ntdll.dll

• File Path: C:\Windows\SysWOW64\ntdll.dll
• Description: NT Layer DLL

Hashes

Type	Hash
MD5	F67820271FB12D577E2427963BEA13E8
SHA1	1794EDF50669CB5B1AFD63774AF8BD46D37CDD5B
SHA256	C44B5ED955D297C4CA4D8EF5892D8342905F65C4643862721353B1D1EBAC8E5D
SHA384	820DE87CA7D06BE45AEB94B605BB6EAC5F8A1AD186DA87D7FAD455E3B18F72B1C4B75EC3F5A1D8FCDBF60691C0250ECE
SHA512	D7E5ED094360CC2E58AC05F64F5FF97706E5707FEC537374508BF1053AB2C35339A1E65015F8583CBB01FB749502D15FB998D0E5A4287364BBA7EEF994E5FB19
SSDEEP	24576:P6dxO3VHUHmfrvpimkSAw+b9ygadqJZ8JE0GJC7VXF+rjejG2SBRBkbXI:NJUHQ5kSArb95ado+EdoARRBTkrI
PESHA1	314ABAA939AD41A3C25C9CB75E421F906478CDAF
PE256	49374ABB62AA21A109D8D8BC0BA2027A68463027F05D9DFF4683FA05BA8C7CE6

DLL Exports:

Function Name	Ordinal	Type
RtlSetSaclSecurityDescriptor	1451	Exported Function
RtlSetProxiedProcessId	1450	Exported Function
RtlSetSecurityDescriptorRMControl	1453	Exported Function
RtlSetSearchPathMode	1452	Exported Function
RtlSetProtectedPolicy	1449	Exported Function
RtlSetProcessIsCritical	1446	Exported Function
RtlSetProcessDebugInformation	1445	Exported Function
RtlSetProcessPreferredUILanguages	1448	Exported Function
RtlSetProcessPlaceholderCompatibilityMode	1447	Exported Function
RtlSetSecurityObject	1454	Exported Function
RtlSetThreadPoolStartFunc	1461	Exported Function
RtlSetThreadPlaceholderCompatibilityMode	1460	Exported Function
RtlSetThreadPreferredUILanguages2	1462	Exported Function
RtlSetThreadPreferredUILanguages	1463	Exported Function
RtlSetThreadIsCritical	1459	Exported Function
RtlSetSystemBootStatus	1456	Exported Function
RtlSetSecurityObjectEx	1455	Exported Function
RtlSetThreadErrorMode	1458	Exported Function
RtlSetSystemBootStatusEx	1457	Exported Function
RtlSetEnvironmentVariable	1432	Exported Function
RtlSetEnvironmentVar	1431	Exported Function
RtlSetFeatureConfigurations	1434	Exported Function
RtlSetExtendedFeaturesMask	1433	Exported Function
RtlSetEnvironmentStrings	1430	Exported Function
RtlSetCurrentTransaction	1427	Exported Function
RtlSetCurrentEnvironment	1426	Exported Function
RtlSetDynamicTimeZoneInformation	1429	Exported Function
RtlSetDaclSecurityDescriptor	1428	Exported Function
RtlSetGroupSecurityDescriptor	1435	Exported Function
RtlSetMemoryStreamSize	1442	Exported Function
RtlSetLastWin32ErrorAndNtStatusFromNtStatus	1441	Exported Function
RtlSetPortableOperatingSystem	1444	Exported Function
RtlSetOwnerSecurityDescriptor	1443	Exported Function
RtlSetLastWin32Error	1440	Exported Function
RtlSetImageMitigationPolicy	1437	Exported Function
RtlSetHeapInformation	1436	Exported Function
RtlSetIoCompletionCallback	1439	Exported Function
RtlSetInformationAcl	1438	Exported Function
RtlSubscribeForFeatureUsageNotification	1489	Exported Function
RtlSubAuthoritySid	1488	Exported Function
RtlSubtreePredecessor	1491	Exported Function
RtlSubscribeWnfStateChangeNotification	1490	Exported Function
RtlSubAuthorityCountSid	1487	Exported Function
RtlStringFromGUID	1484	Exported Function
RtlStatMemoryStream	1483	Exported Function
RtlStronglyEnumerateEntryHashTable	1486	Exported Function
RtlStringFromGUIDEx	1485	Exported Function
RtlSubtreeSuccessor	1492	Exported Function
RtlTimeToElapsedTimeFields	1499	Exported Function
RtlTimeFieldsToTime	1498	Exported Function
RtlTimeToSecondsSince1980	1501	Exported Function
RtlTimeToSecondsSince1970	1500	Exported Function
RtlTestProtectedAccess	1497	Exported Function
RtlSystemTimeToLocalTime	1494	Exported Function
RtlSwitchedVVI	1493	Exported Function
RtlTestBit	1496	Exported Function
RtlTestAndPublishWnfStateData	1495	Exported Function
RtlSetUserFlagsHeap	1470	Exported Function
RtlSetUserCallbackExceptionFilter	1469	Exported Function
RtlSidDominates	1472	Exported Function
RtlSetUserValueHeap	1471	Exported Function
RtlSetUnhandledExceptionFilter	1468	Exported Function
RtlSetThreadWorkOnBehalfTicket	1465	Exported Function
RtlSetThreadSubProcessTag	1464	Exported Function
RtlSetTimeZoneInformation	1466	Exported Function
RtlSetTimer	1467	Exported Function
RtlSidDominatesForTrust	1473	Exported Function
RtlSleepConditionVariableSRW	1480	Exported Function
RtlSleepConditionVariableCS	1479	Exported Function
RtlStartRXact	1482	Exported Function
RtlSplay	1481	Exported Function
RtlSizeHeap	1478	Exported Function
RtlSidHashInitialize	1475	Exported Function
RtlSidEqualLevel	1474	Exported Function
RtlSidIsHigherLevel	1477	Exported Function
RtlSidHashLookup	1476	Exported Function
RtlRegisterThreadWithCsrss	1375	Exported Function
RtlRegisterSecureMemoryCacheCallback	1374	Exported Function
RtlReleaseActivationContext	1377	Exported Function
RtlRegisterWait	1376	Exported Function
RtlRegisterForWnfMetaNotification	1373	Exported Function
RtlRealPredecessor	1370	Exported Function
RtlReAllocateHeap	1366	Exported Function
RtlRegisterFeatureConfigurationChangeNotification	1372	Exported Function
RtlRealSuccessor	1371	Exported Function
RtlReleaseMemoryStream	1378	Exported Function
RtlReleaseSRWLockShared	1385	Exported Function
RtlReleaseSRWLockExclusive	1384	Exported Function
RtlRemoveEntryHashTable	1387	Exported Function
RtlRemoteCall	1386	Exported Function
RtlReleaseResource	1383	Exported Function
RtlReleasePebLock	1380	Exported Function
RtlReleasePath	1379	Exported Function
RtlReleaseRelativeName	1382	Exported Function
RtlReleasePrivilege	1381	Exported Function
RtlQueryWnfStateDataWithExplicitScope	1356	Exported Function
RtlQueryWnfStateData	1355	Exported Function
RtlQueueWorkItem	1358	Exported Function
RtlQueueApcWow64Thread	1357	Exported Function
RtlQueryWnfMetaNotification	1354	Exported Function
RtlQueryTokenHostIdAsUlong64	1351	Exported Function
RtlQueryTimeZoneInformation	1350	Exported Function
RtlQueryValidationRunlevel	1353	Exported Function
RtlQueryUnbiasedInterruptTime	1352	Exported Function
RtlRaiseCustomSystemEventTrigger	1359	Exported Function
RtlReadMemoryStream	1367	Exported Function
RtlRbRemoveNode	1365	Exported Function
RtlReadThreadProfilingData	1369	Exported Function
RtlReadOutOfProcessMemoryStream	1368	Exported Function
RtlRbInsertNodeEx	1364	Exported Function
RtlRaiseStatus	1361	Exported Function
RtlRaiseException	1360	Exported Function
RtlRandomEx	1363	Exported Function
RtlRandom	1362	Exported Function
RtlSecondsSince1970ToTime	1413	Exported Function
RtlRunOnceInitialize	1412	Exported Function
RtlSeekMemoryStream	1415	Exported Function
RtlSecondsSince1980ToTime	1414	Exported Function
RtlRunOnceExecuteOnce	1411	Exported Function
RtlRunEncodeUnicodeString	1408	Exported Function
RtlRunDecodeUnicodeString	1407	Exported Function
RtlRunOnceComplete	1410	Exported Function
RtlRunOnceBeginInitialize	1409	Exported Function
RtlSelfRelativeToAbsoluteSD	1417	Exported Function
RtlSetControlSecurityDescriptor	1423	Exported Function
RtlSetBits	1422	Exported Function
RtlSetCurrentDirectory_U	1425	Exported Function
RtlSetCriticalSectionSpinCount	1424	Exported Function
RtlSetBit	1421	Exported Function
RtlSendMsgToSm	1418	Exported Function
RtlSelfRelativeToAbsoluteSD2	1416	Exported Function
RtlSetAttributesSecurityDescriptor	1420	Exported Function
RtlSetAllBits	1419	Exported Function
RtlReportExceptionEx	1394	Exported Function
RtlReportException	1393	Exported Function
RtlReportSqmEscalation	1396	Exported Function
RtlReportSilentProcessExit	1395	Exported Function
RtlReplaceSystemDirectoryInPath	1392	Exported Function
RtlRemoveVectoredContinueHandler	1389	Exported Function
RtlRemovePrivileges	1388	Exported Function
RtlReplaceSidInSd	1391	Exported Function
RtlRemoveVectoredExceptionHandler	1390	Exported Function
RtlResetMemoryBlockLookaside	1397	Exported Function
RtlRestoreThreadPreferredUILanguages	1404	Exported Function
RtlRestoreSystemBootStatusDefaults	1403	Exported Function
RtlRevertMemoryStream	1406	Exported Function
RtlRetrieveNtUserPfn	1405	Exported Function
RtlRestoreLastWin32Error	1402	Exported Function
RtlResetNtUserPfn	1399	Exported Function
RtlResetMemoryZone	1398	Exported Function
RtlRestoreBootStatusDefaults	1401	Exported Function
RtlResetRtlTranslations	1400	Exported Function
RtlxUnicodeStringToOemSize	1645	Exported Function
RtlxUnicodeStringToAnsiSize	1644	Exported Function
RtlZeroMemory	1598	Exported Function
RtlZeroHeap	1597	Exported Function
RtlxOemStringToUnicodeSize	1643	Exported Function
RtlWriteMemoryStream	1595	Exported Function
RtlWow64LogMessageInEventLogger	1594	Exported Function
RtlxAnsiStringToUnicodeSize	1642	Exported Function
RtlWriteRegistryValue	1596	Exported Function
RtlZombifyActivationContext	1599	Exported Function
sin	2379	Exported Function
ShipAssertMsgW	1651	Exported Function
sprintf_s	2381	Exported Function
sprintf	2380	Exported Function
ShipAssertMsgA	1650	Exported Function
SbSelectProcedure	1647	Exported Function
SbExecuteProcedure	1646	Exported Function
ShipAssertGetBufferInfo	1649	Exported Function
ShipAssert	1648	Exported Function
RtlWalkHeap	1581	Exported Function
RtlWalkFrameChain	1580	Exported Function
RtlWerpReportException	1583	Exported Function
RtlWeaklyEnumerateEntryHashTable	1582	Exported Function
RtlWakeConditionVariable	1579	Exported Function
RtlWakeAddressSingle	1576	Exported Function
RtlWakeAddressAllNoFence	1575	Exported Function
RtlWakeAllConditionVariable	1578	Exported Function
RtlWakeAddressSingleNoFence	1577	Exported Function
RtlWnfCompareChangeStamp	1584	Exported Function
RtlWow64GetProcessMachines	1591	Exported Function
RtlWow64GetEquivalentMachineCHPE	1590	Exported Function
RtlWow64IsWowGuestMachineSupported	1593	Exported Function
RtlWow64GetSharedInfoProcess	1592	Exported Function
RtlWow64GetCurrentMachine	1589	Exported Function
RtlWow64CallFunction64	1586	Exported Function
RtlWnfDllUnloadCallback	1585	Exported Function
RtlWow64EnableFsRedirectionEx	1588	Exported Function
RtlWow64EnableFsRedirection	1587	Exported Function
swprintf_s	2407	Exported Function
swprintf	2406	Exported Function
tan	2409	Exported Function
swscanf_s	2408	Exported Function
strtoul	2405	Exported Function
strstr	2402	Exported Function
strspn	2401	Exported Function
strtol	2404	Exported Function
strtok_s	2403	Exported Function
tolower	2410	Exported Function
TpAllocIoCompletion	1655	Exported Function
TpAllocCleanupGroup	1654	Exported Function
TpAllocPool	1657	Exported Function
TpAllocJobNotification	1656	Exported Function
TpAllocAlpcCompletionEx	1653	Exported Function
towlower	2412	Exported Function
toupper	2411	Exported Function
TpAllocAlpcCompletion	1652	Exported Function
towupper	2413	Exported Function
strcmp	2388	Exported Function
strchr	2387	Exported Function
strcpy_s	2390	Exported Function
strcpy	2389	Exported Function
strcat_s	2386	Exported Function
sscanf	2383	Exported Function
sqrt	2382	Exported Function
strcat	2385	Exported Function
sscanf_s	2384	Exported Function
strcspn	2391	Exported Function
strnlen	2398	Exported Function
strncpy_s	2397	Exported Function
strrchr	2400	Exported Function
strpbrk	2399	Exported Function
strncpy	2396	Exported Function
strncat	2393	Exported Function
strlen	2392	Exported Function
strncmp	2395	Exported Function
strncat_s	2394	Exported Function
RtlUnicodeStringToUTF8String	1527	Exported Function
RtlUnicodeStringToOemString	1526	Exported Function
RtlUnicodeToMultiByteN	1529	Exported Function
RtlUnicodeToCustomCPN	1528	Exported Function
RtlUnicodeStringToOemSize	1525	Exported Function
RtlUnicodeStringToAnsiString	1522	Exported Function
RtlUnicodeStringToAnsiSize	1521	Exported Function
RtlUnicodeStringToInteger	1524	Exported Function
RtlUnicodeStringToCountedOemString	1523	Exported Function
RtlUnicodeToMultiByteSize	1530	Exported Function
RtlUnlockMemoryBlockLookaside	1537	Exported Function
RtlUnlockHeap	1536	Exported Function
RtlUnlockMemoryZone	1539	Exported Function
RtlUnlockMemoryStreamRegion	1538	Exported Function
RtlUnlockCurrentThread	1535	Exported Function
RtlUnicodeToUTF8N	1532	Exported Function
RtlUnicodeToOemN	1531	Exported Function
RtlUnlockBootStatusData	1534	Exported Function
RtlUniform	1533	Exported Function
RtlTraceDatabaseLock	1508	Exported Function
RtlTraceDatabaseFind	1507	Exported Function
RtlTraceDatabaseValidate	1510	Exported Function
RtlTraceDatabaseUnlock	1509	Exported Function
RtlTraceDatabaseEnumerate	1506	Exported Function
RtlTraceDatabaseAdd	1503	Exported Function
RtlTimeToTimeFields	1502	Exported Function
RtlTraceDatabaseDestroy	1505	Exported Function
RtlTraceDatabaseCreate	1504	Exported Function
RtlTryAcquirePebLock	1511	Exported Function
RtlUlonglongByteSwap	13	Exported Function
RtlUlongByteSwap	12	Exported Function
RtlUnhandledExceptionFilter2	1519	Exported Function
RtlUnhandledExceptionFilter	1520	Exported Function
RtlUdiv128	1518	Exported Function
RtlTryAcquireSRWLockShared	1513	Exported Function
RtlTryAcquireSRWLockExclusive	1512	Exported Function
RtlTryEnterCriticalSection	1515	Exported Function
RtlTryConvertSRWLockSharedToExclusiveOrRelease	1514	Exported Function
RtlValidAcl	1562	Exported Function
RtlUTF8ToUnicodeN	1517	Exported Function
RtlValidateHeap	1568	Exported Function
RtlValidateCorrelationVector	1567	Exported Function
RtlUTF8StringToUnicodeString	1516	Exported Function
RtlUserFiberStart	1560	Exported Function
RtlUpperString	1559	Exported Function
RtlUshortByteSwap	14	Exported Function
RtlUserThreadStart	1561	Exported Function
RtlValidateProcessHeaps	1569	Exported Function
RtlWaitForWnfMetaNotification	1572	Exported Function
RtlVerifyVersionInfo	1571	Exported Function
RtlWakeAddressAll	1574	Exported Function
RtlWaitOnAddress	1573	Exported Function
RtlValidSid	1566	Exported Function
RtlValidProcessProtection	1563	Exported Function
RtlValidateUnicodeString	1570	Exported Function
RtlValidSecurityDescriptor	1565	Exported Function
RtlValidRelativeSecurityDescriptor	1564	Exported Function
RtlUnwind	1546	Exported Function
RtlUnsubscribeWnfStateChangeNotification	1545	Exported Function
RtlUpcaseUnicodeString	1548	Exported Function
RtlUpcaseUnicodeChar	1547	Exported Function
RtlUnsubscribeWnfNotificationWithCompletionCallback	1544	Exported Function
RtlUnregisterFeatureConfigurationChangeNotification	1541	Exported Function
RtlUnlockModuleSection	1540	Exported Function
RtlUnsubscribeWnfNotificationWaitForCompletion	1543	Exported Function
RtlUnsubscribeFromFeatureUsageNotifications	1542	Exported Function
RtlUpcaseUnicodeStringToAnsiString	1549	Exported Function
RtlUpdateClonedSRWLock	1556	Exported Function
RtlUpdateClonedCriticalSection	1555	Exported Function
