2025 lines
64 KiB
Plaintext
2025 lines
64 KiB
Plaintext
3E9A25F3 = wcstoul
|
|
4D14FEEC = wcstombs
|
|
3E7D3452 = wcstol
|
|
3E7CF9CC = wcsstr
|
|
3E7CFBD0 = wcsspn
|
|
3E592B6D = wcsrchr
|
|
3E196674 = wcspbrk
|
|
3DDAEDF1 = wcsnlen
|
|
49D9A085 = wcsncpy_s
|
|
3DD92766 = wcsncpy
|
|
3DD929EF = wcsncmp
|
|
4BFAE085 = wcsncat_s
|
|
3DD92FEB = wcsncat
|
|
3E7B3150 = wcslen
|
|
3C7D2771 = wcscspn
|
|
3EF1E06D = wcscpy_s
|
|
3E78FBC7 = wcscpy
|
|
3E78F54E = wcscmp
|
|
3E78F7CC = wcschr
|
|
3CD2A06D = wcscat_s
|
|
3E78F34A = wcscat
|
|
19787904 = vswprintf_s
|
|
9D786486 = vsprintf_s
|
|
2DD675E1 = vsprintf
|
|
01CF256B = vDbgPrintExWithPrefix
|
|
FF127CCC = vDbgPrintEx
|
|
5EF58D4D = towupper
|
|
CD144D4C = towlower
|
|
5E1DE18D = toupper
|
|
CDFC218C = tolower
|
|
001D30EE = tan
|
|
6E3660ED = swscanf_s
|
|
19786484 = swprintf_s
|
|
2DDC65E1 = swprintf
|
|
2E9A354B = strtoul
|
|
4E5D3473 = strtol
|
|
4D1D3C64 = strtok_s
|
|
4E5CF9ED = strstr
|
|
4E5CFBF1 = strspn
|
|
2E593BD5 = strrchr
|
|
2E1976CC = strpbrk
|
|
2DDAFD49 = strnlen
|
|
4DF7A485 = strncpy_s
|
|
2DD937DE = strncpy
|
|
2DD93957 = strncmp
|
|
4FD4E485 = strncat_s
|
|
2DD93F53 = strncat
|
|
4E5B3171 = strlen
|
|
2C7D37C9 = strcspn
|
|
3EF9BC65 = strcpy_s
|
|
4E58FBE6 = strcpy
|
|
4E58F56F = strcmp
|
|
4E58F7ED = strchr
|
|
3CDAFC65 = strcat_s
|
|
4E58F36B = strcat
|
|
1D3E60ED = sscanf_s
|
|
3C7874F9 = sscanf
|
|
0E7C7974 = sqrt
|
|
9D7864BD = sprintf_s
|
|
2D3A75E1 = sprintf
|
|
001CF4EE = sin
|
|
1E7BF973 = qsort
|
|
001C37F7 = pow
|
|
5DBCF19A = memset
|
|
9312D89D = memmove_s
|
|
DDBA4C4B = memmove
|
|
3EC5F89D = memcpy_s
|
|
5DB8FB17 = memcpy
|
|
5DB8F59E = memcmp
|
|
5DB8F71C = memchr
|
|
4D267A6C = mbstowcs
|
|
001B37E7 = log
|
|
0D987173 = labs
|
|
4DEA3B32 = isxdigit
|
|
24DE2B32 = iswxdigit
|
|
3ECBBE5A = iswspace
|
|
CD2E3D4C = iswlower
|
|
4DEA3B4A = iswdigit
|
|
3E4DB7DB = iswctype
|
|
1D4FFBDF = iswalpha
|
|
5E1D956D = isupper
|
|
3E19D67A = isspace
|
|
0EBA166B = ispunct
|
|
0E5BD0EB = isprint
|
|
CDFC556C = islower
|
|
7E59DFF6 = isgraph
|
|
4D38536A = isdigit
|
|
3DDC9EF2 = iscntrl
|
|
1D9D93FF = isalpha
|
|
1D9A1D73 = isalnum
|
|
6D9BF7F4 = floor
|
|
0CD87173 = fabs
|
|
0018F7F3 = cos
|
|
0C7974EC = ceil
|
|
5C3D3A76 = bsearch
|
|
0C3D37EC = atol
|
|
0C3D37E9 = atoi
|
|
0C3D30EE = atan
|
|
00187173 = abs
|
|
FEFD37E9 = _wtol
|
|
4DFB248B = _wtoi64
|
|
FEFD37EC = _wtoi
|
|
77B7008D = _wsplitpath_s
|
|
FF464583 = _wmakepath_s
|
|
3E7C07CC = _wcsupr
|
|
097D94BD = _wcstoui64
|
|
6352A06C = _wcsset_s
|
|
CB7AE0AB = _wcsnset_s
|
|
B2D7796E = _wcsnicmp
|
|
3E7A444C = _wcslwr
|
|
3D8729EF = _wcsicmp
|
|
DBDC65CE = _vswprintf
|
|
9C86B84A = _vsnwprintf_s
|
|
5EE6721A = _vsnwprintf
|
|
00739904 = _vsnprintf_s
|
|
DBDC01CE = _vsnprintf
|
|
5EFC721A = _vscwprintf
|
|
4D423894 = _ultow_s
|
|
5D9D3508 = _ultow
|
|
4D47B894 = _ultoa_s
|
|
5D9D351E = _ultoa
|
|
B82F367B = _ui64tow_s
|
|
6622E0BC = _ui64tow
|
|
B82AB67B = _ui64toa_s
|
|
6622E0AA = _ui64toa
|
|
72DC65E1 = _swprintf
|
|
4E5C07ED = _strupr
|
|
635AFC64 = _strset_s
|
|
CF54E4AB = _strnset_s
|
|
B2DF2566 = _strnicmp
|
|
4E5A446D = _strlwr
|
|
2D873957 = _stricmp
|
|
2CC4B7CE = _strcmpi
|
|
7242008D = _splitpath_s
|
|
BDF9C908 = _splitpath
|
|
F3367714 = _snwscanf_s
|
|
9973984A = _snwprintf_s
|
|
DEE665CE = _snwprintf
|
|
EE0460C2 = _snscanf_s
|
|
00787344 = _snprintf_s
|
|
72DC01E1 = _snprintf
|
|
DD8741DE = _memicmp
|
|
DCC74F57 = _memccpy
|
|
FF4DAF83 = _makepath_s
|
|
4DFC9094 = _ltow_s
|
|
FD9D37F2 = _ltow
|
|
4DF91094 = _ltoa_s
|
|
FD9D37E4 = _ltoa
|
|
CCDA759A = _lfind
|
|
4DFC90BC = _itow_s
|
|
FD3D37F2 = _itow
|
|
4DF910BC = _itoa_s
|
|
FD3D37E4 = _itoa
|
|
122F3654 = _i64tow_s
|
|
669C48BC = _i64tow
|
|
122AB654 = _i64toa_s
|
|
669C48AA = _i64toa
|
|
FCDD37E9 = _ftol
|
|
4E036983 = _fltused
|
|
8D7D8575 = _chkstk
|
|
CD2373DC = _aullshr
|
|
CD233543 = _aullrem
|
|
935E6E0B = _aulldvrm
|
|
CD26B358 = _aulldiv
|
|
4DFB243B = _atoi64
|
|
CD9D8B7C = _allshr
|
|
CD9D8B62 = _allshl
|
|
CD9DCDE3 = _allrem
|
|
132B36A0 = _alloca_probe_8
|
|
959B54BF = _alloca_probe_16
|
|
64604CAC = _alloca_probe
|
|
CD9A05E2 = _allmul
|
|
CC223E0B = _alldvrm
|
|
CD984BF8 = _alldiv
|
|
41C72797 = __toascii
|
|
61C1D178 = __iscsymf
|
|
3CC383A2 = __iscsym
|
|
41C75377 = __isascii
|
|
9E7D0768 = _CIsqrt
|
|
393CF612 = _CIsin
|
|
393C350B = _CIpow
|
|
393B351B = _CIlog
|
|
3938F50F = _CIcos
|
|
D5F7EE1D = ZwYieldExecution
|
|
EEE7AF23 = ZwWriteVirtualMemory
|
|
DB48F687 = ZwWriteRequestData
|
|
E187D2F0 = ZwWriteFileGather
|
|
8F3FC778 = ZwWriteFile
|
|
22170752 = ZwWow64WriteVirtualMemory64
|
|
509C894A = ZwWow64ReadVirtualMemory64
|
|
E4113F93 = ZwWow64QueryVirtualMemory64
|
|
7D68CC44 = ZwWow64QueryInformationProcess64
|
|
828B4E39 = ZwWow64InterlockedPopEntrySList
|
|
75B82AC0 = ZwWow64GetNativeSystemInformation
|
|
93F5A2F3 = ZwWow64GetCurrentProcessorNumberEx
|
|
5528AFF9 = ZwWow64DebuggerCall
|
|
537C5BF5 = ZwWow64CsrVerifyRegion
|
|
3B609961 = ZwWow64CsrIdentifyAlertableThread
|
|
68D0B174 = ZwWow64CsrGetProcessId
|
|
374E62EB = ZwWow64CsrFreeCaptureBuffer
|
|
95D38872 = ZwWow64CsrClientConnectToServer
|
|
B7BD4BC1 = ZwWow64CsrClientCallServer
|
|
0F5BFFA1 = ZwWow64CsrCaptureMessageString
|
|
1DD83ABC = ZwWow64CsrCaptureMessageBuffer
|
|
77E3D468 = ZwWow64CsrAllocateMessagePointer
|
|
01C74F6D = ZwWow64CsrAllocateCaptureBuffer
|
|
01C94D96 = ZwWow64CallFunction64
|
|
BD9ADCDB = ZwWorkerFactoryWorkerReady
|
|
EDCBD7F9 = ZwWaitLowEventPair
|
|
10AF19C0 = ZwWaitHighEventPair
|
|
C1E775D9 = ZwWaitForWorkViaWorkerFactory
|
|
C546DA13 = ZwWaitForSingleObject
|
|
29E8BD69 = ZwWaitForMultipleObjects32
|
|
936CA7A2 = ZwWaitForMultipleObjects
|
|
A490DF44 = ZwWaitForKeyedEvent
|
|
24A69F5B = ZwWaitForDebugEvent
|
|
8A4CE579 = ZwVdmControl
|
|
9ED4D161 = ZwUnmapViewOfSection
|
|
027C06D7 = ZwUnlockVirtualMemory
|
|
56089491 = ZwUnlockFile
|
|
D5CF10AB = ZwUnloadKeyEx
|
|
A7AB9E56 = ZwUnloadKey2
|
|
C94F573C = ZwUnloadKey
|
|
95849B61 = ZwUnloadDriver
|
|
412C31AB = ZwUmsThreadYield
|
|
F37CA0E5 = ZwTranslateFilePath
|
|
2C11A5B2 = ZwTraceEvent
|
|
DA2D2420 = ZwTraceControl
|
|
81D1457F = ZwThawTransactions
|
|
BEA23475 = ZwThawRegistry
|
|
C952A06B = ZwTestAlert
|
|
C0C7B366 = ZwTerminateThread
|
|
B318A842 = ZwTerminateProcess
|
|
430F2852 = ZwTerminateJobObject
|
|
5C72CD6D = ZwSystemDebugControl
|
|
56BA5FD1 = ZwSuspendThread
|
|
8DEEF389 = ZwSuspendProcess
|
|
9695C109 = ZwStopProfile
|
|
D94948C1 = ZwStartProfile
|
|
B9A180FB = ZwSinglePhaseReject
|
|
0D3CA1CA = ZwSignalAndWaitForSingleObject
|
|
BFDAFC01 = ZwShutdownWorkerFactory
|
|
6F1C809E = ZwShutdownSystem
|
|
D23BFCD6 = ZwSetVolumeInformationFile
|
|
ADB1816C = ZwSetValueKey
|
|
BB7C5158 = ZwSetUuidSeed
|
|
9C44962E = ZwSetTimerResolution
|
|
395EAC5F = ZwSetTimerEx
|
|
3A9CE57A = ZwSetTimer
|
|
938DAE0D = ZwSetThreadExecutionState
|
|
9E411989 = ZwSetSystemTime
|
|
3CCA5F8B = ZwSetSystemPowerState
|
|
A69C8741 = ZwSetSystemInformation
|
|
C72EB291 = ZwSetSystemEnvironmentValueEx
|
|
41A71CBA = ZwSetSystemEnvironmentValue
|
|
613F2137 = ZwSetSecurityObject
|
|
4785FE58 = ZwSetQuotaInformationFile
|
|
1F800AA2 = ZwSetLowWaitHighEventPair
|
|
A0E69731 = ZwSetLowEventPair
|
|
978FD9C9 = ZwSetLdtEntries
|
|
9809856C = ZwSetIoCompletionEx
|
|
9E526026 = ZwSetIoCompletion
|
|
03AA6B32 = ZwSetIntervalProfile
|
|
9133C21B = ZwSetInformationWorkerFactory
|
|
CE0C9DB9 = ZwSetInformationTransactionManager
|
|
2C22911A = ZwSetInformationTransaction
|
|
7D262BA4 = ZwSetInformationToken
|
|
E035D5DA = ZwSetInformationThread
|
|
97F96A02 = ZwSetInformationResourceManager
|
|
CA2BF652 = ZwSetInformationProcess
|
|
4335D412 = ZwSetInformationObject
|
|
652E318A = ZwSetInformationKey
|
|
948B361E = ZwSetInformationJobObject
|
|
96BBCFD7 = ZwSetInformationFile
|
|
25861AB0 = ZwSetInformationEnlistment
|
|
BCD7C27B = ZwSetInformationDebugObject
|
|
FC7BC40C = ZwSetHighWaitLowEventPair
|
|
860F7DE6 = ZwSetHighEventPair
|
|
E79DBDC9 = ZwSetEventBoostPriority
|
|
297EE0FD = ZwSetEvent
|
|
CB11B2F0 = ZwSetEaFile
|
|
AD2D62A3 = ZwSetDriverEntryOrder
|
|
C0EFD85B = ZwSetDefaultUILanguage
|
|
809ABA24 = ZwSetDefaultLocale
|
|
F73CF77C = ZwSetDefaultHardErrorPort
|
|
37DC3B27 = ZwSetDebugFilterState
|
|
62E2FE6F = ZwSetContextThread
|
|
3C8CED9D = ZwSetBootOptions
|
|
BD9ECFD8 = ZwSetBootEntryOrder
|
|
04BEEDFD = ZwSerializeBoot
|
|
B0391505 = ZwSecureConnectPort
|
|
32828F65 = ZwSaveMergedKeys
|
|
6F7DAF6F = ZwSaveKeyEx
|
|
365DBDF6 = ZwSaveKey
|
|
8669BED8 = ZwRollforwardTransactionManager
|
|
E693BAA6 = ZwRollbackTransaction
|
|
5C1378E7 = ZwRollbackEnlistment
|
|
ADA538C4 = ZwRollbackComplete
|
|
ACF8BF39 = ZwResumeThread
|
|
AC9E87F4 = ZwResumeProcess
|
|
495E7C6F = ZwRestoreKey
|
|
A188B0A5 = ZwResetWriteWatch
|
|
3B35BD39 = ZwResetEvent
|
|
178EB1FF = ZwRequestWaitReplyPort
|
|
BE5E9A59 = ZwRequestPort
|
|
ECC9EA87 = ZwReplyWaitReplyPort
|
|
50DD9185 = ZwReplyWaitReceivePortEx
|
|
CDF54376 = ZwReplyWaitReceivePort
|
|
48D02CA8 = ZwReplyPort
|
|
D4E596E6 = ZwReplacePartitionUnit
|
|
59581C1E = ZwReplaceKey
|
|
60D1116F = ZwRenameTransactionManager
|
|
0E795F4C = ZwRenameKey
|
|
F04CB92E = ZwRemoveProcessDebug
|
|
57E2D967 = ZwRemoveIoCompletionEx
