Windows APIs

win7 Symbols in ntdll.dll

⇒

general DLL page

• A_SHAFinal
• A_SHAInit
• A_SHAUpdate
• AlpcAdjustCompletionListConcurrencyCount
• AlpcFreeCompletionListMessage
• AlpcGetCompletionListLastMessageInformation
• AlpcGetCompletionListMessageAttributes
• AlpcGetHeaderSize
• AlpcGetMessageAttribute
• AlpcGetMessageFromCompletionList
• AlpcGetOutstandingCompletionListMessageCount
• AlpcInitializeMessageAttribute
• AlpcMaxAllowedMessageLength
• AlpcRegisterCompletionList
• AlpcRegisterCompletionListWorkerThread
• AlpcRundownCompletionList
• AlpcUnregisterCompletionList
• AlpcUnregisterCompletionListWorkerThread
• CsrAllocateCaptureBuffer
• CsrAllocateMessagePointer
• CsrCaptureMessageBuffer
• CsrCaptureMessageMultiUnicodeStringsInPlace
• CsrCaptureMessageString
• CsrCaptureTimeout
• CsrClientCallServer
• CsrClientConnectToServer
• CsrFreeCaptureBuffer
• CsrGetProcessId
• CsrIdentifyAlertableThread
• CsrSetPriorityClass
• CsrVerifyRegion
• DbgBreakPoint
• DbgPrint
• DbgPrintEx
• DbgPrintReturnControlC
• DbgPrompt
• DbgQueryDebugFilterState
• DbgSetDebugFilterState
• DbgUiConnectToDbg
• DbgUiContinue
• DbgUiConvertStateChangeStructure
• DbgUiDebugActiveProcess
• DbgUiGetThreadDebugObject
• DbgUiIssueRemoteBreakin
• DbgUiRemoteBreakin
• DbgUiSetThreadDebugObject
• DbgUiStopDebugging
• DbgUiWaitStateChange
• DbgUserBreakPoint
• EtwCreateTraceInstanceId
• EtwDeliverDataBlock
• EtwEnumerateProcessRegGuids
• EtwEventActivityIdControl
• EtwEventEnabled
• EtwEventProviderEnabled
• EtwEventRegister
• EtwEventUnregister
• EtwEventWrite
• EtwEventWriteEndScenario
• EtwEventWriteEx
• EtwEventWriteFull
• EtwEventWriteNoRegistration
• EtwEventWriteStartScenario
• EtwEventWriteString
• EtwEventWriteTransfer
• EtwGetTraceEnableFlags
• EtwGetTraceEnableLevel
• EtwGetTraceLoggerHandle
• EtwLogTraceEvent
• EtwNotificationRegister
• EtwNotificationUnregister
• EtwProcessPrivateLoggerRequest
• EtwRegisterSecurityProvider
• EtwRegisterTraceGuidsA
• EtwRegisterTraceGuidsW
• EtwReplyNotification
• EtwSendNotification
• EtwSetMark
• EtwTraceEventInstance
• EtwTraceMessage
• EtwTraceMessageVa
• EtwUnregisterTraceGuids
• EtwWriteUMSecurityEvent
• EtwpCreateEtwThread
• EtwpGetCpuSpeed
• EtwpNotificationThread
• EvtIntReportAuthzEventAndSourceAsync
• EvtIntReportEventAndSourceAsync
• ExpInterlockedPopEntrySListEnd
• ExpInterlockedPopEntrySListEnd16
• ExpInterlockedPopEntrySListFault
• ExpInterlockedPopEntrySListFault16
• ExpInterlockedPopEntrySListResume
• ExpInterlockedPopEntrySListResume16
• KiFastSystemCall
• KiFastSystemCallRet
• KiIntSystemCall
• KiRaiseUserExceptionDispatcher
• KiUserApcDispatcher
• KiUserCallbackDispatcher
• KiUserExceptionDispatcher
• LdrAccessResource
• LdrAddLoadAsDataTable
• LdrAddRefDll
• LdrDisableThreadCalloutsForDll
• LdrEnumResources
• LdrEnumerateLoadedModules
• LdrFindEntryForAddress
• LdrFindResourceDirectory_U
• LdrFindResourceEx_U
• LdrFindResource_U
• LdrFlushAlternateResourceModules
• LdrGetDllHandle
• LdrGetDllHandleByMapping
• LdrGetDllHandleByName
• LdrGetDllHandleEx
• LdrGetFailureData
• LdrGetFileNameFromLoadAsDataTable
• LdrGetKnownDllSectionHandle
• LdrGetProcedureAddress
• LdrGetProcedureAddressEx
• LdrHotPatchRoutine
• LdrInitShimEngineDynamic
• LdrInitializeThunk
• LdrLoadAlternateResourceModule
• LdrLoadAlternateResourceModuleEx
• LdrLoadDll
• LdrLockLoaderLock
• LdrOpenImageFileOptionsKey
• LdrProcessInitializationComplete
• LdrProcessRelocationBlock
• LdrQueryImageFileExecutionOptions
• LdrQueryImageFileExecutionOptionsEx
• LdrQueryImageFileKeyOption
• LdrQueryModuleServiceTags
• LdrQueryProcessModuleInformation
• LdrRegisterDllNotification
• LdrRemoveLoadAsDataTable
• LdrResFindResource
• LdrResFindResourceDirectory
• LdrResGetRCConfig
• LdrResRelease
• LdrResSearchResource
• LdrRscIsTypeExist
• LdrSetAppCompatDllRedirectionCallback
• LdrSetDllManifestProber
• LdrSetMUICacheType
• LdrShutdownProcess
• LdrShutdownThread
• LdrUnloadAlternateResourceModule
• LdrUnloadAlternateResourceModuleEx
• LdrUnloadDll
• LdrUnlockLoaderLock
• LdrUnregisterDllNotification
• LdrVerifyImageMatchesChecksum
• LdrVerifyImageMatchesChecksumEx
• LdrWx86FormatVirtualImage
• LdrpResGetMappingSize
• LdrpResGetResourceDirectory
• MD4Final
• MD4Init
• MD4Update
• MD5Final
• MD5Init
• MD5Update
• NlsAnsiCodePage
• NlsMbCodePageTag
• NlsMbOemCodePageTag
• NtAcceptConnectPort
• NtAccessCheck
• NtAccessCheckAndAuditAlarm
• NtAccessCheckByType
• NtAccessCheckByTypeAndAuditAlarm
• NtAccessCheckByTypeResultList
• NtAccessCheckByTypeResultListAndAuditAlarm
• NtAccessCheckByTypeResultListAndAuditAlarmByHandle
• NtAddAtom
• NtAddBootEntry
• NtAddDriverEntry
• NtAdjustGroupsToken
• NtAdjustPrivilegesToken
• NtAlertResumeThread
• NtAlertThread
• NtAllocateLocallyUniqueId
• NtAllocateReserveObject
• NtAllocateUserPhysicalPages
• NtAllocateUuids
• NtAllocateVirtualMemory
• NtAlpcAcceptConnectPort
• NtAlpcCancelMessage
• NtAlpcConnectPort
• NtAlpcCreatePort
• NtAlpcCreatePortSection
• NtAlpcCreateResourceReserve
• NtAlpcCreateSectionView
• NtAlpcCreateSecurityContext
• NtAlpcDeletePortSection
• NtAlpcDeleteResourceReserve
• NtAlpcDeleteSectionView
• NtAlpcDeleteSecurityContext
• NtAlpcDisconnectPort
• NtAlpcImpersonateClientOfPort
• NtAlpcOpenSenderProcess
• NtAlpcOpenSenderThread
• NtAlpcQueryInformation
• NtAlpcQueryInformationMessage
• NtAlpcRevokeSecurityContext
• NtAlpcSendWaitReceivePort
• NtAlpcSetInformation
• NtApphelpCacheControl
• NtAreMappedFilesTheSame
• NtAssignProcessToJobObject
• NtCallbackReturn
• NtCancelIoFile
• NtCancelIoFileEx
• NtCancelSynchronousIoFile
• NtCancelTimer
• NtClearEvent
• NtClose
• NtCloseObjectAuditAlarm
• NtCommitComplete
• NtCommitEnlistment
• NtCommitTransaction
• NtCompactKeys
• NtCompareTokens
• NtCompleteConnectPort
• NtCompressKey
• NtConnectPort
• NtContinue
• NtCreateDebugObject
• NtCreateDirectoryObject
• NtCreateEnlistment
• NtCreateEvent
• NtCreateEventPair
• NtCreateFile
• NtCreateIoCompletion
• NtCreateJobObject
• NtCreateJobSet
• NtCreateKey
• NtCreateKeyTransacted
