvalidateAllCaches
• KeInvalidateRangeAllCaches
• KeInvalidateRangeAllCachesNoIpi
• KeIpiGenericCall
• KeIsAttachedProcess
• KeIsEmptyAffinityEx
• KeIsEqualAffinityEx
• KeIsExecutingDpc
• KeIsSingleGroupAffinityEx
• KeIsSubsetAffinityEx
• KeIsWaitListEmpty
• KeLastBranchMSR
• KeLeaveCriticalRegion
• KeLeaveGuardedRegion
• KeLoadMTRR
• KeLoaderBlock
• KeLowerIrql
• KeNotifyProcessorFreezeSupported
• KeNumberProcessors
• KeOrAffinityEx
• KeOrAffinityEx2
• KePrepareToDispatchVirtualProcessor
• KeProcessorGroupAffinity
• KeProfileInterruptWithSource
• KePulseEvent
• KeQueryActiveGroupCount
• KeQueryActiveProcessorAffinity
• KeQueryActiveProcessorAffinity2
• KeQueryActiveProcessorCount
• KeQueryActiveProcessorCountEx
• KeQueryActiveProcessors
• KeQueryAuxiliaryCounterFrequency
• KeQueryDpcWatchdogInformation
• KeQueryEffectivePriorityThread
• KeQueryGroupAffinity
• KeQueryGroupAffinityEx
• KeQueryHardwareCounterConfiguration
• KeQueryHeteroCpuPolicyThread
• KeQueryHighestNodeNumber
• KeQueryInterruptPartitionCount
• KeQueryInterruptPartitionInformation
• KeQueryInterruptTimePrecise
• KeQueryLogicalProcessorRelationship
• KeQueryMaximumGroupCount
• KeQueryMaximumProcessorCount
• KeQueryMaximumProcessorCountEx
• KeQueryNodeActiveAffinity
• KeQueryNodeActiveAffinity2
• KeQueryNodeActiveProcessorCount
• KeQueryNodeMaximumProcessorCount
• KeQueryPerformanceCounter
• KeQueryPrcbAddress
• KeQueryPriorityThread
• KeQueryRuntimeThread
• KeQuerySystemCpuPartitionAffinity
• KeQuerySystemTimePrecise
• KeQueryTimeIncrement
• KeQueryTotalCycleTimeThread
• KeQueryTypeEvent
• KeQueryUnbiasedInterruptTime
• KeQueryUnbiasedInterruptTimePrecise
• KeRaiseIrqlToDpcLevel
• KeRaiseUserException
• KeReadStateEvent
• KeReadStateMutant
• KeReadStateMutex
• KeReadStateQueue
• KeReadStateSemaphore
• KeReadStateTimer
• KeReenterRetpolinedCode
• KeRegisterBoundCallback
• KeRegisterBugCheckCallback
• KeRegisterBugCheckReasonCallback
• KeRegisterNmiCallback
• KeRegisterProcessorChangeCallback
• KeReinitializeAffinityEx
• KeReleaseGuardedMutex
• KeReleaseGuardedMutexUnsafe
• KeReleaseInStackQueuedSpinLock
• KeReleaseInStackQueuedSpinLockForDpc
• KeReleaseInStackQueuedSpinLockFromDpcLevel
• KeReleaseInterruptSpinLock
• KeReleaseMutant
• KeReleaseMutex
• KeReleaseQueuedSpinLock
• KeReleaseSemaphore
• KeReleaseSpinLock
• KeReleaseSpinLockForDpc
• KeReleaseSpinLockFromDpcLevel
• KeRemoveByKeyDeviceQueue
• KeRemoveByKeyDeviceQueueIfBusy
• KeRemoveDeviceQueue
• KeRemoveEntryDeviceQueue
• KeRemoveGroupAffinityEx
• KeRemoveProcessorAffinityEx
• KeRemoveProcessorGroupAffinity
• KeRemoveQueue
• KeRemoveQueueApc
• KeRemoveQueueDpc
• KeRemoveQueueDpcEx
• KeRemoveQueueEx
• KeRemoveSystemServiceTable
• KeReportCacheIncoherentDevice
• KeResetEvent
• KeRestoreExtendedProcessorState
• KeRestoreFloatingPointState
• KeRevertToUserAffinityThread
• KeRevertToUserAffinityThreadEx
• KeRevertToUserGroupAffinityThread
• KeRundownQueue
• KeSaveExtendedProcessorState
• KeSaveFloatingPointState
• KeSaveStateForHibernate
• KeSetActualBasePriorityThread
• KeSetAffinityThread
• KeSetBasePriorityThread
• KeSetCoalescableTimer
• KeSetDmaIoCoherency
• KeSetEvent
• KeSetEventBoostPriority
• KeSetHardwareCounterConfiguration
• KeSetHeteroCpuPolicyThread
• KeSetIdealProcessorThread
• KeSetImportanceDpc
• KeSetKernelStackSwapEnable
• KeSetLastBranchRecordInUse
• KeSetPriorityThread
• KeSetProfileIrql
• KeSetSelectedCpuSetsThread
• KeSetSystemAffinityThread
• KeSetSystemAffinityThreadEx
• KeSetSystemGroupAffinityThread
• KeSetTargetProcessorDpc
• KeSetTargetProcessorDpcEx
• KeSetTimer
• KeSetTimer2
• KeSetTimerEx
• KeShouldYieldProcessor
• KeSignalCallDpcDone
• KeSignalCallDpcSynchronize
• KeSizeOfAffinityEx
• KeStackAttachProcess
• KeStallExecutionProcessor
• KeStallWhileFrozen
• KeStartDynamicProcessor
• KeSubtractAffinityEx
• KeSubtractAffinityEx2
• KeSweepLocalCaches
• KeSynchronizeExecution
• KeSynchronizeTimeToQpc
• KeSystemFullyCacheCoherent
• KeTestAlertThread
• KeTestSpinLock
• KeTryToAcquireGuardedMutex
• KeTryToAcquireQueuedSpinLock
• KeTryToAcquireQueuedSpinLockRaiseToSynch
• KeTryToAcquireSpinLockAtDpcLevel
• KeUnstackDetachProcess
• KeUpdateThreadTag
• KeUserModeCallback
• KeWaitForMultipleObjects
• KeWaitForMutexObject
• KeWaitForSingleObject
• KeWriteProtectPAT
• KfRaiseIrql
• KiBugCheckData
• KiCheckForKernelApcDelivery
• KitLogFeatureUsage
• KseQueryDeviceData
• KseQueryDeviceDataList
• KseQueryDeviceFlags
• KseRegisterShim
• KseRegisterShimEx
• KseSetDeviceFlags
• KseUnregisterShim
• LdrAccessResource
• LdrEnumResources
• LdrFindResourceDirectory_U
• LdrFindResourceEx_U
• LdrFindResource_U
• LdrResFindResource
• LdrResFindResourceDirectory
• LdrResSearchResource
• LpcPortObjectType
• LpcReplyWaitReplyPort
• LpcRequestPort
• LpcRequestWaitReplyPort
• LpcRequestWaitReplyPortEx
• LpcSendWaitReceivePort
• LsaCallAuthenticationPackage
• LsaDeregisterLogonProcess
• LsaFreeReturnBuffer
• LsaLogonUser
• LsaLookupAuthenticationPackage
• LsaRegisterLogonProcess
• Mm64BitPhysicalAddress
• MmAddPhysicalMemory
• MmAddVerifierSpecialThunks
• MmAddVerifierThunks
• MmAdjustWorkingSetSize
• MmAdvanceMdl
• MmAllocateContiguousMemory
• MmAllocateContiguousMemoryEx
• MmAllocateContiguousMemorySpecifyCache
• MmAllocateContiguousMemorySpecifyCacheNode
• MmAllocateContiguousNodeMemory
• MmAllocateMappingAddress
• MmAllocateMappingAddressEx
• MmAllocateMdlForIoSpace
• MmAllocateMemoryRanges
• MmAllocateNodePagesForMdlEx
• MmAllocateNonCachedMemory
• MmAllocatePagesForMdl
• MmAllocatePagesForMdlEx
• MmAllocatePartitionNodePagesForMdlEx
• MmAreMdlPagesCached
• MmBadPointer
• MmBuildMdlForNonPagedPool
• MmCanFileBeTruncated
• MmChangeImageProtection
• MmCommitSessionMappedView
• MmConfigureGraphicsPtes
• MmCopyMemory
• MmCopyVirtualMemory
• MmCreateMdl
• MmCreateMirror
• MmCreateSection
• MmDisableModifiedWriteOfSection
• MmDoesFileHaveUserWritableReferences
• MmFlushImageSection
• MmForceSectionClosed
• MmForceSectionClosedEx
• MmFreeContiguousMemory
• MmFreeContiguousMemorySpecifyCache
• MmFreeMappingAddress
• MmFreeMemoryRanges
• MmFreeNonCachedMemory
• MmFreePagesFromMdl
• MmFreePagesFromMdlEx
