ntdll.dll

• File Path: C:\Windows\system32\ntdll.dll
• Description: NT Layer DLL

Hashes

Type	Hash
MD5	635887A7BE92C96C04606D52646DEF5B
SHA1	9BDDE709ABCB4F52290899AC31B2A2DED1E785E3
SHA256	B362B0BC83463CF58F5C0E666A76DDE2AEB63A435C79642719FD32FB9FADFB13
SHA384	C67CDF8AF8EB29A6933D629A150613C1F951F3D8297669F42E567992C87F98B48BBD5FBA30ED01DDACD474089B3FDEC3
SHA512	AE25996BCBA43BC15DBF07201AA1960E4F41EF03D26FEB9330A6208176068B359847D597FEDC24CD76A393E14EA72A68BACAE255F70EB6872CE212FF31147C9A
SSDEEP	24576:LUf29Nixbe/hV4cDk53EaZR1zYm1eBtXUuuMMocF+i0SSXX5PLeiXCNFO2Yk:+je/n4cc3EaZR1IquhMocs5SGpe/
PESHA1	468E1B3374708A3E1278032EF1B96AD2EEF42221
PE256	DD9DD1E61C61E47EC981DF5FC9F7C99F697042DEB32388B2ADD4BE0B2560295C

DLL Exports:

Function Name	Ordinal	Type
RtlSetProcessPlaceholderCompatibilityMode	1457	Exported Function
RtlSetProcessIsCritical	1456	Exported Function
RtlSetProtectedPolicy	1459	Exported Function
RtlSetProcessPreferredUILanguages	1458	Exported Function
RtlSetProcessDebugInformation	1455	Exported Function
RtlSetMemoryStreamSize	1452	Exported Function
RtlSetLastWin32ErrorAndNtStatusFromNtStatus	1451	Exported Function
RtlSetPortableOperatingSystem	1454	Exported Function
RtlSetOwnerSecurityDescriptor	1453	Exported Function
RtlSetSystemBootStatus	1466	Exported Function
RtlSetSecurityObjectEx	1465	Exported Function
RtlSetThreadErrorMode	1468	Exported Function
RtlSetSystemBootStatusEx	1467	Exported Function
RtlSetSecurityObject	1464	Exported Function
RtlSetSaclSecurityDescriptor	1461	Exported Function
RtlSetProxiedProcessId	1460	Exported Function
RtlSetSecurityDescriptorRMControl	1463	Exported Function
RtlSetSearchPathMode	1462	Exported Function
RtlSetLastWin32Error	1450	Exported Function
RtlSetDaclSecurityDescriptor	1438	Exported Function
RtlSetCurrentTransaction	1437	Exported Function
RtlSetEnvironmentStrings	1440	Exported Function
RtlSetDynamicTimeZoneInformation	1439	Exported Function
RtlSetCurrentEnvironment	1436	Exported Function
RtlSetControlSecurityDescriptor	1433	Exported Function
RtlSetBitsEx	1432	Exported Function
RtlSetCurrentDirectory_U	1435	Exported Function
RtlSetCriticalSectionSpinCount	1434	Exported Function
RtlSetImageMitigationPolicy	1447	Exported Function
RtlSetHeapInformation	1446	Exported Function
RtlSetIoCompletionCallback	1449	Exported Function
RtlSetInformationAcl	1448	Exported Function
RtlSetGroupSecurityDescriptor	1445	Exported Function
RtlSetEnvironmentVariable	1442	Exported Function
RtlSetEnvironmentVar	1441	Exported Function
RtlSetFeatureConfigurations	1444	Exported Function
RtlSetExtendedFeaturesMask	1443	Exported Function
RtlSetThreadIsCritical	1469	Exported Function
RtlStringFromGUIDEx	1495	Exported Function
RtlStringFromGUID	1494	Exported Function
RtlSubAuthorityCountSid	1497	Exported Function
RtlStronglyEnumerateEntryHashTable	1496	Exported Function
RtlStatMemoryStream	1493	Exported Function
RtlSleepConditionVariableSRW	1490	Exported Function
RtlSleepConditionVariableCS	1489	Exported Function
RtlStartRXact	1492	Exported Function
RtlSplay	1491	Exported Function
RtlSystemTimeToLocalTime	1504	Exported Function
RtlSwitchedVVI	1503	Exported Function
RtlTestBit	1506	Exported Function
RtlTestAndPublishWnfStateData	1505	Exported Function
RtlSubtreeSuccessor	1502	Exported Function
RtlSubscribeForFeatureUsageNotification	1499	Exported Function
RtlSubAuthoritySid	1498	Exported Function
RtlSubtreePredecessor	1501	Exported Function
RtlSubscribeWnfStateChangeNotification	1500	Exported Function
RtlSizeHeap	1488	Exported Function
RtlSetTimer	1477	Exported Function
RtlSetThreadWorkOnBehalfTicket	1475	Exported Function
RtlSetUmsThreadInformation	1478	Exported Function
RtlSetTimeZoneInformation	1476	Exported Function
RtlSetThreadSubProcessTag	1474	Exported Function
RtlSetThreadPoolStartFunc	1471	Exported Function
RtlSetThreadPlaceholderCompatibilityMode	1470	Exported Function
RtlSetThreadPreferredUILanguages2	1473	Exported Function
RtlSetThreadPreferredUILanguages	1472	Exported Function
RtlSidHashInitialize	1485	Exported Function
RtlSidEqualLevel	1484	Exported Function
RtlSidIsHigherLevel	1487	Exported Function
RtlSidHashLookup	1486	Exported Function
RtlSidDominatesForTrust	1483	Exported Function
RtlSetUserFlagsHeap	1480	Exported Function
RtlSetUnhandledExceptionFilter	1479	Exported Function
RtlSidDominates	1482	Exported Function
RtlSetUserValueHeap	1481	Exported Function
RtlSetBits	1431	Exported Function
RtlRegisterThreadWithCsrss	1381	Exported Function
RtlRegisterSecureMemoryCacheCallback	1380	Exported Function
RtlReleaseActivationContext	1383	Exported Function
RtlRegisterWait	1382	Exported Function
RtlRegisterForWnfMetaNotification	1379	Exported Function
RtlRealPredecessor	1376	Exported Function
RtlReAllocateHeap	1372	Exported Function
RtlRegisterFeatureConfigurationChangeNotification	1378	Exported Function
RtlRealSuccessor	1377	Exported Function
RtlReleaseSRWLockExclusive	1390	Exported Function
RtlReleaseResource	1389	Exported Function
RtlRemoteCall	1392	Exported Function
RtlReleaseSRWLockShared	1391	Exported Function
RtlReleaseRelativeName	1388	Exported Function
RtlReleasePath	1385	Exported Function
RtlReleaseMemoryStream	1384	Exported Function
RtlReleasePrivilege	1387	Exported Function
RtlReleasePebLock	1386	Exported Function
RtlReadThreadProfilingData	1375	Exported Function
RtlQueueWorkItem	1362	Exported Function
RtlQueueApcWow64Thread	1361	Exported Function
RtlRaiseException	1364	Exported Function
RtlRaiseCustomSystemEventTrigger	1363	Exported Function
RtlQueryWnfStateDataWithExplicitScope	1360	Exported Function
RtlQueryValidationRunlevel	1357	Exported Function
RtlQueryUnbiasedInterruptTime	1356	Exported Function
RtlQueryWnfStateData	1359	Exported Function
RtlQueryWnfMetaNotification	1358	Exported Function
RtlRbRemoveNode	1371	Exported Function
RtlRbInsertNodeEx	1370	Exported Function
RtlReadOutOfProcessMemoryStream	1374	Exported Function
RtlReadMemoryStream	1373	Exported Function
RtlRandomEx	1369	Exported Function
RtlRaiseNoncontinuableException	1366	Exported Function
RtlRaiseExceptionForReturnAddressHijack	1365	Exported Function
RtlRandom	1368	Exported Function
RtlRaiseStatus	1367	Exported Function
RtlRemoveEntryHashTable	1393	Exported Function
RtlRunOnceInitialize	1419	Exported Function
RtlRunOnceExecuteOnce	1418	Exported Function
RtlSecondsSince1980ToTime	1421	Exported Function
RtlSecondsSince1970ToTime	1420	Exported Function
RtlRunOnceComplete	1417	Exported Function
RtlRunDecodeUnicodeString	1414	Exported Function
RtlRevertMemoryStream	1413	Exported Function
RtlRunOnceBeginInitialize	1416	Exported Function
RtlRunEncodeUnicodeString	1415	Exported Function
RtlSetAttributesSecurityDescriptor	1428	Exported Function
RtlSetAllBitsEx	1427	Exported Function
RtlSetBitEx	1430	Exported Function
RtlSetBit	1429	Exported Function
RtlSetAllBits	1426	Exported Function
RtlSelfRelativeToAbsoluteSD	1423	Exported Function
RtlSeekMemoryStream	1422	Exported Function
RtlSendMsgToSm	1425	Exported Function
RtlSelfRelativeToAbsoluteSD2	1424	Exported Function
RtlRetrieveNtUserPfn	1412	Exported Function
RtlReportExceptionEx	1400	Exported Function
RtlReportException	1399	Exported Function
RtlReportSqmEscalation	1402	Exported Function
RtlReportSilentProcessExit	1401	Exported Function
RtlReplaceSystemDirectoryInPath	1398	Exported Function
RtlRemoveVectoredContinueHandler	1395	Exported Function
RtlRemovePrivileges	1394	Exported Function
RtlReplaceSidInSd	1397	Exported Function
RtlRemoveVectoredExceptionHandler	1396	Exported Function
RtlRestoreLastWin32Error	1409	Exported Function
RtlRestoreContext	1408	Exported Function
RtlRestoreThreadPreferredUILanguages	1411	Exported Function
RtlRestoreSystemBootStatusDefaults	1410	Exported Function
RtlRestoreBootStatusDefaults	1407	Exported Function
RtlResetMemoryZone	1404	Exported Function
RtlResetMemoryBlockLookaside	1403	Exported Function
RtlResetRtlTranslations	1406	Exported Function
RtlResetNtUserPfn	1405	Exported Function
RtlTestBitEx	1507	Exported Function
RtlWow64GetThreadContext	1609	Exported Function
RtlWow64GetSharedInfoProcess	1608	Exported Function
RtlWow64IsWowGuestMachineSupported	1611	Exported Function
RtlWow64GetThreadSelectorEntry	1610	Exported Function
RtlWow64GetProcessMachines	1607	Exported Function
RtlWow64GetCurrentCpuArea	1604	Exported Function
RtlWow64GetCpuAreaInfo	1603	Exported Function
RtlWow64GetEquivalentMachineCHPE	1606	Exported Function
RtlWow64GetCurrentMachine	1605	Exported Function
RtlWow64SetThreadContext	1618	Exported Function
RtlWow64RequestCrossProcessHeavyFlush	1617	Exported Function
RtlWow64SuspendThread	1620	Exported Function
RtlWow64SuspendProcess	1619	Exported Function
RtlWow64PushCrossProcessWorkOntoWorkList	1616	Exported Function
RtlWow64PopAllCrossProcessWorkFromWorkList	1613	Exported Function
RtlWow64LogMessageInEventLogger	1612	Exported Function
RtlWow64PushCrossProcessWorkOntoFreeList	1615	Exported Function
RtlWow64PopCrossProcessWorkFromFreeList	1614	Exported Function
RtlWow64EnableFsRedirectionEx	1602	Exported Function
RtlWakeAddressSingle	1590	Exported Function
RtlWakeAddressAllNoFence	1589	Exported Function
RtlWakeAllConditionVariable	1592	Exported Function
RtlWakeAddressSingleNoFence	1591	Exported Function
RtlWakeAddressAll	1588	Exported Function
RtlVirtualUnwind	1585	Exported Function
RtlVerifyVersionInfo	1584	Exported Function
RtlWaitOnAddress	1587	Exported Function
RtlWaitForWnfMetaNotification	1586	Exported Function
RtlWnfDllUnloadCallback	1599	Exported Function
RtlWnfCompareChangeStamp	1598	Exported Function
RtlWow64EnableFsRedirection	1601	Exported Function
RtlWow64CallFunction64	1600	Exported Function
RtlWerpReportException	1597	Exported Function
RtlWalkFrameChain	1594	Exported Function
RtlWakeConditionVariable	1593	Exported Function
RtlWeaklyEnumerateEntryHashTable	1596	Exported Function
RtlWalkHeap	1595	Exported Function
RtlWriteMemoryStream	1621	Exported Function
strcpy	2386	Exported Function
strcmp	2385	Exported Function
strcspn	2388	Exported Function
strcpy_s	2387	Exported Function
strchr	2384	Exported Function
sscanf_s	2381	Exported Function
sscanf	2380	Exported Function
strcat_s	2383	Exported Function
strcat	2382	Exported Function
strnlen	2395	Exported Function
strncpy_s	2394	Exported Function
strrchr	2397	Exported Function
strpbrk	2396	Exported Function
strncpy	2393	Exported Function
strncat	2390	Exported Function
strlen	2389	Exported Function
strncmp	2392	Exported Function
strncat_s	2391	Exported Function
sqrt	2379	Exported Function
RtlZeroHeap	1624	Exported Function
RtlxUnicodeStringToOemSize	1679	Exported Function
RtlZombifyActivationContext	1626	Exported Function
RtlZeroMemory	1625	Exported Function
RtlxUnicodeStringToAnsiSize	1678	Exported Function
RtlWriteRegistryValue	1623	Exported Function
RtlWriteNonVolatileMemory	1622	Exported Function
RtlxOemStringToUnicodeSize	1677	Exported Function
RtlxAnsiStringToUnicodeSize	1676	Exported Function
sin	2376	Exported Function
ShipAssertMsgW	1685	Exported Function
sprintf_s	2378	Exported Function
sprintf	2377	Exported Function
ShipAssertMsgA	1684	Exported Function
SbSelectProcedure	1681	Exported Function
SbExecuteProcedure	1680	Exported Function
ShipAssertGetBufferInfo	1683	Exported Function
ShipAssert	1682	Exported Function
RtlValidSid	1579	Exported Function
RtlUnicodeStringToCountedOemString	1535	Exported Function
RtlUnicodeStringToAnsiString	1534	Exported Function
RtlUnicodeStringToOemSize	1537	Exported Function
RtlUnicodeStringToInteger	1536	Exported Function
RtlUnicodeStringToAnsiSize	1533	Exported Function
RtlUmsThreadYield	1530	Exported Function
RtlUdiv128	1529	Exported Function
RtlUnhandledExceptionFilter2	1532	Exported Function
RtlUnhandledExceptionFilter	1531	Exported Function
RtlUnicodeToUTF8N	1544	Exported Function
RtlUnicodeToOemN	1543	Exported Function
RtlUnlockBootStatusData	1546	Exported Function
RtlUniform	1545	Exported Function
RtlUnicodeToMultiByteSize	1542	Exported Function
RtlUnicodeStringToUTF8String	1539	Exported Function
RtlUnicodeStringToOemString	1538	Exported Function
RtlUnicodeToMultiByteN	1541	Exported Function
RtlUnicodeToCustomCPN	1540	Exported Function
RtlTryEnterCriticalSection	1526	Exported Function
RtlTraceDatabaseAdd	1514	Exported Function
RtlTimeToTimeFields	1513	Exported Function
RtlTraceDatabaseDestroy	1516	Exported Function
RtlTraceDatabaseCreate	1515	Exported Function
RtlTimeToSecondsSince1980	1512	Exported Function
RtlTimeFieldsToTime	1509	Exported Function
RtlTestProtectedAccess	1508	Exported Function
RtlTimeToSecondsSince1970	1511	Exported Function
RtlTimeToElapsedTimeFields	1510	Exported Function
RtlTryAcquireSRWLockExclusive	1523	Exported Function
RtlTryAcquirePebLock	1522	Exported Function
RtlTryConvertSRWLockSharedToExclusiveOrRelease	1525	Exported Function
RtlTryAcquireSRWLockShared	1524	Exported Function
RtlTraceDatabaseValidate	1521	Exported Function
RtlTraceDatabaseFind	1518	Exported Function
RtlTraceDatabaseEnumerate	1517	Exported Function
RtlTraceDatabaseUnlock	1520	Exported Function
RtlTraceDatabaseLock	1519	Exported Function
RtlUnlockCurrentThread	1547	Exported Function
RtlUserFiberStart	1573	Exported Function
RtlUpperString	1572	Exported Function
RtlUTF8StringToUnicodeString	1527	Exported Function
RtlUserThreadStart	1574	Exported Function
RtlUpperChar	1571	Exported Function
RtlUpdateClonedCriticalSection	1568	Exported Function
RtlUpcaseUnicodeToOemN	1567	Exported Function
RtlUpdateTimer	1570	Exported Function
RtlUpdateClonedSRWLock	1569	Exported Function
RtlValidProcessProtection	1576	Exported Function
RtlValidateUnicodeString	1583	Exported Function
RtlValidSecurityDescriptor	1578	Exported Function
RtlValidRelativeSecurityDescriptor	1577	Exported Function
RtlValidateProcessHeaps	1582	Exported Function
RtlValidAcl	1575	Exported Function
RtlUTF8ToUnicodeN	1528	Exported Function
RtlValidateHeap	1581	Exported Function
RtlValidateCorrelationVector	1580	Exported Function
RtlUpcaseUnicodeToMultiByteN	1566	Exported Function
RtlUnsubscribeFromFeatureUsageNotifications	1554	Exported Function
RtlUnregisterFeatureConfigurationChangeNotification	1553	Exported Function
RtlUnsubscribeWnfNotificationWithCompletionCallback	1556	Exported Function
RtlUnsubscribeWnfNotificationWaitForCompletion	1555	Exported Function
RtlUnlockModuleSection	1552	Exported Function
RtlUnlockMemoryBlockLookaside	1549	Exported Function
