Windows APIs

win8 Symbols in ntoskrnl.exe

⇒

general DLL page

• AlpcGetHeaderSize
• AlpcGetMessageAttribute
• AlpcInitializeMessageAttribute
• BgkDisplayCharacter
• BgkGetConsoleState
• BgkGetCursorState
• BgkSetCursor
• CcAddDirtyPagesToExternalCache
• CcCanIWrite
• CcCoherencyFlushAndPurgeCache
• CcCopyRead
• CcCopyReadEx
• CcCopyWrite
• CcCopyWriteEx
• CcCopyWriteWontFlush
• CcDeductDirtyPagesFromExternalCache
• CcDeferWrite
• CcFastCopyRead
• CcFastCopyWrite
• CcFastMdlReadWait
• CcFlushCache
• CcFlushCacheToLsn
• CcGetDirtyPages
• CcGetFileObjectFromBcb
• CcGetFileObjectFromSectionPtrs
• CcGetFileObjectFromSectionPtrsRef
• CcGetFlushedValidData
• CcGetLsnForFileObject
• CcInitializeCacheMap
• CcIsThereDirtyData
• CcIsThereDirtyDataEx
• CcIsThereDirtyLoggedPages
• CcMapData
• CcMdlRead
• CcMdlReadComplete
• CcMdlWriteAbort
• CcMdlWriteComplete
• CcPinMappedData
• CcPinRead
• CcPrepareMdlWrite
• CcPreparePinWrite
• CcPurgeCacheSection
• CcRegisterExternalCache
• CcRemapBcb
• CcRepinBcb
• CcScheduleReadAhead
• CcScheduleReadAheadEx
• CcSetAdditionalCacheAttributes
• CcSetAdditionalCacheAttributesEx
• CcSetBcbOwnerPointer
• CcSetDirtyPageThreshold
• CcSetDirtyPinnedData
• CcSetFileSizes
• CcSetFileSizesEx
• CcSetLogHandleForFile
• CcSetLogHandleForFileEx
• CcSetLoggedDataThreshold
• CcSetParallelFlushFile
• CcSetReadAheadGranularity
• CcSetReadAheadGranularityEx
• CcTestControl
• CcUninitializeCacheMap
• CcUnmapFileOffsetFromSystemCache
• CcUnpinData
• CcUnpinDataForThread
• CcUnpinRepinnedBcb
• CcUnregisterExternalCache
• CcWaitForCurrentLazyWriterActivity
• CcZeroData
• CcZeroDataOnDisk
• CmCallbackGetKeyObjectID
• CmCallbackGetKeyObjectIDEx
• CmCallbackReleaseKeyObjectIDEx
• CmGetBoundTransaction
• CmGetCallbackVersion
• CmKeyObjectType
• CmRegisterCallback
• CmRegisterCallbackEx
• CmSetCallbackObjectContext
• CmUnRegisterCallback
• DbgBreakPoint
• DbgBreakPointWithStatus
• DbgCommandString
• DbgLoadImageSymbols
• DbgPrint
• DbgPrintEx
• DbgPrintReturnControlC
• DbgPrompt
• DbgQueryDebugFilterState
• DbgSetDebugFilterState
• DbgSetDebugPrintCallback
• DbgkLkmdRegisterCallback
• DbgkLkmdUnregisterCallback
• EmClientQueryRuleState
• EmClientRuleDeregisterNotification
• EmClientRuleEvaluate
• EmClientRuleRegisterNotification
• EmProviderDeregister
• EmProviderDeregisterEntry
• EmProviderRegister
• EmProviderRegisterEntry
• EmpProviderRegister
• EtwActivityIdControl
• EtwEnableTrace
• EtwEventEnabled
• EtwProviderEnabled
• EtwRegister
• EtwRegisterClassicProvider
• EtwSendTraceBuffer
• EtwUnregister
• EtwWrite
• EtwWriteEndScenario
• EtwWriteEx
• EtwWriteStartScenario
• EtwWriteString
• EtwWriteTransfer
• ExAcquireCacheAwarePushLockExclusive
• ExAcquireFastMutex
• ExAcquireFastMutexUnsafe
• ExAcquireResourceExclusiveLite
• ExAcquireResourceSharedLite
• ExAcquireRundownProtection
• ExAcquireRundownProtectionCacheAware
• ExAcquireRundownProtectionCacheAwareEx
• ExAcquireRundownProtectionEx
• ExAcquireSharedStarveExclusive
• ExAcquireSharedWaitForExclusive
• ExAcquireSpinLockExclusive
• ExAcquireSpinLockExclusiveAtDpcLevel
• ExAcquireSpinLockShared
• ExAcquireSpinLockSharedAtDpcLevel
• ExAllocateCacheAwarePushLock
• ExAllocateCacheAwareRundownProtection
• ExAllocatePool
• ExAllocatePoolWithQuota
• ExAllocatePoolWithQuotaTag
• ExAllocatePoolWithTag
• ExAllocatePoolWithTagPriority
• ExBlockOnAddressPushLock
• ExBlockPushLock
• ExCompositionSurfaceObjectType
• ExConvertExclusiveToSharedLite
• ExCreateCallback
• ExDeleteLookasideListEx
• ExDeleteNPagedLookasideList
• ExDeletePagedLookasideList
• ExDeleteResourceLite
• ExDesktopObjectType
• ExDisableResourceBoostLite
• ExEnterCriticalRegionAndAcquireFastMutexUnsafe
• ExEnterCriticalRegionAndAcquireResourceExclusive
• ExEnterCriticalRegionAndAcquireResourceShared
• ExEnterCriticalRegionAndAcquireSharedWaitForExclusive
• ExEnterPriorityRegionAndAcquireResourceExclusive
• ExEnterPriorityRegionAndAcquireResourceShared
• ExEnumHandleTable
• ExEventObjectType
• ExExtendZone
• ExFetchLicenseData
• ExFlushLookasideListEx
• ExFreeCacheAwarePushLock
• ExFreeCacheAwareRundownProtection
• ExFreePool
• ExFreePoolWithTag
• ExGetCurrentProcessorCounts
• ExGetCurrentProcessorCpuUsage
• ExGetExclusiveWaiterCount
• ExGetFirmwareEnvironmentVariable
• ExGetLicenseTamperState
• ExGetPreviousMode
• ExGetSharedWaiterCount
• ExInitializeLookasideListEx
• ExInitializeNPagedLookasideList
• ExInitializePagedLookasideList
• ExInitializePushLock
• ExInitializeResourceLite
• ExInitializeRundownProtection
• ExInitializeRundownProtectionCacheAware
• ExInitializeZone
• ExInterlockedAddLargeInteger
• ExInterlockedAddUlong
• ExInterlockedExtendZone
• ExInterlockedInsertHeadList
• ExInterlockedInsertTailList
• ExInterlockedPopEntryList
• ExInterlockedPushEntryList
• ExInterlockedRemoveHeadList
• ExIsProcessorFeaturePresent
• ExIsResourceAcquiredExclusiveLite
• ExIsResourceAcquiredSharedLite
• ExLocalTimeToSystemTime
• ExNotifyBootDeviceRemoval
• ExNotifyCallback
• ExQueryAttributeInformation
• ExQueryDepthSList
• ExQueryFastCacheAppOrigin
• ExQueryFastCacheDevLicense
• ExQueryPoolBlockSize
• ExQueryTimerResolution
• ExQueryWnfStateData
• ExQueueWorkItem
• ExRaiseAccessViolation
• ExRaiseDatatypeMisalignment
• ExRaiseException
• ExRaiseHardError
• ExRaiseStatus
• ExReInitializeRundownProtection
• ExReInitializeRundownProtectionCacheAware
• ExRealTimeIsUniversal
• ExRegisterAttributeInformationCallback
• ExRegisterBootDevice
• ExRegisterCallback
• ExRegisterExtension
• ExReinitializeResourceLite
• ExReleaseCacheAwarePushLockExclusive
• ExReleaseFastMutex
• ExReleaseFastMutexUnsafe
• ExReleaseFastMutexUnsafeAndLeaveCriticalRegion
• ExReleaseResourceAndLeaveCriticalRegion
• ExReleaseResourceAndLeavePriorityRegion
• ExReleaseResourceForThreadLite
• ExReleaseResourceLite
• ExReleaseRundownProtection
• ExReleaseRundownProtectionCacheAware
• ExReleaseRundownProtectionCacheAwareEx
• ExReleaseRundownProtectionEx
• ExReleaseSpinLockExclusive
• ExReleaseSpinLockExclusiveFromDpcLevel
• ExReleaseSpinLockShared
• ExReleaseSpinLockSharedFromDpcLevel
• ExRundownCompleted
• ExRundownCompletedCacheAware
• ExSemaphoreObjectType
• ExSetFirmwareEnvironmentVariable
• ExSetLicenseTamperState
• ExSetResourceOwnerPointer
• ExSetResourceOwnerPointerEx
• ExSetTimerResolution
• ExSizeOfRundownProtectionCacheAware
• ExSubscribeWnfStateChange
• ExSystemExceptionFilter
• ExSystemTimeToLocalTime
• ExTimedWaitForUnblockPushLock
• ExTryConvertSharedSpinLockExclusive
• ExTryQueueWorkItem
• ExTryToAcquireFastMutex
• ExUnregisterAttributeInformationCallback
• ExUnregisterCallback
• ExUnregisterExtension
• ExUnsubscribeWnfStateChange
• ExUuidCreate
• ExVerifySuite
• ExWaitForRundownProtectionRelease
• ExWaitForRundownProtectionReleaseCacheAware
• ExWaitForUnblockPushLock
• ExWindowStationObjectType
• ExfAcquirePushLockExclusive
• ExfAcquirePushLockShared
• ExfReleasePushLock
• ExfReleasePushLockExclusive
• ExfReleasePushLockShared
• ExfTryAcquirePushLockShared
• ExfTryToWakePushLock
• ExfUnblockPushLock
• ExpInterlockedFlushSList
• ExpInterlockedPopEntrySList
• ExpInterlockedPushEntrySList
• FirstEntrySList
• FsRtlAcknowledgeEcp
• FsRtlAcquireEofLock
• FsRtlAcquireFileExclusive
• FsRtlAcquireHeaderMutex