RtlUpperChar	1558	Exported Function
RtlUpdateTimer	1557	Exported Function
RtlUpcaseUnicodeToOemN	1554	Exported Function
RtlUpcaseUnicodeStringToOemString	1551	Exported Function
RtlUpcaseUnicodeStringToCountedOemString	1550	Exported Function
RtlUpcaseUnicodeToMultiByteN	1553	Exported Function
RtlUpcaseUnicodeToCustomCPN	1552	Exported Function
RtlIpv4StringToAddressW	1189	Exported Function
RtlIpv4StringToAddressExW	1188	Exported Function
RtlIpv6AddressToStringExA	1191	Exported Function
RtlIpv6AddressToStringA	1190	Exported Function
RtlIpv4StringToAddressExA	1187	Exported Function
RtlIpv4AddressToStringExW	1184	Exported Function
RtlIpv4AddressToStringExA	1183	Exported Function
RtlIpv4StringToAddressA	1186	Exported Function
RtlIpv4AddressToStringW	1185	Exported Function
RtlIpv6AddressToStringExW	1192	Exported Function
RtlIsCapabilitySid	1199	Exported Function
RtlIsActivationContextActive	1198	Exported Function
RtlIsCriticalSectionLocked	1201	Exported Function
RtlIsCloudFilesPlaceholder	1200	Exported Function
RtlIpv6StringToAddressW	1197	Exported Function
RtlIpv6StringToAddressA	1194	Exported Function
RtlIpv6AddressToStringW	1193	Exported Function
RtlIpv6StringToAddressExW	1196	Exported Function
RtlIpv6StringToAddressExA	1195	Exported Function
RtlIntegerToChar	1171	Exported Function
RtlInt64ToUnicodeString	1170	Exported Function
RtlInterlockedClearBitRun	1173	Exported Function
RtlIntegerToUnicodeString	1172	Exported Function
RtlInsertEntryHashTable	1169	Exported Function
RtlInsertElementGenericTableAvl	1166	Exported Function
RtlInsertElementGenericTable	1165	Exported Function
RtlInsertElementGenericTableFullAvl	1168	Exported Function
RtlInsertElementGenericTableFull	1167	Exported Function
RtlInterlockedCompareExchange64	1174	Exported Function
RtlIoDecodeMemIoResource	1180	Exported Function
RtlInterlockedSetBitRun	1179	Exported Function
RtlIpv4AddressToStringA	1182	Exported Function
RtlIoEncodeMemIoResource	1181	Exported Function
RtlInterlockedPushListSListEx	1178	Exported Function
RtlInterlockedPopEntrySList	1176	Exported Function
RtlInterlockedFlushSList	1175	Exported Function
RtlInterlockedPushListSList	11	Exported Function
RtlInterlockedPushEntrySList	1177	Exported Function
RtlIsValidHandle	1227	Exported Function
RtlIsUntrustedObject	1226	Exported Function
RtlIsValidLocaleName	1229	Exported Function
RtlIsValidIndexHandle	1228	Exported Function
RtlIsThreadWithinLoaderCallout	1225	Exported Function
RtlIsProcessorFeaturePresent	1222	Exported Function
RtlIsPartialPlaceholderFileInfo	1221	Exported Function
RtlIsTextUnicode	1224	Exported Function
RtlIsStateSeparationEnabled	1223	Exported Function
RtlIsValidProcessTrustLabelSid	1230	Exported Function
RtlLargeIntegerShiftLeft	1238	Exported Function
RtlLargeIntegerNegate	1237	Exported Function
RtlLargeIntegerSubtract	1240	Exported Function
RtlLargeIntegerShiftRight	1239	Exported Function
RtlLargeIntegerDivide	1236	Exported Function
RtlKnownExceptionFilter	1232	Exported Function
RtlIsZeroMemory	1231	Exported Function
RtlLargeIntegerArithmeticShift	1235	Exported Function
RtlLargeIntegerAdd	1234	Exported Function
RtlIsGenericTableEmpty	1208	Exported Function
RtlIsElevatedRid	1207	Exported Function
RtlIsMultiSessionSku	1210	Exported Function
RtlIsGenericTableEmptyAvl	1209	Exported Function
RtlIsDosDeviceName_U	1206	Exported Function
RtlIsCurrentProcess	1203	Exported Function
RtlIsCriticalSectionLockedByThread	1202	Exported Function
RtlIsCurrentThreadAttachExempt	1205	Exported Function
RtlIsCurrentThread	1204	Exported Function
RtlIsMultiUsersInSessionSku	1211	Exported Function
RtlIsParentOfChildAppContainer	1218	Exported Function
RtlIsPackageSid	1217	Exported Function
RtlIsPartialPlaceholderFileHandle	1220	Exported Function
RtlIsPartialPlaceholder	1219	Exported Function
RtlIsNormalizedString	1216	Exported Function
RtlIsNameInUnUpcasedExpression	1213	Exported Function
RtlIsNameInExpression	1212	Exported Function
RtlIsNonEmptyDirectoryReparsePointAllowed	1215	Exported Function
RtlIsNameLegalDOS8Dot3	1214	Exported Function
RtlHashUnicodeString	1114	Exported Function
RtlGUIDFromString	1036	Exported Function
RtlIdentifierAuthoritySid	1116	Exported Function
RtlHeapTrkInitialize	1115	Exported Function
RtlGuardCheckLongJumpTarget	1113	Exported Function
RtlGetUserInfoHeap	1110	Exported Function
RtlGetUnloadEventTraceEx	1109	Exported Function
RtlGetVersion	1112	Exported Function
RtlGetUserPreferredUILanguages	1111	Exported Function
RtlIdnToAscii	1117	Exported Function
RtlImageRvaToVa	1124	Exported Function
RtlImageRvaToSection	1123	Exported Function
RtlImpersonateSelfEx	1126	Exported Function
RtlImpersonateSelf	1125	Exported Function
RtlImageNtHeaderEx	1122	Exported Function
RtlIdnToUnicode	1119	Exported Function
RtlIdnToNameprepUnicode	1118	Exported Function
RtlImageNtHeader	1121	Exported Function
RtlImageDirectoryEntryToData	1120	Exported Function
RtlGetSetBootStatusData	1096	Exported Function
RtlGetSessionProperties	1095	Exported Function
RtlGetSystemBootStatus	1098	Exported Function
RtlGetSuiteMask	1097	Exported Function
RtlGetSecurityDescriptorRMControl	1094	Exported Function
RtlGetReturnAddressHijackTarget	1091	Exported Function
RtlGetProductInfo	1090	Exported Function
RtlGetSearchPath	1093	Exported Function
RtlGetSaclSecurityDescriptor	1092	Exported Function
RtlGetSystemBootStatusEx	1099	Exported Function
RtlGetTokenNamedObjectPath	1106	Exported Function
RtlGetThreadWorkOnBehalfTicket	1105	Exported Function
RtlGetUnloadEventTrace	1108	Exported Function
RtlGetUILanguageInfo	1107	Exported Function
RtlGetThreadPreferredUILanguages	1104	Exported Function
RtlGetSystemTimePrecise	1101	Exported Function
RtlGetSystemPreferredUILanguages	1100	Exported Function
RtlGetThreadLangIdByIndex	1103	Exported Function
RtlGetThreadErrorMode	1102	Exported Function
RtlInitializeSListHead	1161	Exported Function
RtlInitializeSidEx	1164	Exported Function
RtlInitMemoryStream	1133	Exported Function
RtlInitializeSRWLock	1162	Exported Function
RtlInitializeSid	1163	Exported Function
RtlInitializeNtUserPfn	1158	Exported Function
RtlInitializeHandleTable	1157	Exported Function
RtlInitializeRXact	1159	Exported Function
RtlInitializeResource	1160	Exported Function
RtlInitNlsTables	1134	Exported Function
RtlInitUTF8String	1139	Exported Function
RtlInitUnicodeStringEx	1142	Exported Function
RtlInitWeakEnumerationHashTable	1143	Exported Function
RtlInitUTF8StringEx	1140	Exported Function
RtlInitUnicodeString	1141	Exported Function
RtlInitString	1136	Exported Function
RtlInitOutOfProcessMemoryStream	1135	Exported Function
RtlInitStrongEnumerationHashTable	1138	Exported Function
RtlInitStringEx	1137	Exported Function
RtlInitializeAtomPackage	1144	Exported Function
RtlInitEnumerationHashTable	1132	Exported Function
RtlInitializeConditionVariable	1146	Exported Function
RtlInitializeBitMap	1145	Exported Function
RtlInitCodePageTable	1131	Exported Function
RtlInitAnsiString	1128	Exported Function
RtlIncrementCorrelationVector	1127	Exported Function
RtlInitBarrier	1130	Exported Function
RtlInitAnsiStringEx	1129	Exported Function
RtlInitializeContext	1147	Exported Function
RtlInitializeExtendedContext2	1153	Exported Function
RtlInitializeExtendedContext	1154	Exported Function
RtlInitializeGenericTableAvl	1156	Exported Function
RtlInitializeGenericTable	1155	Exported Function
RtlInitializeExceptionChain	1152	Exported Function
RtlInitializeCriticalSection	1149	Exported Function
RtlInitializeCorrelationVector	1148	Exported Function
RtlInitializeCriticalSectionEx	1151	Exported Function
RtlInitializeCriticalSectionAndSpinCount	1150	Exported Function
RtlpRefreshCachedUILanguage	1633	Exported Function
RtlPrefixUnicodeString	1307	Exported Function
RtlProtectHeap	1309	Exported Function
RtlProcessFlsData	1308	Exported Function
RtlPrefixString	1306	Exported Function
RtlPopFrame	1305	Exported Function
RtlpNtSetValueKey	1630	Exported Function
RtlpQueryProcessDebugInformationRemote	1632	Exported Function
RtlpQueryDefaultUILanguage	1631	Exported Function
RtlpSetInstallLanguage	1634	Exported Function
RtlPushFrame	1311	Exported Function
RtlpUnWaitCriticalSection	1639	Exported Function
RtlpWaitForCriticalSection	1641	Exported Function
RtlpVerifyAndCommitUILanguageSettings	1640	Exported Function
RtlPublishWnfStateData	1310	Exported Function
RtlpSetUserPreferredUILanguages	1636	Exported Function
RtlpSetPreferredUILanguages	1635	Exported Function
RtlpTimeToTimeFields	1638	Exported Function
RtlpTimeFieldsToTime	1637	Exported Function
RtlpLoadMachineUIByPolicy	1617	Exported Function
RtlpIsQualifiedLanguage	1616	Exported Function
RtlpMergeSecurityAttributeInformation	1619	Exported Function
RtlpLoadUserUIByPolicy	1618	Exported Function
RtlpInitializeLangRegistryInfo	1615	Exported Function
RtlpGetSystemDefaultUILanguage	1613	Exported Function
RtlpGetNameFromLangInfoNode	1612	Exported Function
RtlPinAtomInAtomTable	1304	Exported Function
RtlpGetUserOrMachineUILanguage4NLS	1614	Exported Function
RtlpMuiFreeLangRegistryInfo	1620	Exported Function
RtlpNtMakeTemporaryKey	1627	Exported Function
RtlpNtEnumerateSubKey	1626	Exported Function
RtlpNtQueryValueKey	1629	Exported Function
RtlpNtOpenKey	1628	Exported Function
RtlpNtCreateKey	1625	Exported Function
RtlpMuiRegFreeRegistryInfo	1622	Exported Function
RtlpMuiRegCreateRegistryInfo	1621	Exported Function
RtlpNotOwnerCriticalSection	1624	Exported Function
RtlpMuiRegLoadRegistryInfo	1623	Exported Function
RtlQueryProcessDebugInformation	1337	Exported Function
RtlQueryProcessBackTraceInformation	1336	Exported Function
RtlQueryProcessLockInformation	1339	Exported Function
RtlQueryProcessHeapInformation	1338	Exported Function
RtlQueryPerformanceFrequency	1335	Exported Function
RtlQueryPackageIdentity	1332	Exported Function
RtlQueryPackageClaims	1331	Exported Function
RtlQueryPerformanceCounter	1334	Exported Function
RtlQueryPackageIdentityEx	1333	Exported Function
RtlQueryProcessPlaceholderCompatibilityMode	1340	Exported Function
RtlQueryTagHeap	1347	Exported Function
RtlQuerySecurityObject	1346	Exported Function
RtlQueryThreadProfiling	1349	Exported Function
RtlQueryThreadPlaceholderCompatibilityMode	1348	Exported Function
RtlQueryResourcePolicy	1345	Exported Function
RtlQueryRegistryValues	1343	Exported Function
RtlQueryProtectedPolicy	1341	Exported Function
RtlQueryRegistryValueWithFallback	1342	Exported Function
RtlQueryRegistryValuesEx	1344	Exported Function
RtlQueryElevationFlags	1318	Exported Function
RtlQueryDynamicTimeZoneInformation	1317	Exported Function
RtlQueryEnvironmentVariable_U	1320	Exported Function
RtlQueryEnvironmentVariable	1319	Exported Function
RtlQueryDepthSList	1316	Exported Function
RtlQueryAllFeatureConfigurations	1313	Exported Function
RtlQueryActivationContextApplicationSettings	1312	Exported Function
RtlQueryCriticalSectionOwner	1315	Exported Function
RtlQueryAtomInAtomTable	1314	Exported Function
RtlQueryFeatureConfiguration	1321	Exported Function
RtlQueryInformationActiveActivationContext	1328	Exported Function
RtlQueryInformationActivationContext	1327	Exported Function
RtlQueryModuleInformation	1330	Exported Function
RtlQueryInterfaceMemoryStream	1329	Exported Function
RtlQueryInformationAcl	1326	Exported Function
RtlQueryFeatureUsageNotificationSubscriptions	1323	Exported Function
RtlQueryFeatureConfigurationChangeStamp	1322	Exported Function
RtlQueryImageMitigationPolicy	1325	Exported Function
RtlQueryHeapInformation	1324	Exported Function
RtlLookupElementGenericTableFull	1265	Exported Function
RtlLookupElementGenericTableAvl	1264	Exported Function
RtlLookupEntryHashTable	1267	Exported Function
RtlLookupElementGenericTableFullAvl	1266	Exported Function
RtlLookupElementGenericTable	1263	Exported Function
RtlLockModuleSection	1260	Exported Function
RtlLockMemoryZone	1259	Exported Function
RtlLookupAtomInAtomTable	1262	Exported Function
RtlLogStackBackTrace	1261	Exported Function
RtlLookupFirstMatchingElementGenericTableAvl	1268	Exported Function
RtlMultiByteToUnicodeSize	1275	Exported Function
RtlMultiByteToUnicodeN	1274	Exported Function
RtlMultipleFreeHeap	1277	Exported Function
RtlMultipleAllocateHeap	1276	Exported Function
RtlMultiAppendUnicodeStringBuffer	1273	Exported Function
RtlMapGenericMask	1270	Exported Function
RtlMakeSelfRelativeSD	1269	Exported Function
RtlMoveMemory	1272	Exported Function
RtlMapSecurityErrorToNtStatus	1271	Exported Function
RtlLengthSid	1246	Exported Function
RtlLengthSecurityDescriptor	1245	Exported Function
RtlLoadString	1248	Exported Function
RtlLengthSidAsUnicodeString	1247	Exported Function
RtlLengthRequiredSid	1244	Exported Function
RtlLCIDToCultureName	1233	Exported Function
RtlLargeIntegerToChar	1241	Exported Function
RtlLeaveCriticalSection	1243	Exported Function
RtlLcidToLocaleName	1242	Exported Function
RtlLocaleNameToLcid	1250	Exported Function
RtlLockHeap	1256	Exported Function
RtlLockCurrentThread	1255	Exported Function
RtlLockMemoryStreamRegion	1258	Exported Function
RtlLockMemoryBlockLookaside	1257	Exported Function
RtlLockBootStatusData	1254	Exported Function
RtlLocateExtendedFeature	1252	Exported Function
RtlLocalTimeToSystemTime	1249	Exported Function
RtlLocateLegacyContext	1253	Exported Function
RtlLocateExtendedFeature2	1251	Exported Function
RtlpApplyLengthFunction	1600	Exported Function
RtlOwnerAcesPresent	1302	Exported Function
RtlpCleanupRegistryKeys	1602	Exported Function
RtlpCheckDynamicTimeZoneInformation	1601	Exported Function
RtlOsDeploymentState	1301	Exported Function
RtlOemStringToUnicodeString	1298	Exported Function
RtlOemStringToUnicodeSize	1297	Exported Function
RtlOpenCurrentUser	1300	Exported Function
RtlOemToUnicodeN	1299	Exported Function
RtlpConvertAbsoluteToRelativeSecurityAttribute	1603	Exported Function
RtlpFreezeTimeBias	1609	Exported Function
RtlpEnsureBufferSize	1608	Exported Function
RtlpGetLCIDFromLangInfoNode	1611	Exported Function
RtlpGetDeviceFamilyInfoEnum	1610	Exported Function
RtlPcToFileHeader	1303	Exported Function
RtlpConvertLCIDsToCultureNames	1605	Exported Function
RtlpConvertCultureNamesToLCIDs	1604	Exported Function
RtlpCreateProcessRegistryInfo	1607	Exported Function
RtlpConvertRelativeToAbsoluteSecurityAttribute	1606	Exported Function
RtlNormalizeSecurityDescriptor	1284	Exported Function
RtlNormalizeProcessParams	1283	Exported Function