RtlUnlockHeap	1548	Exported Function
RtlUnlockMemoryZone	1551	Exported Function
RtlUnlockMemoryStreamRegion	1550	Exported Function
RtlUpcaseUnicodeStringToCountedOemString	1563	Exported Function
RtlUpcaseUnicodeStringToAnsiString	1562	Exported Function
RtlUpcaseUnicodeToCustomCPN	1565	Exported Function
RtlUpcaseUnicodeStringToOemString	1564	Exported Function
RtlUpcaseUnicodeString	1561	Exported Function
RtlUnwind	1558	Exported Function
RtlUnsubscribeWnfStateChangeNotification	1557	Exported Function
RtlUpcaseUnicodeChar	1560	Exported Function
RtlUnwindEx	1559	Exported Function
RtlQueryUmsThreadInformation	1355	Exported Function
RtlIsActivationContextActive	1202	Exported Function
RtlIpv6StringToAddressW	1201	Exported Function
RtlIsCloudFilesPlaceholder	1204	Exported Function
RtlIsCapabilitySid	1203	Exported Function
RtlIpv6StringToAddressExW	1200	Exported Function
RtlIpv6AddressToStringW	1197	Exported Function
RtlIpv6AddressToStringExW	1196	Exported Function
RtlIpv6StringToAddressExA	1199	Exported Function
RtlIpv6StringToAddressA	1198	Exported Function
RtlIsElevatedRid	1211	Exported Function
RtlIsDosDeviceName_U	1210	Exported Function
RtlIsGenericTableEmptyAvl	1213	Exported Function
RtlIsGenericTableEmpty	1212	Exported Function
RtlIsCurrentThreadAttachExempt	1209	Exported Function
RtlIsCriticalSectionLockedByThread	1206	Exported Function
RtlIsCriticalSectionLocked	1205	Exported Function
RtlIsCurrentThread	1208	Exported Function
RtlIsCurrentProcess	1207	Exported Function
RtlIpv6AddressToStringExA	1195	Exported Function
RtlInterlockedSetBitRun	1183	Exported Function
RtlInterlockedPushListSListEx	1182	Exported Function
RtlIoEncodeMemIoResource	1185	Exported Function
RtlIoDecodeMemIoResource	1184	Exported Function
RtlInterlockedPushListSList	1181	Exported Function
RtlInterlockedFlushSList	1178	Exported Function
RtlInterlockedClearBitRun	1177	Exported Function
RtlInterlockedPushEntrySList	1180	Exported Function
RtlInterlockedPopEntrySList	1179	Exported Function
RtlIpv4StringToAddressExW	1192	Exported Function
RtlIpv4StringToAddressExA	1191	Exported Function
RtlIpv6AddressToStringA	1194	Exported Function
RtlIpv4StringToAddressW	1193	Exported Function
RtlIpv4StringToAddressA	1190	Exported Function
RtlIpv4AddressToStringExA	1187	Exported Function
RtlIpv4AddressToStringA	1186	Exported Function
RtlIpv4AddressToStringW	1189	Exported Function
RtlIpv4AddressToStringExW	1188	Exported Function
RtlIsMultiSessionSku	1214	Exported Function
RtlLeaveCriticalSection	1240	Exported Function
RtlLcidToLocaleName	1239	Exported Function
RtlLengthSecurityDescriptor	1242	Exported Function
RtlLengthRequiredSid	1241	Exported Function
RtlLCIDToCultureName	1237	Exported Function
RtlIsZeroMemory	1235	Exported Function
RtlIsValidProcessTrustLabelSid	1234	Exported Function
RtlLargeIntegerToChar	1238	Exported Function
RtlKnownExceptionFilter	1236	Exported Function
RtlLocateExtendedFeature2	1249	Exported Function
RtlLocateExtendedFeature	1248	Exported Function
RtlLockBootStatusData	1251	Exported Function
RtlLocateLegacyContext	1250	Exported Function
RtlLocalTimeToSystemTime	1246	Exported Function
RtlLengthSidAsUnicodeString	1244	Exported Function
RtlLengthSid	1243	Exported Function
RtlLocaleNameToLcid	1247	Exported Function
RtlLoadString	1245	Exported Function
RtlIsValidLocaleName	1233	Exported Function
RtlIsPackageSid	1221	Exported Function
RtlIsNormalizedString	1220	Exported Function
RtlIsPartialPlaceholder	1223	Exported Function
RtlIsParentOfChildAppContainer	1222	Exported Function
RtlIsNonEmptyDirectoryReparsePointAllowed	1219	Exported Function
RtlIsNameInExpression	1216	Exported Function
RtlIsMultiUsersInSessionSku	1215	Exported Function
RtlIsNameLegalDOS8Dot3	1218	Exported Function
RtlIsNameInUnUpcasedExpression	1217	Exported Function
RtlIsUntrustedObject	1230	Exported Function
RtlIsThreadWithinLoaderCallout	1229	Exported Function
RtlIsValidIndexHandle	1232	Exported Function
RtlIsValidHandle	1231	Exported Function
RtlIsTextUnicode	1228	Exported Function
RtlIsPartialPlaceholderFileInfo	1225	Exported Function
RtlIsPartialPlaceholderFileHandle	1224	Exported Function
RtlIsStateSeparationEnabled	1227	Exported Function
RtlIsProcessorFeaturePresent	1226	Exported Function
RtlIntegerToUnicodeString	1176	Exported Function
RtlImageRvaToSection	1126	Exported Function
RtlImageNtHeaderEx	1125	Exported Function
RtlImpersonateSelf	1128	Exported Function
RtlImageRvaToVa	1127	Exported Function
RtlImageNtHeader	1124	Exported Function
RtlIdnToNameprepUnicode	1121	Exported Function
RtlIdnToAscii	1120	Exported Function
RtlImageDirectoryEntryToData	1123	Exported Function
RtlIdnToUnicode	1122	Exported Function
RtlInitEnumerationHashTable	1135	Exported Function
RtlInitCodePageTable	1134	Exported Function
RtlInitializeBitMap	1148	Exported Function
RtlInitializeAtomPackage	1147	Exported Function
RtlInitBarrier	1133	Exported Function
RtlIncrementCorrelationVector	1130	Exported Function
RtlImpersonateSelfEx	1129	Exported Function
RtlInitAnsiStringEx	1132	Exported Function
RtlInitAnsiString	1131	Exported Function
RtlIdentifierAuthoritySid	1119	Exported Function
RtlGetUILanguageInfo	1108	Exported Function
RtlGetTokenNamedObjectPath	1107	Exported Function
RtlGetUnloadEventTrace	1110	Exported Function
RtlGetUmsCompletionListEvent	1109	Exported Function
RtlGetThreadWorkOnBehalfTicket	1106	Exported Function
RtlGetThreadErrorMode	1103	Exported Function
RtlGetSystemTimePrecise	1102	Exported Function
RtlGetThreadPreferredUILanguages	1105	Exported Function
RtlGetThreadLangIdByIndex	1104	Exported Function
RtlGUIDFromString	1033	Exported Function
RtlGuardCheckLongJumpTarget	1116	Exported Function
RtlHeapTrkInitialize	1118	Exported Function
RtlHashUnicodeString	1117	Exported Function
RtlGrowFunctionTable	1115	Exported Function
RtlGetUserInfoHeap	1112	Exported Function
RtlGetUnloadEventTraceEx	1111	Exported Function
RtlGetVersion	1114	Exported Function
RtlGetUserPreferredUILanguages	1113	Exported Function
RtlInitializeBitMapEx	1149	Exported Function
RtlInitUnicodeStringEx	1145	Exported Function
RtlInitUnicodeString	1144	Exported Function
RtlInitUTF8StringEx	1143	Exported Function
RtlInitUTF8String	1142	Exported Function
RtlInitStrongEnumerationHashTable	1141	Exported Function
RtlInitOutOfProcessMemoryStream	1138	Exported Function
RtlInitNlsTables	1137	Exported Function
RtlInitStringEx	1140	Exported Function
RtlInitString	1139	Exported Function
RtlInstallFunctionTableCallback	1173	Exported Function
RtlInsertEntryHashTable	1172	Exported Function
RtlIntegerToChar	1175	Exported Function
RtlInt64ToUnicodeString	1174	Exported Function
RtlInsertElementGenericTableFullAvl	1171	Exported Function
RtlInsertElementGenericTable	1168	Exported Function
RtlInitWeakEnumerationHashTable	1146	Exported Function
RtlInsertElementGenericTableFull	1170	Exported Function
RtlInsertElementGenericTableAvl	1169	Exported Function
RtlInitMemoryStream	1136	Exported Function
RtlInitializeExtendedContext	1156	Exported Function
RtlInitializeCriticalSectionEx	1155	Exported Function
RtlInitializeGenericTable	1158	Exported Function
RtlInitializeExtendedContext2	1157	Exported Function
RtlInitializeCriticalSectionAndSpinCount	1154	Exported Function
RtlInitializeContext	1151	Exported Function
RtlInitializeConditionVariable	1150	Exported Function
RtlInitializeCriticalSection	1153	Exported Function
RtlInitializeCorrelationVector	1152	Exported Function
RtlInitializeSidEx	1167	Exported Function
RtlInitializeSid	1166	Exported Function
RtlInitializeSRWLock	1165	Exported Function
RtlInitializeSListHead	1164	Exported Function
RtlInitializeRXact	1162	Exported Function
RtlInitializeHandleTable	1160	Exported Function
RtlInitializeGenericTableAvl	1159	Exported Function
RtlInitializeResource	1163	Exported Function
RtlInitializeNtUserPfn	1161	Exported Function
RtlLockCurrentThread	1252	Exported Function
RtlPublishWnfStateData	1313	Exported Function
RtlpTimeToTimeFields	1667	Exported Function
RtlpUmsThreadYield	1669	Exported Function
RtlpUmsExecuteYieldThreadEnd	1668	Exported Function
RtlpTimeFieldsToTime	1666	Exported Function
RtlpSetInstallLanguage	1663	Exported Function
RtlProtectHeap	1312	Exported Function
RtlpSetUserPreferredUILanguages	1665	Exported Function
RtlpSetPreferredUILanguages	1664	Exported Function
RtlpWow64SetContextOnAmd64	1675	Exported Function
RtlpWow64GetContextOnAmd64	1674	Exported Function
RtlQueryAllFeatureConfigurations	1316	Exported Function
RtlQueryActivationContextApplicationSettings	1315	Exported Function
RtlpWow64CtxFromAmd64	1673	Exported Function
RtlPushFrame	1314	Exported Function
RtlpUnWaitCriticalSection	1670	Exported Function
RtlpWaitForCriticalSection	1672	Exported Function
RtlpVerifyAndCommitUILanguageSettings	1671	Exported Function
RtlProcessFlsData	1311	Exported Function
RtlpNtMakeTemporaryKey	1655	Exported Function
RtlpNtEnumerateSubKey	1654	Exported Function
RtlpNtQueryValueKey	1657	Exported Function
RtlpNtOpenKey	1656	Exported Function
RtlpNtCreateKey	1653	Exported Function
RtlpMuiRegFreeRegistryInfo	1650	Exported Function
RtlpMuiRegCreateRegistryInfo	1649	Exported Function
RtlpNotOwnerCriticalSection	1652	Exported Function
RtlpMuiRegLoadRegistryInfo	1651	Exported Function
RtlPrefixUnicodeString	1309	Exported Function
RtlPrefixString	1308	Exported Function
RtlPrepareForProcessCloning	1310	Exported Function
RtlpRefreshCachedUILanguage	1662	Exported Function
RtlpQueryProcessDebugInformationRemote	1661	Exported Function
RtlPopFrame	1307	Exported Function
RtlpNtSetValueKey	1658	Exported Function
RtlpQueryProcessDebugInformationFromWow64	1660	Exported Function
RtlpQueryDefaultUILanguage	1659	Exported Function
RtlQueryAtomInAtomTable	1317	Exported Function
RtlQueryProcessPlaceholderCompatibilityMode	1343	Exported Function
RtlQueryProcessLockInformation	1342	Exported Function
RtlQueryRegistryValues	1346	Exported Function
RtlQueryProtectedPolicy	1344	Exported Function
RtlQueryProcessHeapInformation	1341	Exported Function
RtlQueryPerformanceFrequency	1338	Exported Function
RtlQueryPerformanceCounter	1337	Exported Function
RtlQueryProcessDebugInformation	1340	Exported Function
RtlQueryProcessBackTraceInformation	1339	Exported Function
RtlQueryThreadProfiling	1352	Exported Function
RtlQueryThreadPlaceholderCompatibilityMode	1351	Exported Function
RtlQueryTokenHostIdAsUlong64	1354	Exported Function
RtlQueryTimeZoneInformation	1353	Exported Function
RtlQueryTagHeap	1350	Exported Function
RtlQueryRegistryValueWithFallback	1345	Exported Function
RtlQueryRegistryValuesEx	1347	Exported Function
RtlQuerySecurityObject	1349	Exported Function
RtlQueryResourcePolicy	1348	Exported Function
RtlQueryPackageIdentityEx	1336	Exported Function
RtlQueryFeatureConfiguration	1324	Exported Function
RtlQueryEnvironmentVariable_U	1323	Exported Function
RtlQueryFeatureUsageNotificationSubscriptions	1326	Exported Function
RtlQueryFeatureConfigurationChangeStamp	1325	Exported Function
RtlQueryEnvironmentVariable	1322	Exported Function
RtlQueryDepthSList	1319	Exported Function
RtlQueryCriticalSectionOwner	1318	Exported Function
RtlQueryElevationFlags	1321	Exported Function
RtlQueryDynamicTimeZoneInformation	1320	Exported Function
RtlQueryModuleInformation	1333	Exported Function
RtlQueryInterfaceMemoryStream	1332	Exported Function
RtlQueryPackageIdentity	1335	Exported Function
RtlQueryPackageClaims	1334	Exported Function
RtlQueryInformationActiveActivationContext	1331	Exported Function
RtlQueryImageMitigationPolicy	1328	Exported Function
RtlQueryHeapInformation	1327	Exported Function
RtlQueryInformationActivationContext	1330	Exported Function
RtlQueryInformationAcl	1329	Exported Function
RtlpMuiFreeLangRegistryInfo	1648	Exported Function
RtlNewSecurityGrantedAccess	1278	Exported Function
RtlNewInstanceSecurityObject	1277	Exported Function
RtlNewSecurityObjectEx	1280	Exported Function
RtlNewSecurityObject	1279	Exported Function
RtlMultipleFreeHeap	1276	Exported Function
RtlMultiByteToUnicodeN	1273	Exported Function
RtlMultiAppendUnicodeStringBuffer	1272	Exported Function
RtlMultipleAllocateHeap	1275	Exported Function
RtlMultiByteToUnicodeSize	1274	Exported Function
RtlNtPathNameToDosPathName	1286	Exported Function
RtlNtdllName	1289	Exported Function
RtlNtStatusToDosErrorNoTeb	1288	Exported Function
RtlNtStatusToDosError	1287	Exported Function
RtlNotifyFeatureUsage	1285	Exported Function
RtlNormalizeProcessParams	1282	Exported Function
RtlNewSecurityObjectWithMultipleInheritance	1281	Exported Function
RtlNormalizeString	1284	Exported Function
RtlNormalizeSecurityDescriptor	1283	Exported Function
RtlMoveMemory	1271	Exported Function
RtlLookupAtomInAtomTable	1259	Exported Function
RtlLogStackBackTrace	1258	Exported Function
RtlLookupElementGenericTableAvl	1261	Exported Function
RtlLookupElementGenericTable	1260	Exported Function
RtlLockModuleSection	1257	Exported Function
RtlLockMemoryBlockLookaside	1254	Exported Function
RtlLockHeap	1253	Exported Function
RtlLockMemoryZone	1256	Exported Function
RtlLockMemoryStreamRegion	1255	Exported Function
RtlMakeSelfRelativeSD	1268	Exported Function
RtlLookupFunctionTable	1267	Exported Function
RtlMapSecurityErrorToNtStatus	1270	Exported Function
RtlMapGenericMask	1269	Exported Function
RtlLookupFunctionEntry	1266	Exported Function
RtlLookupElementGenericTableFullAvl	1263	Exported Function
RtlLookupElementGenericTableFull	1262	Exported Function
RtlLookupFirstMatchingElementGenericTableAvl	1265	Exported Function
RtlLookupEntryHashTable	1264	Exported Function
RtlNumberGenericTableElements	1290	Exported Function
RtlpFreezeTimeBias	1637	Exported Function
RtlpExecuteUmsThread	1636	Exported Function
RtlpGetLCIDFromLangInfoNode	1639	Exported Function
RtlpGetDeviceFamilyInfoEnum	1638	Exported Function
RtlpEnsureBufferSize	1635	Exported Function
RtlpConvertRelativeToAbsoluteSecurityAttribute	1633	Exported Function
RtlpConvertLCIDsToCultureNames	1632	Exported Function
RtlPcToFileHeader	1305	Exported Function
RtlpCreateProcessRegistryInfo	1634	Exported Function
RtlpLoadMachineUIByPolicy	1645	Exported Function
RtlpIsQualifiedLanguage	1644	Exported Function
RtlpMergeSecurityAttributeInformation	1647	Exported Function
RtlpLoadUserUIByPolicy	1646	Exported Function
RtlpInitializeLangRegistryInfo	1643	Exported Function
RtlpGetSystemDefaultUILanguage	1641	Exported Function