|
|
EE7D5F8B = ZwRemoveIoCompletion
|
|
38C7A246 = ZwReleaseWorkerFactoryWorker
|
|
95FBD70F = ZwReleaseSemaphore
|
|
02535B42 = ZwReleaseMutant
|
|
2EE65290 = ZwReleaseKeyedEvent
|
|
99ECB5CB = ZwRegisterThreadTerminatePort
|
|
DCB33E31 = ZwRegisterProtocolAddressInformation
|
|
AE4EC504 = ZwRecoverTransactionManager
|
|
853C8100 = ZwRecoverResourceManager
|
|
67DEA7D0 = ZwRecoverEnlistment
|
|
B6C7BC3C = ZwReadVirtualMemory
|
|
97359607 = ZwReadRequestData
|
|
34E88646 = ZwReadOnlyEnlistment
|
|
DC100313 = ZwReadFileScatter
|
|
3F7FE146 = ZwReadFile
|
|
0082F5FA = ZwRaiseHardError
|
|
5D7671ED = ZwRaiseException
|
|
3DBB92C1 = ZwQueueApcThreadEx
|
|
C0E4F6EE = ZwQueueApcThread
|
|
D3967EB1 = ZwQueryVolumeInformationFile
|
|
0DE0B73B = ZwQueryVirtualMemory
|
|
9801CD8C = ZwQueryValueKey
|
|
0584FD4E = ZwQueryTimerResolution
|
|
B8FBE4D7 = ZwQueryTimer
|
|
8D7914E5 = ZwQuerySystemTime
|
|
284C4DE9 = ZwQuerySystemInformationEx
|
|
BC44A131 = ZwQuerySystemInformation
|
|
8BCE8721 = ZwQuerySystemEnvironmentValueEx
|
|
97662F3A = ZwQuerySystemEnvironmentValue
|
|
141E3856 = ZwQuerySymbolicLinkObject
|
|
518C4708 = ZwQuerySemaphore
|
|
A00CA1E1 = ZwQuerySecurityObject
|
|
59F7D730 = ZwQuerySecurityAttributesToken
|
|
1B1305B0 = ZwQuerySection
|
|
8986A55C = ZwQueryQuotaInformationFile
|
|
B36AD4F8 = ZwQueryPortInformationProcess
|
|
6EF064D0 = ZwQueryPerformanceCounter
|
|
28DCB147 = ZwQueryOpenSubKeysEx
|
|
4EFCA372 = ZwQueryOpenSubKeys
|
|
CD1263F0 = ZwQueryObject
|
|
BED36561 = ZwQueryMutant
|
|
4C96CCC7 = ZwQueryMultipleValueKey
|
|
A5AE8438 = ZwQueryLicenseValue
|
|
589125FB = ZwQueryKey
|
|
9D0964E8 = ZwQueryIoCompletion
|
|
9A6A0052 = ZwQueryIntervalProfile
|
|
737AEE7F = ZwQueryInstallUILanguage
|
|
DDD3F7AB = ZwQueryInformationWorkerFactory
|
|
A90D303B = ZwQueryInformationTransactionManager
|
|
FAE3A29A = ZwQueryInformationTransaction
|
|
9D139BE8 = ZwQueryInformationToken
|
|
FAEDF3AA = ZwQueryInformationThread
|
|
9A95793A = ZwQueryInformationResourceManager
|
|
A638CE5F = ZwQueryInformationProcess
|
|
0DBA2BA6 = ZwQueryInformationPort
|
|
5A886D1A = ZwQueryInformationJobObject
|
|
0F7BA4B7 = ZwQueryInformationFile
|
|
242B98D7 = ZwQueryInformationEnlistment
|
|
0F9CE53F = ZwQueryInformationAtom
|
|
F1A4E4FD = ZwQueryFullAttributesFile
|
|
AB19E150 = ZwQueryEvent
|
|
F8916431 = ZwQueryEaFile
|
|
4D18D2EF = ZwQueryDriverEntryOrder
|
|
7DB5A65E = ZwQueryDirectoryObject
|
|
5F8B35D6 = ZwQueryDirectoryFile
|
|
DA37FE2B = ZwQueryDefaultUILanguage
|
|
2D18DD25 = ZwQueryDefaultLocale
|
|
D7E98B6B = ZwQueryDebugFilterState
|
|
A08A5B94 = ZwQueryBootOptions
|
|
7CAD4F0E = ZwQueryBootEntryOrder
|
|
AF9F72EC = ZwQueryAttributesFile
|
|
2B0BE5B0 = ZwPulseEvent
|
|
3836C63E = ZwProtectVirtualMemory
|
|
49289501 = ZwPropagationFailed
|
|
E46A100E = ZwPropagationComplete
|
|
7FC15CD8 = ZwPrivilegedServiceAuditAlarm
|
|
7CE5711E = ZwPrivilegeObjectAuditAlarm
|
|
56FF66AD = ZwPrivilegeCheck
|
|
9EAE6C08 = ZwPrepareEnlistment
|
|
FE1A3230 = ZwPrepareComplete
|
|
95791602 = ZwPrePrepareEnlistment
|
|
16321D6D = ZwPrePrepareComplete
|
|
EB6C4F48 = ZwPowerInformation
|
|
E869A3E7 = ZwPlugPlayControl
|
|
E9F5777D = ZwOpenTransactionManager
|
|
D94082E6 = ZwOpenTransaction
|
|
82DAF33C = ZwOpenTimer
|
|
93F00CB5 = ZwOpenThreadTokenEx
|
|
B9364FC0 = ZwOpenThreadToken
|
|
7E9997A5 = ZwOpenThread
|
|
4DCF30E9 = ZwOpenSymbolicLinkObject
|
|
5E09CB39 = ZwOpenSession
|
|
E22E5676 = ZwOpenSemaphore
|
|
5EE9CB38 = ZwOpenSection
|
|
58AF4B3D = ZwOpenResourceManager
|
|
2F81C993 = ZwOpenProcessTokenEx
|
|
ADACBE07 = ZwOpenProcessToken
|
|
9C0AC99D = ZwOpenProcess
|
|
8F8E23CF = ZwOpenPrivateNamespace
|
|
8E34459E = ZwOpenObjectAuditAlarm
|
|
AE5890FC = ZwOpenMutant
|
|
C426EE2B = ZwOpenKeyedEvent
|
|
75A44A8B = ZwOpenKeyTransactedEx
|
|
A1CDD691 = ZwOpenKeyTransacted
|
|
735FE337 = ZwOpenKeyEx
|
|
073DCD7F = ZwOpenKey
|
|
DB78E396 = ZwOpenJobObject
|
|
B2DF10AA = ZwOpenIoCompletion
|
|
9F45B566 = ZwOpenFile
|
|
B30BFB99 = ZwOpenEventPair
|
|
9138F6BB = ZwOpenEvent
|
|
DC6CDE97 = ZwOpenEnlistment
|
|
F5F05C90 = ZwOpenDirectoryObject
|
|
227D5DDE = ZwNotifyChangeSession
|
|
CD902A1B = ZwNotifyChangeMultipleKeys
|
|
C074A308 = ZwNotifyChangeKey
|
|
66EA8930 = ZwNotifyChangeDirectoryFile
|
|
C1924051 = ZwModifyDriverEntry
|
|
E1155056 = ZwModifyBootEntry
|
|
594D9A3C = ZwMapViewOfSection
|
|
F51C690F = ZwMapUserPhysicalPagesScatter
|
|
0A71F5C0 = ZwMapUserPhysicalPages
|
|
687FD471 = ZwMapCMFModule
|
|
128CE9D3 = ZwMakeTemporaryObject
|
|
17477E4D = ZwMakePermanentObject
|
|
CED9A834 = ZwLockVirtualMemory
|
|
B686A6DF = ZwLockRegistryKey
|
|
ED3D44A0 = ZwLockProductActivationKeys
|
|
CF43C956 = ZwLockFile
|
|
7061F367 = ZwLoadKeyEx
|
|
3EE0C391 = ZwLoadKey2
|
|
467DC187 = ZwLoadKey
|
|
42F57D33 = ZwLoadDriver
|
|
83F777BC = ZwListenPort
|
|
E57AD542 = ZwIsUILanguageComitted
|
|
EF10E277 = ZwIsSystemResumeAutomatic
|
|
3123D117 = ZwIsProcessInJob
|
|
B1714E82 = ZwInitiatePowerAction
|
|
512BECB4 = ZwInitializeRegistry
|
|
A255C39C = ZwInitializeNlsFiles
|
|
7B574660 = ZwImpersonateThread
|
|
B71EDBEA = ZwImpersonateClientOfPort
|
|
8C3DD0F9 = ZwImpersonateAnonymousToken
|
|
32925E85 = ZwGetWriteWatch
|
|
067AE25C = ZwGetPlugPlayEvent
|
|
2907137E = ZwGetNotificationResourceManager
|
|
9189FA42 = ZwGetNlsSectionPtr
|
|
57D41E0E = ZwGetNextThread
|
|
3ACE1C09 = ZwGetNextProcess
|
|
3FA3DBE0 = ZwGetMUIRegistryInfo
|
|
151AB3FE = ZwGetDevicePowerState
|
|
4ED17128 = ZwGetCurrentProcessorNumber
|
|
62E2D66F = ZwGetContextThread
|
|
9A5DCC87 = ZwFsControlFile
|
|
96F42C16 = ZwFreezeTransactions
|
|
CCF4A2E4 = ZwFreezeRegistry
|
|
BED3922C = ZwFreeVirtualMemory
|
|
699AE220 = ZwFreeUserPhysicalPages
|
|
B77ABCAF = ZwFlushWriteBuffer
|
|
8E79973F = ZwFlushVirtualMemory
|
|
8DC50367 = ZwFlushProcessWriteBuffers
|
|
4A9F417B = ZwFlushKey
|
|
45F1E847 = ZwFlushInstructionCache
|
|
3B437C7F = ZwFlushInstallUILanguage
|
|
5C5D7CFB = ZwFlushBuffersFile
|
|
3FB090B6 = ZwFindAtom
|
|
A4BD94CF = ZwFilterToken
|
|
6C0C2499 = ZwExtendSection
|
|
EC84F025 = ZwEnumerateValueKey
|
|
EBA3D42A = ZwEnumerateTransactionObject
|
|
33F44CA3 = ZwEnumerateSystemEnvironmentValuesEx
|
|
7601824E = ZwEnumerateKey
|
|
AB2D1222 = ZwEnumerateDriverEntries
|
|
16C56643 = ZwEnumerateBootEntries
|
|
F88E1FE2 = ZwEnableLastKnownGood
|
|
89678F29 = ZwDuplicateToken
|
|
63E792E8 = ZwDuplicateObject
|
|
0D10B756 = ZwDrawText
|
|
9ED4AC6B = ZwDisplayString
|
|
F4DCC989 = ZwDisableLastKnownGood
|
|
385D3092 = ZwDeviceIoControlFile
|
|
1F42593A = ZwDeleteValueKey
|
|
1BF4071F = ZwDeletePrivateNamespace
|
|
1A4E614E = ZwDeleteObjectAuditAlarm
|
|
8879576D = ZwDeleteKey
|
|
3D08BC21 = ZwDeleteFile
|
|
A0B8D471 = ZwDeleteDriverEntry
|
|
B194D4FC = ZwDeleteBootEntry
|
|
3DEFFDA9 = ZwDeleteAtom
|
|
BD36CD53 = ZwDelayExecution
|
|
16F0BC43 = ZwDebugContinue
|
|
D4CB89DB = ZwDebugActiveProcess
|
|
0F6373E1 = ZwCreateWorkerFactory
|
|
E9704ABC = ZwCreateWaitablePort
|
|
AD136A9D = ZwCreateUserProcess
|
|
3C89126D = ZwCreateTransactionManager
|
|
EBC8E858 = ZwCreateTransaction
|
|
2D97D13A = ZwCreateToken
|
|
2D565126 = ZwCreateTimer
|
|
26BC8CCA = ZwCreateThreadEx
|
|
B8C89AF2 = ZwCreateThread
|
|
98B355F9 = ZwCreateSymbolicLinkObject
|
|
48D69C57 = ZwCreateSemaphore
|
|
766F60DB = ZwCreateSection
|
|
BB87CD96 = ZwCreateResourceManager
|
|
DB7A0FF3 = ZwCreateProfileEx
|
|
B42F6DE8 = ZwCreateProfile
|
|
189F8FDB = ZwCreateProcessEx
|
|
B48C627E = ZwCreateProcess
|
|
1BCD763E = ZwCreatePrivateNamespace
|
|
A8DB2333 = ZwCreatePort
|
|
1A7CCFB0 = ZwCreatePagingFile
|
|
69F787B2 = ZwCreateNamedPipeFile
|
|
68099DAB = ZwCreateMutant
|
|
E396BDB4 = ZwCreateMailslotFile
|
|
B843FEFE = ZwCreateKeyedEvent
|
|
BB625A33 = ZwCreateKeyTransacted
|
|
8F57734D = ZwCreateKey
|
|
CAC51812 = ZwCreateJobSet
|
|
718029B7 = ZwCreateJobObject
|
|
F6EA4FB3 = ZwCreateIoCompletion
|
|
AA1AAC22 = ZwCreateFile
|
|
19F331B8 = ZwCreateEventPair
|
|
3EB454A1 = ZwCreateEvent
|
|
A009CE42 = ZwCreateEnlistment
|
|
16D8DA3B = ZwCreateDirectoryObject
|
|
7B3DBB39 = ZwCreateDebugObject
|
|
3ABC05BF = ZwContinue
|
|
A1689E9C = ZwConnectPort
|
|
D63DC921 = ZwCompressKey
|
|
7C6291DF = ZwCompleteConnectPort
|
|
20A11BC6 = ZwCompareTokens
|
|
A1360B1B = ZwCompactKeys
|
|
8A1AF278 = ZwCommitTransaction
|
|
E0CA6A76 = ZwCommitEnlistment
|
|
E7E3CBA0 = ZwCommitComplete
|
|
2C5401F8 = ZwCloseObjectAuditAlarm
|
|
3D9A9259 = ZwClose
|
|
B219AD01 = ZwClearEvent
|
|
A6521567 = ZwCancelTimer
|
|
F0E2A6F1 = ZwCancelSynchronousIoFile
|
|
6F17B1E2 = ZwCancelIoFileEx
|
|
4C69BC5E = ZwCancelIoFile
|
|
2147F917 = ZwCallbackReturn
|
|
AF79BA4A = ZwAssignProcessToJobObject
|
|
1C8A004E = ZwAreMappedFilesTheSame
|
|
192ABF84 = ZwApphelpCacheControl
|
|
06F7C424 = ZwAlpcSetInformation
|
|
42C755B4 = ZwAlpcSendWaitReceivePort
|
|
5619E995 = ZwAlpcRevokeSecurityContext
|
|
944F9F76 = ZwAlpcQueryInformationMessage
|
|
6DDE551B = ZwAlpcQueryInformation
|
|
FECC24CD = ZwAlpcOpenSenderThread
|
|
B6D37DDD = ZwAlpcOpenSenderProcess
|
|
4768F46C = ZwAlpcImpersonateClientOfPort
|
|
62B4FC4F = ZwAlpcDisconnectPort
|
|
D3078993 = ZwAlpcDeleteSecurityContext
|
|
7C07B755 = ZwAlpcDeleteSectionView
|
|