RtlNotifyFeatureUsage	1286	Exported Function
RtlNormalizeString	1285	Exported Function
RtlNewSecurityObjectWithMultipleInheritance	1282	Exported Function
RtlNewSecurityGrantedAccess	1279	Exported Function
RtlNewInstanceSecurityObject	1278	Exported Function
RtlNewSecurityObjectEx	1281	Exported Function
RtlNewSecurityObject	1280	Exported Function
RtlNtPathNameToDosPathName	1287	Exported Function
RtlNumberOfSetBits	1294	Exported Function
RtlNumberOfClearBitsInRange	1293	Exported Function
RtlNumberOfSetBitsUlongPtr	1296	Exported Function
RtlNumberOfSetBitsInRange	1295	Exported Function
RtlNumberOfClearBits	1292	Exported Function
RtlNtStatusToDosErrorNoTeb	1289	Exported Function
RtlNtStatusToDosError	1288	Exported Function
RtlNumberGenericTableElementsAvl	1291	Exported Function
RtlNumberGenericTableElements	1290	Exported Function
ZwQueryInformationResourceManager	2036	Exported Function
ZwQueryInformationProcess	2035	Exported Function
ZwQueryInformationToken	2038	Exported Function
ZwQueryInformationThread	2037	Exported Function
ZwQueryInformationPort	2034	Exported Function
ZwQueryInformationEnlistment	2031	Exported Function
ZwQueryInformationByName	2030	Exported Function
ZwQueryInformationJobObject	2033	Exported Function
ZwQueryInformationFile	2032	Exported Function
ZwQueryInformationTransaction	2039	Exported Function
ZwQueryLicenseValue	2046	Exported Function
ZwQueryKey	2045	Exported Function
ZwQueryMutant	2048	Exported Function
ZwQueryMultipleValueKey	2047	Exported Function
ZwQueryIoCompletion	2044	Exported Function
ZwQueryInformationWorkerFactory	2041	Exported Function
ZwQueryInformationTransactionManager	2040	Exported Function
ZwQueryIntervalProfile	2043	Exported Function
ZwQueryInstallUILanguage	2042	Exported Function
ZwQueryBootEntryOrder	2017	Exported Function
ZwQueryAuxiliaryCounterFrequency	2016	Exported Function
ZwQueryDebugFilterState	2019	Exported Function
ZwQueryBootOptions	2018	Exported Function
ZwQueryAttributesFile	2015	Exported Function
ZwProtectVirtualMemory	2012	Exported Function
ZwPropagationFailed	2011	Exported Function
ZwPulseEvent	2014	Exported Function
ZwPssCaptureVaSpaceBulk	2013	Exported Function
ZwQueryDefaultLocale	2020	Exported Function
ZwQueryEvent	2027	Exported Function
ZwQueryEaFile	2026	Exported Function
ZwQueryInformationAtom	2029	Exported Function
ZwQueryFullAttributesFile	2028	Exported Function
ZwQueryDriverEntryOrder	2025	Exported Function
ZwQueryDirectoryFile	2022	Exported Function
ZwQueryDefaultUILanguage	2021	Exported Function
ZwQueryDirectoryObject	2024	Exported Function
ZwQueryDirectoryFileEx	2023	Exported Function
ZwQueueApcThreadEx	2074	Exported Function
ZwQueueApcThread	2073	Exported Function
ZwRaiseHardError	2076	Exported Function
ZwRaiseException	2075	Exported Function
ZwQueryWnfStateNameInformation	2072	Exported Function
ZwQueryVirtualMemory	2069	Exported Function
ZwQueryValueKey	2068	Exported Function
ZwQueryWnfStateData	2071	Exported Function
ZwQueryVolumeInformationFile	2070	Exported Function
ZwReadFile	2077	Exported Function
ZwRecoverTransactionManager	2084	Exported Function
ZwRecoverResourceManager	2083	Exported Function
ZwRegisterThreadTerminatePort	2086	Exported Function
ZwRegisterProtocolAddressInformation	2085	Exported Function
ZwRecoverEnlistment	2082	Exported Function
ZwReadOnlyEnlistment	2079	Exported Function
ZwReadFileScatter	2078	Exported Function
ZwReadVirtualMemory	2081	Exported Function
ZwReadRequestData	2080	Exported Function
ZwQuerySection	2055	Exported Function
ZwQueryQuotaInformationFile	2054	Exported Function
ZwQuerySecurityObject	2057	Exported Function
ZwQuerySecurityAttributesToken	2056	Exported Function
ZwQueryPortInformationProcess	2053	Exported Function
ZwQueryOpenSubKeys	2050	Exported Function
ZwQueryObject	2049	Exported Function
ZwQueryPerformanceCounter	2052	Exported Function
ZwQueryOpenSubKeysEx	2051	Exported Function
ZwQuerySecurityPolicy	2058	Exported Function
ZwQuerySystemTime	2065	Exported Function
ZwQuerySystemInformationEx	2064	Exported Function
ZwQueryTimerResolution	2067	Exported Function
ZwQueryTimer	2066	Exported Function
ZwQuerySystemInformation	2063	Exported Function
ZwQuerySymbolicLinkObject	2060	Exported Function
ZwQuerySemaphore	2059	Exported Function
ZwQuerySystemEnvironmentValueEx	2062	Exported Function
ZwQuerySystemEnvironmentValue	2061	Exported Function
ZwMapUserPhysicalPagesScatter	1960	Exported Function
ZwMapUserPhysicalPages	1959	Exported Function
ZwMapViewOfSectionEx	1962	Exported Function
ZwMapViewOfSection	1961	Exported Function
ZwMapCMFModule	1958	Exported Function
ZwMakeTemporaryObject	1955	Exported Function
ZwMakePermanentObject	1954	Exported Function
ZwManagePartition	1957	Exported Function
ZwManageHotPatch	1956	Exported Function
ZwModifyBootEntry	1963	Exported Function
ZwOpenDirectoryObject	1970	Exported Function
ZwNotifyChangeSession	1969	Exported Function
ZwOpenEvent	1972	Exported Function
ZwOpenEnlistment	1971	Exported Function
ZwNotifyChangeMultipleKeys	1968	Exported Function
ZwNotifyChangeDirectoryFile	1965	Exported Function
ZwModifyDriverEntry	1964	Exported Function
ZwNotifyChangeKey	1967	Exported Function
ZwNotifyChangeDirectoryFileEx	1966	Exported Function
ZwIsSystemResumeAutomatic	1941	Exported Function
ZwIsProcessInJob	1940	Exported Function
ZwListenPort	1943	Exported Function
ZwIsUILanguageComitted	1942	Exported Function
ZwInitiatePowerAction	1939	Exported Function
ZwInitializeEnclave	1936	Exported Function
ZwImpersonateThread	1935	Exported Function
ZwInitializeRegistry	1938	Exported Function
ZwInitializeNlsFiles	1937	Exported Function
ZwLoadDriver	1944	Exported Function
ZwLockProductActivationKeys	1951	Exported Function
ZwLockFile	1950	Exported Function
ZwLockVirtualMemory	1953	Exported Function
ZwLockRegistryKey	1952	Exported Function
ZwLoadKeyEx	1949	Exported Function
ZwLoadKey	1948	Exported Function
ZwLoadEnclaveData	1945	Exported Function
ZwLoadKey3	1947	Exported Function
ZwLoadKey2	1946	Exported Function
ZwOpenTimer	1998	Exported Function
ZwOpenThreadTokenEx	1997	Exported Function
ZwOpenTransactionManager	2000	Exported Function
ZwOpenTransaction	1999	Exported Function
ZwOpenThreadToken	1996	Exported Function
ZwOpenSession	1993	Exported Function
ZwOpenSemaphore	1992	Exported Function
ZwOpenThread	1995	Exported Function
ZwOpenSymbolicLinkObject	1994	Exported Function
ZwPlugPlayControl	2001	Exported Function
ZwPrivilegedServiceAuditAlarm	2009	Exported Function
ZwPrivilegeCheck	2007	Exported Function
ZwPropagationComplete	2010	Exported Function
ZwPrivilegeObjectAuditAlarm	2008	Exported Function
ZwPrePrepareEnlistment	2004	Exported Function
ZwPrepareComplete	2005	Exported Function
ZwPowerInformation	2002	Exported Function
ZwPrePrepareComplete	2003	Exported Function
ZwPrepareEnlistment	2006	Exported Function
ZwOpenKeyEx	1978	Exported Function
ZwOpenKeyedEvent	1981	Exported Function
ZwOpenKeyTransactedEx	1980	Exported Function
ZwOpenKeyTransacted	1979	Exported Function
ZwOpenKey	1977	Exported Function
ZwOpenFile	1974	Exported Function
ZwOpenEventPair	1973	Exported Function
ZwOpenJobObject	1976	Exported Function
ZwOpenIoCompletion	1975	Exported Function
ZwOpenMutant	1982	Exported Function
ZwOpenRegistryTransaction	1989	Exported Function
ZwOpenProcessTokenEx	1988	Exported Function
ZwOpenSection	1991	Exported Function
ZwOpenResourceManager	1990	Exported Function
ZwOpenProcessToken	1987	Exported Function
ZwOpenPartition	1984	Exported Function
ZwOpenObjectAuditAlarm	1983	Exported Function
ZwOpenProcess	1986	Exported Function
ZwOpenPrivateNamespace	1985	Exported Function
ZwThawRegistry	2188	Exported Function
ZwTestAlert	2187	Exported Function
ZwTraceControl	2190	Exported Function
ZwThawTransactions	2189	Exported Function
ZwTerminateThread	2186	Exported Function
ZwTerminateEnclave	2183	Exported Function
ZwSystemDebugControl	2182	Exported Function
ZwTerminateProcess	2185	Exported Function
ZwTerminateJobObject	2184	Exported Function
ZwTraceEvent	2191	Exported Function
ZwUnlockFile	2198	Exported Function
ZwUnloadKeyEx	2197	Exported Function
ZwUnmapViewOfSection	2200	Exported Function
ZwUnlockVirtualMemory	2199	Exported Function
ZwUnloadKey2	2195	Exported Function
ZwUmsThreadYield	2193	Exported Function
ZwTranslateFilePath	2192	Exported Function
ZwUnloadKey	2196	Exported Function
ZwUnloadDriver	2194	Exported Function
ZwSetUuidSeed	2169	Exported Function
ZwSetTimerResolution	2168	Exported Function
ZwSetVolumeInformationFile	2171	Exported Function
ZwSetValueKey	2170	Exported Function
ZwSetTimerEx	2167	Exported Function
ZwSetThreadExecutionState	2164	Exported Function
ZwSetSystemTime	2163	Exported Function
ZwSetTimer2	2165	Exported Function
ZwSetTimer	2166	Exported Function
ZwSetWnfProcessNotificationEvent	2172	Exported Function
ZwSubscribeWnfStateChange	2179	Exported Function
ZwStopProfile	2178	Exported Function
ZwSuspendThread	2181	Exported Function
ZwSuspendProcess	2180	Exported Function
ZwStartProfile	2177	Exported Function
ZwShutdownWorkerFactory	2174	Exported Function
ZwShutdownSystem	2173	Exported Function
ZwSinglePhaseReject	2176	Exported Function
ZwSignalAndWaitForSingleObject	2175	Exported Function
ZwWow64CsrVerifyRegion	2226	Exported Function
ZwWow64CsrIdentifyAlertableThread	2225	Exported Function
ZwWow64GetCurrentProcessorNumberEx	2228	Exported Function
ZwWow64DebuggerCall	2227	Exported Function
ZwWow64CsrGetProcessId	2224	Exported Function
ZwWow64CsrClientCallServer	2221	Exported Function
ZwWow64CsrCaptureMessageString	2220	Exported Function
ZwWow64CsrFreeCaptureBuffer	2223	Exported Function
ZwWow64CsrClientConnectToServer	2222	Exported Function
ZwWow64GetNativeSystemInformation	2229	Exported Function
ZwWriteRequestData	2236	Exported Function
ZwWriteFileGather	2235	Exported Function
ZwYieldExecution	2238	Exported Function
ZwWriteVirtualMemory	2237	Exported Function
ZwWriteFile	2234	Exported Function
ZwWow64QueryInformationProcess64	2231	Exported Function
ZwWow64IsProcessorFeaturePresent	2230	Exported Function
ZwWow64WriteVirtualMemory64	2233	Exported Function
ZwWow64ReadVirtualMemory64	2232	Exported Function
ZwWaitForKeyedEvent	2207	Exported Function
ZwWaitForDebugEvent	2206	Exported Function
ZwWaitForMultipleObjects32	2208	Exported Function
ZwWaitForMultipleObjects	2209	Exported Function
ZwWaitForAlertByThreadId	2205	Exported Function
ZwUnsubscribeWnfStateChange	2202	Exported Function
ZwUnmapViewOfSectionEx	2201	Exported Function
ZwVdmControl	2204	Exported Function
ZwUpdateWnfStateData	2203	Exported Function
ZwWaitForSingleObject	2210	Exported Function
ZwWow64CsrAllocateCaptureBuffer	2217	Exported Function
ZwWow64CallFunction64	2216	Exported Function
ZwWow64CsrCaptureMessageBuffer	2219	Exported Function
ZwWow64CsrAllocateMessagePointer	2218	Exported Function
ZwWow64AllocateVirtualMemory64	2215	Exported Function
ZwWaitHighEventPair	2212	Exported Function
ZwWaitForWorkViaWorkerFactory	2211	Exported Function
ZwWorkerFactoryWorkerReady	2214	Exported Function
ZwWaitLowEventPair	2213	Exported Function
ZwRollbackRegistryTransaction	2112	Exported Function
ZwRollbackEnlistment	2111	Exported Function
ZwRollforwardTransactionManager	2114	Exported Function
ZwRollbackTransaction	2113	Exported Function
ZwRollbackComplete	2110	Exported Function
ZwResumeProcess	2107	Exported Function
ZwRestoreKey	2106	Exported Function
ZwRevertContainerImpersonation	2109	Exported Function
ZwResumeThread	2108	Exported Function
ZwSaveKey	2115	Exported Function
ZwSetCachedSigningLevel	2123	Exported Function
ZwSetBootOptions	2121	Exported Function
ZwSetContextThread	2124	Exported Function
ZwSetCachedSigningLevel2	2122	Exported Function
ZwSetBootEntryOrder	2120	Exported Function
ZwSaveMergedKeys	2117	Exported Function
ZwSaveKeyEx	2116	Exported Function
ZwSerializeBoot	2119	Exported Function
ZwSecureConnectPort	2118	Exported Function
ZwRemoveProcessDebug	2093	Exported Function
ZwRemoveIoCompletionEx	2092	Exported Function
ZwRenameTransactionManager	2095	Exported Function
ZwRenameKey	2094	Exported Function
ZwRemoveIoCompletion	2091	Exported Function
ZwReleaseMutant	2088	Exported Function
ZwReleaseKeyedEvent	2087	Exported Function
ZwReleaseWorkerFactoryWorker	2090	Exported Function
ZwReleaseSemaphore	2089	Exported Function
ZwReplaceKey	2096	Exported Function
ZwRequestWaitReplyPort	2103	Exported Function
ZwRequestPort	2102	Exported Function
ZwResetWriteWatch	2105	Exported Function
ZwResetEvent	2104	Exported Function
ZwReplyWaitReplyPort	2101	Exported Function
ZwReplyPort	2098	Exported Function
ZwReplacePartitionUnit	2097	Exported Function
ZwReplyWaitReceivePortEx	2100	Exported Function
ZwReplyWaitReceivePort	2099	Exported Function
ZwSetIntervalProfile	2151	Exported Function
ZwSetInformationWorkerFactory	2150	Exported Function
ZwSetIoCompletionEx	2153	Exported Function
ZwSetIoCompletion	2152	Exported Function
ZwSetInformationVirtualMemory	2149	Exported Function
ZwSetInformationToken	2146	Exported Function
ZwSetInformationThread	2145	Exported Function
ZwSetInformationTransactionManager	2148	Exported Function
ZwSetInformationTransaction	2147	Exported Function
ZwSetIRTimer	2135	Exported Function
ZwSetSystemEnvironmentValueEx	2160	Exported Function
ZwSetSystemEnvironmentValue	2159	Exported Function
ZwSetSystemPowerState	2162	Exported Function
ZwSetSystemInformation	2161	Exported Function
ZwSetSecurityObject	2158	Exported Function
ZwSetLowEventPair	2155	Exported Function
ZwSetLdtEntries	2154	Exported Function
ZwSetQuotaInformationFile	2157	Exported Function
ZwSetLowWaitHighEventPair	2156	Exported Function
ZwSetEvent	2131	Exported Function
ZwSetEaFile	2130	Exported Function
ZwSetHighEventPair	2133	Exported Function
ZwSetEventBoostPriority	2132	Exported Function
ZwSetDriverEntryOrder	2129	Exported Function
ZwSetDefaultHardErrorPort	2126	Exported Function
ZwSetDebugFilterState	2125	Exported Function
ZwSetDefaultUILanguage	2128	Exported Function
ZwSetDefaultLocale	2127	Exported Function
ZwSetHighWaitLowEventPair	2134	Exported Function
ZwSetInformationProcess	2142	Exported Function
ZwSetInformationObject	2141	Exported Function
ZwSetInformationSymbolicLink	2144	Exported Function
ZwSetInformationResourceManager	2143	Exported Function
ZwSetInformationKey	2140	Exported Function
ZwSetInformationEnlistment	2137	Exported Function
ZwSetInformationDebugObject	2136	Exported Function
ZwSetInformationJobObject	2139	Exported Function