RtlpGetNameFromLangInfoNode	1640	Exported Function
RtlPinAtomInAtomTable	1306	Exported Function
RtlpGetUserOrMachineUILanguage4NLS	1642	Exported Function
RtlpConvertCultureNamesToLCIDs	1631	Exported Function
RtlNumberOfSetBitsInRange	1297	Exported Function
RtlNumberOfSetBitsEx	1296	Exported Function
RtlOemStringToUnicodeSize	1299	Exported Function
RtlNumberOfSetBitsUlongPtr	1298	Exported Function
RtlNumberOfSetBits	1295	Exported Function
RtlNumberOfClearBits	1292	Exported Function
RtlNumberGenericTableElementsAvl	1291	Exported Function
RtlNumberOfClearBitsInRange	1294	Exported Function
RtlNumberOfClearBitsEx	1293	Exported Function
RtlpCheckDynamicTimeZoneInformation	1628	Exported Function
RtlpApplyLengthFunction	1627	Exported Function
RtlpConvertAbsoluteToRelativeSecurityAttribute	1630	Exported Function
RtlpCleanupRegistryKeys	1629	Exported Function
RtlOwnerAcesPresent	1304	Exported Function
RtlOemToUnicodeN	1301	Exported Function
RtlOemStringToUnicodeString	1300	Exported Function
RtlOsDeploymentState	1303	Exported Function
RtlOpenCurrentUser	1302	Exported Function
ZwQueryBootOptions	2051	Exported Function
ZwQueryBootEntryOrder	2050	Exported Function
ZwQueryDefaultLocale	2053	Exported Function
ZwQueryDebugFilterState	2052	Exported Function
ZwQueryAuxiliaryCounterFrequency	2049	Exported Function
ZwPssCaptureVaSpaceBulk	2046	Exported Function
ZwProtectVirtualMemory	2045	Exported Function
ZwQueryAttributesFile	2048	Exported Function
ZwPulseEvent	2047	Exported Function
ZwQueryEvent	2060	Exported Function
ZwQueryEaFile	2059	Exported Function
ZwQueryInformationAtom	2062	Exported Function
ZwQueryFullAttributesFile	2061	Exported Function
ZwQueryDriverEntryOrder	2058	Exported Function
ZwQueryDirectoryFile	2055	Exported Function
ZwQueryDefaultUILanguage	2054	Exported Function
ZwQueryDirectoryObject	2057	Exported Function
ZwQueryDirectoryFileEx	2056	Exported Function
ZwPropagationFailed	2044	Exported Function
ZwOpenTransaction	2032	Exported Function
ZwOpenTimer	2031	Exported Function
ZwPlugPlayControl	2034	Exported Function
ZwOpenTransactionManager	2033	Exported Function
ZwOpenThreadTokenEx	2030	Exported Function
ZwOpenSymbolicLinkObject	2027	Exported Function
ZwOpenSession	2026	Exported Function
ZwOpenThreadToken	2029	Exported Function
ZwOpenThread	2028	Exported Function
ZwPrivilegedServiceAuditAlarm	2042	Exported Function
ZwPrivilegeCheck	2040	Exported Function
ZwPropagationComplete	2043	Exported Function
ZwPrivilegeObjectAuditAlarm	2041	Exported Function
ZwPrePrepareEnlistment	2037	Exported Function
ZwPrepareComplete	2038	Exported Function
ZwPowerInformation	2035	Exported Function
ZwPrePrepareComplete	2036	Exported Function
ZwPrepareEnlistment	2039	Exported Function
ZwQueryInformationByName	2063	Exported Function
ZwQuerySecurityAttributesToken	2089	Exported Function
ZwQuerySection	2088	Exported Function
ZwQuerySecurityPolicy	2091	Exported Function
ZwQuerySecurityObject	2090	Exported Function
ZwQueryQuotaInformationFile	2087	Exported Function
ZwQueryOpenSubKeysEx	2084	Exported Function
ZwQueryOpenSubKeys	2083	Exported Function
ZwQueryPortInformationProcess	2086	Exported Function
ZwQueryPerformanceCounter	2085	Exported Function
ZwQuerySystemTime	2098	Exported Function
ZwQuerySystemInformationEx	2097	Exported Function
ZwQueryTimerResolution	2100	Exported Function
ZwQueryTimer	2099	Exported Function
ZwQuerySystemInformation	2096	Exported Function
ZwQuerySymbolicLinkObject	2093	Exported Function
ZwQuerySemaphore	2092	Exported Function
ZwQuerySystemEnvironmentValueEx	2095	Exported Function
ZwQuerySystemEnvironmentValue	2094	Exported Function
ZwQueryObject	2082	Exported Function
ZwQueryInformationThread	2070	Exported Function
ZwQueryInformationResourceManager	2069	Exported Function
ZwQueryInformationTransaction	2072	Exported Function
ZwQueryInformationToken	2071	Exported Function
ZwQueryInformationProcess	2068	Exported Function
ZwQueryInformationFile	2065	Exported Function
ZwQueryInformationEnlistment	2064	Exported Function
ZwQueryInformationPort	2067	Exported Function
ZwQueryInformationJobObject	2066	Exported Function
ZwQueryLicenseValue	2079	Exported Function
ZwQueryKey	2078	Exported Function
ZwQueryMutant	2081	Exported Function
ZwQueryMultipleValueKey	2080	Exported Function
ZwQueryIoCompletion	2077	Exported Function
ZwQueryInformationWorkerFactory	2074	Exported Function
ZwQueryInformationTransactionManager	2073	Exported Function
ZwQueryIntervalProfile	2076	Exported Function
ZwQueryInstallUILanguage	2075	Exported Function
ZwOpenSemaphore	2025	Exported Function
ZwIsUILanguageComitted	1975	Exported Function
ZwIsSystemResumeAutomatic	1974	Exported Function
ZwLoadDriver	1977	Exported Function
ZwListenPort	1976	Exported Function
ZwIsProcessInJob	1973	Exported Function
ZwInitializeNlsFiles	1970	Exported Function
ZwInitializeEnclave	1969	Exported Function
ZwInitiatePowerAction	1972	Exported Function
ZwInitializeRegistry	1971	Exported Function
ZwLockProductActivationKeys	1984	Exported Function
ZwLockFile	1983	Exported Function
ZwLockVirtualMemory	1986	Exported Function
ZwLockRegistryKey	1985	Exported Function
ZwLoadKeyEx	1982	Exported Function
ZwLoadKey	1979	Exported Function
ZwLoadEnclaveData	1978	Exported Function
ZwLoadKey3	1981	Exported Function
ZwLoadKey2	1980	Exported Function
ZwImpersonateThread	1968	Exported Function
ZwGetContextThread	1956	Exported Function
ZwGetCompleteWnfStateSubscription	1955	Exported Function
ZwGetCurrentProcessorNumberEx	1958	Exported Function
ZwGetCurrentProcessorNumber	1957	Exported Function
ZwGetCachedSigningLevel	1954	Exported Function
ZwFreezeRegistry	1951	Exported Function
ZwFreeVirtualMemory	1950	Exported Function
ZwFsControlFile	1953	Exported Function
ZwFreezeTransactions	1952	Exported Function
ZwGetWriteWatch	1965	Exported Function
ZwGetNotificationResourceManager	1964	Exported Function
ZwImpersonateClientOfPort	1967	Exported Function
ZwImpersonateAnonymousToken	1966	Exported Function
ZwGetNlsSectionPtr	1963	Exported Function
ZwGetMUIRegistryInfo	1960	Exported Function
ZwGetDevicePowerState	1959	Exported Function
ZwGetNextThread	1962	Exported Function
ZwGetNextProcess	1961	Exported Function
ZwMakePermanentObject	1987	Exported Function
ZwOpenKeyTransacted	2012	Exported Function
ZwOpenKeyEx	2011	Exported Function
ZwOpenMutant	2015	Exported Function
ZwOpenKeyTransactedEx	2013	Exported Function
ZwOpenKeyedEvent	2014	Exported Function
ZwOpenIoCompletion	2008	Exported Function
ZwOpenFile	2007	Exported Function
ZwOpenKey	2010	Exported Function
ZwOpenJobObject	2009	Exported Function
ZwOpenRegistryTransaction	2022	Exported Function
ZwOpenProcessTokenEx	2021	Exported Function
ZwOpenSection	2024	Exported Function
ZwOpenResourceManager	2023	Exported Function
ZwOpenProcessToken	2020	Exported Function
ZwOpenPartition	2017	Exported Function
ZwOpenObjectAuditAlarm	2016	Exported Function
ZwOpenProcess	2019	Exported Function
ZwOpenPrivateNamespace	2018	Exported Function
ZwOpenEventPair	2006	Exported Function
ZwMapViewOfSection	1994	Exported Function
ZwMapUserPhysicalPagesScatter	1993	Exported Function
ZwModifyBootEntry	1996	Exported Function
ZwMapViewOfSectionEx	1995	Exported Function
ZwMapUserPhysicalPages	1992	Exported Function
ZwManageHotPatch	1989	Exported Function
ZwMakeTemporaryObject	1988	Exported Function
ZwMapCMFModule	1991	Exported Function
ZwManagePartition	1990	Exported Function
ZwOpenDirectoryObject	2003	Exported Function
ZwNotifyChangeSession	2002	Exported Function
ZwOpenEvent	2005	Exported Function
ZwOpenEnlistment	2004	Exported Function
ZwNotifyChangeMultipleKeys	2001	Exported Function
ZwNotifyChangeDirectoryFile	1998	Exported Function
ZwModifyDriverEntry	1997	Exported Function
ZwNotifyChangeKey	2000	Exported Function
ZwNotifyChangeDirectoryFileEx	1999	Exported Function
ZwQueryValueKey	2101	Exported Function
ZwSetValueKey	2203	Exported Function
ZwSetUuidSeed	2202	Exported Function
ZwSetWnfProcessNotificationEvent	2205	Exported Function
ZwSetVolumeInformationFile	2204	Exported Function
ZwSetTimerResolution	2201	Exported Function
ZwSetTimer	2198	Exported Function
ZwSetThreadExecutionState	2197	Exported Function
ZwSetTimerEx	2200	Exported Function
ZwSetTimer2	2199	Exported Function
ZwSubscribeWnfStateChange	2212	Exported Function
ZwStopProfile	2211	Exported Function
ZwSuspendThread	2214	Exported Function
ZwSuspendProcess	2213	Exported Function
ZwStartProfile	2210	Exported Function
ZwShutdownWorkerFactory	2207	Exported Function
ZwShutdownSystem	2206	Exported Function
ZwSinglePhaseReject	2209	Exported Function
ZwSignalAndWaitForSingleObject	2208	Exported Function
ZwSetSystemTime	2196	Exported Function
ZwSetIoCompletion	2185	Exported Function
ZwSetIntervalProfile	2184	Exported Function
ZwSetIRTimer	2168	Exported Function
ZwSetIoCompletionEx	2186	Exported Function
ZwSetInformationWorkerFactory	2183	Exported Function
ZwSetInformationTransaction	2180	Exported Function
ZwSetInformationToken	2179	Exported Function
ZwSetInformationVirtualMemory	2182	Exported Function
ZwSetInformationTransactionManager	2181	Exported Function
ZwSetSystemEnvironmentValueEx	2193	Exported Function
ZwSetSystemEnvironmentValue	2192	Exported Function
ZwSetSystemPowerState	2195	Exported Function
ZwSetSystemInformation	2194	Exported Function
ZwSetSecurityObject	2191	Exported Function
ZwSetLowEventPair	2188	Exported Function
ZwSetLdtEntries	2187	Exported Function
ZwSetQuotaInformationFile	2190	Exported Function
ZwSetLowWaitHighEventPair	2189	Exported Function
ZwSystemDebugControl	2215	Exported Function
ZwWaitForMultipleObjects	2241	Exported Function
ZwWaitForKeyedEvent	2240	Exported Function
ZwWaitForSingleObject	2243	Exported Function
ZwWaitForMultipleObjects32	2242	Exported Function
ZwWaitForDebugEvent	2239	Exported Function
ZwUpdateWnfStateData	2236	Exported Function
ZwUnsubscribeWnfStateChange	2235	Exported Function
ZwWaitForAlertByThreadId	2238	Exported Function
ZwVdmControl	2237	Exported Function
ZwWriteRequestData	2250	Exported Function
ZwWriteFileGather	2249	Exported Function
ZwYieldExecution	2252	Exported Function
ZwWriteVirtualMemory	2251	Exported Function
ZwWriteFile	2248	Exported Function
ZwWaitHighEventPair	2245	Exported Function
ZwWaitForWorkViaWorkerFactory	2244	Exported Function
ZwWorkerFactoryWorkerReady	2247	Exported Function
ZwWaitLowEventPair	2246	Exported Function
ZwUnmapViewOfSectionEx	2234	Exported Function
ZwThawTransactions	2222	Exported Function
ZwThawRegistry	2221	Exported Function
ZwTraceEvent	2224	Exported Function
ZwTraceControl	2223	Exported Function
ZwTestAlert	2220	Exported Function
ZwTerminateJobObject	2217	Exported Function
ZwTerminateEnclave	2216	Exported Function
ZwTerminateThread	2219	Exported Function
ZwTerminateProcess	2218	Exported Function
ZwUnlockFile	2231	Exported Function
ZwUnloadKeyEx	2230	Exported Function
ZwUnmapViewOfSection	2233	Exported Function
ZwUnlockVirtualMemory	2232	Exported Function
ZwUnloadKey2	2229	Exported Function
ZwUmsThreadYield	2226	Exported Function
ZwTranslateFilePath	2225	Exported Function
ZwUnloadKey	2228	Exported Function
ZwUnloadDriver	2227	Exported Function
ZwSetInformationThread	2178	Exported Function
ZwRenameKey	2127	Exported Function
ZwRemoveProcessDebug	2126	Exported Function
ZwReplaceKey	2129	Exported Function
ZwRenameTransactionManager	2128	Exported Function
ZwRemoveIoCompletionEx	2125	Exported Function
ZwReleaseSemaphore	2122	Exported Function
ZwReleaseMutant	2121	Exported Function
ZwRemoveIoCompletion	2124	Exported Function
ZwReleaseWorkerFactoryWorker	2123	Exported Function
ZwRequestWaitReplyPort	2136	Exported Function
ZwRequestPort	2135	Exported Function
ZwResetWriteWatch	2138	Exported Function
ZwResetEvent	2137	Exported Function
ZwReplyWaitReplyPort	2134	Exported Function
ZwReplyPort	2131	Exported Function
ZwReplacePartitionUnit	2130	Exported Function
ZwReplyWaitReceivePortEx	2133	Exported Function
ZwReplyWaitReceivePort	2132	Exported Function
ZwReleaseKeyedEvent	2120	Exported Function
ZwRaiseException	2108	Exported Function
ZwQueueApcThreadEx	2107	Exported Function
ZwReadFile	2110	Exported Function
ZwRaiseHardError	2109	Exported Function
ZwQueueApcThread	2106	Exported Function
ZwQueryVolumeInformationFile	2103	Exported Function
ZwQueryVirtualMemory	2102	Exported Function
ZwQueryWnfStateNameInformation	2105	Exported Function
ZwQueryWnfStateData	2104	Exported Function
ZwRecoverTransactionManager	2117	Exported Function
ZwRecoverResourceManager	2116	Exported Function
ZwRegisterThreadTerminatePort	2119	Exported Function
ZwRegisterProtocolAddressInformation	2118	Exported Function
ZwRecoverEnlistment	2115	Exported Function
ZwReadOnlyEnlistment	2112	Exported Function
ZwReadFileScatter	2111	Exported Function
ZwReadVirtualMemory	2114	Exported Function
ZwReadRequestData	2113	Exported Function
ZwRestoreKey	2139	Exported Function
ZwSetEventBoostPriority	2165	Exported Function
ZwSetEvent	2164	Exported Function
ZwSetHighWaitLowEventPair	2167	Exported Function
ZwSetHighEventPair	2166	Exported Function
ZwSetEaFile	2163	Exported Function
ZwSetDefaultLocale	2160	Exported Function
ZwSetDefaultHardErrorPort	2159	Exported Function
ZwSetDriverEntryOrder	2162	Exported Function
ZwSetDefaultUILanguage	2161	Exported Function
ZwSetInformationProcess	2175	Exported Function
ZwSetInformationObject	2174	Exported Function
ZwSetInformationSymbolicLink	2177	Exported Function
ZwSetInformationResourceManager	2176	Exported Function
ZwSetInformationKey	2173	Exported Function
ZwSetInformationEnlistment	2170	Exported Function
ZwSetInformationDebugObject	2169	Exported Function
ZwSetInformationJobObject	2172	Exported Function
ZwSetInformationFile	2171	Exported Function
ZwSetDebugFilterState	2158	Exported Function
ZwRollbackTransaction	2146	Exported Function
ZwRollbackRegistryTransaction	2145	Exported Function
ZwSaveKey	2148	Exported Function
ZwRollforwardTransactionManager	2147	Exported Function
ZwRollbackEnlistment	2144	Exported Function
ZwResumeThread	2141	Exported Function
ZwResumeProcess	2140	Exported Function
ZwRollbackComplete	2143	Exported Function
ZwRevertContainerImpersonation	2142	Exported Function
ZwSetCachedSigningLevel	2155	Exported Function
ZwSetBootOptions	2154	Exported Function
ZwSetContextThread	2157	Exported Function
ZwSetCachedSigningLevel2	2156	Exported Function
ZwSetBootEntryOrder	2153	Exported Function