• FsRtlAddBaseMcbEntry
• FsRtlAddBaseMcbEntryEx
• FsRtlAddLargeMcbEntry
• FsRtlAddMcbEntry
• FsRtlAddToTunnelCache
• FsRtlAllocateExtraCreateParameter
• FsRtlAllocateExtraCreateParameterFromLookasideList
• FsRtlAllocateExtraCreateParameterList
• FsRtlAllocateFileLock
• FsRtlAllocatePool
• FsRtlAllocatePoolWithQuota
• FsRtlAllocatePoolWithQuotaTag
• FsRtlAllocatePoolWithTag
• FsRtlAllocateResource
• FsRtlAreNamesEqual
• FsRtlAreThereCurrentOrInProgressFileLocks
• FsRtlAreThereWaitingFileLocks
• FsRtlAreVolumeStartupApplicationsComplete
• FsRtlBalanceReads
• FsRtlCancellableWaitForMultipleObjects
• FsRtlCancellableWaitForSingleObject
• FsRtlChangeBackingFileObject
• FsRtlCheckLockForOplockRequest
• FsRtlCheckLockForReadAccess
• FsRtlCheckLockForWriteAccess
• FsRtlCheckOplock
• FsRtlCheckOplockEx
• FsRtlCopyRead
• FsRtlCopyWrite
• FsRtlCreateSectionForDataScan
• FsRtlCurrentBatchOplock
• FsRtlCurrentOplock
• FsRtlCurrentOplockH
• FsRtlDeleteExtraCreateParameterLookasideList
• FsRtlDeleteKeyFromTunnelCache
• FsRtlDeleteTunnelCache
• FsRtlDeregisterUncProvider
• FsRtlDismountComplete
• FsRtlDissectDbcs
• FsRtlDissectName
• FsRtlDoesDbcsContainWildCards
• FsRtlDoesNameContainWildCards
• FsRtlFastCheckLockForRead
• FsRtlFastCheckLockForWrite
• FsRtlFastUnlockAll
• FsRtlFastUnlockAllByKey
• FsRtlFastUnlockSingle
• FsRtlFindExtraCreateParameter
• FsRtlFindInTunnelCache
• FsRtlFreeExtraCreateParameter
• FsRtlFreeExtraCreateParameterList
• FsRtlFreeFileLock
• FsRtlGetEcpListFromIrp
• FsRtlGetFileNameInformation
• FsRtlGetFileSize
• FsRtlGetIoAtEof
• FsRtlGetNextBaseMcbEntry
• FsRtlGetNextExtraCreateParameter
• FsRtlGetNextFileLock
• FsRtlGetNextLargeMcbEntry
• FsRtlGetNextMcbEntry
• FsRtlGetSectorSizeInformation
• FsRtlGetSupportedFeatures
• FsRtlGetVirtualDiskNestingLevel
• FsRtlIncrementCcFastMdlReadWait
• FsRtlIncrementCcFastReadNoWait
• FsRtlIncrementCcFastReadNotPossible
• FsRtlIncrementCcFastReadResourceMiss
• FsRtlIncrementCcFastReadWait
• FsRtlInitExtraCreateParameterLookasideList
• FsRtlInitializeBaseMcb
• FsRtlInitializeBaseMcbEx
• FsRtlInitializeEofLock
• FsRtlInitializeExtraCreateParameter
• FsRtlInitializeExtraCreateParameterList
• FsRtlInitializeFileLock
• FsRtlInitializeLargeMcb
• FsRtlInitializeMcb
• FsRtlInitializeOplock
• FsRtlInitializeTunnelCache
• FsRtlInsertExtraCreateParameter
• FsRtlInsertPerFileContext
• FsRtlInsertPerFileObjectContext
• FsRtlInsertPerStreamContext
• FsRtlIsDbcsInExpression
• FsRtlIsEcpAcknowledged
• FsRtlIsEcpFromUserMode
• FsRtlIsFatDbcsLegal
• FsRtlIsHpfsDbcsLegal
• FsRtlIsNameInExpression
• FsRtlIsNtstatusExpected
• FsRtlIsPagingFile
• FsRtlIsSystemPagingFile
• FsRtlIsTotalDeviceFailure
• FsRtlIssueDeviceIoControl
• FsRtlKernelFsControlFile
• FsRtlLegalAnsiCharacterArray
• FsRtlLogCcFlushError
• FsRtlLookupBaseMcbEntry
• FsRtlLookupLargeMcbEntry
• FsRtlLookupLastBaseMcbEntry
• FsRtlLookupLastBaseMcbEntryAndIndex
• FsRtlLookupLastLargeMcbEntry
• FsRtlLookupLastLargeMcbEntryAndIndex
• FsRtlLookupLastMcbEntry
• FsRtlLookupMcbEntry
• FsRtlLookupPerFileContext
• FsRtlLookupPerFileObjectContext
• FsRtlLookupPerStreamContextInternal
• FsRtlMdlRead
• FsRtlMdlReadComplete
• FsRtlMdlReadCompleteDev
• FsRtlMdlReadDev
• FsRtlMdlReadEx
• FsRtlMdlWriteComplete
• FsRtlMdlWriteCompleteDev
• FsRtlMupGetProviderIdFromName
• FsRtlMupGetProviderInfoFromFileObject
• FsRtlNormalizeNtstatus
• FsRtlNotifyChangeDirectory
• FsRtlNotifyCleanup
• FsRtlNotifyCleanupAll
• FsRtlNotifyFilterChangeDirectory
• FsRtlNotifyFilterReportChange
• FsRtlNotifyFullChangeDirectory
• FsRtlNotifyFullReportChange
• FsRtlNotifyInitializeSync
• FsRtlNotifyReportChange
• FsRtlNotifyUninitializeSync
• FsRtlNotifyVolumeEvent
• FsRtlNotifyVolumeEventEx
• FsRtlNumberOfRunsInBaseMcb
• FsRtlNumberOfRunsInLargeMcb
• FsRtlNumberOfRunsInMcb
• FsRtlOplockBreakH
• FsRtlOplockBreakToNone
• FsRtlOplockBreakToNoneEx
• FsRtlOplockFsctrl
• FsRtlOplockFsctrlEx
• FsRtlOplockIsFastIoPossible
• FsRtlOplockIsSharedRequest
• FsRtlOplockKeysEqual
• FsRtlPostPagingFileStackOverflow
• FsRtlPostStackOverflow
• FsRtlPrepareMdlWrite
• FsRtlPrepareMdlWriteDev
• FsRtlPrepareMdlWriteEx
• FsRtlPrepareToReuseEcp
• FsRtlPrivateLock
• FsRtlProcessFileLock
• FsRtlQueryCachedVdl
• FsRtlQueryKernelEaFile
• FsRtlQueryMaximumVirtualDiskNestingLevel
• FsRtlRegisterFileSystemFilterCallbacks
• FsRtlRegisterFltMgrCalls
• FsRtlRegisterMupCalls
• FsRtlRegisterUncProvider
• FsRtlRegisterUncProviderEx
• FsRtlReleaseEofLock
• FsRtlReleaseFile
• FsRtlReleaseFileNameInformation
• FsRtlReleaseHeaderMutex
• FsRtlRemoveBaseMcbEntry
• FsRtlRemoveDotsFromPath
• FsRtlRemoveExtraCreateParameter
• FsRtlRemoveLargeMcbEntry
• FsRtlRemoveMcbEntry
• FsRtlRemovePerFileContext
• FsRtlRemovePerFileObjectContext
• FsRtlRemovePerStreamContext
• FsRtlResetBaseMcb
• FsRtlResetLargeMcb
• FsRtlSetEcpListIntoIrp
• FsRtlSetKernelEaFile
• FsRtlSplitBaseMcb
• FsRtlSplitLargeMcb
• FsRtlSyncVolumes
• FsRtlTeardownPerFileContexts
• FsRtlTeardownPerStreamContexts
• FsRtlTruncateBaseMcb
• FsRtlTruncateLargeMcb
• FsRtlTruncateMcb
• FsRtlTryToAcquireHeaderMutex
• FsRtlUninitializeBaseMcb
• FsRtlUninitializeFileLock
• FsRtlUninitializeLargeMcb
• FsRtlUninitializeMcb
• FsRtlUninitializeOplock
• FsRtlUpdateDiskCounters
• FsRtlValidateReparsePointBuffer
• HalDispatchTable
• HalExamineMBR
• HalPrivateDispatchTable
• HeadlessDispatch
• HvlGetLpIndexFromApicId
• HvlPerformEndOfInterrupt
• HvlQueryActiveHypervisorProcessorCount
• HvlQueryActiveProcessors
• HvlQueryConnection
• HvlQueryHypervisorProcessorNodeNumber
• HvlQueryProcessorTopology
• HvlQueryProcessorTopologyCount
• HvlQueryProcessorTopologyHighestId
• HvlRegisterInterruptCallback
• HvlRegisterWheaErrorNotification
• HvlUnregisterInterruptCallback
• HvlUnregisterWheaErrorNotification
• InbvAcquireDisplayOwnership
• InbvCheckDisplayOwnership
• InbvDisplayString
• InbvEnableBootDriver
• InbvEnableDisplayString
• InbvInstallDisplayStringFilter
• InbvIsBootDriverInstalled
• InbvNotifyDisplayOwnershipChange
• InbvNotifyDisplayOwnershipLost
• InbvResetDisplay
• InbvSetScrollRegion
• InbvSetTextColor
• InbvSolidColorFill
• InitSafeBootMode
• InitializeSListHead
• IoAcquireCancelSpinLock
• IoAcquireRemoveLockEx
• IoAcquireVpbSpinLock
• IoAdapterObjectType
• IoAdjustStackSizeForRedirection
• IoAllocateAdapterChannel
• IoAllocateController
• IoAllocateDriverObjectExtension
• IoAllocateErrorLogEntry
• IoAllocateIrp
• IoAllocateMdl
• IoAllocateMiniCompletionPacket
• IoAllocateSfioStreamIdentifier
• IoAllocateWorkItem
• IoApplyPriorityInfoThread
• IoAssignResources
• IoAttachDevice
• IoAttachDeviceByPointer
• IoAttachDeviceToDeviceStack
• IoAttachDeviceToDeviceStackSafe
• IoBoostThreadIo
• IoBuildAsynchronousFsdRequest
• IoBuildDeviceIoControlRequest
• IoBuildPartialMdl
• IoBuildSynchronousFsdRequest
• IoCallDriver
• IoCancelFileOpen
• IoCancelIrp
• IoCheckDesiredAccess
• IoCheckEaBufferValidity
• IoCheckFunctionAccess
• IoCheckQuerySetFileInformation
• IoCheckQuerySetVolumeInformation
• IoCheckQuotaBufferValidity
• IoCheckShareAccess
• IoCheckShareAccessEx
• IoClearActivityIdThread
• IoClearDependency
• IoClearIrpExtraCreateParameter
• IoClearReservedDependency
• IoCompleteRequest
• IoCompletionObjectType
• IoConnectInterrupt
• IoConnectInterruptEx