• NtCreateKeyedEvent
• NtCreateMailslotFile
• NtCreateMutant
• NtCreateNamedPipeFile
• NtCreatePagingFile
• NtCreatePort
• NtCreatePrivateNamespace
• NtCreateProcess
• NtCreateProcessEx
• NtCreateProfile
• NtCreateProfileEx
• NtCreateResourceManager
• NtCreateSection
• NtCreateSemaphore
• NtCreateSymbolicLinkObject
• NtCreateThread
• NtCreateThreadEx
• NtCreateTimer
• NtCreateToken
• NtCreateTransaction
• NtCreateTransactionManager
• NtCreateUserProcess
• NtCreateWaitablePort
• NtCreateWorkerFactory
• NtCurrentTeb
• NtDebugActiveProcess
• NtDebugContinue
• NtDelayExecution
• NtDeleteAtom
• NtDeleteBootEntry
• NtDeleteDriverEntry
• NtDeleteFile
• NtDeleteKey
• NtDeleteObjectAuditAlarm
• NtDeletePrivateNamespace
• NtDeleteValueKey
• NtDeviceIoControlFile
• NtDisableLastKnownGood
• NtDisplayString
• NtDrawText
• NtDuplicateObject
• NtDuplicateToken
• NtEnableLastKnownGood
• NtEnumerateBootEntries
• NtEnumerateDriverEntries
• NtEnumerateKey
• NtEnumerateSystemEnvironmentValuesEx
• NtEnumerateTransactionObject
• NtEnumerateValueKey
• NtExtendSection
• NtFilterToken
• NtFindAtom
• NtFlushBuffersFile
• NtFlushInstallUILanguage
• NtFlushInstructionCache
• NtFlushKey
• NtFlushProcessWriteBuffers
• NtFlushVirtualMemory
• NtFlushWriteBuffer
• NtFreeUserPhysicalPages
• NtFreeVirtualMemory
• NtFreezeRegistry
• NtFreezeTransactions
• NtFsControlFile
• NtGetContextThread
• NtGetCurrentProcessorNumber
• NtGetDevicePowerState
• NtGetMUIRegistryInfo
• NtGetNextProcess
• NtGetNextThread
• NtGetNlsSectionPtr
• NtGetNotificationResourceManager
• NtGetPlugPlayEvent
• NtGetTickCount
• NtGetWriteWatch
• NtImpersonateAnonymousToken
• NtImpersonateClientOfPort
• NtImpersonateThread
• NtInitializeNlsFiles
• NtInitializeRegistry
• NtInitiatePowerAction
• NtIsProcessInJob
• NtIsSystemResumeAutomatic
• NtIsUILanguageComitted
• NtListenPort
• NtLoadDriver
• NtLoadKey
• NtLoadKey2
• NtLoadKeyEx
• NtLockFile
• NtLockProductActivationKeys
• NtLockRegistryKey
• NtLockVirtualMemory
• NtMakePermanentObject
• NtMakeTemporaryObject
• NtMapCMFModule
• NtMapUserPhysicalPages
• NtMapUserPhysicalPagesScatter
• NtMapViewOfSection
• NtModifyBootEntry
• NtModifyDriverEntry
• NtNotifyChangeDirectoryFile
• NtNotifyChangeKey
• NtNotifyChangeMultipleKeys
• NtNotifyChangeSession
• NtOpenDirectoryObject
• NtOpenEnlistment
• NtOpenEvent
• NtOpenEventPair
• NtOpenFile
• NtOpenIoCompletion
• NtOpenJobObject
• NtOpenKey
• NtOpenKeyEx
• NtOpenKeyTransacted
• NtOpenKeyTransactedEx
• NtOpenKeyedEvent
• NtOpenMutant
• NtOpenObjectAuditAlarm
• NtOpenPrivateNamespace
• NtOpenProcess
• NtOpenProcessToken
• NtOpenProcessTokenEx
• NtOpenResourceManager
• NtOpenSection
• NtOpenSemaphore
• NtOpenSession
• NtOpenSymbolicLinkObject
• NtOpenThread
• NtOpenThreadToken
• NtOpenThreadTokenEx
• NtOpenTimer
• NtOpenTransaction
• NtOpenTransactionManager
• NtPlugPlayControl
• NtPowerInformation
• NtPrePrepareComplete
• NtPrePrepareEnlistment
• NtPrepareComplete
• NtPrepareEnlistment
• NtPrivilegeCheck
• NtPrivilegeObjectAuditAlarm
• NtPrivilegedServiceAuditAlarm
• NtPropagationComplete
• NtPropagationFailed
• NtProtectVirtualMemory
• NtPulseEvent
• NtQueryAttributesFile
• NtQueryBootEntryOrder
• NtQueryBootOptions
• NtQueryDebugFilterState
• NtQueryDefaultLocale
• NtQueryDefaultUILanguage
• NtQueryDirectoryFile
• NtQueryDirectoryObject
• NtQueryDriverEntryOrder
• NtQueryEaFile
• NtQueryEvent
• NtQueryFullAttributesFile
• NtQueryInformationAtom
• NtQueryInformationEnlistment
• NtQueryInformationFile
• NtQueryInformationJobObject
• NtQueryInformationPort
• NtQueryInformationProcess
• NtQueryInformationResourceManager
• NtQueryInformationThread
• NtQueryInformationToken
• NtQueryInformationTransaction
• NtQueryInformationTransactionManager
• NtQueryInformationWorkerFactory
• NtQueryInstallUILanguage
• NtQueryIntervalProfile
• NtQueryIoCompletion
• NtQueryKey
• NtQueryLicenseValue
• NtQueryMultipleValueKey
• NtQueryMutant
• NtQueryObject
• NtQueryOpenSubKeys
• NtQueryOpenSubKeysEx
• NtQueryPerformanceCounter
• NtQueryPortInformationProcess
• NtQueryQuotaInformationFile
• NtQuerySection
• NtQuerySecurityAttributesToken
• NtQuerySecurityObject
• NtQuerySemaphore
• NtQuerySymbolicLinkObject
• NtQuerySystemEnvironmentValue
• NtQuerySystemEnvironmentValueEx
• NtQuerySystemInformation
• NtQuerySystemInformationEx
• NtQuerySystemTime
• NtQueryTimer
• NtQueryTimerResolution
• NtQueryValueKey
• NtQueryVirtualMemory
• NtQueryVolumeInformationFile
• NtQueueApcThread
• NtQueueApcThreadEx
• NtRaiseException
• NtRaiseHardError
• NtReadFile
• NtReadFileScatter
• NtReadOnlyEnlistment
• NtReadRequestData
• NtReadVirtualMemory
• NtRecoverEnlistment
• NtRecoverResourceManager
• NtRecoverTransactionManager
• NtRegisterProtocolAddressInformation
• NtRegisterThreadTerminatePort
• NtReleaseKeyedEvent
• NtReleaseMutant
• NtReleaseSemaphore
• NtReleaseWorkerFactoryWorker
• NtRemoveIoCompletion
• NtRemoveIoCompletionEx
• NtRemoveProcessDebug
• NtRenameKey
• NtRenameTransactionManager
• NtReplaceKey
• NtReplacePartitionUnit
• NtReplyPort
• NtReplyWaitReceivePort
• NtReplyWaitReceivePortEx
• NtReplyWaitReplyPort
• NtRequestPort
• NtRequestWaitReplyPort
• NtResetEvent
• NtResetWriteWatch
• NtRestoreKey
• NtResumeProcess
• NtResumeThread
• NtRollbackComplete
• NtRollbackEnlistment
• NtRollbackTransaction
• NtRollforwardTransactionManager
• NtSaveKey
• NtSaveKeyEx
• NtSaveMergedKeys
• NtSecureConnectPort
• NtSerializeBoot
• NtSetBootEntryOrder
• NtSetBootOptions
• NtSetContextThread
• NtSetDebugFilterState
• NtSetDefaultHardErrorPort
• NtSetDefaultLocale
• NtSetDefaultUILanguage
• NtSetDriverEntryOrder
• NtSetEaFile
• NtSetEvent
• NtSetEventBoostPriority
• NtSetHighEventPair
• NtSetHighWaitLowEventPair
• NtSetInformationDebugObject
• NtSetInformationEnlistment
• NtSetInformationFile
• NtSetInformationJobObject
• NtSetInformationKey
• NtSetInformationObject
• NtSetInformationProcess
• NtSetInformationResourceManager
• NtSetInformationThread
• NtSetInformationToken
• NtSetInformationTransaction
• NtSetInformationTransactionManager