97194B1A = ZwAlpcDeleteResourceReserve
|
|
B9475AD9 = ZwAlpcDeletePortSection
|
|
9107FB71 = ZwAlpcCreateSecurityContext
|
|
5C009971 = ZwAlpcCreateSectionView
|
|
D51939F8 = ZwAlpcCreateResourceReserve
|
|
994074FD = ZwAlpcCreatePortSection
|
|
A61ED3ED = ZwAlpcCreatePort
|
|
C390F19B = ZwAlpcConnectPort
|
|
7C5CA6AE = ZwAlpcCancelMessage
|
|
D1B5248E = ZwAlpcAcceptConnectPort
|
|
594AA9E4 = ZwAllocateVirtualMemory
|
|
01643B02 = ZwAllocateUuids
|
|
E7E3719C = ZwAllocateUserPhysicalPages
|
|
AEC78531 = ZwAllocateReserveObject
|
|
EEBCB8B9 = ZwAllocateLocallyUniqueId
|
|
EE125234 = ZwAlertThread
|
|
570966BA = ZwAlertResumeThread
|
|
6FE44ADD = ZwAdjustPrivilegesToken
|
|
36EE6937 = ZwAdjustGroupsToken
|
|
3A7C8A0A = ZwAddDriverEntry
|
|
C87ABFED = ZwAddBootEntry
|
|
12D230CB = ZwAddAtom
|
|
BFB6B30B = ZwAccessCheckByTypeResultListAndAuditAlarmByHandle
|
|
EA6328A2 = ZwAccessCheckByTypeResultListAndAuditAlarm
|
|
C5E5E960 = ZwAccessCheckByTypeResultList
|
|
171134E1 = ZwAccessCheckByTypeAndAuditAlarm
|
|
6BA6611F = ZwAccessCheckByType
|
|
DA97E599 = ZwAccessCheckAndAuditAlarm
|
|
DB7C4E06 = ZwAccessCheck
|
|
30093905 = ZwAcceptConnectPort
|
|
69A098BE = WinSqmStartSession
|
|
D37BD8D1 = WinSqmSetString
|
|
35BA54C6 = WinSqmSetIfMinDWORD
|
|
35BA7476 = WinSqmSetIfMaxDWORD
|
|
8E734DC8 = WinSqmSetEscalationInfo
|
|
6A869D46 = WinSqmSetDWORD64
|
|
19C9AA1A = WinSqmSetDWORD
|
|
19901015 = WinSqmIsOptedInEx
|
|
CBB46640 = WinSqmIsOptedIn
|
|
9E87C71E = WinSqmIncrementDWORD
|
|
4D5D8E81 = WinSqmGetInstrumentationProperty
|
|
4A1E3258 = WinSqmGetEscalationRuleStatus
|
|
FDAF5505 = WinSqmEventWrite
|
|
5783456F = WinSqmEventEnabled
|
|
A58DAC04 = WinSqmEndSession
|
|
5299F924 = WinSqmCommonDatapointSetString
|
|
BFABB65E = WinSqmCommonDatapointSetStreamEx
|
|
9B966786 = WinSqmCommonDatapointSetDWORD64
|
|
F2CA6E59 = WinSqmCommonDatapointSetDWORD
|
|
1F7F9A3B = WinSqmCommonDatapointDelete
|
|
1CEB33D7 = WinSqmCheckEscalationSetString
|
|
A2F31E21 = WinSqmCheckEscalationSetDWORD64
|
|
14568BCC = WinSqmCheckEscalationSetDWORD
|
|
C7978126 = WinSqmCheckEscalationAddToStreamEx
|
|
AB6E8F96 = WinSqmAddToStreamEx
|
|
B5BAADBA = WinSqmAddToStream
|
|
37476835 = WinSqmAddToAverageDWORD
|
|
BC77E12B = WerReportSQMEvent
|
|
969E82A5 = VerSetConditionMask
|
|
C65CF7E4 = TpWaitForWork
|
|
C65F7A7B = TpWaitForWait
|
|
1EBC3511 = TpWaitForTimer
|
|
3E842867 = TpWaitForIoCompletion
|
|
964C0F98 = TpWaitForAlpcCompletion
|
|
35662F59 = TpStartAsyncIoOperation
|
|
73ED9048 = TpSimpleTryPost
|
|
1E193BDB = TpSetWait
|
|
3D9CE57D = TpSetTimer
|
|
CEBB77DE = TpSetPoolStackInformation
|
|
7BCB11D5 = TpSetPoolMinThreads
|
|
73E711D5 = TpSetPoolMaxThreads
|
|
6E035BA2 = TpSetDefaultPoolStackInformation
|
|
6CCF3FDE = TpSetDefaultPoolMaxThreads
|
|
B37E6A47 = TpReleaseWork
|
|
B37DE7D8 = TpReleaseWait
|
|
8FF2E4AB = TpReleaseTimer
|
|
B39E64C0 = TpReleasePool
|
|
9DF10AFA = TpReleaseIoCompletion
|
|
7BF32832 = TpReleaseCleanupGroupMembers
|
|
B337D3D5 = TpReleaseCleanupGroup
|
|
DEEB6745 = TpReleaseAlpcCompletion
|
|
033BA2D4 = TpQueryPoolStackInformation
|
|
3A5A46DE = TpPostWork
|
|
39A887AF = TpPoolFreeUnusedNodes
|
|
ADF7C9BE = TpIsTimerSet
|
|
ACA421A2 = TpDisassociateCallback
|
|
413B7624 = TpDisablePoolCallbackChecks
|
|
261908B7 = TpDbgSetLogRoutine
|
|
8B9A2071 = TpDbgGetFreeInfo
|
|
008DC693 = TpDbgDumpHeapUsage
|
|
80DA0112 = TpCheckTerminateWorker
|
|
EC429985 = TpCaptureCaller
|
|
2F650CB1 = TpCancelAsyncIoOperation
|
|
55513D1E = TpCallbackUnloadDllOnCompletion
|
|
4327D30A = TpCallbackSetEventOnCompletion
|
|
0C4CAD9F = TpCallbackReleaseSemaphoreOnCompletion
|
|
24955FDF = TpCallbackReleaseMutexOnCompletion
|
|
3F951500 = TpCallbackMayRunLong
|
|
0FE42B38 = TpCallbackLeaveCriticalSectionOnCompletion
|
|
768651B6 = TpCallbackIndependent
|
|
6BD6312F = TpAlpcUnregisterCompletionList
|
|
F9CC1967 = TpAlpcRegisterCompletionList
|
|
7B225F2D = TpAllocWork
|
|
7B21D2B2 = TpAllocWait
|
|
A1E851CF = TpAllocTimer
|
|
7BC251AA = TpAllocPool
|
|
F73956CF = TpAllocIoCompletion
|
|
D9FF8FE0 = TpAllocCleanupGroup
|
|
8F7DD081 = TpAllocAlpcCompletionEx
|
|
C9E63DF7 = TpAllocAlpcCompletion
|
|
24D65862 = ShipAssertMsgW
|
|
24D65874 = ShipAssertMsgA
|
|
CE3FC0BB = ShipAssertGetBufferInfo
|
|
D6AABB52 = ShipAssert
|
|
22E7BBCE = SbSelectProcedure
|
|
8BA4F0AA = SbExecuteProcedure
|
|
BCEB2B56 = RtlxUnicodeStringToOemSize
|
|
D2CD4848 = RtlxUnicodeStringToAnsiSize
|
|
16D5CDE2 = RtlxOemStringToUnicodeSize
|
|
E74FB54A = RtlxAnsiStringToUnicodeSize
|
|
A8252E5A = RtlpWaitForCriticalSection
|
|
9E62CA26 = RtlpVerifyAndCommitUILanguageSettings
|
|
0AB14482 = RtlpUnWaitCriticalSection
|
|
6ED66F1A = RtlpSetUserPreferredUILanguages
|
|
EFD5319E = RtlpSetPreferredUILanguages
|
|
4E6DC85E = RtlpSetInstallLanguage
|
|
8FD1C886 = RtlpRefreshCachedUILanguage
|
|
2B007BC4 = RtlpQueryProcessDebugInformationRemote
|
|
C61E8A47 = RtlpQueryDefaultUILanguage
|
|
2CA308DF = RtlpNtSetValueKey
|
|
3A6D2DC8 = RtlpNtQueryValueKey
|
|
16155647 = RtlpNtOpenKey
|
|
A454769B = RtlpNtMakeTemporaryKey
|
|
72AD1A93 = RtlpNtEnumerateSubKey
|
|
A9997707 = RtlpNtCreateKey
|
|
917D62A2 = RtlpNotOwnerCriticalSection
|
|
0E3789D9 = RtlpMuiRegLoadRegistryInfo
|
|
2E279DAD = RtlpMuiRegFreeRegistryInfo
|
|
BD0FAE24 = RtlpMuiRegCreateRegistryInfo
|
|
97575431 = RtlpMuiFreeLangRegistryInfo
|
|
BFDBA5DB = RtlpLoadUserUIByPolicy
|
|
B34B128B = RtlpLoadMachineUIByPolicy
|
|
CECA0B75 = RtlpIsQualifiedLanguage
|
|
34ABC408 = RtlpInitializeLangRegistryInfo
|
|
1AA74A7B = RtlpGetUserOrMachineUILanguage4NLS
|
|
1D56EE1F = RtlpGetSystemDefaultUILanguage
|
|
9DE179D6 = RtlpGetNameFromLangInfoNode
|
|
0FC0799E = RtlpGetLCIDFromLangInfoNode
|
|
F6993ECD = RtlpEnsureBufferSize
|
|
DABEF463 = RtlpCreateProcessRegistryInfo
|
|
58ED1B64 = RtlpConvertLCIDsToCultureNames
|
|
062C56AE = RtlpConvertCultureNamesToLCIDs
|
|
6257FBBD = RtlpCleanupRegistryKeys
|
|
2ED3DC04 = RtlpCheckDynamicTimeZoneInformation
|
|
039C6E95 = RtlpApplyLengthFunction
|
|
593DC861 = RtlZombifyActivationContext
|
|
3D70DC3A = RtlZeroMemory
|
|
95ACF3DC = RtlZeroHeap
|
|
9909B594 = RtlWriteRegistryValue
|
|
31B2C0FE = RtlWriteMemoryStream
|
|
05845B6A = RtlWow64LogMessageInEventLogger
|
|
C1FFE869 = RtlWow64EnableFsRedirectionEx
|
|
2A4707FF = RtlWow64EnableFsRedirection
|
|
035BAEF6 = RtlWow64CallFunction64
|
|
9403A8A5 = RtlWerpReportException
|
|
D9A5D83C = RtlWeaklyEnumerateEntryHashTable
|
|
D5B6E32C = RtlWalkHeap
|
|
F194B093 = RtlWalkFrameChain
|
|
75AD08A0 = RtlWakeConditionVariable
|
|
F1AC40AB = RtlWakeAllConditionVariable
|
|
63E5E035 = RtlVerifyVersionInfo
|
|
6B4F94C4 = RtlValidateUnicodeString
|
|
F4E6A806 = RtlValidateProcessHeaps
|
|
961A2E6B = RtlValidateHeap
|
|
F0396738 = RtlValidSid
|
|
1FA65831 = RtlValidSecurityDescriptor
|
|
63553D68 = RtlValidRelativeSecurityDescriptor
|
|
F03DE230 = RtlValidAcl
|
|
8197E51D = RtlUshortByteSwap
|
|
FB797232 = RtlUserThreadStart
|
|
A9DC2882 = RtlUpperString
|
|
7D91AEEB = RtlUpperChar
|
|
BEB534A5 = RtlUpdateTimer
|
|
4A9CAACF = RtlUpdateClonedSRWLock
|
|
F8EEA5AB = RtlUpdateClonedCriticalSection
|
|
4199B443 = RtlUpcaseUnicodeToOemN
|
|
59EED485 = RtlUpcaseUnicodeToMultiByteN
|
|
FD5D3382 = RtlUpcaseUnicodeToCustomCPN
|
|
D72BAA08 = RtlUpcaseUnicodeStringToOemString
|
|
789E7241 = RtlUpcaseUnicodeStringToCountedOemString
|
|
FD8829B3 = RtlUpcaseUnicodeStringToAnsiString
|
|
F63AB5D3 = RtlUpcaseUnicodeString
|
|
08D4D171 = RtlUpcaseUnicodeChar
|
|
BC13C5CA = RtlUnwind
|
|
FB7753E0 = RtlUnlockModuleSection
|
|
A21099BB = RtlUnlockMemoryZone
|
|
E79AF72F = RtlUnlockMemoryStreamRegion
|
|
96B38266 = RtlUnlockMemoryBlockLookaside
|
|
52EE54C4 = RtlUnlockHeap
|
|
C2418CE1 = RtlUnlockCurrentThread
|
|
276F59F3 = RtlUnlockBootStatusData
|
|
E802AE32 = RtlUniform
|
|
10E51E76 = RtlUnicodeToUTF8N
|
|
736D9FCA = RtlUnicodeToOemN
|
|
0A6B557B = RtlUnicodeToMultiByteSize
|
|
8940F04E = RtlUnicodeToMultiByteN
|
|
6AFC6FCB = RtlUnicodeToCustomCPN
|
|
525A8C56 = RtlUnicodeStringToOemString
|
|
ECC20D66 = RtlUnicodeStringToOemSize
|
|
7A019AA8 = RtlUnicodeStringToInteger
|
|
342378A3 = RtlUnicodeStringToCountedOemString
|
|
451B06F1 = RtlUnicodeStringToAnsiString
|
|
C65E5060 = RtlUnicodeStringToAnsiSize
|
|
F3C64DE7 = RtlUnhandledExceptionFilter2
|
|
ABE78C9B = RtlUnhandledExceptionFilter
|
|
7DD05F43 = RtlUlonglongByteSwap
|
|
58A52972 = RtlUlongByteSwap
|
|
FF48AE18 = RtlUTF8ToUnicodeN
|
|
A006ABDC = RtlTryEnterCriticalSection
|
|
658A76B6 = RtlTryAcquireSRWLockShared
|
|
C216C2DA = RtlTryAcquireSRWLockExclusive
|
|
E33A600A = RtlTryAcquirePebLock
|
|
7DA96200 = RtlTraceDatabaseValidate
|
|
91947537 = RtlTraceDatabaseUnlock
|
|
105201D5 = RtlTraceDatabaseLock
|
|
1113875A = RtlTraceDatabaseFind
|
|
D5CA2CFB = RtlTraceDatabaseEnumerate
|
|
395E9DE8 = RtlTraceDatabaseDestroy
|
|
50B7FE08 = RtlTraceDatabaseCreate
|
|
7C23E184 = RtlTraceDatabaseAdd
|
|
2156961C = RtlTimeToTimeFields
|
|
43C956D0 = RtlTimeToSecondsSince1980
|
|
43C95150 = RtlTimeToSecondsSince1970
|
|
16FE6C84 = RtlTimeToElapsedTimeFields
|
|
C267CB82 = RtlTimeFieldsToTime
|
|
4A49E7F2 = RtlTestBit
|
|
6199A816 = RtlSystemTimeToLocalTime
|
|
20B5865D = RtlSubtreeSuccessor
|
|
84193F9D = RtlSubtreePredecessor