ZwSetInformationFile	2138	Exported Function
WinSqmEventWrite	1732	Exported Function
WinSqmEventEnabled	1731	Exported Function
WinSqmGetInstrumentationProperty	1734	Exported Function
WinSqmGetEscalationRuleStatus	1733	Exported Function
WinSqmEndSession	1730	Exported Function
WinSqmCommonDatapointSetDWORD64	1726	Exported Function
WinSqmCommonDatapointSetDWORD	1727	Exported Function
WinSqmCommonDatapointSetString	1729	Exported Function
WinSqmCommonDatapointSetStreamEx	1728	Exported Function
WinSqmIncrementDWORD	1735	Exported Function
WinSqmSetIfMaxDWORD	1742	Exported Function
WinSqmSetEscalationInfo	1741	Exported Function
WinSqmSetString	1744	Exported Function
WinSqmSetIfMinDWORD	1743	Exported Function
WinSqmSetDWORD64	1739	Exported Function
WinSqmIsOptedInEx	1737	Exported Function
WinSqmIsOptedIn	1736	Exported Function
WinSqmSetDWORD	1740	Exported Function
WinSqmIsSessionDisabled	1738	Exported Function
wcstol	2438	Exported Function
wcstok_s	2437	Exported Function
wcstoul	2440	Exported Function
wcstombs	2439	Exported Function
wcsstr	2436	Exported Function
wcspbrk	2433	Exported Function
wcsnlen	2432	Exported Function
wcsspn	2435	Exported Function
wcsrchr	2434	Exported Function
WerReportExceptionWorker	1716	Exported Function
WinSqmCheckEscalationSetDWORD64	1722	Exported Function
WinSqmCheckEscalationSetDWORD	1723	Exported Function
WinSqmCommonDatapointDelete	1725	Exported Function
WinSqmCheckEscalationSetString	1724	Exported Function
WinSqmCheckEscalationAddToStreamEx	1721	Exported Function
WinSqmAddToAverageDWORD	1718	Exported Function
WerReportSQMEvent	1717	Exported Function
WinSqmAddToStreamEx	1720	Exported Function
WinSqmAddToStream	1719	Exported Function
ZwAllocateReserveObject	1770	Exported Function
ZwAllocateLocallyUniqueId	1769	Exported Function
ZwAllocateUserPhysicalPagesEx	1772	Exported Function
ZwAllocateUserPhysicalPages	1771	Exported Function
ZwAlertThreadByThreadId	1768	Exported Function
ZwAdjustTokenClaimsAndDeviceGroups	1765	Exported Function
ZwAdjustPrivilegesToken	1764	Exported Function
ZwAlertThread	1767	Exported Function
ZwAlertResumeThread	1766	Exported Function
ZwAllocateUuids	1773	Exported Function
ZwAlpcCreatePort	1780	Exported Function
ZwAlpcConnectPortEx	1779	Exported Function
ZwAlpcCreateResourceReserve	1782	Exported Function
ZwAlpcCreatePortSection	1781	Exported Function
ZwAlpcConnectPort	1778	Exported Function
ZwAllocateVirtualMemoryEx	1775	Exported Function
ZwAllocateVirtualMemory	1774	Exported Function
ZwAlpcCancelMessage	1777	Exported Function
ZwAlpcAcceptConnectPort	1776	Exported Function
ZwAccessCheckAndAuditAlarm	1751	Exported Function
ZwAccessCheck	1750	Exported Function
ZwAccessCheckByTypeAndAuditAlarm	1753	Exported Function
ZwAccessCheckByType	1752	Exported Function
ZwAcceptConnectPort	1749	Exported Function
WinSqmStartSessionForPartner	1746	Exported Function
WinSqmStartSession	1745	Exported Function
Wow64Transition	1748	Exported Function
WinSqmStartSqmOptinListener	1747	Exported Function
ZwAccessCheckByTypeResultList	1754	Exported Function
ZwAddBootEntry	1761	Exported Function
ZwAddAtomEx	1760	Exported Function
ZwAdjustGroupsToken	1763	Exported Function
ZwAddDriverEntry	1762	Exported Function
ZwAddAtom	1759	Exported Function
ZwAccessCheckByTypeResultListAndAuditAlarmByHandle	1756	Exported Function
ZwAccessCheckByTypeResultListAndAuditAlarm	1755	Exported Function
ZwAcquireProcessActivityReference	1758	Exported Function
ZwAcquireCrossVmMutant	1757	Exported Function
TpReleaseAlpcCompletion	1683	Exported Function
TpQueryPoolStackInformation	1682	Exported Function
TpReleaseCleanupGroupMembers	1685	Exported Function
TpReleaseCleanupGroup	1684	Exported Function
TpPostWork	1681	Exported Function
TpDisablePoolCallbackChecks	1678	Exported Function
TpDbgSetLogRoutine	1677	Exported Function
TpIsTimerSet	1680	Exported Function
TpDisassociateCallback	1679	Exported Function
TpReleaseIoCompletion	1686	Exported Function
TpSetDefaultPoolStackInformation	1693	Exported Function
TpSetDefaultPoolMaxThreads	1692	Exported Function
TpSetPoolMaxThreadsSoftLimit	1695	Exported Function
TpSetPoolMaxThreads	1694	Exported Function
TpReleaseWork	1691	Exported Function
TpReleasePool	1688	Exported Function
TpReleaseJobNotification	1687	Exported Function
TpReleaseWait	1690	Exported Function
TpReleaseTimer	1689	Exported Function
TpCallbackIndependent	1664	Exported Function
TpCallbackDetectedUnrecoverableError	1663	Exported Function
TpCallbackMayRunLong	1666	Exported Function
TpCallbackLeaveCriticalSectionOnCompletion	1665	Exported Function
TpAlpcUnregisterCompletionList	1662	Exported Function
TpAllocWait	1659	Exported Function
TpAllocTimer	1658	Exported Function
TpAlpcRegisterCompletionList	1661	Exported Function
TpAllocWork	1660	Exported Function
TpCallbackReleaseMutexOnCompletion	1667	Exported Function
TpCaptureCaller	1674	Exported Function
TpCancelAsyncIoOperation	1673	Exported Function
TpDbgDumpHeapUsage	1676	Exported Function
TpCheckTerminateWorker	1675	Exported Function
TpCallbackUnloadDllOnCompletion	1672	Exported Function
TpCallbackSendAlpcMessageOnCompletion	1669	Exported Function
TpCallbackReleaseSemaphoreOnCompletion	1668	Exported Function
TpCallbackSetEventOnCompletion	1671	Exported Function
TpCallbackSendPendingAlpcMessage	1670	Exported Function
wcscat	2419	Exported Function
vswprintf_s	2418	Exported Function
wcschr	2421	Exported Function
wcscat_s	2420	Exported Function
vsprintf_s	2417	Exported Function
vDbgPrintExWithPrefix	2415	Exported Function
vDbgPrintEx	2414	Exported Function
vsprintf	2416	Exported Function
VerSetConditionMask	1715	Exported Function
wcscmp	2422	Exported Function
wcsncmp	2429	Exported Function
wcsncat_s	2428	Exported Function
wcsncpy_s	2431	Exported Function
wcsncpy	2430	Exported Function
wcsncat	2427	Exported Function
wcscpy_s	2424	Exported Function
wcscpy	2423	Exported Function
wcslen	2426	Exported Function
wcscspn	2425	Exported Function
TpSetTimerEx	1702	Exported Function
TpSetTimer	1701	Exported Function
TpSetWaitEx	1704	Exported Function
TpSetWait	1703	Exported Function
TpSetPoolWorkerThreadIdleTimeout	1700	Exported Function
TpSetPoolStackInformation	1697	Exported Function
TpSetPoolMinThreads	1696	Exported Function
TpSetPoolThreadCpuSets	1699	Exported Function
TpSetPoolThreadBasePriority	1698	Exported Function
TpSimpleTryPost	1705	Exported Function
TpWaitForTimer	1712	Exported Function
TpWaitForJobNotification	1711	Exported Function
TpWaitForWork	1714	Exported Function
TpWaitForWait	1713	Exported Function
TpWaitForIoCompletion	1710	Exported Function
TpTimerOutstandingCallbackCount	1707	Exported Function
TpStartAsyncIoOperation	1706	Exported Function
TpWaitForAlpcCompletion	1709	Exported Function
TpTrimPools	1708	Exported Function
ZwDeleteObjectAuditAlarm	1884	Exported Function
ZwDeleteKey	1883	Exported Function
ZwDeleteValueKey	1886	Exported Function
ZwDeletePrivateNamespace	1885	Exported Function
ZwDeleteFile	1882	Exported Function
ZwDeleteAtom	1879	Exported Function
ZwDelayExecution	1878	Exported Function
ZwDeleteDriverEntry	1881	Exported Function
ZwDeleteBootEntry	1880	Exported Function
ZwDeleteWnfStateData	1887	Exported Function
ZwDuplicateObject	1894	Exported Function
ZwDrawText	1893	Exported Function
ZwEnableLastKnownGood	1896	Exported Function
ZwDuplicateToken	1895	Exported Function
ZwDisplayString	1892	Exported Function
ZwDeviceIoControlFile	1889	Exported Function
ZwDeleteWnfStateName	1888	Exported Function
ZwDisableLastKnownGood	1891	Exported Function
ZwDirectGraphicsCall	1890	Exported Function
ZwCreateTimer	1866	Exported Function
ZwCreateThreadEx	1864	Exported Function
ZwCreateToken	1867	Exported Function
ZwCreateTimer2	1865	Exported Function
ZwCreateThread	1863	Exported Function
ZwCreateSectionEx	1860	Exported Function
ZwCreateSection	1859	Exported Function
ZwCreateSymbolicLinkObject	1862	Exported Function
ZwCreateSemaphore	1861	Exported Function
ZwCreateTokenEx	1868	Exported Function
ZwCreateWorkerFactory	1875	Exported Function
ZwCreateWnfStateName	1874	Exported Function
ZwDebugContinue	1877	Exported Function
ZwDebugActiveProcess	1876	Exported Function
ZwCreateWaitCompletionPacket	1872	Exported Function
ZwCreateTransactionManager	1870	Exported Function
ZwCreateTransaction	1869	Exported Function
ZwCreateWaitablePort	1873	Exported Function
ZwCreateUserProcess	1871	Exported Function
ZwGetCompleteWnfStateSubscription	1922	Exported Function
ZwGetCachedSigningLevel	1921	Exported Function
ZwGetCurrentProcessorNumber	1924	Exported Function
ZwGetContextThread	1923	Exported Function
ZwFsControlFile	1920	Exported Function
ZwFreeVirtualMemory	1917	Exported Function
ZwFreeUserPhysicalPages	1916	Exported Function
ZwFreezeTransactions	1919	Exported Function
ZwFreezeRegistry	1918	Exported Function
ZwGetCurrentProcessorNumberEx	1925	Exported Function
ZwGetWriteWatch	1932	Exported Function
ZwGetNotificationResourceManager	1931	Exported Function
ZwImpersonateClientOfPort	1934	Exported Function
ZwImpersonateAnonymousToken	1933	Exported Function
ZwGetNlsSectionPtr	1930	Exported Function
ZwGetMUIRegistryInfo	1927	Exported Function
ZwGetDevicePowerState	1926	Exported Function
ZwGetNextThread	1929	Exported Function
ZwGetNextProcess	1928	Exported Function
ZwExtendSection	1903	Exported Function
ZwEnumerateValueKey	1902	Exported Function
ZwFilterToken	1905	Exported Function
ZwFilterBootOption	1904	Exported Function
ZwEnumerateTransactionObject	1901	Exported Function
ZwEnumerateDriverEntries	1898	Exported Function
ZwEnumerateBootEntries	1897	Exported Function
ZwEnumerateSystemEnvironmentValuesEx	1900	Exported Function
ZwEnumerateKey	1899	Exported Function
ZwFilterTokenEx	1906	Exported Function
ZwFlushProcessWriteBuffers	1913	Exported Function
ZwFlushKey	1912	Exported Function
ZwFlushWriteBuffer	1915	Exported Function
ZwFlushVirtualMemory	1914	Exported Function
ZwFlushInstructionCache	1911	Exported Function
ZwFlushBuffersFile	1908	Exported Function
ZwFindAtom	1907	Exported Function
ZwFlushInstallUILanguage	1910	Exported Function
ZwFlushBuffersFileEx	1909	Exported Function
ZwCancelTimer	1809	Exported Function
ZwCancelSynchronousIoFile	1807	Exported Function
ZwCancelWaitCompletionPacket	1810	Exported Function
ZwCancelTimer2	1808	Exported Function
ZwCancelIoFileEx	1806	Exported Function
ZwCallbackReturn	1804	Exported Function
ZwAssociateWaitCompletionPacket	1802	Exported Function
ZwCancelIoFile	1805	Exported Function
ZwCallEnclave	1803	Exported Function
ZwClearEvent	1811	Exported Function
ZwCompactKeys	1818	Exported Function
ZwCommitTransaction	1817	Exported Function
ZwCompareSigningLevels	1820	Exported Function
ZwCompareObjects	1819	Exported Function
ZwCommitRegistryTransaction	1816	Exported Function
ZwCloseObjectAuditAlarm	1813	Exported Function
ZwClose	1812	Exported Function
ZwCommitEnlistment	1815	Exported Function
ZwCommitComplete	1814	Exported Function
ZwAlpcDisconnectPort	1789	Exported Function
ZwAlpcDeleteSecurityContext	1788	Exported Function
ZwAlpcImpersonateClientOfPort	1791	Exported Function
ZwAlpcImpersonateClientContainerOfPort	1790	Exported Function
ZwAlpcDeleteSectionView	1787	Exported Function
ZwAlpcCreateSecurityContext	1784	Exported Function
ZwAlpcCreateSectionView	1783	Exported Function
ZwAlpcDeleteResourceReserve	1786	Exported Function
ZwAlpcDeletePortSection	1785	Exported Function
ZwAlpcOpenSenderProcess	1792	Exported Function
ZwApphelpCacheControl	1799	Exported Function
ZwAlpcSetInformation	1798	Exported Function
ZwAssignProcessToJobObject	1801	Exported Function
ZwAreMappedFilesTheSame	1800	Exported Function
ZwAlpcSendWaitReceivePort	1797	Exported Function
ZwAlpcQueryInformation	1794	Exported Function
ZwAlpcOpenSenderThread	1793	Exported Function
ZwAlpcRevokeSecurityContext	1796	Exported Function
ZwAlpcQueryInformationMessage	1795	Exported Function
ZwCreateMailslotFile	1846	Exported Function
ZwCreateLowBoxToken	1845	Exported Function
ZwCreateNamedPipeFile	1848	Exported Function
ZwCreateMutant	1847	Exported Function
ZwCreateKeyTransacted	1843	Exported Function
ZwCreateJobSet	1841	Exported Function
ZwCreateJobObject	1840	Exported Function
ZwCreateKeyedEvent	1844	Exported Function
ZwCreateKey	1842	Exported Function
ZwCreatePagingFile	1849	Exported Function
ZwCreateProfileEx	1856	Exported Function
ZwCreateProfile	1855	Exported Function
ZwCreateResourceManager	1858	Exported Function
ZwCreateRegistryTransaction	1857	Exported Function
ZwCreateProcessEx	1854	Exported Function
ZwCreatePort	1851	Exported Function
ZwCreatePartition	1850	Exported Function
ZwCreateProcess	1853	Exported Function
ZwCreatePrivateNamespace	1852	Exported Function
ZwConvertBetweenAuxiliaryCounterAndPerformanceCounter	1827	Exported Function
ZwContinueEx	1826	Exported Function
ZwCreateCrossVmMutant	1829	Exported Function
ZwCreateCrossVmEvent	1828	Exported Function
ZwContinue	1825	Exported Function
ZwCompleteConnectPort	1822	Exported Function
ZwCompareTokens	1821	Exported Function
ZwConnectPort	1824	Exported Function
ZwCompressKey	1823	Exported Function
ZwCreateDebugObject	1830	Exported Function
ZwCreateFile	1837	Exported Function
ZwCreateEventPair	1836	Exported Function
ZwCreateIRTimer	1838	Exported Function
ZwCreateIoCompletion	1839	Exported Function
ZwCreateEvent	1835	Exported Function
ZwCreateDirectoryObjectEx	1832	Exported Function
ZwCreateDirectoryObject	1831	Exported Function
ZwCreateEnlistment	1834	Exported Function
ZwCreateEnclave	1833	Exported Function
RtlGetProcessPreferredUILanguages	1089	Exported Function
NtContinue	283	Exported Function
NtConnectPort	282	Exported Function
NtConvertBetweenAuxiliaryCounterAndPerformanceCounter	285	Exported Function
NtContinueEx	284	Exported Function
NtCompressKey	281	Exported Function
NtCompareSigningLevels	278	Exported Function
NtCompareObjects	277	Exported Function
NtCompleteConnectPort	280	Exported Function
NtCompareTokens	279	Exported Function
NtCreateCrossVmEvent	286	Exported Function
NtCreateEvent	293	Exported Function
NtCreateEnlistment	292	Exported Function
NtCreateFile	295	Exported Function
NtCreateEventPair	294	Exported Function
NtCreateEnclave	291	Exported Function
NtCreateDebugObject	288	Exported Function
NtCreateCrossVmMutant	287	Exported Function
NtCreateDirectoryObjectEx	290	Exported Function
NtCreateDirectoryObject	289	Exported Function
NtCancelIoFileEx	264	Exported Function
NtCancelIoFile	263	Exported Function
