;
; Definition file of ntdll.dll
; Automatic generated by gendef
; written by Kai Tietz 2008
;
LIBRARY "ntdll.dll"
EXPORTS
RtlActivateActivationContextUnsafeFast@0
RtlDeactivateActivationContextUnsafeFast@0
RtlInterlockedPushListSList@8
@RtlUlongByteSwap@4
@RtlUlonglongByteSwap@8
@RtlUshortByteSwap@4
ExpInterlockedPopEntrySListEnd@0
ExpInterlockedPopEntrySListFault@0
ExpInterlockedPopEntrySListResume@0
RtlpInterlockedPopEntrySeqSListEnd@0
RtlpInterlockedPopEntrySeqSListFault@0
RtlpInterlockedPopEntrySeqSListResume@0
A_SHAFinal@8
A_SHAInit@4
A_SHAUpdate@12
AlpcAdjustCompletionListConcurrencyCount@8
AlpcFreeCompletionListMessage@8
AlpcGetCompletionListLastMessageInformation@12
AlpcGetCompletionListMessageAttributes@8
AlpcGetHeaderSize@4
AlpcGetMessageAttribute@8
AlpcGetMessageFromCompletionList@8
AlpcGetOutstandingCompletionListMessageCount@4
AlpcInitializeMessageAttribute@16
AlpcMaxAllowedMessageLength@0
AlpcRegisterCompletionList@20
AlpcRegisterCompletionListWorkerThread@4
AlpcRundownCompletionList@4
AlpcUnregisterCompletionList@4
AlpcUnregisterCompletionListWorkerThread@4
CsrAllocateCaptureBuffer@8
CsrAllocateMessagePointer@12
CsrCaptureMessageBuffer@16
CsrCaptureMessageMultiUnicodeStringsInPlace@12
CsrCaptureMessageString@20
CsrCaptureTimeout@8
CsrClientCallServer@16
CsrClientConnectToServer@20
CsrFreeCaptureBuffer@4
CsrGetProcessId@0
CsrIdentifyAlertableThread@0
CsrNewThread@0
CsrProbeForRead@12
CsrProbeForWrite@12
CsrSetPriorityClass@8
CsrVerifyRegion@8
DbgBreakPoint@0
DbgPrint
DbgPrintEx
DbgPrintReturnControlC
DbgPrompt@12
DbgQueryDebugFilterState@8
DbgSetDebugFilterState@12
DbgSsHandleKmApiMsg@8
DbgSsInitialize@16
DbgUiConnectToDbg@0
DbgUiContinue@8
DbgUiConvertStateChangeStructure@8
DbgUiDebugActiveProcess@4
DbgUiGetThreadDebugObject@0
DbgUiIssueRemoteBreakin@4
DbgUiRemoteBreakin@4
DbgUiSetThreadDebugObject@4
DbgUiStopDebugging@4
DbgUiWaitStateChange@8
DbgUserBreakPoint@0
EtwCreateTraceInstanceId@8
EtwDeliverDataBlock@4
EtwEnumerateProcessRegGuids@12
EtwEventActivityIdControl@8
EtwEventEnabled@12
EtwEventProviderEnabled@20
EtwEventRegister@16
EtwEventUnregister@8
EtwEventWrite@20
EtwEventWriteEndScenario@20
EtwEventWriteEx@40
EtwEventWriteFull@32
EtwEventWriteNoRegistration@16
EtwEventWriteStartScenario@20
EtwEventWriteString@24
EtwEventWriteTransfer@28
EtwGetTraceEnableFlags@8
EtwGetTraceEnableLevel@8
EtwGetTraceLoggerHandle@4
EtwLogTraceEvent@12
EtwNotificationRegister@20
EtwNotificationUnregister@12
EtwProcessPrivateLoggerRequest@4
EtwRegisterSecurityProvider@0
EtwRegisterTraceGuidsA@32
EtwRegisterTraceGuidsW@32
EtwReplyNotification@4
EtwSendNotification@20
EtwSetMark@16
EtwTraceEventInstance@20
EtwTraceMessage
EtwTraceMessageVa@24
EtwUnregisterTraceGuids@8
EtwWriteUMSecurityEvent@16
EtwpCreateEtwThread@8
EtwpGetCpuSpeed@8
;EtwpNotificationThread
EvtIntReportAuthzEventAndSourceAsync@44
EvtIntReportEventAndSourceAsync@44
KiFastSystemCall@0
KiFastSystemCallRet@0
KiIntSystemCall@0
KiRaiseUserExceptionDispatcher@0
KiUserApcDispatcher@20
KiUserCallbackDispatcher@12
KiUserExceptionDispatcher@8
LdrAccessResource@16
LdrAddLoadAsDataTable@16; Check!!! gendef says @20
LdrAddRefDll@8
LdrAlternateResourcesEnabled@0
LdrDisableThreadCalloutsForDll@4
LdrEnumResources@20
LdrEnumerateLoadedModules@12
LdrFindEntryForAddress@8
LdrFindResourceDirectory_U@16
LdrFindResourceEx_U@20
LdrFindResource_U@16
LdrFlushAlternateResourceModules@0
LdrGetDllHandle@16
LdrGetDllHandleByMapping@8
LdrGetDllHandleByName@12
LdrGetDllHandleEx@20
LdrGetFailureData@0
LdrGetFileNameFromLoadAsDataTable@8
LdrGetProcedureAddress@16
LdrGetProcedureAddressEx@20
LdrHotPatchRoutine@0
LdrInitShimEngineDynamic@4
LdrInitializeThunk@16
LdrLoadAlternateResourceModule@16
LdrLoadAlternateResourceModuleEx@20
LdrLoadDll@16
LdrAlternateResourcesEnabled@0
LdrLockLoaderLock@12
LdrOpenImageFileOptionsKey@12
LdrProcessRelocationBlock@16
LdrQueryImageFileExecutionOptions@24
LdrQueryImageFileExecutionOptionsEx@28
LdrQueryImageFileKeyOption@24
LdrQueryModuleServiceTags@12
LdrQueryProcessModuleInformation@12
LdrRegisterDllNotification@16
LdrRemoveLoadAsDataTable@16
LdrResFindResource@36
LdrResFindResourceDirectory@28
LdrResGetRCConfig@20
LdrResRelease@12
LdrResSearchResource@32
LdrRscIsTypeExist@16
LdrSetAppCompatDllRedirectionCallback@12
LdrSetDllManifestProber@4
LdrSetMUICacheType@4
LdrShutdownProcess@0
LdrShutdownThread@0
LdrUnloadAlternateResourceModule@4
LdrUnloadAlternateResourceModuleEx@8
LdrUnloadDll@4
LdrUnlockLoaderLock@8
LdrUnregisterDllNotification@4
LdrVerifyImageMatchesChecksum@16
LdrVerifyImageMatchesChecksumEx@8
LdrWx86FormatVirtualImage@12
LdrpResGetMappingSize@16
LdrpResGetRCConfig@20
LdrpResGetResourceDirectory@20
MD4Final@4
MD4Init@4
MD4Update@12
MD5Final@4
MD5Init@4
MD5Update@12
NlsAnsiCodePage DATA
NlsMbCodePageTag DATA
NlsMbOemCodePageTag DATA
NtAcceptConnectPort@24
NtAccessCheck@32
NtAccessCheckAndAuditAlarm@44
NtAccessCheckByType@44
NtAccessCheckByTypeAndAuditAlarm@64
NtAccessCheckByTypeResultList@44
NtAccessCheckByTypeResultListAndAuditAlarm@64
NtAccessCheckByTypeResultListAndAuditAlarmByHandle@68
NtAcquireCMFViewOwnership@12
NtAddAtom@12
NtAddBootEntry@8
NtAddDriverEntry@8
NtAdjustGroupsToken@24
NtAdjustPrivilegesToken@24
NtAlertResumeThread@8
NtAlertThread@4
NtAllocateLocallyUniqueId@4
NtAllocateReserveObject@12
NtAllocateUserPhysicalPages@12
NtAllocateUuids@16
NtAllocateVirtualMemory@24
NtAlpcAcceptConnectPort@36
NtAlpcCancelMessage@12
NtAlpcConnectPort@44
NtAlpcCreatePort@12
NtAlpcCreatePortSection@24
NtAlpcCreateResourceReserve@16
NtAlpcCreateSectionView@12
NtAlpcCreateSecurityContext@12
NtAlpcDeletePortSection@12
NtAlpcDeleteResourceReserve@12
NtAlpcDeleteSectionView@12
NtAlpcDeleteSecurityContext@12
NtAlpcDisconnectPort@8
NtAlpcImpersonateClientOfPort@12
NtAlpcOpenSenderProcess@24
NtAlpcOpenSenderThread@24
NtAlpcQueryInformation@20
NtAlpcQueryInformationMessage@24
NtAlpcRevokeSecurityContext@12
NtAlpcSendWaitReceivePort@32
NtAlpcSetInformation@16
NtApphelpCacheControl@8
NtAreMappedFilesTheSame@8
NtAssignProcessToJobObject@8
NtCallbackReturn@12
NtCancelDeviceWakeupRequest@4
NtCancelIoFile@8
NtCancelIoFileEx@12
NtCancelSynchronousIoFile@12