|
|
A0B7DB9E = RtlSubAuthoritySid
|
|
EB0A309F = RtlSubAuthorityCountSid
|
|
20641C7F = RtlStringFromGUID
|
|
149988C3 = RtlStatMemoryStream
|
|
DAF52178 = RtlStartRXact
|
|
3EBEE39C = RtlSplay
|
|
4DE7338A = RtlSleepConditionVariableSRW
|
|
BA9BC666 = RtlSleepConditionVariableCS
|
|
35BEC39C = RtlSizeHeap
|
|
B59EF0FF = RtlSidIsHigherLevel
|
|
F920C461 = RtlSidHashLookup
|
|
83040DC0 = RtlSidHashInitialize
|
|
586BA979 = RtlSidEqualLevel
|
|
0E28FE84 = RtlSidDominates
|
|
10E81DA4 = RtlSetUserValueHeap
|
|
60F22935 = RtlSetUserFlagsHeap
|
|
F1585598 = RtlSetUserCallbackExceptionFilter
|
|
2BAD83D6 = RtlSetUnhandledExceptionFilter
|
|
219CF1ED = RtlSetTimer
|
|
80DAC9E0 = RtlSetTimeZoneInformation
|
|
3BB750A6 = RtlSetThreadPreferredUILanguages
|
|
B8D5CCF9 = RtlSetThreadPoolStartFunc
|
|
D880E6B0 = RtlSetThreadIsCritical
|
|
029246A0 = RtlSetThreadErrorMode
|
|
CADF19D7 = RtlSetSecurityObjectEx
|
|
ECBF2B7C = RtlSetSecurityObject
|
|
77F5D676 = RtlSetSecurityDescriptorRMControl
|
|
CB29AE6B = RtlSetSaclSecurityDescriptor
|
|
5E54DCB4 = RtlSetProcessPreferredUILanguages
|
|
91176880 = RtlSetProcessIsCritical
|
|
CE55DBDE = RtlSetProcessDebugInformation
|
|
6016EDAA = RtlSetOwnerSecurityDescriptor
|
|
B0026201 = RtlSetMemoryStreamSize
|
|
EF813351 = RtlSetLastWin32ErrorAndNtStatusFromNtStatus
|
|
E7CDC6C2 = RtlSetLastWin32Error
|
|
EA688ADB = RtlSetIoCompletionCallback
|
|
E8ACB8D4 = RtlSetInformationAcl
|
|
7FBB694F = RtlSetHeapInformation
|
|
C03EFFAA = RtlSetGroupSecurityDescriptor
|
|
96788A40 = RtlSetExtendedFeaturesMask
|
|
53905737 = RtlSetEnvironmentVariable
|
|
99F51C2A = RtlSetEnvironmentVar
|
|
A4A4F699 = RtlSetEnvironmentStrings
|
|
ADDB4508 = RtlSetDynamicTimeZoneInformation
|
|
CB91AE6B = RtlSetDaclSecurityDescriptor
|
|
8339F40A = RtlSetCurrentTransaction
|
|
4714F4AE = RtlSetCurrentEnvironment
|
|
D0EBA894 = RtlSetCurrentDirectory_U
|
|
DE026292 = RtlSetCriticalSectionSpinCount
|
|
8717293F = RtlSetControlSecurityDescriptor
|
|
3C833575 = RtlSetBits
|
|
EB5BD982 = RtlSetAttributesSecurityDescriptor
|
|
289DE63C = RtlSetAllBits
|
|
031F4A83 = RtlSendMsgToSm
|
|
CCD10D4D = RtlSelfRelativeToAbsoluteSD2
|
|
FF99A21A = RtlSelfRelativeToAbsoluteSD
|
|
35698887 = RtlSeekMemoryStream
|
|
48FC24C6 = RtlSecondsSince1980ToTime
|
|
48E224C6 = RtlSecondsSince1970ToTime
|
|
BBF736A8 = RtlRunOnceInitialize
|
|
6370249B = RtlRunOnceExecuteOnce
|
|
6F83E7F0 = RtlRunOnceComplete
|
|
98C051BE = RtlRunOnceBeginInitialize
|
|
493AEB22 = RtlRunEncodeUnicodeString
|
|
0CBAEB22 = RtlRunDecodeUnicodeString
|
|
1F95EC08 = RtlRevertMemoryStream
|
|
307318CC = RtlRetrieveNtUserPfn
|
|
F894CEC2 = RtlRestoreLastWin32Error
|
|
3755FBDF = RtlResetRtlTranslations
|
|
78C82C9F = RtlResetMemoryZone
|
|
209ECB50 = RtlResetMemoryBlockLookaside
|
|
F80459B5 = RtlReportSqmEscalation
|
|
88C29DC4 = RtlReportSilentProcessExit
|
|
4D12DD30 = RtlReportException
|
|
3CFC1428 = RtlReplaceSidInSd
|
|
6AAA3975 = RtlRemoveVectoredExceptionHandler
|
|
5B51EFF8 = RtlRemoveVectoredContinueHandler
|
|
6AF85556 = RtlRemovePrivileges
|
|
975CC252 = RtlRemoveEntryHashTable
|
|
388D52E3 = RtlRemoteCall
|
|
F302400B = RtlReleaseSRWLockShared
|
|
15A413DC = RtlReleaseSRWLockExclusive
|
|
1CA14749 = RtlReleaseResource
|
|
16100E36 = RtlReleaseRelativeName
|
|
914C4D22 = RtlReleasePrivilege
|
|
4C5FC207 = RtlReleasePebLock
|
|
8F9EA917 = RtlReleaseMemoryStream
|
|
3F35B974 = RtlReleaseActivationContext
|
|
65D5FFE3 = RtlRegisterWait
|
|
9FE13E73 = RtlRegisterThreadWithCsrss
|
|
C01A17A6 = RtlRegisterSecureMemoryCacheCallback
|
|
68BB6549 = RtlRealSuccessor
|
|
3CDC2D9E = RtlRealPredecessor
|
|
4B3A252F = RtlReadThreadProfilingData
|
|
88755612 = RtlReadOutOfProcessMemoryStream
|
|
15998A87 = RtlReadMemoryStream
|
|
A0D425D2 = RtlReAllocateHeap
|
|
215EF134 = RtlRandomEx
|
|
4F30857B = RtlRandom
|
|
329738DE = RtlRaiseStatus
|
|
5D242D81 = RtlRaiseException
|
|
398C91D2 = RtlQueueWorkItem
|
|
0E4B71B7 = RtlQueueApcWow64Thread
|
|
F1D1860A = RtlQueryTimeZoneInformation
|
|
B307494C = RtlQueryThreadProfiling
|
|
2D201FC7 = RtlQueryTagHeap
|
|
A29E4281 = RtlQuerySecurityObject
|
|
0756C64E = RtlQueryRegistryValues
|
|
86747694 = RtlQueryProcessLockInformation
|
|
D6571684 = RtlQueryProcessHeapInformation
|
|
69456F20 = RtlQueryProcessDebugInformation
|
|
07F765E0 = RtlQueryProcessBackTraceInformation
|
|
4784EAB7 = RtlQueryPerformanceFrequency
|
|
6ED94AE6 = RtlQueryPerformanceCounter
|
|
D8CBDF31 = RtlQueryModuleInformation
|
|
DDF38FBB = RtlQueryInterfaceMemoryStream
|
|
21FA9EB8 = RtlQueryInformationActiveActivationContext
|
|
D41F0AFB = RtlQueryInformationActivationContext
|
|
A68DD129 = RtlQueryInformationAcl
|
|
6F0F97E8 = RtlQueryHeapInformation
|
|
C6376773 = RtlQueryEnvironmentVariable_U
|
|
229B18DD = RtlQueryEnvironmentVariable
|
|
CFF5D945 = RtlQueryElevationFlags
|
|
320FA71E = RtlQueryDynamicTimeZoneInformation
|
|
DB512D94 = RtlQueryDepthSList
|
|
7AB76EE5 = RtlQueryCriticalSectionOwner
|
|
92788244 = RtlQueryAtomInAtomTable
|
|
C922909C = RtlQueryActivationContextApplicationSettings
|
|
3EB9E497 = RtlPushFrame
|
|
B1BD73D4 = RtlProtectHeap
|
|
4C007046 = RtlProcessFlsData
|
|
5F3CBBBA = RtlPrefixUnicodeString
|
|
0E438801 = RtlPrefixString
|
|
02F9DDDB = RtlPopFrame
|
|
834048E3 = RtlPinAtomInAtomTable
|
|
B388D6E5 = RtlPcToFileHeader
|
|
77ACFB58 = RtlOwnerAcesPresent
|
|
17706C40 = RtlOpenCurrentUser
|
|
36AE9739 = RtlOemToUnicodeN
|
|
EBF7A6D9 = RtlOemStringToUnicodeString
|
|
46FCEBD2 = RtlOemStringToUnicodeSize
|
|
F2DFB6B9 = RtlNumberOfSetBitsUlongPtr
|
|
803FB51E = RtlNumberOfSetBits
|
|
4B935F65 = RtlNumberOfClearBits
|
|
8808195D = RtlNumberGenericTableElementsAvl
|
|
C3118C40 = RtlNumberGenericTableElements
|
|
22A4DC86 = RtlNtStatusToDosErrorNoTeb
|
|
19EA3DCC = RtlNtStatusToDosError
|
|
58F6BB27 = RtlNtPathNameToDosPathName
|
|
71F680B5 = RtlNormalizeString
|
|
142B9CDD = RtlNormalizeProcessParams
|
|
5EDB3A89 = RtlNewSecurityObjectWithMultipleInheritance
|
|
8ADC19D0 = RtlNewSecurityObjectEx
|
|
ECA22B70 = RtlNewSecurityObject
|
|
FD39307C = RtlNewSecurityGrantedAccess
|
|
697A8DD9 = RtlNewInstanceSecurityObject
|
|
E1B51C2B = RtlMultipleFreeHeap
|
|
6D54D61F = RtlMultipleAllocateHeap
|
|
985DCB93 = RtlMultiByteToUnicodeSize
|
|
3DB7B4DF = RtlMultiByteToUnicodeN
|
|
D39FD418 = RtlMultiAppendUnicodeStringBuffer
|
|
B778F431 = RtlMoveMemory
|
|
D4713DA2 = RtlMapSecurityErrorToNtStatus
|
|
B93F4AE5 = RtlMapGenericMask
|
|
43B98EC6 = RtlMakeSelfRelativeSD
|
|
1658C7C4 = RtlLookupEntryHashTable
|
|
8F28F5F0 = RtlLookupElementGenericTableFullAvl
|
|
C474E479 = RtlLookupElementGenericTableFull
|
|
2B892848 = RtlLookupElementGenericTableAvl
|
|
CA99215C = RtlLookupElementGenericTable
|
|
8DBD9726 = RtlLookupAtomInAtomTable
|
|
259B138E = RtlLogStackBackTrace
|
|
B8C01428 = RtlLockModuleSection
|
|
182EDBA6 = RtlLockMemoryZone
|
|
FA20C96D = RtlLockMemoryStreamRegion
|
|
19230508 = RtlLockMemoryBlockLookaside
|
|
D580DB54 = RtlLockHeap
|
|
81F6CB29 = RtlLockCurrentThread
|
|
FCCCBDD2 = RtlLockBootStatusData
|
|
14D244BA = RtlLocateLegacyContext
|
|
9F88DFB3 = RtlLocateExtendedFeature
|
|
3C32628E = RtlLocaleNameToLcid
|
|
6EAF5AD8 = RtlLocalTimeToSystemTime
|
|
24B77EDE = RtlLoadString
|
|
01D512ED = RtlLengthSid
|
|
C74DF3D2 = RtlLengthSecurityDescriptor
|
|
A47E8626 = RtlLengthRequiredSid
|
|
728DA026 = RtlLeaveCriticalSection
|
|
C239F3FE = RtlLcidToLocaleName
|
|
1548EC62 = RtlLargeIntegerToChar
|
|
F9721DAF = RtlLargeIntegerSubtract
|
|
AB39421B = RtlLargeIntegerShiftRight
|
|
DC957218 = RtlLargeIntegerShiftLeft
|
|
B1CAA625 = RtlLargeIntegerNegate
|
|
73E8AE75 = RtlLargeIntegerDivide
|
|
38F42043 = RtlLargeIntegerArithmeticShift
|
|
96E1C50D = RtlLargeIntegerAdd
|
|
A630DCF2 = RtlLCIDToCultureName
|
|
CE2F2093 = RtlKnownExceptionFilter
|
|
0E9B25A3 = RtlIsValidLocaleName
|
|
3B78C548 = RtlIsValidIndexHandle
|
|
95947440 = RtlIsValidHandle
|
|
71128326 = RtlIsThreadWithinLoaderCallout
|
|
000C75F2 = RtlIsTextUnicode
|
|
06BB6DE8 = RtlIsNormalizedString
|
|
3387F37D = RtlIsNameLegalDOS8Dot3
|
|
8C34347F = RtlIsNameInExpression
|
|
F2DD7BEA = RtlIsGenericTableEmptyAvl
|
|
68043796 = RtlIsGenericTableEmpty
|
|
3D0F8D96 = RtlIsDosDeviceName_U
|
|
90B10B8D = RtlIsCurrentThreadAttachExempt
|
|
F271D33F = RtlIsCriticalSectionLockedByThread
|
|
AD457D7C = RtlIsCriticalSectionLocked
|
|
C58B85BE = RtlIsActivationContextActive
|
|
A532DDF4 = RtlIpv6StringToAddressW
|
|
B779951B = RtlIpv6StringToAddressExW
|
|
B779950D = RtlIpv6StringToAddressExA
|
|
A532DDE2 = RtlIpv6StringToAddressA
|
|
AE580A27 = RtlIpv6AddressToStringW
|
|
028D57C1 = RtlIpv6AddressToStringExW
|
|
028D57D7 = RtlIpv6AddressToStringExA
|
|
AE580A31 = RtlIpv6AddressToStringA
|
|
A530DDF4 = RtlIpv4StringToAddressW
|
|
3779951B = RtlIpv4StringToAddressExW
|
|
3779950D = RtlIpv4StringToAddressExA
|
|
A530DDE2 = RtlIpv4StringToAddressA
|
|
AE5A0A27 = RtlIpv4AddressToStringW
|
|
828D57C1 = RtlIpv4AddressToStringExW
|
|
828D57D7 = RtlIpv4AddressToStringExA
|
|
AE5A0A31 = RtlIpv4AddressToStringA
|
|
99C2DFD8 = RtlIoEncodeMemIoResource
|
|
DC42DFD8 = RtlIoDecodeMemIoResource
|
|
42A13D03 = RtlInterlockedSetBitRun
|
|
C8B8EFFA = RtlInterlockedPushListSList