• NtSetInformationWorkerFactory
• NtSetIntervalProfile
• NtSetIoCompletion
• NtSetIoCompletionEx
• NtSetLdtEntries
• NtSetLowEventPair
• NtSetLowWaitHighEventPair
• NtSetQuotaInformationFile
• NtSetSecurityObject
• NtSetSystemEnvironmentValue
• NtSetSystemEnvironmentValueEx
• NtSetSystemInformation
• NtSetSystemPowerState
• NtSetSystemTime
• NtSetThreadExecutionState
• NtSetTimer
• NtSetTimerEx
• NtSetTimerResolution
• NtSetUuidSeed
• NtSetValueKey
• NtSetVolumeInformationFile
• NtShutdownSystem
• NtShutdownWorkerFactory
• NtSignalAndWaitForSingleObject
• NtSinglePhaseReject
• NtStartProfile
• NtStopProfile
• NtSuspendProcess
• NtSuspendThread
• NtSystemDebugControl
• NtTerminateJobObject
• NtTerminateProcess
• NtTerminateThread
• NtTestAlert
• NtThawRegistry
• NtThawTransactions
• NtTraceControl
• NtTraceEvent
• NtTranslateFilePath
• NtUmsThreadYield
• NtUnloadDriver
• NtUnloadKey
• NtUnloadKey2
• NtUnloadKeyEx
• NtUnlockFile
• NtUnlockVirtualMemory
• NtUnmapViewOfSection
• NtVdmControl
• NtWaitForDebugEvent
• NtWaitForKeyedEvent
• NtWaitForMultipleObjects
• NtWaitForMultipleObjects32
• NtWaitForSingleObject
• NtWaitForWorkViaWorkerFactory
• NtWaitHighEventPair
• NtWaitLowEventPair
• NtWorkerFactoryWorkerReady
• NtWow64CallFunction64
• NtWow64CsrAllocateCaptureBuffer
• NtWow64CsrAllocateMessagePointer
• NtWow64CsrCaptureMessageBuffer
• NtWow64CsrCaptureMessageString
• NtWow64CsrClientCallServer
• NtWow64CsrClientConnectToServer
• NtWow64CsrFreeCaptureBuffer
• NtWow64CsrGetProcessId
• NtWow64CsrIdentifyAlertableThread
• NtWow64CsrVerifyRegion
• NtWow64DebuggerCall
• NtWow64GetCurrentProcessorNumberEx
• NtWow64GetNativeSystemInformation
• NtWow64InterlockedPopEntrySList
• NtWow64QueryInformationProcess64
• NtWow64QueryVirtualMemory64
• NtWow64ReadVirtualMemory64
• NtWow64WriteVirtualMemory64
• NtWriteFile
• NtWriteFileGather
• NtWriteRequestData
• NtWriteVirtualMemory
• NtYieldExecution
• NtdllDefWindowProc_A
• NtdllDefWindowProc_W
• NtdllDialogWndProc_A
• NtdllDialogWndProc_W
• PfxFindPrefix
• PfxInitialize
• PfxInsertPrefix
• PfxRemovePrefix
• RtlAbortRXact
• RtlAbsoluteToSelfRelativeSD
• RtlAcquirePebLock
• RtlAcquirePrivilege
• RtlAcquireReleaseSRWLockExclusive
• RtlAcquireResourceExclusive
• RtlAcquireResourceShared
• RtlAcquireSRWLockExclusive
• RtlAcquireSRWLockShared
• RtlActivateActivationContext
• RtlActivateActivationContextEx
• RtlActivateActivationContextUnsafeFast
• RtlAddAccessAllowedAce
• RtlAddAccessAllowedAceEx
• RtlAddAccessAllowedObjectAce
• RtlAddAccessDeniedAce
• RtlAddAccessDeniedAceEx
• RtlAddAccessDeniedObjectAce
• RtlAddAce
• RtlAddActionToRXact
• RtlAddAtomToAtomTable
• RtlAddAttributeActionToRXact
• RtlAddAuditAccessAce
• RtlAddAuditAccessAceEx
• RtlAddAuditAccessObjectAce
• RtlAddCompoundAce
• RtlAddFunctionTable
• RtlAddIntegrityLabelToBoundaryDescriptor
• RtlAddMandatoryAce
• RtlAddRefActivationContext
• RtlAddRefMemoryStream
• RtlAddSIDToBoundaryDescriptor
• RtlAddVectoredContinueHandler
• RtlAddVectoredExceptionHandler
• RtlAddressInSectionTable
• RtlAdjustPrivilege
• RtlAllocateActivationContextStack
• RtlAllocateAndInitializeSid
• RtlAllocateHandle
• RtlAllocateHeap
• RtlAllocateMemoryBlockLookaside
• RtlAllocateMemoryZone
• RtlAnsiCharToUnicodeChar
• RtlAnsiStringToUnicodeSize
• RtlAnsiStringToUnicodeString
• RtlAppendAsciizToString
• RtlAppendPathElement
• RtlAppendStringToString
• RtlAppendUnicodeStringToString
• RtlAppendUnicodeToString
• RtlApplicationVerifierStop
• RtlApplyRXact
• RtlApplyRXactNoFlush
• RtlAreAllAccessesGranted
• RtlAreAnyAccessesGranted
• RtlAreBitsClear
• RtlAreBitsSet
• RtlAssert
• RtlBarrier
• RtlBarrierForDelete
• RtlCancelTimer
• RtlCaptureContext
• RtlCaptureStackBackTrace
• RtlCaptureStackContext
• RtlCharToInteger
• RtlCheckForOrphanedCriticalSections
• RtlCheckRegistryKey
• RtlCleanUpTEBLangLists
• RtlClearAllBits
• RtlClearBits
• RtlCloneMemoryStream
• RtlCloneUserProcess
• RtlCmDecodeMemIoResource
• RtlCmEncodeMemIoResource
• RtlCommitDebugInfo
• RtlCommitMemoryStream
• RtlCompactHeap
• RtlCompareAltitudes
• RtlCompareMemory
• RtlCompareMemoryUlong
• RtlCompareString
• RtlCompareUnicodeString
• RtlCompareUnicodeStrings
• RtlCompleteProcessCloning
• RtlCompressBuffer
• RtlComputeCrc32
• RtlComputeImportTableHash
• RtlComputePrivatizedDllName_U
• RtlConnectToSm
• RtlConsoleMultiByteToUnicodeN
• RtlContractHashTable
• RtlConvertExclusiveToShared
• RtlConvertLCIDToString
• RtlConvertLongToLargeInteger
• RtlConvertSharedToExclusive
• RtlConvertSidToUnicodeString
• RtlConvertToAutoInheritSecurityObject
• RtlConvertUiListToApiList
• RtlConvertUlongToLargeInteger
• RtlCopyExtendedContext
• RtlCopyLuid
• RtlCopyLuidAndAttributesArray
• RtlCopyMappedMemory
• RtlCopyMemory
• RtlCopyMemoryNonTemporal
• RtlCopyMemoryStreamTo
• RtlCopyOutOfProcessMemoryStreamTo
• RtlCopySecurityDescriptor
• RtlCopySid
• RtlCopySidAndAttributesArray
• RtlCopyString
• RtlCopyUnicodeString
• RtlCreateAcl
• RtlCreateActivationContext
• RtlCreateAndSetSD
• RtlCreateAtomTable
• RtlCreateBootStatusDataFile
• RtlCreateBoundaryDescriptor
• RtlCreateEnvironment
• RtlCreateEnvironmentEx
• RtlCreateHashTable
• RtlCreateHeap
• RtlCreateMemoryBlockLookaside
• RtlCreateMemoryZone
• RtlCreateProcessParameters
• RtlCreateProcessParametersEx
• RtlCreateProcessReflection
• RtlCreateQueryDebugBuffer
• RtlCreateRegistryKey
• RtlCreateSecurityDescriptor
• RtlCreateServiceSid
• RtlCreateSystemVolumeInformationFolder
• RtlCreateTagHeap
• RtlCreateTimer
• RtlCreateTimerQueue
• RtlCreateUmsCompletionList
• RtlCreateUmsThread
• RtlCreateUmsThreadContext
• RtlCreateUnicodeString
• RtlCreateUnicodeStringFromAsciiz
• RtlCreateUserProcess
• RtlCreateUserSecurityObject
• RtlCreateUserStack
• RtlCreateUserThread
• RtlCreateVirtualAccountSid
• RtlCultureNameToLCID
• RtlCustomCPToUnicodeN
• RtlCutoverTimeToSystemTime
• RtlDeCommitDebugInfo
• RtlDeNormalizeProcessParams
• RtlDeactivateActivationContext
• RtlDeactivateActivationContextUnsafeFast
• RtlDebugPrintTimes
• RtlDecodePointer
• RtlDecodeSystemPointer