NtCancelTimer@8
NtClearEvent@4
NtClose@4
NtCloseObjectAuditAlarm@12
NtCommitComplete@8
NtCommitEnlistment@8
NtCommitTransaction@8
NtCompactKeys@8
NtCompareTokens@12
NtCompleteConnectPort@4
NtCompressKey@4
NtConnectPort@32
NtContinue@8
NtCreateDebugObject@16
NtCreateDirectoryObject@12
NtCreateEnlistment@32
NtCreateEvent@20
NtCreateEventPair@12
NtCreateFile@44
NtCreateIoCompletion@16
NtCreateJobObject@12
NtCreateJobSet@12
NtCreateKey@28
NtCreateKeyTransacted@32
NtCreateKeyedEvent@16
NtCreateMailslotFile@32
NtCreateMutant@16
NtCreateNamedPipeFile@56
NtCreatePagingFile@16
NtCreatePort@20
NtCreatePrivateNamespace@16
NtCreateProcess@32
NtCreateProcessEx@36
NtCreateProfile@36
NtCreateProfileEx@40
NtCreateResourceManager@28
NtCreateSection@28
NtCreateSemaphore@20
NtCreateSymbolicLinkObject@16
NtCreateThread@32
NtCreateThreadEx@44
NtCreateTimer@16
NtCreateToken@52
NtCreateTransaction@40
NtCreateTransactionManager@24
NtCreateUserProcess@44
NtCreateWaitablePort@20
NtCreateWorkerFactory@40
NtCurrentTeb@0
NtDebugActiveProcess@8
NtDebugContinue@12
NtDelayExecution@8
NtDeleteAtom@4
NtDeleteBootEntry@4
NtDeleteDriverEntry@4
NtDeleteFile@4
NtDeleteKey@4
NtDeleteObjectAuditAlarm@12
NtDeletePrivateNamespace@4
NtDeleteValueKey@8
NtDeviceIoControlFile@40
NtDisableLastKnownGood@0
NtDisplayString@4
NtDrawText@4
NtDuplicateObject@28
NtDuplicateToken@24
NtEnableLastKnownGood@0
NtEnumerateBootEntries@8
NtEnumerateDriverEntries@8
NtEnumerateKey@24
NtEnumerateSystemEnvironmentValuesEx@12
NtEnumerateTransactionObject@20
NtEnumerateValueKey@24
NtExtendSection@8
NtFilterToken@24
NtFindAtom@12
NtFlushBuffersFile@8
NtFlushInstallUILanguage@8
NtFlushInstructionCache@12
NtFlushKey@4
NtFlushProcessWriteBuffers@0
NtFlushVirtualMemory@16
NtFlushWriteBuffer@0
NtFreeUserPhysicalPages@12
NtFreeVirtualMemory@16
NtFreezeRegistry@4
NtFreezeTransactions@8
NtFsControlFile@40
NtGetContextThread@8
NtGetCurrentProcessorNumber@0
NtGetDevicePowerState@8
NtGetMUIRegistryInfo@12
NtGetNextProcess@20
NtGetNextThread@24
NtGetNlsSectionPtr@20
NtGetNotificationResourceManager@28
NtGetPlugPlayEvent@16
NtGetTickCount@0
NtGetWriteWatch@28
NtImpersonateAnonymousToken@4
NtImpersonateClientOfPort@8
NtImpersonateThread@12
NtInitializeNlsFiles@16 ;Check!!! gendef says 12
NtInitializeRegistry@4
NtInitiatePowerAction@16
NtIsProcessInJob@8
NtIsSystemResumeAutomatic@0
NtIsUILanguageComitted@0
NtListenPort@8
NtLoadDriver@4
NtLoadKey2@12
NtLoadKey@8
NtLoadKeyEx@32
NtLockFile@40
NtLockProductActivationKeys@8
NtLockRegistryKey@4
NtLockVirtualMemory@16
NtMakePermanentObject@4
NtMakeTemporaryObject@4
NtMapCMFModule@24
NtMapUserPhysicalPages@12
NtMapUserPhysicalPagesScatter@12
NtMapViewOfSection@40
NtModifyBootEntry@4
NtModifyDriverEntry@4
NtNotifyChangeDirectoryFile@36
NtNotifyChangeKey@40
NtNotifyChangeMultipleKeys@48
NtNotifyChangeSession@32
NtOpenDirectoryObject@12
NtOpenEnlistment@20
NtOpenEvent@12
NtOpenEventPair@12
NtOpenFile@24
NtOpenIoCompletion@12
NtOpenJobObject@12
NtOpenKey@12
NtOpenKeyEx@16
NtOpenKeyTransacted@16
NtOpenKeyTransactedEx@20
NtOpenKeyedEvent@12
NtOpenMutant@12
NtOpenObjectAuditAlarm@48
NtOpenPrivateNamespace@16
NtOpenProcess@16
NtOpenProcessToken@12
NtOpenProcessTokenEx@16
NtOpenResourceManager@20
NtOpenSection@12
NtOpenSemaphore@12
NtOpenSession@12
NtOpenSymbolicLinkObject@12
NtOpenThread@16
NtOpenThreadToken@16
NtOpenThreadTokenEx@20
NtOpenTimer@12
NtOpenTransaction@20
NtOpenTransactionManager@24
NtPlugPlayControl@12
NtPowerInformation@20
NtPrePrepareComplete@8
NtPrePrepareEnlistment@8
NtPrepareComplete@8
NtPrepareEnlistment@8
NtPrivilegeCheck@12
NtPrivilegeObjectAuditAlarm@24
NtPrivilegedServiceAuditAlarm@20
NtPropagationComplete@16
NtPropagationFailed@12
NtProtectVirtualMemory@20
NtPulseEvent@8
NtQueryAttributesFile@8
NtQueryBootEntryOrder@8
NtQueryBootOptions@8
NtQueryDebugFilterState@8
NtQueryDefaultLocale@8
NtQueryDefaultUILanguage@4
NtQueryDirectoryFile@44
NtQueryDirectoryObject@28
NtQueryDriverEntryOrder@8
NtQueryEaFile@36
NtQueryEvent@20
NtQueryFullAttributesFile@8
NtQueryInformationAtom@20
NtQueryInformationEnlistment@20
NtQueryInformationFile@20
NtQueryInformationJobObject@20
NtQueryInformationPort@20
NtQueryInformationProcess@20
NtQueryInformationResourceManager@20
NtQueryInformationThread@20
NtQueryInformationToken@20
NtQueryInformationTransaction@20
NtQueryInformationTransactionManager@20
NtQueryInformationWorkerFactory@20
NtQueryInstallUILanguage@4
NtQueryIntervalProfile@8
NtQueryIoCompletion@20
NtQueryKey@20
NtQueryLicenseValue@20
NtQueryMultipleValueKey@24
NtQueryMutant@20
NtQueryObject@20
NtQueryOpenSubKeys@8
NtQueryOpenSubKeysEx@16
NtQueryPerformanceCounter@8
NtQueryPortInformationProcess@0
NtQueryQuotaInformationFile@36
NtQuerySection@20
NtQuerySecurityAttributesToken@24
NtQuerySecurityObject@20
NtQuerySemaphore@20
NtQuerySymbolicLinkObject@12
NtQuerySystemEnvironmentValue@16
NtQuerySystemEnvironmentValueEx@20
NtQuerySystemInformation@16
NtQuerySystemInformationEx@24
NtQuerySystemTime@4
NtQueryTimer@20
NtQueryTimerResolution@12
NtQueryValueKey@24
NtQueryVirtualMemory@24
NtQueryVolumeInformationFile@20
NtQueueApcThread@20
NtQueueApcThreadEx@24
NtRaiseException@12
NtRaiseHardError@24
NtReadFile@36
NtReadFileScatter@36
NtReadOnlyEnlistment@8
NtReadRequestData@24
NtReadVirtualMemory@20
NtRecoverEnlistment@8
NtRecoverResourceManager@4
NtRecoverTransactionManager@4
NtRegisterProtocolAddressInformation@20
NtRegisterThreadTerminatePort@4
NtReleaseCMFViewOwnership@0
NtReleaseKeyedEvent@16
NtReleaseMutant@8
NtReleaseSemaphore@12
NtReleaseWorkerFactoryWorker@4
NtRemoveIoCompletion@20
NtRemoveIoCompletionEx@24
NtRemoveProcessDebug@8
NtRenameKey@8
NtRenameTransactionManager@8
NtReplaceKey@12
NtReplacePartitionUnit@12
NtReplyPort@8
NtReplyWaitReceivePort@16
NtReplyWaitReceivePortEx@20
NtReplyWaitReplyPort@8
NtRequestDeviceWakeup@4
NtRequestPort@8
NtRequestWaitReplyPort@12
NtRequestWakeupLatency@4
NtResetEvent@8
NtResetWriteWatch@12
NtRestoreKey@12
NtResumeProcess@4
NtResumeThread@8
NtRollbackComplete@8
NtRollbackEnlistment@8
NtRollbackTransaction@8
NtRollforwardTransactionManager@8
NtSaveKey@8
NtSaveKeyEx@12
NtSaveMergedKeys@12
NtSecureConnectPort@36