• MmGetCacheAttribute
• MmGetCacheAttributeEx
• MmGetMaximumFileSectionSize
• MmGetPageBadStatus
• MmGetPhysicalAddress
• MmGetPhysicalMemoryRanges
• MmGetPhysicalMemoryRangesEx
• MmGetPhysicalMemoryRangesEx2
• MmGetSectionInformation
• MmGetSystemRoutineAddress
• MmGetVirtualForPhysical
• MmGrowKernelStack
• MmHighestUserAddress
• MmIsAddressValid
• MmIsDriverSuspectForVerifier
• MmIsDriverVerifying
• MmIsDriverVerifyingByAddress
• MmIsFileSectionActive
• MmIsIoSpaceActive
• MmIsNonPagedSystemAddressValid
• MmIsRecursiveIoFault
• MmIsThisAnNtAsSystem
• MmIsVerifierEnabled
• MmLoadSystemImage
• MmLockPagableDataSection
• MmLockPagableImageSection
• MmLockPagableSectionByHandle
• MmLockPreChargedPagedPool
• MmMapIoSpace
• MmMapIoSpaceEx
• MmMapLockedPages
• MmMapLockedPagesSpecifyCache
• MmMapLockedPagesWithReservedMapping
• MmMapMdl
• MmMapMemoryDumpMdl
• MmMapMemoryDumpMdlEx
• MmMapUserAddressesToPage
• MmMapVideoDisplay
• MmMapViewInSessionSpace
• MmMapViewInSessionSpaceEx
• MmMapViewInSystemSpace
• MmMapViewInSystemSpaceEx
• MmMapViewOfSection
• MmMarkPhysicalMemoryAsBad
• MmMarkPhysicalMemoryAsGood
• MmMdlPageContentsState
• MmMdlPagesAreZero
• MmObtainChargesToLockPagedPool
• MmPageEntireDriver
• MmPrefetchPages
• MmPrefetchVirtualAddresses
• MmProbeAndLockPages
• MmProbeAndLockProcessPages
• MmProbeAndLockSelectedPages
• MmProtectDriverSection
• MmProtectMdlSystemAddress
• MmQueryMemoryRanges
• MmQuerySystemSize
• MmRemovePhysicalMemory
• MmResetDriverPaging
• MmReturnChargesToLockPagedPool
• MmRotatePhysicalView
• MmSectionObjectType
• MmSecureVirtualMemory
• MmSecureVirtualMemoryEx
• MmSetAddressRangeModified
• MmSetBankedSection
• MmSetGraphicsPtes
• MmSetPermanentCacheAttribute
• MmSizeOfMdl
• MmSystemRangeStart
• MmTrimAllSystemPagableMemory
• MmUnloadSystemImage
• MmUnlockPagableImageSection
• MmUnlockPages
• MmUnlockPreChargedPagedPool
• MmUnmapIoSpace
• MmUnmapLockedPages
• MmUnmapReservedMapping
• MmUnmapVideoDisplay
• MmUnmapViewInSessionSpace
• MmUnmapViewInSystemSpace
• MmUnmapViewOfSection
• MmUnsecureVirtualMemory
• MmUserProbeAddress
• NlsAnsiCodePage
• NlsLeadByteInfo
• NlsMbCodePageTag
• NlsMbOemCodePageTag
• NlsOemCodePage
• NlsOemLeadByteInfo
• NtAddAtom
• NtAdjustPrivilegesToken
• NtAllocateLocallyUniqueId
• NtAllocateUuids
• NtAllocateVirtualMemory
• NtBuildGUID
• NtBuildLab
• NtBuildNumber
• NtClose
• NtCommitComplete
• NtCommitEnlistment
• NtCommitTransaction
• NtCompareSigningLevels
• NtConnectPort
• NtCopyFileChunk
• NtCreateCrossVmEvent
• NtCreateEnlistment
• NtCreateEvent
• NtCreateFile
• NtCreateResourceManager
• NtCreateSection
• NtCreateTransaction
• NtCreateTransactionManager
• NtDeleteAtom
• NtDeleteFile
• NtDeviceIoControlFile
• NtDuplicateObject
• NtDuplicateToken
• NtEnumerateTransactionObject
• NtFindAtom
• NtFreeVirtualMemory
• NtFreezeTransactions
• NtFsControlFile
• NtGetEnvironmentVariableEx
• NtGetNotificationResourceManager
• NtGlobalFlag
• NtImageInfo
• NtLockFile
• NtMakePermanentObject
• NtMapViewOfSection
• NtNotifyChangeDirectoryFile
• NtNotifyChangeDirectoryFileEx
• NtOpenEnlistment
• NtOpenFile
• NtOpenProcess
• NtOpenProcessToken
• NtOpenProcessTokenEx
• NtOpenResourceManager
• NtOpenThread
• NtOpenThreadToken
• NtOpenThreadTokenEx
• NtOpenTransaction
• NtOpenTransactionManager
• NtPrePrepareComplete
• NtPrePrepareEnlistment
• NtPrepareComplete
• NtPrepareEnlistment
• NtPropagationComplete
• NtPropagationFailed
• NtQueryDirectoryFile
• NtQueryDirectoryFileEx
• NtQueryEaFile
• NtQueryEnvironmentVariableInfoEx
• NtQueryInformationAtom
• NtQueryInformationByName
• NtQueryInformationEnlistment
• NtQueryInformationFile
• NtQueryInformationProcess
• NtQueryInformationResourceManager
• NtQueryInformationThread
• NtQueryInformationToken
• NtQueryInformationTransaction
• NtQueryInformationTransactionManager
• NtQueryQuotaInformationFile
• NtQuerySecurityAttributesToken
• NtQuerySecurityObject
• NtQuerySystemInformation
• NtQuerySystemInformationEx
• NtQueryVolumeInformationFile
• NtReadFile
• NtReadFileScatter
• NtReadOnlyEnlistment
• NtRecoverEnlistment
• NtRecoverResourceManager
• NtRecoverTransactionManager
• NtRequestPort
• NtRequestWaitReplyPort
• NtRollbackComplete
• NtRollbackEnlistment
• NtRollbackTransaction
• NtSetCachedSigningLevel
• NtSetEaFile
• NtSetEvent
• NtSetInformationEnlistment
• NtSetInformationFile
• NtSetInformationProcess
• NtSetInformationResourceManager
• NtSetInformationThread
• NtSetInformationToken
• NtSetInformationTransaction
• NtSetInformationVirtualMemory
• NtSetQuotaInformationFile
• NtSetSecurityObject
• NtSetVolumeInformationFile
• NtShutdownSystem
• NtThawTransactions
• NtTraceControl
• NtTraceEvent
• NtUnlockFile
• NtVdmControl
• NtWaitForSingleObject
• NtWriteFile
• NtWriteFileGather
• ObAssignSecurity
• ObCheckCreateObjectAccess
• ObCheckObjectAccess
• ObCloseHandle
• ObCreateObject
• ObCreateObjectType
• ObCreateObjectTypeEx
• ObDeleteCapturedInsertInfo
• ObDereferenceObject
• ObDereferenceObjectDeferDelete
• ObDereferenceObjectDeferDeleteWithTag
• ObDereferenceSecurityDescriptor
• ObDuplicateObject
• ObFindHandleForObject
• ObGetFilterVersion
• ObGetObjectSecurity
• ObGetObjectType
• ObInsertObject
• ObIsDosDeviceLocallyMapped
• ObIsKernelHandle
• ObLogSecurityDescriptor
• ObMakeTemporaryObject
• ObOpenObjectByName
• ObOpenObjectByNameEx
• ObOpenObjectByPointer
• ObOpenObjectByPointerWithTag
• ObQueryNameInfo
• ObQueryNameString
• ObQueryObjectAuditingByHandle
• ObReferenceObjectByHandle
• ObReferenceObjectByHandleWithTag
• ObReferenceObjectByName
• ObReferenceObjectByPointer
• ObReferenceObjectByPointerWithTag
• ObReferenceObjectSafe
• ObReferenceObjectSafeWithTag
• ObReferenceSecurityDescriptor
• ObRegisterCallbacks
• ObReleaseObjectSecurity
• ObSetHandleAttributes
• ObSetSecurityDescriptorInfo
• ObSetSecurityObjectByPointer
• ObUnRegisterCallbacks
• ObWaitForMultipleObjects
• ObWaitForSingleObject
• ObfDereferenceObject
• ObfDereferenceObjectWithTag
• ObfReferenceObject
• ObfReferenceObjectWithTag
• POGOBuffer
• PcwAddInstance
• PcwCloseInstance
• PcwCreateInstance
• PcwRegister
• PcwUnregister
• PfFileInfoNotify