• RtlDecompressBuffer
• RtlDecompressFragment
• RtlDefaultNpAcl
• RtlDelete
• RtlDeleteAce
• RtlDeleteAtomFromAtomTable
• RtlDeleteBarrier
• RtlDeleteBoundaryDescriptor
• RtlDeleteCriticalSection
• RtlDeleteElementGenericTable
• RtlDeleteElementGenericTableAvl
• RtlDeleteFunctionTable
• RtlDeleteHashTable
• RtlDeleteNoSplay
• RtlDeleteRegistryValue
• RtlDeleteResource
• RtlDeleteSecurityObject
• RtlDeleteTimer
• RtlDeleteTimerQueue
• RtlDeleteTimerQueueEx
• RtlDeleteUmsCompletionList
• RtlDeleteUmsThreadContext
• RtlDequeueUmsCompletionListItems
• RtlDeregisterSecureMemoryCacheCallback
• RtlDeregisterWait
• RtlDeregisterWaitEx
• RtlDestroyAtomTable
• RtlDestroyEnvironment
• RtlDestroyHandleTable
• RtlDestroyHeap
• RtlDestroyMemoryBlockLookaside
• RtlDestroyMemoryZone
• RtlDestroyProcessParameters
• RtlDestroyQueryDebugBuffer
• RtlDetectHeapLeaks
• RtlDetermineDosPathNameType_U
• RtlDisableThreadProfiling
• RtlDllShutdownInProgress
• RtlDnsHostNameToComputerName
• RtlDoesFileExists_U
• RtlDosApplyFileIsolationRedirection_Ustr
• RtlDosPathNameToNtPathName_U
• RtlDosPathNameToNtPathName_U_WithStatus
• RtlDosPathNameToRelativeNtPathName_U
• RtlDosPathNameToRelativeNtPathName_U_WithStatus
• RtlDosSearchPath_U
• RtlDosSearchPath_Ustr
• RtlDowncaseUnicodeChar
• RtlDowncaseUnicodeString
• RtlDumpResource
• RtlDuplicateUnicodeString
• RtlEmptyAtomTable
• RtlEnableEarlyCriticalSectionEventCreation
• RtlEnableThreadProfiling
• RtlEncodePointer
• RtlEncodeSystemPointer
• RtlEndEnumerationHashTable
• RtlEndWeakEnumerationHashTable
• RtlEnlargedIntegerMultiply
• RtlEnlargedUnsignedDivide
• RtlEnlargedUnsignedMultiply
• RtlEnterCriticalSection
• RtlEnterUmsSchedulingMode
• RtlEnumProcessHeaps
• RtlEnumerateEntryHashTable
• RtlEnumerateGenericTable
• RtlEnumerateGenericTableAvl
• RtlEnumerateGenericTableLikeADirectory
• RtlEnumerateGenericTableWithoutSplaying
• RtlEnumerateGenericTableWithoutSplayingAvl
• RtlEqualComputerName
• RtlEqualDomainName
• RtlEqualLuid
• RtlEqualPrefixSid
• RtlEqualSid
• RtlEqualString
• RtlEqualUnicodeString
• RtlEraseUnicodeString
• RtlEthernetAddressToStringA
• RtlEthernetAddressToStringW
• RtlEthernetStringToAddressA
• RtlEthernetStringToAddressW
• RtlExecuteUmsThread
• RtlExitUserProcess
• RtlExitUserThread
• RtlExpandEnvironmentStrings
• RtlExpandEnvironmentStrings_U
• RtlExpandHashTable
• RtlExtendMemoryBlockLookaside
• RtlExtendMemoryZone
• RtlExtendedIntegerMultiply
• RtlExtendedLargeIntegerDivide
• RtlExtendedMagicDivide
• RtlFillMemory
• RtlFillMemoryUlong
• RtlFillMemoryUlonglong
• RtlFinalReleaseOutOfProcessMemoryStream
• RtlFindAceByType
• RtlFindActivationContextSectionGuid
• RtlFindActivationContextSectionString
• RtlFindCharInUnicodeString
• RtlFindClearBits
• RtlFindClearBitsAndSet
• RtlFindClearRuns
• RtlFindClosestEncodableLength
• RtlFindLastBackwardRunClear
• RtlFindLeastSignificantBit
• RtlFindLongestRunClear
• RtlFindMessage
• RtlFindMostSignificantBit
• RtlFindNextForwardRunClear
• RtlFindSetBits
• RtlFindSetBitsAndClear
• RtlFirstEntrySList
• RtlFirstFreeAce
• RtlFlsAlloc
• RtlFlsFree
• RtlFlushSecureMemoryCache
• RtlFormatCurrentUserKeyPath
• RtlFormatMessage
• RtlFormatMessageEx
• RtlFreeActivationContextStack
• RtlFreeAnsiString
• RtlFreeHandle
• RtlFreeHeap
• RtlFreeMemoryBlockLookaside
• RtlFreeOemString
• RtlFreeSid
• RtlFreeThreadActivationContextStack
• RtlFreeUnicodeString
• RtlFreeUserStack
• RtlGUIDFromString
• RtlGenerate8dot3Name
• RtlGetAce
• RtlGetActiveActivationContext
• RtlGetCallersAddress
• RtlGetCompressionWorkSpaceSize
• RtlGetControlSecurityDescriptor
• RtlGetCriticalSectionRecursionCount
• RtlGetCurrentDirectory_U
• RtlGetCurrentPeb
• RtlGetCurrentProcessorNumber
• RtlGetCurrentProcessorNumberEx
• RtlGetCurrentTransaction
• RtlGetCurrentUmsThread
• RtlGetDaclSecurityDescriptor
• RtlGetElementGenericTable
• RtlGetElementGenericTableAvl
• RtlGetEnabledExtendedFeatures
• RtlGetExtendedContextLength
• RtlGetExtendedFeaturesMask
• RtlGetFileMUIPath
• RtlGetFrame
• RtlGetFullPathName_U
• RtlGetFullPathName_UEx
• RtlGetFullPathName_UstrEx
• RtlGetFunctionTableListHead
• RtlGetGroupSecurityDescriptor
• RtlGetIntegerAtom
• RtlGetLastNtStatus
• RtlGetLastWin32Error
• RtlGetLengthWithoutLastFullDosOrNtPathElement
• RtlGetLengthWithoutTrailingPathSeperators
• RtlGetLocaleFileMappingAddress
• RtlGetLongestNtPathLength
• RtlGetNativeSystemInformation
• RtlGetNextEntryHashTable
• RtlGetNextUmsListItem
• RtlGetNtGlobalFlags
• RtlGetNtProductType
• RtlGetNtVersionNumbers
• RtlGetOwnerSecurityDescriptor
• RtlGetParentLocaleName
• RtlGetProcessHeaps
• RtlGetProcessPreferredUILanguages
• RtlGetProductInfo
• RtlGetSaclSecurityDescriptor
• RtlGetSecurityDescriptorRMControl
• RtlGetSetBootStatusData
• RtlGetSystemPreferredUILanguages
• RtlGetThreadErrorMode
• RtlGetThreadLangIdByIndex
• RtlGetThreadPreferredUILanguages
• RtlGetUILanguageInfo
• RtlGetUmsCompletionListEvent
• RtlGetUnloadEventTrace
• RtlGetUnloadEventTraceEx
• RtlGetUserInfoHeap
• RtlGetUserPreferredUILanguages
• RtlGetVersion
• RtlHashUnicodeString
• RtlHeapTrkInitialize
• RtlIdentifierAuthoritySid
• RtlIdnToAscii
• RtlIdnToNameprepUnicode
• RtlIdnToUnicode
• RtlImageDirectoryEntryToData
• RtlImageNtHeader
• RtlImageNtHeaderEx
• RtlImageRvaToSection
• RtlImageRvaToVa
• RtlImpersonateSelf
• RtlImpersonateSelfEx
• RtlInitAnsiString
• RtlInitAnsiStringEx
• RtlInitBarrier
• RtlInitCodePageTable
• RtlInitEnumerationHashTable
• RtlInitMemoryStream
• RtlInitNlsTables
• RtlInitOutOfProcessMemoryStream
• RtlInitString
• RtlInitUnicodeString
• RtlInitUnicodeStringEx
• RtlInitWeakEnumerationHashTable
• RtlInitializeAtomPackage
• RtlInitializeBitMap
• RtlInitializeConditionVariable
• RtlInitializeContext
• RtlInitializeCriticalSection
• RtlInitializeCriticalSectionAndSpinCount
• RtlInitializeCriticalSectionEx
• RtlInitializeExceptionChain
• RtlInitializeExtendedContext
• RtlInitializeGenericTable
• RtlInitializeGenericTableAvl
• RtlInitializeHandleTable
• RtlInitializeNtUserPfn
• RtlInitializeRXact
• RtlInitializeResource