|
|
2FDF67C5 = RtlInterlockedPushEntrySList
|
|
6A81AB44 = RtlInterlockedPopEntrySList
|
|
AA5B4B55 = RtlInterlockedFlushSList
|
|
69EC80BA = RtlInterlockedCompareExchange64
|
|
6E2983F1 = RtlInterlockedClearBitRun
|
|
1D6562AA = RtlIntegerToUnicodeString
|
|
7B2C82B5 = RtlIntegerToChar
|
|
2D5E9BE0 = RtlInt64ToUnicodeString
|
|
5856C974 = RtlInsertEntryHashTable
|
|
642C1510 = RtlInsertElementGenericTableFullAvl
|
|
E373E321 = RtlInsertElementGenericTableFull
|
|
9BC72646 = RtlInsertElementGenericTableAvl
|
|
BAE954DE = RtlInsertElementGenericTable
|
|
A1EA3802 = RtlInitializeSid
|
|
138553B0 = RtlInitializeSRWLock
|
|
E1B34DFC = RtlInitializeSListHead
|
|
F1EF414E = RtlInitializeResource
|
|
9821D98E = RtlInitializeRXact
|
|
EB8EFE77 = RtlInitializeNtUserPfn
|
|
4450E9B4 = RtlInitializeHandleTable
|
|
CF9F5E3D = RtlInitializeGenericTableAvl
|
|
792A8E7C = RtlInitializeGenericTable
|
|
8276D643 = RtlInitializeExtendedContext
|
|
BFDB66DF = RtlInitializeExceptionChain
|
|
EF148315 = RtlInitializeCriticalSectionEx
|
|
AB3C90C9 = RtlInitializeCriticalSectionAndSpinCount
|
|
87B7BC52 = RtlInitializeCriticalSection
|
|
84879FC4 = RtlInitializeContext
|
|
D3B347A5 = RtlInitializeConditionVariable
|
|
02474D3F = RtlInitializeBitMap
|
|
B402DE5D = RtlInitializeAtomPackage
|
|
1CAA63C1 = RtlInitWeakEnumerationHashTable
|
|
FB1CEE59 = RtlInitUnicodeStringEx
|
|
3287EC73 = RtlInitUnicodeString
|
|
A5A73EDC = RtlInitString
|
|
EAB14611 = RtlInitOutOfProcessMemoryStream
|
|
361F83FC = RtlInitNlsTables
|
|
5499BCAB = RtlInitMemoryStream
|
|
1EAEAD34 = RtlInitEnumerationHashTable
|
|
0E8F0780 = RtlInitCodePageTable
|
|
D0FEEB88 = RtlInitBarrier
|
|
815A9978 = RtlInitAnsiStringEx
|
|
EE02056A = RtlInitAnsiString
|
|
25179E0F = RtlImpersonateSelfEx
|
|
F3DC945E = RtlImpersonateSelf
|
|
5B999AEC = RtlImageRvaToVa
|
|
E256B4AA = RtlImageRvaToSection
|
|
7F4515B6 = RtlImageNtHeaderEx
|
|
DD39FD14 = RtlImageNtHeader
|
|
503F7B28 = RtlImageDirectoryEntryToData
|
|
6E6D9D6F = RtlIdnToUnicode
|
|
8BB40F29 = RtlIdnToNameprepUnicode
|
|
FF8B3CB1 = RtlIdnToAscii
|
|
00E4D124 = RtlIdentifierAuthoritySid
|
|
404F3515 = RtlHeapTrkInitialize
|
|
D286F21B = RtlHashUnicodeString
|
|
CEBDB7E2 = RtlGetVersion
|
|
EA9F5E99 = RtlGetUserPreferredUILanguages
|
|
0DB4AE2B = RtlGetUserInfoHeap
|
|
0552297B = RtlGetUnloadEventTraceEx
|
|
2E0C1548 = RtlGetUnloadEventTrace
|
|
A40E6DA9 = RtlGetUILanguageInfo
|
|
3BB751E6 = RtlGetThreadPreferredUILanguages
|
|
F690C57C = RtlGetThreadLangIdByIndex
|
|
089246A0 = RtlGetThreadErrorMode
|
|
7F9450E4 = RtlGetSystemPreferredUILanguages
|
|
EB5357CD = RtlGetSetBootStatusData
|
|
77F57676 = RtlGetSecurityDescriptorRMControl
|
|
CB29BA6B = RtlGetSaclSecurityDescriptor
|
|
18FE19FB = RtlGetProductInfo
|
|
5E547CB4 = RtlGetProcessPreferredUILanguages
|
|
694D7247 = RtlGetProcessHeaps
|
|
5021C0B3 = RtlGetParentLocaleName
|
|
601CEDAA = RtlGetOwnerSecurityDescriptor
|
|
75B9CE6A = RtlGetNtVersionNumbers
|
|
3BD5B4C0 = RtlGetNtProductType
|
|
1CDFEAE2 = RtlGetNtGlobalFlags
|
|
5E146856 = RtlGetNextEntryHashTable
|
|
CCE750C2 = RtlGetNativeSystemInformation
|
|
26A946CB = RtlGetLongestNtPathLength
|
|
830FC53A = RtlGetLocaleFileMappingAddress
|
|
2737AF2E = RtlGetLengthWithoutTrailingPathSeperators
|
|
AF11F5C5 = RtlGetLengthWithoutLastFullDosOrNtPathElement
|
|
E7D9C6C2 = RtlGetLastWin32Error
|
|
BE9DA90A = RtlGetLastNtStatus
|
|
62FAD307 = RtlGetIntegerAtom
|
|
C034FFAA = RtlGetGroupSecurityDescriptor
|
|
D4C81ADC = RtlGetFullPathName_UstrEx
|
|
A5C13DAA = RtlGetFullPathName_UEx
|
|
7D4A9704 = RtlGetFullPathName_U
|
|
02D7F5FB = RtlGetFrame
|
|
48DF34C2 = RtlGetFileMUIPath
|
|
C6788A40 = RtlGetExtendedFeaturesMask
|
|
ADE529B1 = RtlGetExtendedContextLength
|
|
B2DD8BB1 = RtlGetEnabledExtendedFeatures
|
|
FC0322AB = RtlGetElementGenericTableAvl
|
|
9ACE3FE0 = RtlGetElementGenericTable
|
|
CB91BA6B = RtlGetDaclSecurityDescriptor
|
|
8338B40A = RtlGetCurrentTransaction
|
|
3C48A3AF = RtlGetCurrentProcessorNumberEx
|
|
055CF122 = RtlGetCurrentProcessorNumber
|
|
7F0DE13E = RtlGetCurrentPeb
|
|
D0EAE894 = RtlGetCurrentDirectory_U
|
|
708721EE = RtlGetCriticalSectionRecursionCount
|
|
0717293D = RtlGetControlSecurityDescriptor
|
|
AB8AB8E2 = RtlGetCompressionWorkSpaceSize
|
|
94E42468 = RtlGetCallersAddress
|
|
60D52417 = RtlGetActiveActivationContext
|
|
0C79C3DB = RtlGetAce
|
|
987A3592 = RtlGenerate8dot3Name
|
|
018E1969 = RtlGUIDFromString
|
|
8F111ADF = RtlFreeUserStack
|
|
BA88D443 = RtlFreeUnicodeString
|
|
CA32CF71 = RtlFreeThreadActivationContextStack
|
|
286DEF5B = RtlFreeSid
|
|
E5FF3D59 = RtlFreeOemString
|
|
6D13E51C = RtlFreeMemoryBlockLookaside
|
|
3594AF64 = RtlFreeHeap
|
|
6A3C3B00 = RtlFreeHandle
|
|
97C3812A = RtlFreeAnsiString
|
|
42F74961 = RtlFreeActivationContextStack
|
|
076BCC07 = RtlFormatMessageEx
|
|
BBFC1DAF = RtlFormatMessage
|
|
DBCA9545 = RtlFormatCurrentUserKeyPath
|
|
38AEDB01 = RtlFlushSecureMemoryCache
|
|
4C05A9AB = RtlFlsFree
|
|
711690C5 = RtlFlsAlloc
|
|
8991B141 = RtlFirstFreeAce
|
|
B1291600 = RtlFirstEntrySList
|
|
D72B1572 = RtlFindSetBitsAndClear
|
|
31DEA4EA = RtlFindSetBits
|
|
8F8D2EAE = RtlFindNextForwardRunClear
|
|
0206E8AC = RtlFindMostSignificantBit
|
|
47FCD57C = RtlFindMessage
|
|
01A9DA5D = RtlFindLongestRunClear
|
|
BF59BFD6 = RtlFindLeastSignificantBit
|
|
8DBAFF6D = RtlFindLastBackwardRunClear
|
|
32F3DD26 = RtlFindClosestEncodableLength
|
|
0DE97E1D = RtlFindClearRuns
|
|
555884C5 = RtlFindClearBitsAndSet
|
|
0FEE731D = RtlFindClearBits
|
|
3BC846E7 = RtlFindCharInUnicodeString
|
|
BBC11A21 = RtlFindActivationContextSectionString
|
|
B79AA289 = RtlFindActivationContextSectionGuid
|
|
BF347013 = RtlFindAceByType
|
|
79A7E3D3 = RtlFinalReleaseOutOfProcessMemoryStream
|
|
30E4200B = RtlFillMemoryUlonglong
|
|
D7FD76C3 = RtlFillMemoryUlong
|
|
314CD034 = RtlFillMemory
|
|
21B6E919 = RtlExtendedMagicDivide
|
|
7FB93190 = RtlExtendedLargeIntegerDivide
|
|
6D60A9A9 = RtlExtendedIntegerMultiply
|
|
62B11A23 = RtlExtendMemoryZone
|
|
BED36456 = RtlExtendMemoryBlockLookaside
|
|
EA839B85 = RtlExpandHashTable
|
|
6EF4CFEA = RtlExpandEnvironmentStrings_U
|
|
80FDBBD3 = RtlExpandEnvironmentStrings
|
|
524D6EDA = RtlExitUserThread
|
|
F676760B = RtlExitUserProcess
|
|
A0AA2619 = RtlEthernetStringToAddressW
|
|
A0AA260F = RtlEthernetStringToAddressA
|
|
ABC0F1CA = RtlEthernetAddressToStringW
|
|
ABC0F1DC = RtlEthernetAddressToStringA
|
|
AE39D6DD = RtlEraseUnicodeString
|
|
E63AFE95 = RtlEqualUnicodeString
|
|
2CD45482 = RtlEqualString
|
|
711F27F0 = RtlEqualSid
|
|
E0BD3216 = RtlEqualPrefixSid
|
|
8C74FEDC = RtlEqualLuid
|
|
202B139E = RtlEqualDomainName
|
|
E1BE37B6 = RtlEqualComputerName
|
|
DE05F545 = RtlEnumerateGenericTableWithoutSplayingAvl
|
|
AC714EF0 = RtlEnumerateGenericTableWithoutSplaying
|
|
34C408F5 = RtlEnumerateGenericTableLikeADirectory
|
|
1E153BE6 = RtlEnumerateGenericTableAvl
|
|
2A0450F0 = RtlEnumerateGenericTable
|
|
C42A256A = RtlEnumerateEntryHashTable
|
|
7BC520F7 = RtlEnumProcessHeaps
|
|
B81E8F04 = RtlEnterCriticalSection
|
|
6A03C3C5 = RtlEnlargedUnsignedMultiply
|
|
15B6EED3 = RtlEnlargedUnsignedDivide
|
|
6C51292E = RtlEnlargedIntegerMultiply
|
|
B720C245 = RtlEndWeakEnumerationHashTable
|
|
A604B57E = RtlEndEnumerationHashTable
|
|
A0CDDF74 = RtlEncodeSystemPointer
|
|
1D4B0CA8 = RtlEncodePointer
|
|
285BE60D = RtlEnableThreadProfiling
|
|
3744CAA0 = RtlEnableEarlyCriticalSectionEventCreation
|
|
A35DFD86 = RtlEmptyAtomTable
|
|
0A0AF4A8 = RtlDuplicateUnicodeString
|
|
A8D1BA46 = RtlDumpResource
|
|
A8C9B51E = RtlDowncaseUnicodeString
|
|
0BE1AABD = RtlDowncaseUnicodeChar
|
|
A60BB817 = RtlDosSearchPath_Ustr
|
|
BA132D30 = RtlDosSearchPath_U
|
|
FF8A0328 = RtlDosPathNameToRelativeNtPathName_U_WithStatus
|
|
657AD2F4 = RtlDosPathNameToRelativeNtPathName_U
|
|
B7FEC248 = RtlDosPathNameToNtPathName_U_WithStatus
|
|
6E789152 = RtlDosPathNameToNtPathName_U
|
|
77A19165 = RtlDosApplyFileIsolationRedirection_Ustr
|
|
CE435F47 = RtlDoesFileExists_U
|
|
CBDABF00 = RtlDnsHostNameToComputerName
|
|
4C8AEFC4 = RtlDllShutdownInProgress
|
|
491977E1 = RtlDisableThreadProfiling
|
|
C7AC0167 = RtlDetermineDosPathNameType_U
|
|
824B939E = RtlDetectHeapLeaks
|
|
35E2F445 = RtlDestroyQueryDebugBuffer
|
|
5ED74598 = RtlDestroyProcessParameters
|
|
EFE97706 = RtlDestroyMemoryZone
|
|
E8C82D35 = RtlDestroyMemoryBlockLookaside
|
|
FDBD2ABF = RtlDestroyHeap
|
|
166EFE30 = RtlDestroyHandleTable
|
|
2FF54435 = RtlDestroyEnvironment
|
|
A8F3DB77 = RtlDestroyAtomTable
|
|
C5C69BBC = RtlDeregisterWaitEx
|
|
E513171A = RtlDeregisterWait
|
|
87D61191 = RtlDeregisterSecureMemoryCacheCallback
|
|
3F66482C = RtlDeleteTimerQueueEx
|
|
AB50FD99 = RtlDeleteTimerQueue
|
|
36BD30EF = RtlDeleteTimer
|
|
E72FCBFD = RtlDeleteSecurityObject
|
|
BD1656B3 = RtlDeleteResource
|
|
8285CE9E = RtlDeleteRegistryValue
|
|
AE9C1565 = RtlDeleteNoSplay
|
|
83431D01 = RtlDeleteHashTable
|
|
7D08A64B = RtlDeleteElementGenericTableAvl
|
|
C6E93BE8 = RtlDeleteElementGenericTable
|
|
A84D25A0 = RtlDeleteCriticalSection
|
|
3F573FAD = RtlDeleteBoundaryDescriptor
|
|
BEDD671C = RtlDeleteBarrier
|
|
C0790325 = RtlDeleteAtomFromAtomTable
|
|
08719FFC = RtlDeleteAce
|
|