• PfxFindPrefix
• PfxInitialize
• PfxInsertPrefix
• PfxRemovePrefix
• PoCallDriver
• PoCancelDeviceNotify
• PoClearPowerRequest
• PoCpuIdledSinceLastCallImprecise
• PoCreatePowerRequest
• PoCreateThermalRequest
• PoDeletePowerRequest
• PoDeleteThermalRequest
• PoDirectedDripsClearDeviceFlags
• PoDirectedDripsSetDeviceFlags
• PoDisableSleepStates
• PoEndDeviceBusy
• PoEnergyEstimationEnabled
• PoFxActivateComponent
• PoFxAddComponentRelation
• PoFxAddDeviceRelation
• PoFxCompleteDevicePowerNotRequired
• PoFxCompleteDirectedPowerDown
• PoFxCompleteIdleCondition
• PoFxCompleteIdleState
• PoFxEnableDStateReporting
• PoFxIdleComponent
• PoFxIssueComponentPerfStateChange
• PoFxIssueComponentPerfStateChangeMultiple
• PoFxNotifySurprisePowerOn
• PoFxPowerControl
• PoFxPowerOnCrashdumpDevice
• PoFxProcessorNotification
• PoFxQueryCurrentComponentPerfState
• PoFxRegisterComponentPerfStates
• PoFxRegisterCoreDevice
• PoFxRegisterCrashdumpDevice
• PoFxRegisterDevice
• PoFxRegisterDripsWatchdogCallback
• PoFxRegisterPlugin
• PoFxRegisterPluginEx
• PoFxRegisterPrimaryDevice
• PoFxRemoveComponentRelation
• PoFxRemoveDeviceRelation
• PoFxReportDevicePoweredOn
• PoFxSetComponentLatency
• PoFxSetComponentResidency
• PoFxSetComponentWake
• PoFxSetDeviceIdleTimeout
• PoFxSetTargetDripsDevicePowerState
• PoFxStartDevicePowerManagement
• PoFxUnregisterDevice
• PoGetProcessorIdleAccounting
• PoGetSystemWake
• PoGetThermalRequestSupport
• PoInitiateProcessorWake
• PoLatencySensitivityHint
• PoNotifyMediaBuffering
• PoNotifyVSyncChange
• PoQueryWatchdogTime
• PoQueueShutdownWorkItem
• PoReenableSleepStates
• PoRegisterCoalescingCallback
• PoRegisterDeviceForIdleDetection
• PoRegisterDeviceNotify
• PoRegisterPowerSettingCallback
• PoRegisterSystemState
• PoRequestPowerIrp
• PoRequestShutdownEvent
• PoSetDeviceBusyEx
• PoSetFixedWakeSource
• PoSetHiberRange
• PoSetPowerButtonHoldState
• PoSetPowerRequest
• PoSetPowerState
• PoSetSystemState
• PoSetSystemWake
• PoSetSystemWakeDevice
• PoSetThermalActiveCooling
• PoSetThermalPassiveCooling
• PoSetUserPresent
• PoShutdownBugCheck
• PoStartDeviceBusy
• PoStartNextPowerIrp
• PoUnregisterCoalescingCallback
• PoUnregisterPowerSettingCallback
• PoUnregisterSystemState
• PoUserShutdownCancelled
• PoUserShutdownInitiated
• ProbeForRead
• ProbeForWrite
• PsAcquireProcessExitSynchronization
• PsAcquireSiloHardReference
• PsAllocSiloContextSlot
• PsAllocateAffinityToken
• PsAssignImpersonationToken
• PsAssignProcessToJobObject
• PsAttachSiloToCurrentThread
• PsChargePoolQuota
• PsChargeProcessNonPagedPoolQuota
• PsChargeProcessPagedPoolQuota
• PsChargeProcessPoolQuota
• PsChargeProcessWakeCounter
• PsCheckProcessFileSigningLevel
• PsCreateSiloContext
• PsCreateSystemThread
• PsCreateSystemThreadEx
• PsDereferenceImpersonationToken
• PsDereferenceKernelStack
• PsDereferencePrimaryToken
• PsDereferenceSiloContext
• PsDetachSiloFromCurrentThread
• PsDisableImpersonation
• PsEnterPriorityRegion
• PsEstablishWin32Callouts
• PsFreeAffinityToken
• PsFreeSiloContextSlot
• PsGetContextThread
• PsGetCurrentProcess
• PsGetCurrentProcessId
• PsGetCurrentProcessSessionId
• PsGetCurrentProcessWin32Process
• PsGetCurrentProcessWow64Process
• PsGetCurrentServerSilo
• PsGetCurrentServerSiloName
• PsGetCurrentSilo
• PsGetCurrentThread
• PsGetCurrentThreadId
• PsGetCurrentThreadPreviousMode
• PsGetCurrentThreadProcess
• PsGetCurrentThreadProcessId
• PsGetCurrentThreadStackBase
• PsGetCurrentThreadStackLimit
• PsGetCurrentThreadTeb
• PsGetCurrentThreadWin32Thread
• PsGetCurrentThreadWin32ThreadAndEnterCriticalRegion
• PsGetEffectiveContainerId
• PsGetEffectiveServerSilo
• PsGetHostSilo
• PsGetJobLock
• PsGetJobProperty
• PsGetJobServerSilo
• PsGetJobSessionId
• PsGetJobSilo
• PsGetJobUIRestrictionsClass
• PsGetParentSilo
• PsGetPermanentSiloContext
• PsGetProcessCommonJob
• PsGetProcessCreateTimeQuadPart
• PsGetProcessDebugPort
• PsGetProcessDxgProcess
• PsGetProcessExitProcessCalled
• PsGetProcessExitStatus
• PsGetProcessExitTime
• PsGetProcessId
• PsGetProcessImageFileName
• PsGetProcessInheritedFromUniqueProcessId
• PsGetProcessJob
• PsGetProcessMachine
• PsGetProcessPeb
• PsGetProcessPriorityClass
• PsGetProcessProtection
• PsGetProcessSectionBaseAddress
• PsGetProcessSecurityPort
• PsGetProcessSequenceNumber
• PsGetProcessServerSilo
• PsGetProcessSessionId
• PsGetProcessSessionIdEx
• PsGetProcessSignatureLevel
• PsGetProcessSilo
• PsGetProcessStartKey
• PsGetProcessWin32Process
• PsGetProcessWin32WindowStation
• PsGetProcessWow64Process
• PsGetServerSiloServiceSessionId
• PsGetSiloContainerId
• PsGetSiloContext
• PsGetSiloIdentifier
• PsGetSiloMonitorContextSlot
• PsGetThreadCreateTime
• PsGetThreadExitStatus
• PsGetThreadFreezeCount
• PsGetThreadHardErrorsAreDisabled
• PsGetThreadId
• PsGetThreadProcess
• PsGetThreadProcessId
• PsGetThreadProperty
• PsGetThreadServerSilo
• PsGetThreadSessionId
• PsGetThreadTeb
• PsGetThreadWin32Thread
• PsGetVersion
• PsGetWin32KFilterSet
• PsImpersonateClient
• PsInitialSystemProcess
• PsInsertPermanentSiloContext
• PsInsertSiloContext
• PsIsComponentEnabled
• PsIsCurrentThreadInServerSilo
• PsIsCurrentThreadPrefetching
• PsIsDiskCountersEnabled
• PsIsHostSilo
• PsIsProcessBeingDebugged
• PsIsProcessCommitRelinquished
• PsIsProcessInAppSilo
• PsIsProtectedProcess
• PsIsProtectedProcessLight
• PsIsSystemProcess
• PsIsSystemThread
• PsIsThreadImpersonating
• PsIsThreadTerminating
• PsIsWin32KFilterAuditEnabled
• PsIsWin32KFilterAuditEnabledForProcess
• PsIsWin32KFilterEnabled
• PsIsWin32KFilterEnabledForProcess
• PsJobType
• PsLeavePriorityRegion
• PsLoadedModuleList
• PsLoadedModuleResource
• PsLookupProcessByProcessId
• PsLookupProcessThreadByCid
• PsLookupThreadByThreadId
• PsMakeSiloContextPermanent
• PsPartitionType
• PsProcessType
• PsQueryProcessAttributesByToken
• PsQueryProcessCommandLine
• PsQueryProcessExceptionFlags
• PsQuerySyscallProviderInformation
• PsQueryTotalCycleTimeProcess
• PsReferenceImpersonationToken
• PsReferenceKernelStack
• PsReferencePrimaryToken
• PsReferenceProcessFilePointer
• PsReferenceSiloContext
• PsRegisterAltSystemCallHandler