• RtlInitializeSListHead
• RtlInitializeSRWLock
• RtlInitializeSid
• RtlInsertElementGenericTable
• RtlInsertElementGenericTableAvl
• RtlInsertElementGenericTableFull
• RtlInsertElementGenericTableFullAvl
• RtlInsertEntryHashTable
• RtlInstallFunctionTableCallback
• RtlInt64ToUnicodeString
• RtlIntegerToChar
• RtlIntegerToUnicodeString
• RtlInterlockedClearBitRun
• RtlInterlockedCompareExchange64
• RtlInterlockedFlushSList
• RtlInterlockedPopEntrySList
• RtlInterlockedPushEntrySList
• RtlInterlockedPushListSList
• RtlInterlockedSetBitRun
• RtlIoDecodeMemIoResource
• RtlIoEncodeMemIoResource
• RtlIpv4AddressToStringA
• RtlIpv4AddressToStringExA
• RtlIpv4AddressToStringExW
• RtlIpv4AddressToStringW
• RtlIpv4StringToAddressA
• RtlIpv4StringToAddressExA
• RtlIpv4StringToAddressExW
• RtlIpv4StringToAddressW
• RtlIpv6AddressToStringA
• RtlIpv6AddressToStringExA
• RtlIpv6AddressToStringExW
• RtlIpv6AddressToStringW
• RtlIpv6StringToAddressA
• RtlIpv6StringToAddressExA
• RtlIpv6StringToAddressExW
• RtlIpv6StringToAddressW
• RtlIsActivationContextActive
• RtlIsCriticalSectionLocked
• RtlIsCriticalSectionLockedByThread
• RtlIsCurrentThreadAttachExempt
• RtlIsDosDeviceName_U
• RtlIsGenericTableEmpty
• RtlIsGenericTableEmptyAvl
• RtlIsNameInExpression
• RtlIsNameLegalDOS8Dot3
• RtlIsNormalizedString
• RtlIsTextUnicode
• RtlIsThreadWithinLoaderCallout
• RtlIsValidHandle
• RtlIsValidIndexHandle
• RtlIsValidLocaleName
• RtlKnownExceptionFilter
• RtlLCIDToCultureName
• RtlLargeIntegerAdd
• RtlLargeIntegerArithmeticShift
• RtlLargeIntegerDivide
• RtlLargeIntegerNegate
• RtlLargeIntegerShiftLeft
• RtlLargeIntegerShiftRight
• RtlLargeIntegerSubtract
• RtlLargeIntegerToChar
• RtlLcidToLocaleName
• RtlLeaveCriticalSection
• RtlLengthRequiredSid
• RtlLengthSecurityDescriptor
• RtlLengthSid
• RtlLoadString
• RtlLocalTimeToSystemTime
• RtlLocaleNameToLcid
• RtlLocateExtendedFeature
• RtlLocateLegacyContext
• RtlLockBootStatusData
• RtlLockCurrentThread
• RtlLockHeap
• RtlLockMemoryBlockLookaside
• RtlLockMemoryStreamRegion
• RtlLockMemoryZone
• RtlLockModuleSection
• RtlLogStackBackTrace
• RtlLookupAtomInAtomTable
• RtlLookupElementGenericTable
• RtlLookupElementGenericTableAvl
• RtlLookupElementGenericTableFull
• RtlLookupElementGenericTableFullAvl
• RtlLookupEntryHashTable
• RtlLookupFunctionEntry
• RtlLookupFunctionTable
• RtlMakeSelfRelativeSD
• RtlMapGenericMask
• RtlMapSecurityErrorToNtStatus
• RtlMoveMemory
• RtlMultiAppendUnicodeStringBuffer
• RtlMultiByteToUnicodeN
• RtlMultiByteToUnicodeSize
• RtlMultipleAllocateHeap
• RtlMultipleFreeHeap
• RtlNewInstanceSecurityObject
• RtlNewSecurityGrantedAccess
• RtlNewSecurityObject
• RtlNewSecurityObjectEx
• RtlNewSecurityObjectWithMultipleInheritance
• RtlNormalizeProcessParams
• RtlNormalizeString
• RtlNtPathNameToDosPathName
• RtlNtStatusToDosError
• RtlNtStatusToDosErrorNoTeb
• RtlNtdllName
• RtlNumberGenericTableElements
• RtlNumberGenericTableElementsAvl
• RtlNumberOfClearBits
• RtlNumberOfSetBits
• RtlNumberOfSetBitsUlongPtr
• RtlOemStringToUnicodeSize
• RtlOemStringToUnicodeString
• RtlOemToUnicodeN
• RtlOpenCurrentUser
• RtlOwnerAcesPresent
• RtlPcToFileHeader
• RtlPinAtomInAtomTable
• RtlPopFrame
• RtlPrefixString
• RtlPrefixUnicodeString
• RtlPrepareForProcessCloning
• RtlProcessFlsData
• RtlProtectHeap
• RtlPushFrame
• RtlQueryActivationContextApplicationSettings
• RtlQueryAtomInAtomTable
• RtlQueryCriticalSectionOwner
• RtlQueryDepthSList
• RtlQueryDynamicTimeZoneInformation
• RtlQueryElevationFlags
• RtlQueryEnvironmentVariable
• RtlQueryEnvironmentVariable_U
• RtlQueryHeapInformation
• RtlQueryInformationAcl
• RtlQueryInformationActivationContext
• RtlQueryInformationActiveActivationContext
• RtlQueryInterfaceMemoryStream
• RtlQueryModuleInformation
• RtlQueryPerformanceCounter
• RtlQueryPerformanceFrequency
• RtlQueryProcessBackTraceInformation
• RtlQueryProcessDebugInformation
• RtlQueryProcessHeapInformation
• RtlQueryProcessLockInformation
• RtlQueryRegistryValues
• RtlQuerySecurityObject
• RtlQueryTagHeap
• RtlQueryThreadProfiling
• RtlQueryTimeZoneInformation
• RtlQueryUmsThreadInformation
• RtlQueueApcWow64Thread
• RtlQueueWorkItem
• RtlRaiseException
• RtlRaiseStatus
• RtlRandom
• RtlRandomEx
• RtlReAllocateHeap
• RtlReadMemoryStream
• RtlReadOutOfProcessMemoryStream
• RtlReadThreadProfilingData
• RtlRealPredecessor
• RtlRealSuccessor
• RtlRegisterSecureMemoryCacheCallback
• RtlRegisterThreadWithCsrss
• RtlRegisterWait
• RtlReleaseActivationContext
• RtlReleaseMemoryStream
• RtlReleasePebLock
• RtlReleasePrivilege
• RtlReleaseRelativeName
• RtlReleaseResource
• RtlReleaseSRWLockExclusive
• RtlReleaseSRWLockShared
• RtlRemoteCall
• RtlRemoveEntryHashTable
• RtlRemovePrivileges
• RtlRemoveVectoredContinueHandler
• RtlRemoveVectoredExceptionHandler
• RtlReplaceSidInSd
• RtlReportException
• RtlReportSilentProcessExit
• RtlReportSqmEscalation
• RtlResetMemoryBlockLookaside
• RtlResetMemoryZone
• RtlResetRtlTranslations
• RtlRestoreContext
• RtlRestoreLastWin32Error
• RtlRetrieveNtUserPfn
• RtlRevertMemoryStream
• RtlRunDecodeUnicodeString
• RtlRunEncodeUnicodeString
• RtlRunOnceBeginInitialize
• RtlRunOnceComplete
• RtlRunOnceExecuteOnce
• RtlRunOnceInitialize
• RtlSecondsSince1970ToTime
• RtlSecondsSince1980ToTime
• RtlSeekMemoryStream
• RtlSelfRelativeToAbsoluteSD
• RtlSelfRelativeToAbsoluteSD2
• RtlSendMsgToSm
• RtlSetAllBits
• RtlSetAttributesSecurityDescriptor
• RtlSetBits
• RtlSetControlSecurityDescriptor
• RtlSetCriticalSectionSpinCount
• RtlSetCurrentDirectory_U
• RtlSetCurrentEnvironment
• RtlSetCurrentTransaction
• RtlSetDaclSecurityDescriptor
• RtlSetDynamicTimeZoneInformation
• RtlSetEnvironmentStrings
• RtlSetEnvironmentVar
• RtlSetEnvironmentVariable
• RtlSetExtendedFeaturesMask
• RtlSetGroupSecurityDescriptor
• RtlSetHeapInformation
• RtlSetInformationAcl
• RtlSetIoCompletionCallback
• RtlSetLastWin32Error
• RtlSetLastWin32ErrorAndNtStatusFromNtStatus
• RtlSetMemoryStreamSize
• RtlSetOwnerSecurityDescriptor
• RtlSetProcessDebugInformation
• RtlSetProcessIsCritical