ZwSaveMergedKeys	2150	Exported Function
ZwSaveKeyEx	2149	Exported Function
ZwSerializeBoot	2152	Exported Function
ZwSecureConnectPort	2151	Exported Function
ZwFreeUserPhysicalPages	1949	Exported Function
wcstol	2435	Exported Function
wcstok_s	2434	Exported Function
wcstoul	2437	Exported Function
wcstombs	2436	Exported Function
wcsstr	2433	Exported Function
wcspbrk	2430	Exported Function
wcsnlen	2429	Exported Function
wcsspn	2432	Exported Function
wcsrchr	2431	Exported Function
WinSqmCheckEscalationSetDWORD	1756	Exported Function
WinSqmCheckEscalationAddToStreamEx	1755	Exported Function
WinSqmCheckEscalationSetString	1758	Exported Function
WinSqmCheckEscalationSetDWORD64	1757	Exported Function
WinSqmAddToStreamEx	1754	Exported Function
WerReportSQMEvent	1751	Exported Function
WerReportExceptionWorker	1750	Exported Function
WinSqmAddToStream	1753	Exported Function
WinSqmAddToAverageDWORD	1752	Exported Function
wcsncpy_s	2428	Exported Function
wcscat	2416	Exported Function
vswprintf_s	2415	Exported Function
wcschr	2418	Exported Function
wcscat_s	2417	Exported Function
vsprintf_s	2414	Exported Function
vDbgPrintExWithPrefix	2412	Exported Function
vDbgPrintEx	2411	Exported Function
vsprintf	2413	Exported Function
VerSetConditionMask	1749	Exported Function
wcsncat_s	2425	Exported Function
wcsncat	2424	Exported Function
wcsncpy	2427	Exported Function
wcsncmp	2426	Exported Function
wcslen	2423	Exported Function
wcscpy	2420	Exported Function
wcscmp	2419	Exported Function
wcscspn	2422	Exported Function
wcscpy_s	2421	Exported Function
WinSqmCommonDatapointDelete	1759	Exported Function
ZwAccessCheckByType	1785	Exported Function
ZwAccessCheckAndAuditAlarm	1784	Exported Function
ZwAccessCheckByTypeResultList	1787	Exported Function
ZwAccessCheckByTypeAndAuditAlarm	1786	Exported Function
ZwAccessCheck	1783	Exported Function
WinSqmStartSessionForPartner	1780	Exported Function
WinSqmStartSession	1779	Exported Function
ZwAcceptConnectPort	1782	Exported Function
WinSqmStartSqmOptinListener	1781	Exported Function
ZwAddBootEntry	1794	Exported Function
ZwAddAtomEx	1793	Exported Function
ZwAdjustGroupsToken	1796	Exported Function
ZwAddDriverEntry	1795	Exported Function
ZwAddAtom	1792	Exported Function
ZwAccessCheckByTypeResultListAndAuditAlarmByHandle	1789	Exported Function
ZwAccessCheckByTypeResultListAndAuditAlarm	1788	Exported Function
ZwAcquireProcessActivityReference	1791	Exported Function
ZwAcquireCrossVmMutant	1790	Exported Function
WinSqmSetString	1778	Exported Function
WinSqmEventWrite	1766	Exported Function
WinSqmEventEnabled	1765	Exported Function
WinSqmGetInstrumentationProperty	1768	Exported Function
WinSqmGetEscalationRuleStatus	1767	Exported Function
WinSqmEndSession	1764	Exported Function
WinSqmCommonDatapointSetDWORD64	1761	Exported Function
WinSqmCommonDatapointSetDWORD	1760	Exported Function
WinSqmCommonDatapointSetString	1763	Exported Function
WinSqmCommonDatapointSetStreamEx	1762	Exported Function
WinSqmSetEscalationInfo	1775	Exported Function
WinSqmSetDWORD64	1774	Exported Function
WinSqmSetIfMinDWORD	1777	Exported Function
WinSqmSetIfMaxDWORD	1776	Exported Function
WinSqmSetDWORD	1773	Exported Function
WinSqmIsOptedIn	1770	Exported Function
WinSqmIncrementDWORD	1769	Exported Function
WinSqmIsSessionDisabled	1772	Exported Function
WinSqmIsOptedInEx	1771	Exported Function
TpWaitForWork	1748	Exported Function
TpCallbackIndependent	1698	Exported Function
TpCallbackDetectedUnrecoverableError	1697	Exported Function
TpCallbackMayRunLong	1700	Exported Function
TpCallbackLeaveCriticalSectionOnCompletion	1699	Exported Function
TpAlpcUnregisterCompletionList	1696	Exported Function
TpAllocWait	1693	Exported Function
TpAllocTimer	1692	Exported Function
TpAlpcRegisterCompletionList	1695	Exported Function
TpAllocWork	1694	Exported Function
TpCancelAsyncIoOperation	1707	Exported Function
TpCallbackUnloadDllOnCompletion	1706	Exported Function
TpCheckTerminateWorker	1709	Exported Function
TpCaptureCaller	1708	Exported Function
TpCallbackSetEventOnCompletion	1705	Exported Function
TpCallbackReleaseSemaphoreOnCompletion	1702	Exported Function
TpCallbackReleaseMutexOnCompletion	1701	Exported Function
TpCallbackSendPendingAlpcMessage	1704	Exported Function
TpCallbackSendAlpcMessageOnCompletion	1703	Exported Function
TpAllocPool	1691	Exported Function
swprintf_s	2404	Exported Function
swprintf	2403	Exported Function
tan	2406	Exported Function
swscanf_s	2405	Exported Function
strtoul	2402	Exported Function
strstr	2399	Exported Function
strspn	2398	Exported Function
strtol	2401	Exported Function
strtok_s	2400	Exported Function
TpAllocCleanupGroup	1688	Exported Function
TpAllocAlpcCompletionEx	1687	Exported Function
TpAllocJobNotification	1690	Exported Function
TpAllocIoCompletion	1689	Exported Function
TpAllocAlpcCompletion	1686	Exported Function
toupper	2408	Exported Function
tolower	2407	Exported Function
towupper	2410	Exported Function
towlower	2409	Exported Function
TpDbgDumpHeapUsage	1710	Exported Function
TpSetTimerEx	1736	Exported Function
TpSetTimer	1735	Exported Function
TpSetWaitEx	1738	Exported Function
TpSetWait	1737	Exported Function
TpSetPoolWorkerThreadIdleTimeout	1734	Exported Function
TpSetPoolStackInformation	1731	Exported Function
TpSetPoolMinThreads	1730	Exported Function
TpSetPoolThreadCpuSets	1733	Exported Function
TpSetPoolThreadBasePriority	1732	Exported Function
TpWaitForJobNotification	1745	Exported Function
TpWaitForIoCompletion	1744	Exported Function
TpWaitForWait	1747	Exported Function
TpWaitForTimer	1746	Exported Function
TpWaitForAlpcCompletion	1743	Exported Function
TpStartAsyncIoOperation	1740	Exported Function
TpSimpleTryPost	1739	Exported Function
TpTrimPools	1742	Exported Function
TpTimerOutstandingCallbackCount	1741	Exported Function
TpSetPoolMaxThreadsSoftLimit	1729	Exported Function
TpReleaseAlpcCompletion	1717	Exported Function
TpQueryPoolStackInformation	1716	Exported Function
TpReleaseCleanupGroupMembers	1719	Exported Function
TpReleaseCleanupGroup	1718	Exported Function
TpPostWork	1715	Exported Function
TpDisablePoolCallbackChecks	1712	Exported Function
TpDbgSetLogRoutine	1711	Exported Function
TpIsTimerSet	1714	Exported Function
TpDisassociateCallback	1713	Exported Function
TpSetDefaultPoolMaxThreads	1726	Exported Function
TpReleaseWork	1725	Exported Function
TpSetPoolMaxThreads	1728	Exported Function
TpSetDefaultPoolStackInformation	1727	Exported Function
TpReleaseWait	1724	Exported Function
TpReleaseJobNotification	1721	Exported Function
TpReleaseIoCompletion	1720	Exported Function
TpReleaseTimer	1723	Exported Function
TpReleasePool	1722	Exported Function
ZwAdjustPrivilegesToken	1797	Exported Function
ZwCreateTimer2	1899	Exported Function
ZwCreateTimer	1898	Exported Function
ZwCreateTokenEx	1901	Exported Function
ZwCreateToken	1900	Exported Function
ZwCreateThreadEx	1897	Exported Function
ZwCreateSemaphore	1894	Exported Function
ZwCreateSectionEx	1893	Exported Function
ZwCreateThread	1896	Exported Function
ZwCreateSymbolicLinkObject	1895	Exported Function
ZwCreateWorkerFactory	1908	Exported Function
ZwCreateWnfStateName	1907	Exported Function
ZwDebugContinue	1910	Exported Function
ZwDebugActiveProcess	1909	Exported Function
ZwCreateWaitCompletionPacket	1905	Exported Function
ZwCreateTransactionManager	1903	Exported Function
ZwCreateTransaction	1902	Exported Function
ZwCreateWaitablePort	1906	Exported Function
ZwCreateUserProcess	1904	Exported Function
ZwCreateSection	1892	Exported Function
ZwCreateMutant	1880	Exported Function
ZwCreateMailslotFile	1879	Exported Function
ZwCreatePagingFile	1882	Exported Function
ZwCreateNamedPipeFile	1881	Exported Function
ZwCreateLowBoxToken	1878	Exported Function
ZwCreateKey	1875	Exported Function
ZwCreateJobSet	1874	Exported Function
ZwCreateKeyTransacted	1876	Exported Function
ZwCreateKeyedEvent	1877	Exported Function
ZwCreateProfileEx	1889	Exported Function
ZwCreateProfile	1888	Exported Function
ZwCreateResourceManager	1891	Exported Function
ZwCreateRegistryTransaction	1890	Exported Function
ZwCreateProcessEx	1887	Exported Function
ZwCreatePort	1884	Exported Function
ZwCreatePartition	1883	Exported Function
ZwCreateProcess	1886	Exported Function
ZwCreatePrivateNamespace	1885	Exported Function
ZwDelayExecution	1911	Exported Function
ZwFilterBootOption	1937	Exported Function
ZwExtendSection	1936	Exported Function
ZwFilterTokenEx	1939	Exported Function
ZwFilterToken	1938	Exported Function
ZwEnumerateValueKey	1935	Exported Function
ZwEnumerateKey	1932	Exported Function
ZwEnumerateDriverEntries	1931	Exported Function
ZwEnumerateTransactionObject	1934	Exported Function
ZwEnumerateSystemEnvironmentValuesEx	1933	Exported Function
ZwFlushProcessWriteBuffers	1946	Exported Function
ZwFlushKey	1945	Exported Function
ZwFlushWriteBuffer	1948	Exported Function
ZwFlushVirtualMemory	1947	Exported Function
ZwFlushInstructionCache	1944	Exported Function
ZwFlushBuffersFile	1941	Exported Function
ZwFindAtom	1940	Exported Function
ZwFlushInstallUILanguage	1943	Exported Function
ZwFlushBuffersFileEx	1942	Exported Function
ZwEnumerateBootEntries	1930	Exported Function
ZwDeletePrivateNamespace	1918	Exported Function
ZwDeleteObjectAuditAlarm	1917	Exported Function
ZwDeleteWnfStateData	1920	Exported Function
ZwDeleteValueKey	1919	Exported Function
ZwDeleteKey	1916	Exported Function
ZwDeleteBootEntry	1913	Exported Function
ZwDeleteAtom	1912	Exported Function
ZwDeleteFile	1915	Exported Function
ZwDeleteDriverEntry	1914	Exported Function
ZwDuplicateObject	1927	Exported Function
ZwDrawText	1926	Exported Function
ZwEnableLastKnownGood	1929	Exported Function
ZwDuplicateToken	1928	Exported Function
ZwDisplayString	1925	Exported Function
ZwDeviceIoControlFile	1922	Exported Function
ZwDeleteWnfStateName	1921	Exported Function
ZwDisableLastKnownGood	1924	Exported Function
ZwDirectGraphicsCall	1923	Exported Function
ZwCreateJobObject	1873	Exported Function
ZwAlpcImpersonateClientContainerOfPort	1823	Exported Function
ZwAlpcDisconnectPort	1822	Exported Function
ZwAlpcOpenSenderProcess	1825	Exported Function
ZwAlpcImpersonateClientOfPort	1824	Exported Function
ZwAlpcDeleteSecurityContext	1821	Exported Function
ZwAlpcDeletePortSection	1818	Exported Function
ZwAlpcCreateSecurityContext	1817	Exported Function
ZwAlpcDeleteSectionView	1820	Exported Function
ZwAlpcDeleteResourceReserve	1819	Exported Function
ZwApphelpCacheControl	1832	Exported Function
ZwAlpcSetInformation	1831	Exported Function
ZwAssignProcessToJobObject	1834	Exported Function
ZwAreMappedFilesTheSame	1833	Exported Function
ZwAlpcSendWaitReceivePort	1830	Exported Function
ZwAlpcQueryInformation	1827	Exported Function
ZwAlpcOpenSenderThread	1826	Exported Function
ZwAlpcRevokeSecurityContext	1829	Exported Function
ZwAlpcQueryInformationMessage	1828	Exported Function
ZwAlpcCreateSectionView	1816	Exported Function
ZwAllocateUserPhysicalPages	1804	Exported Function
ZwAllocateReserveObject	1803	Exported Function
ZwAllocateUuids	1806	Exported Function
ZwAllocateUserPhysicalPagesEx	1805	Exported Function
ZwAllocateLocallyUniqueId	1802	Exported Function
ZwAlertResumeThread	1799	Exported Function
ZwAdjustTokenClaimsAndDeviceGroups	1798	Exported Function
ZwAlertThreadByThreadId	1801	Exported Function
ZwAlertThread	1800	Exported Function
ZwAlpcCreatePort	1813	Exported Function
ZwAlpcConnectPortEx	1812	Exported Function
ZwAlpcCreateResourceReserve	1815	Exported Function
ZwAlpcCreatePortSection	1814	Exported Function
ZwAlpcConnectPort	1811	Exported Function
ZwAllocateVirtualMemoryEx	1808	Exported Function
ZwAllocateVirtualMemory	1807	Exported Function
ZwAlpcCancelMessage	1810	Exported Function
ZwAlpcAcceptConnectPort	1809	Exported Function
ZwAssociateWaitCompletionPacket	1835	Exported Function
ZwCreateCrossVmEvent	1861	Exported Function
ZwConvertBetweenAuxiliaryCounterAndPerformanceCounter	1860	Exported Function
ZwCreateDebugObject	1863	Exported Function
ZwCreateCrossVmMutant	1862	Exported Function
ZwContinueEx	1859	Exported Function
ZwCompressKey	1856	Exported Function
ZwCompleteConnectPort	1855	Exported Function
ZwContinue	1858	Exported Function
ZwConnectPort	1857	Exported Function
ZwCreateFile	1870	Exported Function
ZwCreateEventPair	1869	Exported Function
ZwCreateIRTimer	1871	Exported Function
ZwCreateIoCompletion	1872	Exported Function
ZwCreateEvent	1868	Exported Function
ZwCreateDirectoryObjectEx	1865	Exported Function
ZwCreateDirectoryObject	1864	Exported Function
ZwCreateEnlistment	1867	Exported Function
ZwCreateEnclave	1866	Exported Function
ZwCompareTokens	1854	Exported Function
ZwCancelTimer2	1842	Exported Function
ZwCancelTimer	1841	Exported Function
ZwClearEvent	1844	Exported Function
ZwCancelWaitCompletionPacket	1843	Exported Function
ZwCancelSynchronousIoFile	1840	Exported Function
ZwCallEnclave	1836	Exported Function
ZwCallbackReturn	1837	Exported Function
ZwCancelIoFileEx	1839	Exported Function
ZwCancelIoFile	1838	Exported Function
ZwCompactKeys	1851	Exported Function
ZwCommitTransaction	1850	Exported Function
ZwCompareSigningLevels	1853	Exported Function
ZwCompareObjects	1852	Exported Function
ZwCommitRegistryTransaction	1849	Exported Function
ZwCloseObjectAuditAlarm	1846	Exported Function
ZwClose	1845	Exported Function
ZwCommitEnlistment	1848	Exported Function
ZwCommitComplete	1847	Exported Function
RtlGetSystemPreferredUILanguages	1101	Exported Function
NtCreateKeyTransacted	293	Exported Function
NtCreateKeyedEvent	294	Exported Function
NtCreateMailslotFile	296	Exported Function
NtCreateLowBoxToken	295	Exported Function
NtCreateKey	292	Exported Function
NtCreateIRTimer	288	Exported Function
NtCreateIoCompletion	289	Exported Function
NtCreateJobSet	291	Exported Function
NtCreateJobObject	290	Exported Function
NtCreateProcess	303	Exported Function
NtCreatePrivateNamespace	302	Exported Function
NtCreateProfile	305	Exported Function
NtCreateProcessEx	304	Exported Function
NtCreatePort	301	Exported Function
NtCreateNamedPipeFile	298	Exported Function
NtCreateMutant	297	Exported Function
NtCreatePartition	300	Exported Function
NtCreatePagingFile	299	Exported Function
NtCreateFile	287	Exported Function
NtContinue	275	Exported Function
NtConnectPort	274	Exported Function
NtConvertBetweenAuxiliaryCounterAndPerformanceCounter	277	Exported Function
NtContinueEx	276	Exported Function
NtCompressKey	273	Exported Function