• PsRegisterPicoProvider
• PsRegisterSiloMonitor
• PsRegisterSyscallProvider
• PsReleaseProcessExitSynchronization
• PsReleaseProcessWakeCounter
• PsReleaseSiloHardReference
• PsRemoveCreateThreadNotifyRoutine
• PsRemoveLoadImageNotifyRoutine
• PsRemoveSiloContext
• PsReplaceSiloContext
• PsRestoreImpersonation
• PsResumeProcess
• PsReturnPoolQuota
• PsReturnProcessNonPagedPoolQuota
• PsReturnProcessPagedPoolQuota
• PsRevertThreadToSelf
• PsRevertToSelf
• PsRevertToUserMultipleGroupAffinityThread
• PsSetContextThread
• PsSetCreateProcessNotifyRoutine
• PsSetCreateProcessNotifyRoutineEx
• PsSetCreateProcessNotifyRoutineEx2
• PsSetCreateThreadNotifyRoutine
• PsSetCreateThreadNotifyRoutineEx
• PsSetCurrentThreadPrefetching
• PsSetJobProperty
• PsSetLegoNotifyRoutine
• PsSetLoadImageNotifyRoutine
• PsSetLoadImageNotifyRoutineEx
• PsSetProcessDxgProcess
• PsSetProcessFaultInformation
• PsSetProcessPriorityByClass
• PsSetProcessPriorityClass
• PsSetProcessSecurityPort
• PsSetProcessWin32Process
• PsSetProcessWindowStation
• PsSetSystemMultipleGroupAffinityThread
• PsSetThreadHardErrorsAreDisabled
• PsSetThreadProperty
• PsSetThreadWin32Thread
• PsSiloContextNonPagedType
• PsSiloContextPagedType
• PsStartSiloMonitor
• PsSuspendProcess
• PsTerminateServerSilo
• PsTerminateSystemThread
• PsThreadType
• PsTlsAlloc
• PsTlsFree
• PsTlsGetValue
• PsTlsSetValue
• PsUILanguageComitted
• PsUnregisterSiloMonitor
• PsUnregisterSyscallProvider
• PsUpdateComponentPower
• PsUpdateDiskCounters
• PsWow64GetProcessMachine
• PsWow64IsMachineSupported
• PsWrapApcWow64Thread
• RtlAbsoluteToSelfRelativeSD
• RtlAddAccessAllowedAce
• RtlAddAccessAllowedAceEx
• RtlAddAccessAllowedObjectAce
• RtlAddAccessDeniedAceEx
• RtlAddAccessDeniedObjectAce
• RtlAddAccessFilterAce
• RtlAddAce
• RtlAddAtomToAtomTable
• RtlAddAtomToAtomTableEx
• RtlAddAuditAccessAceEx
• RtlAddAuditAccessObjectAce
• RtlAddMandatoryAce
• RtlAddProcessTrustLabelAce
• RtlAddRange
• RtlAddResourceAttributeAce
• RtlAllocateHeap
• RtlAnsiCharToUnicodeChar
• RtlAnsiStringToUnicodeSize
• RtlAnsiStringToUnicodeString
• RtlAppendAsciizToString
• RtlAppendStringToString
• RtlAppendUnicodeStringToString
• RtlAppendUnicodeToString
• RtlAreAllAccessesGranted
• RtlAreAnyAccessesGranted
• RtlAreBitsClear
• RtlAreBitsClearEx
• RtlAreBitsSet
• RtlAreBitsSetEx
• RtlAssert
• RtlAvlInsertNodeEx
• RtlAvlRemoveNode
• RtlCapabilityCheck
• RtlCapabilityCheckForSingleSessionSku
• RtlCaptureContext
• RtlCaptureStackBackTrace
• RtlCharToInteger
• RtlCheckPortableOperatingSystem
• RtlCheckRegistryKey
• RtlCheckSystemBootStatusIntegrity
• RtlCheckTokenCapability
• RtlCheckTokenMembership
• RtlCheckTokenMembershipEx
• RtlClearAllBits
• RtlClearAllBitsEx
• RtlClearBit
• RtlClearBitEx
• RtlClearBits
• RtlClearBitsEx
• RtlCmDecodeMemIoResource
• RtlCmEncodeMemIoResource
• RtlCompareAltitudes
• RtlCompareExchangePointerMapping
• RtlCompareExchangePropertyStore
• RtlCompareMemory
• RtlCompareMemoryUlong
• RtlCompareString
• RtlCompareUnicodeString
• RtlCompareUnicodeStrings
• RtlCompressBuffer
• RtlCompressChunks
• RtlComputeCrc32
• RtlConstructCrossVmEventPath
• RtlConstructCrossVmMutexPath
• RtlContractHashTable
• RtlConvertHostPerfCounterToPerfCounter
• RtlConvertSidToUnicodeString
• RtlCopyBitMap
• RtlCopyBitMapEx
• RtlCopyContext
• RtlCopyExtendedContext
• RtlCopyLuid
• RtlCopyLuidAndAttributesArray
• RtlCopyMemory
• RtlCopyMemoryNonTemporal
• RtlCopyRangeList
• RtlCopySid
• RtlCopySidAndAttributesArray
• RtlCopyString
• RtlCopyUnicodeString
• RtlCrc32
• RtlCrc64
• RtlCreateAcl
• RtlCreateAtomTable
• RtlCreateAtomTableEx
• RtlCreateHashTable
• RtlCreateHashTableEx
• RtlCreateHeap
• RtlCreateRegistryKey
• RtlCreateSecurityDescriptor
• RtlCreateSystemVolumeInformationFolder
• RtlCreateUnicodeString
• RtlCreateUnicodeStringFromAsciiz
• RtlCreateUserThread
• RtlCultureNameToLCID
• RtlCustomCPToUnicodeN
• RtlDecompressBuffer
• RtlDecompressBufferEx
• RtlDecompressBufferEx2
• RtlDecompressChunks
• RtlDecompressFragment
• RtlDecompressFragmentEx
• RtlDelete
• RtlDeleteAce
• RtlDeleteAtomFromAtomTable
• RtlDeleteElementGenericTable
• RtlDeleteElementGenericTableAvl
• RtlDeleteElementGenericTableAvlEx
• RtlDeleteHashTable
• RtlDeleteNoSplay
• RtlDeleteOwnersRanges
• RtlDeleteRange
• RtlDeleteRegistryValue
• RtlDeriveCapabilitySidsFromName
• RtlDescribeChunk
• RtlDestroyAtomTable
• RtlDestroyHeap
• RtlDowncaseUnicodeChar
• RtlDowncaseUnicodeString
• RtlDrainNonVolatileFlush
• RtlDuplicateUnicodeString
• RtlEmptyAtomTable
• RtlEndEnumerationHashTable
• RtlEndStrongEnumerationHashTable
• RtlEndWeakEnumerationHashTable
• RtlEnumerateEntryHashTable
• RtlEnumerateGenericTable
• RtlEnumerateGenericTableAvl
• RtlEnumerateGenericTableLikeADirectory
• RtlEnumerateGenericTableWithoutSplaying
• RtlEnumerateGenericTableWithoutSplayingAvl
• RtlEqualLuid
• RtlEqualSid
• RtlEqualString
• RtlEqualUnicodeString
• RtlEqualWnfChangeStamps
• RtlEthernetAddressToStringA
• RtlEthernetAddressToStringW
• RtlEthernetStringToAddressA
• RtlEthernetStringToAddressW
• RtlExpandHashTable
• RtlExtendCorrelationVector
• RtlExtractBitMap
• RtlExtractBitMapEx
• RtlFillMemory
• RtlFillMemoryNonTemporal
• RtlFillNonVolatileMemory
• RtlFindAceByType
• RtlFindClearBits
• RtlFindClearBitsAndSet
• RtlFindClearBitsAndSetEx
• RtlFindClearBitsEx
• RtlFindClearRuns
• RtlFindClosestEncodableLength
• RtlFindExportedRoutineByName
• RtlFindFirstRunClear
• RtlFindLastBackwardRunClear
• RtlFindLeastSignificantBit
• RtlFindLongestRunClear
• RtlFindMessage
• RtlFindMostSignificantBit
• RtlFindNextForwardRunClear
• RtlFindNextForwardRunClearCapped
• RtlFindNextForwardRunClearEx
• RtlFindRange
• RtlFindSetBits
• RtlFindSetBitsAndClear
• RtlFindSetBitsAndClearEx
• RtlFindSetBitsEx
• RtlFindUnicodePrefix
• RtlFindUnicodeSubstring
• RtlFirstFreeAce
• RtlFlushNonVolatileMemory
• RtlFlushNonVolatileMemoryRanges
• RtlFormatCurrentUserKeyPath
• RtlFormatMessage
• RtlFreeAnsiString
• RtlFreeHeap
• RtlFreeNonVolatileToken
• RtlFreeOemString
• RtlFreeRangeList
• RtlFreeUTF8String
• RtlFreeUnicodeString
• RtlGUIDFromString
• RtlGenerate8dot3Name
• RtlGenerateClass5Guid
• RtlGetAce