NtCancelTimer	267	Exported Function
NtCancelSynchronousIoFile	265	Exported Function
NtCallEnclave	261	Exported Function
NtAssignProcessToJobObject	259	Exported Function
NtAreMappedFilesTheSame	258	Exported Function
NtCallbackReturn	262	Exported Function
NtAssociateWaitCompletionPacket	260	Exported Function
NtCancelTimer2	266	Exported Function
NtCommitRegistryTransaction	274	Exported Function
NtCommitEnlistment	273	Exported Function
NtCompactKeys	276	Exported Function
NtCommitTransaction	275	Exported Function
NtCommitComplete	272	Exported Function
NtClearEvent	269	Exported Function
NtCancelWaitCompletionPacket	268	Exported Function
NtCloseObjectAuditAlarm	271	Exported Function
NtClose	270	Exported Function
NtCreateThread	321	Exported Function
NtCreateSymbolicLinkObject	320	Exported Function
NtCreateTimer	324	Exported Function
NtCreateThreadEx	322	Exported Function
NtCreateSemaphore	319	Exported Function
NtCreateResourceManager	316	Exported Function
NtCreateRegistryTransaction	315	Exported Function
NtCreateSectionEx	318	Exported Function
NtCreateSection	317	Exported Function
NtCreateTimer2	323	Exported Function
NtCreateWaitCompletionPacket	330	Exported Function
NtCreateWaitablePort	331	Exported Function
NtCreateWorkerFactory	333	Exported Function
NtCreateWnfStateName	332	Exported Function
NtCreateUserProcess	329	Exported Function
NtCreateTokenEx	326	Exported Function
NtCreateToken	325	Exported Function
NtCreateTransactionManager	328	Exported Function
NtCreateTransaction	327	Exported Function
NtCreateKeyTransacted	301	Exported Function
NtCreateKeyedEvent	302	Exported Function
NtCreateMailslotFile	304	Exported Function
NtCreateLowBoxToken	303	Exported Function
NtCreateKey	300	Exported Function
NtCreateIRTimer	296	Exported Function
NtCreateIoCompletion	297	Exported Function
NtCreateJobSet	299	Exported Function
NtCreateJobObject	298	Exported Function
NtCreateMutant	305	Exported Function
NtCreateProcessEx	312	Exported Function
NtCreateProcess	311	Exported Function
NtCreateProfileEx	314	Exported Function
NtCreateProfile	313	Exported Function
NtCreatePrivateNamespace	310	Exported Function
NtCreatePagingFile	307	Exported Function
NtCreateNamedPipeFile	306	Exported Function
NtCreatePort	309	Exported Function
NtCreatePartition	308	Exported Function
NtAcceptConnectPort	207	Exported Function
NlsMbOemCodePageTag	206	Exported Function
NtAccessCheckAndAuditAlarm	209	Exported Function
NtAccessCheck	208	Exported Function
NlsMbCodePageTag	205	Exported Function
memmove_s	2374	Exported Function
memmove	2373	Exported Function
NlsAnsiCodePage	204	Exported Function
memset	2375	Exported Function
NtAccessCheckByType	210	Exported Function
NtAddAtom	217	Exported Function
NtAcquireProcessActivityReference	216	Exported Function
NtAddBootEntry	219	Exported Function
NtAddAtomEx	218	Exported Function
NtAcquireCrossVmMutant	215	Exported Function
NtAccessCheckByTypeResultList	212	Exported Function
NtAccessCheckByTypeAndAuditAlarm	211	Exported Function
NtAccessCheckByTypeResultListAndAuditAlarmByHandle	214	Exported Function
NtAccessCheckByTypeResultListAndAuditAlarm	213	Exported Function
LdrVerifyImageMatchesChecksumEx	194	Exported Function
LdrVerifyImageMatchesChecksum	193	Exported Function
mbstowcs	2368	Exported Function
log	2367	Exported Function
LdrUpdatePackageSearchPath	192	Exported Function
LdrUnloadDll	189	Exported Function
LdrUnloadAlternateResourceModuleEx	188	Exported Function
LdrUnregisterDllNotification	191	Exported Function
LdrUnlockLoaderLock	190	Exported Function
MD4Final	198	Exported Function
memcmp	2370	Exported Function
memchr	2369	Exported Function
memcpy_s	2372	Exported Function
memcpy	2371	Exported Function
MD5Update	203	Exported Function
MD4Update	200	Exported Function
MD4Init	199	Exported Function
MD5Init	202	Exported Function
MD5Final	201	Exported Function
NtAlpcDeleteSectionView	245	Exported Function
NtAlpcDeleteResourceReserve	244	Exported Function
NtAlpcDisconnectPort	247	Exported Function
NtAlpcDeleteSecurityContext	246	Exported Function
NtAlpcDeletePortSection	243	Exported Function
NtAlpcCreateResourceReserve	240	Exported Function
NtAlpcCreatePortSection	239	Exported Function
NtAlpcCreateSecurityContext	242	Exported Function
NtAlpcCreateSectionView	241	Exported Function
NtAlpcImpersonateClientContainerOfPort	248	Exported Function
NtAlpcSendWaitReceivePort	255	Exported Function
NtAlpcRevokeSecurityContext	254	Exported Function
NtApphelpCacheControl	257	Exported Function
NtAlpcSetInformation	256	Exported Function
NtAlpcQueryInformationMessage	253	Exported Function
NtAlpcOpenSenderProcess	250	Exported Function
NtAlpcImpersonateClientOfPort	249	Exported Function
NtAlpcQueryInformation	252	Exported Function
NtAlpcOpenSenderThread	251	Exported Function
NtAlertThreadByThreadId	226	Exported Function
NtAlertThread	225	Exported Function
NtAllocateReserveObject	228	Exported Function
NtAllocateLocallyUniqueId	227	Exported Function
NtAlertResumeThread	224	Exported Function
NtAdjustGroupsToken	221	Exported Function
NtAddDriverEntry	220	Exported Function
NtAdjustTokenClaimsAndDeviceGroups	223	Exported Function
NtAdjustPrivilegesToken	222	Exported Function
NtAllocateUserPhysicalPages	229	Exported Function
NtAlpcConnectPort	236	Exported Function
NtAlpcCancelMessage	235	Exported Function
NtAlpcCreatePort	238	Exported Function
NtAlpcConnectPortEx	237	Exported Function
NtAlpcAcceptConnectPort	234	Exported Function
NtAllocateUuids	231	Exported Function
NtAllocateUserPhysicalPagesEx	230	Exported Function
NtAllocateVirtualMemoryEx	233	Exported Function
NtAllocateVirtualMemory	232	Exported Function
NtOpenEnlistment	431	Exported Function
NtOpenDirectoryObject	430	Exported Function
NtOpenEventPair	433	Exported Function
NtOpenEvent	432	Exported Function
NtNotifyChangeSession	429	Exported Function
NtNotifyChangeDirectoryFileEx	426	Exported Function
NtNotifyChangeDirectoryFile	425	Exported Function
NtNotifyChangeMultipleKeys	428	Exported Function
NtNotifyChangeKey	427	Exported Function
NtOpenFile	434	Exported Function
NtOpenKeyTransactedEx	440	Exported Function
NtOpenKeyTransacted	439	Exported Function
NtOpenObjectAuditAlarm	443	Exported Function
NtOpenMutant	442	Exported Function
NtOpenKeyEx	438	Exported Function
NtOpenJobObject	436	Exported Function
NtOpenIoCompletion	435	Exported Function
NtOpenKeyedEvent	441	Exported Function
NtOpenKey	437	Exported Function
NtLockRegistryKey	412	Exported Function
NtLockProductActivationKeys	411	Exported Function
NtMakePermanentObject	414	Exported Function
NtLockVirtualMemory	413	Exported Function
NtLockFile	410	Exported Function
NtLoadKey2	406	Exported Function
NtLoadKey	408	Exported Function
NtLoadKeyEx	409	Exported Function
NtLoadKey3	407	Exported Function
NtMakeTemporaryObject	415	Exported Function
NtMapViewOfSectionEx	422	Exported Function
NtMapViewOfSection	421	Exported Function
NtModifyDriverEntry	424	Exported Function
NtModifyBootEntry	423	Exported Function
NtMapUserPhysicalPagesScatter	420	Exported Function
NtManagePartition	417	Exported Function
NtManageHotPatch	416	Exported Function
NtMapUserPhysicalPages	419	Exported Function
NtMapCMFModule	418	Exported Function
NtPrivilegeObjectAuditAlarm	468	Exported Function
NtPrivilegedServiceAuditAlarm	469	Exported Function
NtPropagationFailed	471	Exported Function
NtPropagationComplete	470	Exported Function
NtPrivilegeCheck	467	Exported Function
NtPrepareEnlistment	466	Exported Function
NtPrepareComplete	465	Exported Function
NtPrePrepareEnlistment	464	Exported Function
NtPrePrepareComplete	463	Exported Function
NtProtectVirtualMemory	472	Exported Function
NtQueryDebugFilterState	479	Exported Function
NtQueryBootOptions	478	Exported Function
NtQueryDefaultUILanguage	481	Exported Function
NtQueryDefaultLocale	480	Exported Function
NtQueryBootEntryOrder	477	Exported Function
NtPulseEvent	474	Exported Function
NtPssCaptureVaSpaceBulk	473	Exported Function
NtQueryAuxiliaryCounterFrequency	476	Exported Function
NtQueryAttributesFile	475	Exported Function
NtOpenResourceManager	450	Exported Function
NtOpenRegistryTransaction	449	Exported Function
NtOpenSemaphore	452	Exported Function
NtOpenSection	451	Exported Function
NtOpenProcessTokenEx	448	Exported Function
NtOpenPrivateNamespace	445	Exported Function
NtOpenPartition	444	Exported Function
NtOpenProcessToken	447	Exported Function
NtOpenProcess	446	Exported Function
NtOpenSession	453	Exported Function
NtOpenTransactionManager	460	Exported Function
NtOpenTransaction	459	Exported Function
NtPowerInformation	462	Exported Function
NtPlugPlayControl	461	Exported Function
NtOpenTimer	458	Exported Function
NtOpenThread	455	Exported Function
NtOpenSymbolicLinkObject	454	Exported Function
NtOpenThreadTokenEx	457	Exported Function
NtOpenThreadToken	456	Exported Function
NtEnableLastKnownGood	355	Exported Function
NtDuplicateToken	354	Exported Function
NtEnumerateDriverEntries	357	Exported Function
NtEnumerateBootEntries	356	Exported Function
NtDuplicateObject	353	Exported Function
NtdllDialogWndProc_A	701	Exported Function
NtdllDefWindowProc_W	700	Exported Function
NtDrawText	352	Exported Function
NtdllDialogWndProc_W	702	Exported Function
NtEnumerateKey	358	Exported Function
NtFilterTokenEx	365	Exported Function
NtFilterToken	364	Exported Function
NtFlushBuffersFile	367	Exported Function
NtFindAtom	366	Exported Function
NtFilterBootOption	363	Exported Function
NtEnumerateTransactionObject	360	Exported Function
NtEnumerateSystemEnvironmentValuesEx	359	Exported Function
NtExtendSection	362	Exported Function
NtEnumerateValueKey	361	Exported Function
NtDeleteDriverEntry	340	Exported Function
NtDeleteBootEntry	339	Exported Function
NtDeleteKey	342	Exported Function
NtDeleteFile	341	Exported Function
NtDeleteAtom	338	Exported Function
NtDebugActiveProcess	335	Exported Function
NtCurrentTeb	334	Exported Function
NtDelayExecution	337	Exported Function
NtDebugContinue	336	Exported Function
NtDeleteObjectAuditAlarm	343	Exported Function
NtDisableLastKnownGood	350	Exported Function
NtDirectGraphicsCall	349	Exported Function
NtdllDefWindowProc_A	699	Exported Function
NtDisplayString	351	Exported Function
NtDeviceIoControlFile	348	Exported Function
NtDeleteValueKey	345	Exported Function
NtDeletePrivateNamespace	344	Exported Function
NtDeleteWnfStateName	347	Exported Function
NtDeleteWnfStateData	346	Exported Function
NtImpersonateAnonymousToken	393	Exported Function
NtGetWriteWatch	392	Exported Function
NtImpersonateThread	395	Exported Function
NtImpersonateClientOfPort	394	Exported Function
NtGetTickCount	391	Exported Function
NtGetNextThread	388	Exported Function
NtGetNextProcess	387	Exported Function
NtGetNotificationResourceManager	390	Exported Function
NtGetNlsSectionPtr	389	Exported Function
NtInitializeEnclave	396	Exported Function
NtListenPort	403	Exported Function
NtIsUILanguageComitted	402	Exported Function
NtLoadEnclaveData	405	Exported Function
NtLoadDriver	404	Exported Function
NtIsSystemResumeAutomatic	401	Exported Function
NtInitializeRegistry	398	Exported Function
NtInitializeNlsFiles	397	Exported Function
NtIsProcessInJob	400	Exported Function
NtInitiatePowerAction	399	Exported Function
NtFlushWriteBuffer	374	Exported Function
NtFlushVirtualMemory	373	Exported Function
NtFreeVirtualMemory	376	Exported Function
NtFreeUserPhysicalPages	375	Exported Function
NtFlushProcessWriteBuffers	372	Exported Function
NtFlushInstallUILanguage	369	Exported Function
NtFlushBuffersFileEx	368	Exported Function
NtFlushKey	371	Exported Function
NtFlushInstructionCache	370	Exported Function
NtFreezeRegistry	377	Exported Function
NtGetCurrentProcessorNumberEx	384	Exported Function
NtGetCurrentProcessorNumber	383	Exported Function
NtGetMUIRegistryInfo	386	Exported Function
NtGetDevicePowerState	385	Exported Function
NtGetContextThread	382	Exported Function
NtFsControlFile	379	Exported Function
NtFreezeTransactions	378	Exported Function
NtGetCompleteWnfStateSubscription	381	Exported Function
NtGetCachedSigningLevel	380	Exported Function
AlpcGetCompletionListLastMessageInformation	20	Exported Function
AlpcFreeCompletionListMessage	19	Exported Function
AlpcGetHeaderSize	22	Exported Function
AlpcGetCompletionListMessageAttributes	21	Exported Function
AlpcAdjustCompletionListConcurrencyCount	18	Exported Function
A_SHAInit	16	Exported Function
A_SHAFinal	15	Exported Function
abs	2334	Exported Function
A_SHAUpdate	17	Exported Function
AlpcGetMessageAttribute	23	Exported Function
AlpcRundownCompletionList	30	Exported Function
AlpcRegisterCompletionListWorkerThread	29	Exported Function
AlpcUnregisterCompletionListWorkerThread	32	Exported Function
AlpcUnregisterCompletionList	31	Exported Function
AlpcRegisterCompletionList	28	Exported Function
AlpcGetOutstandingCompletionListMessageCount	25	Exported Function
AlpcGetMessageFromCompletionList	24	Exported Function
AlpcMaxAllowedMessageLength	27	Exported Function
AlpcInitializeMessageAttribute	26	Exported Function
_wcslwr_s	2321	Exported Function
_wcslwr	2320	Exported Function
_wcsnset_s	2323	Exported Function
_wcsnicmp	2322	Exported Function
_wcsicmp	2319	Exported Function
_vsnwprintf	2316	Exported Function
_vsnprintf_s	2315	Exported Function
_vswprintf	2318	Exported Function
_vsnwprintf_s	2317	Exported Function
_wcsset_s	2324	Exported Function
_wtoi	2331	Exported Function
_wsplitpath_s	2330	Exported Function
_wtol	2333	Exported Function
_wtoi64	2332	Exported Function
_wmakepath_s	2329	Exported Function
_wcstoui64	2326	Exported Function
_wcstoi64	2325	Exported Function
_wcsupr_s	2328	Exported Function
_wcsupr	2327	Exported Function
DbgPrintEx	50	Exported Function
DbgPrint	49	Exported Function
DbgPrompt	52	Exported Function
DbgPrintReturnControlC	51	Exported Function
DbgBreakPoint	48	Exported Function
CsrIdentifyAlertableThread	45	Exported Function
CsrGetProcessId	44	Exported Function
CsrVerifyRegion	47	Exported Function
CsrSetPriorityClass	46	Exported Function
DbgQueryDebugFilterState	53	Exported Function
DbgUiGetThreadDebugObject	60	Exported Function
DbgUiDebugActiveProcess	59	Exported Function
DbgUiRemoteBreakin	62	Exported Function
DbgUiIssueRemoteBreakin	61	Exported Function
DbgUiConvertStateChangeStructureEx	58	Exported Function
DbgUiConnectToDbg	55	Exported Function
DbgSetDebugFilterState	54	Exported Function
DbgUiConvertStateChangeStructure	57	Exported Function