NtSerializeBoot@0
NtSetBootEntryOrder@8
NtSetBootOptions@8
NtSetContextThread@8
NtSetDebugFilterState@12
NtSetDefaultHardErrorPort@4
NtSetDefaultLocale@8
NtSetDefaultUILanguage@4
NtSetDriverEntryOrder@8
NtSetEaFile@16
NtSetEvent@8
NtSetEventBoostPriority@4
NtSetHighEventPair@4
NtSetHighWaitLowEventPair@4
NtSetInformationDebugObject@20
NtSetInformationEnlistment@16
NtSetInformationFile@20
NtSetInformationJobObject@16
NtSetInformationKey@16
NtSetInformationObject@16
NtSetInformationProcess@16
NtSetInformationResourceManager@16
NtSetInformationThread@16
NtSetInformationToken@16
NtSetInformationTransaction@16
NtSetInformationTransactionManager@16
NtSetInformationWorkerFactory@16
NtSetIntervalProfile@8
NtSetIoCompletion@20
NtSetIoCompletionEx@24
NtSetLdtEntries@24
NtSetLowEventPair@4
NtSetLowWaitHighEventPair@4
NtSetQuotaInformationFile@16
NtSetSecurityObject@12
NtSetSystemEnvironmentValue@8
NtSetSystemEnvironmentValueEx@20
NtSetSystemInformation@12
NtSetSystemPowerState@12
NtSetSystemTime@8
NtSetThreadExecutionState@8
NtSetTimer@28
NtSetTimerEx@16
NtSetTimerResolution@12
NtSetUuidSeed@4
NtSetValueKey@24
NtSetVolumeInformationFile@20
NtShutdownSystem@4
NtShutdownWorkerFactory@8
NtSignalAndWaitForSingleObject@16
NtSinglePhaseReject@8
NtStartProfile@4
NtStopProfile@4
NtSuspendProcess@4
NtSuspendThread@8
NtSystemDebugControl@24
NtTerminateJobObject@8
NtTerminateProcess@8
NtTerminateThread@8
NtTestAlert@0
NtThawRegistry@0
NtThawTransactions@0
NtTraceControl@24
NtTraceEvent@16
NtTranslateFilePath@16
NtUmsThreadYield@4
NtUnloadDriver@4
NtUnloadKey2@8
NtUnloadKey@4
NtUnloadKeyEx@8
NtUnlockFile@20
NtUnlockVirtualMemory@16
NtUnmapViewOfSection@8
NtVdmControl@8
NtWaitForDebugEvent@16
NtWaitForKeyedEvent@16
NtWaitForMultipleObjects32@20
NtWaitForMultipleObjects@20
NtWaitForSingleObject@12
NtWaitForWorkViaWorkerFactory@8
NtWaitHighEventPair@4
NtWaitLowEventPair@4
NtWorkerFactoryWorkerReady@4
NtWow64CallFunction64@28
NtWow64CsrAllocateCaptureBuffer@8
NtWow64CsrAllocateMessagePointer@12
NtWow64CsrCaptureMessageBuffer@16
NtWow64CsrCaptureMessageString@20
NtWow64CsrClientCallServer@16
NtWow64CsrClientConnectToServer@20
NtWow64CsrFreeCaptureBuffer@4
NtWow64CsrGetProcessId@0
NtWow64CsrIdentifyAlertableThread@0
NtWow64CsrVerifyRegion@8
NtWow64DebuggerCall@20
NtWow64GetCurrentProcessorNumberEx@4
NtWow64GetNativeSystemInformation@16
NtWow64InterlockedPopEntrySList@4
NtWow64QueryInformationProcess64@20
NtWow64QueryVirtualMemory64@32
NtWow64ReadVirtualMemory64@28
NtWow64WriteVirtualMemory64@28
NtWriteFile@36
NtWriteFileGather@36
NtWriteRequestData@24
NtWriteVirtualMemory@20
NtYieldExecution@0
; Not sure, but we assume here standard DefWindowProc arguments
NtdllDefWindowProc_A@16
NtdllDefWindowProc_W@16
; Not sure, but we assume here standard DefDlgProc arguments
NtdllDialogWndProc_A@16
NtdllDialogWndProc_W@16
PfxFindPrefix@8
PfxInitialize@4
PfxInsertPrefix@12
PfxRemovePrefix@8
RtlAbortRXact@4
RtlAbsoluteToSelfRelativeSD@12
RtlAcquirePebLock@0
RtlAcquirePrivilege@16
RtlAcquireReleaseSRWLockExclusive@4
RtlAcquireResourceExclusive@8
RtlAcquireResourceShared@8
RtlAcquireSRWLockExclusive@4
RtlAcquireSRWLockShared@4
RtlActivateActivationContext@12
RtlActivateActivationContextEx@16
RtlAddAccessAllowedAce@16
RtlAddAccessAllowedAceEx@20
RtlAddAccessAllowedObjectAce@28
RtlAddAccessDeniedAce@16
RtlAddAccessDeniedAceEx@20
RtlAddAccessDeniedObjectAce@28
RtlAddAce@20
RtlAddActionToRXact@24
RtlAddAtomToAtomTable@12
RtlAddAttributeActionToRXact@32
RtlAddAuditAccessAce@24
RtlAddAuditAccessAceEx@28
RtlAddAuditAccessObjectAce@36
RtlAddCompoundAce@24
RtlAddIntegrityLabelToBoundaryDescriptor@8
RtlAddMandatoryAce@24
RtlAddRefActivationContext@4
RtlAddRange@36
RtlAddRefMemoryStream@4
RtlAddSIDToBoundaryDescriptor@8
RtlAddVectoredContinueHandler@8
RtlAddVectoredExceptionHandler@8
RtlAddressInSectionTable@12
RtlAdjustPrivilege@16
RtlAllocateActivationContextStack@4
RtlAllocateAndInitializeSid@44
RtlAllocateHandle@8
RtlAllocateHeap@12
RtlAllocateMemoryBlockLookaside@12
RtlAllocateMemoryZone@12
RtlAnsiCharToUnicodeChar@4
RtlAnsiStringToUnicodeSize@4
RtlAnsiStringToUnicodeString@12
RtlAppendAsciizToString@8
RtlAppendPathElement@12
RtlAppendStringToString@8
RtlAppendUnicodeStringToString@8
RtlAppendUnicodeToString@8
RtlApplicationVerifierStop@40
RtlApplyRXact@4
RtlApplyRXactNoFlush@4
RtlAreAllAccessesGranted@8
RtlAreAnyAccessesGranted@8
RtlAreBitsClear@12
RtlAreBitsSet@12
RtlAssert@16
RtlBarrier@8
RtlBarrierForDelete@8
RtlCallbackLpcClient@12
RtlCancelTimer@8
RtlCaptureContext@4
RtlCaptureStackBackTrace@16
RtlCaptureStackContext@12
RtlCharToInteger@12
RtlCheckForOrphanedCriticalSections@4
RtlCheckRegistryKey@8
RtlCleanUpTEBLangLists@0
RtlClearAllBits@4
RtlClearBits@12
RtlCloneMemoryStream@8
RtlCloneUserProcess@20
RtlCmDecodeMemIoResource@8
RtlCmEncodeMemIoResource@24
RtlCommitDebugInfo@8
RtlCommitMemoryStream@8
RtlCompactHeap@8
RtlCompareAltitudes@8
RtlCompareMemory@12
RtlCompareMemoryUlong@12
RtlCompareString@12
RtlCompareUnicodeString@12
RtlCompareUnicodeStrings@20
RtlCompressBuffer@32
RtlComputeCrc32@12
RtlComputeImportTableHash@12
RtlComputePrivatizedDllName_U@12
RtlConnectToSm@16
RtlConsoleMultiByteToUnicodeN@24
RtlContractHashTable@4
RtlConvertExclusiveToShared@4
RtlConvertLCIDToString@20
RtlConvertLongToLargeInteger@4
RtlConvertSharedToExclusive@4
RtlConvertSidToUnicodeString@12
RtlConvertToAutoInheritSecurityObject@24
RtlConvertUiListToApiList@12
RtlConvertUlongToLargeInteger@4
RtlCopyExtendedContext@12
RtlCopyLuid@8
RtlCopyLuidAndAttributesArray@12
RtlCopyMappedMemory@12
RtlCopyMemoryStreamTo@24
RtlCopyOutOfProcessMemoryStreamTo@24
RtlCopyRangeList@8
RtlCopySecurityDescriptor@8
RtlCopySid@12
RtlCopySidAndAttributesArray@28
RtlCopyString@8
RtlCopyUnicodeString@8
RtlCreateAcl@12
RtlCreateActivationContext@24
RtlCreateAndSetSD@20
RtlCreateAtomTable@8
RtlCreateBootStatusDataFile@4
RtlCreateBoundaryDescriptor@8
RtlCreateEnvironment@8
RtlCreateEnvironmentEx@12
RtlCreateHashTable@12
RtlCreateHeap@24
RtlCreateLpcServer@24
RtlCreateMemoryBlockLookaside@20
RtlCreateMemoryZone@12
RtlCreateProcessParameters@40
RtlCreateProcessParametersEx@44
RtlCreateProcessReflection@24