• RtlGetActiveConsoleId
• RtlGetAppContainerNamedObjectPath
• RtlGetAppContainerParent
• RtlGetAppContainerSidType
• RtlGetCallersAddress
• RtlGetCompressionWorkSpaceSize
• RtlGetConsoleSessionForegroundProcessId
• RtlGetControlSecurityDescriptor
• RtlGetCurrentServiceSessionId
• RtlGetDaclSecurityDescriptor
• RtlGetDefaultCodePage
• RtlGetElementGenericTable
• RtlGetElementGenericTableAvl
• RtlGetEnabledExtendedAndSupervisorFeatures
• RtlGetEnabledExtendedFeatures
• RtlGetExtendedContextLength
• RtlGetFirstRange
• RtlGetGroupSecurityDescriptor
• RtlGetIntegerAtom
• RtlGetLastRange
• RtlGetMultiTimePrecise
• RtlGetNextEntryHashTable
• RtlGetNextRange
• RtlGetNonVolatileToken
• RtlGetNtGlobalFlags
• RtlGetNtProductType
• RtlGetNtSystemRoot
• RtlGetOwnerSecurityDescriptor
• RtlGetPersistedStateLocation
• RtlGetProductInfo
• RtlGetSaclSecurityDescriptor
• RtlGetSessionProperties
• RtlGetSetBootStatusData
• RtlGetSuiteMask
• RtlGetSystemBootStatus
• RtlGetSystemBootStatusEx
• RtlGetSystemGlobalData
• RtlGetThreadLangIdByIndex
• RtlGetTokenNamedObjectPath
• RtlGetVersion
• RtlHashUnicodeString
• RtlIdnToAscii
• RtlIdnToNameprepUnicode
• RtlIdnToUnicode
• RtlImageDirectoryEntryToData
• RtlImageNtHeader
• RtlImageNtHeaderEx
• RtlIncrementCorrelationVector
• RtlInitAnsiString
• RtlInitAnsiStringEx
• RtlInitCodePageTable
• RtlInitEnumerationHashTable
• RtlInitString
• RtlInitStringEx
• RtlInitStrongEnumerationHashTable
• RtlInitUTF8String
• RtlInitUTF8StringEx
• RtlInitUnicodeString
• RtlInitUnicodeStringEx
• RtlInitWeakEnumerationHashTable
• RtlInitializeBitMap
• RtlInitializeBitMapEx
• RtlInitializeCorrelationVector
• RtlInitializeExtendedContext
• RtlInitializeGenericTable
• RtlInitializeGenericTableAvl
• RtlInitializeRangeList
• RtlInitializeSid
• RtlInitializeSidEx
• RtlInitializeUnicodePrefix
• RtlInsertElementGenericTable
• RtlInsertElementGenericTableAvl
• RtlInsertElementGenericTableFull
• RtlInsertElementGenericTableFullAvl
• RtlInsertEntryHashTable
• RtlInsertUnicodePrefix
• RtlInt64ToUnicodeString
• RtlIntegerToChar
• RtlIntegerToUnicode
• RtlIntegerToUnicodeString
• RtlInterlockedClearBitRun
• RtlInterlockedClearBitRunEx
• RtlInterlockedSetBitRun
• RtlInterlockedSetBitRunEx
• RtlInterlockedSetClearRun
• RtlIntersectBitMaps
• RtlIntersectBitMapsEx
• RtlInvertRangeList
• RtlInvertRangeListEx
• RtlIoDecodeMemIoResource
• RtlIoEncodeMemIoResource
• RtlIpv4AddressToStringA
• RtlIpv4AddressToStringExA
• RtlIpv4AddressToStringExW
• RtlIpv4AddressToStringW
• RtlIpv4StringToAddressA
• RtlIpv4StringToAddressExA
• RtlIpv4StringToAddressExW
• RtlIpv4StringToAddressW
• RtlIpv6AddressToStringA
• RtlIpv6AddressToStringExA
• RtlIpv6AddressToStringExW
• RtlIpv6AddressToStringW
• RtlIpv6StringToAddressA
• RtlIpv6StringToAddressExA
• RtlIpv6StringToAddressExW
• RtlIpv6StringToAddressW
• RtlIsApiSetImplemented
• RtlIsCloudFilesPlaceholder
• RtlIsElevatedRid
• RtlIsGenericTableEmpty
• RtlIsGenericTableEmptyAvl
• RtlIsMultiSessionSku
• RtlIsMultiUsersInSessionSku
• RtlIsNameLegalDOS8Dot3
• RtlIsNonEmptyDirectoryReparsePointAllowed
• RtlIsNormalizedString
• RtlIsNtDdiVersionAvailable
• RtlIsPartialPlaceholder
• RtlIsPartialPlaceholderFileHandle
• RtlIsPartialPlaceholderFileInfo
• RtlIsProcessorFeaturePresent
• RtlIsRangeAvailable
• RtlIsSandboxedToken
• RtlIsServicePackVersionInstalled
• RtlIsStateSeparationEnabled
• RtlIsUntrustedObject
• RtlIsValidOemCharacter
• RtlIsZeroMemory
• RtlLCIDToCultureName
• RtlLargeIntegerToChar
• RtlLengthRequiredSid
• RtlLengthSecurityDescriptor
• RtlLengthSid
• RtlLoadString
• RtlLocalTimeToSystemTime
• RtlLocateSupervisorFeature
• RtlLockBootStatusData
• RtlLookupAtomInAtomTable
• RtlLookupElementGenericTable
• RtlLookupElementGenericTableAvl
• RtlLookupElementGenericTableFull
• RtlLookupElementGenericTableFullAvl
• RtlLookupEntryHashTable
• RtlLookupFirstMatchingElementGenericTableAvl
• RtlLookupFunctionEntry
• RtlMapGenericMask
• RtlMapSecurityErrorToNtStatus
• RtlMergeBitMaps
• RtlMergeBitMapsEx
• RtlMergeRangeLists
• RtlMoveMemory
• RtlMultiByteToUnicodeN
• RtlMultiByteToUnicodeSize
• RtlNextUnicodePrefix
• RtlNormalizeSecurityDescriptor
• RtlNormalizeString
• RtlNotifyFeatureUsage
• RtlNtStatusToDosError
• RtlNtStatusToDosErrorNoTeb
• RtlNumberGenericTableElements
• RtlNumberGenericTableElementsAvl
• RtlNumberOfClearBits
• RtlNumberOfClearBitsEx
• RtlNumberOfClearBitsInRange
• RtlNumberOfSetBits
• RtlNumberOfSetBitsEx
• RtlNumberOfSetBitsInRange
• RtlNumberOfSetBitsInRangeEx
• RtlNumberOfSetBitsUlongPtr
• RtlOemStringToCountedUnicodeString
• RtlOemStringToUnicodeSize
• RtlOemStringToUnicodeString
• RtlOemToUnicodeN
• RtlOpenCurrentUser
• RtlOpenImageFileOptionsKey
• RtlOsDeploymentState
• RtlOwnerAcesPresent
• RtlPcToFileHeader
• RtlPcToFileName
• RtlPcToFilePath
• RtlPinAtomInAtomTable
• RtlPrefetchMemoryNonTemporal
• RtlPrefixString
• RtlPrefixUnicodeString
• RtlQueryAllFeatureConfigurations
• RtlQueryAtomInAtomTable
• RtlQueryDynamicTimeZoneInformation
• RtlQueryElevationFlags
• RtlQueryFeatureConfiguration
• RtlQueryFeatureConfigurationChangeStamp
• RtlQueryImageFileKeyOption
• RtlQueryInformationAcl
• RtlQueryModuleInformation
• RtlQueryPackageClaims
• RtlQueryPackageIdentity
• RtlQueryPointerMapping
• RtlQueryProcessPlaceholderCompatibilityMode
• RtlQueryPropertyStore
• RtlQueryRegistryValueWithFallback
• RtlQueryRegistryValues
• RtlQueryRegistryValuesEx
• RtlQueryThreadPlaceholderCompatibilityMode
• RtlQueryTimeZoneInformation
• RtlQueryValidationRunlevel
• RtlRaiseCustomSystemEventTrigger
• RtlRaiseException
• RtlRaiseStatus
• RtlRandom
• RtlRandomEx
• RtlRbInsertNodeEx
• RtlRbRemoveNode
• RtlRbReplaceNode
• RtlRealPredecessor
• RtlRealSuccessor
• RtlRegisterFeatureConfigurationChangeNotification
• RtlRemoveEntryHashTable
• RtlRemovePointerMapping
• RtlRemovePropertyStore
• RtlRemoveUnicodePrefix
• RtlReplaceSidInSd
• RtlReserveChunk
• RtlRestoreContext
• RtlRestoreSystemBootStatusDefaults
• RtlRunOnceBeginInitialize
• RtlRunOnceComplete
• RtlRunOnceExecuteOnce
• RtlRunOnceInitialize
• RtlSecondsSince1970ToTime
• RtlSecondsSince1980ToTime
• RtlSelfRelativeToAbsoluteSD