NtCompareSigningLevels	270	Exported Function
NtCompareObjects	269	Exported Function
NtCompleteConnectPort	272	Exported Function
NtCompareTokens	271	Exported Function
NtCreateEnlistment	284	Exported Function
NtCreateEnclave	283	Exported Function
NtCreateEventPair	286	Exported Function
NtCreateEvent	285	Exported Function
NtCreateDirectoryObjectEx	282	Exported Function
NtCreateCrossVmMutant	279	Exported Function
NtCreateCrossVmEvent	278	Exported Function
NtCreateDirectoryObject	281	Exported Function
NtCreateDebugObject	280	Exported Function
NtCreateProfileEx	306	Exported Function
NtDeleteFile	332	Exported Function
NtDeleteDriverEntry	331	Exported Function
NtDeleteObjectAuditAlarm	334	Exported Function
NtDeleteKey	333	Exported Function
NtDeleteBootEntry	330	Exported Function
NtDebugContinue	327	Exported Function
NtDebugActiveProcess	326	Exported Function
NtDeleteAtom	329	Exported Function
NtDelayExecution	328	Exported Function
NtDisableLastKnownGood	341	Exported Function
NtDirectGraphicsCall	340	Exported Function
NtdllDefWindowProc_A	671	Exported Function
NtDisplayString	342	Exported Function
NtDeviceIoControlFile	339	Exported Function
NtDeleteValueKey	336	Exported Function
NtDeletePrivateNamespace	335	Exported Function
NtDeleteWnfStateName	338	Exported Function
NtDeleteWnfStateData	337	Exported Function
NtCreateWorkerFactory	325	Exported Function
NtCreateThread	313	Exported Function
NtCreateSymbolicLinkObject	312	Exported Function
NtCreateTimer	315	Exported Function
NtCreateThreadEx	314	Exported Function
NtCreateSemaphore	311	Exported Function
NtCreateResourceManager	308	Exported Function
NtCreateRegistryTransaction	307	Exported Function
NtCreateSectionEx	310	Exported Function
NtCreateSection	309	Exported Function
NtCreateWaitablePort	323	Exported Function
NtCreateUserProcess	321	Exported Function
NtCreateWnfStateName	324	Exported Function
NtCreateWaitCompletionPacket	322	Exported Function
NtCreateTransactionManager	320	Exported Function
NtCreateToken	317	Exported Function
NtCreateTimer2	316	Exported Function
NtCreateTransaction	319	Exported Function
NtCreateTokenEx	318	Exported Function
NtCompactKeys	268	Exported Function
NtAlertThreadByThreadId	218	Exported Function
NtAlertThread	217	Exported Function
NtAllocateReserveObject	220	Exported Function
NtAllocateLocallyUniqueId	219	Exported Function
NtAlertResumeThread	216	Exported Function
NtAdjustGroupsToken	213	Exported Function
NtAddDriverEntry	212	Exported Function
NtAdjustTokenClaimsAndDeviceGroups	215	Exported Function
NtAdjustPrivilegesToken	214	Exported Function
NtAlpcCancelMessage	227	Exported Function
NtAlpcAcceptConnectPort	226	Exported Function
NtAlpcConnectPortEx	229	Exported Function
NtAlpcConnectPort	228	Exported Function
NtAllocateVirtualMemoryEx	225	Exported Function
NtAllocateUserPhysicalPagesEx	222	Exported Function
NtAllocateUserPhysicalPages	221	Exported Function
NtAllocateVirtualMemory	224	Exported Function
NtAllocateUuids	223	Exported Function
NtAddBootEntry	211	Exported Function
NtAcceptConnectPort	199	Exported Function
NlsMbOemCodePageTag	198	Exported Function
NtAccessCheckAndAuditAlarm	201	Exported Function
NtAccessCheck	200	Exported Function
NlsMbCodePageTag	197	Exported Function
memmove_s	2371	Exported Function
memmove	2370	Exported Function
NlsAnsiCodePage	196	Exported Function
memset	2372	Exported Function
NtAcquireProcessActivityReference	208	Exported Function
NtAcquireCrossVmMutant	207	Exported Function
NtAddAtomEx	210	Exported Function
NtAddAtom	209	Exported Function
NtAccessCheckByTypeResultListAndAuditAlarmByHandle	206	Exported Function
NtAccessCheckByTypeAndAuditAlarm	203	Exported Function
NtAccessCheckByType	202	Exported Function
NtAccessCheckByTypeResultListAndAuditAlarm	205	Exported Function
NtAccessCheckByTypeResultList	204	Exported Function
NtAlpcCreatePort	230	Exported Function
NtCancelIoFileEx	256	Exported Function
NtCancelIoFile	255	Exported Function
NtCancelTimer	258	Exported Function
NtCancelSynchronousIoFile	257	Exported Function
NtCallEnclave	253	Exported Function
NtAssignProcessToJobObject	251	Exported Function
NtAreMappedFilesTheSame	250	Exported Function
NtCallbackReturn	254	Exported Function
NtAssociateWaitCompletionPacket	252	Exported Function
NtCommitEnlistment	265	Exported Function
NtCommitComplete	264	Exported Function
NtCommitTransaction	267	Exported Function
NtCommitRegistryTransaction	266	Exported Function
NtCloseObjectAuditAlarm	263	Exported Function
NtCancelWaitCompletionPacket	260	Exported Function
NtCancelTimer2	259	Exported Function
NtClose	262	Exported Function
NtClearEvent	261	Exported Function
NtApphelpCacheControl	249	Exported Function
NtAlpcDeleteSectionView	237	Exported Function
NtAlpcDeleteResourceReserve	236	Exported Function
NtAlpcDisconnectPort	239	Exported Function
NtAlpcDeleteSecurityContext	238	Exported Function
NtAlpcDeletePortSection	235	Exported Function
NtAlpcCreateResourceReserve	232	Exported Function
NtAlpcCreatePortSection	231	Exported Function
NtAlpcCreateSecurityContext	234	Exported Function
NtAlpcCreateSectionView	233	Exported Function
NtAlpcRevokeSecurityContext	246	Exported Function
NtAlpcQueryInformationMessage	245	Exported Function
NtAlpcSetInformation	248	Exported Function
NtAlpcSendWaitReceivePort	247	Exported Function
NtAlpcQueryInformation	244	Exported Function
NtAlpcImpersonateClientOfPort	241	Exported Function
NtAlpcImpersonateClientContainerOfPort	240	Exported Function
NtAlpcOpenSenderThread	243	Exported Function
NtAlpcOpenSenderProcess	242	Exported Function
NtdllDefWindowProc_W	672	Exported Function
NtOpenSection	442	Exported Function
NtOpenResourceManager	441	Exported Function
NtOpenSession	444	Exported Function
NtOpenSemaphore	443	Exported Function
NtOpenRegistryTransaction	440	Exported Function
NtOpenProcess	437	Exported Function
NtOpenPrivateNamespace	436	Exported Function
NtOpenProcessTokenEx	439	Exported Function
NtOpenProcessToken	438	Exported Function
NtOpenTransactionManager	451	Exported Function
NtOpenTransaction	450	Exported Function
NtPowerInformation	453	Exported Function
NtPlugPlayControl	452	Exported Function
NtOpenTimer	449	Exported Function
NtOpenThread	446	Exported Function
NtOpenSymbolicLinkObject	445	Exported Function
NtOpenThreadTokenEx	448	Exported Function
NtOpenThreadToken	447	Exported Function
NtOpenPartition	435	Exported Function
NtOpenEvent	423	Exported Function
NtOpenEnlistment	422	Exported Function
NtOpenFile	425	Exported Function
NtOpenEventPair	424	Exported Function
NtOpenDirectoryObject	421	Exported Function
NtNotifyChangeKey	418	Exported Function
NtNotifyChangeDirectoryFileEx	417	Exported Function
NtNotifyChangeSession	420	Exported Function
NtNotifyChangeMultipleKeys	419	Exported Function
NtOpenKeyTransactedEx	431	Exported Function
NtOpenKeyTransacted	430	Exported Function
NtOpenObjectAuditAlarm	434	Exported Function
NtOpenMutant	433	Exported Function
NtOpenKeyEx	429	Exported Function
NtOpenJobObject	427	Exported Function
NtOpenIoCompletion	426	Exported Function
NtOpenKeyedEvent	432	Exported Function
NtOpenKey	428	Exported Function
NtPrepareComplete	456	Exported Function
NtQueryInformationAtom	480	Exported Function
NtQueryFullAttributesFile	479	Exported Function
NtQueryInformationEnlistment	482	Exported Function
NtQueryInformationByName	481	Exported Function
NtQueryEvent	478	Exported Function
NtQueryDirectoryObject	475	Exported Function
NtQueryDirectoryFileEx	474	Exported Function
NtQueryEaFile	477	Exported Function
NtQueryDriverEntryOrder	476	Exported Function
NtQueryInformationToken	489	Exported Function
NtQueryInformationThread	488	Exported Function
NtQueryInformationTransactionManager	491	Exported Function
NtQueryInformationTransaction	490	Exported Function
NtQueryInformationResourceManager	487	Exported Function
NtQueryInformationJobObject	484	Exported Function
NtQueryInformationFile	483	Exported Function
NtQueryInformationProcess	486	Exported Function
NtQueryInformationPort	485	Exported Function
NtQueryDirectoryFile	473	Exported Function
NtPropagationComplete	461	Exported Function
NtPrivilegeObjectAuditAlarm	459	Exported Function
NtProtectVirtualMemory	463	Exported Function
NtPropagationFailed	462	Exported Function
NtPrivilegedServiceAuditAlarm	460	Exported Function
NtPrePrepareComplete	454	Exported Function
NtPrepareEnlistment	457	Exported Function
NtPrivilegeCheck	458	Exported Function
NtPrePrepareEnlistment	455	Exported Function
NtQueryDebugFilterState	470	Exported Function
NtQueryBootOptions	469	Exported Function
NtQueryDefaultUILanguage	472	Exported Function
NtQueryDefaultLocale	471	Exported Function
NtQueryBootEntryOrder	468	Exported Function
NtPulseEvent	465	Exported Function
NtPssCaptureVaSpaceBulk	464	Exported Function
NtQueryAuxiliaryCounterFrequency	467	Exported Function
NtQueryAttributesFile	466	Exported Function
NtNotifyChangeDirectoryFile	416	Exported Function
NtFreeUserPhysicalPages	366	Exported Function
NtFlushWriteBuffer	365	Exported Function
NtFreezeRegistry	368	Exported Function
NtFreeVirtualMemory	367	Exported Function
NtFlushVirtualMemory	364	Exported Function
NtFlushInstructionCache	361	Exported Function
NtFlushInstallUILanguage	360	Exported Function
NtFlushProcessWriteBuffers	363	Exported Function
NtFlushKey	362	Exported Function
NtGetCurrentProcessorNumberEx	375	Exported Function
NtGetCurrentProcessorNumber	374	Exported Function
NtGetMUIRegistryInfo	377	Exported Function
NtGetDevicePowerState	376	Exported Function
NtGetContextThread	373	Exported Function
NtFsControlFile	370	Exported Function
NtFreezeTransactions	369	Exported Function
NtGetCompleteWnfStateSubscription	372	Exported Function
NtGetCachedSigningLevel	371	Exported Function
NtFlushBuffersFileEx	359	Exported Function
NtEnumerateBootEntries	347	Exported Function
NtEnableLastKnownGood	346	Exported Function
NtEnumerateKey	349	Exported Function
NtEnumerateDriverEntries	348	Exported Function
NtDuplicateToken	345	Exported Function
NtdllDialogWndProc_W	674	Exported Function
NtdllDialogWndProc_A	673	Exported Function
NtDuplicateObject	344	Exported Function
NtDrawText	343	Exported Function
NtFilterTokenEx	356	Exported Function
NtFilterToken	355	Exported Function
NtFlushBuffersFile	358	Exported Function
NtFindAtom	357	Exported Function
NtFilterBootOption	354	Exported Function
NtEnumerateTransactionObject	351	Exported Function
NtEnumerateSystemEnvironmentValuesEx	350	Exported Function
NtExtendSection	353	Exported Function
NtEnumerateValueKey	352	Exported Function
NtGetNextProcess	378	Exported Function
NtLockVirtualMemory	404	Exported Function
NtLockRegistryKey	403	Exported Function
NtMakeTemporaryObject	406	Exported Function
NtMakePermanentObject	405	Exported Function
NtLockProductActivationKeys	402	Exported Function
NtLoadKey3	399	Exported Function
NtLoadKey2	398	Exported Function
NtLockFile	401	Exported Function
NtLoadKeyEx	400	Exported Function
NtMapViewOfSectionEx	413	Exported Function
NtMapViewOfSection	412	Exported Function
NtModifyDriverEntry	415	Exported Function
NtModifyBootEntry	414	Exported Function
NtMapUserPhysicalPagesScatter	411	Exported Function
NtManagePartition	408	Exported Function
NtManageHotPatch	407	Exported Function
NtMapUserPhysicalPages	410	Exported Function
NtMapCMFModule	409	Exported Function
NtLoadKey	397	Exported Function
NtImpersonateClientOfPort	385	Exported Function
NtImpersonateAnonymousToken	384	Exported Function
NtInitializeEnclave	387	Exported Function
NtImpersonateThread	386	Exported Function
NtGetWriteWatch	383	Exported Function
NtGetNlsSectionPtr	380	Exported Function
NtGetNextThread	379	Exported Function
NtGetTickCount	382	Exported Function
NtGetNotificationResourceManager	381	Exported Function
NtListenPort	394	Exported Function
NtIsUILanguageComitted	393	Exported Function
NtLoadEnclaveData	396	Exported Function
NtLoadDriver	395	Exported Function
NtIsSystemResumeAutomatic	392	Exported Function
NtInitializeRegistry	389	Exported Function
NtInitializeNlsFiles	388	Exported Function
NtIsProcessInJob	391	Exported Function
NtInitiatePowerAction	390	Exported Function
memcpy_s	2369	Exported Function
atol	2334	Exported Function
atoi	2333	Exported Function
bsearch_s	2336	Exported Function
bsearch	2335	Exported Function
atan2	2332	Exported Function
ApiSetQueryApiSetPresence	27	Exported Function
AlpcUnregisterCompletionListWorkerThread	26	Exported Function
atan	2331	Exported Function
ApiSetQueryApiSetPresenceEx	28	Exported Function
CsrCaptureMessageString	33	Exported Function
CsrCaptureMessageMultiUnicodeStringsInPlace	32	Exported Function
CsrClientCallServer	35	Exported Function
CsrCaptureTimeout	34	Exported Function
CsrCaptureMessageBuffer	31	Exported Function
cos	2338	Exported Function
ceil	2337	Exported Function
CsrAllocateMessagePointer	30	Exported Function
CsrAllocateCaptureBuffer	29	Exported Function
AlpcUnregisterCompletionList	25	Exported Function
AlpcFreeCompletionListMessage	13	Exported Function
AlpcAdjustCompletionListConcurrencyCount	12	Exported Function
AlpcGetCompletionListMessageAttributes	15	Exported Function
AlpcGetCompletionListLastMessageInformation	14	Exported Function
abs	2330	Exported Function
A_SHAFinal	9	Exported Function
_wtol	2329	Exported Function
A_SHAUpdate	11	Exported Function
A_SHAInit	10	Exported Function
AlpcRegisterCompletionList	22	Exported Function
AlpcMaxAllowedMessageLength	21	Exported Function
AlpcRundownCompletionList	24	Exported Function
AlpcRegisterCompletionListWorkerThread	23	Exported Function
AlpcInitializeMessageAttribute	20	Exported Function
AlpcGetMessageAttribute	17	Exported Function
AlpcGetHeaderSize	16	Exported Function
AlpcGetOutstandingCompletionListMessageCount	19	Exported Function
AlpcGetMessageFromCompletionList	18	Exported Function
CsrClientConnectToServer	36	Exported Function
EtwCreateTraceInstanceId	62	Exported Function
EtwCheckCoverage	61	Exported Function
EtwEnumerateProcessRegGuids	64	Exported Function
EtwDeliverDataBlock	63	Exported Function
DbgUserBreakPoint	60	Exported Function
DbgUiSetThreadDebugObject	57	Exported Function
DbgUiRemoteBreakin	56	Exported Function
DbgUiWaitStateChange	59	Exported Function
DbgUiStopDebugging	58	Exported Function
EtwEventWrite	71	Exported Function
EtwEventUnregister	70	Exported Function
EtwEventWriteEx	73	Exported Function
EtwEventWriteEndScenario	72	Exported Function
EtwEventSetInformation	69	Exported Function