RtlCreateQueryDebugBuffer@8
RtlCreateRegistryKey@8
RtlCreateSecurityDescriptor@8
RtlCreateServiceSid@12
RtlCreateSystemVolumeInformationFolder@4
RtlCreateTagHeap@16
RtlCreateTimer@28
RtlCreateTimerQueue@4
RtlCreateUnicodeString@8
RtlCreateUnicodeStringFromAsciiz@8
RtlCreateUserProcess@40
RtlCreateUserSecurityObject@28
RtlCreateUserStack@24
RtlCreateUserThread@40
RtlCreateVirtualAccountSid@16
RtlCultureNameToLCID@8
RtlCustomCPToUnicodeN@24
RtlCutoverTimeToSystemTime@16
RtlDeCommitDebugInfo@12
RtlDeNormalizeProcessParams@4
RtlDeactivateActivationContext@8
RtlDebugPrintTimes@0
RtlDecodePointer@4
RtlDecodeSystemPointer@4
RtlDecompressBuffer@24
RtlDecompressFragment@32
RtlDefaultNpAcl@4
RtlDelete@4
RtlDeleteAce@8
RtlDeleteAtomFromAtomTable@8
RtlDeleteBarrier@4
RtlDeleteBoundaryDescriptor@4
RtlDeleteCriticalSection@4
RtlDeleteElementGenericTable@8
RtlDeleteElementGenericTableAvl@8
RtlDeleteHashTable@4
RtlDeleteNoSplay@8
RtlDeleteOwnersRanges@8
RtlDeleteRange@24
RtlDeleteRegistryValue@12
RtlDeleteResource@4
RtlDeleteSecurityObject@4
RtlDeleteTimer@12
RtlDeleteTimerQueue@4
RtlDeleteTimerQueueEx@8
RtlDeNormalizeProcessParams@4
RtlDeregisterSecureMemoryCacheCallback@4
RtlDeregisterWait@4
RtlDeregisterWaitEx@8
RtlDestroyAtomTable@4
RtlDestroyEnvironment@4
RtlDestroyHandleTable@4
RtlDestroyHeap@4
RtlDestroyMemoryBlockLookaside@4
RtlDestroyMemoryZone@4
RtlDestroyProcessParameters@4
RtlDestroyQueryDebugBuffer@4
RtlDetectHeapLeaks@0
RtlDetermineDosPathNameType_U@4
RtlDisableThreadProfiling@4
RtlDllShutdownInProgress@0
RtlDnsHostNameToComputerName@12
RtlDoesFileExists_U@4
RtlDosApplyFileIsolationRedirection_Ustr@36
RtlDosPathNameToNtPathName_U@16
RtlDosPathNameToNtPathName_U_WithStatus@16
RtlDosPathNameToRelativeNtPathName_U@16
RtlDosPathNameToRelativeNtPathName_U_WithStatus@16
RtlDosSearchPath_U@24
RtlDosSearchPath_Ustr@36
RtlDowncaseUnicodeChar@4
RtlDowncaseUnicodeString@12
RtlDumpResource@4
RtlDuplicateUnicodeString@12
RtlEmptyAtomTable@8
RtlEnableEarlyCriticalSectionEventCreation@0
RtlEnableThreadProfiling@20
RtlEncodePointer@4
RtlEncodeSystemPointer@4
RtlEndEnumerationHashTable@8
RtlEndWeakEnumerationHashTable@8
RtlEnlargedIntegerMultiply@8
RtlEnlargedUnsignedDivide@16
RtlEnlargedUnsignedMultiply@8
RtlEnterCriticalSection@4
RtlEnumProcessHeaps@8
RtlEnumerateEntryHashTable@8
RtlEnumerateGenericTable@8
RtlEnumerateGenericTableAvl@8
RtlEnumerateGenericTableLikeADirectory@28
RtlEnumerateGenericTableWithoutSplaying@8
RtlEnumerateGenericTableWithoutSplayingAvl@8
RtlEqualComputerName@8
RtlEqualDomainName@8
RtlEqualLuid@8
RtlEqualPrefixSid@8
RtlEqualSid@8
RtlEqualString@12
RtlEqualUnicodeString@12
RtlEraseUnicodeString@4
RtlEthernetAddressToStringA@8
RtlEthernetAddressToStringW@8
RtlEthernetStringToAddressA@12
RtlEthernetStringToAddressW@12
RtlExitUserProcess@4
; Not sure, but we assume @4
RtlExitUserThread@4
RtlExpandEnvironmentStrings@24
RtlExpandEnvironmentStrings_U@16
RtlExpandHashTable@4
RtlExtendMemoryBlockLookaside@8
RtlExtendMemoryZone@8
RtlExtendedIntegerMultiply@12
RtlExtendedLargeIntegerDivide@16
RtlExtendedMagicDivide@20
RtlExtendHeap@16
RtlFillMemory@12
RtlFillMemoryUlong@12
RtlFillMemoryUlonglong@16
RtlFinalReleaseOutOfProcessMemoryStream@4
RtlFindAceByType@12
RtlFindActivationContextSectionGuid@20
RtlFindActivationContextSectionString@20
RtlFindCharInUnicodeString@16
RtlFindClearBits@12
RtlFindClearBitsAndSet@12
RtlFindClearRuns@16
RtlFindClosestEncodableLength@12
RtlFindLastBackwardRunClear@12
RtlFindLeastSignificantBit@8
RtlFindLongestRunClear@8
RtlFindLongestRunSet@8
RtlFindMessage@20
RtlFindMostSignificantBit@8
RtlFindNextForwardRunClear@12
RtlFindRange@48
RtlFindSetBits@12
RtlFindSetBitsAndClear@12
RtlFirstEntrySList@4
RtlFirstFreeAce@8
RtlFlsAlloc@8
RtlFlsFree@4
RtlFlushSecureMemoryCache@8
RtlFormatCurrentUserKeyPath@4
RtlFormatMessage@36
RtlFormatMessageEx@40
RtlFreeActivationContextStack@4
RtlFreeAnsiString@4
RtlFreeHandle@8
RtlFreeHeap@12
RtlFreeMemoryBlockLookaside@8
RtlFreeOemString@4
RtlFreeSid@4
RtlFreeThreadActivationContextStack@0
RtlFreeUnicodeString@4
RtlFreeUserStack@4
RtlFreeUserThreadStack@8
RtlGUIDFromString@8
RtlGenerate8dot3Name@16
RtlGetAce@12
RtlGetActiveActivationContext@4
RtlGetCallersAddress@8
RtlGetCompressionWorkSpaceSize@12
RtlGetControlSecurityDescriptor@12
RtlGetCriticalSectionRecursionCount@4
RtlGetCurrentDirectory_U@8
RtlGetCurrentPeb@0
RtlGetCurrentProcessorNumber@0
RtlGetCurrentProcessorNumberEx@4
RtlGetCurrentTransaction@0
RtlGetDaclSecurityDescriptor@16
RtlGetElementGenericTable@8
RtlGetElementGenericTableAvl@8
RtlGetEnabledExtendedFeatures@8
RtlGetExtendedContextLength@8
RtlGetExtendedFeaturesMask@4
RtlGetFileMUIPath@28
RtlGetFirstRange@12
RtlGetFrame@0
RtlGetFullPathName_U@16
RtlGetFullPathName_UEx@20
RtlGetFullPathName_UstrEx@32
RtlGetGroupSecurityDescriptor@12
RtlGetIntegerAtom@8
RtlGetLastNtStatus@0
RtlGetLastWin32Error@0
RtlGetLengthWithoutLastFullDosOrNtPathElement@12
RtlGetLengthWithoutTrailingPathSeperators@12
RtlGetLocaleFileMappingAddress@12
RtlGetLongestNtPathLength@0
RtlGetNativeSystemInformation@16
RtlGetNextRange@12
RtlGetNextEntryHashTable@8
RtlGetNtGlobalFlags@0
RtlGetNtProductType@4
RtlGetNtVersionNumbers@12
RtlGetOwnerSecurityDescriptor@12
RtlGetParentLocaleName@16
RtlGetProcessHeaps@8
RtlGetProcessPreferredUILanguages@16
RtlGetProductInfo@20
RtlGetSaclSecurityDescriptor@16
RtlGetSecurityDescriptorRMControl@8
RtlGetSetBootStatusData@24
RtlGetSystemPreferredUILanguages@20
RtlGetThreadErrorMode@0
RtlGetThreadLangIdByIndex@16
RtlGetThreadPreferredUILanguages@16
RtlGetUILanguageInfo@20
RtlGetUnloadEventTrace@0
RtlGetUnloadEventTraceEx@12
RtlGetUserInfoHeap@20
RtlGetUserPreferredUILanguages@20
RtlGetVersion@4
RtlGUIDFromString@8
RtlHashUnicodeString@16
RtlHeapTrkInitialize@4
RtlIdentifierAuthoritySid@4
RtlIdnToAscii@20
RtlIdnToNameprepUnicode@20
RtlIdnToUnicode@20
RtlImageDirectoryEntryToData@16
RtlImageNtHeader@4
RtlImageNtHeaderEx@20
RtlImageRvaToSection@12
RtlImageRvaToVa@16
RtlImpersonateLpcClient@8
RtlImpersonateSelf@4
RtlImpersonateSelfEx@12
RtlInitAnsiString@8
RtlInitAnsiStringEx@8
RtlInitBarrier@12
RtlInitCodePageTable@8
RtlInitEnumerationHashTable@8