• RtlSelfRelativeToAbsoluteSD2
• RtlSetActiveConsoleId
• RtlSetAllBits
• RtlSetAllBitsEx
• RtlSetBit
• RtlSetBitEx
• RtlSetBits
• RtlSetBitsEx
• RtlSetConsoleSessionForegroundProcessId
• RtlSetControlSecurityDescriptor
• RtlSetDaclSecurityDescriptor
• RtlSetDynamicTimeZoneInformation
• RtlSetGroupSecurityDescriptor
• RtlSetOwnerSecurityDescriptor
• RtlSetPortableOperatingSystem
• RtlSetProcessPlaceholderCompatibilityMode
• RtlSetSaclSecurityDescriptor
• RtlSetSystemBootStatus
• RtlSetSystemBootStatusEx
• RtlSetSystemGlobalData
• RtlSetThreadPlaceholderCompatibilityMode
• RtlSetTimeZoneInformation
• RtlShiftLeftBitMap
• RtlShiftLeftBitMapEx
• RtlSidHashInitialize
• RtlSidHashLookup
• RtlSizeHeap
• RtlSplay
• RtlStringFromGUID
• RtlStringFromGUIDEx
• RtlStronglyEnumerateEntryHashTable
• RtlSubAuthorityCountSid
• RtlSubAuthoritySid
• RtlSubtreePredecessor
• RtlSubtreeSuccessor
• RtlSuffixUnicodeString
• RtlSystemTimeToLocalTime
• RtlTestBit
• RtlTestBitEx
• RtlTimeFieldsToTime
• RtlTimeToElapsedTimeFields
• RtlTimeToSecondsSince1970
• RtlTimeToSecondsSince1980
• RtlTimeToTimeFields
• RtlTraceDatabaseAdd
• RtlTraceDatabaseCreate
• RtlTraceDatabaseDestroy
• RtlTraceDatabaseEnumerate
• RtlTraceDatabaseFind
• RtlTraceDatabaseLock
• RtlTraceDatabaseUnlock
• RtlTraceDatabaseValidate
• RtlUTF8StringToUnicodeString
• RtlUTF8ToUnicodeN
• RtlUdiv128
• RtlUnicodeStringToAnsiSize
• RtlUnicodeStringToAnsiString
• RtlUnicodeStringToCountedOemString
• RtlUnicodeStringToInt64
• RtlUnicodeStringToInteger
• RtlUnicodeStringToOemSize
• RtlUnicodeStringToOemString
• RtlUnicodeStringToUTF8String
• RtlUnicodeToCustomCPN
• RtlUnicodeToMultiByteN
• RtlUnicodeToMultiByteSize
• RtlUnicodeToOemN
• RtlUnicodeToUTF8N
• RtlUnlockBootStatusData
• RtlUnregisterFeatureConfigurationChangeNotification
• RtlUnsignedMultiplyHigh
• RtlUnwind
• RtlUnwindEx
• RtlUpcaseUnicodeChar
• RtlUpcaseUnicodeString
• RtlUpcaseUnicodeStringToAnsiString
• RtlUpcaseUnicodeStringToCountedOemString
• RtlUpcaseUnicodeStringToOemString
• RtlUpcaseUnicodeToCustomCPN
• RtlUpcaseUnicodeToMultiByteN
• RtlUpcaseUnicodeToOemN
• RtlUpperChar
• RtlUpperString
• RtlValidAcl
• RtlValidRelativeSecurityDescriptor
• RtlValidSecurityDescriptor
• RtlValidSid
• RtlValidateCorrelationVector
• RtlValidateUnicodeString
• RtlVerifyVersionInfo
• RtlVirtualUnwind
• RtlVirtualUnwind2
• RtlVolumeDeviceToDosName
• RtlWalkFrameChain
• RtlWeaklyEnumerateEntryHashTable
• RtlWriteNonVolatileMemory
• RtlWriteRegistryValue
• RtlZeroHeap
• RtlZeroMemory
• RtlxAnsiStringToUnicodeSize
• RtlxOemStringToUnicodeSize
• RtlxUnicodeStringToAnsiSize
• RtlxUnicodeStringToOemSize
• SeAccessCheck
• SeAccessCheckEx
• SeAccessCheckFromState
• SeAccessCheckFromStateEx
• SeAccessCheckWithHint
• SeAdjustAccessStateForAccessConstraints
• SeAdjustAccessStateForTrustLabel
• SeAdjustObjectSecurity
• SeAppendPrivileges
• SeAssignSecurity
• SeAssignSecurityEx
• SeAuditFipsCryptoSelftests
• SeAuditHardLinkCreation
• SeAuditHardLinkCreationWithTransaction
• SeAuditTransactionStateChange
• SeAuditingAnyFileEventsWithContext
• SeAuditingAnyFileEventsWithContextEx
• SeAuditingFileEvents
• SeAuditingFileEventsWithContext
• SeAuditingFileEventsWithContextEx
• SeAuditingFileOrGlobalEvents
• SeAuditingHardLinkEvents
• SeAuditingHardLinkEventsWithContext
• SeAuditingWithTokenForSubcategory
• SeCaptureSecurityDescriptor
• SeCaptureSubjectContext
• SeCaptureSubjectContextEx
• SeCheckForCriticalAceRemoval
• SeCloseObjectAuditAlarm
• SeCloseObjectAuditAlarmForNonObObject
• SeCompareSigningLevels
• SeComputeAutoInheritByObjectType
• SeConvertSecurityDescriptorToStringSecurityDescriptor
• SeConvertSidToStringSid
• SeConvertStringSecurityDescriptorToSecurityDescriptor
• SeConvertStringSidToSid
• SeCreateAccessState
• SeCreateAccessStateEx
• SeCreateAndRegisterAccessCheckDebugContext
• SeCreateClientSecurity
• SeCreateClientSecurityEx
• SeCreateClientSecurityFromSubjectContext
• SeCreateClientSecurityFromSubjectContextEx
• SeDeassignSecurity
• SeDeleteAccessState
• SeDeleteClientSecurity
• SeDeleteObjectAuditAlarm
• SeDeleteObjectAuditAlarmWithTransaction
• SeEtwWriteKMCveEvent
• SeExamineSacl
• SeExports
• SeFilterToken
• SeFreePrivileges
• SeGetCachedSigningLevel
• SeGetLinkedToken
• SeGetLogonSessionToken
• SeILSigningPolicyPtr
• SeImpersonateClient
• SeImpersonateClientEx
• SeIsParentOfChildAppContainer
• SeLocateProcessImageName
• SeLockSubjectContext
• SeMarkLogonSessionForTerminationNotification
• SeMarkLogonSessionForTerminationNotificationEx
• SeOpenObjectAuditAlarm
• SeOpenObjectAuditAlarmForNonObObject
• SeOpenObjectAuditAlarmWithTransaction
• SeOpenObjectForDeleteAuditAlarm
• SeOpenObjectForDeleteAuditAlarmWithTransaction
• SePrivilegeCheck
• SePrivilegeObjectAuditAlarm
• SePublicDefaultDacl
• SeQueryAuthenticationIdToken
• SeQueryInformationToken
• SeQuerySecureBootPlatformManifest
• SeQuerySecureBootPolicyValue
• SeQuerySecurityAttributesToken
• SeQuerySecurityAttributesTokenAccessInformation
• SeQuerySecurityDescriptorInfo
• SeQueryServerSiloToken
• SeQuerySessionIdToken
• SeQuerySessionIdTokenEx
• SeRegisterImageVerificationCallback
• SeRegisterLogonSessionTerminatedRoutine
• SeRegisterLogonSessionTerminatedRoutineEx
• SeReleaseSecurityDescriptor
• SeReleaseSubjectContext
• SeReportSecurityEvent
• SeReportSecurityEventWithSubCategory
• SeSecurityAttributePresent
• SeSetAccessStateGenericMapping
• SeSetAuditParameter
• SeSetSecurityAttributesToken
• SeSetSecurityAttributesTokenEx
• SeSetSecurityDescriptorInfo
• SeSetSecurityDescriptorInfoEx
• SeSetSessionIdTokenWithLinked
• SeShouldCheckForAccessRightsFromParent
• SeSinglePrivilegeCheck
• SeSrpAccessCheck
• SeSystemDefaultDacl
• SeSystemDefaultSd
• SeTokenFromAccessInformation
• SeTokenImpersonationLevel
• SeTokenIsAdmin
• SeTokenIsRestricted
• SeTokenIsWriteRestricted
• SeTokenObjectType
• SeTokenType
• SeUnRegisterAndFreeAccessCheckDebugContext
• SeUnlockSubjectContext
• SeUnregisterImageVerificationCallback
• SeUnregisterLogonSessionTerminatedRoutine
• SeUnregisterLogonSessionTerminatedRoutineEx
• SeValidSecurityDescriptor
• SkAcquirePushLockExclusive
• SkAllocatePool
• SkFreePool