• IoCopyDeviceObjectHint
• IoCreateArcName
• IoCreateController
• IoCreateDevice
• IoCreateDisk
• IoCreateDriver
• IoCreateFile
• IoCreateFileEx
• IoCreateFileSpecifyDeviceObjectHint
• IoCreateNotificationEvent
• IoCreateStreamFileObject
• IoCreateStreamFileObjectEx
• IoCreateStreamFileObjectEx2
• IoCreateStreamFileObjectLite
• IoCreateSymbolicLink
• IoCreateSynchronizationEvent
• IoCreateSystemThread
• IoCreateUnprotectedSymbolicLink
• IoCsqInitialize
• IoCsqInitializeEx
• IoCsqInsertIrp
• IoCsqInsertIrpEx
• IoCsqRemoveIrp
• IoCsqRemoveNextIrp
• IoDecrementKeepAliveCount
• IoDeleteAllDependencyRelations
• IoDeleteController
• IoDeleteDevice
• IoDeleteDriver
• IoDeleteSymbolicLink
• IoDetachDevice
• IoDeviceHandlerObjectSize
• IoDeviceHandlerObjectType
• IoDeviceObjectType
• IoDisconnectInterrupt
• IoDisconnectInterruptEx
• IoDriverObjectType
• IoDuplicateDependency
• IoEnqueueIrp
• IoEnumerateDeviceObjectList
• IoEnumerateRegisteredFiltersList
• IoFastQueryNetworkAttributes
• IoFileObjectType
• IoForwardAndCatchIrp
• IoForwardIrpSynchronously
• IoFreeController
• IoFreeErrorLogEntry
• IoFreeIrp
• IoFreeMdl
• IoFreeMiniCompletionPacket
• IoFreeSfioStreamIdentifier
• IoFreeWorkItem
• IoGetActivityIdIrp
• IoGetActivityIdThread
• IoGetAffinityInterrupt
• IoGetAttachedDevice
• IoGetAttachedDeviceReference
• IoGetBaseFileSystemDeviceObject
• IoGetBootDiskInformation
• IoGetBootDiskInformationLite
• IoGetConfigurationInformation
• IoGetContainerInformation
• IoGetCurrentProcess
• IoGetDeviceAttachmentBaseRef
• IoGetDeviceInterfaceAlias
• IoGetDeviceInterfacePropertyData
• IoGetDeviceInterfaces
• IoGetDeviceNumaNode
• IoGetDeviceObjectPointer
• IoGetDeviceProperty
• IoGetDevicePropertyData
• IoGetDeviceToVerify
• IoGetDiskDeviceObject
• IoGetDmaAdapter
• IoGetDriverObjectExtension
• IoGetFileObjectGenericMapping
• IoGetInitialStack
• IoGetInitiatorProcess
• IoGetIoPriorityHint
• IoGetIrpExtraCreateParameter
• IoGetLowerDeviceObject
• IoGetOplockKeyContext
• IoGetOplockKeyContextEx
• IoGetPagingIoPriority
• IoGetRelatedDeviceObject
• IoGetRequestorProcess
• IoGetRequestorProcessId
• IoGetRequestorSessionId
• IoGetSfioStreamIdentifier
• IoGetStackLimits
• IoGetSymlinkSupportInformation
• IoGetTopLevelIrp
• IoGetTransactionParameterBlock
• IoIncrementKeepAliveCount
• IoInitializeIrp
• IoInitializeMiniCompletionPacket
• IoInitializeRemoveLockEx
• IoInitializeTimer
• IoInitializeWorkItem
• IoInvalidateDeviceRelations
• IoInvalidateDeviceState
• IoIs32bitProcess
• IoIsActivityTracingEnabled
• IoIsFileObjectIgnoringSharing
• IoIsFileOriginRemote
• IoIsInitiator32bitProcess
• IoIsOperationSynchronous
• IoIsSystemThread
• IoIsValidIrpStatus
• IoIsValidNameGraftingBuffer
• IoIsWdmVersionAvailable
• IoMakeAssociatedIrp
• IoOpenDeviceInterfaceRegistryKey
• IoOpenDeviceRegistryKey
• IoPageRead
• IoPropagateActivityIdToThread
• IoQueryDeviceDescription
• IoQueryFileDosDeviceName
• IoQueryFileInformation
• IoQueryVolumeInformation
• IoQueueThreadIrp
• IoQueueWorkItem
• IoQueueWorkItemEx
• IoQueueWorkItemToNode
• IoRaiseHardError
• IoRaiseInformationalHardError
• IoReadDiskSignature
• IoReadOperationCount
• IoReadPartitionTable
• IoReadPartitionTableEx
• IoReadTransferCount
• IoRegisterBootDriverCallback
• IoRegisterBootDriverReinitialization
• IoRegisterContainerNotification
• IoRegisterDeviceInterface
• IoRegisterDriverReinitialization
• IoRegisterFileSystem
• IoRegisterFsRegistrationChange
• IoRegisterFsRegistrationChangeMountAware
• IoRegisterIoTracking
• IoRegisterLastChanceShutdownNotification
• IoRegisterPlugPlayNotification
• IoRegisterPriorityCallback
• IoRegisterShutdownNotification
• IoReleaseCancelSpinLock
• IoReleaseRemoveLockAndWaitEx
• IoReleaseRemoveLockEx
• IoReleaseVpbSpinLock
• IoRemoveShareAccess
• IoReplaceFileObjectName
• IoReplacePartitionUnit
• IoReportDetectedDevice
• IoReportHalResourceUsage
• IoReportInterruptActive
• IoReportInterruptInactive
• IoReportResourceForDetection
• IoReportResourceUsage
• IoReportRootDevice
• IoReportTargetDeviceChange
• IoReportTargetDeviceChangeAsynchronous
• IoRequestDeviceEject
• IoRequestDeviceEjectEx
• IoReserveDependency
• IoResolveDependency
• IoRetrievePriorityInfo
• IoReuseIrp
• IoSetActivityIdIrp
• IoSetActivityIdThread
• IoSetCompletionRoutineEx
• IoSetDependency
• IoSetDeviceInterfacePropertyData
• IoSetDeviceInterfaceState
• IoSetDevicePropertyData
• IoSetDeviceToVerify
• IoSetFileObjectIgnoreSharing
• IoSetFileOrigin
• IoSetHardErrorOrVerifyDevice
• IoSetInformation
• IoSetIoCompletion
• IoSetIoCompletionEx
• IoSetIoPriorityHint
• IoSetIoPriorityHintIntoFileObject
• IoSetIoPriorityHintIntoThread
• IoSetIrpExtraCreateParameter
• IoSetMasterIrpStatus
• IoSetPartitionInformation
• IoSetPartitionInformationEx
• IoSetShareAccess
• IoSetShareAccessEx
• IoSetStartIoAttributes
• IoSetSystemPartition
• IoSetThreadHardErrorMode
• IoSetTopLevelIrp
• IoSizeofWorkItem
• IoStartNextPacket
• IoStartNextPacketByKey
• IoStartPacket
• IoStartTimer
• IoStatisticsLock
• IoStopTimer
• IoSynchronousCallDriver
• IoSynchronousInvalidateDeviceRelations
• IoSynchronousPageWrite
• IoThreadToProcess
• IoTransferActivityId
• IoTranslateBusAddress
• IoTryQueueWorkItem
• IoUninitializeWorkItem
• IoUnregisterBootDriverCallback
• IoUnregisterContainerNotification
• IoUnregisterFileSystem
• IoUnregisterFsRegistrationChange
• IoUnregisterIoTracking
• IoUnregisterPlugPlayNotification
• IoUnregisterPlugPlayNotificationEx
• IoUnregisterPriorityCallback
• IoUnregisterShutdownNotification
• IoUpdateShareAccess
• IoValidateDeviceIoControlAccess
• IoVerifyPartitionTable
• IoVerifyVolume
• IoVolumeDeviceToDosName
• IoVolumeDeviceToGuid
• IoVolumeDeviceToGuidPath
• IoWMIAllocateInstanceIds
• IoWMIDeviceObjectToInstanceName
• IoWMIDeviceObjectToProviderId
• IoWMIExecuteMethod
• IoWMIHandleToInstanceName
• IoWMIOpenBlock
• IoWMIQueryAllData
• IoWMIQueryAllDataMultiple
• IoWMIQuerySingleInstance
• IoWMIQuerySingleInstanceMultiple
• IoWMIRegistrationControl
• IoWMISetNotificationCallback
• IoWMISetSingleInstance
• IoWMISetSingleItem
• IoWMISuggestInstanceName
• IoWMIWriteEvent
• IoWithinStackLimits
• IoWriteErrorLogEntry
• IoWriteOperationCount
• IoWritePartitionTable
• IoWritePartitionTableEx
• IoWriteTransferCount
• IofCallDriver
• IofCompleteRequest
• KdChangeOption
• KdDebuggerEnabled
• KdDebuggerNotPresent
• KdDisableDebugger
• KdEnableDebugger
• KdEnteredDebugger
• KdLogDbgPrint
• KdPollBreakIn
• KdPowerTransition
• KdRefreshDebuggerNotPresent
• KdSystemDebugControl
• KeAcquireGuardedMutex
• KeAcquireGuardedMutexUnsafe
• KeAcquireInStackQueuedSpinLock
• KeAcquireInStackQueuedSpinLockAtDpcLevel
• KeAcquireInStackQueuedSpinLockForDpc
• KeAcquireInStackQueuedSpinLockRaiseToSynch
• KeAcquireInterruptSpinLock
• KeAcquireQueuedSpinLock
• KeAcquireQueuedSpinLockRaiseToSynch
• KeAcquireSpinLockAtDpcLevel
• KeAcquireSpinLockForDpc
• KeAcquireSpinLockRaiseToDpc
• KeAcquireSpinLockRaiseToSynch
• KeAddGroupAffinityEx
• KeAddProcessorAffinityEx
• KeAddProcessorGroupAffinity
• KeAddSystemServiceTable
• KeAlertThread
• KeAllocateCalloutStack
• KeAllocateCalloutStackEx
• KeAndAffinityEx
• KeAndGroupAffinityEx
• KeAreAllApcsDisabled
• KeAreApcsDisabled
• KeAttachProcess
• KeBugCheck
• KeBugCheckEx