RtlInitMemoryStream@4
RtlInitNlsTables@16
RtlInitOutOfProcessMemoryStream@4
RtlInitString@8
RtlInitUnicodeString@8
RtlInitUnicodeStringEx@8
RtlInitWeakEnumerationHashTable@8
RtlInitializeAtomPackage@4
RtlInitializeBitMap@12
RtlInitializeConditionVariable@4
RtlInitializeContext@20
RtlInitializeCriticalSection@4
RtlInitializeCriticalSectionAndSpinCount@8
RtlInitializeCriticalSectionEx@12
RtlInitializeExceptionChain@4
RtlInitializeExtendedContext@12
RtlInitializeGenericTable@20
RtlInitializeGenericTableAvl@20
RtlInitializeHandleTable@12
RtlInitializeNtUserPfn@24
RtlInitializeRXact@12
RtlInitializeResource@4
RtlInitializeSListHead@4
RtlInitializeSRWLock@4
RtlInitializeSid@12
RtlInsertElementGenericTable@16
RtlInsertElementGenericTableAvl@16
RtlInsertElementGenericTableFull@24
RtlInsertElementGenericTableFullAvl@24
RtlInsertEntryHashTable@16
RtlInt64ToUnicodeString@16
RtlIntegerToChar@16
RtlIntegerToUnicodeString@12
RtlInterlockedClearBitRun@12
RtlInterlockedCompareExchange64@20
RtlInterlockedFlushSList@4
RtlInterlockedPopEntrySList@4
RtlInterlockedPushEntrySList@8
RtlInvertRangeList@8
RtlInterlockedSetBitRun@12
RtlIoDecodeMemIoResource@16
RtlIoEncodeMemIoResource@40
RtlIpv4AddressToStringA@8
RtlIpv4AddressToStringExA@16
RtlIpv4AddressToStringExW@16
RtlIpv4AddressToStringW@8
RtlIpv4StringToAddressA@16
RtlIpv4StringToAddressExA@16
RtlIpv4StringToAddressExW@16
RtlIpv4StringToAddressW@16
RtlIpv6AddressToStringA@8
RtlIpv6AddressToStringExA@20
RtlIpv6AddressToStringExW@20
RtlIpv6AddressToStringW@8
RtlIpv6StringToAddressA@12
RtlIpv6StringToAddressExA@16
RtlIpv6StringToAddressExW@16
RtlIpv6StringToAddressW@12
RtlIsActivationContextActive@4
RtlIsCriticalSectionLocked@4
RtlIsCriticalSectionLockedByThread@4
RtlIsCurrentThreadAttachExempt@0
RtlIsDosDeviceName_U@4
RtlIsGenericTableEmpty@4
RtlIsGenericTableEmptyAvl@4
RtlIsNameInExpression@16
RtlIsNameLegalDOS8Dot3@12
RtlIsNormalizedString@16
RtlIsRangeAvailable@40
RtlIsTextUnicode@12
RtlIsThreadWithinLoaderCallout@0
RtlIsValidHandle@8
RtlIsValidIndexHandle@12
RtlIsValidLocaleName@8
RtlKnownExceptionFilter@4
RtlLCIDToCultureName@8
RtlLargeIntegerAdd@16
RtlLargeIntegerArithmeticShift@12
RtlLargeIntegerDivide@20
RtlLargeIntegerNegate@8
RtlLargeIntegerShiftLeft@12
RtlLargeIntegerShiftRight@12
RtlLargeIntegerSubtract@16
RtlLargeIntegerToChar@16
RtlLcidToLocaleName@16
RtlLeaveCriticalSection@4
RtlLengthRequiredSid@4
RtlLengthSecurityDescriptor@4
RtlLengthSid@4
RtlLoadString@32
RtlLocalTimeToSystemTime@8
RtlLocaleNameToLcid@12
RtlLocateExtendedFeature@12
RtlLocateLegacyContext@8
RtlLockBootStatusData@4
RtlLockCurrentThread@0
RtlLockHeap@4
RtlLockMemoryBlockLookaside@4
RtlLockMemoryStreamRegion@24
RtlLockMemoryZone@4
RtlLockModuleSection@4
RtlLogStackBackTrace@0
RtlLookupAtomInAtomTable@12
RtlLookupElementGenericTable@8
RtlLookupElementGenericTableAvl@8
RtlLookupElementGenericTableFull@16
RtlLookupElementGenericTableFullAvl@16
RtlLookupEntryHashTable@12
RtlMakeSelfRelativeSD@12
RtlMapGenericMask@8
RtlMapSecurityErrorToNtStatus@4
RtlMergeRangeLists@16
RtlMoveMemory@12
RtlMultiAppendUnicodeStringBuffer@12
RtlMultiByteToUnicodeN@20
RtlMultiByteToUnicodeSize@12
RtlMultipleAllocateHeap@20
RtlMultipleFreeHeap@16
RtlNewInstanceSecurityObject@40
RtlNewSecurityGrantedAccess@24
RtlNewSecurityObject@24
RtlNewSecurityObjectEx@32
RtlNewSecurityObjectWithMultipleInheritance@36
RtlNormalizeProcessParams@4
RtlNormalizeString@20
RtlNtPathNameToDosPathName@16
RtlNtStatusToDosError@4
RtlNtStatusToDosErrorNoTeb@4
RtlNumberGenericTableElements@4
RtlNumberGenericTableElementsAvl@4
RtlNumberOfClearBits@4
RtlNumberOfSetBits@4
RtlNumberOfSetBitsUlongPtr@4
RtlOemStringToUnicodeSize@4
RtlOemStringToUnicodeString@12
RtlOemToUnicodeN@20
RtlOpenCurrentUser@8
RtlOwnerAcesPresent@4
RtlPcToFileHeader@8
RtlPinAtomInAtomTable@8
RtlPopFrame@4
RtlPrefixString@12
RtlPrefixUnicodeString@12
RtlProcessFlsData@4
RtlProtectHeap@8
RtlPushFrame@4
RtlQueryActivationContextApplicationSettings@28
RtlQueryAtomInAtomTable@24
RtlQueryCriticalSectionOwner@4
RtlQueryDepthSList@4
RtlQueryDynamicTimeZoneInformation@4
RtlQueryElevationFlags@4
RtlQueryEnvironmentVariable@24
RtlQueryEnvironmentVariable_U@12
RtlQueryHeapInformation@20
RtlQueryInformationAcl@16
RtlQueryInformationActivationContext@28
RtlQueryInformationActiveActivationContext@16
RtlQueryInterfaceMemoryStream@12
RtlQueryModuleInformation@12
RtlQueryPerformanceCounter@4
RtlQueryPerformanceFrequency@4
RtlQueryProcessBackTraceInformation@4
RtlQueryProcessDebugInformation@12
RtlQueryProcessHeapInformation@4
RtlQueryProcessLockInformation@4
RtlQueryRegistryValues@20
RtlQuerySecurityObject@20
RtlQueryTagHeap@20
RtlQueryThreadProfiling@8
RtlQueryTimeZoneInformation@4
RtlQueueApcWow64Thread@20
RtlQueueWorkItem@12
RtlRaiseException@4
RtlRaiseStatus@4
RtlRandom@4
RtlRandomEx@4
RtlReAllocateHeap@16
RtlReadMemoryStream@16
RtlReadOutOfProcessMemoryStream@16
RtlReadThreadProfilingData@12
RtlRealPredecessor@4
RtlRealSuccessor@4
RtlRegisterSecureMemoryCacheCallback@4
RtlRegisterThreadWithCsrss@0
RtlRegisterWait@24
RtlReleaseActivationContext@4
RtlReleaseMemoryStream@4
RtlReleasePebLock@0
RtlReleasePrivilege@4
RtlReleaseRelativeName@4
RtlReleaseResource@4
RtlReleaseSRWLockExclusive@4
RtlReleaseSRWLockShared@4
RtlRemoteCall@28
RtlRemoveEntryHashTable@12
RtlRemovePrivileges@12
RtlRemoveVectoredContinueHandler@4
RtlRemoveVectoredExceptionHandler@4
RtlReplaceSidInSd@16
RtlReportException@12
RtlReportSilentProcessExit@8
RtlReportSqmEscalation@24
RtlResetMemoryBlockLookaside@4
RtlResetMemoryZone@4
RtlResetRtlTranslations@4
RtlRestoreLastWin32Error@4
RtlRetrieveNtUserPfn@12
RtlRevertMemoryStream@4
RtlRunDecodeUnicodeString@8
RtlRunEncodeUnicodeString@8
RtlRunOnceBeginInitialize@12
RtlRunOnceComplete@12
RtlRunOnceExecuteOnce@16
RtlRunOnceInitialize@4
RtlSecondsSince1970ToTime@8
RtlSecondsSince1980ToTime@8
RtlSeekMemoryStream@20
RtlSelfRelativeToAbsoluteSD2@8
RtlSelfRelativeToAbsoluteSD@44
RtlSendMsgToSm@8
RtlSetAllBits@4
RtlSetAttributesSecurityDescriptor@12
RtlSetBits@12
RtlSetControlSecurityDescriptor@12
RtlSetCriticalSectionSpinCount@8
RtlSetCurrentDirectory_U@4
RtlSetCurrentEnvironment@8
RtlSetCurrentTransaction@4