EtwEventEnabled	66	Exported Function
EtwEventActivityIdControl	65	Exported Function
EtwEventRegister	68	Exported Function
EtwEventProviderEnabled	67	Exported Function
DbgUiIssueRemoteBreakin	55	Exported Function
DbgPrint	43	Exported Function
DbgBreakPoint	42	Exported Function
DbgPrintReturnControlC	45	Exported Function
DbgPrintEx	44	Exported Function
CsrVerifyRegion	41	Exported Function
CsrGetProcessId	38	Exported Function
CsrFreeCaptureBuffer	37	Exported Function
CsrSetPriorityClass	40	Exported Function
CsrIdentifyAlertableThread	39	Exported Function
DbgUiConvertStateChangeStructureEx	52	Exported Function
DbgUiConvertStateChangeStructure	51	Exported Function
DbgUiGetThreadDebugObject	54	Exported Function
DbgUiDebugActiveProcess	53	Exported Function
DbgUiContinue	50	Exported Function
DbgQueryDebugFilterState	47	Exported Function
DbgPrompt	46	Exported Function
DbgUiConnectToDbg	49	Exported Function
DbgSetDebugFilterState	48	Exported Function
_wtoi64	2328	Exported Function
_memccpy	2278	Exported Function
_makepath_s	2277	Exported Function
_setjmp	2280	Exported Function
_memicmp	2279	Exported Function
_ltow_s	2276	Exported Function
_ltoa	2273	Exported Function
_local_unwind	2272	Exported Function
_ltow	2275	Exported Function
_ltoa_s	2274	Exported Function
_snwscanf_s	2287	Exported Function
_snwprintf_s	2286	Exported Function
_splitpath_s	2289	Exported Function
_splitpath	2288	Exported Function
_snwprintf	2285	Exported Function
_snprintf	2282	Exported Function
_setjmpex	2281	Exported Function
_snscanf_s	2284	Exported Function
_snprintf_s	2283	Exported Function
_lfind	2271	Exported Function
__toascii	2259	Exported Function
__misaligned_access	2258	Exported Function
_errno	2261	Exported Function
_atoi64	2260	Exported Function
__iscsymf	2257	Exported Function
__chkstk	2254	Exported Function
__C_specific_handler	2253	Exported Function
__iscsym	2256	Exported Function
__isascii	2255	Exported Function
_itoa_s	2268	Exported Function
_itoa	2267	Exported Function
_itow_s	2270	Exported Function
_itow	2269	Exported Function
_i64tow_s	2266	Exported Function
_i64toa	2263	Exported Function
_fltused	2262	Exported Function
_i64tow	2265	Exported Function
_i64toa_s	2264	Exported Function
_strcmpi	2290	Exported Function
_wcslwr	2316	Exported Function
_wcsicmp	2315	Exported Function
_wcsnicmp	2318	Exported Function
_wcslwr_s	2317	Exported Function
_vswprintf	2314	Exported Function
_vsnprintf_s	2311	Exported Function
_vsnprintf	2310	Exported Function
_vsnwprintf_s	2313	Exported Function
_vsnwprintf	2312	Exported Function
_wmakepath_s	2325	Exported Function
_wcsupr_s	2324	Exported Function
_wtoi	2327	Exported Function
_wsplitpath_s	2326	Exported Function
_wcsupr	2323	Exported Function
_wcsset_s	2320	Exported Function
_wcsnset_s	2319	Exported Function
_wcstoui64	2322	Exported Function
_wcstoi64	2321	Exported Function
_vscwprintf	2309	Exported Function
_strupr	2297	Exported Function
_strset_s	2296	Exported Function
_swprintf	2299	Exported Function
_strupr_s	2298	Exported Function
_strnset_s	2295	Exported Function
_strlwr	2292	Exported Function
_stricmp	2291	Exported Function
_strnicmp	2294	Exported Function
_strlwr_s	2293	Exported Function
_ultow	2306	Exported Function
_ultoa_s	2305	Exported Function
_vscprintf	2308	Exported Function
_ultow_s	2307	Exported Function
_ultoa	2304	Exported Function
_ui64toa_s	2301	Exported Function
_ui64toa	2300	Exported Function
_ui64tow_s	2303	Exported Function
_ui64tow	2302	Exported Function
EtwEventWriteFull	74	Exported Function
LdrProcessInitializationComplete	150	Exported Function
LdrpResGetResourceDirectory	189	Exported Function
LdrProcessRelocationBlockEx	152	Exported Function
LdrProcessRelocationBlock	151	Exported Function
LdrpResGetMappingSize	188	Exported Function
LdrLoadEnclaveModule	147	Exported Function
LdrLoadDll	146	Exported Function
LdrOpenImageFileOptionsKey	149	Exported Function
LdrLockLoaderLock	148	Exported Function
LdrRegisterDllNotification	159	Exported Function
LdrQueryProcessModuleInformation	158	Exported Function
LdrRemoveLoadAsDataTable	161	Exported Function
LdrRemoveDllDirectory	160	Exported Function
LdrQueryOptionalDelayLoadedAPI	157	Exported Function
LdrQueryImageFileExecutionOptionsEx	154	Exported Function
LdrQueryImageFileExecutionOptions	153	Exported Function
LdrQueryModuleServiceTags	156	Exported Function
LdrQueryImageFileKeyOption	155	Exported Function
LdrLoadAlternateResourceModuleEx	145	Exported Function
LdrGetDllPath	133	Exported Function
LdrGetDllHandleEx	132	Exported Function
LdrGetFileNameFromLoadAsDataTable	135	Exported Function
LdrGetFailureData	134	Exported Function
LdrGetDllHandleByName	131	Exported Function
LdrGetDllFullName	128	Exported Function
LdrGetDllDirectory	127	Exported Function
LdrGetDllHandleByMapping	130	Exported Function
LdrGetDllHandle	129	Exported Function
LdrInitShimEngineDynamic	140	Exported Function
LdrInitializeThunk	142	Exported Function
LdrLoadAlternateResourceModule	144	Exported Function
LdrIsModuleSxsRedirected	143	Exported Function
LdrInitializeEnclave	141	Exported Function
LdrGetProcedureAddress	137	Exported Function
LdrGetKnownDllSectionHandle	136	Exported Function
LdrGetProcedureAddressForCaller	139	Exported Function
LdrGetProcedureAddressEx	138	Exported Function
LdrResFindResource	162	Exported Function
log	2363	Exported Function
LdrVerifyImageMatchesChecksumEx	187	Exported Function
mbstowcs	2365	Exported Function
longjmp	2364	Exported Function
LdrVerifyImageMatchesChecksum	186	Exported Function
LdrUnlockLoaderLock	183	Exported Function
LdrUnloadDll	182	Exported Function
LdrUpdatePackageSearchPath	185	Exported Function
LdrUnregisterDllNotification	184	Exported Function
memchr	2366	Exported Function
MD5Update	195	Exported Function
memcpy	2368	Exported Function
memcmp	2367	Exported Function
MD5Init	194	Exported Function
MD4Init	191	Exported Function
MD4Final	190	Exported Function
MD5Final	193	Exported Function
MD4Update	192	Exported Function
LdrUnloadAlternateResourceModuleEx	181	Exported Function
LdrRscIsTypeExist	169	Exported Function
LdrResSearchResource	166	Exported Function
LdrSetDefaultDllDirectories	171	Exported Function
LdrSetAppCompatDllRedirectionCallback	170	Exported Function
LdrResRelease	165	Exported Function
LdrResGetRCConfig	164	Exported Function
LdrResFindResourceDirectory	163	Exported Function
LdrResolveDelayLoadsFromDll	168	Exported Function
LdrResolveDelayLoadedAPI	167	Exported Function
LdrStandardizeSystemPath	178	Exported Function
LdrShutdownThread	177	Exported Function
LdrUnloadAlternateResourceModule	180	Exported Function
LdrSystemDllInitBlock	179	Exported Function
LdrShutdownProcess	176	Exported Function
LdrSetDllManifestProber	173	Exported Function
LdrSetDllDirectory	172	Exported Function
LdrSetMUICacheType	175	Exported Function
LdrSetImplicitPathOptions	174	Exported Function
LdrFlushAlternateResourceModules	126	Exported Function
EvtIntReportEventAndSourceAsync	100	Exported Function
EvtIntReportAuthzEventAndSourceAsync	99	Exported Function
ExpInterlockedPopEntrySListFault	102	Exported Function
ExpInterlockedPopEntrySListEnd	101	Exported Function
EtwWriteUMSecurityEvent	96	Exported Function
EtwTraceMessage	93	Exported Function
EtwTraceEventInstance	92	Exported Function
EtwUnregisterTraceGuids	95	Exported Function
EtwTraceMessageVa	94	Exported Function
isdigit	2344	Exported Function
iscntrl	2343	Exported Function
islower	2346	Exported Function
isgraph	2345	Exported Function
isalpha	2342	Exported Function
fabs	2339	Exported Function
ExpInterlockedPopEntrySListResume	103	Exported Function
isalnum	2341	Exported Function
floor	2340	Exported Function
EtwSetMark	91	Exported Function
EtwGetTraceLoggerHandle	81	Exported Function
EtwGetTraceEnableLevel	80	Exported Function
EtwNotificationRegister	83	Exported Function
EtwLogTraceEvent	82	Exported Function
EtwGetTraceEnableFlags	79	Exported Function
EtwEventWriteStartScenario	76	Exported Function
EtwEventWriteNoRegistration	75	Exported Function
EtwEventWriteTransfer	78	Exported Function
EtwEventWriteString	77	Exported Function
EtwRegisterTraceGuidsW	88	Exported Function
EtwRegisterTraceGuidsA	87	Exported Function
EtwSendNotification	90	Exported Function
EtwReplyNotification	89	Exported Function
EtwRegisterSecurityProvider	86	Exported Function
EtwpCreateEtwThread	97	Exported Function
EtwNotificationUnregister	84	Exported Function
EtwProcessPrivateLoggerRequest	85	Exported Function
EtwpGetCpuSpeed	98	Exported Function
isprint	2347	Exported Function
LdrCallEnclave	114	Exported Function
LdrAppxHandleIntegrityFailure	113	Exported Function
LdrCreateEnclave	116	Exported Function
LdrControlFlowGuardEnforced	115	Exported Function
LdrAddRefDll	112	Exported Function
LdrAccessResource	109	Exported Function
labs	2362	Exported Function
LdrAddLoadAsDataTable	111	Exported Function
LdrAddDllDirectory	110	Exported Function
LdrFindResource_U	125	Exported Function
LdrFindEntryForAddress	122	Exported Function
LdrFindResourceEx_U	124	Exported Function
LdrFindResourceDirectory_U	123	Exported Function
LdrFastFailInLoaderCallout	121	Exported Function
LdrDisableThreadCalloutsForDll	118	Exported Function
LdrDeleteEnclave	117	Exported Function
LdrEnumResources	119	Exported Function
LdrEnumerateLoadedModules	120	Exported Function
KiUserInvertedFunctionTable	108	Exported Function
iswctype	2354	Exported Function
iswascii	2353	Exported Function
iswgraph	2356	Exported Function
iswdigit	2355	Exported Function
iswalpha	2352	Exported Function
isspace	2349	Exported Function
ispunct	2348	Exported Function
iswalnum	2351	Exported Function
isupper	2350	Exported Function
KiUserApcDispatcher	105	Exported Function
KiRaiseUserExceptionDispatcher	104	Exported Function
KiUserExceptionDispatcher	107	Exported Function
KiUserCallbackDispatcher	106	Exported Function
isxdigit	2361	Exported Function
iswprint	2358	Exported Function
iswlower	2357	Exported Function
iswxdigit	2360	Exported Function
iswspace	2359	Exported Function
RtlDeleteTimer	899	Exported Function
RtlDeleteSecurityObject	898	Exported Function
RtlDeleteTimerQueueEx	901	Exported Function
RtlDeleteTimerQueue	900	Exported Function
RtlDeleteResource	897	Exported Function
RtlDeleteHashTable	894	Exported Function
RtlDeleteGrowableFunctionTable	893	Exported Function
RtlDeleteRegistryValue	896	Exported Function
RtlDeleteNoSplay	895	Exported Function
RtlDeregisterWaitEx	907	Exported Function
RtlDeregisterWait	906	Exported Function
RtlDestroyAtomTable	909	Exported Function
RtlDeriveCapabilitySidsFromName	908	Exported Function
RtlDeregisterSecureMemoryCacheCallback	905	Exported Function
RtlDeleteUmsThreadContext	903	Exported Function
RtlDeleteUmsCompletionList	902	Exported Function
RtlDequeueUmsCompletionListItems	904	Exported Function
RtlDeNormalizeProcessParams	872	Exported Function
RtlDeleteFunctionTable	892	Exported Function
RtlDecompressBufferEx	880	Exported Function
RtlDecompressBuffer	879	Exported Function
RtlDefaultNpAcl	882	Exported Function
RtlDecompressFragment	881	Exported Function
RtlDeCommitDebugInfo	871	Exported Function
RtlDecodePointer	876	Exported Function
RtlDebugPrintTimes	875	Exported Function
RtlDecodeSystemPointer	878	Exported Function
RtlDecodeRemotePointer	877	Exported Function
RtlDeleteElementGenericTable	889	Exported Function
RtlDeleteCriticalSection	888	Exported Function
RtlDeleteElementGenericTableAvlEx	891	Exported Function
RtlDeleteElementGenericTableAvl	890	Exported Function
RtlDeleteBoundaryDescriptor	887	Exported Function
RtlDeleteAce	884	Exported Function
RtlDelete	883	Exported Function
RtlDeleteBarrier	886	Exported Function
RtlDeleteAtomFromAtomTable	885	Exported Function
RtlDestroyEnvironment	910	Exported Function
RtlDrainNonVolatileFlush	936	Exported Function
RtlDowncaseUnicodeString	935	Exported Function
RtlDuplicateUnicodeString	938	Exported Function
RtlDumpResource	937	Exported Function
RtlDowncaseUnicodeChar	934	Exported Function
RtlDosPathNameToRelativeNtPathName_U_WithStatus	931	Exported Function
RtlDosPathNameToRelativeNtPathName_U	930	Exported Function
RtlDosSearchPath_Ustr	933	Exported Function
RtlDosSearchPath_U	932	Exported Function
RtlEncodeRemotePointer	945	Exported Function
RtlEncodePointer	944	Exported Function
RtlEndEnumerationHashTable	947	Exported Function
RtlEncodeSystemPointer	946	Exported Function
RtlEnclaveCallDispatchReturn	943	Exported Function
RtlEnableEarlyCriticalSectionEventCreation	940	Exported Function
RtlEmptyAtomTable	939	Exported Function
RtlEnclaveCallDispatch	942	Exported Function
RtlEnableThreadProfiling	941	Exported Function
RtlDosPathNameToNtPathName_U_WithStatus	929	Exported Function
RtlDetectHeapLeaks	917	Exported Function
RtlDestroyQueryDebugBuffer	916	Exported Function
RtlDisableThreadProfiling	919	Exported Function
RtlDetermineDosPathNameType_U	918	Exported Function
RtlDestroyProcessParameters	915	Exported Function
RtlDestroyHeap	912	Exported Function
RtlDestroyHandleTable	911	Exported Function
RtlDestroyMemoryZone	914	Exported Function
RtlDestroyMemoryBlockLookaside	913	Exported Function
RtlDosLongPathNameToNtPathName_U_WithStatus	926	Exported Function
RtlDosApplyFileIsolationRedirection_Ustr	925	Exported Function
RtlDosPathNameToNtPathName_U	928	Exported Function
RtlDosLongPathNameToRelativeNtPathName_U_WithStatus	927	Exported Function
RtlDoesNameContainWildCards	924	Exported Function
RtlDllShutdownInProgress	921	Exported Function
RtlDisownModuleHeapAllocation	920	Exported Function
RtlDoesFileExists_U	923	Exported Function
RtlDnsHostNameToComputerName	922	Exported Function
RtlDeactivateActivationContextUnsafeFast	874	Exported Function
RtlCopyMemoryNonTemporal	822	Exported Function
RtlCopyMemory	821	Exported Function
RtlCopyOutOfProcessMemoryStreamTo	824	Exported Function
RtlCopyMemoryStreamTo	823	Exported Function
RtlCopyMappedMemory	820	Exported Function
RtlCopyExtendedContext	817	Exported Function
RtlCopyContext	816	Exported Function
RtlCopyLuidAndAttributesArray	819	Exported Function
RtlCopyLuid	818	Exported Function
RtlCrc64	831	Exported Function
RtlCrc32	830	Exported Function
RtlCreateActivationContext	833	Exported Function
RtlCreateAcl	832	Exported Function
RtlCopyUnicodeString	829	Exported Function
RtlCopySid	826	Exported Function
RtlCopySecurityDescriptor	825	Exported Function
RtlCopyString	828	Exported Function
RtlCopySidAndAttributesArray	827	Exported Function