0F70C843 = RtlDelete
|
|
29335A70 = RtlDefaultNpAcl
|
|
C35A0C27 = RtlDecompressFragment
|
|
9DAF495F = RtlDecompressBuffer
|
|
E54DDF74 = RtlDecodeSystemPointer
|
|
1D5A6CA8 = RtlDecodePointer
|
|
38B2A9AD = RtlDebugPrintTimes
|
|
139B2867 = RtlDeactivateActivationContextUnsafeFast
|
|
3E96935A = RtlDeactivateActivationContext
|
|
2491A2BD = RtlDeNormalizeProcessParams
|
|
756943E9 = RtlDeCommitDebugInfo
|
|
F053AEA1 = RtlCutoverTimeToSystemTime
|
|
0D7A34E2 = RtlCustomCPToUnicodeN
|
|
0956CAEB = RtlCultureNameToLCID
|
|
97668B45 = RtlCreateVirtualAccountSid
|
|
E9E0A4F7 = RtlCreateUserThread
|
|
54570243 = RtlCreateUserStack
|
|
6F8B5327 = RtlCreateUserSecurityObject
|
|
209360D6 = RtlCreateUserProcess
|
|
8188B04B = RtlCreateUnicodeStringFromAsciiz
|
|
773CB5CA = RtlCreateUnicodeString
|
|
E310F3C5 = RtlCreateTimerQueue
|
|
BFB53124 = RtlCreateTimer
|
|
E9ECDF5D = RtlCreateTagHeap
|
|
70659088 = RtlCreateSystemVolumeInformationFolder
|
|
4D23311C = RtlCreateServiceSid
|
|
DB1593CF = RtlCreateSecurityDescriptor
|
|
F1EE6626 = RtlCreateRegistryKey
|
|
5967C051 = RtlCreateQueryDebugBuffer
|
|
78667572 = RtlCreateProcessReflection
|
|
53EBA5EB = RtlCreateProcessParametersEx
|
|
1C4D4FAE = RtlCreateProcessParameters
|
|
EAF2564B = RtlCreateMemoryZone
|
|
AE007E74 = RtlCreateMemoryBlockLookaside
|
|
AEFC6C77 = RtlCreateHeap
|
|
3BD39D1D = RtlCreateHashTable
|
|
78ADCA61 = RtlCreateEnvironmentEx
|
|
A265E2B7 = RtlCreateEnvironment
|
|
631F7FA3 = RtlCreateBoundaryDescriptor
|
|
CAE46135 = RtlCreateBootStatusDataFile
|
|
32F9ED35 = RtlCreateAtomTable
|
|
4640C329 = RtlCreateAndSetSD
|
|
7356A109 = RtlCreateActivationContext
|
|
0F5FBBD5 = RtlCreateAcl
|
|
5A8DEE17 = RtlCopyUnicodeString
|
|
A4950AD9 = RtlCopyString
|
|
72EECAFF = RtlCopySidAndAttributesArray
|
|
7BEDFBB2 = RtlCopySid
|
|
B69F4D26 = RtlCopySecurityDescriptor
|
|
72C400D0 = RtlCopyOutOfProcessMemoryStreamTo
|
|
6A2BCD7D = RtlCopyMemoryStreamTo
|
|
108554C4 = RtlCopyMappedMemory
|
|
915303E5 = RtlCopyLuidAndAttributesArray
|
|
F51ADFD9 = RtlCopyLuid
|
|
B97B763F = RtlCopyExtendedContext
|
|
8927E3FF = RtlCopyContext
|
|
BBEA5404 = RtlConvertUlongToLargeInteger
|
|
816404EB = RtlConvertUiListToApiList
|
|
5D156BD4 = RtlConvertToAutoInheritSecurityObject
|
|
13A7EF52 = RtlConvertSidToUnicodeString
|
|
1C49B089 = RtlConvertSharedToExclusive
|
|
4D648DEA = RtlConvertLongToLargeInteger
|
|
E8C3F91B = RtlConvertLCIDToString
|
|
9F4387B5 = RtlConvertExclusiveToShared
|
|
9594943C = RtlContractHashTable
|
|
6B7FDF0C = RtlConsoleMultiByteToUnicodeN
|
|
330BEE07 = RtlConnectToSm
|
|
9E18CF17 = RtlComputePrivatizedDllName_U
|
|
EA3C6A46 = RtlComputeImportTableHash
|
|
687B7023 = RtlComputeCrc32
|
|
2791296E = RtlCompressBuffer
|
|
CC181C6B = RtlCompareUnicodeStrings
|
|
31983038 = RtlCompareUnicodeString
|
|
4B82BF53 = RtlCompareString
|
|
9E827A80 = RtlCompareMemoryUlong
|
|
586331BC = RtlCompareMemory
|
|
5A005AA5 = RtlCompareAltitudes
|
|
33B5671A = RtlCompactHeap
|
|
CF1FDA28 = RtlCommitMemoryStream
|
|
6A595BB4 = RtlCommitDebugInfo
|
|
99C27F98 = RtlCmEncodeMemIoResource
|
|
DC427F98 = RtlCmDecodeMemIoResource
|
|
DD1C08BB = RtlCloneUserProcess
|
|
E1A6FCE6 = RtlCloneMemoryStream
|
|
6B89B04A = RtlClearBits
|
|
8F77076C = RtlClearAllBits
|
|
DA075E04 = RtlCleanUpTEBLangLists
|
|
5CB0CE5B = RtlCheckRegistryKey
|
|
61B335A2 = RtlCheckForOrphanedCriticalSections
|
|
7C5B682F = RtlCharToInteger
|
|
6973AA7D = RtlCaptureStackContext
|
|
FAC61F42 = RtlCaptureStackBackTrace
|
|
021E8782 = RtlCaptureContext
|
|
34B17565 = RtlCancelTimer
|
|
36070CA9 = RtlBarrierForDelete
|
|
5A8379D4 = RtlBarrier
|
|
6C90CB7B = RtlAssert
|
|
B991629B = RtlAreBitsSet
|
|
59829E97 = RtlAreBitsClear
|
|
558C7C70 = RtlAreAnyAccessesGranted
|
|
558E5670 = RtlAreAllAccessesGranted
|
|
DFAFFF3A = RtlApplyRXactNoFlush
|
|
DED75919 = RtlApplyRXact
|
|
4B15D942 = RtlApplicationVerifierStop
|
|
BCE565E4 = RtlAppendUnicodeToString
|
|
EC0DE045 = RtlAppendUnicodeStringToString
|
|
C57E8620 = RtlAppendStringToString
|
|
B1C51FBC = RtlAppendPathElement
|
|
C80CA623 = RtlAppendAsciizToString
|
|
FA5B8B91 = RtlAnsiStringToUnicodeString
|
|
F3DCAD62 = RtlAnsiStringToUnicodeSize
|
|
8357B65D = RtlAnsiCharToUnicodeChar
|
|
407726B0 = RtlAllocateMemoryZone
|
|
0F5C409E = RtlAllocateMemoryBlockLookaside
|
|
9016CD2B = RtlAllocateHeap
|
|
F2AFD260 = RtlAllocateHandle
|
|
3C538E91 = RtlAllocateAndInitializeSid
|
|
AB97D1F2 = RtlAllocateActivationContextStack
|
|
C2A6B1AE = RtlAdjustPrivilege
|
|
1C008B93 = RtlAddressInSectionTable
|
|
A8933937 = RtlAddVectoredExceptionHandler
|
|
DED59DF8 = RtlAddVectoredContinueHandler
|
|
E9E7A6C1 = RtlAddSIDToBoundaryDescriptor
|
|
AF34C8D4 = RtlAddRefMemoryStream
|
|
3A66B76D = RtlAddRefActivationContext
|
|
44CEC3EA = RtlAddMandatoryAce
|
|
7F32C342 = RtlAddIntegrityLabelToBoundaryDescriptor
|
|
0F6FB70E = RtlAddCompoundAce
|
|
9A0FB3D1 = RtlAddAuditAccessObjectAce
|
|
A9DFF352 = RtlAddAuditAccessAceEx
|
|
46AAA77F = RtlAddAuditAccessAce
|
|
9302BB31 = RtlAddAttributeActionToRXact
|
|
0BCD5BA3 = RtlAddAtomToAtomTable
|
|
5AB5DC3A = RtlAddActionToRXact
|
|
1E79C3EB = RtlAddAce
|
|
2AD57451 = RtlAddAccessDeniedObjectAce
|
|
A4738B59 = RtlAddAccessDeniedAceEx
|
|
A68691CE = RtlAddAccessDeniedAce
|
|
A160DDB0 = RtlAddAccessAllowedObjectAce
|
|
1F291541 = RtlAddAccessAllowedAceEx
|
|
DEE47CA4 = RtlAddAccessAllowedAce
|
|
1216F994 = RtlActivateActivationContextUnsafeFast
|
|
29075E5C = RtlActivateActivationContextEx
|
|
F290A41D = RtlActivateActivationContext
|
|
7D92526E = RtlAcquireSRWLockShared
|
|
5915C1DE = RtlAcquireSRWLockExclusive
|
|
4128A6CF = RtlAcquireResourceShared
|
|
CD325680 = RtlAcquireResourceExclusive
|
|
C14B9BA2 = RtlAcquireReleaseSRWLockExclusive
|
|
784D6B7A = RtlAcquirePrivilege
|
|
D53C6603 = RtlAcquirePebLock
|
|
801C4F6B = RtlAbsoluteToSelfRelativeSD
|
|
CCE92171 = RtlAbortRXact
|
|
F4DE7A4A = PfxRemovePrefix
|
|
FED55C85 = PfxInsertPrefix
|
|
F645700F = PfxInitialize
|
|
4068F85C = PfxFindPrefix
|
|
8654366D = NtdllDialogWndProc_W
|
|
8654367B = NtdllDialogWndProc_A
|
|
55211BE9 = NtdllDefWindowProc_W
|
|
55211BFF = NtdllDefWindowProc_A
|
|
D5F7C611 = NtYieldExecution
|
|
2EE7ADA3 = NtWriteVirtualMemory
|
|
D14BF687 = NtWriteRequestData
|
|
E193D4F0 = NtWriteFileGather
|
|
0F3FC279 = NtWriteFile
|
|
27168752 = NtWow64WriteVirtualMemory64
|
|
50968A4A = NtWow64ReadVirtualMemory64
|
|
E110BF93 = NtWow64QueryVirtualMemory64
|
|
5564CC44 = NtWow64QueryInformationProcess64
|
|
82DB5639 = NtWow64InterlockedPopEntrySList
|
|
73B82AD4 = NtWow64GetNativeSystemInformation
|
|
93F5A8F0 = NtWow64GetCurrentProcessorNumberEx
|
|
54A8AFFC = NtWow64DebuggerCall
|
|
53DC6BF5 = NtWow64CsrVerifyRegion
|
|
3D609975 = NtWow64CsrIdentifyAlertableThread
|
|
68708174 = NtWow64CsrGetProcessId
|
|
324FE2EB = NtWow64CsrFreeCaptureBuffer
|
|
95839072 = NtWow64CsrClientConnectToServer
|
|
B7B748C1 = NtWow64CsrClientCallServer
|
|
0F5B5F91 = NtWow64CsrCaptureMessageString
|
|
1DD89A8C = NtWow64CsrCaptureMessageBuffer
|
|
5FEFD468 = NtWow64CsrAllocateMessagePointer
|
|
0197576D = NtWow64CsrAllocateCaptureBuffer
|
|
01C80DF6 = NtWow64CallFunction64
|
|
BD90DFDB = NtWorkerFactoryWorkerReady
|
|
E7C8D7F9 = NtWaitLowEventPair
|
|
112F19C5 = NtWaitHighEventPair
|
|
A1E77499 = NtWaitForWorkViaWorkerFactory
|
|
C5479A73 = NtWaitForSingleObject
|
|
29E2BE69 = NtWaitForMultipleObjects32
|
|
9F6CA78A = NtWaitForMultipleObjects
|
|
A510DF41 = NtWaitForKeyedEvent
|
|
25269F5E = NtWaitForDebugEvent
|
|
8A4E65B9 = NtVdmControl
|
|
5ED4D3E1 = NtUnmapViewOfSection
|
|
027D46B7 = NtUnlockVirtualMemory
|
|
560A1451 = NtUnlockFile
|
|
D48F70AB = NtUnloadKeyEx
|
|
A7A91E96 = NtUnloadKey2
|
|
494F523D = NtUnloadKey
|
|
35B49B61 = NtUnloadDriver
|
|
412C19A7 = NtUmsThreadYield
|
|
F2FCA0E0 = NtTranslateFilePath
|
|
2C132572 = NtTraceEvent
|
|
7A1D2420 = NtTraceControl
|
|
8BD2457F = NtThawTransactions
|
|
1E923475 = NtThawRegistry
|
|
4952A56A = NtTestAlert
|
|
C0D3B566 = NtTerminateThread
|
|
B91BA842 = NtTerminateProcess
|
|
830F2AD2 = NtTerminateJobObject
|
|
9C72CFED = NtSystemDebugControl
|
|
4EBA5F81 = NtSuspendThread
|
|
8DEEDB85 = NtSuspendProcess
|
|
97D5A109 = NtStopProfile
|
|
797948C1 = NtStartProfile
|
|
B82180FE = NtSinglePhaseReject
|
|
0D3C01FA = NtSignalAndWaitForSingleObject
|
|
EFC2FC01 = NtShutdownWorkerFactory
|
|
6F1CA892 = NtShutdownSystem
|
|
D231FFD6 = NtSetVolumeInformationFile
|
|
ACF1E16C = NtSetValueKey
|
|
BA3C3158 = NtSetUuidSeed
|
|
5C4494AE = NtSetTimerResolution
|
|
395C2C9F = NtSetTimerEx
|
|
399CE570 = NtSetTimer
|
|
938DBA0B = NtSetThreadExecutionState
|
|
864119D9 = NtSetSystemTime
|
|
3CCB1FEB = NtSetSystemPowerState
|
|
A63CB741 = NtSetSystemInformation
|
|
A72EB3D1 = NtSetSystemEnvironmentValueEx
|
|
44A69CBA = NtSetSystemEnvironmentValue
|
|
60BF2132 = NtSetSecurityObject
|
|
4785EA5E = NtSetQuotaInformationFile
|
|
1F801EA4 = NtSetLowWaitHighEventPair
|
|
A0F29131 = NtSetLowEventPair
|
|
8F8FD999 = NtSetLdtEntries
|
|
99898569 = NtSetIoCompletionEx
|
|
9E466626 = NtSetIoCompletion
|
|
C3AA69B2 = NtSetIntervalProfile
|
|
F133C35B = NtSetInformationWorkerFactory
|
|
CE0C97BA = NtSetInformationTransactionManager
|
|