• SkInitializePushLock
• SkIsSecureKernel
• SkQuerySecureKernelInformation
• SkReleasePushLockExclusive
• TmCancelPropagationRequest
• TmCommitComplete
• TmCommitEnlistment
• TmCommitTransaction
• TmCreateEnlistment
• TmCurrentTransaction
• TmDereferenceEnlistmentKey
• TmEnableCallbacks
• TmEndPropagationRequest
• TmEnlistmentObjectType
• TmFreezeTransactions
• TmGetTransactionId
• TmInitSystem
• TmInitSystemPhase2
• TmInitializeTransactionManager
• TmIsKTMCommitCoordinator
• TmIsTransactionActive
• TmPrePrepareComplete
• TmPrePrepareEnlistment
• TmPrepareComplete
• TmPrepareEnlistment
• TmPropagationComplete
• TmPropagationFailed
• TmReadOnlyEnlistment
• TmRecoverEnlistment
• TmRecoverResourceManager
• TmRecoverTransactionManager
• TmReferenceEnlistmentKey
• TmRenameTransactionManager
• TmRequestOutcomeEnlistment
• TmResourceManagerObjectType
• TmRollbackComplete
• TmRollbackEnlistment
• TmRollbackTransaction
• TmSetCurrentTransaction
• TmSinglePhaseReject
• TmThawTransactions
• TmTransactionManagerObjectType
• TmTransactionObjectType
• TtmNotifyDeviceArrival
• TtmNotifyDeviceDeparture
• TtmNotifyDeviceInput
• VerSetConditionMask
• VfCheckNxPagePriority
• VfCheckNxPageProtection
• VfCheckNxPoolType
• VfFailDeviceNode
• VfFailDriver
• VfFailSystemBIOS
• VfInsertContext
• VfIsRuleClassEnabled
• VfIsVerificationEnabled
• VfQueryDeviceContext
• VfQueryDispatchTable
• VfQueryDriverContext
• VfQueryIrpContext
• VfRemoveContext
• VslCreateSecureSection
• VslDeleteSecureSection
• VslExchangeEntropy
• VslGetSecurePciDeviceAlternateFunctionNumberForVtl0Dma
• VslGetSecurePciDeviceBootConfiguration
• VslGetSecurePciEnabled
• VslQuerySecureDevice
• VslRetrieveMailbox
• WheaAddErrorSource
• WheaAddErrorSourceDeviceDriver
• WheaAddErrorSourceDeviceDriverV1
• WheaAddHwErrorReportSectionDeviceDriver
• WheaAttemptClearPoison
• WheaAttemptPhysicalPageOffline
• WheaConfigureErrorSource
• WheaCreateHwErrorReportDeviceDriver
• WheaDeferredRecoveryService
• WheaEnterCriticalState
• WheaErrorSourceGetState
• WheaExitCriticalState
• WheaGetCurrentProcessName
• WheaGetErrorSource
• WheaGetNotifyAllOfflinesPolicy
• WheaHighIrqlLogSelEventHandlerRegister
• WheaHighIrqlLogSelEventHandlerUnregister
• WheaHwErrorReportAbandonDeviceDriver
• WheaHwErrorReportGetLogDataBufferDeviceDriver
• WheaHwErrorReportMarkAsCriticalDeviceDriver
• WheaHwErrorReportSetFatalSeverityDeviceDriver
• WheaHwErrorReportSetSectionNameDeviceDriver
• WheaHwErrorReportSetSeverityDeviceDriver
• WheaHwErrorReportSubmitDeviceDriver
• WheaInitializeDeferredRecoveryObject
• WheaInitializeRecordHeader
• WheaIsAltContextAllocPossible
• WheaIsCriticalState
• WheaLogInternalEvent
• WheaProcessWaitingETWEvents
• WheaRecoveryBugCheck
• WheaRegisterErrorSourceOverride
• WheaRegisterInUsePageOfflineNotification
• WheaRemoveErrorSource
• WheaRemoveErrorSourceDeviceDriver
• WheaReportFatalHwErrorDeviceDriverEx
• WheaReportHwError
• WheaReportHwErrorDeviceDriver
• WheaReportHwErrorDeviceDriverEx
• WheaRequestDeferredRecovery
• WheaSignalHandlerOverride
• WheaTerminateProcess
• WheaUnconfigureErrorSource
• WheaUnregisterErrorSourceOverride
• WheaUnregisterInUsePageOfflineNotification
• WmiGetClock
• WmiQueryTraceInformation
• WmiTraceMessage
• WmiTraceMessageVa
• XIPDispatch
• ZwAccessCheckAndAuditAlarm
• ZwAddBootEntry
• ZwAddDriverEntry
• ZwAdjustPrivilegesToken
• ZwAlertThread
• ZwAllocateLocallyUniqueId
• ZwAllocateReserveObject
• ZwAllocateVirtualMemory
• ZwAllocateVirtualMemoryEx
• ZwAlpcAcceptConnectPort
• ZwAlpcCancelMessage
• ZwAlpcConnectPort
• ZwAlpcConnectPortEx
• ZwAlpcCreatePort
• ZwAlpcCreatePortSection
• ZwAlpcCreateResourceReserve
• ZwAlpcCreateSectionView
• ZwAlpcCreateSecurityContext
• ZwAlpcDeletePortSection
• ZwAlpcDeleteResourceReserve
• ZwAlpcDeleteSectionView
• ZwAlpcDeleteSecurityContext
• ZwAlpcDisconnectPort
• ZwAlpcOpenSenderProcess
• ZwAlpcOpenSenderThread
• ZwAlpcQueryInformation
• ZwAlpcQueryInformationMessage
• ZwAlpcSendWaitReceivePort
• ZwAlpcSetInformation
• ZwAssignProcessToJobObject
• ZwAssociateWaitCompletionPacket
• ZwCancelIoFile
• ZwCancelIoFileEx
• ZwCancelTimer
• ZwCancelWaitCompletionPacket
• ZwClearEvent
• ZwClose
• ZwCloseObjectAuditAlarm
• ZwCommitComplete
• ZwCommitEnlistment
• ZwCommitRegistryTransaction
• ZwCommitTransaction
• ZwCompareTokens
• ZwConnectPort
• ZwCreateCrossVmEvent
• ZwCreateDirectoryObject
• ZwCreateEnlistment
• ZwCreateEvent
• ZwCreateFile
• ZwCreateIoCompletion
• ZwCreateJobObject
• ZwCreateKey
• ZwCreateKeyTransacted
• ZwCreatePartition
• ZwCreateProcessEx
• ZwCreateProfileEx
• ZwCreateRegistryTransaction
• ZwCreateResourceManager
• ZwCreateSection
• ZwCreateSectionEx
• ZwCreateSemaphore
• ZwCreateSymbolicLinkObject
• ZwCreateTimer
• ZwCreateTransaction
• ZwCreateTransactionManager
• ZwCreateWaitCompletionPacket
• ZwCreateWnfStateName
• ZwDeleteBootEntry
• ZwDeleteDriverEntry
• ZwDeleteFile
• ZwDeleteKey
• ZwDeleteValueKey
• ZwDeleteWnfStateData
• ZwDeleteWnfStateName
• ZwDeviceIoControlFile
• ZwDisplayString
• ZwDuplicateObject
• ZwDuplicateToken
• ZwEnumerateBootEntries
• ZwEnumerateDriverEntries
• ZwEnumerateKey
• ZwEnumerateTransactionObject
• ZwEnumerateValueKey
• ZwFlushBuffersFile
• ZwFlushBuffersFileEx
• ZwFlushInstructionCache
• ZwFlushKey
• ZwFlushVirtualMemory
• ZwFreeVirtualMemory
• ZwFsControlFile
• ZwGetCachedSigningLevel
• ZwGetNextProcess
• ZwGetNextThread
• ZwGetNotificationResourceManager
• ZwGetWriteWatch
• ZwImpersonateAnonymousToken
• ZwInitiatePowerAction
• ZwIsProcessInJob
• ZwLoadDriver
• ZwLoadKey
• ZwLoadKeyEx
• ZwLockFile
• ZwLockProductActivationKeys
• ZwLockVirtualMemory
• ZwMakeTemporaryObject
• ZwManagePartition
• ZwMapViewOfSection
• ZwModifyBootEntry
• ZwModifyDriverEntry
• ZwNotifyChangeDirectoryFile
• ZwNotifyChangeDirectoryFileEx
• ZwNotifyChangeKey
• ZwNotifyChangeSession
• ZwOpenDirectoryObject
• ZwOpenEnlistment
• ZwOpenEvent
• ZwOpenFile
• ZwOpenJobObject
• ZwOpenKey
• ZwOpenKeyEx
• ZwOpenKeyTransacted
• ZwOpenKeyTransactedEx
• ZwOpenPartition
• ZwOpenProcess
• ZwOpenProcessToken
• ZwOpenProcessTokenEx
• ZwOpenRegistryTransaction
• ZwOpenResourceManager
• ZwOpenSection