DbgUiContinue	56	Exported Function
bsearch	2339	Exported Function
atol	2338	Exported Function
ceil	2341	Exported Function
bsearch_s	2340	Exported Function
atoi	2337	Exported Function
ApiSetQueryApiSetPresenceEx	34	Exported Function
ApiSetQueryApiSetPresence	33	Exported Function
atan2	2336	Exported Function
atan	2335	Exported Function
cos	2342	Exported Function
CsrClientCallServer	41	Exported Function
CsrCaptureTimeout	40	Exported Function
CsrFreeCaptureBuffer	43	Exported Function
CsrClientConnectToServer	42	Exported Function
CsrCaptureMessageString	39	Exported Function
CsrAllocateMessagePointer	36	Exported Function
CsrAllocateCaptureBuffer	35	Exported Function
CsrCaptureMessageMultiUnicodeStringsInPlace	38	Exported Function
CsrCaptureMessageBuffer	37	Exported Function
_except_handler4_common	2264	Exported Function
_errno	2263	Exported Function
_ftol	2266	Exported Function
_fltused	2265	Exported Function
_CIsqrt	2243	Exported Function
_CIlog	2240	Exported Function
_CIcos	2239	Exported Function
_CIsin	2242	Exported Function
_CIpow	2241	Exported Function
_ftol2	2267	Exported Function
_itoa_s	2274	Exported Function
_itoa	2273	Exported Function
_itow_s	2276	Exported Function
_itow	2275	Exported Function
_i64tow_s	2272	Exported Function
_i64toa	2269	Exported Function
_ftol2_sse	2268	Exported Function
_i64tow	2271	Exported Function
_i64toa_s	2270	Exported Function
_allmul	2250	Exported Function
_alldvrm	2249	Exported Function
_alloca_probe_16	2252	Exported Function
_alloca_probe	2251	Exported Function
_alldiv	2248	Exported Function
__iscsym	2245	Exported Function
__isascii	2244	Exported Function
__toascii	2247	Exported Function
__iscsymf	2246	Exported Function
_alloca_probe_8	2253	Exported Function
_aullrem	2260	Exported Function
_aulldvrm	2259	Exported Function
_chkstk	2262	Exported Function
_aullshr	2261	Exported Function
_aulldiv	2258	Exported Function
_allshl	2255	Exported Function
_allrem	2254	Exported Function
_atoi64	2257	Exported Function
_allshr	2256	Exported Function
_strupr_s	2302	Exported Function
_strupr	2301	Exported Function
_ui64toa	2304	Exported Function
_swprintf	2303	Exported Function
_strset_s	2300	Exported Function
_strlwr_s	2297	Exported Function
_strlwr	2296	Exported Function
_strnset_s	2299	Exported Function
_strnicmp	2298	Exported Function
_ui64toa_s	2305	Exported Function
_vscprintf	2312	Exported Function
_ultow_s	2311	Exported Function
_vsnprintf	2314	Exported Function
_vscwprintf	2313	Exported Function
_ultow	2310	Exported Function
_ui64tow_s	2307	Exported Function
_ui64tow	2306	Exported Function
_ultoa_s	2309	Exported Function
_ultoa	2308	Exported Function
_makepath_s	2283	Exported Function
_ltow_s	2282	Exported Function
_memicmp	2285	Exported Function
_memccpy	2284	Exported Function
_ltow	2281	Exported Function
_local_unwind4	2278	Exported Function
_lfind	2277	Exported Function
_ltoa_s	2280	Exported Function
_ltoa	2279	Exported Function
_snprintf	2286	Exported Function
_splitpath_s	2293	Exported Function
_splitpath	2292	Exported Function
_stricmp	2295	Exported Function
_strcmpi	2294	Exported Function
_snwscanf_s	2291	Exported Function
_snscanf_s	2288	Exported Function
_snprintf_s	2287	Exported Function
_snwprintf_s	2290	Exported Function
_snwprintf	2289	Exported Function
LdrGetFileNameFromLoadAsDataTable	140	Exported Function
LdrGetFailureData	139	Exported Function
LdrGetProcedureAddressEx	142	Exported Function
LdrGetProcedureAddress	141	Exported Function
LdrGetDllPath	138	Exported Function
LdrGetDllHandleByMapping	135	Exported Function
LdrGetDllHandle	134	Exported Function
LdrGetDllHandleEx	137	Exported Function
LdrGetDllHandleByName	136	Exported Function
LdrGetProcedureAddressForCaller	143	Exported Function
LdrLoadDll	150	Exported Function
LdrLoadAlternateResourceModuleEx	149	Exported Function
LdrLockLoaderLock	152	Exported Function
LdrLoadEnclaveModule	151	Exported Function
LdrLoadAlternateResourceModule	148	Exported Function
LdrInitializeThunk	146	Exported Function
LdrInitializeEnclave	145	Exported Function
LdrIsModuleSxsRedirected	147	Exported Function
LdrInitShimEngineDynamic	144	Exported Function
LdrCreateEnclave	121	Exported Function
LdrControlFlowGuardEnforced	120	Exported Function
LdrDisableThreadCalloutsForDll	123	Exported Function
LdrDeleteEnclave	122	Exported Function
LdrCallEnclave	119	Exported Function
LdrAddLoadAsDataTable	116	Exported Function
LdrAddDllDirectory	115	Exported Function
LdrAppxHandleIntegrityFailure	118	Exported Function
LdrAddRefDll	117	Exported Function
LdrEnumerateLoadedModules	125	Exported Function
LdrFlushAlternateResourceModules	131	Exported Function
LdrFindResourceEx_U	129	Exported Function
LdrGetDllFullName	133	Exported Function
LdrGetDllDirectory	132	Exported Function
LdrFindResourceDirectory_U	128	Exported Function
LdrFastFailInLoaderCallout	126	Exported Function
LdrEnumResources	124	Exported Function
LdrFindResource_U	130	Exported Function
LdrFindEntryForAddress	127	Exported Function
LdrResSearchResource	173	Exported Function
LdrResRelease	172	Exported Function
LdrSetAppCompatDllRedirectionCallback	177	Exported Function
LdrRscIsTypeExist	176	Exported Function
LdrResolveDelayLoadsFromDll	175	Exported Function
LdrResFindResourceDirectory	170	Exported Function
LdrResFindResource	169	Exported Function
LdrResolveDelayLoadedAPI	174	Exported Function
LdrResGetRCConfig	171	Exported Function
LdrSetDefaultDllDirectories	178	Exported Function
LdrStandardizeSystemPath	185	Exported Function
LdrShutdownThread	184	Exported Function
LdrUnloadAlternateResourceModule	187	Exported Function
LdrSystemDllInitBlock	186	Exported Function
LdrShutdownProcess	183	Exported Function
LdrSetDllManifestProber	180	Exported Function
LdrSetDllDirectory	179	Exported Function
LdrSetMUICacheType	182	Exported Function
LdrSetImplicitPathOptions	181	Exported Function
LdrpResGetMappingSize	196	Exported Function
LdrpChildNtdll	195	Exported Function
LdrProcessRelocationBlock	158	Exported Function
LdrpResGetResourceDirectory	197	Exported Function
LdrParentRtlRetrieveNtUserPfn	157	Exported Function
LdrParentInterlockedPopEntrySList	154	Exported Function
LdrOpenImageFileOptionsKey	153	Exported Function
LdrParentRtlResetNtUserPfn	156	Exported Function
LdrParentRtlInitializeNtUserPfn	155	Exported Function
LdrProcessRelocationBlockEx	159	Exported Function
LdrRegisterDllNotification	166	Exported Function
LdrQueryProcessModuleInformation	165	Exported Function
LdrRemoveLoadAsDataTable	168	Exported Function
LdrRemoveDllDirectory	167	Exported Function
LdrQueryOptionalDelayLoadedAPI	164	Exported Function
LdrQueryImageFileExecutionOptionsEx	161	Exported Function
LdrQueryImageFileExecutionOptions	160	Exported Function
LdrQueryModuleServiceTags	163	Exported Function
LdrQueryImageFileKeyOption	162	Exported Function
EtwLogTraceEvent	88	Exported Function
EtwGetTraceLoggerHandle	87	Exported Function
EtwNotificationUnregister	90	Exported Function
EtwNotificationRegister	89	Exported Function
EtwGetTraceEnableLevel	86	Exported Function
EtwEventWriteString	83	Exported Function
EtwEventWriteStartScenario	82	Exported Function
EtwGetTraceEnableFlags	85	Exported Function
EtwEventWriteTransfer	84	Exported Function
EtwpCreateEtwThread	103	Exported Function
EtwSendNotification	96	Exported Function
EtwReplyNotification	95	Exported Function
EtwTraceEventInstance	98	Exported Function
EtwSetMark	97	Exported Function
EtwRegisterTraceGuidsW	94	Exported Function
EtwProcessPrivateLoggerRequest	91	Exported Function
EtwpGetCpuSpeed	104	Exported Function
EtwRegisterTraceGuidsA	93	Exported Function
EtwRegisterSecurityProvider	92	Exported Function
EtwDeliverDataBlock	69	Exported Function
EtwCreateTraceInstanceId	68	Exported Function
EtwEventActivityIdControl	71	Exported Function
EtwEnumerateProcessRegGuids	70	Exported Function
EtwCheckCoverage	67	Exported Function
DbgUiStopDebugging	64	Exported Function
DbgUiSetThreadDebugObject	63	Exported Function
DbgUserBreakPoint	66	Exported Function
DbgUiWaitStateChange	65	Exported Function
EtwEventEnabled	72	Exported Function
EtwEventWriteEx	79	Exported Function
EtwEventWriteEndScenario	78	Exported Function
EtwEventWriteNoRegistration	81	Exported Function
EtwEventWriteFull	80	Exported Function
EtwEventWrite	77	Exported Function
EtwEventRegister	74	Exported Function
EtwEventProviderEnabled	73	Exported Function
EtwEventUnregister	76	Exported Function
EtwEventSetInformation	75	Exported Function
iswprint	2362	Exported Function
iswlower	2361	Exported Function
iswxdigit	2364	Exported Function
iswspace	2363	Exported Function
iswgraph	2360	Exported Function
iswascii	2357	Exported Function
iswalpha	2356	Exported Function
iswdigit	2359	Exported Function
iswctype	2358	Exported Function
isxdigit	2365	Exported Function
KiUserExceptionDispatcher	113	Exported Function
KiUserCallbackDispatcher	112	Exported Function
LdrAccessResource	114	Exported Function
labs	2366	Exported Function
KiUserApcDispatcher	111	Exported Function
KiFastSystemCallRet	108	Exported Function
KiFastSystemCall	107	Exported Function
KiRaiseUserExceptionDispatcher	110	Exported Function
KiIntSystemCall	109	Exported Function
fabs	2343	Exported Function
EvtIntReportEventAndSourceAsync	106	Exported Function
isalnum	2345	Exported Function
floor	2344	Exported Function
EvtIntReportAuthzEventAndSourceAsync	105	Exported Function
EtwTraceMessageVa	100	Exported Function
EtwTraceMessage	99	Exported Function
EtwWriteUMSecurityEvent	102	Exported Function
EtwUnregisterTraceGuids	101	Exported Function
isalpha	2346	Exported Function
isspace	2353	Exported Function
ispunct	2352	Exported Function
iswalnum	2355	Exported Function
isupper	2354	Exported Function
isprint	2351	Exported Function
isdigit	2348	Exported Function
iscntrl	2347	Exported Function
islower	2350	Exported Function
isgraph	2349	Exported Function
RtlDeactivateActivationContext	889	Exported Function
RtlCutoverTimeToSystemTime	886	Exported Function
RtlDebugPrintTimes	890	Exported Function
RtlDeactivateActivationContextUnsafeFast	10	Exported Function
RtlCustomCPToUnicodeN	885	Exported Function
RtlCreateUserThread	882	Exported Function
RtlCreateUserStack	881	Exported Function
RtlCultureNameToLCID	884	Exported Function
RtlCreateVirtualAccountSid	883	Exported Function
RtlDecodePointer	891	Exported Function
RtlDefaultNpAcl	897	Exported Function
RtlDecompressFragment	896	Exported Function
RtlDeleteAce	899	Exported Function
RtlDelete	898	Exported Function
RtlDecompressBufferEx	895	Exported Function
RtlDecodeSystemPointer	893	Exported Function
RtlDecodeRemotePointer	892	Exported Function
RtlDecompressBuffer	894	Exported Function
RtlDeCommitDebugInfo	887	Exported Function
RtlCreateQueryDebugBuffer	868	Exported Function
RtlCreateProcessReflection	867	Exported Function
RtlCreateSecurityDescriptor	870	Exported Function
RtlCreateRegistryKey	869	Exported Function
RtlCreateProcessParametersWithTemplate	866	Exported Function
RtlCreateMemoryZone	863	Exported Function
RtlCreateMemoryBlockLookaside	862	Exported Function
RtlCreateProcessParametersEx	865	Exported Function
RtlCreateProcessParameters	864	Exported Function
RtlCreateServiceSid	871	Exported Function
RtlCreateUserProcess	878	Exported Function
RtlCreateUnicodeStringFromAsciiz	877	Exported Function
RtlCreateUserSecurityObject	880	Exported Function
RtlCreateUserProcessEx	879	Exported Function
RtlCreateUnicodeString	876	Exported Function
RtlCreateTagHeap	873	Exported Function
RtlCreateSystemVolumeInformationFolder	872	Exported Function
RtlCreateTimerQueue	875	Exported Function
RtlCreateTimer	874	Exported Function
RtlDestroyMemoryZone	924	Exported Function
RtlDestroyMemoryBlockLookaside	923	Exported Function
RtlDestroyQueryDebugBuffer	926	Exported Function
RtlDestroyProcessParameters	925	Exported Function
RtlDestroyHeap	922	Exported Function
RtlDestroyAtomTable	919	Exported Function
RtlDeriveCapabilitySidsFromName	918	Exported Function
RtlDestroyHandleTable	921	Exported Function
RtlDestroyEnvironment	920	Exported Function
RtlDetectHeapLeaks	927	Exported Function
RtlDoesFileExists_U	933	Exported Function
RtlDnsHostNameToComputerName	932	Exported Function
RtlDosApplyFileIsolationRedirection_Ustr	935	Exported Function
RtlDoesNameContainWildCards	934	Exported Function
RtlDllShutdownInProgress	931	Exported Function
RtlDisableThreadProfiling	929	Exported Function
RtlDetermineDosPathNameType_U	928	Exported Function
RtlDispatchAPC	8	Exported Function
RtlDisownModuleHeapAllocation	930	Exported Function
RtlDeleteElementGenericTableAvlEx	906	Exported Function
RtlDeleteElementGenericTableAvl	905	Exported Function
RtlDeleteNoSplay	908	Exported Function
RtlDeleteHashTable	907	Exported Function
RtlDeleteElementGenericTable	904	Exported Function
RtlDeleteBarrier	901	Exported Function
RtlDeleteAtomFromAtomTable	900	Exported Function
RtlDeleteCriticalSection	903	Exported Function
RtlDeleteBoundaryDescriptor	902	Exported Function
RtlDeleteRegistryValue	909	Exported Function
RtlDeregisterSecureMemoryCacheCallback	915	Exported Function
RtlDeNormalizeProcessParams	888	Exported Function
RtlDeregisterWaitEx	917	Exported Function
RtlDeregisterWait	916	Exported Function
RtlDeleteTimerQueueEx	914	Exported Function
RtlDeleteSecurityObject	911	Exported Function
RtlDeleteResource	910	Exported Function
RtlDeleteTimerQueue	913	Exported Function
RtlDeleteTimer	912	Exported Function
RtlCompactHeap	811	Exported Function
RtlCommitMemoryStream	810	Exported Function
RtlCompareMemory	813	Exported Function
RtlCompareAltitudes	812	Exported Function
RtlCommitDebugInfo	809	Exported Function
RtlCloneUserProcess	806	Exported Function
RtlCloneMemoryStream	805	Exported Function
RtlCmEncodeMemIoResource	808	Exported Function
RtlCmDecodeMemIoResource	807	Exported Function
RtlCompareMemoryUlong	814	Exported Function
RtlComputePrivatizedDllName_U	821	Exported Function
RtlComputeImportTableHash	820	Exported Function
RtlConsoleMultiByteToUnicodeN	823	Exported Function
RtlConnectToSm	822	Exported Function
RtlComputeCrc32	819	Exported Function
RtlCompareUnicodeString	816	Exported Function
RtlCompareString	815	Exported Function
RtlCompressBuffer	818	Exported Function
RtlCompareUnicodeStrings	817	Exported Function
RtlCheckForOrphanedCriticalSections	792	Exported Function
RtlCheckBootStatusIntegrity	791	Exported Function
RtlCheckRegistryKey	794	Exported Function