2923111A = NtSetInformationTransaction
|
|
7D276BC4 = NtSetInformationToken
|
|
E095E5DA = NtSetInformationThread
|
|
97A97202 = NtSetInformationResourceManager
|
|
9A33F652 = NtSetInformationProcess
|
|
4395E412 = NtSetInformationObject
|
|
64AE318F = NtSetInformationKey
|
|
948B2218 = NtSetInformationJobObject
|
|
56BBCD57 = NtSetInformationFile
|
|
258C19B0 = NtSetInformationEnlistment
|
|
B9D6427B = NtSetInformationDebugObject
|
|
FC7BD00A = NtSetHighWaitLowEventPair
|
|
8C0C7DE6 = NtSetHighEventPair
|
|
B785BDC9 = NtSetEventBoostPriority
|
|
2A7EE0F7 = NtSetEvent
|
|
4B11B7F1 = NtSetEaFile
|
|
AD2C22C3 = NtSetDriverEntryOrder
|
|
C04FE85B = NtSetDefaultUILanguage
|
|
8A99BA24 = NtSetDefaultLocale
|
|
F73CE37A = NtSetDefaultHardErrorPort
|
|
37DD7B47 = NtSetDebugFilterState
|
|
68E1FE6F = NtSetContextThread
|
|
3C8CC591 = NtSetBootOptions
|
|
BC1ECFDD = NtSetBootEntryOrder
|
|
1CBEEDAD = NtSerializeBoot
|
|
B1B91500 = NtSecureConnectPort
|
|
3282A769 = NtSaveMergedKeys
|
|
EF7DAA6E = NtSaveKeyEx
|
|
225BBDF6 = NtSaveKey
|
|
8639A6D8 = NtRollforwardTransactionManager
|
|
E692FAC6 = NtRollbackTransaction
|
|
9C137A67 = NtRollbackEnlistment
|
|
A7A638C4 = NtRollbackComplete
|
|
0CC8BF39 = NtResumeThread
|
|
B49E87A4 = NtResumeProcess
|
|
495CFCAF = NtRestoreKey
|
|
A19CB6A5 = NtResetWriteWatch
|
|
3B373DF9 = NtResetEvent
|
|
172E81FF = NtRequestWaitReplyPort
|
|
BF1EFA59 = NtRequestPort
|
|
2CC9E807 = NtReplyWaitReplyPort
|
|
5CDD91AD = NtReplyWaitReceivePortEx
|
|
CD557376 = NtReplyWaitReceivePort
|
|
C8D029A9 = NtReplyPort
|
|
D445A6E6 = NtReplacePartitionUnit
|
|
595A9CDE = NtReplaceKey
|
|
60DB126F = NtRenameTransactionManager
|
|
8E795A4D = NtRenameKey
|
|
304CBBAE = NtRemoveProcessDebug
|
|
5742E967 = NtRemoveIoCompletionEx
|
|
2E7D5D0B = NtRemoveIoCompletion
|
|
B807A244 = NtReleaseWorkerFactoryWorker
|
|
9FF8D70F = NtReleaseSemaphore
|
|
1A535B12 = NtReleaseMutant
|
|
2F665295 = NtReleaseKeyedEvent
|
|
F9ECB48B = NtRegisterThreadTerminatePort
|
|
DE33FE31 = NtRegisterProtocolAddressInformation
|
|
AB4F4504 = NtRecoverTransactionManager
|
|
893C8128 = NtRecoverResourceManager
|
|
665EA7D5 = NtRecoverEnlistment
|
|
B747BC39 = NtReadVirtualMemory
|
|
97219007 = NtReadRequestData
|
|
F4E884C6 = NtReadOnlyEnlistment
|
|
DC040513 = NtReadFileScatter
|
|
3C7FE14C = NtReadFile
|
|
0082DDF6 = NtRaiseHardError
|
|
5D7659E1 = NtRaiseException
|
|
37B892C1 = NtQueueApcThreadEx
|
|
C0E4DEE2 = NtQueueApcThread
|
|
53567EB3 = NtQueryVolumeInformationFile
|
|
CDE0B5BB = NtQueryVirtualMemory
|
|
8001CDDC = NtQueryValueKey
|
|
0524CD4E = NtQueryTimerResolution
|
|
B8F96417 = NtQueryTimer
|
|
8D6D12E5 = NtQuerySystemTime
|
|
28464EE9 = NtQuerySystemInformationEx
|
|
B044A119 = NtQuerySystemInformation
|
|
8B9E9F21 = NtQuerySystemEnvironmentValueEx
|
|
F7662E7A = NtQuerySystemEnvironmentValue
|
|
141E2C50 = NtQuerySymbolicLinkObject
|
|
518C6F04 = NtQuerySemaphore
|
|
A00DE181 = NtQuerySecurityObject
|
|
59F77700 = NtQuerySecurityAttributesToken
|
|
BB2305B0 = NtQuerySection
|
|
8C87255C = NtQueryQuotaInformationFile
|
|
D36AD5B8 = NtQueryPortInformationProcess
|
|
6EF070D6 = NtQueryPerformanceCounter
|
|
E8DCB3C7 = NtQueryOpenSubKeysEx
|
|
44FFA372 = NtQueryOpenSubKeys
|
|
CC5203F0 = NtQueryObject
|
|
BF930561 = NtQueryMutant
|
|
1C8ECCC7 = NtQueryMultipleValueKey
|
|
A42E843D = NtQueryLicenseValue
|
|
5B9125F1 = NtQueryKey
|
|
9C8964ED = NtQueryIoCompletion
|
|
9ACA3052 = NtQueryIntervalProfile
|
|
7F7AEE57 = NtQueryInstallUILanguage
|
|
DD83EFAB = NtQueryInformationWorkerFactory
|
|
AB8DF03B = NtQueryInformationTransactionManager
|
|
9AE3A3DA = NtQueryInformationTransaction
|
|
CD0B9BE8 = NtQueryInformationToken
|
|
F6EDF382 = NtQueryInformationThread
|
|
9C95792E = NtQueryInformationResourceManager
|
|
A638DA59 = NtQueryInformationProcess
|
|
0D1A1BA6 = NtQueryInformationPort
|
|
5F89ED1A = NtQueryInformationJobObject
|
|
0FDB94B7 = NtQueryInformationFile
|
|
A4EB98D5 = NtQueryInformationEnlistment
|
|
0F3CD53F = NtQueryInformationAtom
|
|
F1A4F0FB = NtQueryFullAttributesFile
|
|
AB1B6190 = NtQueryEvent
|
|
F9D10431 = NtQueryEaFile
|
|
1D00D2EF = NtQueryDriverEntryOrder
|
|
7D15965E = NtQueryDirectoryObject
|
|
9F8B3756 = NtQueryDirectoryFile
|
|
D637FE03 = NtQueryDefaultUILanguage
|
|
ED18DFA5 = NtQueryDefaultLocale
|
|
87F18B6B = NtQueryDebugFilterState
|
|
AA895B94 = NtQueryBootOptions
|
|
7CAC0F6E = NtQueryBootEntryOrder
|
|
AF9E328C = NtQueryAttributesFile
|
|
2B096570 = NtPulseEvent
|
|
3896F63E = NtProtectVirtualMemory
|
|
48A89504 = NtPropagationFailed
|
|
E46B506E = NtPropagationComplete
|
|
1FC15D98 = NtPrivilegedServiceAuditAlarm
|
|
79E4F11E = NtPrivilegeObjectAuditAlarm
|
|
56FF4EA1 = NtPrivilegeCheck
|
|
9F2E6C0D = NtPrepareEnlistment
|
|
FE0E3430 = NtPrepareComplete
|
|
95D92602 = NtPrePrepareEnlistment
|
|
D6321FED = NtPrePrepareComplete
|
|
E16F4F48 = NtPowerInformation
|
|
E87DA5E7 = NtPlugPlayControl
|
|
E5F57755 = NtOpenTransactionManager
|
|
D95484E6 = NtOpenTransaction
|
|
02DAF63D = NtOpenTimer
|
|
92700CB0 = NtOpenThreadTokenEx
|
|
B92249C0 = NtOpenThreadToken
|
|
7E9B1765 = NtOpenThread
|
|
41CF30C1 = NtOpenSymbolicLinkObject
|
|
5F49AB39 = NtOpenSession
|
|
FA2E5626 = NtOpenSemaphore
|
|
5FA9AB38 = NtOpenSection
|
|
58AE0B5D = NtOpenResourceManager
|
|
EF81CB13 = NtOpenProcessTokenEx
|
|
A7AFBE07 = NtOpenProcessToken
|
|
9D4AA99D = NtOpenProcess
|
|
8F2E13CF = NtOpenPrivateNamespace
|
|
8E94759E = NtOpenObjectAuditAlarm
|
|
AE5A103C = NtOpenMutant
|
|
C426C627 = NtOpenKeyedEvent
|
|
75A50AEB = NtOpenKeyTransactedEx
|
|
A04DD694 = NtOpenKeyTransacted
|
|
F35FE636 = NtOpenKeyEx
|
|
133BCD7F = NtOpenKey
|
|
C378E3C6 = NtOpenJobObject
|
|
B8DC10AA = NtOpenIoCompletion
|
|
9C45B56C = NtOpenFile
|
|
AB0BFBC9 = NtOpenEventPair
|
|
1138F3BA = NtOpenEvent
|
|
DC6CF69B = NtOpenEnlistment
|
|
F5F11CF0 = NtOpenDirectoryObject
|
|
227C1DBE = NtNotifyChangeSession
|
|
CD9A291B = NtNotifyChangeMultipleKeys
|
|
C060A508 = NtNotifyChangeKey
|
|
63EB0930 = NtNotifyChangeDirectoryFile
|
|
C0124054 = NtModifyDriverEntry
|
|
E1015656 = NtModifyBootEntry
|
|
534E9A3C = NtMapViewOfSection
|
|
951C684F = NtMapUserPhysicalPagesScatter
|
|
0AD1C5C0 = NtMapUserPhysicalPages
|
|
C84FD471 = NtMapCMFModule
|
|
128DA9B3 = NtMakeTemporaryObject
|
|
17463E2D = NtMakePermanentObject
|
|
CF59A831 = NtLockVirtualMemory
|
|
B692A0DF = NtLockRegistryKey
|
|
E83CC4A0 = NtLockProductActivationKeys
|
|
CC43C95C = NtLockFile
|
|
F061F666 = NtLoadKeyEx
|
|
3DE0C39B = NtLoadKey2
|
|
527BC187 = NtLoadKey
|
|
42F7FDF3 = NtLoadDriver
|
|
83F5F77C = NtListenPort
|
|
E5DAE542 = NtIsUILanguageComitted
|
|
EF10F671 = NtIsSystemResumeAutomatic
|
|
3123F91B = NtIsProcessInJob
|
|
B1700EE2 = NtInitiatePowerAction
|
|
912BEE34 = NtInitializeRegistry
|
|
6255C11C = NtInitializeNlsFiles
|
|
7AD74665 = NtImpersonateThread
|
|
B71ECFEC = NtImpersonateClientOfPort
|
|
893C50F9 = NtImpersonateAnonymousToken
|
|
2A925ED5 = NtGetWriteWatch
|
|
1E660150 = NtGetTickCount
|
|
0C79E25C = NtGetPlugPlayEvent
|
|
010B137E = NtGetNotificationResourceManager
|
|
9B8AFA42 = NtGetNlsSectionPtr
|
|
4FD41E5E = NtGetNextThread
|
|
3ACE3405 = NtGetNextProcess
|
|
FFA3D960 = NtGetMUIRegistryInfo
|
|
151BF39E = NtGetDevicePowerState
|
|
4BD0F128 = NtGetCurrentProcessorNumber
|
|
68E1D66F = NtGetContextThread
|
|
825DCCD7 = NtFsControlFile
|
|
56F42E96 = NtFreezeTransactions
|
|
CCF48AE8 = NtFreezeRegistry
|
|
BF539229 = NtFreeVirtualMemory
|
|
3982E220 = NtFreeUserPhysicalPages
|
|
BD79BCAF = NtFlushWriteBuffer
|
|
4E7995BF = NtFlushVirtualMemory
|
|
8DCF0067 = NtFlushProcessWriteBuffers
|
|
499F4171 = NtFlushKey
|
|
15E9E847 = NtFlushInstructionCache
|
|
37437C57 = NtFlushInstallUILanguage
|
|
565E7CFB = NtFlushBuffersFile
|
|
3CB090BC = NtFindAtom
|
|
A5FDF4CF = NtFilterToken
|
|
740C24C9 = NtExtendSection
|
|
ED04F020 = NtEnumerateValueKey
|
|
6B63D428 = NtEnumerateTransactionObject
|
|
31748CA3 = NtEnumerateSystemEnvironmentValuesEx
|
|
D631824E = NtEnumerateKey
|
|
A72D120A = NtEnumerateDriverEntries
|
|
16655643 = NtEnumerateBootEntries
|
|
F88F5F82 = NtEnableLastKnownGood
|
|
8967A725 = NtDuplicateToken
|
|
63F394E8 = NtDuplicateObject
|
|
0E10B75C = NtDrawText
|
|
86D4AC3B = NtDisplayString
|
|
F47CF989 = NtDisableLastKnownGood
|
|
385C70F2 = NtDeviceIoControlFile
|
|
1F427136 = NtDeleteValueKey
|
|
17F40737 = NtDeletePrivateNamespace
|
|
164E6166 = NtDeleteObjectAuditAlarm
|
|
0879526C = NtDeleteKey
|
|
3D0A3CE1 = NtDeleteFile
|
|
A138D474 = NtDeleteDriverEntry
|
|
B180D2FC = NtDeleteBootEntry
|
|
3DED7D69 = NtDeleteAtom
|
|
BD36E55F = NtDelayExecution
|
|
0EF0BC13 = NtDebugContinue
|
|
14CB8B5B = NtDebugActiveProcess
|
|
1B7924ED = NtCurrentTeb
|
|
0F623381 = NtCreateWorkerFactory
|
|
2970483C = NtCreateWaitablePort
|
|
AC936A98 = NtCreateUserProcess
|
|
3C83116D = NtCreateTransactionManager
|
|
EA48E85D = NtCreateTransaction
|
|
2CD7B13A = NtCreateToken
|
|
2C163126 = NtCreateTimer
|
|
26BCA4C6 = NtCreateThreadEx
|
|
18F89AF2 = NtCreateThread
|
|
98B956F9 = NtCreateSymbolicLinkObject
|
|
48C29A57 = NtCreateSemaphore
|
|
6E6F608B = NtCreateSection
|
|
EB9FCD96 = NtCreateResourceManager
|
|
DB6E09F3 = NtCreateProfileEx
|
|
AC2F6DB8 = NtCreateProfile