• RtlSetProcessPreferredUILanguages
• RtlSetSaclSecurityDescriptor
• RtlSetSecurityDescriptorRMControl
• RtlSetSecurityObject
• RtlSetSecurityObjectEx
• RtlSetThreadErrorMode
• RtlSetThreadIsCritical
• RtlSetThreadPoolStartFunc
• RtlSetThreadPreferredUILanguages
• RtlSetTimeZoneInformation
• RtlSetTimer
• RtlSetUmsThreadInformation
• RtlSetUnhandledExceptionFilter
• RtlSetUserCallbackExceptionFilter
• RtlSetUserFlagsHeap
• RtlSetUserValueHeap
• RtlSidDominates
• RtlSidEqualLevel
• RtlSidHashInitialize
• RtlSidHashLookup
• RtlSidIsHigherLevel
• RtlSizeHeap
• RtlSleepConditionVariableCS
• RtlSleepConditionVariableSRW
• RtlSplay
• RtlStartRXact
• RtlStatMemoryStream
• RtlStringFromGUID
• RtlSubAuthorityCountSid
• RtlSubAuthoritySid
• RtlSubtreePredecessor
• RtlSubtreeSuccessor
• RtlSystemTimeToLocalTime
• RtlTestBit
• RtlTimeFieldsToTime
• RtlTimeToElapsedTimeFields
• RtlTimeToSecondsSince1970
• RtlTimeToSecondsSince1980
• RtlTimeToTimeFields
• RtlTraceDatabaseAdd
• RtlTraceDatabaseCreate
• RtlTraceDatabaseDestroy
• RtlTraceDatabaseEnumerate
• RtlTraceDatabaseFind
• RtlTraceDatabaseLock
• RtlTraceDatabaseUnlock
• RtlTraceDatabaseValidate
• RtlTryAcquirePebLock
• RtlTryAcquireSRWLockExclusive
• RtlTryAcquireSRWLockShared
• RtlTryEnterCriticalSection
• RtlUTF8ToUnicodeN
• RtlUlongByteSwap
• RtlUlonglongByteSwap
• RtlUmsThreadYield
• RtlUnhandledExceptionFilter
• RtlUnhandledExceptionFilter2
• RtlUnicodeStringToAnsiSize
• RtlUnicodeStringToAnsiString
• RtlUnicodeStringToCountedOemString
• RtlUnicodeStringToInteger
• RtlUnicodeStringToOemSize
• RtlUnicodeStringToOemString
• RtlUnicodeToCustomCPN
• RtlUnicodeToMultiByteN
• RtlUnicodeToMultiByteSize
• RtlUnicodeToOemN
• RtlUnicodeToUTF8N
• RtlUniform
• RtlUnlockBootStatusData
• RtlUnlockCurrentThread
• RtlUnlockHeap
• RtlUnlockMemoryBlockLookaside
• RtlUnlockMemoryStreamRegion
• RtlUnlockMemoryZone
• RtlUnlockModuleSection
• RtlUnwind
• RtlUnwindEx
• RtlUpcaseUnicodeChar
• RtlUpcaseUnicodeString
• RtlUpcaseUnicodeStringToAnsiString
• RtlUpcaseUnicodeStringToCountedOemString
• RtlUpcaseUnicodeStringToOemString
• RtlUpcaseUnicodeToCustomCPN
• RtlUpcaseUnicodeToMultiByteN
• RtlUpcaseUnicodeToOemN
• RtlUpdateClonedCriticalSection
• RtlUpdateClonedSRWLock
• RtlUpdateTimer
• RtlUpperChar
• RtlUpperString
• RtlUserThreadStart
• RtlUshortByteSwap
• RtlValidAcl
• RtlValidRelativeSecurityDescriptor
• RtlValidSecurityDescriptor
• RtlValidSid
• RtlValidateHeap
• RtlValidateProcessHeaps
• RtlValidateUnicodeString
• RtlVerifyVersionInfo
• RtlVirtualUnwind
• RtlWakeAllConditionVariable
• RtlWakeConditionVariable
• RtlWalkFrameChain
• RtlWalkHeap
• RtlWeaklyEnumerateEntryHashTable
• RtlWerpReportException
• RtlWow64CallFunction64
• RtlWow64EnableFsRedirection
• RtlWow64EnableFsRedirectionEx
• RtlWow64GetThreadContext
• RtlWow64GetThreadSelectorEntry
• RtlWow64LogMessageInEventLogger
• RtlWow64SetThreadContext
• RtlWow64SuspendThread
• RtlWriteMemoryStream
• RtlWriteRegistryValue
• RtlZeroHeap
• RtlZeroMemory
• RtlZombifyActivationContext
• RtlpApplyLengthFunction
• RtlpCheckDynamicTimeZoneInformation
• RtlpCleanupRegistryKeys
• RtlpConvertCultureNamesToLCIDs
• RtlpConvertLCIDsToCultureNames
• RtlpCreateProcessRegistryInfo
• RtlpEnsureBufferSize
• RtlpExecuteUmsThread
• RtlpGetLCIDFromLangInfoNode
• RtlpGetNameFromLangInfoNode
• RtlpGetSystemDefaultUILanguage
• RtlpGetUserOrMachineUILanguage4NLS
• RtlpInitializeLangRegistryInfo
• RtlpIsQualifiedLanguage
• RtlpLoadMachineUIByPolicy
• RtlpLoadUserUIByPolicy
• RtlpMuiFreeLangRegistryInfo
• RtlpMuiRegCreateRegistryInfo
• RtlpMuiRegFreeRegistryInfo
• RtlpMuiRegLoadRegistryInfo
• RtlpNotOwnerCriticalSection
• RtlpNtCreateKey
• RtlpNtEnumerateSubKey
• RtlpNtMakeTemporaryKey
• RtlpNtOpenKey
• RtlpNtQueryValueKey
• RtlpNtSetValueKey
• RtlpQueryDefaultUILanguage
• RtlpQueryProcessDebugInformationFromWow64
• RtlpQueryProcessDebugInformationRemote
• RtlpRefreshCachedUILanguage
• RtlpSetInstallLanguage
• RtlpSetPreferredUILanguages
• RtlpSetUserPreferredUILanguages
• RtlpUmsExecuteYieldThreadEnd
• RtlpUmsThreadYield
• RtlpUnWaitCriticalSection
• RtlpVerifyAndCommitUILanguageSettings
• RtlpWaitForCriticalSection
• RtlxAnsiStringToUnicodeSize
• RtlxOemStringToUnicodeSize
• RtlxUnicodeStringToAnsiSize
• RtlxUnicodeStringToOemSize
• SbExecuteProcedure
• SbSelectProcedure
• ShipAssert
• ShipAssertGetBufferInfo
• ShipAssertMsgA
• ShipAssertMsgW
• TpAllocAlpcCompletion
• TpAllocAlpcCompletionEx
• TpAllocCleanupGroup
• TpAllocIoCompletion
• TpAllocPool
• TpAllocTimer
• TpAllocWait
• TpAllocWork
• TpAlpcRegisterCompletionList
• TpAlpcUnregisterCompletionList
• TpCallbackIndependent
• TpCallbackLeaveCriticalSectionOnCompletion
• TpCallbackMayRunLong
• TpCallbackReleaseMutexOnCompletion
• TpCallbackReleaseSemaphoreOnCompletion
• TpCallbackSetEventOnCompletion
• TpCallbackUnloadDllOnCompletion
• TpCancelAsyncIoOperation
• TpCaptureCaller
• TpCheckTerminateWorker
• TpDbgDumpHeapUsage
• TpDbgGetFreeInfo
• TpDbgSetLogRoutine
• TpDisablePoolCallbackChecks
• TpDisassociateCallback
• TpIsTimerSet
• TpPoolFreeUnusedNodes
• TpPostWork
• TpQueryPoolStackInformation
• TpReleaseAlpcCompletion
• TpReleaseCleanupGroup
• TpReleaseCleanupGroupMembers
• TpReleaseIoCompletion
• TpReleasePool
• TpReleaseTimer
• TpReleaseWait
• TpReleaseWork
• TpSetDefaultPoolMaxThreads
• TpSetDefaultPoolStackInformation
• TpSetPoolMaxThreads
• TpSetPoolMinThreads
• TpSetPoolStackInformation
• TpSetTimer
• TpSetWait
• TpSimpleTryPost
• TpStartAsyncIoOperation
• TpWaitForAlpcCompletion
• TpWaitForIoCompletion
• TpWaitForTimer
• TpWaitForWait
• TpWaitForWork
• VerSetConditionMask
• WerReportSQMEvent
• WinSqmAddToAverageDWORD
• WinSqmAddToStream
• WinSqmAddToStreamEx
• WinSqmCheckEscalationAddToStreamEx
• WinSqmCheckEscalationSetDWORD
• WinSqmCheckEscalationSetDWORD64
• WinSqmCheckEscalationSetString
• WinSqmCommonDatapointDelete
• WinSqmCommonDatapointSetDWORD
• WinSqmCommonDatapointSetDWORD64
• WinSqmCommonDatapointSetStreamEx
• WinSqmCommonDatapointSetString
• WinSqmEndSession
• WinSqmEventEnabled