RtlSetDaclSecurityDescriptor@16
RtlSetDynamicTimeZoneInformation@4
RtlSetEnvironmentStrings@8
RtlSetEnvironmentVar@20
RtlSetEnvironmentVariable@12
RtlSetExtendedFeaturesMask@12
RtlSetGroupSecurityDescriptor@12
RtlSetHeapInformation@16
RtlSetInformationAcl@16
RtlSetIoCompletionCallback@12
RtlSetLastWin32Error@4
RtlSetLastWin32ErrorAndNtStatusFromNtStatus@4
RtlSetMemoryStreamSize@12
RtlSetOwnerSecurityDescriptor@12
RtlSetProcessDebugInformation@12
RtlSetProcessIsCritical@0
RtlSetProcessPreferredUILanguages@12
RtlSetSaclSecurityDescriptor@16
RtlSetSecurityDescriptorRMControl@8
RtlSetSecurityObject@20
RtlSetSecurityObjectEx@24
RtlSetThreadErrorMode@8
RtlSetThreadIsCritical@0
RtlSetThreadPoolStartFunc@8
RtlSetThreadPreferredUILanguages@12
RtlSetTimeZoneInformation@4
RtlSetTimer@28
RtlSetUnhandledExceptionFilter@4
RtlSetUserCallbackExceptionFilter@4
RtlSetUserFlagsHeap@20
RtlSetUserValueHeap@16
RtlShutdownLpcServer@4
RtlSidDominates@12
RtlSidEqualLevel@12
RtlSidHashInitialize@12
RtlSidHashLookup@8
RtlSidIsHigherLevel@12
RtlSizeHeap@12
RtlSleepConditionVariableCS@12
RtlSleepConditionVariableSRW@16
RtlSplay@4
RtlStartRXact@4
RtlStatMemoryStream@12
RtlStringFromGUID@8
RtlSubAuthorityCountSid@4
RtlSubAuthoritySid@8
RtlSubtreePredecessor@4
RtlSubtreeSuccessor@4
RtlSystemTimeToLocalTime@8
RtlTestBit@8
RtlTimeFieldsToTime@8
RtlTimeToElapsedTimeFields@8
RtlTimeToSecondsSince1970@8
RtlTimeToSecondsSince1980@8
RtlTimeToTimeFields@8
RtlTraceDatabaseAdd@16
RtlTraceDatabaseCreate@20
RtlTraceDatabaseDestroy@4
RtlTraceDatabaseEnumerate@12
RtlTraceDatabaseFind@16
RtlTraceDatabaseLock@4
RtlTraceDatabaseUnlock@4
RtlTraceDatabaseValidate@4
RtlTryAcquirePebLock@0
RtlTryAcquireSRWLockExclusive@4
RtlTryAcquireSRWLockShared@4
RtlTryEnterCriticalSection@4
RtlUTF8ToUnicodeN@20
RtlUnhandledExceptionFilter2@8
RtlUnhandledExceptionFilter@4
RtlUnicodeStringToAnsiSize@4
RtlUnicodeStringToAnsiString@12
RtlUnicodeStringToCountedOemString@12
RtlUnicodeStringToInteger@12
RtlUnicodeStringToOemSize@4
RtlUnicodeStringToOemString@12
RtlUnicodeToCustomCPN@24
RtlUnicodeToMultiByteN@20
RtlUnicodeToMultiByteSize@12
RtlUnicodeToOemN@20
RtlUnicodeToUTF8N@20
RtlUniform@4
RtlUnlockBootStatusData@4
RtlUnlockCurrentThread@0
RtlUnlockHeap@4
RtlUnlockMemoryBlockLookaside@4
RtlUnlockMemoryStreamRegion@24
RtlUnlockMemoryZone@4
RtlUnlockModuleSection@4
RtlUnwind@16
RtlUpcaseUnicodeChar@4
RtlUpcaseUnicodeString@12
RtlUpcaseUnicodeStringToAnsiString@12
RtlUpcaseUnicodeStringToCountedOemString@12
RtlUpcaseUnicodeStringToOemString@12
RtlUpcaseUnicodeToCustomCPN@24
RtlUpcaseUnicodeToMultiByteN@20
RtlUpcaseUnicodeToOemN@20
RtlUpdateClonedCriticalSection@4
RtlUpdateClonedSRWLock@8
RtlUpdateTimer@16
RtlUpperChar@4
RtlUpperString@8
RtlUsageHeap@12
; Not sure.
RtlUserThreadStart
RtlValidAcl@4
RtlValidRelativeSecurityDescriptor@12
RtlValidSecurityDescriptor@4
RtlValidSid@4
RtlValidateHeap@12
RtlValidateProcessHeaps@0
RtlValidateUnicodeString@8
RtlVerifyVersionInfo@16
RtlWakeAllConditionVariable@4
RtlWakeConditionVariable@4
RtlWalkFrameChain@12
RtlWalkHeap@8
RtlWeaklyEnumerateEntryHashTable@8
RtlWerpReportException@16
RtlWow64CallFunction64@28
RtlWow64EnableFsRedirection@4
RtlWow64EnableFsRedirectionEx@8
RtlWow64LogMessageInEventLogger@12
RtlWriteMemoryStream@16
RtlWriteRegistryValue@24
RtlZeroHeap@8
RtlZeroMemory@8
RtlZombifyActivationContext@4
RtlpApplyLengthFunction@16
RtlpCheckDynamicTimeZoneInformation@8
RtlpCleanupRegistryKeys@0
RtlpConvertCultureNamesToLCIDs@8
RtlpConvertLCIDsToCultureNames@8
RtlpCreateProcessRegistryInfo@4
RtlpEnsureBufferSize@12
RtlpGetLCIDFromLangInfoNode@12
RtlpGetNameFromLangInfoNode@12
RtlpGetSystemDefaultUILanguage@4 ; Check!!! gendef says @8
RtlpGetUserOrMachineUILanguage4NLS@12
RtlpInitializeLangRegistryInfo@4
RtlpIsQualifiedLanguage@12
RtlpLoadMachineUIByPolicy@12
RtlpLoadUserUIByPolicy@12
RtlpMuiFreeLangRegistryInfo@4
RtlpMuiRegCreateRegistryInfo@0
RtlpMuiRegFreeRegistryInfo@8
RtlpMuiRegLoadRegistryInfo@8
RtlpNotOwnerCriticalSection@0 ; Check!!! gebdef says @4
RtlpNtCreateKey@24
RtlpNtEnumerateSubKey@16
RtlpNtMakeTemporaryKey@4
RtlpNtOpenKey@16
RtlpNtQueryValueKey@20
RtlpNtSetValueKey@16
RtlpQueryDefaultUILanguage@8
; Not sure.
RtlpQueryProcessDebugInformationRemote
RtlpRefreshCachedUILanguage@8
RtlpSetInstallLanguage@8
RtlpSetPreferredUILanguages@12
RtlpSetUserPreferredUILanguages@12
RtlpUnWaitCriticalSection@4
RtlpVerifyAndCommitUILanguageSettings@4
RtlpWaitForCriticalSection@4
RtlxAnsiStringToUnicodeSize@4
RtlxOemStringToUnicodeSize@4
RtlxUnicodeStringToAnsiSize@4
RtlxUnicodeStringToOemSize@4
SbExecuteProcedure@20
SbSelectProcedure@16
ShipAssert@8
ShipAssertGetBufferInfo@8
ShipAssertMsgA@12
ShipAssertMsgW@12
TpAllocAlpcCompletion@20
TpAllocAlpcCompletionEx@20
TpAllocCleanupGroup@4
TpAllocIoCompletion@20
TpAllocPool@8
TpAllocTimer@16
TpAllocWait@16
TpAllocWork@16
TpAlpcRegisterCompletionList@4
TpAlpcUnregisterCompletionList@4
TpCallbackIndependent@4
TpCallbackLeaveCriticalSectionOnCompletion@8
TpCallbackMayRunLong@4
TpCallbackReleaseMutexOnCompletion@8
TpCallbackReleaseSemaphoreOnCompletion@12
TpCallbackSetEventOnCompletion@8
TpCallbackUnloadDllOnCompletion@8
TpCancelAsyncIoOperation@4
TpCaptureCaller@4
TpCheckTerminateWorker@4
TpDbgDumpHeapUsage@12
TpDbgGetFreeInfo@8
TpDbgSetLogRoutine@4
TpDisablePoolCallbackChecks@4
TpDisassociateCallback@4
TpIsTimerSet@4
TpPoolFreeUnusedNodes@4
TpPostWork@4
TpQueryPoolStackInformation@8
TpReleaseAlpcCompletion@4
TpReleaseCleanupGroup@4
TpReleaseCleanupGroupMembers@12
TpReleaseIoCompletion@4
TpReleasePool@4
TpReleaseTimer@4
TpReleaseWait@4
TpReleaseWork@4
TpSetDefaultPoolMaxThreads@4
TpSetDefaultPoolStackInformation@4
TpSetPoolMaxThreads@8
TpSetPoolMinThreads@8
TpSetPoolStackInformation@8
TpSetTimer@16
TpSetWait@12
TpSimpleTryPost@12
TpStartAsyncIoOperation@4
TpWaitForAlpcCompletion@4
TpWaitForIoCompletion@8
TpWaitForTimer@8
TpWaitForWait@8
TpWaitForWork@8
VerSetConditionMask@16
WerCheckEventEscalation@8
WerReportSQMEvent@12
WerReportWatsonEvent@16
WerReportSQMEvent@16
WinSqmAddToAverageDWORD@12
WinSqmAddToStream@16
WinSqmAddToStreamEx@20
WinSqmCheckEscalationAddToStreamEx@20
WinSqmCheckEscalationSetDWORD64@20