• KeCancelTimer
• KeCapturePersistentThreadState
• KeCheckProcessorAffinityEx
• KeCheckProcessorGroupAffinity
• KeClearEvent
• KeComplementAffinityEx
• KeCopyAffinityEx
• KeCountSetBitsAffinityEx
• KeCountSetBitsGroupAffinity
• KeDelayExecutionThread
• KeDeregisterBugCheckCallback
• KeDeregisterBugCheckReasonCallback
• KeDeregisterNmiCallback
• KeDeregisterProcessorChangeCallback
• KeDetachProcess
• KeDispatchSecondaryInterrupt
• KeEnterCriticalRegion
• KeEnterGuardedRegion
• KeEnterKernelDebugger
• KeEnumerateNextProcessor
• KeExpandKernelStackAndCallout
• KeExpandKernelStackAndCalloutEx
• KeFindConfigurationEntry
• KeFindConfigurationNextEntry
• KeFindFirstSetLeftAffinityEx
• KeFindFirstSetLeftGroupAffinity
• KeFindFirstSetRightGroupAffinity
• KeFirstGroupAffinityEx
• KeFlushEntireTb
• KeFlushQueuedDpcs
• KeForceEnableNx
• KeFreeCalloutStack
• KeGenericCallDpc
• KeGetCurrentIrql
• KeGetCurrentNodeNumber
• KeGetCurrentProcessorNumberEx
• KeGetCurrentThread
• KeGetNextTimerExpirationDueTime
• KeGetProcessorIndexFromNumber
• KeGetProcessorNumberFromIndex
• KeGetRecommendedSharedDataAlignment
• KeGetXSaveFeatureFlags
• KeHwPolicyLocateResource
• KeInitializeAffinityEx
• KeInitializeApc
• KeInitializeCrashDumpHeader
• KeInitializeDeviceQueue
• KeInitializeDpc
• KeInitializeEnumerationContext
• KeInitializeEnumerationContextFromGroup
• KeInitializeEvent
• KeInitializeGuardedMutex
• KeInitializeInterrupt
• KeInitializeMutant
• KeInitializeMutex
• KeInitializeQueue
• KeInitializeSecondaryInterruptServices
• KeInitializeSemaphore
• KeInitializeSpinLock
• KeInitializeThreadedDpc
• KeInitializeTimer
• KeInitializeTimerEx
• KeInsertByKeyDeviceQueue
• KeInsertDeviceQueue
• KeInsertHeadQueue
• KeInsertQueue
• KeInsertQueueApc
• KeInsertQueueDpc
• KeInterlockedClearProcessorAffinityEx
• KeInterlockedSetProcessorAffinityEx
• KeInvalidateAllCaches
• KeInvalidateRangeAllCaches
• KeIpiGenericCall
• KeIsAttachedProcess
• KeIsEmptyAffinityEx
• KeIsEqualAffinityEx
• KeIsExecutingDpc
• KeIsSingleGroupAffinityEx
• KeIsSubsetAffinityEx
• KeIsWaitListEmpty
• KeLastBranchMSR
• KeLeaveCriticalRegion
• KeLeaveGuardedRegion
• KeLoadMTRR
• KeLoaderBlock
• KeLowerIrql
• KeNumberProcessors
• KeOrAffinityEx
• KeProcessorGroupAffinity
• KeProfileInterruptWithSource
• KePulseEvent
• KeQueryActiveGroupCount
• KeQueryActiveProcessorAffinity
• KeQueryActiveProcessorCount
• KeQueryActiveProcessorCountEx
• KeQueryActiveProcessors
• KeQueryDpcWatchdogInformation
• KeQueryEffectivePriorityThread
• KeQueryGroupAffinity
• KeQueryGroupAffinityEx
• KeQueryHardwareCounterConfiguration
• KeQueryHighestNodeNumber
• KeQueryInterruptTimePrecise
• KeQueryLogicalProcessorRelationship
• KeQueryMaximumGroupCount
• KeQueryMaximumProcessorCount
• KeQueryMaximumProcessorCountEx
• KeQueryNodeActiveAffinity
• KeQueryNodeMaximumProcessorCount
• KeQueryPrcbAddress
• KeQueryPriorityThread
• KeQueryRuntimeThread
• KeQuerySystemTimePrecise
• KeQueryTimeIncrement
• KeQueryTotalCycleTimeThread
• KeQueryUnbiasedInterruptTime
• KeRaiseIrqlToDpcLevel
• KeRaiseUserException
• KeReadStateEvent
• KeReadStateMutant
• KeReadStateMutex
• KeReadStateQueue
• KeReadStateSemaphore
• KeReadStateTimer
• KeRegisterBugCheckCallback
• KeRegisterBugCheckReasonCallback
• KeRegisterNmiCallback
• KeRegisterProcessorChangeCallback
• KeReleaseGuardedMutex
• KeReleaseGuardedMutexUnsafe
• KeReleaseInStackQueuedSpinLock
• KeReleaseInStackQueuedSpinLockForDpc
• KeReleaseInStackQueuedSpinLockFromDpcLevel
• KeReleaseInterruptSpinLock
• KeReleaseMutant
• KeReleaseMutex
• KeReleaseQueuedSpinLock
• KeReleaseSemaphore
• KeReleaseSpinLock
• KeReleaseSpinLockForDpc
• KeReleaseSpinLockFromDpcLevel
• KeRemoveByKeyDeviceQueue
• KeRemoveByKeyDeviceQueueIfBusy
• KeRemoveDeviceQueue
• KeRemoveEntryDeviceQueue
• KeRemoveGroupAffinityEx
• KeRemoveProcessorAffinityEx
• KeRemoveProcessorGroupAffinity
• KeRemoveQueue
• KeRemoveQueueDpc
• KeRemoveQueueEx
• KeRemoveSystemServiceTable
• KeResetEvent
• KeRestoreExtendedProcessorState
• KeRestoreFloatingPointState
• KeRevertToUserAffinityThread
• KeRevertToUserAffinityThreadEx
• KeRevertToUserGroupAffinityThread
• KeRundownQueue
• KeSaveExtendedProcessorState
• KeSaveFloatingPointState
• KeSaveStateForHibernate
• KeSetActualBasePriorityThread
• KeSetAffinityThread
• KeSetBasePriorityThread
• KeSetCoalescableTimer
• KeSetDmaIoCoherency
• KeSetEvent
• KeSetEventBoostPriority
• KeSetHardwareCounterConfiguration
• KeSetIdealProcessorThread
• KeSetImportanceDpc
• KeSetKernelStackSwapEnable
• KeSetPriorityThread
• KeSetProfileIrql
• KeSetSystemAffinityThread
• KeSetSystemAffinityThreadEx
• KeSetSystemGroupAffinityThread
• KeSetTargetProcessorDpc
• KeSetTargetProcessorDpcEx
• KeSetTimeIncrement
• KeSetTimer
• KeSetTimerEx
• KeSignalCallDpcDone
• KeSignalCallDpcSynchronize
• KeStackAttachProcess
• KeStallWhileFrozen
• KeStartDynamicProcessor
• KeSubtractAffinityEx
• KeSweepLocalCaches
• KeSynchronizeExecution
• KeTestAlertThread
• KeTestSpinLock
• KeTryToAcquireGuardedMutex
• KeTryToAcquireQueuedSpinLock
• KeTryToAcquireQueuedSpinLockRaiseToSynch
• KeTryToAcquireSpinLockAtDpcLevel
• KeUnstackDetachProcess
• KeUpdateRunTime
• KeUpdateTime
• KeUpdateTimeAssist
• KeUserModeCallback
• KeWaitForMultipleObjects
• KeWaitForMutexObject
• KeWaitForSingleObject
• KeWriteProtectPAT
• KfRaiseIrql
• KiBugCheckData
• KiCheckForKernelApcDelivery
• KiCpuId
• KseQueryDeviceData
• KseQueryDeviceDataList
• KseQueryDeviceFlags
• KseRegisterShim
• KseRegisterShimEx
• KseSetDeviceFlags
• KseUnregisterShim
• LdrAccessResource
• LdrEnumResources
• LdrFindResourceDirectory_U
• LdrFindResourceEx_U
• LdrFindResource_U
• LdrResFindResource
• LdrResFindResourceDirectory
• LdrResSearchResource
• LpcPortObjectType
• LpcReplyWaitReplyPort
• LpcRequestPort
• LpcRequestWaitReplyPort
• LpcRequestWaitReplyPortEx
• LpcSendWaitReceivePort
• LsaCallAuthenticationPackage
• LsaDeregisterLogonProcess
• LsaFreeReturnBuffer
• LsaLogonUser
• LsaLookupAuthenticationPackage
• LsaRegisterLogonProcess
• Mm64BitPhysicalAddress
• MmAddPhysicalMemory
• MmAddVerifierThunks
• MmAdjustWorkingSetSize
• MmAdvanceMdl
• MmAllocateContiguousMemory
• MmAllocateContiguousMemorySpecifyCache
• MmAllocateContiguousMemorySpecifyCacheNode
• MmAllocateContiguousNodeMemory
• MmAllocateMappingAddress
• MmAllocateMdlForIoSpace
• MmAllocateNodePagesForMdlEx
• MmAllocateNonCachedMemory
• MmAllocatePagesForMdl
• MmAllocatePagesForMdlEx
• MmAreMdlPagesCached
• MmBadPointer
• MmBuildMdlForNonPagedPool
• MmCanFileBeTruncated
• MmCommitSessionMappedView
• MmCopyVirtualMemory
• MmCreateMdl
• MmCreateMirror
• MmCreateSection
• MmDisableModifiedWriteOfSection
• MmDoesFileHaveUserWritableReferences
• MmFlushImageSection
• MmForceSectionClosed
• MmFreeContiguousMemory
• MmFreeContiguousMemorySpecifyCache
• MmFreeMappingAddress
• MmFreeNonCachedMemory
• MmFreePagesFromMdl
• MmGetMaximumFileSectionSize
• MmGetPhysicalAddress
• MmGetPhysicalMemoryRanges
• MmGetSystemRoutineAddress
• MmGetVirtualForPhysical
• MmGrowKernelStack
• MmHighestUserAddress
• MmIsAddressValid
• MmIsDriverSuspectForVerifier
• MmIsDriverVerifying
• MmIsDriverVerifyingByAddress
• MmIsIoSpaceActive
• MmIsNonPagedSystemAddressValid
• MmIsRecursiveIoFault
• MmIsThisAnNtAsSystem