• WinSqmEventWrite
• WinSqmGetEscalationRuleStatus
• WinSqmGetInstrumentationProperty
• WinSqmIncrementDWORD
• WinSqmIsOptedIn
• WinSqmIsOptedInEx
• WinSqmSetDWORD
• WinSqmSetDWORD64
• WinSqmSetEscalationInfo
• WinSqmSetIfMaxDWORD
• WinSqmSetIfMinDWORD
• WinSqmSetString
• WinSqmStartSession
• ZwAcceptConnectPort
• ZwAccessCheck
• ZwAccessCheckAndAuditAlarm
• ZwAccessCheckByType
• ZwAccessCheckByTypeAndAuditAlarm
• ZwAccessCheckByTypeResultList
• ZwAccessCheckByTypeResultListAndAuditAlarm
• ZwAccessCheckByTypeResultListAndAuditAlarmByHandle
• ZwAddAtom
• ZwAddBootEntry
• ZwAddDriverEntry
• ZwAdjustGroupsToken
• ZwAdjustPrivilegesToken
• ZwAlertResumeThread
• ZwAlertThread
• ZwAllocateLocallyUniqueId
• ZwAllocateReserveObject
• ZwAllocateUserPhysicalPages
• ZwAllocateUuids
• ZwAllocateVirtualMemory
• ZwAlpcAcceptConnectPort
• ZwAlpcCancelMessage
• ZwAlpcConnectPort
• ZwAlpcCreatePort
• ZwAlpcCreatePortSection
• ZwAlpcCreateResourceReserve
• ZwAlpcCreateSectionView
• ZwAlpcCreateSecurityContext
• ZwAlpcDeletePortSection
• ZwAlpcDeleteResourceReserve
• ZwAlpcDeleteSectionView
• ZwAlpcDeleteSecurityContext
• ZwAlpcDisconnectPort
• ZwAlpcImpersonateClientOfPort
• ZwAlpcOpenSenderProcess
• ZwAlpcOpenSenderThread
• ZwAlpcQueryInformation
• ZwAlpcQueryInformationMessage
• ZwAlpcRevokeSecurityContext
• ZwAlpcSendWaitReceivePort
• ZwAlpcSetInformation
• ZwApphelpCacheControl
• ZwAreMappedFilesTheSame
• ZwAssignProcessToJobObject
• ZwCallbackReturn
• ZwCancelIoFile
• ZwCancelIoFileEx
• ZwCancelSynchronousIoFile
• ZwCancelTimer
• ZwClearEvent
• ZwClose
• ZwCloseObjectAuditAlarm
• ZwCommitComplete
• ZwCommitEnlistment
• ZwCommitTransaction
• ZwCompactKeys
• ZwCompareTokens
• ZwCompleteConnectPort
• ZwCompressKey
• ZwConnectPort
• ZwContinue
• ZwCreateDebugObject
• ZwCreateDirectoryObject
• ZwCreateEnlistment
• ZwCreateEvent
• ZwCreateEventPair
• ZwCreateFile
• ZwCreateIoCompletion
• ZwCreateJobObject
• ZwCreateJobSet
• ZwCreateKey
• ZwCreateKeyTransacted
• ZwCreateKeyedEvent
• ZwCreateMailslotFile
• ZwCreateMutant
• ZwCreateNamedPipeFile
• ZwCreatePagingFile
• ZwCreatePort
• ZwCreatePrivateNamespace
• ZwCreateProcess
• ZwCreateProcessEx
• ZwCreateProfile
• ZwCreateProfileEx
• ZwCreateResourceManager
• ZwCreateSection
• ZwCreateSemaphore
• ZwCreateSymbolicLinkObject
• ZwCreateThread
• ZwCreateThreadEx
• ZwCreateTimer
• ZwCreateToken
• ZwCreateTransaction
• ZwCreateTransactionManager
• ZwCreateUserProcess
• ZwCreateWaitablePort
• ZwCreateWorkerFactory
• ZwDebugActiveProcess
• ZwDebugContinue
• ZwDelayExecution
• ZwDeleteAtom
• ZwDeleteBootEntry
• ZwDeleteDriverEntry
• ZwDeleteFile
• ZwDeleteKey
• ZwDeleteObjectAuditAlarm
• ZwDeletePrivateNamespace
• ZwDeleteValueKey
• ZwDeviceIoControlFile
• ZwDisableLastKnownGood
• ZwDisplayString
• ZwDrawText
• ZwDuplicateObject
• ZwDuplicateToken
• ZwEnableLastKnownGood
• ZwEnumerateBootEntries
• ZwEnumerateDriverEntries
• ZwEnumerateKey
• ZwEnumerateSystemEnvironmentValuesEx
• ZwEnumerateTransactionObject
• ZwEnumerateValueKey
• ZwExtendSection
• ZwFilterToken
• ZwFindAtom
• ZwFlushBuffersFile
• ZwFlushInstallUILanguage
• ZwFlushInstructionCache
• ZwFlushKey
• ZwFlushProcessWriteBuffers
• ZwFlushVirtualMemory
• ZwFlushWriteBuffer
• ZwFreeUserPhysicalPages
• ZwFreeVirtualMemory
• ZwFreezeRegistry
• ZwFreezeTransactions
• ZwFsControlFile
• ZwGetContextThread
• ZwGetCurrentProcessorNumber
• ZwGetDevicePowerState
• ZwGetMUIRegistryInfo
• ZwGetNextProcess
• ZwGetNextThread
• ZwGetNlsSectionPtr
• ZwGetNotificationResourceManager
• ZwGetPlugPlayEvent
• ZwGetWriteWatch
• ZwImpersonateAnonymousToken
• ZwImpersonateClientOfPort
• ZwImpersonateThread
• ZwInitializeNlsFiles
• ZwInitializeRegistry
• ZwInitiatePowerAction
• ZwIsProcessInJob
• ZwIsSystemResumeAutomatic
• ZwIsUILanguageComitted
• ZwListenPort
• ZwLoadDriver
• ZwLoadKey
• ZwLoadKey2
• ZwLoadKeyEx
• ZwLockFile
• ZwLockProductActivationKeys
• ZwLockRegistryKey
• ZwLockVirtualMemory
• ZwMakePermanentObject
• ZwMakeTemporaryObject
• ZwMapCMFModule
• ZwMapUserPhysicalPages
• ZwMapUserPhysicalPagesScatter
• ZwMapViewOfSection
• ZwModifyBootEntry
• ZwModifyDriverEntry
• ZwNotifyChangeDirectoryFile
• ZwNotifyChangeKey
• ZwNotifyChangeMultipleKeys
• ZwNotifyChangeSession
• ZwOpenDirectoryObject
• ZwOpenEnlistment
• ZwOpenEvent
• ZwOpenEventPair
• ZwOpenFile
• ZwOpenIoCompletion
• ZwOpenJobObject
• ZwOpenKey
• ZwOpenKeyEx
• ZwOpenKeyTransacted
• ZwOpenKeyTransactedEx
• ZwOpenKeyedEvent
• ZwOpenMutant
• ZwOpenObjectAuditAlarm
• ZwOpenPrivateNamespace
• ZwOpenProcess
• ZwOpenProcessToken
• ZwOpenProcessTokenEx
• ZwOpenResourceManager
• ZwOpenSection
• ZwOpenSemaphore
• ZwOpenSession
• ZwOpenSymbolicLinkObject
• ZwOpenThread
• ZwOpenThreadToken
• ZwOpenThreadTokenEx
• ZwOpenTimer
• ZwOpenTransaction
• ZwOpenTransactionManager
• ZwPlugPlayControl
• ZwPowerInformation
• ZwPrePrepareComplete
• ZwPrePrepareEnlistment
• ZwPrepareComplete
• ZwPrepareEnlistment
• ZwPrivilegeCheck
• ZwPrivilegeObjectAuditAlarm
• ZwPrivilegedServiceAuditAlarm
• ZwPropagationComplete
• ZwPropagationFailed
• ZwProtectVirtualMemory
• ZwPulseEvent
• ZwQueryAttributesFile
• ZwQueryBootEntryOrder
• ZwQueryBootOptions
• ZwQueryDebugFilterState
• ZwQueryDefaultLocale
• ZwQueryDefaultUILanguage
• ZwQueryDirectoryFile
• ZwQueryDirectoryObject
• ZwQueryDriverEntryOrder
• ZwQueryEaFile
• ZwQueryEvent
• ZwQueryFullAttributesFile
• ZwQueryInformationAtom
• ZwQueryInformationEnlistment
• ZwQueryInformationFile
• ZwQueryInformationJobObject
• ZwQueryInformationPort
• ZwQueryInformationProcess
• ZwQueryInformationResourceManager
• ZwQueryInformationThread
• ZwQueryInformationToken
• ZwQueryInformationTransaction
• ZwQueryInformationTransactionManager
• ZwQueryInformationWorkerFactory
• ZwQueryInstallUILanguage
• ZwQueryIntervalProfile
• ZwQueryIoCompletion
• ZwQueryKey
• ZwQueryLicenseValue
• ZwQueryMultipleValueKey
• ZwQueryMutant
• ZwQueryObject
• ZwQueryOpenSubKeys
• ZwQueryOpenSubKeysEx
• ZwQueryPerformanceCounter
• ZwQueryPortInformationProcess
• ZwQueryQuotaInformationFile
• ZwQuerySection