RtlCopyBitMap	815	Exported Function
RtlConnectToSm	803	Exported Function
RtlComputePrivatizedDllName_U	802	Exported Function
RtlConstructCrossVmEventPath	805	Exported Function
RtlConsoleMultiByteToUnicodeN	804	Exported Function
RtlComputeImportTableHash	801	Exported Function
RtlCompleteProcessCloning	798	Exported Function
RtlCompareUnicodeStrings	797	Exported Function
RtlComputeCrc32	800	Exported Function
RtlCompressBuffer	799	Exported Function
RtlConvertSidToUnicodeString	813	Exported Function
RtlConvertSharedToExclusive	812	Exported Function
RtlConvertToAutoInheritSecurityObject	814	Exported Function
RtlConvertSRWLockExclusiveToShared	811	Exported Function
RtlConvertLCIDToString	810	Exported Function
RtlContractHashTable	807	Exported Function
RtlConstructCrossVmMutexPath	806	Exported Function
RtlConvertExclusiveToShared	809	Exported Function
RtlConvertDeviceFamilyInfoToString	808	Exported Function
RtlCreateAndSetSD	834	Exported Function
RtlCreateUnicodeStringFromAsciiz	860	Exported Function
RtlCreateUnicodeString	859	Exported Function
RtlCreateUserProcess	862	Exported Function
RtlCreateUserFiberShadowStack	861	Exported Function
RtlCreateUmsThreadContext	858	Exported Function
RtlCreateTimer	855	Exported Function
RtlCreateTagHeap	854	Exported Function
RtlCreateUmsCompletionList	857	Exported Function
RtlCreateTimerQueue	856	Exported Function
RtlCustomCPToUnicodeN	869	Exported Function
RtlCultureNameToLCID	868	Exported Function
RtlDeactivateActivationContext	873	Exported Function
RtlCutoverTimeToSystemTime	870	Exported Function
RtlCreateVirtualAccountSid	867	Exported Function
RtlCreateUserSecurityObject	864	Exported Function
RtlCreateUserProcessEx	863	Exported Function
RtlCreateUserThread	866	Exported Function
RtlCreateUserStack	865	Exported Function
RtlCreateSystemVolumeInformationFolder	853	Exported Function
RtlCreateHashTableEx	841	Exported Function
RtlCreateHashTable	840	Exported Function
RtlCreateMemoryBlockLookaside	843	Exported Function
RtlCreateHeap	842	Exported Function
RtlCreateEnvironmentEx	839	Exported Function
RtlCreateBootStatusDataFile	836	Exported Function
RtlCreateAtomTable	835	Exported Function
RtlCreateEnvironment	838	Exported Function
RtlCreateBoundaryDescriptor	837	Exported Function
RtlCreateRegistryKey	850	Exported Function
RtlCreateQueryDebugBuffer	849	Exported Function
RtlCreateServiceSid	852	Exported Function
RtlCreateSecurityDescriptor	851	Exported Function
RtlCreateProcessReflection	848	Exported Function
RtlCreateProcessParameters	845	Exported Function
RtlCreateMemoryZone	844	Exported Function
RtlCreateProcessParametersWithTemplate	847	Exported Function
RtlCreateProcessParametersEx	846	Exported Function
RtlEndStrongEnumerationHashTable	948	Exported Function
RtlGetCurrentTransaction	1051	Exported Function
RtlGetCurrentServiceSessionId	1050	Exported Function
RtlGetDaclSecurityDescriptor	1053	Exported Function
RtlGetCurrentUmsThread	1052	Exported Function
RtlGetCurrentProcessorNumberEx	1049	Exported Function
RtlGetCurrentDirectory_U	1046	Exported Function
RtlGetCriticalSectionRecursionCount	1045	Exported Function
RtlGetCurrentProcessorNumber	1048	Exported Function
RtlGetCurrentPeb	1047	Exported Function
RtlGetExtendedContextLength2	1060	Exported Function
RtlGetExtendedContextLength	1059	Exported Function
RtlGetFileMUIPath	1062	Exported Function
RtlGetExtendedFeaturesMask	1061	Exported Function
RtlGetExePath	1058	Exported Function
RtlGetElementGenericTable	1055	Exported Function
RtlGetDeviceFamilyInfoEnum	1054	Exported Function
RtlGetEnabledExtendedFeatures	1057	Exported Function
RtlGetElementGenericTableAvl	1056	Exported Function
RtlGetControlSecurityDescriptor	1044	Exported Function
RtlFreeUserStack	1032	Exported Function
RtlFreeUserFiberShadowStack	1031	Exported Function
RtlGenerate8dot3Name	1034	Exported Function
RtlFreeUTF8String	1029	Exported Function
RtlFreeUnicodeString	1030	Exported Function
RtlFreeOemString	1026	Exported Function
RtlFreeNonVolatileToken	1025	Exported Function
RtlFreeThreadActivationContextStack	1028	Exported Function
RtlFreeSid	1027	Exported Function
RtlGetCallersAddress	1041	Exported Function
RtlGetAppContainerSidType	1040	Exported Function
RtlGetConsoleSessionForegroundProcessId	1043	Exported Function
RtlGetCompressionWorkSpaceSize	1042	Exported Function
RtlGetAppContainerParent	1039	Exported Function
RtlGetActiveActivationContext	1036	Exported Function
RtlGetAce	1035	Exported Function
RtlGetAppContainerNamedObjectPath	1038	Exported Function
RtlGetActiveConsoleId	1037	Exported Function
RtlGetFrame	1063	Exported Function
RtlGetProcessHeaps	1089	Exported Function
RtlGetPersistedStateLocation	1088	Exported Function
RtlGetProductInfo	1091	Exported Function
RtlGetProcessPreferredUILanguages	1090	Exported Function
RtlGetParentLocaleName	1087	Exported Function
RtlGetNtSystemRoot	1084	Exported Function
RtlGetNtProductType	1083	Exported Function
RtlGetOwnerSecurityDescriptor	1086	Exported Function
RtlGetNtVersionNumbers	1085	Exported Function
RtlGetSuiteMask	1098	Exported Function
RtlGetSetBootStatusData	1097	Exported Function
RtlGetSystemBootStatusEx	1100	Exported Function
RtlGetSystemBootStatus	1099	Exported Function
RtlGetSessionProperties	1096	Exported Function
RtlGetSaclSecurityDescriptor	1093	Exported Function
RtlGetReturnAddressHijackTarget	1092	Exported Function
RtlGetSecurityDescriptorRMControl	1095	Exported Function
RtlGetSearchPath	1094	Exported Function
RtlGetNtGlobalFlags	1082	Exported Function
RtlGetInterruptTimePrecise	1070	Exported Function
RtlGetIntegerAtom	1069	Exported Function
RtlGetLastWin32Error	1072	Exported Function
RtlGetLastNtStatus	1071	Exported Function
RtlGetGroupSecurityDescriptor	1068	Exported Function
RtlGetFullPathName_UEx	1065	Exported Function
RtlGetFullPathName_U	1064	Exported Function
RtlGetFunctionTableListHead	1067	Exported Function
RtlGetFullPathName_UstrEx	1066	Exported Function
RtlGetNextEntryHashTable	1079	Exported Function
RtlGetNativeSystemInformation	1078	Exported Function
RtlGetNonVolatileToken	1081	Exported Function
RtlGetNextUmsListItem	1080	Exported Function
RtlGetMultiTimePrecise	1077	Exported Function
RtlGetLengthWithoutTrailingPathSeperators	1074	Exported Function
RtlGetLengthWithoutLastFullDosOrNtPathElement	1073	Exported Function
RtlGetLongestNtPathLength	1076	Exported Function
RtlGetLocaleFileMappingAddress	1075	Exported Function
RtlFreeMemoryBlockLookaside	1024	Exported Function
RtlExitUserThread	974	Exported Function
RtlExitUserProcess	973	Exported Function
RtlExpandEnvironmentStrings_U	976	Exported Function
RtlExpandEnvironmentStrings	975	Exported Function
RtlExecuteUmsThread	972	Exported Function
RtlEthernetAddressToStringW	969	Exported Function
RtlEthernetAddressToStringA	968	Exported Function
RtlEthernetStringToAddressW	971	Exported Function
RtlEthernetStringToAddressA	970	Exported Function
RtlFillMemoryNonTemporal	983	Exported Function
RtlFillMemory	982	Exported Function
RtlFinalReleaseOutOfProcessMemoryStream	985	Exported Function
RtlFillNonVolatileMemory	984	Exported Function
RtlExtractBitMap	981	Exported Function
RtlExtendCorrelationVector	978	Exported Function
RtlExpandHashTable	977	Exported Function
RtlExtendMemoryZone	980	Exported Function
RtlExtendMemoryBlockLookaside	979	Exported Function
RtlEraseUnicodeString	967	Exported Function
RtlEnumerateGenericTableLikeADirectory	956	Exported Function
RtlEnumerateGenericTableAvl	955	Exported Function
RtlEnumerateGenericTableWithoutSplayingAvl	958	Exported Function
RtlEnumerateGenericTableWithoutSplaying	957	Exported Function
RtlEnumerateGenericTable	954	Exported Function
RtlEnterCriticalSection	950	Exported Function
RtlEndWeakEnumerationHashTable	949	Exported Function
RtlEnumerateEntryHashTable	953	Exported Function
RtlEnterUmsSchedulingMode	951	Exported Function
RtlEqualString	964	Exported Function
RtlEqualSid	963	Exported Function
RtlEqualWnfChangeStamps	966	Exported Function
RtlEqualUnicodeString	965	Exported Function
RtlEqualPrefixSid	962	Exported Function
RtlEqualComputerName	959	Exported Function
RtlEnumProcessHeaps	952	Exported Function
RtlEqualLuid	961	Exported Function
RtlEqualDomainName	960	Exported Function
RtlFindAceByType	986	Exported Function
RtlFlsSetValue	1012	Exported Function
RtlFlsGetValue	1011	Exported Function
RtlFlushNonVolatileMemory	1014	Exported Function
RtlFlushHeaps	1013	Exported Function
RtlFlsFree	1010	Exported Function
RtlFirstEntrySList	1007	Exported Function
RtlFindUnicodeSubstring	1006	Exported Function
RtlFlsAlloc	1009	Exported Function
RtlFirstFreeAce	1008	Exported Function
RtlFreeAnsiString	1021	Exported Function
RtlFreeActivationContextStack	1020	Exported Function
RtlFreeHeap	1023	Exported Function
RtlFreeHandle	1022	Exported Function
RtlFormatMessageEx	1019	Exported Function
RtlFlushSecureMemoryCache	1016	Exported Function
RtlFlushNonVolatileMemoryRanges	1015	Exported Function
RtlFormatMessage	1018	Exported Function
RtlFormatCurrentUserKeyPath	1017	Exported Function
RtlFindSetBitsEx	1005	Exported Function
RtlFindClearRuns	993	Exported Function
RtlFindClearBitsEx	992	Exported Function
RtlFindExportedRoutineByName	995	Exported Function
RtlFindClosestEncodableLength	994	Exported Function
RtlFindClearBitsAndSet	991	Exported Function
RtlFindActivationContextSectionString	988	Exported Function
RtlFindActivationContextSectionGuid	987	Exported Function
RtlFindClearBits	990	Exported Function
RtlFindCharInUnicodeString	989	Exported Function
RtlFindSetBits	1002	Exported Function
RtlFindNextForwardRunClear	1001	Exported Function
RtlFindSetBitsAndClearEx	1004	Exported Function
RtlFindSetBitsAndClear	1003	Exported Function
RtlFindMostSignificantBit	1000	Exported Function
RtlFindLeastSignificantBit	997	Exported Function
RtlFindLastBackwardRunClear	996	Exported Function
RtlFindMessage	999	Exported Function
RtlFindLongestRunClear	998	Exported Function
RtlCompareUnicodeString	796	Exported Function
NtSetInformationResourceManager	594	Exported Function
NtSetInformationProcess	593	Exported Function
NtSetInformationThread	596	Exported Function
NtSetInformationSymbolicLink	595	Exported Function
NtSetInformationObject	592	Exported Function
NtSetInformationFile	589	Exported Function
NtSetInformationEnlistment	588	Exported Function
NtSetInformationKey	591	Exported Function
NtSetInformationJobObject	590	Exported Function
NtSetIoCompletion	603	Exported Function
NtSetIntervalProfile	602	Exported Function
NtSetIRTimer	586	Exported Function
NtSetIoCompletionEx	604	Exported Function
NtSetInformationWorkerFactory	601	Exported Function
NtSetInformationTransaction	598	Exported Function
NtSetInformationToken	597	Exported Function
NtSetInformationVirtualMemory	600	Exported Function
NtSetInformationTransactionManager	599	Exported Function
NtSetInformationDebugObject	587	Exported Function
NtSetCachedSigningLevel2	574	Exported Function
NtSetCachedSigningLevel	573	Exported Function
NtSetDebugFilterState	576	Exported Function
NtSetContextThread	575	Exported Function
NtSetBootOptions	572	Exported Function
NtSecureConnectPort	569	Exported Function
NtSaveMergedKeys	568	Exported Function
NtSetBootEntryOrder	571	Exported Function
NtSerializeBoot	570	Exported Function
NtSetEventBoostPriority	583	Exported Function
NtSetEvent	582	Exported Function
NtSetHighWaitLowEventPair	585	Exported Function
NtSetHighEventPair	584	Exported Function
NtSetEaFile	581	Exported Function
NtSetDefaultLocale	578	Exported Function
NtSetDefaultHardErrorPort	577	Exported Function
NtSetDriverEntryOrder	580	Exported Function
NtSetDefaultUILanguage	579	Exported Function
NtSetLdtEntries	605	Exported Function
NtSuspendProcess	631	Exported Function
NtSubscribeWnfStateChange	630	Exported Function
NtSystemDebugControl	633	Exported Function
NtSuspendThread	632	Exported Function
NtStopProfile	629	Exported Function
NtSignalAndWaitForSingleObject	626	Exported Function
NtShutdownWorkerFactory	625	Exported Function
NtStartProfile	628	Exported Function
NtSinglePhaseReject	627	Exported Function
NtThawTransactions	640	Exported Function
NtThawRegistry	639	Exported Function
NtTraceEvent	642	Exported Function
NtTraceControl	641	Exported Function
NtTestAlert	638	Exported Function
NtTerminateJobObject	635	Exported Function
NtTerminateEnclave	634	Exported Function
NtTerminateThread	637	Exported Function
NtTerminateProcess	636	Exported Function
NtShutdownSystem	624	Exported Function
NtSetSystemInformation	612	Exported Function
NtSetSystemEnvironmentValueEx	611	Exported Function
NtSetSystemTime	614	Exported Function
NtSetSystemPowerState	613	Exported Function
NtSetSystemEnvironmentValue	610	Exported Function
NtSetLowWaitHighEventPair	607	Exported Function
NtSetLowEventPair	606	Exported Function
NtSetSecurityObject	609	Exported Function
NtSetQuotaInformationFile	608	Exported Function
NtSetValueKey	621	Exported Function
NtSetUuidSeed	620	Exported Function
NtSetWnfProcessNotificationEvent	623	Exported Function
NtSetVolumeInformationFile	622	Exported Function
NtSetTimerResolution	619	Exported Function
NtSetTimer	616	Exported Function
NtSetThreadExecutionState	615	Exported Function
NtSetTimerEx	618	Exported Function
NtSetTimer2	617	Exported Function
NtSaveKeyEx	567	Exported Function
NtQueryTimer	517	Exported Function
NtQuerySystemTime	516	Exported Function
NtQueryValueKey	519	Exported Function
NtQueryTimerResolution	518	Exported Function
NtQuerySystemInformationEx	515	Exported Function
NtQuerySystemEnvironmentValue	512	Exported Function
NtQuerySymbolicLinkObject	511	Exported Function
NtQuerySystemInformation	514	Exported Function
NtQuerySystemEnvironmentValueEx	513	Exported Function
NtRaiseException	526	Exported Function
NtQueueApcThreadEx	525	Exported Function
NtReadFile	528	Exported Function
NtRaiseHardError	527	Exported Function
NtQueueApcThread	524	Exported Function
NtQueryVolumeInformationFile	521	Exported Function
NtQueryVirtualMemory	520	Exported Function
NtQueryWnfStateNameInformation	523	Exported Function
NtQueryWnfStateData	522	Exported Function
NtQuerySemaphore	510	Exported Function
NtQueryMultipleValueKey	498	Exported Function
NtQueryLicenseValue	497	Exported Function
NtQueryObject	500	Exported Function
NtQueryMutant	499	Exported Function
NtQueryKey	496	Exported Function
NtQueryInstallUILanguage	493	Exported Function
NtQueryInformationWorkerFactory	492	Exported Function