WinSqmCheckEscalationSetDWORD@16
WinSqmCheckEscalationSetString@16
WinSqmCommonDatapointDelete@4
WinSqmCommonDatapointSetDWORD64@16
WinSqmCommonDatapointSetDWORD@12
WinSqmCommonDatapointSetStreamEx@20
WinSqmCommonDatapointSetString@12
WinSqmEndSession@4
WinSqmEventEnabled@8
WinSqmEventWrite@12
WinSqmGetEscalationRuleStatus@8
WinSqmGetInstrumentationProperty@16
WinSqmIncrementDWORD@12
WinSqmIsOptedIn@0
WinSqmIsOptedInEx@4
WinSqmSetDWORD64@16
WinSqmSetDWORD@12
WinSqmSetEscalationInfo@16
WinSqmSetIfMaxDWORD@12
WinSqmSetIfMinDWORD@12
WinSqmSetString@12
WinSqmStartSession@12
ZwAcceptConnectPort@24
ZwAccessCheck@32
ZwAccessCheckAndAuditAlarm@44
ZwAccessCheckByType@44
ZwAccessCheckByTypeAndAuditAlarm@64
ZwAccessCheckByTypeResultList@44
ZwAccessCheckByTypeResultListAndAuditAlarm@64
ZwAccessCheckByTypeResultListAndAuditAlarmByHandle@68
ZwAcquireCMFViewOwnership@12
ZwAddAtom@12
ZwAddBootEntry@8
ZwAddDriverEntry@8
ZwAdjustGroupsToken@24
ZwAdjustPrivilegesToken@24
ZwAlertResumeThread@8
ZwAlertThread@4
ZwAllocateLocallyUniqueId@4
ZwAllocateReserveObject@12
ZwAllocateUserPhysicalPages@12
ZwAllocateUuids@16
ZwAllocateVirtualMemory@24
ZwAlpcAcceptConnectPort@36
ZwAlpcCancelMessage@12
ZwAlpcConnectPort@44
ZwAlpcCreatePort@12
ZwAlpcCreatePortSection@24
ZwAlpcCreateResourceReserve@16
ZwAlpcCreateSectionView@12
ZwAlpcCreateSecurityContext@12
ZwAlpcDeletePortSection@12
ZwAlpcDeleteResourceReserve@12
ZwAlpcDeleteSectionView@12
ZwAlpcDeleteSecurityContext@12
ZwAlpcDisconnectPort@8
ZwAlpcImpersonateClientOfPort@12
ZwAlpcOpenSenderProcess@24
ZwAlpcOpenSenderThread@24
ZwAlpcQueryInformation@20
ZwAlpcQueryInformationMessage@24
ZwAlpcRevokeSecurityContext@12
ZwAlpcSendWaitReceivePort@32
ZwAlpcSetInformation@16
ZwApphelpCacheControl@8
ZwAreMappedFilesTheSame@8
ZwAssignProcessToJobObject@8
ZwCallbackReturn@12
ZwCancelDeviceWakeupRequest@4
ZwCancelIoFile@8
ZwCancelIoFileEx@12
ZwCancelSynchronousIoFile@12
ZwCancelTimer@8
ZwClearEvent@4
ZwClose@4
ZwCloseObjectAuditAlarm@12
ZwCommitComplete@8
ZwCommitEnlistment@8
ZwCommitTransaction@8
ZwCompactKeys@8
ZwCompareTokens@12
ZwCompleteConnectPort@4
ZwCompressKey@4
ZwConnectPort@32
ZwContinue@8
ZwCreateDebugObject@16
ZwCreateDirectoryObject@12
ZwCreateEnlistment@32
ZwCreateEvent@20
ZwCreateEventPair@12
ZwCreateFile@44
ZwCreateIoCompletion@16
ZwCreateJobObject@12
ZwCreateJobSet@12
ZwCreateKey@28
ZwCreateKeyTransacted@32
ZwCreateKeyedEvent@16
ZwCreateMailslotFile@32
ZwCreateMutant@16
ZwCreateNamedPipeFile@56
ZwCreatePagingFile@16
ZwCreatePort@20
ZwCreatePrivateNamespace@16
ZwCreateProcess@32
ZwCreateProcessEx@36
ZwCreateProfile@36
ZwCreateProfileEx@40
ZwCreateResourceManager@28
ZwCreateSection@28
ZwCreateSemaphore@20
ZwCreateSymbolicLinkObject@16
ZwCreateThread@32
ZwCreateThreadEx@44
ZwCreateTimer@16
ZwCreateToken@52
ZwCreateTransaction@40
ZwCreateTransactionManager@24
ZwCreateUserProcess@44
ZwCreateWaitablePort@20
ZwCreateWorkerFactory@40
ZwDebugActiveProcess@8
ZwDebugContinue@12
ZwDelayExecution@8
ZwDeleteAtom@4
ZwDeleteBootEntry@4
ZwDeleteDriverEntry@4
ZwDeleteFile@4
ZwDeleteKey@4
ZwDeleteObjectAuditAlarm@12
ZwDeletePrivateNamespace@4
ZwDeleteValueKey@8
ZwDeviceIoControlFile@40
ZwDisableLastKnownGood@0
ZwDisplayString@4
ZwDrawText@4
ZwDuplicateObject@28
ZwDuplicateToken@24
ZwEnableLastKnownGood@0
ZwEnumerateBootEntries@8
ZwEnumerateDriverEntries@8
ZwEnumerateKey@24
ZwEnumerateSystemEnvironmentValuesEx@12
ZwEnumerateTransactionObject@20
ZwEnumerateValueKey@24
ZwExtendSection@8
ZwFilterToken@24
ZwFindAtom@12
ZwFlushBuffersFile@8
ZwFlushInstallUILanguage@8
ZwFlushInstructionCache@12
ZwFlushKey@4
ZwFlushProcessWriteBuffers@0
ZwFlushVirtualMemory@16
ZwFlushWriteBuffer@0
ZwFreeUserPhysicalPages@12
ZwFreeVirtualMemory@16
ZwFreezeRegistry@4
ZwFreezeTransactions@8
ZwFsControlFile@40
ZwGetContextThread@8
ZwGetCurrentProcessorNumber@0
ZwGetDevicePowerState@8
ZwGetMUIRegistryInfo@12
ZwGetNextProcess@20
ZwGetNextThread@24
ZwGetNlsSectionPtr@20
ZwGetNotificationResourceManager@28
ZwGetPlugPlayEvent@16
ZwGetTickCount@0
ZwGetWriteWatch@28
ZwImpersonateAnonymousToken@4
ZwImpersonateClientOfPort@8
ZwImpersonateThread@12
ZwInitializeNlsFiles@16
ZwInitializeRegistry@4
ZwInitiatePowerAction@16
ZwIsProcessInJob@8
ZwIsSystemResumeAutomatic@0
ZwIsUILanguageComitted@0
ZwListenPort@8
ZwLoadDriver@4
ZwLoadKey2@12
ZwLoadKey@8
ZwLoadKeyEx@32
ZwLockFile@40
ZwLockProductActivationKeys@8
ZwLockRegistryKey@4
ZwLockVirtualMemory@16
ZwMakePermanentObject@4
ZwMakeTemporaryObject@4
ZwMapCMFModule@24
ZwMapUserPhysicalPages@12
ZwMapUserPhysicalPagesScatter@12
ZwMapViewOfSection@40
ZwModifyBootEntry@4
ZwModifyDriverEntry@4
ZwNotifyChangeDirectoryFile@36
ZwNotifyChangeKey@40
ZwNotifyChangeMultipleKeys@48
ZwNotifyChangeSession@32
ZwOpenDirectoryObject@12
ZwOpenEnlistment@20
ZwOpenEvent@12
ZwOpenEventPair@12
ZwOpenFile@24
ZwOpenIoCompletion@12
ZwOpenJobObject@12
ZwOpenKey@12
ZwOpenKeyEx@16
ZwOpenKeyTransacted@16
ZwOpenKeyTransactedEx@20
ZwOpenKeyedEvent@12
ZwOpenMutant@12
ZwOpenObjectAuditAlarm@48
ZwOpenPrivateNamespace@16
ZwOpenProcess@16
ZwOpenProcessToken@12
ZwOpenProcessTokenEx@16
ZwOpenResourceManager@20
ZwOpenSection@12
ZwOpenSemaphore@12
ZwOpenSession@12
ZwOpenSymbolicLinkObject@12
ZwOpenThread@16
ZwOpenThreadToken@16
ZwOpenThreadTokenEx@20
ZwOpenTimer@12
ZwOpenTransaction@20
ZwOpenTransactionManager@24
ZwPlugPlayControl@12
ZwPowerInformation@20
ZwPrePrepareComplete@8
ZwPrePrepareEnlistment@8
ZwPrepareComplete@8
ZwPrepareEnlistment@8
ZwPrivilegeCheck@12
ZwPrivilegeObjectAuditAlarm@24
ZwPrivilegedServiceAuditAlarm@20
ZwPropagationComplete@16
ZwPropagationFailed@12
ZwProtectVirtualMemory@20
ZwPulseEvent@8
ZwQueryAttributesFile@8
ZwQueryBootEntryOrder@8
ZwQueryBootOptions@8
ZwQueryDebugFilterState@8
ZwQueryDefaultLocale@8
ZwQueryDefaultUILanguage@4
ZwQueryDirectoryFile@44
ZwQueryDirectoryObject@28
ZwQueryDriverEntryOrder@8
ZwQueryEaFile@36
ZwQueryEvent@20
ZwQueryFullAttributesFile@8
ZwQueryInformationAtom@20
ZwQueryInformationEnlistment@20
ZwQueryInformationFile@20
ZwQueryInformationJobObject@20
ZwQueryInformationPort@20
ZwQueryInformationProcess@20
ZwQueryInformationResourceManager@20
ZwQueryInformationThread@20
ZwQueryInformationToken@20