• ZwOpenSession
• ZwOpenSymbolicLinkObject
• ZwOpenThread
• ZwOpenThreadToken
• ZwOpenThreadTokenEx
• ZwOpenTimer
• ZwOpenTransaction
• ZwOpenTransactionManager
• ZwPowerInformation
• ZwPrePrepareComplete
• ZwPrePrepareEnlistment
• ZwPrepareComplete
• ZwPrepareEnlistment
• ZwPropagationComplete
• ZwPropagationFailed
• ZwProtectVirtualMemory
• ZwPulseEvent
• ZwQueryBootEntryOrder
• ZwQueryBootOptions
• ZwQueryDefaultLocale
• ZwQueryDefaultUILanguage
• ZwQueryDirectoryFile
• ZwQueryDirectoryFileEx
• ZwQueryDirectoryObject
• ZwQueryDriverEntryOrder
• ZwQueryEaFile
• ZwQueryFullAttributesFile
• ZwQueryInformationByName
• ZwQueryInformationEnlistment
• ZwQueryInformationFile
• ZwQueryInformationJobObject
• ZwQueryInformationProcess
• ZwQueryInformationResourceManager
• ZwQueryInformationThread
• ZwQueryInformationToken
• ZwQueryInformationTransaction
• ZwQueryInformationTransactionManager
• ZwQueryInstallUILanguage
• ZwQueryIntervalProfile
• ZwQueryKey
• ZwQueryLicenseValue
• ZwQueryObject
• ZwQueryQuotaInformationFile
• ZwQuerySection
• ZwQuerySecurityAttributesToken
• ZwQuerySecurityObject
• ZwQuerySecurityPolicy
• ZwQuerySymbolicLinkObject
• ZwQuerySystemEnvironmentValueEx
• ZwQuerySystemInformation
• ZwQuerySystemInformationEx
• ZwQueryTimerResolution
• ZwQueryValueKey
• ZwQueryVirtualMemory
• ZwQueryVolumeInformationFile
• ZwQueryWnfStateData
• ZwQueryWnfStateNameInformation
• ZwReadFile
• ZwReadOnlyEnlistment
• ZwRecoverEnlistment
• ZwRecoverResourceManager
• ZwRecoverTransactionManager
• ZwReleaseSemaphore
• ZwRemoveIoCompletion
• ZwRemoveIoCompletionEx
• ZwRenameKey
• ZwReplaceKey
• ZwRequestPort
• ZwRequestWaitReplyPort
• ZwResetEvent
• ZwResetWriteWatch
• ZwRestoreKey
• ZwRollbackComplete
• ZwRollbackEnlistment
• ZwRollbackRegistryTransaction
• ZwRollbackTransaction
• ZwSaveKey
• ZwSaveKeyEx
• ZwSecureConnectPort
• ZwSetBootEntryOrder
• ZwSetBootOptions
• ZwSetCachedSigningLevel
• ZwSetDefaultLocale
• ZwSetDefaultUILanguage
• ZwSetDriverEntryOrder
• ZwSetEaFile
• ZwSetEvent
• ZwSetInformationEnlistment
• ZwSetInformationFile
• ZwSetInformationJobObject
• ZwSetInformationKey
• ZwSetInformationObject
• ZwSetInformationProcess
• ZwSetInformationResourceManager
• ZwSetInformationThread
• ZwSetInformationToken
• ZwSetInformationTransaction
• ZwSetInformationVirtualMemory
• ZwSetIntervalProfile
• ZwSetIoCompletion
• ZwSetIoCompletionEx
• ZwSetQuotaInformationFile
• ZwSetSecurityObject
• ZwSetSystemEnvironmentValueEx
• ZwSetSystemInformation
• ZwSetSystemTime
• ZwSetTimer
• ZwSetTimerEx
• ZwSetTimerResolution
• ZwSetValueKey
• ZwSetVolumeInformationFile
• ZwStartProfile
• ZwStopProfile
• ZwSystemDebugControl
• ZwTerminateJobObject
• ZwTerminateProcess
• ZwTraceControl
• ZwTraceEvent
• ZwTranslateFilePath
• ZwUnloadDriver
• ZwUnloadKey
• ZwUnloadKey2
• ZwUnloadKeyEx
• ZwUnlockFile
• ZwUnlockVirtualMemory
• ZwUnmapViewOfSection
• ZwUpdateWnfStateData
• ZwWaitForMultipleObjects
• ZwWaitForSingleObject
• ZwWriteFile
• ZwYieldExecution
• __C_specific_handler
• __asan_alloca_poison
• __asan_allocas_unpoison
• __asan_load1
• __asan_load16
• __asan_load16_noabort
• __asan_load1_noabort
• __asan_load2
• __asan_load2_noabort
• __asan_load4
• __asan_load4_noabort
• __asan_load8
• __asan_load8_noabort
• __asan_loadN
• __asan_loadN_noabort
• __asan_memcpy
• __asan_memmove
• __asan_memset
• __asan_report_load1
• __asan_report_load16
• __asan_report_load2
• __asan_report_load4
• __asan_report_load8
• __asan_report_load_n
• __asan_report_store1
• __asan_report_store16
• __asan_report_store2
• __asan_report_store4
• __asan_report_store8
• __asan_report_store_n
• __asan_set_shadow_00
• __asan_set_shadow_f8
• __asan_store1
• __asan_store16
• __asan_store16_noabort
• __asan_store1_noabort
• __asan_store2
• __asan_store2_noabort
• __asan_store4
• __asan_store4_noabort
• __asan_store8
• __asan_store8_noabort
• __asan_storeN
• __asan_storeN_noabort
• __chkstk
• __misaligned_access
• _atoi64
• _finite
• _i64toa_s
• _i64tow_s
• _itoa
• _itoa_s
• _itow
• _itow_s
• _local_unwind
• _ltoa_s
• _ltow_s
• _makepath_s
• _purecall
• _setjmp
• _setjmpex
• _snprintf
• _snprintf_s
• _snscanf_s
• _snwprintf
• _snwprintf_s
• _snwscanf_s
• _splitpath_s
• _stricmp
• _strlwr
• _strnicmp
• _strnset
• _strnset_s
• _strrev
• _strset
• _strset_s
• _strtoui64
• _strupr
• _swprintf
• _ui64toa_s
• _ui64tow_s
• _ultoa_s
• _ultow_s
• _vsnprintf
• _vsnprintf_s
• _vsnwprintf
• _vsnwprintf_s
• _vswprintf
• _wcsicmp
• _wcslwr
• _wcslwr_s
• _wcsnicmp
• _wcsnset
• _wcsnset_s
• _wcsrev
• _wcsset_s
• _wcsupr
• _wmakepath_s
• _wsplitpath_s
• _wtoi
• _wtol
• atoi
• atol
• bsearch
• bsearch_s
• isdigit
• islower
• isprint
• isspace
• isupper
• iswalnum
• iswdigit
• iswspace
• isxdigit
• longjmp
• mbstowcs
• mbtowc
• memchr
• memcmp
• memcpy
• memcpy_s
• memmove
• memmove_s
• memset
• psMUITest
• qsort
• qsort_s
• rand
• sprintf
• sprintf_s
• sqrt
• sqrtf
• srand
• sscanf_s
• strcat
• strcat_s
• strchr
• strcmp
• strcpy
• strcpy_s
• strlen
• strncat
• strncat_s
• strncmp
• strncpy
• strncpy_s
• strnlen
• strrchr
• strspn
• strstr
• strtok_s
• swprintf
• swprintf_s
• swscanf_s
• tolower
• toupper
• towlower
• towupper
• vDbgPrintEx
• vDbgPrintExWithPrefix
• vsprintf
• vsprintf_s
• vswprintf_s
• wcscat
• wcscat_s
• wcschr
• wcscmp
• wcscpy
• wcscpy_s
• wcscspn
• wcslen
• wcsncat
• wcsncat_s
• wcsncmp
• wcsncpy
• wcsncpy_s
• wcsnlen
• wcsrchr
• wcsspn
• wcsstr
• wcstombs
• wcstoul
• wctomb
• x86BiosAllocateBuffer
• x86BiosCall
• x86BiosFreeBuffer
• x86BiosReadMemory
• x86BiosWriteMemory
• ntoskrnl.exe#1
• ntoskrnl.exe#2
• ntoskrnl.exe#3
• ntoskrnl.exe#4
• ntoskrnl.exe#5
• ntoskrnl.exe#6
• ntoskrnl.exe#7
• ntoskrnl.exe#9
• ntoskrnl.exe#12
• ntoskrnl.exe#13
• ntoskrnl.exe#14
• ntoskrnl.exe#15
• ntoskrnl.exe#16
• ntoskrnl.exe#17
• ntoskrnl.exe#19
• ntoskrnl.exe#20
• ntoskrnl.exe#21
• ntoskrnl.exe#22
• ntoskrnl.exe#23
• ntoskrnl.exe#24
• ntoskrnl.exe#25
• ntoskrnl.exe#27
• ntoskrnl.exe#28
• ntoskrnl.exe#29
• ntoskrnl.exe#30
• ntoskrnl.exe#31
• ntoskrnl.exe#32
• ntoskrnl.exe#33
• ntoskrnl.exe#34
• ntoskrnl.exe#35
• ntoskrnl.exe#36
• ntoskrnl.exe#37
• ntoskrnl.exe#38
• ntoskrnl.exe#39