|
|
188B89DB = NtCreateProcessEx
|
|
AC8C622E = NtCreateProcess
|
|
17CD7616 = NtCreatePrivateNamespace
|
|
A8D9A3F3 = NtCreatePort
|
|
107FCFB0 = NtCreatePagingFile
|
|
69F6C7D2 = NtCreateNamedPipeFile
|
|
C8399DAB = NtCreateMutant
|
|
2396BF34 = NtCreateMailslotFile
|
|
B240FEFE = NtCreateKeyedEvent
|
|
BB631A53 = NtCreateKeyTransacted
|
|
0F57764C = NtCreateKey
|
|
6AF51812 = NtCreateJobSet
|
|
71942FB7 = NtCreateJobObject
|
|
36EA4D33 = NtCreateIoCompletion
|
|
AA182CE2 = NtCreateFile
|
|
19E737B8 = NtCreateEventPair
|
|
3FF434A1 = NtCreateEvent
|
|
AA0ACE42 = NtCreateEnlistment
|
|
46C0DA3B = NtCreateDirectoryObject
|
|
7ABDBB3C = NtCreateDebugObject
|
|
39BC05B5 = NtContinue
|
|
A028FE9C = NtConnectPort
|
|
D77DA921 = NtCompressKey
|
|
7C63D1BF = NtCompleteConnectPort
|
|
38A11B96 = NtCompareTokens
|
|
A0766B1B = NtCompactKeys
|
|
8B9AF27D = NtCommitTransaction
|
|
EAC96A76 = NtCommitEnlistment
|
|
E7E3E3AC = NtCommitComplete
|
|
7C4C01F8 = NtCloseObjectAuditAlarm
|
|
3D9AC241 = NtClose
|
|
B21B2DC1 = NtClearEvent
|
|
A7127567 = NtCancelTimer
|
|
F0E2B2F7 = NtCancelSynchronousIoFile
|
|
6F1799EE = NtCancelIoFileEx
|
|
EC59BC5E = NtCancelIoFile
|
|
2147D11B = NtCallbackReturn
|
|
AF73B94A = NtAssignProcessToJobObject
|
|
4C92004E = NtAreMappedFilesTheSame
|
|
192BFFE4 = NtApphelpCacheControl
|
|
C6F7C6A4 = NtAlpcSetInformation
|
|
42C741B2 = NtAlpcSendWaitReceivePort
|
|
53186995 = NtAlpcRevokeSecurityContext
|
|
F44F9E36 = NtAlpcQueryInformationMessage
|
|
6D7E651B = NtAlpcQueryInformation
|
|
FE6C14CD = NtAlpcOpenSenderThread
|
|
E6CB7DDD = NtAlpcOpenSenderProcess
|
|
2768F52C = NtAlpcImpersonateClientOfPort
|
|
A2B4FECF = NtAlpcDisconnectPort
|
|
D6060993 = NtAlpcDeleteSecurityContext
|
|
2C1FB755 = NtAlpcDeleteSectionView
|
|
9218CB1A = NtAlpcDeleteResourceReserve
|
|
E95F5AD9 = NtAlpcDeletePortSection
|
|
94067B71 = NtAlpcCreateSecurityContext
|
|
0C189971 = NtAlpcCreateSectionView
|
|
D018B9F8 = NtAlpcCreateResourceReserve
|
|
C95874FD = NtAlpcCreatePortSection
|
|
A61EFBE1 = NtAlpcCreatePort
|
|
C384F79B = NtAlpcConnectPort
|
|
7DDCA6AB = NtAlpcCancelMessage
|
|
81AD248E = NtAlpcAcceptConnectPort
|
|
0952A9E4 = NtAllocateVirtualMemory
|
|
19643B52 = NtAllocateUuids
|
|
E2E2F19C = NtAllocateUserPhysicalPages
|
|
FEDF8531 = NtAllocateReserveObject
|
|
EEBCACBF = NtAllocateLocallyUniqueId
|
|
EF523234 = NtAlertThread
|
|
568966BF = NtAlertResumeThread
|
|
3FFC4ADD = NtAdjustPrivilegesToken
|
|
376E6932 = NtAdjustGroupsToken
|
|
3A7CA206 = NtAddDriverEntry
|
|
684ABFED = NtAddBootEntry
|
|
06D430CB = NtAddAtom
|
|
B5B5B30B = NtAccessCheckByTypeResultListAndAuditAlarmByHandle
|
|
E96328A8 = NtAccessCheckByTypeResultListAndAuditAlarm
|
|
A5E5E820 = NtAccessCheckByTypeResultList
|
|
3F1D34E1 = NtAccessCheckByTypeAndAuditAlarm
|
|
6A26611A = NtAccessCheckByType
|
|
DA9DE699 = NtAccessCheckAndAuditAlarm
|
|
DA3C2E06 = NtAccessCheck
|
|
31893900 = NtAcceptConnectPort
|
|
50505887 = NlsMbOemCodePageTag
|
|
04A2BEAD = NlsMbCodePageTag
|
|
D4A7F641 = NlsAnsiCodePage
|
|
4110ACCA = MD5Update
|
|
593A82D7 = MD5Init
|
|
6DA0A140 = MD5Final
|
|
4110A8CA = MD4Update
|
|
493A82D7 = MD4Init
|
|
6DA0A148 = MD4Final
|
|
A759EB72 = LdrpResGetResourceDirectory
|
|
0C934E31 = LdrpResGetMappingSize
|
|
8FC9008B = LdrWx86FormatVirtualImage
|
|
0435004B = LdrVerifyImageMatchesChecksumEx
|
|
8ACC10D4 = LdrVerifyImageMatchesChecksum
|
|
B9ECC6F1 = LdrUnregisterDllNotification
|
|
12D6B38A = LdrUnlockLoaderLock
|
|
49451C2B = LdrUnloadDll
|
|
9293F851 = LdrUnloadAlternateResourceModuleEx
|
|
6AA64A4F = LdrUnloadAlternateResourceModule
|
|
7F74BEBA = LdrShutdownThread
|
|
6A9E461D = LdrShutdownProcess
|
|
9070A708 = LdrSetMUICacheType
|
|
6F6149CC = LdrSetDllManifestProber
|
|
324EAC8F = LdrSetAppCompatDllRedirectionCallback
|
|
1C99016B = LdrRscIsTypeExist
|
|
B117D89D = LdrResSearchResource
|
|
AD93AE62 = LdrResRelease
|
|
9F6E02C1 = LdrResGetRCConfig
|
|
B3EABEF4 = LdrResFindResourceDirectory
|
|
93451947 = LdrResFindResource
|
|
12841200 = LdrRemoveLoadAsDataTable
|
|
A0F3F7C0 = LdrRegisterDllNotification
|
|
C4D00167 = LdrQueryProcessModuleInformation
|
|
70FBAFF9 = LdrQueryModuleServiceTags
|
|
CA595387 = LdrQueryImageFileKeyOption
|
|
780CA0C5 = LdrQueryImageFileExecutionOptionsEx
|
|
08F5E032 = LdrQueryImageFileExecutionOptions
|
|
CFF13015 = LdrProcessRelocationBlock
|
|
61473A41 = LdrOpenImageFileOptionsKey
|
|
20E8D1E8 = LdrLockLoaderLock
|
|
78740534 = LdrLoadDll
|
|
EE573C35 = LdrLoadAlternateResourceModuleEx
|
|
7B37B95C = LdrLoadAlternateResourceModule
|
|
F134E311 = LdrInitializeThunk
|
|
876AF23D = LdrInitShimEngineDynamic
|
|
6465C143 = LdrHotPatchRoutine
|
|
0A1D6E77 = LdrGetProcedureAddressEx
|
|
323C2875 = LdrGetProcedureAddress
|
|
2CF8204A = LdrGetFileNameFromLoadAsDataTable
|
|
8F53F58D = LdrGetFailureData
|
|
1F1ABD72 = LdrGetDllHandleEx
|
|
3829DD0A = LdrGetDllHandleByName
|
|
73FD7E5D = LdrGetDllHandleByMapping
|
|
7E287C6A = LdrGetDllHandle
|
|
05F5110A = LdrFlushAlternateResourceModules
|
|
7F4FC099 = LdrFindResource_U
|
|
F36D3006 = LdrFindResourceEx_U
|
|
333206E1 = LdrFindResourceDirectory_U
|
|
E07AA7F0 = LdrFindEntryForAddress
|
|
BF639C5E = LdrEnumerateLoadedModules
|
|
18CE7969 = LdrEnumResources
|
|
F6906FE8 = LdrDisableThreadCalloutsForDll
|
|
1D113DC3 = LdrAddRefDll
|
|
5607F0BE = LdrAddLoadAsDataTable
|
|
036996C8 = LdrAccessResource
|
|
A8FDD41E = KiUserExceptionDispatcher
|
|
34CF6E87 = KiUserCallbackDispatcher
|
|
45560E9A = KiUserApcDispatcher
|
|
F08B329C = KiRaiseUserExceptionDispatcher
|
|
6D027944 = KiIntSystemCall
|
|
F9B642DD = KiFastSystemCallRet
|
|
17814FCD = KiFastSystemCall
|
|
40A065CE = ExpInterlockedPopEntrySListResume
|
|
1600CC53 = ExpInterlockedPopEntrySListFault
|
|
E89C9F92 = ExpInterlockedPopEntrySListEnd
|
|
67C07A79 = EvtIntReportEventAndSourceAsync
|
|
872266AF = EvtIntReportAuthzEventAndSourceAsync
|
|
F45A1563 = EtwpNotificationThread
|
|
6DE0A1AC = EtwpGetCpuSpeed
|
|
A79B726E = EtwpCreateEtwThread
|
|
6265ADE9 = EtwWriteUMSecurityEvent
|
|
3DF7F4E8 = EtwUnregisterTraceGuids
|
|
765B75D3 = EtwTraceMessageVa
|
|
7AC9D96D = EtwTraceMessage
|
|
FE804E1F = EtwTraceEventInstance
|
|
BD573666 = EtwSetMark
|
|
7B69AC8C = EtwSendNotification
|
|
2B1CC874 = EtwReplyNotification
|
|
2A6867EA = EtwRegisterTraceGuidsW
|
|
2A6867FC = EtwRegisterTraceGuidsA
|
|
BF70EDB8 = EtwRegisterSecurityProvider
|
|
00C3726E = EtwProcessPrivateLoggerRequest
|
|
7B1A2292 = EtwNotificationUnregister
|
|
83088BC6 = EtwNotificationRegister
|
|
90D78A61 = EtwLogTraceEvent
|
|
89B8FAAF = EtwGetTraceLoggerHandle
|
|
539F578D = EtwGetTraceEnableLevel
|
|
F2BA9692 = EtwGetTraceEnableFlags
|
|
CC5CB6A0 = EtwEventWriteTransfer
|
|
732AFFCB = EtwEventWriteString
|
|
89C3D959 = EtwEventWriteStartScenario
|
|
B2BA8D83 = EtwEventWriteNoRegistration
|
|
201183AE = EtwEventWriteFull
|
|
D70881CB = EtwEventWriteEx
|
|
631F7B2F = EtwEventWriteEndScenario
|
|
8CCF5C22 = EtwEventWrite
|
|
E43197F1 = EtwEventUnregister
|
|
5686F768 = EtwEventRegister
|
|
4A096E1F = EtwEventProviderEnabled
|
|
55CA9937 = EtwEventEnabled
|
|
0C566B2F = EtwEventActivityIdControl
|
|
01C3FC42 = EtwEnumerateProcessRegGuids
|
|
75B17218 = EtwDeliverDataBlock
|
|
37CA3B0F = EtwCreateTraceInstanceId
|
|
D0498916 = DbgUserBreakPoint
|
|
50996AC6 = DbgUiWaitStateChange
|
|
576DA866 = DbgUiStopDebugging
|
|
055471CF = DbgUiSetThreadDebugObject
|
|
C7BF8B58 = DbgUiRemoteBreakin
|
|
F238D963 = DbgUiIssueRemoteBreakin
|
|
0554734F = DbgUiGetThreadDebugObject
|
|
47DDF83D = DbgUiDebugActiveProcess
|
|
B57639FB = DbgUiConvertStateChangeStructure
|
|
A0F05C78 = DbgUiContinue
|
|
8DE600AB = DbgUiConnectToDbg
|
|
35FFB927 = DbgSetDebugFilterState
|
|
37698BE3 = DbgQueryDebugFilterState
|
|
693EE6F3 = DbgPrompt
|
|
8DCD256B = DbgPrintReturnControlC
|
|
FF12614C = DbgPrintEx
|
|
0ED3FC49 = DbgPrint
|
|
7B7DA9C8 = DbgBreakPoint
|
|
AA1D490E = CsrVerifyRegion
|
|
93B757CF = CsrSetPriorityClass
|
|
193FE64D = CsrIdentifyAlertableThread
|
|
91B1A38F = CsrGetProcessId
|
|
FC46F534 = CsrFreeCaptureBuffer
|
|
6963010F = CsrClientConnectToServer
|
|
082B5AEE = CsrClientCallServer
|
|
302D534A = CsrCaptureTimeout
|
|
F4A29EB3 = CsrCaptureMessageString
|
|
D901D6DD = CsrCaptureMessageMultiUnicodeStringsInPlace
|
|
E6215BAE = CsrCaptureMessageBuffer
|
|
2FA76A96 = CsrAllocateMessagePointer
|
|
FD77C610 = CsrAllocateCaptureBuffer
|
|
876EFCF2 = AlpcUnregisterCompletionListWorkerThread
|
|
6BD4962F = AlpcUnregisterCompletionList
|
|
E3FCE264 = AlpcRundownCompletionList
|
|
734E1D7A = AlpcRegisterCompletionListWorkerThread
|
|
65CC196D = AlpcRegisterCompletionList
|
|
89DCC79C = AlpcMaxAllowedMessageLength
|
|
7445F611 = AlpcInitializeMessageAttribute
|
|
629FCA32 = AlpcGetOutstandingCompletionListMessageCount
|
|
44AB6A00 = AlpcGetMessageFromCompletionList
|
|
371B07E6 = AlpcGetMessageAttribute
|
|
53848AAD = AlpcGetHeaderSize
|
|
3D546DC8 = AlpcGetCompletionListMessageAttributes
|
|
9837C196 = AlpcGetCompletionListLastMessageInformation
|
|
F01DA32E = AlpcFreeCompletionListMessage
|
|
93CAD7C3 = AlpcAdjustCompletionListConcurrencyCount
|
|
DF096CA5 = A_SHAUpdate
|
|
5884FAB0 = A_SHAInit
|
|
B29C92C0 = A_SHAFinal
|