NtQueryIoCompletion	495	Exported Function
NtQueryIntervalProfile	494	Exported Function
NtQuerySecurityAttributesToken	507	Exported Function
NtQuerySection	506	Exported Function
NtQuerySecurityPolicy	509	Exported Function
NtQuerySecurityObject	508	Exported Function
NtQueryQuotaInformationFile	505	Exported Function
NtQueryOpenSubKeysEx	502	Exported Function
NtQueryOpenSubKeys	501	Exported Function
NtQueryPortInformationProcess	504	Exported Function
NtQueryPerformanceCounter	503	Exported Function
NtReadFileScatter	529	Exported Function
NtResetEvent	555	Exported Function
NtRequestWaitReplyPort	554	Exported Function
NtRestoreKey	557	Exported Function
NtResetWriteWatch	556	Exported Function
NtRequestPort	553	Exported Function
NtReplyWaitReceivePort	550	Exported Function
NtReplyPort	549	Exported Function
NtReplyWaitReplyPort	552	Exported Function
NtReplyWaitReceivePortEx	551	Exported Function
NtRollbackTransaction	564	Exported Function
NtRollbackRegistryTransaction	563	Exported Function
NtSaveKey	566	Exported Function
NtRollforwardTransactionManager	565	Exported Function
NtRollbackEnlistment	562	Exported Function
NtResumeThread	559	Exported Function
NtResumeProcess	558	Exported Function
NtRollbackComplete	561	Exported Function
NtRevertContainerImpersonation	560	Exported Function
NtReplacePartitionUnit	548	Exported Function
NtRegisterProtocolAddressInformation	536	Exported Function
NtRecoverTransactionManager	535	Exported Function
NtReleaseKeyedEvent	538	Exported Function
NtRegisterThreadTerminatePort	537	Exported Function
NtRecoverResourceManager	534	Exported Function
NtReadRequestData	531	Exported Function
NtReadOnlyEnlistment	530	Exported Function
NtRecoverEnlistment	533	Exported Function
NtReadVirtualMemory	532	Exported Function
NtRenameKey	545	Exported Function
NtRemoveProcessDebug	544	Exported Function
NtReplaceKey	547	Exported Function
NtRenameTransactionManager	546	Exported Function
NtRemoveIoCompletionEx	543	Exported Function
NtReleaseSemaphore	540	Exported Function
NtReleaseMutant	539	Exported Function
NtRemoveIoCompletion	542	Exported Function
NtReleaseWorkerFactoryWorker	541	Exported Function
NtTranslateFilePath	643	Exported Function
RtlApplyRXactNoFlush	746	Exported Function
RtlApplyRXact	745	Exported Function
RtlAreAllAccessesGranted	748	Exported Function
RtlAppxIsFileOwnedByTrustedInstaller	747	Exported Function
RtlApplicationVerifierStop	744	Exported Function
RtlAppendStringToString	741	Exported Function
RtlAppendPathElement	740	Exported Function
RtlAppendUnicodeToString	743	Exported Function
RtlAppendUnicodeStringToString	742	Exported Function
RtlAvlInsertNodeEx	755	Exported Function
RtlAssert	754	Exported Function
RtlBarrier	757	Exported Function
RtlAvlRemoveNode	756	Exported Function
RtlAreLongPathsEnabled	753	Exported Function
RtlAreBitsClear	750	Exported Function
RtlAreAnyAccessesGranted	749	Exported Function
RtlAreBitsSet	752	Exported Function
RtlAreBitsClearEx	751	Exported Function
RtlAppendAsciizToString	739	Exported Function
RtlAdjustPrivilege	727	Exported Function
RtlAddVectoredExceptionHandler	725	Exported Function
RtlAllocateAndInitializeSid	729	Exported Function
RtlAllocateActivationContextStack	728	Exported Function
RtlAddVectoredContinueHandler	724	Exported Function
RtlAddressInSectionTable	726	Exported Function
RtlAddResourceAttributeAce	721	Exported Function
RtlAddSIDToBoundaryDescriptor	722	Exported Function
RtlAddScopedPolicyIDAce	723	Exported Function
RtlAnsiCharToUnicodeChar	736	Exported Function
RtlAllocateWnfSerializationGroup	735	Exported Function
RtlAnsiStringToUnicodeString	738	Exported Function
RtlAnsiStringToUnicodeSize	737	Exported Function
RtlAllocateMemoryZone	734	Exported Function
RtlAllocateHandle	731	Exported Function
RtlAllocateAndInitializeSidEx	730	Exported Function
RtlAllocateMemoryBlockLookaside	733	Exported Function
RtlAllocateHeap	732	Exported Function
RtlBarrierForDelete	758	Exported Function
RtlClearThreadWorkOnBehalfTicket	784	Exported Function
RtlClearBitsEx	783	Exported Function
RtlCloneUserProcess	786	Exported Function
RtlCloneMemoryStream	785	Exported Function
RtlClearBits	782	Exported Function
RtlClearAllBitsEx	779	Exported Function
RtlClearAllBits	778	Exported Function
RtlClearBitEx	781	Exported Function
RtlClearBit	780	Exported Function
RtlCompareMemory	793	Exported Function
RtlCompareAltitudes	792	Exported Function
RtlCompareString	795	Exported Function
RtlCompareMemoryUlong	794	Exported Function
RtlCompactHeap	791	Exported Function
RtlCmEncodeMemIoResource	788	Exported Function
RtlCmDecodeMemIoResource	787	Exported Function
RtlCommitMemoryStream	790	Exported Function
RtlCommitDebugInfo	789	Exported Function
RtlCleanUpTEBLangLists	777	Exported Function
RtlCaptureContext2	765	Exported Function
RtlCaptureContext	764	Exported Function
RtlCharToInteger	767	Exported Function
RtlCaptureStackBackTrace	766	Exported Function
RtlCapabilityCheckForSingleSessionSku	763	Exported Function
RtlCancelTimer	760	Exported Function
RtlCallEnclaveReturn	759	Exported Function
RtlCapabilityCheck	762	Exported Function
RtlCanonicalizeDomainName	761	Exported Function
RtlCheckTokenCapability	774	Exported Function
RtlCheckSystemBootStatusIntegrity	773	Exported Function
RtlCheckTokenMembershipEx	776	Exported Function
RtlCheckTokenMembership	775	Exported Function
RtlCheckSandboxedToken	772	Exported Function
RtlCheckForOrphanedCriticalSections	769	Exported Function
RtlCheckBootStatusIntegrity	768	Exported Function
RtlCheckRegistryKey	771	Exported Function
RtlCheckPortableOperatingSystem	770	Exported Function
RtlAddRefMemoryStream	720	Exported Function
NtWriteVirtualMemory	669	Exported Function
NtWriteRequestData	668	Exported Function
PfxFindPrefix	675	Exported Function
NtYieldExecution	670	Exported Function
NtWriteFileGather	667	Exported Function
NtWaitLowEventPair	664	Exported Function
NtWaitHighEventPair	663	Exported Function
NtWriteFile	666	Exported Function
NtWorkerFactoryWorkerReady	665	Exported Function
PssNtFreeRemoteSnapshot	681	Exported Function
PssNtDuplicateSnapshot	680	Exported Function
PssNtFreeWalkMarker	683	Exported Function
PssNtFreeSnapshot	682	Exported Function
PssNtCaptureSnapshot	679	Exported Function
PfxInsertPrefix	677	Exported Function
PfxInitialize	676	Exported Function
pow	2373	Exported Function
PfxRemovePrefix	678	Exported Function
NtWaitForWorkViaWorkerFactory	662	Exported Function
NtUnlockVirtualMemory	650	Exported Function
NtUnlockFile	649	Exported Function
NtUnmapViewOfSectionEx	652	Exported Function
NtUnmapViewOfSection	651	Exported Function
NtUnloadKeyEx	648	Exported Function
NtUnloadDriver	645	Exported Function
NtUmsThreadYield	644	Exported Function
NtUnloadKey2	647	Exported Function
NtUnloadKey	646	Exported Function
NtWaitForMultipleObjects	659	Exported Function
NtWaitForKeyedEvent	658	Exported Function
NtWaitForSingleObject	661	Exported Function
NtWaitForMultipleObjects32	660	Exported Function
NtWaitForDebugEvent	657	Exported Function
NtUpdateWnfStateData	654	Exported Function
NtUnsubscribeWnfStateChange	653	Exported Function
NtWaitForAlertByThreadId	656	Exported Function
NtVdmControl	655	Exported Function
PssNtQuerySnapshot	684	Exported Function
RtlAddAtomToAtomTable	708	Exported Function
RtlAddActionToRXact	707	Exported Function
RtlAddAuditAccessAce	710	Exported Function
RtlAddAttributeActionToRXact	709	Exported Function
RtlAddAce	706	Exported Function
RtlAddAccessDeniedAceEx	703	Exported Function
RtlAddAccessDeniedAce	702	Exported Function
RtlAddAccessFilterAce	705	Exported Function
RtlAddAccessDeniedObjectAce	704	Exported Function
RtlAddMandatoryAce	717	Exported Function
RtlAddIntegrityLabelToBoundaryDescriptor	716	Exported Function
RtlAddRefActivationContext	719	Exported Function
RtlAddProcessTrustLabelAce	718	Exported Function
RtlAddGrowableFunctionTable	715	Exported Function
RtlAddAuditAccessObjectAce	712	Exported Function
RtlAddAuditAccessAceEx	711	Exported Function
RtlAddFunctionTable	714	Exported Function
RtlAddCompoundAce	713	Exported Function
RtlAddAccessAllowedObjectAce	701	Exported Function
RtlAcquirePebLock	689	Exported Function
RtlAbsoluteToSelfRelativeSD	688	Exported Function
RtlAcquireReleaseSRWLockExclusive	691	Exported Function
RtlAcquirePrivilege	690	Exported Function
RtlAbortRXact	687	Exported Function
PssNtWalkSnapshot	686	Exported Function
PssNtValidateDescriptor	685	Exported Function
qsort_s	2375	Exported Function
qsort	2374	Exported Function
RtlActivateActivationContextUnsafeFast	698	Exported Function
RtlActivateActivationContextEx	697	Exported Function
RtlAddAccessAllowedAceEx	700	Exported Function
RtlAddAccessAllowedAce	699	Exported Function
RtlActivateActivationContext	696	Exported Function
RtlAcquireResourceShared	693	Exported Function
RtlAcquireResourceExclusive	692	Exported Function
RtlAcquireSRWLockShared	695	Exported Function
RtlAcquireSRWLockExclusive	694	Exported Function

Signature

• Status: Signature verified.
• Serial: 3300000266BD1580EFA75CD6D3000000000266
• Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
• Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
• Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

• Original Filename: ntdll.dll.mui
• Product Name: Microsoft Windows Operating System
• Company Name: Microsoft Corporation
• File Version: 10.0.19041.1 (WinBuild.160101.0800)
• Product Version: 10.0.19041.1
• Language: English (United States)
• Legal Copyright: Microsoft Corporation. All rights reserved.
• Machine Type: 64-bit

File Scan

• VirusTotal Detections: 0/69
• VirusTotal Link: https://www.virustotal.com/gui/file/b362b0bc83463cf58f5c0e666a76dde2aeb63a435c79642719fd32fb9fadfb13/detection/

Possible Misuse

The following table contains possible examples of ntdll.dll being misused. While ntdll.dll is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source	Source File	Example	License
sigma	proc_access_win_in_memory_assembly_execution.yml	description: Detects the access to processes by other suspicious processes which have reflectively loaded libraries in their memory space. An example is SilentTrinity C2 behaviour. Generally speaking, when Sysmon EventID 10 cannot reference a stack call to a dll loaded from disk (the standard way), it will display "UNKNOWN" as the module name. Usually this means the stack call points to a module that was reflectively loaded in memory. Adding to this, it is not common to see such few calls in the stack (ntdll.dll --> kernelbase.dll --> unknown) which essentially means that most of the functions required by the process to execute certain routines are already present in memory, not requiring any calls to external libraries. The latter should also be considered suspicious.	DRL 1.0
sigma	proc_access_win_in_memory_assembly_execution.yml	- 'C:\WINDOWS\SYSTEM32\ntdll.dll+'	DRL 1.0
sigma	proc_access_win_lazagne_cred_dump_lsass_access.yml	- 'C:\\Windows\\SYSTEM32\\ntdll.dll+'	DRL 1.0
sigma	proc_access_win_lsass_memdump.yml	description: Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and up.	DRL 1.0
sigma	proc_access_win_lsass_memdump.yml	- 'ntdll.dll'	DRL 1.0
sigma	proc_access_win_pypykatz_cred_dump_lsass_access.yml	- 'C:\Windows\SYSTEM32\ntdll.dll+'	DRL 1.0
sigma	proc_creation_win_susp_ntdll_type_redirect.yml	description: Detects command that type the content of ntdll.dll to a different file or a pipe in order to evade AV / EDR detection	DRL 1.0
sigma	proc_creation_win_susp_ntdll_type_redirect.yml	- 'type %windir%\system32\ntdll.dll'	DRL 1.0
sigma	proc_creation_win_susp_ntdll_type_redirect.yml	- 'type %systemroot%\system32\ntdll.dll'	DRL 1.0
sigma	proc_creation_win_susp_ntdll_type_redirect.yml	- 'type c:\windows\system32\ntdll.dll'	DRL 1.0
sigma	proc_creation_win_susp_ntdll_type_redirect.yml	- '\\ntdll.dll > \\\\.\\pipe\\'	DRL 1.0
malware-ioc	misp-dukes-operation-ghost-event.json	"description": "The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like CreateProcess(), LoadLibrary(), etc. of the Win32 API. (Citation: Wikipedia Windows Library Files)\n\nThe module loader can load DLLs:\n\n* via specification of the (fully-qualified or relative) DLL pathname in the IMPORT directory;\n \n* via EXPORT forwarded to another DLL, specified with (fully-qualified or relative) pathname (but without extension);\n \n* via an NTFS junction or symlink program.exe.local with the fully-qualified or relative pathname of a directory containing the DLLs specified in the IMPORT directory or forwarded EXPORTs;\n \n* via <code>&#x3c;file name=\"filename.extension\" loadFrom=\"fully-qualified or relative pathname\"&#x3e;</code> in an embedded or external \"application manifest\". The file name refers to an entry in the IMPORT directory or a forwarded EXPORT.\n\nAdversaries can use this functionality as a way to execute arbitrary code on a system.",	© ESET 2014-2018
malware-ioc	misp_invisimole.json	"description": "The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like CreateProcess(), LoadLibrary(), etc. of the Win32 API. (Citation: Wikipedia Windows Library Files)\n\nThe module loader can load DLLs:\n\n* via specification of the (fully-qualified or relative) DLL pathname in the IMPORT directory;\n \n* via EXPORT forwarded to another DLL, specified with (fully-qualified or relative) pathname (but without extension);\n \n* via an NTFS junction or symlink program.exe.local with the fully-qualified or relative pathname of a directory containing the DLLs specified in the IMPORT directory or forwarded EXPORTs;\n \n* via <code>&#x3c;file name=\"filename.extension\" loadFrom=\"fully-qualified or relative pathname\"&#x3e;</code> in an embedded or external \"application manifest\". The file name refers to an entry in the IMPORT directory or a forwarded EXPORT.\n\nAdversaries can use this functionality as a way to execute arbitrary code on a system.",	© ESET 2014-2018
malware-ioc	rtm	ntdll.dll	© ESET 2014-2018
signature-base	apt_eqgrp.yar	$s2 = “Ntdll.dll” fullword ascii	CC BY-NC 4.0
signature-base	apt_poisonivy.yar	$s19 = “ntdll.dll” fullword ascii /* score: ‘-4675’ / / Goodware String - occured 4680 times */	CC BY-NC 4.0
signature-base	exploit_cve_2015_1674.yar	$s5 = “ntdll.dll” fullword ascii	CC BY-NC 4.0
signature-base	exploit_uac_elevators.yar	$l1 = “ntdll.dll” ascii	CC BY-NC 4.0

MIT License. Copyright (c) 2020-2021 Strontic.