RtlCheckPortableOperatingSystem	793	Exported Function
RtlCharToInteger	790	Exported Function
RtlCaptureContext	787	Exported Function
RtlCapabilityCheckForSingleSessionSku	786	Exported Function
RtlCaptureStackContext	789	Exported Function
RtlCaptureStackBackTrace	788	Exported Function
RtlCheckSandboxedToken	795	Exported Function
RtlClearBit	802	Exported Function
RtlClearAllBits	801	Exported Function
RtlClearThreadWorkOnBehalfTicket	804	Exported Function
RtlClearBits	803	Exported Function
RtlCleanUpTEBLangLists	800	Exported Function
RtlCheckTokenCapability	797	Exported Function
RtlCheckSystemBootStatusIntegrity	796	Exported Function
RtlCheckTokenMembershipEx	799	Exported Function
RtlCheckTokenMembership	798	Exported Function
RtlCrc32	849	Exported Function
RtlCopyUnicodeString	848	Exported Function
RtlCreateAcl	851	Exported Function
RtlCrc64	850	Exported Function
RtlCopyString	847	Exported Function
RtlCopySecurityDescriptor	844	Exported Function
RtlCopyOutOfProcessMemoryStreamTo	843	Exported Function
RtlCopySidAndAttributesArray	846	Exported Function
RtlCopySid	845	Exported Function
RtlCreateActivationContext	852	Exported Function
RtlCreateHashTable	859	Exported Function
RtlCreateEnvironmentEx	858	Exported Function
RtlCreateHeap	861	Exported Function
RtlCreateHashTableEx	860	Exported Function
RtlCreateEnvironment	857	Exported Function
RtlCreateAtomTable	854	Exported Function
RtlCreateAndSetSD	853	Exported Function
RtlCreateBoundaryDescriptor	856	Exported Function
RtlCreateBootStatusDataFile	855	Exported Function
RtlConvertLongToLargeInteger	830	Exported Function
RtlConvertLCIDToString	829	Exported Function
RtlConvertSidToUnicodeString	833	Exported Function
RtlConvertSharedToExclusive	832	Exported Function
RtlConvertExclusiveToShared	828	Exported Function
RtlConstructCrossVmMutexPath	825	Exported Function
RtlConstructCrossVmEventPath	824	Exported Function
RtlConvertDeviceFamilyInfoToString	827	Exported Function
RtlContractHashTable	826	Exported Function
RtlConvertSRWLockExclusiveToShared	831	Exported Function
RtlCopyLuidAndAttributesArray	840	Exported Function
RtlCopyLuid	839	Exported Function
RtlCopyMemoryStreamTo	842	Exported Function
RtlCopyMappedMemory	841	Exported Function
RtlCopyExtendedContext	838	Exported Function
RtlConvertUlongToLargeInteger	835	Exported Function
RtlConvertToAutoInheritSecurityObject	834	Exported Function
RtlCopyContext	837	Exported Function
RtlCopyBitMap	836	Exported Function
RtlGetAce	1038	Exported Function
RtlGenerate8dot3Name	1037	Exported Function
RtlGetActiveConsoleId	1040	Exported Function
RtlGetActiveActivationContext	1039	Exported Function
RtlFreeUTF8String	1033	Exported Function
RtlFreeThreadActivationContextStack	1032	Exported Function
RtlFreeSid	1031	Exported Function
RtlFreeUserStack	1035	Exported Function
RtlFreeUnicodeString	1034	Exported Function
RtlGetAppContainerNamedObjectPath	1041	Exported Function
RtlGetCriticalSectionRecursionCount	1048	Exported Function
RtlGetControlSecurityDescriptor	1047	Exported Function
RtlGetCurrentPeb	1050	Exported Function
RtlGetCurrentDirectory_U	1049	Exported Function
RtlGetConsoleSessionForegroundProcessId	1046	Exported Function
RtlGetAppContainerSidType	1043	Exported Function
RtlGetAppContainerParent	1042	Exported Function
RtlGetCompressionWorkSpaceSize	1045	Exported Function
RtlGetCallersAddress	1044	Exported Function
RtlFlsGetValue	1018	Exported Function
RtlFlsFree	1017	Exported Function
RtlFlushHeaps	1020	Exported Function
RtlFlsSetValue	1019	Exported Function
RtlFlsAlloc	1016	Exported Function
RtlFindUnicodeSubstring	1013	Exported Function
RtlFindSetBitsAndClear	1012	Exported Function
RtlFirstFreeAce	1015	Exported Function
RtlFirstEntrySList	1014	Exported Function
RtlFlushSecureMemoryCache	1021	Exported Function
RtlFreeHeap	1028	Exported Function
RtlFreeHandle	1027	Exported Function
RtlFreeOemString	1030	Exported Function
RtlFreeMemoryBlockLookaside	1029	Exported Function
RtlFreeAnsiString	1026	Exported Function
RtlFormatMessage	1023	Exported Function
RtlFormatCurrentUserKeyPath	1022	Exported Function
RtlFreeActivationContextStack	1025	Exported Function
RtlFormatMessageEx	1024	Exported Function
RtlGetLocaleFileMappingAddress	1076	Exported Function
RtlGetLengthWithoutTrailingPathSeperators	1075	Exported Function
RtlGetMultiTimePrecise	1078	Exported Function
RtlGetLongestNtPathLength	1077	Exported Function
RtlGetLengthWithoutLastFullDosOrNtPathElement	1074	Exported Function
RtlGetInterruptTimePrecise	1071	Exported Function
RtlGetIntegerAtom	1070	Exported Function
RtlGetLastWin32Error	1073	Exported Function
RtlGetLastNtStatus	1072	Exported Function
RtlGetNativeSystemInformation	1079	Exported Function
RtlGetParentLocaleName	1086	Exported Function
RtlGetOwnerSecurityDescriptor	1085	Exported Function
RtlGetProcessHeaps	1088	Exported Function
RtlGetPersistedStateLocation	1087	Exported Function
RtlGetNtVersionNumbers	1084	Exported Function
RtlGetNtGlobalFlags	1081	Exported Function
RtlGetNextEntryHashTable	1080	Exported Function
RtlGetNtSystemRoot	1083	Exported Function
RtlGetNtProductType	1082	Exported Function
RtlGetElementGenericTable	1057	Exported Function
RtlGetDeviceFamilyInfoEnum	1056	Exported Function
RtlGetEnabledExtendedFeatures	1059	Exported Function
RtlGetElementGenericTableAvl	1058	Exported Function
RtlGetDaclSecurityDescriptor	1055	Exported Function
RtlGetCurrentProcessorNumberEx	1052	Exported Function
RtlGetCurrentProcessorNumber	1051	Exported Function
RtlGetCurrentTransaction	1054	Exported Function
RtlGetCurrentServiceSessionId	1053	Exported Function
RtlGetExePath	1060	Exported Function
RtlGetFullPathName_UEx	1067	Exported Function
RtlGetFullPathName_U	1066	Exported Function
RtlGetGroupSecurityDescriptor	1069	Exported Function
RtlGetFullPathName_UstrEx	1068	Exported Function
RtlGetFrame	1065	Exported Function
RtlGetExtendedContextLength2	1061	Exported Function
RtlGetExtendedContextLength	1062	Exported Function
RtlGetFileMUIPath	1064	Exported Function
RtlGetExtendedFeaturesMask	1063	Exported Function
RtlEnumerateGenericTable	962	Exported Function
RtlEnumerateEntryHashTable	961	Exported Function
RtlEnumerateGenericTableLikeADirectory	964	Exported Function
RtlEnumerateGenericTableAvl	963	Exported Function
RtlEnterCriticalSection	959	Exported Function
RtlEndWeakEnumerationHashTable	956	Exported Function
RtlEndStrongEnumerationHashTable	955	Exported Function
RtlEnlargedUnsignedMultiply	958	Exported Function
RtlEnlargedIntegerMultiply	957	Exported Function
RtlEnumerateGenericTableWithoutSplaying	965	Exported Function
RtlEqualSid	971	Exported Function
RtlEqualPrefixSid	970	Exported Function
RtlEqualUnicodeString	973	Exported Function
RtlEqualString	972	Exported Function
RtlEqualLuid	969	Exported Function
RtlEnumProcessHeaps	960	Exported Function
RtlEnumerateGenericTableWithoutSplayingAvl	966	Exported Function
RtlEqualDomainName	968	Exported Function
RtlEqualComputerName	967	Exported Function
RtlDosSearchPath_U	942	Exported Function
RtlDosPathNameToRelativeNtPathName_U_WithStatus	941	Exported Function
RtlDowncaseUnicodeChar	944	Exported Function
RtlDosSearchPath_Ustr	943	Exported Function
RtlDosPathNameToRelativeNtPathName_U	940	Exported Function
RtlDosLongPathNameToRelativeNtPathName_U_WithStatus	937	Exported Function
RtlDosLongPathNameToNtPathName_U_WithStatus	936	Exported Function
RtlDosPathNameToNtPathName_U_WithStatus	939	Exported Function
RtlDosPathNameToNtPathName_U	938	Exported Function
RtlDowncaseUnicodeString	945	Exported Function
RtlEncodeRemotePointer	952	Exported Function
RtlEncodePointer	951	Exported Function
RtlEndEnumerationHashTable	954	Exported Function
RtlEncodeSystemPointer	953	Exported Function
RtlEnableThreadProfiling	950	Exported Function
RtlDuplicateUnicodeString	947	Exported Function
RtlDumpResource	946	Exported Function
RtlEnableEarlyCriticalSectionEventCreation	949	Exported Function
RtlEmptyAtomTable	948	Exported Function
RtlFindCharInUnicodeString	999	Exported Function
RtlFindActivationContextSectionString	998	Exported Function
RtlFindClearBitsAndSet	1001	Exported Function
RtlFindClearBits	1000	Exported Function
RtlFindActivationContextSectionGuid	997	Exported Function
RtlFillMemoryUlonglong	994	Exported Function
RtlFillMemoryUlong	993	Exported Function
RtlFindAceByType	996	Exported Function
RtlFinalReleaseOutOfProcessMemoryStream	995	Exported Function
RtlFindClearRuns	1002	Exported Function
RtlFindMostSignificantBit	1009	Exported Function
RtlFindMessage	1008	Exported Function
RtlFindSetBits	1011	Exported Function
RtlFindNextForwardRunClear	1010	Exported Function
RtlFindLongestRunClear	1007	Exported Function
RtlFindExportedRoutineByName	1004	Exported Function
RtlFindClosestEncodableLength	1003	Exported Function
RtlFindLeastSignificantBit	1006	Exported Function
RtlFindLastBackwardRunClear	1005	Exported Function
RtlExitUserProcess	980	Exported Function
RtlEthernetStringToAddressW	979	Exported Function
RtlExpandEnvironmentStrings	982	Exported Function
RtlExitUserThread	981	Exported Function
RtlEthernetStringToAddressA	978	Exported Function
RtlEraseUnicodeString	975	Exported Function
RtlEqualWnfChangeStamps	974	Exported Function
RtlEthernetAddressToStringW	977	Exported Function
RtlEthernetAddressToStringA	976	Exported Function
RtlExpandEnvironmentStrings_U	983	Exported Function
RtlExtendMemoryZone	987	Exported Function
RtlExtendMemoryBlockLookaside	986	Exported Function
RtlFillMemory	992	Exported Function
RtlExtractBitMap	991	Exported Function
RtlExtendedMagicDivide	990	Exported Function
RtlExtendCorrelationVector	985	Exported Function
RtlExpandHashTable	984	Exported Function
RtlExtendedLargeIntegerDivide	989	Exported Function
RtlExtendedIntegerMultiply	988	Exported Function
NtSetCachedSigningLevel2	582	Exported Function
NtSetCachedSigningLevel	583	Exported Function
NtSetDebugFilterState	585	Exported Function
NtSetContextThread	584	Exported Function
NtSetBootOptions	581	Exported Function
NtSecureConnectPort	578	Exported Function
NtSaveMergedKeys	577	Exported Function
NtSetBootEntryOrder	580	Exported Function
NtSerializeBoot	579	Exported Function
NtSetDefaultHardErrorPort	586	Exported Function
NtSetHighEventPair	593	Exported Function
NtSetEventBoostPriority	592	Exported Function
NtSetInformationDebugObject	596	Exported Function
NtSetHighWaitLowEventPair	594	Exported Function
NtSetEvent	591	Exported Function
NtSetDefaultUILanguage	588	Exported Function
NtSetDefaultLocale	587	Exported Function
NtSetEaFile	590	Exported Function
NtSetDriverEntryOrder	589	Exported Function
NtResetEvent	564	Exported Function
NtRequestWaitReplyPort	563	Exported Function
NtRestoreKey	566	Exported Function
NtResetWriteWatch	565	Exported Function
NtRequestPort	562	Exported Function
NtReplyWaitReceivePort	559	Exported Function
NtReplyPort	558	Exported Function
NtReplyWaitReplyPort	561	Exported Function
NtReplyWaitReceivePortEx	560	Exported Function
NtResumeProcess	567	Exported Function
NtRollforwardTransactionManager	574	Exported Function
NtRollbackTransaction	573	Exported Function
NtSaveKeyEx	576	Exported Function
NtSaveKey	575	Exported Function
NtRollbackRegistryTransaction	572	Exported Function
NtRevertContainerImpersonation	569	Exported Function
NtResumeThread	568	Exported Function
NtRollbackEnlistment	571	Exported Function
NtRollbackComplete	570	Exported Function
NtSetSystemInformation	621	Exported Function
NtSetSystemEnvironmentValueEx	620	Exported Function
NtSetSystemTime	623	Exported Function
NtSetSystemPowerState	622	Exported Function
NtSetSystemEnvironmentValue	619	Exported Function
NtSetLowWaitHighEventPair	616	Exported Function
NtSetLowEventPair	615	Exported Function
NtSetSecurityObject	618	Exported Function
NtSetQuotaInformationFile	617	Exported Function
NtSetThreadExecutionState	624	Exported Function
NtSetVolumeInformationFile	631	Exported Function
NtSetValueKey	630	Exported Function
NtShutdownSystem	633	Exported Function
NtSetWnfProcessNotificationEvent	632	Exported Function
NtSetUuidSeed	629	Exported Function
NtSetTimer2	625	Exported Function
NtSetTimer	626	Exported Function
NtSetTimerResolution	628	Exported Function
NtSetTimerEx	627	Exported Function
NtSetInformationResourceManager	603	Exported Function
NtSetInformationProcess	602	Exported Function
NtSetInformationThread	605	Exported Function
NtSetInformationSymbolicLink	604	Exported Function
NtSetInformationObject	601	Exported Function
NtSetInformationFile	598	Exported Function
NtSetInformationEnlistment	597	Exported Function
NtSetInformationKey	600	Exported Function
NtSetInformationJobObject	599	Exported Function
NtSetInformationToken	606	Exported Function
NtSetIoCompletionEx	613	Exported Function
NtSetIoCompletion	612	Exported Function
NtSetLdtEntries	614	Exported Function
NtSetIRTimer	595	Exported Function
NtSetIntervalProfile	611	Exported Function
NtSetInformationTransactionManager	608	Exported Function
NtSetInformationTransaction	607	Exported Function
NtSetInformationWorkerFactory	610	Exported Function
NtSetInformationVirtualMemory	609	Exported Function
NtQueryMultipleValueKey	507	Exported Function
NtQueryLicenseValue	506	Exported Function
NtQueryObject	509	Exported Function
NtQueryMutant	508	Exported Function
NtQueryKey	505	Exported Function
NtQueryInstallUILanguage	502	Exported Function
NtQueryInformationWorkerFactory	501	Exported Function
NtQueryIoCompletion	504	Exported Function
NtQueryIntervalProfile	503	Exported Function
NtQueryOpenSubKeys	510	Exported Function
NtQuerySecurityObject	517	Exported Function
NtQuerySecurityAttributesToken	516	Exported Function
NtQuerySemaphore	519	Exported Function
NtQuerySecurityPolicy	518	Exported Function
NtQuerySection	515	Exported Function
NtQueryPerformanceCounter	512	Exported Function
NtQueryOpenSubKeysEx	511	Exported Function
NtQueryQuotaInformationFile	514	Exported Function
NtQueryPortInformationProcess	513	Exported Function
NtQueryFullAttributesFile	488	Exported Function
NtQueryEvent	487	Exported Function
NtQueryInformationByName	490	Exported Function
NtQueryInformationAtom	489	Exported Function
NtQueryEaFile	486	Exported Function
NtQueryDirectoryFileEx	483	Exported Function
NtQueryDirectoryFile	482	Exported Function
NtQueryDriverEntryOrder	485	Exported Function
NtQueryDirectoryObject	484	Exported Function
NtQueryInformationEnlistment	491	Exported Function
NtQueryInformationToken	498	Exported Function