• MmIsVerifierEnabled
• MmLockPagableDataSection
• MmLockPagableImageSection
• MmLockPagableSectionByHandle
• MmMapIoSpace
• MmMapLockedPages
• MmMapLockedPagesSpecifyCache
• MmMapLockedPagesWithReservedMapping
• MmMapMemoryDumpMdl
• MmMapUserAddressesToPage
• MmMapVideoDisplay
• MmMapViewInSessionSpace
• MmMapViewInSessionSpaceEx
• MmMapViewInSystemSpace
• MmMapViewInSystemSpaceEx
• MmMapViewOfSection
• MmMarkPhysicalMemoryAsBad
• MmMarkPhysicalMemoryAsGood
• MmMdlPageContentsState
• MmPageEntireDriver
• MmPrefetchPages
• MmPrefetchVirtualAddresses
• MmProbeAndLockPages
• MmProbeAndLockProcessPages
• MmProbeAndLockSelectedPages
• MmProtectMdlSystemAddress
• MmQuerySystemSize
• MmRemovePhysicalMemory
• MmResetDriverPaging
• MmRotatePhysicalView
• MmSectionObjectType
• MmSecureVirtualMemory
• MmSetAddressRangeModified
• MmSetBankedSection
• MmSizeOfMdl
• MmSystemRangeStart
• MmTrimAllSystemPagableMemory
• MmUnlockPagableImageSection
• MmUnlockPages
• MmUnmapIoSpace
• MmUnmapLockedPages
• MmUnmapReservedMapping
• MmUnmapVideoDisplay
• MmUnmapViewInSessionSpace
• MmUnmapViewInSystemSpace
• MmUnmapViewOfSection
• MmUnsecureVirtualMemory
• MmUserProbeAddress
• NlsAnsiCodePage
• NlsLeadByteInfo
• NlsMbCodePageTag
• NlsMbOemCodePageTag
• NlsOemCodePage
• NlsOemLeadByteInfo
• NtAddAtom
• NtAdjustPrivilegesToken
• NtAllocateLocallyUniqueId
• NtAllocateUuids
• NtAllocateVirtualMemory
• NtBuildGUID
• NtBuildLab
• NtBuildNumber
• NtClose
• NtCommitComplete
• NtCommitEnlistment
• NtCommitTransaction
• NtConnectPort
• NtCreateEnlistment
• NtCreateEvent
• NtCreateFile
• NtCreateResourceManager
• NtCreateSection
• NtCreateTransaction
• NtCreateTransactionManager
• NtDeleteAtom
• NtDeleteFile
• NtDeviceIoControlFile
• NtDuplicateObject
• NtDuplicateToken
• NtEnumerateTransactionObject
• NtFindAtom
• NtFreeVirtualMemory
• NtFreezeTransactions
• NtFsControlFile
• NtGetEnvironmentVariableEx
• NtGetNotificationResourceManager
• NtGlobalFlag
• NtLockFile
• NtMakePermanentObject
• NtMapViewOfSection
• NtNotifyChangeDirectoryFile
• NtOpenEnlistment
• NtOpenFile
• NtOpenProcess
• NtOpenProcessToken
• NtOpenProcessTokenEx
• NtOpenResourceManager
• NtOpenThread
• NtOpenThreadToken
• NtOpenThreadTokenEx
• NtOpenTransaction
• NtOpenTransactionManager
• NtPrePrepareComplete
• NtPrePrepareEnlistment
• NtPrepareComplete
• NtPrepareEnlistment
• NtPropagationComplete
• NtPropagationFailed
• NtQueryDirectoryFile
• NtQueryEaFile
• NtQueryEnvironmentVariableInfoEx
• NtQueryInformationAtom
• NtQueryInformationEnlistment
• NtQueryInformationFile
• NtQueryInformationProcess
• NtQueryInformationResourceManager
• NtQueryInformationThread
• NtQueryInformationToken
• NtQueryInformationTransaction
• NtQueryInformationTransactionManager
• NtQueryQuotaInformationFile
• NtQuerySecurityAttributesToken
• NtQuerySecurityObject
• NtQuerySystemInformation
• NtQuerySystemInformationEx
• NtQueryVolumeInformationFile
• NtReadFile
• NtReadOnlyEnlistment
• NtRecoverEnlistment
• NtRecoverResourceManager
• NtRecoverTransactionManager
• NtRequestPort
• NtRequestWaitReplyPort
• NtRollbackComplete
• NtRollbackEnlistment
• NtRollbackTransaction
• NtSetCachedSigningLevel
• NtSetEaFile
• NtSetEvent
• NtSetInformationEnlistment
• NtSetInformationFile
• NtSetInformationProcess
• NtSetInformationResourceManager
• NtSetInformationThread
• NtSetInformationToken
• NtSetInformationTransaction
• NtSetInformationVirtualMemory
• NtSetQuotaInformationFile
• NtSetSecurityObject
• NtSetVolumeInformationFile
• NtShutdownSystem
• NtThawTransactions
• NtTraceControl
• NtTraceEvent
• NtUnlockFile
• NtVdmControl
• NtWaitForSingleObject
• NtWriteFile
• ObAssignSecurity
• ObCheckCreateObjectAccess
• ObCheckObjectAccess
• ObCloseHandle
• ObCreateObject
• ObCreateObjectType
• ObDeleteCapturedInsertInfo
• ObDereferenceObject
• ObDereferenceObjectDeferDelete
• ObDereferenceObjectDeferDeleteWithTag
• ObDereferenceSecurityDescriptor
• ObDuplicateObject
• ObFindHandleForObject
• ObGetFilterVersion
• ObGetObjectSecurity
• ObGetObjectType
• ObInsertObject
• ObIsDosDeviceLocallyMapped
• ObIsKernelHandle
• ObLogSecurityDescriptor
• ObMakeTemporaryObject
• ObOpenObjectByName
• ObOpenObjectByPointer
• ObOpenObjectByPointerWithTag
• ObQueryNameInfo
• ObQueryNameString
• ObQueryObjectAuditingByHandle
• ObReferenceObjectByHandle
• ObReferenceObjectByHandleWithTag
• ObReferenceObjectByName
• ObReferenceObjectByPointer
• ObReferenceObjectByPointerWithTag
• ObReferenceObjectSafe
• ObReferenceObjectSafeWithTag
• ObReferenceSecurityDescriptor
• ObRegisterCallbacks
• ObReleaseObjectSecurity
• ObSetHandleAttributes
• ObSetSecurityDescriptorInfo
• ObSetSecurityObjectByPointer
• ObUnRegisterCallbacks
• ObWaitForMultipleObjects
• ObWaitForSingleObject
• ObfDereferenceObject
• ObfDereferenceObjectWithTag
• ObfReferenceObject
• ObfReferenceObjectWithTag
• POGOBuffer
• PcwAddInstance
• PcwCloseInstance
• PcwCreateInstance
• PcwRegister
• PcwUnregister
• PfFileInfoNotify
• PfxFindPrefix
• PfxInitialize
• PfxInsertPrefix
• PfxRemovePrefix
• PoAllProcessorsDeepIdle
• PoCallDriver
• PoCancelDeviceNotify
• PoClearPowerRequest
• PoCreatePowerRequest
• PoDeletePowerRequest
• PoDisableSleepStates
• PoEndDeviceBusy
• PoFxActivateComponent
• PoFxCompleteDevicePowerNotRequired
• PoFxCompleteIdleCondition
• PoFxCompleteIdleState
• PoFxIdleComponent
• PoFxNotifySurprisePowerOn
• PoFxPowerControl
• PoFxProcessorNotification
• PoFxRegisterCoreDevice
• PoFxRegisterDevice
• PoFxRegisterPlugin
• PoFxRegisterPluginEx
• PoFxRegisterPrimaryDevice
• PoFxReportDevicePoweredOn
• PoFxSetComponentLatency
• PoFxSetComponentResidency
• PoFxSetComponentWake
• PoFxSetDeviceIdleTimeout
• PoFxStartDevicePowerManagement
• PoFxUnregisterDevice
• PoGetProcessorIdleAccounting
• PoGetSystemWake
• PoInitiateProcessorWake
• PoLatencySensitivityHint
• PoNotifyDisableDynamicTick
• PoNotifyVSyncChange
• PoQueryWatchdogTime
• PoQueueShutdownWorkItem
• PoReenableSleepStates
• PoRegisterCoalescingCallback
• PoRegisterDeviceForIdleDetection
• PoRegisterDeviceNotify
• PoRegisterPowerSettingCallback
• PoRegisterSystemState
• PoRequestPowerIrp
• PoRequestShutdownEvent
• PoSetDeviceBusyEx
• PoSetFixedWakeSource
• PoSetHiberRange
• PoSetPowerRequest
• PoSetPowerState
• PoSetSystemState
• PoSetSystemWake
• PoSetUserPresent
• PoShutdownBugCheck
• PoStartDeviceBusy
• PoStartNextPowerIrp
• PoUnregisterCoalescingCallback
• PoUnregisterPowerSettingCallback
• PoUnregisterSystemState
• PoUserShutdownCancelled
• PoUserShutdownInitiated
• ProbeForRead
• ProbeForWrite
• PsAcquireProcessExitSynchronization
• PsAssignImpersonationToken
• PsChargePoolQuota
• PsChargeProcessNonPagedPoolQuota
• PsChargeProcessPagedPoolQuota
• PsChargeProcessPoolQuota
• PsChargeProcessWakeCounter
• PsCreateSystemThread
• PsCreateSystemThreadEx
• PsDereferenceImpersonationToken
• PsDereferenceKernelStack
• PsDereferencePrimaryToken
• PsDisableImpersonation
• PsEnterPriorityRegion
• PsEstablishWin32Callouts
• PsGetContextThread
• PsGetCurrentProcess
• PsGetCurrentProcessId
• PsGetCurrentProcessSessionId
• PsGetCurrentProcessWin32Process
• PsGetCurrentProcessWow64Process
• PsGetCurrentThread
• PsGetCurrentThreadId
• PsGetCurrentThreadPreviousMode
• PsGetCurrentThreadProcess