ZwQueryInformationTransaction@20
ZwQueryInformationTransactionManager@20
ZwQueryInformationWorkerFactory@20
ZwQueryInstallUILanguage@4
ZwQueryIntervalProfile@8
ZwQueryIoCompletion@20
ZwQueryKey@20
ZwQueryLicenseValue@20
ZwQueryMultipleValueKey@24
ZwQueryMutant@20
ZwQueryObject@20
ZwQueryOpenSubKeys@8
ZwQueryOpenSubKeysEx@16
ZwQueryPerformanceCounter@8
ZwQueryPortInformationProcess@0
ZwQueryQuotaInformationFile@36
ZwQuerySection@20
ZwQuerySecurityAttributesToken@24
ZwQuerySecurityObject@20
ZwQuerySemaphore@20
ZwQuerySymbolicLinkObject@12
ZwQuerySystemEnvironmentValue@16
ZwQuerySystemEnvironmentValueEx@20
ZwQuerySystemInformation@16
ZwQuerySystemInformationEx@24
ZwQuerySystemTime@4
ZwQueryTimer@20
ZwQueryTimerResolution@12
ZwQueryValueKey@24
ZwQueryVirtualMemory@24
ZwQueryVolumeInformationFile@20
ZwQueueApcThread@20
ZwQueueApcThreadEx@24
ZwRaiseException@12
ZwRaiseHardError@24
ZwReadFile@36
ZwReadFileScatter@36
ZwReadOnlyEnlistment@8
ZwReadRequestData@24
ZwReadVirtualMemory@20
ZwRecoverEnlistment@8
ZwRecoverResourceManager@4
ZwRecoverTransactionManager@4
ZwRegisterProtocolAddressInformation@20
ZwRegisterThreadTerminatePort@4
ZwReleaseCMFViewOwnership@0
ZwReleaseKeyedEvent@16
ZwReleaseMutant@8
ZwReleaseSemaphore@12
ZwReleaseWorkerFactoryWorker@4
ZwRemoveIoCompletion@20
ZwRemoveIoCompletionEx@24
ZwRemoveProcessDebug@8
ZwRenameKey@8
ZwRenameTransactionManager@8
ZwReplaceKey@12
ZwReplacePartitionUnit@12
ZwReplyPort@8
ZwReplyWaitReceivePort@16
ZwReplyWaitReceivePortEx@20
ZwReplyWaitReplyPort@8
ZwRequestDeviceWakeup@4
ZwRequestPort@8
ZwRequestWaitReplyPort@12
ZwRequestWakeupLatency@4
ZwResetEvent@8
ZwResetWriteWatch@12
ZwRestoreKey@12
ZwResumeProcess@4
ZwResumeThread@8
ZwRollbackComplete@8
ZwRollbackEnlistment@8
ZwRollbackTransaction@8
ZwRollforwardTransactionManager@8
ZwSaveKey@8
ZwSaveKeyEx@12
ZwSaveMergedKeys@12
ZwSecureConnectPort@36
ZwSerializeBoot@0
ZwSetBootEntryOrder@8
ZwSetBootOptions@8
ZwSetContextThread@8
ZwSetDebugFilterState@12
ZwSetDefaultHardErrorPort@4
ZwSetDefaultLocale@8
ZwSetDefaultUILanguage@4
ZwSetDriverEntryOrder@8
ZwSetEaFile@16
ZwSetEvent@8
ZwSetEventBoostPriority@4
ZwSetHighEventPair@4
ZwSetHighWaitLowEventPair@4
ZwSetInformationDebugObject@20
ZwSetInformationEnlistment@16
ZwSetInformationFile@20
ZwSetInformationJobObject@16
ZwSetInformationKey@16
ZwSetInformationObject@16
ZwSetInformationProcess@16
ZwSetInformationResourceManager@16
ZwSetInformationThread@16
ZwSetInformationToken@16
ZwSetInformationTransaction@16
ZwSetInformationTransactionManager@16
ZwSetInformationWorkerFactory@16
ZwSetIntervalProfile@8
ZwSetIoCompletion@20
ZwSetIoCompletionEx@24
ZwSetLdtEntries@24
ZwSetLowEventPair@4
ZwSetLowWaitHighEventPair@4
ZwSetQuotaInformationFile@16
ZwSetSecurityObject@12
ZwSetSystemEnvironmentValue@8
ZwSetSystemEnvironmentValueEx@20
ZwSetSystemInformation@12
ZwSetSystemPowerState@12
ZwSetSystemTime@8
ZwSetThreadExecutionState@8
ZwSetTimer@28
ZwSetTimerEx@16
ZwSetTimerResolution@12
ZwSetUuidSeed@4
ZwSetValueKey@24
ZwSetVolumeInformationFile@20
ZwShutdownSystem@4
ZwShutdownWorkerFactory@8
ZwSignalAndWaitForSingleObject@16
ZwSinglePhaseReject@8
ZwStartProfile@4
ZwStopProfile@4
ZwSuspendProcess@4
ZwSuspendThread@8
ZwSystemDebugControl@24
ZwTerminateJobObject@8
ZwTerminateProcess@8
ZwTerminateThread@8
ZwTestAlert@0
ZwThawRegistry@0
ZwThawTransactions@0
ZwTraceControl@24
ZwTraceEvent@16
ZwTranslateFilePath@16
ZwUmsThreadYield@4
ZwUnloadDriver@4
ZwUnloadKey2@8
ZwUnloadKey@4
ZwUnloadKeyEx@8
ZwUnlockFile@20
ZwUnlockVirtualMemory@16
ZwUnmapViewOfSection@8
ZwVdmControl@8
ZwWaitForDebugEvent@16
ZwWaitForKeyedEvent@16
ZwWaitForMultipleObjects32@20
ZwWaitForMultipleObjects@20
ZwWaitForSingleObject@12
ZwWaitForWorkViaWorkerFactory@8
ZwWaitHighEventPair@4
ZwWaitLowEventPair@4
ZwWorkerFactoryWorkerReady@4
ZwWow64CallFunction64@28
ZwWow64CsrAllocateCaptureBuffer@8
ZwWow64CsrAllocateMessagePointer@12
ZwWow64CsrCaptureMessageBuffer@16
ZwWow64CsrCaptureMessageString@20
ZwWow64CsrClientCallServer@16
ZwWow64CsrClientConnectToServer@20
ZwWow64CsrFreeCaptureBuffer@4
ZwWow64CsrGetProcessId@0
ZwWow64CsrIdentifyAlertableThread@0
ZwWow64CsrVerifyRegion@8
ZwWow64DebuggerCall@20
ZwWow64GetCurrentProcessorNumberEx@4
ZwWow64GetNativeSystemInformation@16
ZwWow64InterlockedPopEntrySList@4
ZwWow64QueryInformationProcess64@20
ZwWow64QueryVirtualMemory64@32
ZwWow64ReadVirtualMemory64@28
ZwWow64WriteVirtualMemory64@28
ZwWriteFile@36
ZwWriteFileGather@36
ZwWriteRequestData@24
ZwWriteVirtualMemory@20
ZwYieldExecution@0
_CIcos
_CIlog
_CIpow
_CIsin
_CIsqrt
__isascii
__iscsym
__iscsymf
__toascii
_alldiv
_alldvrm@16
_allmul@16
_alloca_probe
_alloca_probe_16
_alloca_probe_8
_allrem@16
_allshl
_allshr
_atoi64
_aulldiv@16
_aulldvrm@16
_aullrem@16
_aullshr
;_chkstk
_fltused DATA
_ftol
_i64toa
_i64toa_s
_i64tow
_i64tow_s
_itoa
_itoa_s
_itow
_itow_s
_lfind
_ltoa
_ltoa_s
_ltow
_ltow_s
_makepath_s
_memccpy
_memicmp
_snprintf
_snprintf_s
_snscanf_s
_snwprintf
_snwprintf_s
_snwscanf_s
_splitpath
_splitpath_s
_strcmpi
_stricmp
_strlwr
_strnicmp
_strnset_s
_strset_s
_strupr
_swprintf
_tolower
_toupper
_ui64toa
_ui64toa_s
_ui64tow
_ui64tow_s
_ultoa
_ultoa_s
_ultow
_ultow_s
_vscwprintf
_vsnprintf
_vsnprintf_s
_vsnwprintf
_vsnwprintf_s
_vswprintf
_wcsicmp
_wcslwr
_wcsnicmp
_wcsnset_s
_wcsset_s
_wcstoui64
_wcsupr
_wmakepath_s
_wsplitpath_s
_wtoi
_wtoi64
_wtol
abs
atan DATA
atoi
atol
bsearch
ceil
cos DATA
fabs DATA
floor DATA
isalnum
isalpha
iscntrl
isdigit
isgraph
islower
isprint
ispunct
isspace
isupper
iswalpha
iswctype
iswdigit
iswlower
iswspace
iswxdigit
isxdigit
labs
log
mbstowcs
memchr
memcmp
memcpy
memcpy_s
memmove
memmove_s
memset
pow
qsort
sin
sprintf
sprintf_s
sqrt
sscanf
sscanf_s
strcat
strcat_s
strchr
strcmp
strcpy
strcpy_s
strcspn
strlen
strncat
strncat_s
strncmp
strncpy
strncpy_s
strnlen
strpbrk
strrchr
strspn
strstr
strtok_s
strtol
strtoul
swprintf
swprintf_s
swscanf_s
tan
tolower
toupper
towlower
towupper
vDbgPrintEx@16
vDbgPrintExWithPrefix@20
vsprintf
vsprintf_s
vswprintf_s
wcscat
wcscat_s
wcschr
wcscmp
wcscpy
wcscpy_s
wcscspn
wcslen
wcsncat
wcsncat_s
wcsncmp
wcsncpy
wcsncpy_s
wcsnlen
wcspbrk
wcsrchr
wcsspn
wcsstr
wcstol
wcstombs
wcstoul