NtQueryInformationThread	497	Exported Function
NtQueryInformationTransactionManager	500	Exported Function
NtQueryInformationTransaction	499	Exported Function
NtQueryInformationResourceManager	496	Exported Function
NtQueryInformationJobObject	493	Exported Function
NtQueryInformationFile	492	Exported Function
NtQueryInformationProcess	495	Exported Function
NtQueryInformationPort	494	Exported Function
NtRegisterProtocolAddressInformation	545	Exported Function
NtRecoverTransactionManager	544	Exported Function
NtReleaseKeyedEvent	547	Exported Function
NtRegisterThreadTerminatePort	546	Exported Function
NtRecoverResourceManager	543	Exported Function
NtReadRequestData	540	Exported Function
NtReadOnlyEnlistment	539	Exported Function
NtRecoverEnlistment	542	Exported Function
NtReadVirtualMemory	541	Exported Function
NtReleaseMutant	548	Exported Function
NtRenameTransactionManager	555	Exported Function
NtRenameKey	554	Exported Function
NtReplacePartitionUnit	557	Exported Function
NtReplaceKey	556	Exported Function
NtRemoveProcessDebug	553	Exported Function
NtReleaseWorkerFactoryWorker	550	Exported Function
NtReleaseSemaphore	549	Exported Function
NtRemoveIoCompletionEx	552	Exported Function
NtRemoveIoCompletion	551	Exported Function
NtQueryTimer	526	Exported Function
NtQuerySystemTime	525	Exported Function
NtQueryValueKey	528	Exported Function
NtQueryTimerResolution	527	Exported Function
NtQuerySystemInformationEx	524	Exported Function
NtQuerySystemEnvironmentValue	521	Exported Function
NtQuerySymbolicLinkObject	520	Exported Function
NtQuerySystemInformation	523	Exported Function
NtQuerySystemEnvironmentValueEx	522	Exported Function
NtQueryVirtualMemory	529	Exported Function
NtRaiseHardError	536	Exported Function
NtRaiseException	535	Exported Function
NtReadFileScatter	538	Exported Function
NtReadFile	537	Exported Function
NtQueueApcThreadEx	534	Exported Function
NtQueryWnfStateData	531	Exported Function
NtQueryVolumeInformationFile	530	Exported Function
NtQueueApcThread	533	Exported Function
NtQueryWnfStateNameInformation	532	Exported Function
RtlAddAtomToAtomTable	735	Exported Function
RtlAddActionToRXact	734	Exported Function
RtlAddAuditAccessAce	737	Exported Function
RtlAddAttributeActionToRXact	736	Exported Function
RtlAddAce	733	Exported Function
RtlAddAccessDeniedAceEx	730	Exported Function
RtlAddAccessDeniedAce	729	Exported Function
RtlAddAccessFilterAce	732	Exported Function
RtlAddAccessDeniedObjectAce	731	Exported Function
RtlAddAuditAccessAceEx	738	Exported Function
RtlAddRefMemoryStream	745	Exported Function
RtlAddRefActivationContext	744	Exported Function
RtlAddressInSectionTable	751	Exported Function
RtlAddResourceAttributeAce	746	Exported Function
RtlAddProcessTrustLabelAce	743	Exported Function
RtlAddCompoundAce	740	Exported Function
RtlAddAuditAccessObjectAce	739	Exported Function
RtlAddMandatoryAce	742	Exported Function
RtlAddIntegrityLabelToBoundaryDescriptor	741	Exported Function
RtlAcquirePebLock	717	Exported Function
RtlAbsoluteToSelfRelativeSD	716	Exported Function
RtlAcquireReleaseSRWLockExclusive	719	Exported Function
RtlAcquirePrivilege	718	Exported Function
RtlAbortRXact	715	Exported Function
PssNtWalkSnapshot	714	Exported Function
PssNtValidateDescriptor	713	Exported Function
qsort_s	2378	Exported Function
qsort	2377	Exported Function
RtlAcquireResourceExclusive	720	Exported Function
RtlAddAccessAllowedAce	726	Exported Function
RtlActivateActivationContextUnsafeFast	9	Exported Function
RtlAddAccessAllowedObjectAce	728	Exported Function
RtlAddAccessAllowedAceEx	727	Exported Function
RtlActivateActivationContextEx	725	Exported Function
RtlAcquireSRWLockExclusive	722	Exported Function
RtlAcquireResourceShared	721	Exported Function
RtlActivateActivationContext	724	Exported Function
RtlAcquireSRWLockShared	723	Exported Function
RtlAreAllAccessesGranted	773	Exported Function
RtlAppxIsFileOwnedByTrustedInstaller	772	Exported Function
RtlAreBitsClear	775	Exported Function
RtlAreAnyAccessesGranted	774	Exported Function
RtlApplyRXactNoFlush	771	Exported Function
RtlAppendUnicodeToString	768	Exported Function
RtlAppendUnicodeStringToString	767	Exported Function
RtlApplyRXact	770	Exported Function
RtlApplicationVerifierStop	769	Exported Function
RtlAreBitsSet	776	Exported Function
RtlCancelTimer	783	Exported Function
RtlBarrierForDelete	782	Exported Function
RtlCapabilityCheck	785	Exported Function
RtlCanonicalizeDomainName	784	Exported Function
RtlBarrier	781	Exported Function
RtlAssert	778	Exported Function
RtlAreLongPathsEnabled	777	Exported Function
RtlAvlRemoveNode	780	Exported Function
RtlAvlInsertNodeEx	779	Exported Function
RtlAllocateAndInitializeSid	754	Exported Function
RtlAllocateActivationContextStack	753	Exported Function
RtlAllocateHandle	756	Exported Function
RtlAllocateAndInitializeSidEx	755	Exported Function
RtlAdjustPrivilege	752	Exported Function
RtlAddSIDToBoundaryDescriptor	747	Exported Function
RtlAddScopedPolicyIDAce	748	Exported Function
RtlAddVectoredExceptionHandler	750	Exported Function
RtlAddVectoredContinueHandler	749	Exported Function
RtlAllocateHeap	757	Exported Function
RtlAppendAsciizToString	764	Exported Function
RtlAnsiStringToUnicodeString	763	Exported Function
RtlAppendStringToString	766	Exported Function
RtlAppendPathElement	765	Exported Function
RtlAnsiStringToUnicodeSize	762	Exported Function
RtlAllocateMemoryZone	759	Exported Function
RtlAllocateMemoryBlockLookaside	758	Exported Function
RtlAnsiCharToUnicodeChar	761	Exported Function
RtlAllocateWnfSerializationGroup	760	Exported Function
NtUnlockVirtualMemory	659	Exported Function
NtUnlockFile	658	Exported Function
NtUnmapViewOfSectionEx	661	Exported Function
NtUnmapViewOfSection	660	Exported Function
NtUnloadKeyEx	657	Exported Function
NtUnloadDriver	654	Exported Function
NtUmsThreadYield	653	Exported Function
NtUnloadKey2	655	Exported Function
NtUnloadKey	656	Exported Function
NtUnsubscribeWnfStateChange	662	Exported Function
NtWaitForMultipleObjects32	668	Exported Function
NtWaitForMultipleObjects	669	Exported Function
NtWaitForWorkViaWorkerFactory	671	Exported Function
NtWaitForSingleObject	670	Exported Function
NtWaitForKeyedEvent	667	Exported Function
NtVdmControl	664	Exported Function
NtUpdateWnfStateData	663	Exported Function
NtWaitForDebugEvent	666	Exported Function
NtWaitForAlertByThreadId	665	Exported Function
NtSuspendProcess	640	Exported Function
NtSubscribeWnfStateChange	639	Exported Function
NtSystemDebugControl	642	Exported Function
NtSuspendThread	641	Exported Function
NtStopProfile	638	Exported Function
NtSignalAndWaitForSingleObject	635	Exported Function
NtShutdownWorkerFactory	634	Exported Function
NtStartProfile	637	Exported Function
NtSinglePhaseReject	636	Exported Function
NtTerminateEnclave	643	Exported Function
NtTraceControl	650	Exported Function
NtThawTransactions	649	Exported Function
NtTranslateFilePath	652	Exported Function
NtTraceEvent	651	Exported Function
NtThawRegistry	648	Exported Function
NtTerminateProcess	645	Exported Function
NtTerminateJobObject	644	Exported Function
NtTestAlert	647	Exported Function
NtTerminateThread	646	Exported Function
NtWriteVirtualMemory	697	Exported Function
NtWriteRequestData	696	Exported Function
PfxFindPrefix	703	Exported Function
NtYieldExecution	698	Exported Function
NtWriteFileGather	695	Exported Function
NtWow64ReadVirtualMemory64	692	Exported Function
NtWow64QueryInformationProcess64	691	Exported Function
NtWriteFile	694	Exported Function
NtWow64WriteVirtualMemory64	693	Exported Function
PfxInitialize	704	Exported Function
PssNtFreeSnapshot	710	Exported Function
PssNtFreeRemoteSnapshot	709	Exported Function
PssNtQuerySnapshot	712	Exported Function
PssNtFreeWalkMarker	711	Exported Function
PssNtDuplicateSnapshot	708	Exported Function
PfxRemovePrefix	706	Exported Function
PfxInsertPrefix	705	Exported Function
PssNtCaptureSnapshot	707	Exported Function
pow	2376	Exported Function
NtWow64CsrAllocateMessagePointer	678	Exported Function
NtWow64CsrAllocateCaptureBuffer	677	Exported Function
NtWow64CsrCaptureMessageString	680	Exported Function
NtWow64CsrCaptureMessageBuffer	679	Exported Function
NtWow64CallFunction64	676	Exported Function
NtWaitLowEventPair	673	Exported Function
NtWaitHighEventPair	672	Exported Function
NtWow64AllocateVirtualMemory64	675	Exported Function
NtWorkerFactoryWorkerReady	674	Exported Function
NtWow64CsrClientCallServer	681	Exported Function
NtWow64GetCurrentProcessorNumberEx	688	Exported Function
NtWow64DebuggerCall	687	Exported Function
NtWow64IsProcessorFeaturePresent	690	Exported Function
NtWow64GetNativeSystemInformation	689	Exported Function
NtWow64CsrVerifyRegion	686	Exported Function
NtWow64CsrFreeCaptureBuffer	683	Exported Function
NtWow64CsrClientConnectToServer	682	Exported Function
NtWow64CsrIdentifyAlertableThread	685	Exported Function
NtWow64CsrGetProcessId	684	Exported Function

Signature

• Status: Signature verified.
• Serial: 330000026551AE1BBD005CBFBD000000000265
• Thumbprint: E168609353F30FF2373157B4EB8CD519D07A2BFF
• Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
• Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

• Original Filename: ntdll.dll.mui
• Product Name: Microsoft Windows Operating System
• Company Name: Microsoft Corporation
• File Version: 10.0.19041.1 (WinBuild.160101.0800)
• Product Version: 10.0.19041.1
• Language: English (United States)
• Legal Copyright: Microsoft Corporation. All rights reserved.
• Machine Type: 32-bit

File Scan

• VirusTotal Detections: 0/70
• VirusTotal Link: https://www.virustotal.com/gui/file/c44b5ed955d297c4ca4d8ef5892d8342905f65c4643862721353b1d1ebac8e5d/detection/

Possible Misuse

The following table contains possible examples of ntdll.dll being misused. While ntdll.dll is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source	Source File	Example	License
sigma	proc_access_win_in_memory_assembly_execution.yml	description: Detects the access to processes by other suspicious processes which have reflectively loaded libraries in their memory space. An example is SilentTrinity C2 behaviour. Generally speaking, when Sysmon EventID 10 cannot reference a stack call to a dll loaded from disk (the standard way), it will display "UNKNOWN" as the module name. Usually this means the stack call points to a module that was reflectively loaded in memory. Adding to this, it is not common to see such few calls in the stack (ntdll.dll --> kernelbase.dll --> unknown) which essentially means that most of the functions required by the process to execute certain routines are already present in memory, not requiring any calls to external libraries. The latter should also be considered suspicious.	DRL 1.0
sigma	proc_access_win_in_memory_assembly_execution.yml	- 'C:\WINDOWS\SYSTEM32\ntdll.dll+'	DRL 1.0
sigma	proc_access_win_lazagne_cred_dump_lsass_access.yml	- 'C:\\Windows\\SYSTEM32\\ntdll.dll+'	DRL 1.0
sigma	proc_access_win_lsass_memdump.yml	description: Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and up.	DRL 1.0
sigma	proc_access_win_lsass_memdump.yml	- 'ntdll.dll'	DRL 1.0
sigma	proc_access_win_pypykatz_cred_dump_lsass_access.yml	- 'C:\Windows\SYSTEM32\ntdll.dll+'	DRL 1.0
sigma	proc_creation_win_susp_ntdll_type_redirect.yml	description: Detects command that type the content of ntdll.dll to a different file or a pipe in order to evade AV / EDR detection	DRL 1.0
sigma	proc_creation_win_susp_ntdll_type_redirect.yml	- 'type %windir%\system32\ntdll.dll'	DRL 1.0
sigma	proc_creation_win_susp_ntdll_type_redirect.yml	- 'type %systemroot%\system32\ntdll.dll'	DRL 1.0
sigma	proc_creation_win_susp_ntdll_type_redirect.yml	- 'type c:\windows\system32\ntdll.dll'	DRL 1.0
sigma	proc_creation_win_susp_ntdll_type_redirect.yml	- '\\ntdll.dll > \\\\.\\pipe\\'	DRL 1.0
malware-ioc	misp-dukes-operation-ghost-event.json	"description": "The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like CreateProcess(), LoadLibrary(), etc. of the Win32 API. (Citation: Wikipedia Windows Library Files)\n\nThe module loader can load DLLs:\n\n* via specification of the (fully-qualified or relative) DLL pathname in the IMPORT directory;\n \n* via EXPORT forwarded to another DLL, specified with (fully-qualified or relative) pathname (but without extension);\n \n* via an NTFS junction or symlink program.exe.local with the fully-qualified or relative pathname of a directory containing the DLLs specified in the IMPORT directory or forwarded EXPORTs;\n \n* via <code>&#x3c;file name=\"filename.extension\" loadFrom=\"fully-qualified or relative pathname\"&#x3e;</code> in an embedded or external \"application manifest\". The file name refers to an entry in the IMPORT directory or a forwarded EXPORT.\n\nAdversaries can use this functionality as a way to execute arbitrary code on a system.",	© ESET 2014-2018
malware-ioc	misp_invisimole.json	"description": "The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like CreateProcess(), LoadLibrary(), etc. of the Win32 API. (Citation: Wikipedia Windows Library Files)\n\nThe module loader can load DLLs:\n\n* via specification of the (fully-qualified or relative) DLL pathname in the IMPORT directory;\n \n* via EXPORT forwarded to another DLL, specified with (fully-qualified or relative) pathname (but without extension);\n \n* via an NTFS junction or symlink program.exe.local with the fully-qualified or relative pathname of a directory containing the DLLs specified in the IMPORT directory or forwarded EXPORTs;\n \n* via <code>&#x3c;file name=\"filename.extension\" loadFrom=\"fully-qualified or relative pathname\"&#x3e;</code> in an embedded or external \"application manifest\". The file name refers to an entry in the IMPORT directory or a forwarded EXPORT.\n\nAdversaries can use this functionality as a way to execute arbitrary code on a system.",	© ESET 2014-2018
malware-ioc	rtm	ntdll.dll	© ESET 2014-2018
signature-base	apt_eqgrp.yar	$s2 = “Ntdll.dll” fullword ascii	CC BY-NC 4.0
signature-base	apt_poisonivy.yar	$s19 = “ntdll.dll” fullword ascii /* score: ‘-4675’ / / Goodware String - occured 4680 times */	CC BY-NC 4.0
signature-base	exploit_cve_2015_1674.yar	$s5 = “ntdll.dll” fullword ascii	CC BY-NC 4.0
signature-base	exploit_uac_elevators.yar	$l1 = “ntdll.dll” ascii	CC BY-NC 4.0

MIT License. Copyright (c) 2020-2021 Strontic.