• PsGetCurrentThreadProcessId
• PsGetCurrentThreadStackBase
• PsGetCurrentThreadStackLimit
• PsGetCurrentThreadTeb
• PsGetCurrentThreadWin32Thread
• PsGetCurrentThreadWin32ThreadAndEnterCriticalRegion
• PsGetJobLock
• PsGetJobSessionId
• PsGetJobUIRestrictionsClass
• PsGetProcessCommonJob
• PsGetProcessCreateTimeQuadPart
• PsGetProcessDebugPort
• PsGetProcessExitProcessCalled
• PsGetProcessExitStatus
• PsGetProcessExitTime
• PsGetProcessId
• PsGetProcessImageFileName
• PsGetProcessInheritedFromUniqueProcessId
• PsGetProcessJob
• PsGetProcessPeb
• PsGetProcessPriorityClass
• PsGetProcessSectionBaseAddress
• PsGetProcessSecurityPort
• PsGetProcessSessionId
• PsGetProcessSessionIdEx
• PsGetProcessSignatureLevel
• PsGetProcessWin32Process
• PsGetProcessWin32WindowStation
• PsGetProcessWow64Process
• PsGetThreadExitStatus
• PsGetThreadFreezeCount
• PsGetThreadHardErrorsAreDisabled
• PsGetThreadId
• PsGetThreadProcess
• PsGetThreadProcessId
• PsGetThreadSessionId
• PsGetThreadTeb
• PsGetThreadWin32Thread
• PsGetVersion
• PsImpersonateClient
• PsInitialSystemProcess
• PsIsCurrentThreadPrefetching
• PsIsDiskCountersEnabled
• PsIsProcessBeingDebugged
• PsIsProtectedProcess
• PsIsSystemProcess
• PsIsSystemThread
• PsIsThreadImpersonating
• PsIsThreadTerminating
• PsJobType
• PsLeavePriorityRegion
• PsLookupProcessByProcessId
• PsLookupProcessThreadByCid
• PsLookupThreadByThreadId
• PsProcessType
• PsQueryProcessAttributesByToken
• PsQueryProcessExceptionFlags
• PsQueryTotalCycleTimeProcess
• PsReferenceImpersonationToken
• PsReferenceKernelStack
• PsReferencePrimaryToken
• PsReferenceProcessFilePointer
• PsReleaseProcessExitSynchronization
• PsReleaseProcessWakeCounter
• PsRemoveCreateThreadNotifyRoutine
• PsRemoveLoadImageNotifyRoutine
• PsRestoreImpersonation
• PsResumeProcess
• PsReturnPoolQuota
• PsReturnProcessNonPagedPoolQuota
• PsReturnProcessPagedPoolQuota
• PsRevertThreadToSelf
• PsRevertToSelf
• PsSetContextThread
• PsSetCreateProcessNotifyRoutine
• PsSetCreateProcessNotifyRoutineEx
• PsSetCreateThreadNotifyRoutine
• PsSetCurrentThreadPrefetching
• PsSetLegoNotifyRoutine
• PsSetLoadImageNotifyRoutine
• PsSetProcessPriorityByClass
• PsSetProcessPriorityClass
• PsSetProcessSecurityPort
• PsSetProcessWin32Process
• PsSetProcessWindowStation
• PsSetThreadHardErrorsAreDisabled
• PsSetThreadWin32Thread
• PsSuspendProcess
• PsTerminateSystemThread
• PsThreadType
• PsUILanguageComitted
• PsUpdateDiskCounters
• PsWrapApcWow64Thread
• RtlAbsoluteToSelfRelativeSD
• RtlAddAccessAllowedAce
• RtlAddAccessAllowedAceEx
• RtlAddAce
• RtlAddAtomToAtomTable
• RtlAddAtomToAtomTableEx
• RtlAddRange
• RtlAddResourceAttributeAce
• RtlAllocateHeap
• RtlAnsiCharToUnicodeChar
• RtlAnsiStringToUnicodeSize
• RtlAnsiStringToUnicodeString
• RtlAppendAsciizToString
• RtlAppendStringToString
• RtlAppendUnicodeStringToString
• RtlAppendUnicodeToString
• RtlAreAllAccessesGranted
• RtlAreAnyAccessesGranted
• RtlAreBitsClear
• RtlAreBitsSet
• RtlAssert
• RtlCaptureContext
• RtlCaptureStackBackTrace
• RtlCharToInteger
• RtlCheckPortableOperatingSystem
• RtlCheckRegistryKey
• RtlCheckTokenCapability
• RtlCheckTokenMembership
• RtlCheckTokenMembershipEx
• RtlClearAllBits
• RtlClearBit
• RtlClearBits
• RtlCmDecodeMemIoResource
• RtlCmEncodeMemIoResource
• RtlCompareAltitudes
• RtlCompareMemory
• RtlCompareMemoryUlong
• RtlCompareString
• RtlCompareUnicodeString
• RtlCompareUnicodeStrings
• RtlCompressBuffer
• RtlCompressChunks
• RtlComputeCrc32
• RtlContractHashTable
• RtlConvertSidToUnicodeString
• RtlCopyBitMap
• RtlCopyLuid
• RtlCopyLuidAndAttributesArray
• RtlCopyMemory
• RtlCopyMemoryNonTemporal
• RtlCopyRangeList
• RtlCopySid
• RtlCopySidAndAttributesArray
• RtlCopyString
• RtlCopyUnicodeString
• RtlCrc32
• RtlCrc64
• RtlCreateAcl
• RtlCreateAtomTable
• RtlCreateAtomTableEx
• RtlCreateHashTable
• RtlCreateHashTableEx
• RtlCreateHeap
• RtlCreateRegistryKey
• RtlCreateSecurityDescriptor
• RtlCreateSystemVolumeInformationFolder
• RtlCreateUnicodeString
• RtlCreateUserThread
• RtlCultureNameToLCID
• RtlCustomCPToUnicodeN
• RtlDecompressBuffer
• RtlDecompressBufferEx
• RtlDecompressChunks
• RtlDecompressFragment
• RtlDelete
• RtlDeleteAce
• RtlDeleteAtomFromAtomTable
• RtlDeleteElementGenericTable
• RtlDeleteElementGenericTableAvl
• RtlDeleteElementGenericTableAvlEx
• RtlDeleteHashTable
• RtlDeleteNoSplay
• RtlDeleteOwnersRanges
• RtlDeleteRange
• RtlDeleteRegistryValue
• RtlDescribeChunk
• RtlDestroyAtomTable
• RtlDestroyHeap
• RtlDowncaseUnicodeChar
• RtlDowncaseUnicodeString
• RtlDuplicateUnicodeString
• RtlEmptyAtomTable
• RtlEndEnumerationHashTable
• RtlEndWeakEnumerationHashTable
• RtlEnumerateEntryHashTable
• RtlEnumerateGenericTable
• RtlEnumerateGenericTableAvl
• RtlEnumerateGenericTableLikeADirectory
• RtlEnumerateGenericTableWithoutSplaying
• RtlEnumerateGenericTableWithoutSplayingAvl
• RtlEqualLuid
• RtlEqualSid
• RtlEqualString
• RtlEqualUnicodeString
• RtlEqualWnfChangeStamps
• RtlEthernetAddressToStringA
• RtlEthernetAddressToStringW
• RtlEthernetStringToAddressA
• RtlEthernetStringToAddressW
• RtlExpandHashTable
• RtlExtractBitMap
• RtlFillMemory
• RtlFindAceByType
• RtlFindClearBits
• RtlFindClearBitsAndSet
• RtlFindClearRuns
• RtlFindClosestEncodableLength
• RtlFindFirstRunClear
• RtlFindLastBackwardRunClear
• RtlFindLeastSignificantBit
• RtlFindLongestRunClear
• RtlFindMessage
• RtlFindMostSignificantBit
• RtlFindNextForwardRunClear
• RtlFindRange
• RtlFindSetBits
• RtlFindSetBitsAndClear
• RtlFindUnicodePrefix
• RtlFormatCurrentUserKeyPath
• RtlFormatMessage
• RtlFreeAnsiString
• RtlFreeHeap
• RtlFreeOemString
• RtlFreeRangeList
• RtlFreeUnicodeString
• RtlGUIDFromString
• RtlGenerate8dot3Name
• RtlGenerateClass5Guid
• RtlGetAce
• RtlGetAppContainerNamedObjectPath
• RtlGetCallersAddress
• RtlGetCompressionWorkSpaceSize
• RtlGetDaclSecurityDescriptor
• RtlGetDefaultCodePage
• RtlGetElementGenericTable
• RtlGetElementGenericTableAvl
• RtlGetEnabledExtendedFeatures
• RtlGetFirstRange
• RtlGetGroupSecurityDescriptor
• RtlGetIntegerAtom
• RtlGetLastRange
• RtlGetNextEntryHashTable
• RtlGetNextRange
• RtlGetNtGlobalFlags
• RtlGetOwnerSecurityDescriptor
• RtlGetProductInfo
• RtlGetSaclSecurityDescriptor
• RtlGetSetBootStatusData
• RtlGetThreadLangIdByIndex
• RtlGetVersion
• RtlHashUnicodeString
• RtlIdnToAscii
• RtlIdnToNameprepUnicode
• RtlIdnToUnicode
• RtlImageDirectoryEntryToData
• RtlImageNtHeader
• RtlInitAnsiString
• RtlInitAnsiStringEx
• RtlInitCodePageTable
• RtlInitEnumerationHashTable
• RtlInitString
• RtlInitUnicodeString
• RtlInitUnicodeStringEx
• RtlInitWeakEnumerationHashTable
• RtlInitializeBitMap
• RtlInitializeGenericTable
• RtlInitializeGenericTableAvl
• RtlInitializeRangeList
• RtlInitializeSid
• RtlInitializeUnicodePrefix
• RtlInsertElementGenericTable
• RtlInsertElementGenericTableAvl
• RtlInsertElementGenericTableFull
• RtlInsertElementGenericTableFullAvl
• RtlInsertEntryHashTable
• RtlInsertUnicodePrefix
• RtlInt64ToUnicodeString
• RtlIntegerToChar
• RtlIntegerToUnicode
• RtlIntegerToUnicodeString
• RtlInvertRangeList
• RtlInvertRangeListEx
• RtlIoDecodeMemIoResource
• RtlIoEncodeMemIoResource
• RtlIpv4AddressToStringA
• RtlIpv4AddressToStringExA
• RtlIpv4AddressToStringExW
• RtlIpv4AddressToStringW