• ZwQuerySecurityAttributesToken
• ZwQuerySecurityObject
• ZwQuerySemaphore
• ZwQuerySymbolicLinkObject
• ZwQuerySystemEnvironmentValue
• ZwQuerySystemEnvironmentValueEx
• ZwQuerySystemInformation
• ZwQuerySystemInformationEx
• ZwQuerySystemTime
• ZwQueryTimer
• ZwQueryTimerResolution
• ZwQueryValueKey
• ZwQueryVirtualMemory
• ZwQueryVolumeInformationFile
• ZwQueueApcThread
• ZwQueueApcThreadEx
• ZwRaiseException
• ZwRaiseHardError
• ZwReadFile
• ZwReadFileScatter
• ZwReadOnlyEnlistment
• ZwReadRequestData
• ZwReadVirtualMemory
• ZwRecoverEnlistment
• ZwRecoverResourceManager
• ZwRecoverTransactionManager
• ZwRegisterProtocolAddressInformation
• ZwRegisterThreadTerminatePort
• ZwReleaseKeyedEvent
• ZwReleaseMutant
• ZwReleaseSemaphore
• ZwReleaseWorkerFactoryWorker
• ZwRemoveIoCompletion
• ZwRemoveIoCompletionEx
• ZwRemoveProcessDebug
• ZwRenameKey
• ZwRenameTransactionManager
• ZwReplaceKey
• ZwReplacePartitionUnit
• ZwReplyPort
• ZwReplyWaitReceivePort
• ZwReplyWaitReceivePortEx
• ZwReplyWaitReplyPort
• ZwRequestPort
• ZwRequestWaitReplyPort
• ZwResetEvent
• ZwResetWriteWatch
• ZwRestoreKey
• ZwResumeProcess
• ZwResumeThread
• ZwRollbackComplete
• ZwRollbackEnlistment
• ZwRollbackTransaction
• ZwRollforwardTransactionManager
• ZwSaveKey
• ZwSaveKeyEx
• ZwSaveMergedKeys
• ZwSecureConnectPort
• ZwSerializeBoot
• ZwSetBootEntryOrder
• ZwSetBootOptions
• ZwSetContextThread
• ZwSetDebugFilterState
• ZwSetDefaultHardErrorPort
• ZwSetDefaultLocale
• ZwSetDefaultUILanguage
• ZwSetDriverEntryOrder
• ZwSetEaFile
• ZwSetEvent
• ZwSetEventBoostPriority
• ZwSetHighEventPair
• ZwSetHighWaitLowEventPair
• ZwSetInformationDebugObject
• ZwSetInformationEnlistment
• ZwSetInformationFile
• ZwSetInformationJobObject
• ZwSetInformationKey
• ZwSetInformationObject
• ZwSetInformationProcess
• ZwSetInformationResourceManager
• ZwSetInformationThread
• ZwSetInformationToken
• ZwSetInformationTransaction
• ZwSetInformationTransactionManager
• ZwSetInformationWorkerFactory
• ZwSetIntervalProfile
• ZwSetIoCompletion
• ZwSetIoCompletionEx
• ZwSetLdtEntries
• ZwSetLowEventPair
• ZwSetLowWaitHighEventPair
• ZwSetQuotaInformationFile
• ZwSetSecurityObject
• ZwSetSystemEnvironmentValue
• ZwSetSystemEnvironmentValueEx
• ZwSetSystemInformation
• ZwSetSystemPowerState
• ZwSetSystemTime
• ZwSetThreadExecutionState
• ZwSetTimer
• ZwSetTimerEx
• ZwSetTimerResolution
• ZwSetUuidSeed
• ZwSetValueKey
• ZwSetVolumeInformationFile
• ZwShutdownSystem
• ZwShutdownWorkerFactory
• ZwSignalAndWaitForSingleObject
• ZwSinglePhaseReject
• ZwStartProfile
• ZwStopProfile
• ZwSuspendProcess
• ZwSuspendThread
• ZwSystemDebugControl
• ZwTerminateJobObject
• ZwTerminateProcess
• ZwTerminateThread
• ZwTestAlert
• ZwThawRegistry
• ZwThawTransactions
• ZwTraceControl
• ZwTraceEvent
• ZwTranslateFilePath
• ZwUmsThreadYield
• ZwUnloadDriver
• ZwUnloadKey
• ZwUnloadKey2
• ZwUnloadKeyEx
• ZwUnlockFile
• ZwUnlockVirtualMemory
• ZwUnmapViewOfSection
• ZwVdmControl
• ZwWaitForDebugEvent
• ZwWaitForKeyedEvent
• ZwWaitForMultipleObjects
• ZwWaitForMultipleObjects32
• ZwWaitForSingleObject
• ZwWaitForWorkViaWorkerFactory
• ZwWaitHighEventPair
• ZwWaitLowEventPair
• ZwWorkerFactoryWorkerReady
• ZwWow64CallFunction64
• ZwWow64CsrAllocateCaptureBuffer
• ZwWow64CsrAllocateMessagePointer
• ZwWow64CsrCaptureMessageBuffer
• ZwWow64CsrCaptureMessageString
• ZwWow64CsrClientCallServer
• ZwWow64CsrClientConnectToServer
• ZwWow64CsrFreeCaptureBuffer
• ZwWow64CsrGetProcessId
• ZwWow64CsrIdentifyAlertableThread
• ZwWow64CsrVerifyRegion
• ZwWow64DebuggerCall
• ZwWow64GetCurrentProcessorNumberEx
• ZwWow64GetNativeSystemInformation
• ZwWow64InterlockedPopEntrySList
• ZwWow64QueryInformationProcess64
• ZwWow64QueryVirtualMemory64
• ZwWow64ReadVirtualMemory64
• ZwWow64WriteVirtualMemory64
• ZwWriteFile
• ZwWriteFileGather
• ZwWriteRequestData
• ZwWriteVirtualMemory
• ZwYieldExecution
• _CIcos
• _CIlog
• _CIpow
• _CIsin
• _CIsqrt
• __C_specific_handler
• __chkstk
• __isascii
• __iscsym
• __iscsymf
• __misaligned_access
• __toascii
• _alldiv
• _alldvrm
• _allmul
• _alloca_probe
• _alloca_probe_16
• _alloca_probe_8
• _allrem
• _allshl
• _allshr
• _atoi64
• _aulldiv
• _aulldvrm
• _aullrem
• _aullshr
• _chkstk
• _fltused
• _ftol
• _i64toa
• _i64toa_s
• _i64tow
• _i64tow_s
• _itoa
• _itoa_s
• _itow
• _itow_s
• _lfind
• _local_unwind
• _ltoa
• _ltoa_s
• _ltow
• _ltow_s
• _makepath_s
• _memccpy
• _memicmp
• _setjmp
• _setjmpex
• _snprintf
• _snprintf_s
• _snscanf_s
• _snwprintf
• _snwprintf_s
• _snwscanf_s
• _splitpath
• _splitpath_s
• _strcmpi
• _stricmp
• _strlwr
• _strnicmp
• _strnset_s
• _strset_s
• _strupr
• _swprintf
• _ui64toa
• _ui64toa_s
• _ui64tow
• _ui64tow_s
• _ultoa
• _ultoa_s
• _ultow
• _ultow_s
• _vscwprintf
• _vsnprintf
• _vsnprintf_s
• _vsnwprintf
• _vsnwprintf_s
• _vswprintf
• _wcsicmp
• _wcslwr
• _wcsnicmp
• _wcsnset_s
• _wcsset_s
• _wcstoui64
• _wcsupr
• _wmakepath_s
• _wsplitpath_s
• _wtoi
• _wtoi64
• _wtol
• abs
• atan
• atoi
• atol
• bsearch
• ceil
• cos
• fabs
• floor
• isalnum
• isalpha
• iscntrl
• isdigit
• isgraph
• islower
• isprint
• ispunct
• isspace
• isupper
• iswalpha
• iswctype
• iswdigit
• iswlower
• iswspace
• iswxdigit
• isxdigit
• labs
• log
• longjmp
• mbstowcs
• memchr
• memcmp
• memcpy
• memcpy_s
• memmove
• memmove_s
• memset
• pow
• qsort
• sin
• sprintf
• sprintf_s
• sqrt
• sscanf
• sscanf_s
• strcat
• strcat_s
• strchr
• strcmp
• strcpy
• strcpy_s
• strcspn
• strlen
• strncat
• strncat_s
• strncmp
• strncpy
• strncpy_s
• strnlen
• strpbrk
• strrchr
• strspn
• strstr
• strtok_s
• strtol
• strtoul
• swprintf
• swprintf_s
• swscanf_s
• tan
• tolower
• toupper
• towlower
• towupper
• vDbgPrintEx
• vDbgPrintExWithPrefix
• vsprintf
• vsprintf_s
• vswprintf_s
• wcscat
• wcscat_s
• wcschr
• wcscmp
• wcscpy
• wcscpy_s
• wcscspn
• wcslen
• wcsncat
• wcsncat_s
• wcsncmp
• wcsncpy
• wcsncpy_s
• wcsnlen
• wcspbrk
• wcsrchr
• wcsspn
• wcsstr
• wcstol
• wcstombs
• wcstoul
• ntdll.dll#1
• ntdll.dll#2
• ntdll.dll#3
• ntdll.dll#4
• ntdll.dll#5
• ntdll.dll#6
• ntdll.dll#7
• ntdll.dll#8