• RtlIpv4StringToAddressA
• RtlIpv4StringToAddressExA
• RtlIpv4StringToAddressExW
• RtlIpv4StringToAddressW
• RtlIpv6AddressToStringA
• RtlIpv6AddressToStringExA
• RtlIpv6AddressToStringExW
• RtlIpv6AddressToStringW
• RtlIpv6StringToAddressA
• RtlIpv6StringToAddressExA
• RtlIpv6StringToAddressExW
• RtlIpv6StringToAddressW
• RtlIsGenericTableEmpty
• RtlIsGenericTableEmptyAvl
• RtlIsNameLegalDOS8Dot3
• RtlIsNormalizedString
• RtlIsNtDdiVersionAvailable
• RtlIsRangeAvailable
• RtlIsServicePackVersionInstalled
• RtlIsUntrustedObject
• RtlIsValidOemCharacter
• RtlLCIDToCultureName
• RtlLengthRequiredSid
• RtlLengthSecurityDescriptor
• RtlLengthSid
• RtlLoadString
• RtlLocalTimeToSystemTime
• RtlLockBootStatusData
• RtlLookupAtomInAtomTable
• RtlLookupElementGenericTable
• RtlLookupElementGenericTableAvl
• RtlLookupElementGenericTableFull
• RtlLookupElementGenericTableFullAvl
• RtlLookupEntryHashTable
• RtlLookupFirstMatchingElementGenericTableAvl
• RtlLookupFunctionEntry
• RtlMapGenericMask
• RtlMapSecurityErrorToNtStatus
• RtlMergeRangeLists
• RtlMoveMemory
• RtlMultiByteToUnicodeN
• RtlMultiByteToUnicodeSize
• RtlNextUnicodePrefix
• RtlNormalizeString
• RtlNtStatusToDosError
• RtlNtStatusToDosErrorNoTeb
• RtlNumberGenericTableElements
• RtlNumberGenericTableElementsAvl
• RtlNumberOfClearBits
• RtlNumberOfClearBitsInRange
• RtlNumberOfSetBits
• RtlNumberOfSetBitsInRange
• RtlNumberOfSetBitsUlongPtr
• RtlOemStringToCountedUnicodeString
• RtlOemStringToUnicodeSize
• RtlOemStringToUnicodeString
• RtlOemToUnicodeN
• RtlOpenCurrentUser
• RtlOwnerAcesPresent
• RtlPcToFileHeader
• RtlPinAtomInAtomTable
• RtlPrefetchMemoryNonTemporal
• RtlPrefixString
• RtlPrefixUnicodeString
• RtlQueryAtomInAtomTable
• RtlQueryDynamicTimeZoneInformation
• RtlQueryElevationFlags
• RtlQueryInformationAcl
• RtlQueryModuleInformation
• RtlQueryPackageIdentity
• RtlQueryRegistryValues
• RtlQueryRegistryValuesEx
• RtlQueryTimeZoneInformation
• RtlQueryValidationRunlevel
• RtlRaiseException
• RtlRandom
• RtlRandomEx
• RtlRbInsertNodeEx
• RtlRbRemoveNode
• RtlRealPredecessor
• RtlRealSuccessor
• RtlRemoveEntryHashTable
• RtlRemoveUnicodePrefix
• RtlReplaceSidInSd
• RtlReserveChunk
• RtlRestoreContext
• RtlRunOnceBeginInitialize
• RtlRunOnceComplete
• RtlRunOnceExecuteOnce
• RtlRunOnceInitialize
• RtlSecondsSince1970ToTime
• RtlSecondsSince1980ToTime
• RtlSelfRelativeToAbsoluteSD
• RtlSelfRelativeToAbsoluteSD2
• RtlSetAllBits
• RtlSetBit
• RtlSetBits
• RtlSetControlSecurityDescriptor
• RtlSetDaclSecurityDescriptor
• RtlSetDynamicTimeZoneInformation
• RtlSetGroupSecurityDescriptor
• RtlSetOwnerSecurityDescriptor
• RtlSetPortableOperatingSystem
• RtlSetSaclSecurityDescriptor
• RtlSetTimeZoneInformation
• RtlSidHashInitialize
• RtlSidHashLookup
• RtlSizeHeap
• RtlSplay
• RtlStringFromGUID
• RtlSubAuthorityCountSid
• RtlSubAuthoritySid
• RtlSubtreePredecessor
• RtlSubtreeSuccessor
• RtlSystemTimeToLocalTime
• RtlTestBit
• RtlTimeFieldsToTime
• RtlTimeToElapsedTimeFields
• RtlTimeToSecondsSince1970
• RtlTimeToSecondsSince1980
• RtlTimeToTimeFields
• RtlTraceDatabaseAdd
• RtlTraceDatabaseCreate
• RtlTraceDatabaseDestroy
• RtlTraceDatabaseEnumerate
• RtlTraceDatabaseFind
• RtlTraceDatabaseLock
• RtlTraceDatabaseUnlock
• RtlTraceDatabaseValidate
• RtlUTF8ToUnicodeN
• RtlUnicodeStringToAnsiSize
• RtlUnicodeStringToAnsiString
• RtlUnicodeStringToCountedOemString
• RtlUnicodeStringToInteger
• RtlUnicodeStringToOemSize
• RtlUnicodeStringToOemString
• RtlUnicodeToCustomCPN
• RtlUnicodeToMultiByteN
• RtlUnicodeToMultiByteSize
• RtlUnicodeToOemN
• RtlUnicodeToUTF8N
• RtlUnlockBootStatusData
• RtlUnwind
• RtlUnwindEx
• RtlUpcaseUnicodeChar
• RtlUpcaseUnicodeString
• RtlUpcaseUnicodeStringToAnsiString
• RtlUpcaseUnicodeStringToCountedOemString
• RtlUpcaseUnicodeStringToOemString
• RtlUpcaseUnicodeToCustomCPN
• RtlUpcaseUnicodeToMultiByteN
• RtlUpcaseUnicodeToOemN
• RtlUpperChar
• RtlUpperString
• RtlValidRelativeSecurityDescriptor
• RtlValidSecurityDescriptor
• RtlValidSid
• RtlValidateUnicodeString
• RtlVerifyVersionInfo
• RtlVirtualUnwind
• RtlVolumeDeviceToDosName
• RtlWalkFrameChain
• RtlWeaklyEnumerateEntryHashTable
• RtlWriteRegistryValue
• RtlZeroHeap
• RtlZeroMemory
• RtlxAnsiStringToUnicodeSize
• RtlxOemStringToUnicodeSize
• RtlxUnicodeStringToAnsiSize
• RtlxUnicodeStringToOemSize
• SeAccessCheck
• SeAccessCheckEx
• SeAccessCheckFromState
• SeAccessCheckFromStateEx
• SeAccessCheckWithHint
• SeAppendPrivileges
• SeAssignSecurity
• SeAssignSecurityEx
• SeAuditHardLinkCreation
• SeAuditHardLinkCreationWithTransaction
• SeAuditTransactionStateChange
• SeAuditingAnyFileEventsWithContext
• SeAuditingAnyFileEventsWithContextEx
• SeAuditingFileEvents
• SeAuditingFileEventsWithContext
• SeAuditingFileEventsWithContextEx
• SeAuditingFileOrGlobalEvents
• SeAuditingHardLinkEvents
• SeAuditingHardLinkEventsWithContext
• SeAuditingWithTokenForSubcategory
• SeCaptureSecurityDescriptor
• SeCaptureSubjectContext
• SeCaptureSubjectContextEx
• SeCloseObjectAuditAlarm
• SeCloseObjectAuditAlarmForNonObObject
• SeComputeAutoInheritByObjectType
• SeCreateAccessState
• SeCreateAccessStateEx
• SeCreateClientSecurity
• SeCreateClientSecurityEx
• SeCreateClientSecurityFromSubjectContext
• SeCreateClientSecurityFromSubjectContextEx
• SeDeassignSecurity
• SeDeleteAccessState
• SeDeleteObjectAuditAlarm
• SeDeleteObjectAuditAlarmWithTransaction
• SeExamineSacl
• SeExports
• SeFilterToken
• SeFreePrivileges
• SeGetLinkedToken
• SeGetLogonSessionToken
• SeImpersonateClient
• SeImpersonateClientEx
• SeLocateProcessImageName
• SeLockSubjectContext
• SeMarkLogonSessionForTerminationNotification
• SeOpenObjectAuditAlarm
• SeOpenObjectAuditAlarmForNonObObject
• SeOpenObjectAuditAlarmWithTransaction
• SeOpenObjectForDeleteAuditAlarm
• SeOpenObjectForDeleteAuditAlarmWithTransaction
• SePrivilegeCheck
• SePrivilegeObjectAuditAlarm
• SePublicDefaultDacl
• SeQueryAuthenticationIdToken
• SeQueryInformationToken
• SeQuerySecureBootPolicyValue
• SeQuerySecurityAttributesToken
• SeQuerySecurityDescriptorInfo
• SeQuerySessionIdToken
• SeRegisterLogonSessionTerminatedRoutine
• SeReleaseSecurityDescriptor
• SeReleaseSubjectContext
• SeReportSecurityEvent
• SeReportSecurityEventWithSubCategory
• SeSecurityAttributePresent
• SeSetAccessStateGenericMapping
• SeSetAuditParameter
• SeSetSecurityAttributesToken
• SeSetSecurityDescriptorInfo
• SeSetSecurityDescriptorInfoEx
• SeSinglePrivilegeCheck
• SeSrpAccessCheck
• SeSystemDefaultDacl
• SeSystemDefaultSd
• SeTokenFromAccessInformation
• SeTokenImpersonationLevel
• SeTokenIsAdmin
• SeTokenIsRestricted
• SeTokenIsWriteRestricted
• SeTokenObjectType
• SeTokenType
• SeUnlockSubjectContext
• SeUnregisterLogonSessionTerminatedRoutine
• SeValidSecurityDescriptor
• TmCancelPropagationRequest
• TmCommitComplete
• TmCommitEnlistment
• TmCommitTransaction
• TmCreateEnlistment
• TmCurrentTransaction
• TmDereferenceEnlistmentKey
• TmEnableCallbacks
• TmEndPropagationRequest
• TmEnlistmentObjectType
• TmFreezeTransactions
• TmGetTransactionId
• TmInitSystem
• TmInitSystemPhase2
• TmInitializeTransactionManager
• TmIsKTMCommitCoordinator
• TmIsTransactionActive
• TmPrePrepareComplete
• TmPrePrepareEnlistment
• TmPrepareComplete
• TmPrepareEnlistment
• TmPropagationComplete
• TmPropagationFailed
• TmReadOnlyEnlistment
• TmRecoverEnlistment
• TmRecoverResourceManager
• TmRecoverTransactionManager
• TmReferenceEnlistmentKey
• TmRenameTransactionManager
• TmRequestOutcomeEnlistment
• TmResourceManagerObjectType
• TmRollbackComplete
• TmRollbackEnlistment
• TmRollbackTransaction
• TmSetCurrentTransaction
• TmSinglePhaseReject
• TmThawTransactions
• TmTransactionManagerObjectType
• TmTransactionObjectType
• VerSetConditionMask
• VfFailDeviceNode
• VfFailDriver
• VfFailSystemBIOS
• VfIsVerificationEnabled
• WheaAddErrorSource
• WheaAttemptPhysicalPageOffline
• WheaConfigureErrorSource
• WheaDeferredRecoveryService
• WheaGetErrorSource
• WheaInitializeDeferredRecoveryObject
• WheaInitializeRecordHeader
• WheaRegisterInUsePageOfflineNotification
• WheaReportHwError
• WheaRequestDeferredRecovery
• WheaUnregisterInUsePageOfflineNotification
• WmiGetClock
• WmiQueryTraceInformation
• WmiTraceMessage
• WmiTraceMessageVa
• XIPDispatch
• ZwAccessCheckAndAuditAlarm
• ZwAddBootEntry
• ZwAddDriverEntry
• ZwAdjustPrivilegesToken
• ZwAlertThread
• ZwAllocateLocallyUniqueId
• ZwAllocateVirtualMemory
• ZwAlpcAcceptConnectPort
• ZwAlpcCancelMessage
• ZwAlpcConnectPort
• ZwAlpcConnectPortEx
• ZwAlpcCreatePort
• ZwAlpcCreatePortSection
• ZwAlpcCreateResourceReserve
• ZwAlpcCreateSectionView
• ZwAlpcCreateSecurityContext
• ZwAlpcDeletePortSection
• ZwAlpcDeleteResourceReserve
• ZwAlpcDeleteSectionView
• ZwAlpcDeleteSecurityContext
• ZwAlpcDisconnectPort
• ZwAlpcQueryInformation
• ZwAlpcSendWaitReceivePort
• ZwAlpcSetInformation
• ZwAssignProcessToJobObject
• ZwCancelIoFile
• ZwCancelTimer
• ZwClearEvent
• ZwClose
• ZwCloseObjectAuditAlarm
• ZwCommitComplete
• ZwCommitEnlistment
• ZwCommitTransaction
• ZwConnectPort
• ZwCreateDirectoryObject
• ZwCreateEnlistment
• ZwCreateEvent
• ZwCreateFile
• ZwCreateIoCompletion
• ZwCreateJobObject
• ZwCreateKey
• ZwCreateKeyTransacted
• ZwCreateResourceManager
• ZwCreateSection
• ZwCreateSymbolicLinkObject
• ZwCreateTimer
• ZwCreateTransaction
• ZwCreateTransactionManager
• ZwCreateWnfStateName
• ZwDeleteBootEntry
• ZwDeleteDriverEntry
• ZwDeleteFile
• ZwDeleteKey
• ZwDeleteValueKey
• ZwDeleteWnfStateData
• ZwDeleteWnfStateName
• ZwDeviceIoControlFile
• ZwDisplayString
• ZwDuplicateObject
• ZwDuplicateToken
• ZwEnumerateBootEntries
• ZwEnumerateDriverEntries
• ZwEnumerateKey
• ZwEnumerateTransactionObject
• ZwEnumerateValueKey
• ZwFlushBuffersFile
• ZwFlushBuffersFileEx
• ZwFlushInstructionCache
• ZwFlushKey
• ZwFlushVirtualMemory
• ZwFreeVirtualMemory
• ZwFsControlFile
• ZwGetNotificationResourceManager
• ZwImpersonateAnonymousToken
• ZwInitiatePowerAction
• ZwIsProcessInJob
• ZwLoadDriver
• ZwLoadKey
• ZwLoadKeyEx
• ZwLockFile
• ZwLockProductActivationKeys
• ZwMakeTemporaryObject
• ZwMapViewOfSection
• ZwModifyBootEntry
• ZwModifyDriverEntry
• ZwNotifyChangeKey
• ZwNotifyChangeSession
• ZwOpenDirectoryObject
• ZwOpenEnlistment
• ZwOpenEvent
• ZwOpenFile
• ZwOpenJobObject
• ZwOpenKey
• ZwOpenKeyEx
• ZwOpenKeyTransacted
• ZwOpenKeyTransactedEx
• ZwOpenProcess
• ZwOpenProcessToken
• ZwOpenProcessTokenEx
• ZwOpenResourceManager
• ZwOpenSection
• ZwOpenSession
• ZwOpenSymbolicLinkObject
• ZwOpenThread
• ZwOpenThreadToken
• ZwOpenThreadTokenEx
• ZwOpenTimer
• ZwOpenTransaction
• ZwOpenTransactionManager
• ZwPowerInformation
• ZwPrePrepareComplete
• ZwPrePrepareEnlistment
• ZwPrepareComplete
• ZwPrepareEnlistment
• ZwPropagationComplete
• ZwPropagationFailed
• ZwPulseEvent
• ZwQueryBootEntryOrder
• ZwQueryBootOptions
• ZwQueryDefaultLocale
• ZwQueryDefaultUILanguage
• ZwQueryDirectoryFile
• ZwQueryDirectoryObject
• ZwQueryDriverEntryOrder
• ZwQueryEaFile
• ZwQueryFullAttributesFile
• ZwQueryInformationEnlistment
• ZwQueryInformationFile
• ZwQueryInformationJobObject
• ZwQueryInformationProcess
• ZwQueryInformationResourceManager
• ZwQueryInformationThread
• ZwQueryInformationToken
• ZwQueryInformationTransaction
• ZwQueryInformationTransactionManager
• ZwQueryInstallUILanguage
• ZwQueryKey
• ZwQueryLicenseValue
• ZwQueryObject
• ZwQueryQuotaInformationFile
• ZwQuerySection
• ZwQuerySecurityAttributesToken
• ZwQuerySecurityObject
• ZwQuerySymbolicLinkObject
• ZwQuerySystemEnvironmentValueEx
• ZwQuerySystemInformation
• ZwQueryValueKey
• ZwQueryVirtualMemory
• ZwQueryVolumeInformationFile
• ZwQueryWnfStateData
• ZwQueryWnfStateNameInformation
• ZwReadFile
• ZwReadOnlyEnlistment
• ZwRecoverEnlistment
• ZwRecoverResourceManager
• ZwRecoverTransactionManager
• ZwRemoveIoCompletion
• ZwRemoveIoCompletionEx
• ZwRenameKey
• ZwReplaceKey
• ZwRequestPort
• ZwRequestWaitReplyPort
• ZwResetEvent
• ZwRestoreKey
• ZwRollbackComplete
• ZwRollbackEnlistment
• ZwRollbackTransaction
• ZwSaveKey
• ZwSaveKeyEx
• ZwSecureConnectPort
• ZwSetBootEntryOrder
• ZwSetBootOptions
• ZwSetCachedSigningLevel
• ZwSetDefaultLocale
• ZwSetDefaultUILanguage
• ZwSetDriverEntryOrder
• ZwSetEaFile
• ZwSetEvent
• ZwSetInformationEnlistment
• ZwSetInformationFile
• ZwSetInformationJobObject
• ZwSetInformationKey
• ZwSetInformationObject
• ZwSetInformationProcess
• ZwSetInformationResourceManager
• ZwSetInformationThread
• ZwSetInformationToken
• ZwSetInformationTransaction
• ZwSetInformationVirtualMemory
• ZwSetQuotaInformationFile
• ZwSetSecurityObject
• ZwSetSystemEnvironmentValueEx
• ZwSetSystemInformation
• ZwSetSystemTime
• ZwSetTimer
• ZwSetTimerEx
• ZwSetValueKey
• ZwSetVolumeInformationFile
• ZwTerminateJobObject
• ZwTerminateProcess
• ZwTraceEvent
• ZwTranslateFilePath
• ZwUnloadDriver
• ZwUnloadKey
• ZwUnloadKeyEx
• ZwUnlockFile
• ZwUnlockVirtualMemory
• ZwUnmapViewOfSection
• ZwUpdateWnfStateData
• ZwWaitForMultipleObjects
• ZwWaitForSingleObject
• ZwWriteFile
• ZwYieldExecution
• __C_specific_handler
• __chkstk
• __misaligned_access
• _i64toa_s
• _i64tow_s
• _itoa
• _itoa_s
• _itow
• _itow_s
• _local_unwind
• _ltoa_s
• _ltow_s
• _makepath_s
• _purecall
• _setjmp
• _setjmpex
• _snprintf
• _snprintf_s
• _snscanf_s
• _snwprintf
• _snwprintf_s
• _snwscanf_s
• _splitpath_s
• _stricmp
• _strlwr
• _strnicmp
• _strnset
• _strnset_s
• _strrev
• _strset
• _strset_s
• _strtoui64
• _strupr
• _swprintf
• _ui64toa_s
• _ui64tow_s
• _ultoa_s
• _ultow_s
• _vsnprintf
• _vsnprintf_s
• _vsnwprintf
• _vsnwprintf_s
• _vswprintf
• _wcsicmp
• _wcslwr
• _wcsnicmp
• _wcsnset
• _wcsnset_s
• _wcsrev
• _wcsset_s
• _wcsupr
• _wmakepath_s
• _wsplitpath_s
• _wtoi
• _wtol
• atoi
• atol
• bsearch
• bsearch_s
• isdigit
• islower
• isprint
• isspace
• isupper
• isxdigit
• longjmp
• mbstowcs
• mbtowc
• memchr
• memcmp
• memcpy
• memcpy_s
• memmove
• memmove_s
• memset
• psMUITest
• qsort
• rand
• sprintf
• sprintf_s
• srand
• sscanf_s
• strcat
• strcat_s
• strchr
• strcmp
• strcpy
• strcpy_s
• strlen
• strncat
• strncat_s
• strncmp
• strncpy
• strncpy_s
• strnlen
• strrchr
• strspn
• strstr
• strtok_s
• swprintf
• swprintf_s
• swscanf_s
• tolower
• toupper
• towlower
• towupper
• vDbgPrintEx
• vDbgPrintExWithPrefix
• vsprintf
• vsprintf_s
• vswprintf_s
• wcscat
• wcscat_s
• wcschr
• wcscmp
• wcscpy
• wcscpy_s
• wcscspn
• wcslen
• wcsncat
• wcsncat_s
• wcsncmp
• wcsncpy
• wcsncpy_s
• wcsnlen
• wcsrchr
• wcsspn
• wcsstr
• wcstombs
• wcstoul
• wctomb
• ntoskrnl.exe#1
• ntoskrnl.exe#2